Text

Final Rept, Technical Evaluation Rept on 'Submittal-Only' Review of Individual Plant Exam of External Events at Fort Calhoun Station
	ML20206M286
Person / Time
Site:	Fort Calhoun
Issue date:	03/31/1998
From:	Frank M, Kazarians M, Khatibrahbar; ENERGY RESEARCH GROUP, INC.
To:	; NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20206M239	List: ML20206M260; ML20206M286;
References
	CON-NRC-04-94-050, CON-NRC-4-94-50 ERI-NRC-96-502, NUDOCS 9905140236
	Download: ML20206M286 (71)
	v • d • e

-

ERl/NRC 96-502 e

TECHNICAL e/ALUATION REPORT ON THE l

" SUBMITTAL-ONLY" AEVIELU OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS l 1

AT FORT CALHOUN STATION l i

FINAL REPORT March 1998 Energy Research, Inc.

P.O. Box 2034 Rockville, Maryland 20847-2034 Work Performed Under the Auspices of the United States Nuclear Regulatory Commission Office of Nuclear Regulatory Research Washington, D.C. 20555 Contract No. 04-94-050 99< 140236 990500 **"""""'"

PDl ADOCK 05000285 P PDR

4 a I

, ERI/NRC 9G502 TECHNICAL EVALUATION REPORT ON THE "SUBMITTAleONLY" REVIEW OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS I l

AT FORT CALHOUN STATION l

l FINAL REPORT March 1998 M. Khatib-Rahbar Principal Investigator Authors:

l M. V. Frank 2. M. Kazarians8 , and R. T. Sewell 8 Energy Research, Inc.

l P.O. Box 2034 Rockville, Maryland 20847 Work Performed Under the Auspices of the United States Nuclear Regulatory Commission Office of Nuclear Regulatory Research Washington, D.C. 20555 Contract No. 04-94-050 3

Safety Factor Associates, Inc.,4401 Manchester Avenue, Suite 106, Encinitas, CA 92024 2

Kazarians & Associates,425 East Colorado Street, Suite 545, Glendale, CA 91205 8

Presently with EQE International,2942 Evergreen Parkway, Suite 302 Evergreen, CO 80439

. TABLE OF CONTENTS EXECUTIVE SUMM ARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v 4

PREFA CE . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x1

. ABBREVIATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xii 1 INTRODU CTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - 1 1.1 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I 1.2 Overview of the Licensee's IPEEE Process and Important Insights . . . . . . . . . . . 2 1.2.1 Seismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 i 1.2.2 Fire..............................................3 1.2.3 - HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 ]

1 1.3 Overview of Review Process and Activities . . . . . . . . . . . . . . . . . . . . . . . . . . 5 l 1.3.1 S eismic . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . 5 1.3.2 Fire..............................................7 1.3.3 H FO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

~2 CONTRACTOR REVIEW FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 l 2.1 S eismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1 2.1.1 Overview and Relevance of the Seismic IPEEE Process . . . . . . . . . . . . . 8 2.1.2 Logic Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1.3 Non. Seismic Failures and Human Actions . . . . . . . . . . . . . . . . . . . . . 9 2.1.4 S eismic Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . 10 ,

2.1.5 Structural Responses and Component Demands . . . . . . . . . . . . . . . . . 10

{

2.1.6 Screening Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 l 2.1.7 Plant Walkdown Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.1.8 Evaluation of Outliers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 l 2.1.9 Relay Chatter Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I'3 2.1.10 Soil Failure Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.1.11 Containment Performance Analysis . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.1.12 Seismic-Fire Interaction and Seismically Induced Flood Evaluations . . . . 14 2.1.13 Treatment of USI A-45 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 2.1.14 Other Safety lssues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 2.I.15 Peer Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.1.16 Summary Evaluation of Key Insights . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2 Fire..................................................17 2.2.1 Overview and Relevance of the Fire IPEEE Process . . . . . . . . . . . . . . 17 2.2.2 Review of Plant Information and Walkdown . . . . . . . . . . . . . . . . . . . 18 2.2.3 Fire-Induced Initiating Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.2.4 Screening of Fire Zones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 2.2.5 Fire Hazard Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.2.6 Fire Growth and Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.2.7 Evaluation of Component Fragilities and Failure Modes . . . . . . . . . . . 22 2.2.8 Fire Detection and Suppression . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2.2.9 Analysis of Plant Systems and Sequences . . . . . . . . . . . . . . . . . . . . . 22 Energy Research, Inc. 11 ERI/NRC 96-502

- . . . _ ~ . - _ . _ .

7 _ . . _ -

. 2.2.10 Fire Scenarios and Core Damage Frequency Evaluation . . . . . . . . . . . 23 2.2.11 Analysis of Containment Performance . . . . . . . . . . . . . . . . . . . . . . . 23 2.2.12 Treatment of Fire Risk Scoping Study Issues . . . . . . . . . . . . . . . . . . 24 2.2.13 U SI A-45 1ssue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 2.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 2.3.1 High Winds and Tornadoes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 2.3.1.1 General Methodology . . . . . . . . . . . . . . . . . . . . . . . 25 2.3.1.2 Plant-Specific Hazard Data and Licensing Basis . . . . . . 26 2.3.1.3 Significant Changes Since Issuance of the Operating License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.3.1.4 Significant Findings and Plant-Unique Features . . . . . . 26 '

2.3.1.5 Hazard Frequency and Probabilistic Bounding Analysis . 27 2.3.2 External Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.3.2.1 General Methodology . . . . . . . . . . . . . . . . . . . . . . . 27 2.3.2.2 Plant-Specific Hazard Data and Licensing Basis . . . . . . 28 2.3.2.3 Significant Changes Since Issuance of the Operating License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 2.3.2.4 Significant Findings and Plant-Unique Features ...... 28 #

2.3.2.5 Hazard Frequency and Probabilistic Bounding Analysis . 28 2.3.3 Transportation and Nearby Facility Accidents . . . . . . . . . . . . . . . . . . 29 2.3.3.1 General Methodology . . . . . . . . . . . . . . . . . . . . . . . 29 2.3.3.2 Plant-Specific Hazard Data and Licensing Basis . . . . . . 30 2.3.3.3 Significant Changes Since Issuance of the Operating License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 2.3.3.4 Significant Findings and Plant-Unique Features . . . . . . 30 -

2.3.3.5 Hazard Frequency and Probabilistic Bounding Analysis . 30 2.4 - Generic Safety Issues (GSI-147, GSI-148, GSI-156 and GSI-172) .......... 31 2.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control Panel Interaction" . 31 2.4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" . . . . 31 2.4.3 GSI-156, " Systematic Evaluatyn Program (SEP)" . . . . . . . . . . . . . . . 31 2.4.4 GSI-172, " Multiple System Re.ponses Program (MSRP)" . . . . . . . . . . 35 3 OVERALL EVALUATION AND CONCLUSIONS . . . . . . . . . . . . . . . . . . . . . . . . 40 3.1 Seismi c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 3.2 Fire..................................................42 3.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 3 4 IPEEE INSIGHTS, IMPROVEMENTS, AND COMMITMENTS . . . . . . . . . . . . . . . 44 4.1 Seismic . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 4.2 Fire..................................................44 4.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 5 IPEEE EVALUATION AND DATA

SUMMARY

SHEETS . . . . . . . . . . . . . . . . . . . 50 6 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 ,

Energy Research, Inc. iii ERI/NRC 96-502

_ . . _ _ ._~

. LIST OF TABLES Table 4.1 Summary of HCLPF-Limhing Failure Modes and Plant Modific:.tions . . . . . . . 47 Table 5.1 External Events Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Table 5.2 SMM Seismic Fragility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Table 5.3 PWR Accident Sequence Overview Table - For SMM Only . . . . . . . . . . . . . . 53 Table 5.4 PWR Accident Sequerice Overview Table - For Fire PRA Only . . . . . . . . . . . . 54 Table 5.5 PWR Accident Sequence Detailed Table - For Fire PRA Only . . . . . . . . . . . . . 55 l

l Energy Research, Inc. iv ERI/NRC 96-502 t

i

EXECUTIVE

SUMMARY

This technical evaluation report (TER) documents a " submittal-only" review of the individual plant examination of external events (IPEEE) conducted for the Fort Calhoun Station (FCS). This technical evaluation review was performed by Energy Research, Inc. (ERI) on behalf of the U.S. Nuclear Regulatory Commission (NRC). The submittal-only review process consists of de following tasks:

e' Examine and evaluate the licensee's IPEEE submittal and directly relevant available documentation.

Develop requests for additional information (RAIs) to supplement or clarify the licensee's IPEEE l submittal, as necessary.

Examine and evaluate the licensee's responses to RAIs.

1 Conduct a final assessment of the strengths and weaknesses of the IPEEE subminal, and develop I review conclusions. l l

This TER documents ERI's qualitative assessment of the FCS IPEEE submittal, particularly with respect to the objectives described in Generic Letter (GL) 88-20, Supplement No. 4, and the guidance presented in NUREG-1407.-

Fort Calhoun Station is owned and operated by the Omaha Public Power District (OPPD). The FCS l IPEEE submittal considers seismic; fire; and high winds, floods and other (HFO) external initiating events.

l The licensee's IPEEE was performed predominantly by a team of licensee staff. ;

1 Licensee's IPEEE Proceu i For the seismic portion of the IPEEE, OPPD used the NRC's seismic margin assessment (SMA) methodology, as documented in NUREG/CR-4334, with supplemental technology coming from EPRI-NP 6041 in the areas of response spectrum scaling, soil failure determination, and component screening guidance. The key to the implementation of the method was an iterative determination of the plant high- ,

confidence of low-probability of failure (HCLPF) capacity, over successively higher earthquake levels. '

It is this process that allowed seismic weaknesses to be identified, and that formed the technical basis for scheduled plant modifications. A major assumption in the evaluation had an interesting effect on the emphasis of the seismic study. The study's logic model for determining the plant HCLPF capacity assumed that offsite power and instrument air are unavailable (with probability of unity) regardless of earthquake level. Thus, by implication, potential success paths having to do with use of the power conversion system (PCS) and closed-loop shutdown cooling mode of the residual heat removal (RHR) system are also unavailable. As a result of this implication, the licensee's efforts focused on improving '

the seismic margin of systems / equipment that were included in the logic models, namely, high-pressure injection, long-term cooling with the auxQry feedwater system, and motor control centers (MCCs). The licensee used the SMA as a means of identifying potential seismic weaknesses at the plant. After identifying potential weaknesses, the licensee either performed additional analyses to discover seismic margin that was not apparent from screening assessments, or scheduled plant modifications that were deemed cost-effective. Based on the process of successive evaluations at increasing levels of ground '

Energy Research, Inc. v ERI/NRC 96-502 I

,, -um- -,

.+w-ny-..g.1% e -- --*-w---=+m-+p-m*~- an - **e-* *

l

. motion, the licensee developed useful insights into the governing component failures as a function of ground motion.-

The IPEEE fire analysis was based on a fire probabilistic risk assessment (PRA) methodology prescribed in a draft version (1994) of an Electric Power Research Institute (EPRI) guidebook '(Mrc PRA Implementation Gdde). The methodology, similar to other fire analysis techniques, involved a graduated focus on the most important fire zones, using qualitative and aantitative screening criteria. The fire zones were subjected te at least two screening stages. In the first stage, a zone was screened out if it did not 4

contain safety-related equipment. In the later stages, a core damage frequency (CDF) of 10 per reactor-year (ry), or a conditional core damage probability of 10'8, were used as screening criteria. The plant information gathered for Appendix R compliance was used extensively in the fire PRA. In addition to Appendix R safe shutdown systems, the licensee traced the location of cables for offsite power. The individual plant examination (IPE) model was used to establish the possibility of experiencing core damage from a fire event. The' conditional core damage probability was based on the equipment and systems unaffected by the fire. The unconditional core damage frequency was obtained by multiplying the frequency of a fire in a fire zone by the conditional core damage probability for that fire zone. For fire occurrence frequencies of specific fire zones, a database developed by EPRI (NSAC 178L) was employed, which is commensurate with the data provided in the fire-induced vulnerability evaluation (FIVE) methodology (EPRI TR-100370). The fire frequencies were adapted to specific fire compartments using weighting factors based on the type and number of components in a compartment. For fire propagation, the formulations provided in the draft EPRI guidebook and in FIVE methodology were used. A heat loss factor, for modeling the heat generated from a fire, of 0.85 was used instead of the value of 0.7 approved by the NRC in the context of FIVE formulations. This difference may lead to some optimism in the results, particularly in the hot gas layer severity for computations related to fire compartment interaction analysis (FCIA). The human actions considered in the IPE plant model were included in the fire impact assessment. The human error probabilities were also modified to take into account the additional stress that could be caused by the occurrence of a fire. In addition to the core damage frequency, containment failure probabilities and radionuclide exposure possibilities at different distances from the power plant were considered. To identify vulnerabilities, a set of closure criteria based on the NEI 91-04 document were adopted. The criteria are based on the overall core damage frequency or containment failure frequency, j and on percent contributions to the overall frequencies. l For HFO initiators, the licensee used screening assessments based on comparisons of plant design bases to the 1975 Standard Review Plan (SRP). Because FCS is not a plant originally licensed under the 1975 SRP, the licensee also used deterministic bounding and simplified probabilistic bounding analyses to demonstrate that risks associated with HFO events are low. In general, the methodology followed the guidance of NUREG/CR-2300 and NUREG-1407.

Key IPEEE Mndings The FCS seismic IPEEE findings include:

1. An overall plant HCLPF capacity of 0.25g is controlled by liquefaction of soil outside the region beneath seismic Category-I buildings. Failures, owing to liquefaction, that affect core damage scenarios include: loss of diesel generator fuel oil storage tanks, and loss of raw water system ,

piping between buildings.

Energy Research, Inc. vi ERI/NRC 96-502

r J.

. 2. In the absence ofliquefaction, the plant HCLPF capacity would be dominated by failure of MCC anchorages (at 0.273 ) and failure of raw water system (RWS) pump anchorages (at 0.29g).

1

3. . Operator action to ensure long-term core heat removal appears in seismic sequences in which short-term cooling is successful.

4. The conditional large early release probability given core damage was found to be about 1%,

indicating low vulnerability to earthquake scenarios' .

The licensee has highlighted the conservative nature of the SMA approach it has employed.

From the fire IPEEE, the licensee has concluded that there are no significant fire vulnerabilities at FCS.

However, the licensee has adopted two procedural changes as a result of the fire analysis. Despite the assumption that all cables and equipment are damaged in a fire area, no single fire area, as defined in this study, can cause core damage. Other failures in other areas are required to do so. The licensee has concluded that there is no credible fire that can propagate from one fire area to another. The overall fire 4

CDF, before the implementation of the procedural changes, was found to be 9.25 x 10 /ry. This value is commensurate with fire PRA results obtained for other similar plants. After the implementation of the -

procedural changes, the licensee has concluded that the fire CDF drops to 2.74 x 104/ry. The dominant fire scenarios include the control room and the east basement of the auxiliary building. The dominant core damage scenarios consist of delayed damage, where the recirculation function has failed. Stuck-open power operated relief valve (PORV) and interfacing system loss of coolant accident (ISLOCA) were found to be the dominant contributors before implementing the changes in procedures that safeguard against the failures of the valves that lead to these events. Similar insights were obtained when the containment failure modes were examined. The relative risk ranking of the fire areas was based on plant damage states or radionuclide exposure possibilities at different distances from the power plant.

For HFO initiators, the floodmg assessment included both periodic (precipitation-driven) floods and dam-break floods. Initial results from probabilistic bounding analyses for dam-break floods provided the l licensee incentive to modify procedures in AOP-1, Act of Nature. After procedural improvements, the !

4 CDF for the dam-break-induced flood was estimated to be 6 x 10 /ry, and the CDF estimated for periodic flooding was 3 x 104 /ry. For transportation and nearby facility hazards, the licensee screened out all such events, on the basis of: (1) low CDF for toxic material releases; (2) no potential to damage the plant (for explosions and fires); or (3) low CDF for vapor explosions associated with on-site rupture of a rail tanker containing gasoline. Aircraft crashes were screened out owing to: (1) the combination of distance and traffic of nearby airfields; and (2) a low frequency of crashes owing to overflights. A screening analysis, starting with the hazards listed in NUREG/CR-2300, demonstrated that no other potential initiators are significant for FCS.

Generic Issues and Unresolved Safety Issues (USI)

Seismic system interaction issues, concerning USI A-17, were explicitly considered during the walkdown by development of spatial interaction tables and inclusion of interactions into the plant logic models. The equipment list, SMA capacity evaluations, and logic models, addressed the remaining USI A-40 issue !

regarding the adequacy of tanks. Where tanks have limited the plant HCLPF capacity, component , 1 enhancements have been scheduled (e.g., pre-tension of straps on the diesel generator start air receivers),

more detailed analysis has been performed to discover increased margin (e.g., RWS heat exchangers), or Energy Research, Inc. vil ERI/NRC 96-502

j s

. . plant upgrades have been' scheduled (e.g., tie-in of the RWS to the emergency feedwater storage tank

[EFWST)). I 1

With respect to fire events, the generic issues raised in the Sandia fire risk scoping study (FRSS), USI A-45, and several other generic safety issues have been addressed in the licensee's IPEEE submittal. The '

majorny of these issues were addressed as part of the plant walkdowns conducted for the fire PRA. In the treatment of seismically induced fires, hydrogen piping, combustible oils, and flammable materials were identified as potential sources of fire during an earthquake. Special measures have been undertaken to l minimim the pessibility of such fires. The potential for seismically induced failuy af the fire suppression system has also been addressed. An analysis of fire suppression systems that contain water has led to ;

installation of pipe supports and spray shields to protect safety-related equipment that were deemed to be l

W; Related to this issue, an analysis of the possibility ofinadvertent fire suppression activation as '

a result of an earthquake had already been addressed in a separate study. The final results of that study have been summarized in the IPEEE. From the summary it can be concluded that there are no areas in the plant where inadvertent suppression system actuation can cause safety-related equipment failure. The adequacy of fire barriers was also addressed in the licensee's treatment of FRSS issues. The special inspection and maintenance procedures utilized by FCS personnel minimizes the possibility of barrier failure. Manual fire fighting was not credited in the fire PRA, except in the case of control room fires.

However, the plant maintains a fire brigade which is subjected to training and drills. The issue of equipment survival under all adverse phenomena caused by a fire has been addressed explicitly in three parts: combustion products, spurious actuation of a fire suppression system, and operator actions. The fire PRA has quarnitatively addressed operator actions and equipment and cable failures; the other issues have been addressed qualitatively. USI A-45 addresses the possibility of decay heat removal under all -

conditions. The fire PRA has concluded that there are no fire scenarios for which the conditional core damage probability is equal to one. That is, a path for decay heat removal remains unaffected by the fire for all fire scenarios considered in the fire PRA.

For HFO events, the licensee addressed Generic Issue (GI) 103, paiadeg to effects of probable maximum l precipitation. This issue was treated satisfactorily in the submittal. I Some information is also provided in the Fort Calhoun IPEEE submittal which pertains to generic safety i issue (GSI)-147, GSI-148, GSI-156, and GSI-172.

Vulnerabilities and Plant Improvements in the seismic IPEEE, as the dominant contributors were identified (during an iterative analysis of plant HCLPF capacity), either a more detailed capacity evaluation was made using the conservative deterministic failure margin (CDFM) method, or plant modifications were scheduled. If either action resulted in ;

increasing the estimated HCLPF capacity of the contributor to above 0.3g, then no further work was performed for that contributor. In some cases, modifications were cost prohibitive. These cases were:

(1) modification to ameliorate the effects ofliquefaction; (2) enhancements of anchorages for certain MCCs to increase the HCLPF capacity beyond 0.27g; and (3) upgrades to anchorages of raw water system pumps, all of which have HCLPF capacities less than 0.3g. These conditions, therefore, became the controlling contributors to the plant HCLPF capacity. The key modifications implemented by the licensee to increase the plant HCLPF capacity are summarized as follows: replacement of bad actor relays in the ,

diesel generator lockout circuitry; repair or improvement of anchorages of MCCs particularly related to wwyers cooling water system (CCS) operation; and raw water system tie-in to the EFWST. The key Energy Research, Inc. vill ERI/NRC 96-502

m

, detailed SMA capacity evaluations were those for valves in the safety injection system. Analyses to

' demonstrate that room heatup is not a problem for MCCs, upon failure of heating ventilation and air wr Mu'ri (HVAC) fan units, were also considered essential to the effort. A more-detailed explanation of seismic-related plant upgrades is provided in Table 4.1 of this TER.

Based on the fire analysis, the licensee has concluded that there are no fire vulnerabilities at FCS. The licensee has adopted procedural modifications that reduce the fire risk. These modifications are focused on PORV and primary / secondary isolation valve de-energization to minimite the likelihood of stuck-open PORVs and ISLOCAs. The dominant fire scenarios have been found to be a fire in the control room and a fire in the east basement of the auxiliary building. The turbine building and one of the electrical penetration areas are the next two significant fire areas. The dominant sequences caused by a fire in these areas leading to core damage, include: failure of the PORV in the open position, and failure of the recirculation function (delayed core damage); a transient where long-term cooling is lost due to random and fire-induced failures (delayed core damage); and failure of the PORV in the open position, and failure of reactor coolant system (RCS) inventory control (early core damage). To further reduce the risk of a fire affecting plant safety, the licensee is in the process of developing a severe accident management 4

program where all fire scenarios that lead to core damage at a frequency above 10 /ry will be addressed.

With respect to HFO events, to reduce the CDF associated with flooding (due to periodic floods and dam-break floods), the licensee has proposed to modify procedures in AOP-1, Act of Nature. Proposed ,

mitiga:ive action includes staging four portable pumps that could draw flood water into either the EFWST or the steam generators. The procedures also include actions to close flood doors, close flood gates, sandbag, and build temporary levees. De submittal states that these actions can retard the ingress of water such that plant shutdown is possible for a water level up to 9.5 feet above grade. Beyond this level, there is no effective manne of preventing core damage. Two conduits, one entering the auxiliary building and one entering the intake structure, have also been plugged to stop potential flood paths. The submittal notes i that the plant vicinity would be flooded approximately 2.6 days after the dam-break scenario. A peak flood elevation of 25 feet above grade would occur about 3.9 days after the original dam failure. About 34 hours3.935185e-4 days 0.00944 hours 5.621693e-5 weeks 1.2937e-5 months notice would be provided for periodic floods. After the proposed improvements, the CDF for 4

the dam-break-induced flood was estimated to be 6x10 /ry, and the CDF estimated for periodic flooding was 3 x104/ry.

Observations i

The FCS seismic IPEEE study appears to be a thorough and technically robust implementation of the NRC's SMA methodology, as documented in NUREG/CR-4334, with supplemental technology coming from EPRI-NP 6041 in the areas of response spectrum scaling, soil failure determination, and component screening guidance. De study took advantage of the coincidence of effort with the USI A-46 evaluation, by performing a combined set of walkdowns. A particularly impressive aspect of the seismic IPEEE was the manner in which the plant HCLPF capacity determination was used to identify and correct potential seismic weaknesses at the plant, An extensive set of plant modifications, arising from correction of USI A 46 outliers and from limiting core damage sequences, was documented in the submittal. Insights with respect to the importance of operator actions to ensure long-term heat removal via refilling the EFWST, and the lack of insights regarding the RHR system and offsite power, are artifacts of the assumption that both offsite power and instrument air are lost for any earthquake. This is because loss of instrument air .

fails the RHR system's shutdown decay heat removal function. The licensee's staff was actively involved in the seismic IPEEE study, and a competent peer review was undertaken. The submittal is sufficiently Energy Research, Inc. ix ERI/NRC 96-502 1, .

; complete to provide confidence that the guidance of NUREG-1407 was followed with respect to seismic margin methodology. The overall approach appears robust with respect to the intent of GL 88-20, Supplement 4. ,

From the fire IPEEE, the licensee has gained experience from the exercise of inspecting every part of the plant for potential fire vulnerabilities. The licensee's engineers, it can be safely claimed, have gained an understanding of how the plant would behave under different fire conditions, and when human actions will be necessary to protect the plant from adverse consequences. Overall, notwithstanding some optimistic practices adopted by the licensee, the results are deemed to be reasonable and within the range expected for plants having similar characteristics. Aside from two items identified in this review, the licensee has employed proper methodology and data. A thorough effort in the analyses of the different issues anxi phenomena has been W: The following two practices are those deemed to have yielded optimistic results: first, in the screening stage of the analysis, fire zones or electrical panels that may contain safe shutdown circuits, but may not lead to a reactor trip, have been screened out; and second, the heat loss factor for fire propagation analysis was taken to be 0.85, as opposed to 0.7 (the value accepted by the NRC in the context of FIVE methodology),

i For the HFO assessment, the licensee used deterministic bounding and simplified probabilistic bounding analyses to supplement comparisons of the plant design basis with the 1975 SRP, in order to demonstrate that risks associated with HFO events are low. This approach was used because FCS was not originally licensed under the 1975 SRP. The present review has found the assessment of HFO events to be in concert with the procedures and intent of NUREG-1407 and GL 88-20, Supplement 4. Overall, the deterministic and probabilistic boundmg analyses have been effectively executed. In addition, the licensee has instituted plant and procedural changes to improve the plant's response to flooding scenarios.

I Energy Resear-h. Inc. x ERI/NRC 96-502

}

PREFACE The Energy Research, Inc., team members responsible for the present IPEEE review documented herein, include: .

Selimic M. V. Frank, Primary Reviewer R. T. Sewell, Secondary Reviewer Btt M. Kazarians High Winds. Floods and Other Erternni Events M. V. Frank Review Oversight. Coordination and Inteoration M. Khatib-Rahbar, Principal Investigator A. S. Kuritzky, IPEEE Review Coordination R. T. Sewell and M. V. Frank, Repon Integration Dr. John Lambright, of Lambright Technical Associates, contributed to the preparation of Se' ction 2.4 following the completion of the draft version of this TER.

This work was performed under the auspices of the United States Nuclear Regulatory Commission, Office of Nuclear Regulatory Research. The continued technical guidance and support of various NRC staff is acknowledged.

Energy Research, Inc. xi ERI/NRC 96-502 l

l _-

u

)

l

+

ABBREVIATIONS i

' AC Alternating Current AFW ' Auxiliary.Feedwater AOP. Abnormal Operating Procedure ASCM Alternate Seismic Criteria and Methodology ATWT Anticipated Transient Without Trip CCS- Component Cooling System CCW Component Cooling Water CDF Core Damage Frequency j CDFM Conservative Deterministic Failure Margin l CST Condensate Storage Tank j DG Diesel Generator EFW. Emergency Feedwater EFWST Emergency feedwater Storage Tank EPRI Electric Power Research Institute ERI Energy Research, Inc. I FCIA Fire Compartment Interaction Analysis !

FCS Fort Calhoun Station i FIVE Fire-Induced Vulnerability Evaluation ;

FRSS Fire Risk Scoping Study l FW Feedwater GI Generic Issue:

' GIP Generic Implementation Procedure GL Generic Letter GSI Generic Safety Issue HCLPF High Confidence of Low Probability of Failure HCV Hydraulic Control Valve HEP Human Error Probabilities HFO . High Winds, Floods, and Other HPSI ' High Pressure Safety Injection HVAC Heating, Ventilation and Air Conditioning HX Heat Exchanger IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events ISLOCA Interfacing Systems Loss of Coolant Accident LLNL Lawrence Livermore National Laboratory LOCA Loss of Coolant Accident LOSP I.oss of Station Power LPG Liquid Petroleum Gas MCC Motor Control Center .

NRC Nuclear Regulatory Commission NSAC Nuclear Safety Analysis Center NSSS' Nuclear Steam Supply System OBE Operating Basis Earthquake ,

OL Operating License OPPD Omaha Public Power District Energy Research, Inc. xil ERI/NRC 96-502

. PCS Power Conversion System PDS Plant Damage State PGA Peak Ground Acceleration PMP Probable Maximum Precipitation PORY Power-Operated Relief Valve PRA Probabilistic Risk Assessment PWR Pressurized Water Reactor RAI Request for AdditionalInformation RCP Reactor Coolant Pump RCS Reactor Coolant System RHR Residual Heat Removal RLE Review Level Earthquake RWS Raw Water System +

SEWS Screening and Evaluation Worksheet J SMA Seismic Margin Analysis i SME Seismic Margin Earthquake l SRP Standard Review Plan i SRT Seismic Review Team SSE Safe Shutdown Earthquake l TER Technical Evaluation Report 1 USI - Unresolved Safety Issue l

l l

Energy Research, Inc. xill ERI/NRC 96-502

l

,- 1 INTRODUCTION' .

This technical evaluation report (TER) documents the results of the ' submittal only" review of the l individual plant examination of external events (IPEEE) for the Fort Calhoun Station (FCS) [1]. This l technical evaluation review, conducted by Energy Research, Inc. (ERI), has considered various external '

initiators, including seismic events; fires; and high winds, floods, and other (HFO) external events.

1 The U.S. Nuclear Regulatory Commission (NRC) objective for this review is to determine the extent to l

which the IPEEE process used by the licensee, Omaha Public Power District (OPPD), meets the intent of l

Generic Letter (GL) 88-20, Supplement No. 4 [2]. Insights gained from the ERI review of the IPEEE i submittal are intended to provide a reliable perspective that assists in making such a determination. This review involves a qualitative evaluation of the licensee's IPEEE submittal, development of requests for additional information (RAls), evaluation of the licensee responses to these RAIs, and finalization of this TER.

l The emphasis of this review is on describing the strengths and weaknesses of the IPEEE submittal, particularly in reference to the guidelines established in NUREG-1407 [3]. Numerical results are verified for reasonableness, not for accuracy; however, when encountered, numerical inconsistencies are reported.

This TER complies with the requirements of NRC's contractor task order for an IPEEE submittal-only l review. '

l The remainder of this section of the TER describes the plant configuration and presents an overview of the licensee's IPEEE process and insights, as well as the review process employed for evaluation of the seismic, fire, and HFO events sections of the FCS IPEEE. Sections 2.1 to 2.3 of this report present ERI's findings related to the seismic, fire, and HFO reviews, respectively. Sections 3.1 to 3.3 summarize ERI's conclusions and recommendations from the seismic, fire, and HFO reviews, respectively. Section 4 summarizes the IPEEE insights, improvements, and licensee commitments. Section 5 includes completed IPEEE data summary and entry sheets. Finally, Section 6 provides a list of references.

1.1 Plant Characterization Fort Calhoun Station is a single-unit nuclear power plant located on the west bank of the Missouri River, approximately 19 miles north of Omaha, Nebraska. The plant produces 501 MWe from a Combustion Engineering two-loop nuclear steam supply system (NSSS).. The plant began commercial operation in September 1973.

The plant's safe Shutdown earthquake (SSE) has a peak ground acceleration (PGA) of 0.17g, and the review-level earthquake (RLE), from NUREG-1407, is 0.3g PGA. FCS is a plant addressed within the scope of Unresolved Safety Issue (USI) A-46. FCS is a soil site, with buildings supported by pipe piles extending through about 65 to 75 feet of sandy soil to underlying bedrock. The soil around and beneath seismic Category-I buildings was sufficiently compacted to prevent liquefaction for SSE stresses. The site soil was compacted to a relative density of 85 % under Category-I structures, and has a relative density that averages about 62% elsewhere. Seismic Category-I buildings considered in the seismic IPEEE analysis include the comainment, auxiliary building, and intake structure. The containment and auxiliary building are supported by the same hW basemat. Other buildings also considered in the IPEEE include the .

service / turbine building and the technical support center.

Energy Research, Inc. 1 ERI/NRC 96-502

- _ - _ - , ~ . _ __ ..,

.; Engineered safeguards, emergency diesel generators, the control room, and the cable spreading room are all located within the auxiliary building. The turbine / service building contains balance-of plant related

- equipment and systems. h also contains a diesel-driven auxiliary feedwater pump. The IPEEE submittal does not provide any information regarding variances from Appendix R requirements.

The plant site is located within Region I for purposes of wind criteria. The plant is downstream of six major dams on the Missouri River system extending into South Dakota, Nonh Dakota, and Montana. The area adjoining the plant is sparsely populated farmland, and the nearest industrial facilities are more than a mile away.

1.2 (h&c of the fleenema's IPFFF Prncean and Irnaartant Inelehts 1.2.1 Seismic The licensee performed a focused-scope NRC seismic margins analysis, consistent with NUREG/CR-4334

[4], using a seismic margin earthquake (SME) of 0.3g peak ground acceleration (PGA). Fon Calhoun Station is also a USI A-46 plant, and the IPEEE seismic walkdowns were performed in conjunction with the USI A 46 walkdown; significant information was shared between the two programs. The licensee's staff performed the IPEEE/USI A 46 assessment, with assistance from SAIC, RPK Structural Mechanics, Sargent and Lundy, and Stevenson & Associates.

An equipment list of approximately 680 items was derived from the individual plant examination (IPE) fault tree basic events and from the identification of relevant plant structures. A walkdown was performed in conjunction with USI A 46, to identify areas of concern, screen out equipment, and identify spatial .

interactions. The walkdown teams used a total of six seismic capability engineers who were trained in -l' Generic Implementation Procedure (GIP) requirements.

Structures and components were screened out using Tables 2-3 and 2-4 of EPRI-NP-6041-SL, Rev.1 [5].-

Those components or structures found to limit the plant high confidence oflow probability of failure (HCLPF) capacity were evaluated using the conservative deterministic failure margin (CDFM) method.

Among the equipment list items, all but 91 components were screened out at the level of 0.5g PGA. These 91 components were included in the plant logic model. Development of structural responses and component demands used methods outlined in NUREG/CR 4334 and EPRI NP-6041 [6], as well as the guidance of NUREG 1407. De IPEEE in-structure response spectra were developed by linear scaling of design-basis in-structure spectra, in accordance with ratios of the NUREG/CR 0098 median ground response soil spectrum (having 0.3g PGA) to the SSE ground response spectrum (having 0.17g PGA).

Using two methods from Appendix C of Reference [5], Sargent and Lundy performed a soil liquefaction analysis for the soil under seismic Category-I strucmres and for the soil elsewhere. The calculated HCLPF capacity for soil under seismic Category-I buildings was 0.35g or 0.4g PGA, depending on the method of analysis. Both methods of analysis yielded a calculated HCLPF capacity of 0.25g for soll at all other site locations.

A simplified IPE model, coupled with a seismic event tree, formed the basis of the seismic plant logic model. De seismic event tree included major failure events, such as: liquefaction, containment building failure, auxiliary building failure, and reactor vessel failure. The IPE model, which used the fault tree '

linking methodology, was modified by adding component seismic failure mode frequencies to the random Energy Research, Inc. 2 ERI/NRC 96-502

_ __ _ _ _ - _ _, , m _

, failure mode frequencies, for unscreened components, at the basic event level. Human actions were also

. included in the logic model. IJoteworthy is the fact that the fault trees included addition of spatial interaction failures and seismically induced functional dependency failures.

Since the USI A-46 study found six low ruggedness relays (all in the diesel generator lockout circuitry),

a bad actor relay assessment was performed for IPEEE only equipment, in accordance with NUREG-1407 focusai-scope procedural guidance.

T The determination of plant HCLPF capacity involved an iterative process over successively higher earthquake levels. It is this process that allowed seismic weaknesses to be identified, and formed the technical basis for scheduled plant modifications. Table 4.1 su:nmarizes the actions taken by the licensee for the dominant contributors. Initial assessment of the plant HCLPF capacity used the preliminary capacities obtained from the plant walkdown and alternate seismic criteria and methodology (ASCM) assessments. As the dommant contributors were identified, either a more detailed capacity evaluation was made using the CDFM method, or plant modifications were scheduled. If either action resulted in increasing the estimated HCLPF capacity of the contributor to above 0.3g, then no additional work was performed for that contributor. In some cases, plant modifications were cost prohibitive.

The overall plant HCLPF capacity of 0.25g is controlled by soil liquefaction outside the zone which underlies seismic Category-I buildings. Failures, owing to liquefaction, that can initiate core damage scenarios include: loss of diesel generator fuel oil storage tanks, and loss of the raw water system (RWS) piping between buildings. The primary core damage scenario owing to liquefaction damage is a reactor coolant pump (RCP) seal loss of coolant accident (LOCA), with loss of high pressure injection when the diesels run out of fuel (in aSut 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ). Another insight from the seismic IPEEE was the recognition that operator actions to ens a long-term core heat removal appear in essentially every seismic sequence in which short-term cooling is succesful ne dominant core damage sequence at 0.2g PGA, and above, is a transient with loss oflong-term cooling, owing to seismic failure of the condensate storage tank (CST),

which is used to refill the emergency feodwater storage tank (EFWST). Cutset importance rankings, which were presented only for 0.4g PGA, revealed that the most important cutsets involve failure of the turbine building. Finally, the conditional large early release probability, given core damage, was found to be about 1 %, indicating low vulnerability for earthquake scenarios.

In the absence ofliquefaction, the plant HCLPF capacity would be dominated by failure of motor control centers (MCCs) at 0.27g PGA, and failure of RWS pumps at 0.29g PGA.

The key plant modifications to be performed as a result of the USI A-46/ seismic IPEEE effort include:

repla:ement of bad actor relays in the diesel generator lockout circuitry; repair or improvement of anchorages of MCCs particularly related to component cooling water system (CCS) operation; and raw water system tie-in to the EFWST. The key detailed seismic margin assessment (SMA) capacity calcu'ations were those for valves in the safety injection system. Analyses to demonstrate that room heatup is not a problem for MCCs, upon failure of heating, ventilation, and air conditioning (HVAC) fan units, were also considered essential to the effort.

1.2.2 Fire The licensee has conducted an extensive and detailed fire analysis for Fort Calhoun Station. The licensee has used state-of-the-art methodology, as well as plant data from the Appendix R effort and other plant-Energy Research, Inc. 3 ERI/NRC 96-502

, ._ . . . ~ , . . - . - . ~ . - , ..

specific data sources, to conduct the fire analysis. Overall, the licensee has concluded that there are no significant fire vulnerabilities at FCS. However, the licensee has considered several plant improvements for implementation, based on the fire analysis, that will reduce the risk of fire events.

Fire probabilistic risk assessment (PRA) methodology has been used by the licensee. Although decisions regarding risk significance have been based on core damage frequency (CDF), containment failure modes and dosage measures have been quantified as well. The licensee has analyzed all the fire areas of the plant using a reasonable screening methodology. For fire propagation, the formulations provided in the fire-induced vulnerability evaluation (FIVE) methodology [7] and data from a draft version of an Electric Power Research Institute (EPRI) fire PRA guidebook [8] have been used. The licensee has concluded that propagation of fires across fire zones is very unisely.

The licensee has gained experience from the exercise of inspecting every part of the plant for potential fire vulnerabilities. he '!censee's engineers, it can be safely claimed, have gained an understanding of how the plant would behave under different fire condnions, and under what circumstances human actions would be ==~y to protect the plant from adverse consequences.

1.2.3 HFO Events The licensee used screening assessments based on comparisons of plant design ba:,es to the 1975 Standard Review Plan (SRP). Because FCS was not originally licensed under the 1975 SRP, the licensee also used deterministic boundmg and simplified probabilistic bounding analyses to demcastrate that risks associated with HFO events are low. In general, the licensee's methodology has followed the guidance in NUREG/CR-2300 [9] and Reference [3].

High winds were assessed using probabilistic bounding analysis that included the following elements: (1) tornado hazard analysis that estimated the frequency of various tornado intensities (as characterized by peak wind speed); (2) identification of plant vulnerabilities to tornadoes, and the categorization of potential damage into plant damage states; (3) determination of the conditional probability of occurrence of each plant damage state; (4) quantification of the conditional core damage probability using a loss of offsite power IPE event-tree / fault-tree model, modified to account for the plant damage states; and (5) development of the frequency of core damage for each tornado intensity and plant damage state, by use 4

of Equation 5.2 of the submittal. The frequency of tornado damage was found to be less than 10 per reactor-year (ry).

Two causes of floods at the site were considered. The first was periodic flooding of the Missouri River owing to heavy precipitation, and the second was dam breaks. The dam-break scenario was based on failure of the Oahe earthen dam, with assumed subsequent failures of three additional dams downstream of Oahe dam. De frequency of failure of this earthen dam had previously been assessed at 5 x104/yr.

The outcome of the eerber assessment was to modify procedures, plug two conduits that provided a flood

. path into the auxiliary building and intake rtructure, and stage four portable pumps. The procedures encompassed sand bagging, construction of temporary levees, and closing of flood doors and gates. The portable pumps provide a water source to the EFWST and steam generators, should a flood above the design basis occur. Considering the improved procedures and use of portable pumps, the CDF due to dam-break flooding was reduced to approximately 6x104 /ry. ,

)

Energy Research, Inc. 4 ERI/NRC 96-502

e A probabilistic bounding analysis was employed, as a function of flood level, using Army Corps of Engineers hazard c'ata for precipitation induced periodic flooding. Without improved procedures for j 4

sandbagging and flood gate / door closure, the CDF owing to periodic flooding was calculated at 2 x 10 /ry. I 4

After including the improvements, the CDP was calculated to be approximately 3 x 10 /ry. It is claimed i that sandbagging and flood gates can allow safe shutdown for a flood level up to 9.5 feet above grade.

The conditional core damage probability, given a flood above this level, is assmned to be unity.

The assessment of transportation and nearby facility accidents consisted of: (1) a survey to determine the status of such hazards or new facilities since the time the design basis of the pl:'nt was established; (2) assessment of whether or not potential accidents constitute a hazard to the plant; (3) an assessment of the accident frequency; and (4) an assessment of the CDF. Hazards included: aircraft crashes, toxic material releases, explosion, and delayed vapor cloud explosion and missile generation from a variety of sources within a five mile radius of the plant. Using the most lenient of two criteria (i.e., a 1-psi overpressure per Regulatory Guide 1.91, or 100 mph lead capability of structures), it was found that explosive hazards would not cause damage to the plant. The total frequency of toxic materials causing a loss of control room habitability was found to be approximately 3.v 104/yr, but the CDF was determined to be three orders of magnitude less. It was found that aircraft hazards meet the SRP screening criteria, and they were thus screened out.

In addition, a screening analysis was performed, staning with the list from NUREG/CR-2300, to determine if any other significant hazards could affect the plant. The screening analysis for all other events revealed no significant vulnerabilities for FCS.

1.3 Overview of Review Proceu and Activities In its qualitative review of the Fort Calhoun IPEEE, ERI focused on the study's completeness in reference to NUREG-1407 guidance; its ability to achieve the intent and objectives of GL 88-20, Supplement No.

4; its strengths and weaknesses with respect to the state-of-the-art; and the robustness of its conclusions.

This review did not emphasize confirmation of numerical accuracy of submittal results; however, any numerical errors that were obvious to the reviewers are noted in the review findings. The review process included the following major activities:

Completely examine the IPEEE and related documents

Develop a preliminary TER and RAls

Examine responses to the RAls

Finalize this TER and its findings Because these activities were performed in the context of a submittal-only review, ERI did not perform a site visit or an audit of either plant configuration or detailed supponing IPEEE analyses and data.

Consequently, it is imponant to note that the ERI review team did not verify whether or not the data presented in the IPEEE matches the actual conditions at the plant, and whether or not the programs or procedures described by the licensee have indeed been implemented at FCS.

1.3.1 Seismic In conducting the seismic review, ERI generally followed the emphasis and guidelines described in the repon, Individual Plant Examination ofExternal Events: Review Guidance (10), for review of an NRC Energy Research, Inc. 5 ERI/NRC %-502

SMA, and the guidance provided in the NRC report, IPEEE Step 1 Review Guidance Document [11], In addition, on the basis of the Fost Calhoun IPEEE submittal, ERI completed data entry tables developed in the Lawrence Livermore National Laboratory (LLNL) document entitled "IPEEE Database Data Entry Sheet Package" [12]. .

In its review of the Fort Calhoun seismic IPEEE, ERI examined the IPEEE submittal report [1] and the licensee's response to RAls [13]. The checklist of items identified in Reference [10] was generally consulted in conducting the seismic review. Rather than perform an independent set of calculations, the review team used its experience and comparisons of other plants and other seismic assessments, in order l to judge the accuracy and completeness of the information provided by the licensee. Some of the primary considerations in the seismic review have included (among others) the following items:

. Were appropriate walkdown procedures implemented, and was the valkdown effort sufficient to accomplish the objectives of the seismic IPEEE7

Was the plant logic analysis performed in a manner consistent with state-of-the-art practices?

Were random and human failures properly included in such analysis?

e Were component demands assessed in an appropriate manner, using valid seismic motion input and structural response modeling?

Were capacity calculations performed for a meaningful set of components, and are the capacity results reasonable?

Has the surrogate element been used in such a manner so as to not obscure dominant risk contributors and to produce a valid numerical estimate of CDF7

Was the approach to seismic risk quantification appropriate, and are the results meaningful?

e Does the subnuttal's discussion of qualitative assessments (e.g., containment performance analysis, ,

seismic-fire evaluation) reflect reasonable engineering judgment, and have all relevant concerns i been addressed?

Has the seismic IPEEE produced meaningful findings, has the licensee proposed valid plant improvements, and have all seismic risk outliers been addressed?

In some instances, quick calculations have been performed as part of the seismic review, in order to check the implications of various intermediate and final results. Special consideration was given to review of assumptions, because the results of many studies are unduly influenced by assumptions made to simplify

- or introduce conservatism. Data elements include equipment lists, hazard curves, fragilities, failure probabilities, system model structure, and basic events. Results include minimal cut sets, plant-level HCLPF capacity, core damage frequency, fractional contribution of cutsets, and containment-performance effects.

Energy Research, Inc. 6 ERI/NRC 96-502

.- 1.3.2. - Fire During this technical evaluation, ERI reviewed the fire events ponion of the IPEEE for completeness and consistency with past experience. This review was based on consideration of Sections 1,2,4, 6,7, and 8 of Reference [1], and on the licensee responses to fire-related RAIs [13 and 14]. The guidance provided in References [10 and 11] was used to formulate the review process and organization of this document.

The data entry sheets used in Section 5 have been completed in accordance with Reference [12]. ,

The process implemented for ERI's review of the fire IPEEE included an examination of the licensee's methodology, data, and results. ERI reviewed the methodology for consistency with currently accepted and state-of-the-an methods. The data element of a fire IPEEE includes, among others, such items as:

Cable routing a Fire zone / area partitioning

Fire occurrence frequencies

Event sequences

Fire detection and suppression capabilities For a few fire zones / areas that were deemed important, ERI also verified the logical development of the screening justifications / arguments (especially in the case of fire-zone screening) and the computations for fire occurrence frequencies and CDF. Rather than perform a completely independent set of calculations, however, the review team used its experience and comparisons of other plants and fire evaluation results, in order to judge the accuracy and completeness of the information provided by the licensee.

1.3.3 HFO Events The review process for HFO events closely followed the guidance provided in the report entitled IPEEE Step 1 ReWew Gddance Document [11]. This process involved examinations of the methodology, the data used, and the results and conclusions derived in the submittal. Sections 1,2,5, 6,7 and 8 of the IPEEE submittal [1], and licensee responses to RAls [13], were examined in this HFO events review. The IPEEE methodology was reviewed for consistency with currently accepted practices and NRC recommended procedures. Special attention was focused on evaluating the adequacy of data used to estimate the frequency of HFO events, and on confirming that any analysis of SRP conformance was appropriately executed. In addition, the validity of the licensee's conclusions, in consideration of the results reported in the IPEEE submittal, was assessed Also, bounding analysis and PRA results pertaining to frequencies of occurrence' of hazards and estimates of conditional probabilities of failure, were checked for reasonableness. Review team experience was relied upon to assess the validity of the licensee's evaluation.

Energy Research, Inc. 7 ERI/NRC 96-502 1

7 I CONTRACTOR REVIEW FINDINGS

, 2.1 Selands 7

- A summary of the licensee's seismic IPEEE process has been described in Section 1.2. Here, the licensee's seismic evaluation is examined in detail, and discussion is provided regarding significant

/ observations encountered in the present review.

2.1.1 Overview and Relevance of the Seismic IPEEE Process g

The study implemented the NRC seismic margin assessment (SMA) approach, as documented in NUREG/CR-4334, with supplemental technology coming from EPRI-NP 6041 in the areas of response spectrum scaling, soll failure determinations, and component screening guidance. The study took advantage of the coincidence of effort with the USI A-46 evaluation, by performing a combined set of walkdowns. An incremental determination of plant HCLPF capacity was used to identify and correct potential seismic weaknesses of the plant. An extensive set of plant modifications, arising from correction of USI A-46 outliers, and from limiting core damage sequences, was documented in the submittal. The licensee's staff was actively involved in the study, and a competent peer review was performed.

2.1.2 1.ogic Models A simplified IPE model, coupled with a seismic event tree, formed the basis of the seismic plant logic model. The IPE model, which used the CAFTA fault tree linking methodology, was modified by adding component seismic failure mode frequencies to the random failure mode frequencies for unscreened components. Screened components (i.e., those with a HCLPF capacity greater than 0.5g PGA) were grouped into a surrogate event, which was assigned a HCLPF capacity of 0.5g PGA. The surrogate event was found to not be a significant contributor to core damage. Although NUREG-4334 allows a simplified technique for the consideration oflate emergency core cooling, the FCS analysis included cooling in the recirculation phase within the logic model. A simplified containment event tree, that included the possibility of bypass or isolation failure, was also developed for the seismic inalysis. This approach is consistent with the philosophy of NUREG-1407, which emphasizes early laye releases.

The seismic event tree included major earthquake-caused failure events, such as: Jiquefaction, containment building failure, auxiliary building failure, and reactor vessel failure. It aho included events that determine whaber the plant response is governed by the demand of a small LOCA or is governed by the demand of a transient with loss of the power conversion system (PCS). The seismic event tree assumed core damage ifliquefaction occurs, the surrogate event occurs, or the reactor vessel fails. The likelihood of the occurrence of a <*iamin11y induced small LOCA was taken from NUREGICR 4840. The event tree omitted the im** structure, which houses the RWS pumps and certain fire pumps, without providing any explanation. The intake structure, however, has a HCLPF capacity greater than 0.3g, and would not be a significant CDF contributor. The auxiliary building, containment building (and internals), and occurrences of medium and large LOCAs were screened out, due to assessments of high capacity. The seismic event tree feeds into either a loss of offsite power event tree, or into a LOCA event tree accompanied by loss of offsite power. Screened-out components (i.e., those with a HCLPF capacity greater than 0.5g PGA) were grouped into a surrogate event in the seismic event tree, which was assigned -

a HCLPF capacity of 0.5g PGA.

Energy Research, Inc. 8 ERI/NRC 96-502

, A major simplification of the seismic logic model was achieved by assuming loss of offsite power and loss ofinstrument air for all seismic events. The assumption ofloss ofinstrument air causes all air-operated containment isolation valves to be assumed closed, fails closed-loop residual heat removal (RHR) shutdown cooling, and forces local manual operation of a main steam safety valve. The main steam safety valve is needed only upon failure of auxiliary feedwater, whereupon reactor coolant system (RCS) depressurization would be necessary.

The loss of offsite power and LOCA event trees treat failure of reactivity control, heat removal, inventory control, and long4erm cooling. Seal LOCAs and stuck-open relief valves were included in the event trees.

Although the assumption ofloss of offsite power would effectively preclude an anticipated transient without trip (ATWT), a failure to scram fault tree was included, which apparently modeled scram failure as if offsite power were available. Fault trees supporting the top events were modified by adding seismic

{

failure modes to the random failure modes of each component. Thus, seismic failure modes of motor

{

control centers (MCCs), block walls, and panels were added to the IPE fault tree event (s) that were l affected by the seismic failure. For example, the logic for the failure of a pump may be the logical union of the random failure of the pump, seismic failure of the associated MCC, and seismic failure of a nearby ;

block wall. The original IPE fault tree event identifier was retained to represent the summation of events.

All failure modes with t HCLPF capacity less than 0.5g PGA were included in the model. The event trees and the top few levels of the fault trees are provided in the submittal.

The process for development of the equipment list used for the walkdown and SMA screening investigation involved three successive refinements. The first list included all IPE fault tree events relevant to mitigation of a loss of offsite power. Many components were listed more than once because the fault trees often modeled more than one failure mode per component (e.g., valves may fail to change state or they may leak). A second list was developed that included each component with its plant location only once.

The third list recognized that some components behave as if they are in the same " box" (e.g., breakers within a panel). In such cases, the " box" was walked down and evaluated. This final equipment list for the walkdown comprised approximately 680 componer?.s or boxes.

2.1.3 Non-Seismic Failures and Human Actions Since seismic failures were added to the original IPE logic model, seismic failures, human actions, and internal event equipment failures were included in the seismic IPEEE. Pre-initiator human error probabilities (HEPs) were unchanged from the internal event values. 'lhe seismic effect on post initiator HEPs was approximated by assuming: (1) an HEP of unity for motion levels above 0.5g PGA; (2) an HEP of twice the internal event value for motion levels between the SSE (0.17g PGA) and 0.5g PGA; and (3) an HEP unchanged from the internal event value for ground motions less than the SSE. These values were assigned on the basis of judgment of the analysts and peer reviewers. The study found that the most j important human actiotiwas initiation of long-term EFWST make-up. This finding is an artifact of the !

assumption of loss of instrument air and unrecoverable loss of offsite power. This assumption assures i failure of the PCS and die shutdown decay heat removal mode of the RHR system, and leaves only one j option for long-term steam generator cooling (i.e., the auxiliary feedwater system with refill of the '

EFWST). Should thi path fail, feed-and-bleed cooling can be initiated. Table 3.9 of the submittal ;

provides a summary of Laman actions used in the analysis. Operator initiation of feed and bleed did not emerge as an hr.p06-4 operator action because of the seismic robustness of the auxiliary feedwater system . ;

equipment in the auxiliary building. ;

Energy Research, Inc. 9 ERI/NRC 96-502

An aspect that may complicate operator actions after an canhquake is the very low turbine building and service building HCLPF capacity (0.lg PGA). The licensee dealt with this issue by not crediting actions that require access to the turbine and service buildings. The licensee recognized that alignment of a long-term water source to the EFWST (using the diesel-driven auxiliary feedwater pump in the turbine building) would be hindered by failure of the ~ turbine building. However, it was judged that the 7 to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months available for action was sufficient to gain access to the room in the auxiliary building and take the needed actions. The limiting failure mode in these scenarios, however, is not operator actions but rather failure of the diesel-driven auxiliary feedwater pump owing to failure of the turbine building. The scheduled plant modification to provide a cross-connection from the raw water system to the EFWST is an attempt to reduce the risk significance of the turbine building for seismic events.

In general, the locations at which operator actions are required, and the timing of such actions, were provided in the submittal.

2.1.4 Seismic Input The seismic input excitation for the determination of structural and component responses was specified by the NUREG/CR-0098 median spectral shape for soil conditions. Its use conforms to NUREG-1407. ;

2.1.5 Structural Responses and Component Demands Development of structural responses and component demands followed the methods outlined in NUREG/CR-4334 and EPRI/NP-6041, as well as the guidance of NUREG-1407.

Structures addressed in the analysis included: the containment, concrete support for containment internals, auxiliary building, intake building, and turbine building. The turbics building contains some safe shutdown equipment, for example, a diesel-driven auxiliary feedwater pump (FW 54). Masonry walls, the control room ceiling, seismic interaction between structures, and seismic interaction between structures j and an .= were also analyzed. Identified interactions were included in the fault tree logic model by i

adding an event to the affected component. l Soil structure interactions were calculated from mass-spring models using time-history analysis. Ground !

motion input was the 1940 El Centro NS horizontal ground motion record scaled to the FCS SSE (0.17g l PGA). SSE floor response spectra for the containment, containment structures, and auxiliary building have peaks in the range of 2.5 to 3.5 Hz. Peak broadened in-structure response spectra were generated (for the SSE as part of the FCS Alternate Seismic Criteria and Methodology [ASCM]) at various elevations and directions (north-south, east-west, and vertical) for 2,3,5, and 7 percent damping. These in-structure demands were developed for the auxiliary / containment building (which share a common basemat), the internal containment structure, the intake structure, and the turbine building. Generally, peak spectral .

accelerations appeared at frequencies between 1.5 to 4 lh. A secondary peak at about 10 to 20 Hz appeared in the vertical response spectra.

For the SMA, the SSE-based demands were linearly scaled up to determine W Grelated demands, in accordance with applicable ratios of the NUREG/CR-0098 median soil spectrum a.. chored to 0.3g PGA, to the SSE spectrum anchored to 0.17g PGA. The scaling was performed in accordance with Reference .

[5], Section 4. For example, the scaling factor (approximately 2.4 for the auxiliary / containment building) was developed by the ratio of the NUREG/CR-0098 7 % damped median peak spectral acceleration (0.57g)

Energy Research, Inc. 10 ERI/NRC 96-502

. - . - ~ . . - . - - -

. ' to the ASCM program SSE 7% damped time history response spectrum of each building. This factor was applied to the 5% damped SSE ASCM in-structure response spectrum, which was also broadened by plus and minus 10% along the frequency scale. Peak broadening was suggested on page 4-29 of EPRI/NP-6041 as an acceptable alternate to peak shifting, in order to account for uncertainties in the analysis.

All equipment of the same type (e.g., MCCs, heat exchangers [HXs], blowers, pumps, fans) at the same elevation, in the same building, and having the same capacity, were considered to be failed by common cause. Spatial interactions were explicitly treated by developing lists of equipment that would be impacted by falling or falling structures.

2.1.6 Screening Criteria Of the approximately 680 items on the equipment list, all but 91 were screened out at the 0.5g PGA level.

HCLPF capacities were 'calculated for the 91 remaining items, and the seismic plant logic model was quantified. Calculation of HCLPF capacities and model quantification was an iterative process. As will be discussed in Sections 2.1.9 and 2.1.10, the model was quantified at incrementally increasing ground motion levels (as represented by PGA). Seismic failure modes that were found to control the plant HCLPF capacity were given either more rigorous analytical attention or were evaluated for candidate plant improvements.

Structures and components were either screened out using Tables 2-3 and 2 4 of Reference [5], or HCLPF capacities were evaluated using the CDFM method. Lognormal capacity distributions (i.e., fragilities) were developed, such that the ratio of the median capacity to the HCLPF capacity was assumed to be 2.1, and the value of e (i.e., the composite standard deviation of the logarithm of capacity) was assumed to be 0.4.

All structures, except masonry walls, the intake structure roof, and the turbine building, were screened out by use of the generic criteria in Reference [5]. Masonry walls were calculated to have HCLPF capacities as low as 0.12g PGA. Failure of equipment caused by failure of walls was included in the fault tree models, using the wall HCLPF capacity as the basis for determining a failure probability. Interactions between the containment and auxiliary buildings were found to have a HCLPF capacity of at least 0.5g PGA. The turbine building and service building have a calculated HCLPF capacity of 0.lg PGA, and interactions caused by their collapse onto IPEEE-related equipment were considered in the fault tree logic models. The intake structure roof has a calculated HCLPF capacity of greater than 0.3g PGA, and the effect ofits collapy C "*.EE equipment was evaluated as being minor to negligible.

The turbine building HCLPF capacity was determined by comparing wind pressures from the 1%7 National Building Code to the 1991 Uniform Building Code, and assuming that wind governs over seismic loading. The service building was assumed to fall if the turbine building fails, and hence, collapse of the turbine building is given as the governing failure mode. The estimated HCLPF capacity of 0.lg PGA for the turbine building appears to be somewhat low.

NSSS structures, all distributed systems (i.e., piping, electrical raceways, HVAC ductwork), structures, and all components on the IPEEE equipment list were included in the screening and seismic evaluations.

A 0.5g PGA screening criterion was used. NSSS structures and reactor internals were screened out by .

use of the generic information in NUREGICR-4334 [4] or EPRI NP-6041-SL, Rev.1 [5). Control rod drive mehnieme and housings were screened out. Sampling walkdowns were performed for HVAC duct Energy Research, Inc. 11 ERl/NRC 96-502

and piping, which were screened out. The USI A 46 walkdown identified a few minor outliers with respect to electrical raceways, and these were subsequently repaired.

Another level of screening was used to simplify the plant logic model. If a seismically weak component was found only in cutsets with other probabilistically rare events, such that the overall CDF of the cutset was found to be low, then no further work was done on that component.

2.1.7 Plant Walkdown Process The submittal provided only a brief description of the plant walkdown process. The walkdown was pdimmed in conjunction with the USI A 46 walkdown by seismic review teams (SRTs). The teams used a total of six seismic capability engineers who were trained in GIP requirements. An electronic database was used to track and record the walkdown data and SRT comments. Guidance of EPRI NP-6041-SL, Rev.1, .was used for screening, and seismic evaluation work sheets (SEWS) were used to document caveats and capacity assessments. The submittal did not indicate the SRT personnel's training and experience with respect to beyond-design-basis IPEEE walkdowns.

2.1.8 Evaluation of Outliers Initial assessment of the plant HCLPF capacity used the preliminary capacities obtained from the plant walkdown. As the dominant contributors were identified, either a more detailed capacity evaluation was made using the CDFM method, or plant modifications were schedulad.

This study used a seismic margins method for the purpose of identifying vulnerable plant equipment and calculating a plant HCLPF capacity. Using both seismic and non-seismic failures in the event tree and fault tree models, as described above, cutset frequencies at each ground acceleration level were calculated.

The HCLPF capacity of a cutset was taken to be the highest HCLPF capacity of any element in the cutset.

The plant HCLPF capacity was approximated as the cutset with the minimum HCLPF. The cutsets were generated using the assumptions of unrecoverable loss of offsite power and unrecoverable loss of instrument air. Cutset frequency estimates were not provided. However, a discussion of the dominant equipment and sequences at each PGA level was provided in the submittal, and this information is summarized in Table 4.1 of this report.

The determination of plant HCLPF capacity has followed an iterative process over successively higher earthquake levels. It is this process that allowed seismic weaknesses to be identified, and formed the

. technical basis for identifying plant modifications. For example, the plant HCLPF capacity was first calculated to be 0.01g PGA because seismically induced chatter of bad actor relays could lock out both diesel generators following an earthquake-induced loss of offsite power. With a commitment to replace the relays with seismically robust ones, the plant HCLPF capacity was recalculated, and the next most limiting component or failure mode was discovered. Dominant contributors to the plant HCLPF capacity-were calculated for earthquake PGA levels of 0.01g,0.05g,0.1g,0.17g,0.24g,0.25g,0.273 , and 0.29g PGA. Initial assessment of the plant HCLPF capacity used the preliminary capacities obtained from the plant walkdown. As the dominant contributors were identified, either a more detailed capacity evaluation was made using the CDFM method, or plant modifications were scheduled. If either action resulted in increasing the estimated HCLPF capacity of the contributor to above 0.33 PGA, then no further work was .

performed for that contributor. In some cases, modifications were determined to be cost prohibitive.

These cases included: (1) modification to ameliorate the effects of liquefaction; (2) enhancements to Energy Research, Inc. 12 ERl/NRC 96-502

r

, increase the HCLPF capacity of anchorages of certain MCCs beyond 0.27g PGA; and (3) enhancements to anchorages of the raw water system pumps, all of which have HCLPF capacities less than 0.3g PGA.

These items, therefore, were the contributors found to control the plant HCLPF capacity.

.Two MCCs that provide power to the component cooling water (CCW) and high pressure safety injection (HPSI) systems were found te have missing bolts. Replacing the bolts increased the calculated HCLPF l PGA capacity from 0.24g to r % 'Ibese MCCs, and others, were ultimately assessed as having a 0.27g l PGA HCLPF capacity, with m uer modifications proposed. The RWS pumps were assessed as having a HCLPF capacity of 0.29g F - , with no further modifications proposed. The submittal states that cost-effective modifications for these items of equipment were not available.

Table 4.1 of this report summarizes the limiting components or failure modes at each calculated plant l HCLPF capacity, along with the modification, if any, that tended to remove the limitation and l consequently increased the plant HCLPF capacity.

2.1.9 Relay Chatter Evaluation !

The licensee performed a relay chatter evaluation focusing on low ruggedness relays, as part of the USI ;

A-46 relay evaluation. Six low ruggedness relay, associated with control of components on the IPEEE l equipment list, were found during that program. Therefore, a bad actor relay review was performed for l the IPEEE only relays, as requested in NUREG 1407. All relays in control circuits involving components ;

on the IPEEE equipment list were reviewed by manufacturer and model, and compared to the low l ruggedness relay list. Additional bad actor relays were not found. The six relays, associated with the diesel generator lock-out circuitry, are being replaced with robust relays and were thus not subsequently '

considered to be a seismic vulnerability.

The performance of the relay evaluation appears to be within the guidelines of NUREG-1407.

2.1.10 Soil Failure Analysis Using two methods from Appendix C of Reference [5), Sargent and Lundy performed a soll liquefaction analysis for the soil under Category-I structures, and for the soil elsewhere. One of the methods was based on a comparison of the FCS site with observations from previous earthquakes, and the other was based on soll testing. Soil at the site is sandy to a depth of 65 to 75 feet, where bedrock is reached. The soll .

. was m=pW to a relative density of 85% under Category-I structures. The soil was not compacted in other locations, and has a relative density that averages about 62% under and around the turbine building, service building, and in the yard. The calculacJ HCLPF capacity for soil under Category-I buildings was .

0.35g or 0.4g PGA, dependmg on the evaluation method used. Both methods yielded a calculated HCLPF capacity of 0.25g PGA for soil at all other site locations. Important safe shutdown equipment potentially affected by liquefaction at this motion level include: diesel generator fuel oil storage tanks, and RWS piping that runs between buildings. The effects ofliquefaction on the turbine and service buildings were not discussed. However, failures of the diesel generator fuel oil storage tanks end RWS piping, by themselves, cause this failure mode to limit the plant HCLPF capacity to 0.25g PGA using the employed methodology.

Energy Research,'Inc. 13 ERI/NRC 96-502

r- ,

Although the plant HCLPF capacity was assessed at 0.25g PGA owing to liquefaction, the licensee continued to pursue plant improvements to increase equipment HCLPF capacities toward the RLE, as if liquefaction did not occur. .

2.1.11 Containment Performance Analysis i A simplified event tree was developed that focuses on the likelihood of a large early release owing to I containment bypass or isolation failure. The top events included early core melt (the initiating condition),

containment bypass, and containment isolation. Each core damage sequence, obtained from the event tree analysis, was evaluated using the containment event tree. The submittal did not explain how this analysis was performed, and did not provide conditional probabilities of the containment event tree events. Due to high structural capacity of the containment, loss of containment structural integrity was screened out.

The containment analysis assumed that containment isolation valves would go to their fail-safe position at or below the 0.3g RLE. This assumption took advantage of the previous anumptions ofloss of offsite power and loss ofinstrument air. High seismic capacity of the isolation valves was cited as the reason that valves would be functional.

Sequences identified in the submittal that lead to large early release include: LOCAs or transients accompanied by loss of high pressure injection or primary / secondary heat removal (including loss of feed and bleed), coupled with failure of containment isolation. The study concluded that the conditional probability of large early release, given a core damage sequence induced by earthquakes at the RLE (or below), is about 1%.

2.1.12 Seismic Fire Interaction and Seismically Induced Flood Evaluations The seismic review team communicated to the fire analysis team potential seismic-fire interaction concerns that were encountered as a result of the seismic walkdowns and SMA capacity evaluations. The following concerns were identified in the turbine building: hydrogen piping; fuel oil tank for FW-54; masonry block walls surrounding the turbine lube oil storage room; hydrogen seal oil storage tank; and flammable materials storage area. The intake structure houses a fuel oil tank for the diesel-driven fire water pump, which has an estimated seismic HCLPF capacity (owing to mounting on vibration isolators) of 0.05g PGA.

The tank has been scheduled to be adequately anchored. Treatment of risk associated with seismic fire intera::tions was presented in the submittal as part of the fire IPEEE. The submittal, however, did not include a discussion of anchorage of fire suppression tanks and capability of associated piping, particularly with respect to soil failures; nor did it include a discussion of the potential effects of non-lE cabinets on essential cabinets.

An external flood caused by a dam break has the same effect on the site as an erthquake-induced dam break, namely, a 25-foot wall of water wsh will cause loss of all core coolin3 Accordingly, an emergency recovery system was designed tha6 meludes staging of portable pumps to deliver make-up water to the EFWST and to feed the steam generators. Procedures were also changed accordingly. Seismic-induced dam break CDF, crediting the emergency system, was estimated to be less than 104 / year.

As part of the walkdown, the seismic review team also reviewed the potential for in-plant seismically induced floods. Piping was screened out because of high capacity. The spent fuel pool and the safety ,

injection and refueling water tanks were screened out owing to high capacity. The shutdown neat exchangers will be modiGed to increase their HCLPF capacity to above 0.3g PGA. Many tanks in the Energy Research, Inc. 14 ERl/NRC 96-502

l l .

l auxiliary building (e.g., primary water storage tank and hot water tank, and component cooling water i surge tank) were screened out, because taken together they had insufficient volume to affect other vital i-equipment when using Room 23 as a catch basin. Room 23 contains a small number of safe shutdown related equipment; however, flooding of Room 23 would cause two junction boxes for containment sump valves, which are needed to mitigate a small LOCA, to be flooded. These boxes are being water-proofed.

A concern emerged from the walkdown related to failure of the shutdown heat exchangen. . Such concern is consistent with identified vulnerabilities of RHR heat exchangers in other studies. The controlling failure mode was determined to be insufficient anchorage at the base. This condition is being corrected by providing additional anchor bolts.

2.1.13 Treatment of USI A 45 l The submittal qualitatively treated the USI A-45 issue, by comparing the insights gained from performing l

L the SMA with the generic USI A 45 issues as summnized in Appendix 5 of GL 88-20. Ge a ic insights concerning the significant aspects of decay heat removal include: human actions and support systems are significant; single points of failure owing to train interconnections may be a problem; physical separation

, and protection may be lacking; loss of station power (LOSP) events are significant; and feed and bleed

) operation is significant. The submittal concludes the following for FCS:

l Support systems are significant. FCS weaknesses in this area include the turbine building and soil liquefaction, as well as anchorages of MCCs and RWS pumps.

Human actions are signMeant. The most important human action is the requirement to refill the EFWST after 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . (However, the present review has found that this insight is an artifact of the assumption of loss of instrument air, which disables closed-loop RHR cooling.)

Adequacy of physical separation and protection of redundant trains is an issue because a diesel-driven auxiliary feedwater (AFW) pump is located in the turbine building, which has a low seismic capacity. The two AFW pumps in the auxiliary building are robust. Therefore, the controlling reason to use the diesel-driven pump is to replenish the EFWST. A modification is underway to allow connection of the raw water system to the EFWST.

Sharing and interconnections at FCS are limited to multiple pumps feeding a common header.

LOSP is important at FCS.

The submittal also made a statement to the effect that feed and bleed contributes greater than 10% to the seismic CDF. However, seismic CDF information was not provided in the submittal because SMA methodology was employed.

2.1.14 Other Safety Issues l

Seismic system interaction issues, concerning USI A-17, were explicitly considered during the walkdown by development of spatial interaction tables. These tables listed the equipment potentially affected by l failure of soil, stmetures, and block walls. Each component's inclusion into the seismic plant logic model L accounted for the probability of failure of soil, structures, and block walls.

Energy Research, Inc. 15 ERI/NRC 96-502 1-

._ ~ .-- - ... ~ ._ ~

. l The equipment list, SMA canacity evaluations, and logic models addressed the remaining USI A 40. issue regarding the adequacy of tanks. Where tanks have been determined to limit the plant HCLPF capacity, component upgrades have been scheduled (e.g., pre-tension of straps on the diesel generator start air receivers), more detailed analysis has been performed to discover increased margin (e.g., RWS heat exchangers), or workarounds have been scheduled (e.g., tie-in of the RWS to the EFWST).

The licensee's treatment of USI A-17 and USI A-40 appears reasonable.

Some seismic-related information having relevance to Generic Safety Issue (GSI)-156 and GSI-172 is provided in the submittal, as discussed in Sections 2.4.3 and 2.4.4, respectively, of this TER.

l 2.1.15 Peer Review Process j J

The licensee's staff has performed the FCS seismic IPEEE assessment, with assistance from SAIC, RPK Structural Mechanics, Sargent and Lundy, and Stevenson & Associates.

j Dr. Robert Budnitz and Dr. John Stevenson performed the peer review Key reviewer comments and their resolution are reported in the submittal. Via the peer review process, the licensee recognized that some reported plant-level HCLPF capacities are unrealistically low because of the assumptions regarding a-priori (

loss of offsite power and instrument air. For example, bad actor relays in the diesel generator circuitry were found, by the analysis, to establish a plant level HCLPF capacity of 0.0lg when, in fact, diesel ,

generators would not be called upon below a ground motion level on the order of 0.lg PGA. The peer j reviewers also suggested that PRA-type results should not be presented for this study because such results are misleading using the methodology employed by the licensee. CDF results were thus removed from j the submittal, j

The peer review comments, with respect to the conservative. nature of the plant HCLPF capacity determination and the inappropriateness of presenting SMA-based CDFs as if they were PRA-generated CDFs, coincides with the review findings herein.

2.1.16 Summary Evaluation of Key insights Components limiting the plant HCLPF capacity were identified, and one of three actions was taken: (1) a more detailed analysis was performed using the CDFM method; (2) if the HCLPF capacity could not be demonstrated by such analysis to be greater than 0.3g PGA, then a plant modification was scheduled (if deemed cost-effective); or (3) if the HCLPF capacity could not be demonstrated by analysis to be greater than 0.3g PGA, and no cost-effective means to raise the HCLPF capacity were identified, then nothing was done. Table 4.1 identifies the major limiting seismic failure modes for FCS, as well as the actions to be taken by the licensee. In addition, the IPEEE took credit for the actions taken (or to be taken) to correct USI A-46 outliers. Such outliers included: missing or inadequate anchorages; adjacent cabinets not bolted together; long valve operator cantilevers; component attached to two structures and susceptible to relative motion; fans on vibration isolators; inadequate conduit clamps or supports; no positive connection between the CCS surge tank and ks saddle; and 30" long sight glasses on the diesel generator day tanks. Corrective actions included: repair or replacement of anchors; bolting together cabinets; improvements to anchorages; more detailed analysis; tie-down of vibration isolators; improvement of conduit supports / clamps; and substitution of more robust material for sight glasses.

Energy Research, Inc. 16 ERI/NRC 96-502

- - . , - . v+n..~.-..+---- w~. -..nn . . . . --

l

. The use of the IPEEE coupled with the USI A 46 assessment to identify and correct many outliers and potential seismic weaknesses appears to be a particular strength of the licensee's effort, and complies with the spirit of GL 88-20 and NUREG-1407.

- A number ofIPEEE equipment items are located in the turbine building, including an auxiliary feedwater pump. Also, some RWS valves are located in the service building. Proposed modifications would have the effect of reducing the dependence of the plant's response to earthquakes on equipment in the turbine building.

2.2 Eke A summary of the licensee's fire IPEEE process has been described in Section 1.2. Here, the licensee's fire evaluation is described in detail, and discussion is provided regarding significant observations encountered in the present review.

2.2.1 Overview'and Relevance of the Fire IPEEE Process

a. Methodology Selectedfor the Rre JPEEE The fire IPEEE analysis was based on PRA methodology per the EPRI Fire PRA Implementation Guide

[8]. OPPD has been a member of the EPRI Fire PRA Implementation Collaboration, where the draft version of the implementation guide has been used for the licensee's IPEEE preparation. The Fort Calhoun submittal provides a faint sketch of the adopted methodology. The methodology is composed of 10 steps. In the initial steps, information is collected and the plant failure model is put together. In the second set of steps, a screening analysis is performed based on the contents of the fire zones and CDF estimates. In the third stage, the fire scenarios are subjected to further detailed analysis. As part of this third stage, multi-compartment fire analysis is conducted.

l For fire propagation analysis, the formulations provided in the FIVE methodology [7] have been employed.

b. Key Assumptions Used in Performing the Fire IPEEE A list of fire IPEEE assumptions is provided on Page 4-3 of Reference [1]. The key assumptions, with respect to significance on results, are:

Fire barriers / boundaries are good as rated. Active systems (for example self-closing /normally open fire doors) are part of fire barrier definition. Some consideration is given to the possibility of open doors, ducts, failure of fire dampers, etc.

The automatic fire suppression systems are assumed to be able to handle the entire spectrum of fire scenarios considered in the analysis.

Control room HVAC failure does not require control room evacuation.

The probability of a hot short in an electrical circuit exposed to fire is 0.06, regardless of circuit design.

Energ,y Research, Inc. 17 ERI/NRC 96-502

_~.

, c. Status ofAppendix R Modsfcations The Appendix R effort has provided the majority of information (i.e., fire zone definition, safe shutdown equipment, and cable routing) used for the fire PRA. Only in a few cases did additional information have to be collected. De licensee does not elaborate on what equipment and cables had to be added to the safe shutdown equipment list. However, in Reference [13] it is stated that offsite power related bus bars, cables, and electrical cabinets have been identified, and their locations and cable routing have been included in the core damage analysis for fire zones.

The licensee does not mention the status of Appendix R compliance, and whether or not any variances had been considered.

d. New or Existing PRA The IPEEE is a new PRA.

2.2.2 leview of Plant Information and Walkdown .

a. Volkdoun Team Composition Accordin to the submittal, fire walkdowns have been conducted. Reference [13] provides some details regarding valkdown team composition, site visit agenda, methodology, etc. In the licensee's discussions about issuet raised in the Sandia fire risk scoping study (FRSS), it is indicated that plant walkdowns were employed t , verify or identify plant characteristics relevant to such issues.

b. Si:nifcant Walkdown Findings The licensee has used the walkdown process to confirm information obtained from various documents, and to identify the specific fire scenarios in terms of ignition sources, targets, etc., for the unscreened fire zones. From the discussions in the submittal, it can be inferred that the distribution of combustible materials, and the potential for hot gas layer propagation to adjacent zones, have been investigated as part of the plant walkdowns,

c. Signifcant Plant Features It has not been possible in the present review to glean any information about significant or unusual features of the plant that may be different from plants of similar design or vintage. The following is a list of plant features that could be gleaned, and are deemed to be important:

The plant is a 501 MWe Combustion Engineering pressurized water reactor (PWR) design a The plant has two coolant loops

De plant started commercial operation in 1973

The plant has a diesel-driven auxiliary feedwater pump that is not dependent on plant support systems Energy Research, Inc. 18 ERI/NRC 96-502

e 2.2.3 - Fire-Induced Initiating Events

a. . Were Initiating Events Other then Reactor Trip Considered?

A separate discussion ofinitiating events is not provided in the submittal. However, it can be inferred that initiating events other than reactor trip have been addressed. The possibility of a LOCA, from cable failure or from a stuck-open power-cperated relief valve (PORV), has been considered. The possibility of non-recoverable loss of offsite power has also been identified for the control room, cable spreading room and two switchgear rooms.

b. Were the Initiating Ewnts Analyzed Properly?

From the discussions provided in the submittal, it can be inferred that, with the exception of reactor trip, other :2:aN events have been addressed properly. That is, the initiating events identified as part of the

~ IPE model have been considered in the fire PRA, and cable failures that could lead to these events have been identified.

In the first screening step, it was assumed that if a reactor trip could not occur from a fire in a compartment, and if there are no safe shutdown cables or equipment in that compartment, then the compartment can be screened out. This screening rule may be optimistic, because it is extremely difficult (unless one identifies every cable within a compartment and their associated circuits) to ascertain that a reactor trip would not occur from a fire. As a minimu:n, the operators in the control room may chose to trip the plant. This issue may not lead to a significa it optimism in the final results, however, since the licensee has included in its screening criteria 6 requirement for the presence of Appendix R safe shutdown cables or equipment.

In the case of loss of offsite power, since Appendix R assumes the occurrence of this event, often the associated cables are not identified in a cowrehensive manner. In Reference [13] the licensee does clarify that offsite power related bus bars, control cables, and electrical cabinets have been added to the list of equipment and cables used for fire ahtlysis.

2.2.4 Screening of Fire Zones

a. Was a Proper Screening Methodology Employed?

The screening methodology included two major st:ps. In the first step, fire areas were screened out based on their contents. Areas that did not contain any afe shutdown equipment were screened out. The second step was done in two parts. In the first part, the conditional core damage probability was estimated assuming that all cables and equipment within the area are lost. An area was screened out if the conditional core damage probability was determined to be less than 10~8, In the second part, the CDF was 1 computed using fire ignition frequency, and in some cases, considering the probability of suppression 4

system failure. An area was screened out if the CDF was estimated to be less than 10 /ry,

b. Have the Cable Spreading Room and the Control Room Been Screened Out?

Cable spreading room and control room fire events have been considered. A thorough analysis of the control room has been conducted. The licensee has conducted an investigation of every control cabinet Energy Research, Inc. 19 ERI/NRC 96-502

. . . 1

7, and section of the control console. The overall approach is reasonable. Special distinction was made of panels where a fire would not cause a reactor trip. This approach may be optimistic, since the control room operator may trip the plant because of a fire, it is important to note that the licensee has screened out panels that may include Appendix R safe shutdown systems related circuits if the licensee could convince itself that reactor trip was an impossible consequence of a fire in that panel. As stated earlier, this is a somewhat optimistic approach. At the minimum, the operator may trip the plant based on j%===tal assessment of the conditions of the plant. Furthermore, without an exhaustive analysis of the )

balance of plant circulu, it is not possible to assume that reactor trip will not occur.

The licensee has counted 66 control cabinets associated with the control room. Including this many cabinets in the analysis may lead to optimistic fire frequencies for control room panels, since a typical control room, as assumed in the generic fire frequency data base, may have fewer panels. It was assumed that only in the event of fire suppression failure, would a fire propagate to outside the panel of origin and force control room evacuation.

The cable spreading room analysis was based on a simple methodology. It was assumed that either one l safety train is lost, if the suppression system functions properly, or both trains are lost and the alternate i shutdown panel is utilized, if the suppression system fails. Conservative values were used for manual suppression failure and operator failure in properly controlling the plant from outside the control room.

The fire occurrence frequency, however, was smaller than what is typically used in other PRAs.

c. Were There Any Rre Zones / Areas that Have Been improperly Screened Out?

The justifications provided for screening of fire zones are reasonable. From the information provided by the licensee, no fire zones could be identified as being unreasonably screened out.

2.2.5 Fire Hazard Analysis The fire event database and initiation frequencies provided in NSAC 178L [15), and the partitioning methodology of FIVE, were employed by the licensee. A plant-specific database was not used.

2.2.6 Fire Growth and Propagation For fire growth and propagation analysis the FIVE worksheets were used for those areas that did not screen out. The possibility of oil spills and hot gas layer formation were included in the analysis. The licensee states that a realistic characterization of ignition sources and combustion of in-situ and transient fuels were considered. However, the transient fuel loading assumptions described in Reference [13] may be somewhat optimistic. Also, the licensee elected to use 0.85 for the heat loss factor for propagation analysis. For electrical panel or cabinet fires, the licensee used a probabilistic approach based on the guidance provided in the EPRI Fire PRA Implementation Guide [8] to model the possibility of fire propagation to outside the panel or cabinet. It must be noted that the guidance provided in Reference [8]

is based on Sandia cabinet fire tests, and extreme caution should be practiced in applying test results to plant specific conditions.

In FIVE, the methodology and data approved by the NRC, a heat loss factor of 0.7 is suggested for -

modeling the energy generated by a fire. The licensee has, instead, used a heat loss factor of 0.85, which is not approved by the NRC. The larger heat loss factor reduces the amount of energy generated by a fire, Energy Research, Inc. 20 ERI/NRC 96-502

P

, and leads to smaller target temperatures and hot gas layer heat content than those obtained for a heat loss factor of 0.7. Thus, the licensee's approach may lead to optimisms in probabilities of fire suppression and cable damage. It may also lead to optimisms in fire compartment interaction analysis (FCIA) results, in the assessment of fire propagation potential to adjacent compartments. The issue of electing to use 0.85 was further discussed in Reference [14]. The licensee states th:t fire modeling was done for only 5 fire areas and a review (done by the licensee) of the fire modeling for these areas indicates that the insights would not change if a heat loss factor of 0.7 is used.

a. heatment of Cross-Zone Rre Spread and Associated Mqfor Assumptions

~ Cross-mone fire spread has been included in the licensee's fire analysis. A hot gas layer was taken to be the prunary vehicle for spread of damage to other zones. Computations have been conducted using FIVE formulations for the feiruadon of a hot gas layer, assuming that in-situ materials in addition to 1,000 Btu per square foot of floor area (representing transient fuels) are burning. Using those formulations, it was l verified whether or not the hot gas layer could cause damage beyond the boundaries of the fire area. The related discussions provided for fire areas appear reasonable. However, as mentioned above, the transient fuel loading assumption may be somewhat optimistic. Special attention was given to the failure of fire barriers, and probabilistic failure models were employed. However, it could not be confirmed in the present review whether or not the licensee has used appropriate probabilities.

b. Assumptions Associated uith Detection and Suppression The suppression system failure probabilities given in FIVE have been used for the CDF evaluation. For the majority of cases, the time to damage and the time to detection and suppression have not been modeled. I For fire areas.where suppression system failure was accounted for, it was assumed that failure of the suppression system leads to the loss of all items in the room, otherwise (if the suppression system functions properly) one train of the systems will remain available. This method was employed for the cable spreading room, the compressor area, switchgear areas, and the turbine building. For the control room, fire duration was considered for suppression failure evaluation.

c. Deatment ofSuppression-induced Damage to Equipment, ifAvailable Suppression-induced damage was aot treated explicitly. However, as part of the response to the Sandia fire risk scoping study issues, the possibility of suppression system effects on safety-related equipment has been considered. A separate study has been conducted where this issue was addressed. Splash shields were added to certain safety-related equipment to minimize the possibility of water affecting electrical equipment.

d. Computer Codes Used, ifApplicable There is no mention of a computer program employed for fire propagation analysis. As mentioned above, the formulations and tabulations of FIVE were employed.

Energy Research, Inc. 21 ERI/NRC 96-502

,. 2.2.7 Evaluation of Component Fragilities and Failure Modes

a. Defnition offTre-induced Failures

. Loss of function of equipment associated with damaged cables or damaged cabinets was assumed to take place. Different failure modes of electrical cables, including those that lead to spurious actuation of a component, were also considered for valves and other equipment that need to remain in their original position. The possibility of PORV failure to reclose was included in the analysis.

. b. Afethod Used to Determine Component Capacities The data provided in EPRI documents have been used to establish component fragilities.

c. Generic fragilities The plant started operation in 1973, before the current version of cable fire retardancy testing methods (i.e., IEEE 383-1974) was adopted by the industry. The licensee has tested its cables, and has concluded in a 1978 study, that they comply with (and in some cases even exceed) the 1974 requirements of IEEE 383. In the IPEEE submittal, it is correctly stcted that the failure temperature for IEEE 383 qualified cables should be taken as 700*F, and for non IEEE 383 qualified cables should be taken as 450*F. This <

approach is commensurate with industry accepted practices,

d. Plant-Specifc Fragilities No, plant-specific fragilities have been used,

e. Technique Used to Treat Operator Recowry Actions The licensee has calculated human error and recovery probabilities using the same technique as for the IPE, but has increased the stress factors to account for fire conditions. Special attention was given to the location of a fire, the timing required to complete the task, habitability conditions of the control room, and other factors such as training. For operator error in controlling the plant after control room evacuation, a conservative failure probability of 0.1 was used.

2.2.8 Fire Detection and Suppression Fire initiation frequencies were multiplied by suppression failure probabilities. The failure probabilities suggested in the FIVE report were adopted for this purpose. Generally speaking, the times to damage, detection and suppression have not been modeled. However, for the dominant fire scenarios (e.g.,

switchgear room fires and control room fires), the timing of events has been taken into consideration to some extent.

2.2.9 Analysis of Plant Systems and Sequences

a. Key Assumptions including Success Oiteria and Associated Bases The success criteria are taken directly from the IPE.

Energy Research, Inc. 22 ERI/NRC 96-502

E ,_

s. .

. b. Ewnt hees (iknctionalor Systemic)

The fault trees and event trees of the IPE have been used by flagging the components failed by fire.

c. Dependency Matrix, ifit Is Diferentfrom thatfor Seismic Ewnts A dependency matrix has not been provided.

d. ~ Plant-Unique SystenrDependencies There are no plant-unique system dependencies described in the submittal.

e. Most Signifcant Human Actions From'the information provided in the submittal, it is difficult to glean which human actions were determined to be significant in the sequences leading from a fire to core damage. However, control room fire related human actions may be a significant set. These scenarios have been modeled conservatively.

Also, since the dominant fire scenarios involve stuck-open PORV or recirculation failure, it can be inferred ,

that human actions were modeled for conditional cer9 damage probability evaluations.

2.2.10 Fire Scenarios and Core Damage Frequency Evaluation Overall, the licensee has properly demonstrated and summarized how the CDF was estimated for each fire scenario. However, the submittal does not provide much infoimition regarding the failure of system trains for each specific fire area. Therefore, it is difficult to verify the conditional core damage probability.

Furthermore, in the final steps of the analysis, there are discrepancies among different tabulations of the CDF and plant damage state (PDS) frequencies. For example, the total frequencies for plant damage states in Tables 4.4 and 4.3 of the submittal do not match. As another example, on page 4-55 of the submittal, 4

the total frequency for PDS-319 is 6.35 x 10 /ry. However, on page 4-59 of the submittal, 8.85 x 104/ry is given as the total frequency for PDS-319. Such discrepancies exist for a large number of plant damage

, states.

2.2.11 Analysis of Containment Performance

a. Signifcant Containment Performance Insights.

Containment fires have not been discussed explicitly. It can be inferred that they were concluded to be insigni6 cant at FCS. Containment failure has been analyzed in detail using the same model as that used in the over ll plant PRA. The frequencies of containment failure modes and of dosage measures have been established and cross-referenced with plant damage states. In turn, the plant damage states were cross-referenced with fire scenarios and fire areas. About 65 % of the fire-induced CDP may lead to some form of enntainmant failure. It is also important to note that ret all plant damage states that were obtained from fire induced core damage sequences were mapped in the containment event tree of the IPE. Therefore, the licensee chose to collapse some of these new plant damage states with other more conservative damage states. -

i Energy Research, Inc. 23 ERI/NRC 96-502

b. Plant-Unique Phenomenology Considered The same phenomenology was considered as that developed in the Level-2 IPE analysis. Fire sequences and associated failed equipment were analyzed using the IPE containment event trees.

2.2.12 Treatment of Fire Risk Scoping Study Issues

a. Assumptions Used to Address Rre Risk Scoping Study issues l The possibility of Class-II-rated suppression system degradation, and the potential for hadvertent actuation of these systems, have been addressed explicitly. A sep;. rate study had been pmviously conducted to address the possibility of fire suppression system actuation. The focus of the study was on water-containing systems, since these systems can adversely affect electrical systems, Splash shields have been installed on those equipment that have the potential for being exposed to water spray from a fire I suppression system. Pipe supports and anchors have been provided to minimize the possibility of flooding and equipment damage.

Fire barriers have also been addressed. Special procedures are in place to assure fire barrier integrity.

In the fire PRA, as part of the multi-compartment fire propagation analysis, the location of fire barriers, doors, seals and dampers has been considered, and the probability of failure of such devices has been included in the analysis.

l Hydrogen lines, fuel oil, seal oil, and flammable storage have been analyzed for the potential for failure under seismic forces and resulting ignition of fire. Plant modifications are being considered to strengthen some of the equipment containing oils and flammable liquids.

i Little credit was given to the effectiveness of manual fire fighting actions in the fire PRA. However, the plant maintains a fire brigade which conducts drills and training exercises.

The issue of equipment survival under all adverse phenomena caused by a fire has been addressed explicitly for three conditions (in addition to heat impingement from flames and hot gas layer): combustion products, spurious actuation of a fire suppression system, and operator actions. Combustion products are argued to have a slow effect on the equipment. Operator actions have been addressed in a conservative manner. A probability of 0.1 was assigned for operator failure to control the plant from outside the control room. "Ihe human error probabilities used in the IPE plant model were modified to account for the special stressful conditions posed by a fire.

b. Signifcant Mndings Other than those findings just described, there were no additional findings of significance associated with the Sandia fire risk scoping study issues.

Energy Research, Inc. 24 ERI/NRC 96-502

1 1

1

2.2.13 USI A 45 Issus .

a. Methods ofRemoving Decay Heat The auxiliary feedwater system and long-term cooling, as well as feed and bleed, are the methods l conaldered in the IPEEE for heat removal during and after a fire event. The plant is equipped with a diesel-driven auxiliary feedwater pump that is located in the turbine building. The other auxiliary .

l feedwater pumps are located in the auxiliary building, i

b. Ability of the Plant to Feed and Bleed The plant has feed-and-bleed capability. Feed and bleed actions have been included in the core damage analysis for fire scenarios.

c. Credit Takenfor Feed and Bleed Credit has been taken when fire does not disable power to PORVs or both safety trains.

, d. Presence ofThermo-Lag l l Thermo-lag is not present at Fort Calhoun Station.

2.3 HFO Events The licensee used screening assessments based on comparisons of plant design bases to the 1975 Standard Review Plan (SRP). Because FCS was not originally licensed under the 1975 SRP, the licensee also used deterministic boundmg and simplified probabilistic bounding analyses to demonstrate that risks associated -

with HFO events are low. In general, the licensee's methodology has followed the guidance in NUREG/CR-2300 [9] and Reference [3].

In addition, a screening analysis was performed, starting with the list from NUREG/CR-2300, to determine if any other signi5 cant hazards could affect the plant. The screening analysis for all other events revealed no significant vulnerabilities for FCS.

The details of the licensee's evaluation of high winds and tornadoes, external flooding, and transponation and nearby facility accidents, are provided in the following sections.

2.3.1 High Winds and Tornadoes 2.3.1.1 General Methodology )

A simplified probabilistic bounding assessment was followed in the licensee's HFO IPEEE, whereby the frequency of tornadoes of various intensities was combined with the probability of plant damage owing to tornadoes, and with the #Manni core damage probability given tornado-induced plant damage. The Energy Research, Inc. 25 ERl/NRC 96-502

, j

, following equation (which replicates Equation 5.2 of the submittal) summarizes the approach used for estimation of tornado-induced CDF:

Sem, tor u so

E t lk E P j ,,, 7 , ,,,

where f, is the frequency of tornado strikes at the plant within intensity interval k; Pgi s the conditional probability of damage state j given tornado intensity k; and P'm is the conditional core damage probability given damage state J. The conditional core damage probability was obtained by modification of the IPE fault tree model for weather-initiated loss of offsite power. The damage states were determinul by categorization of vulnerabilities identi6ed by a walkdown of the plant. The total CDF associated with loss 4

of offsite power accompanying the damage states was calculated to be less than 10 /ry.

The methodology and supporting database appears sound and consistent with the state-of-the-art, and the licensee used the analysis to demonstrate that the plant is robust against tornado hazards.

2.3.1.2 Plant-Specific Hazard Data and Licensing Basis Tornado loads represent the governing design basis for wind storms at FCS. Therefore, the licensee searched for vulnerabilities, and assessed risk of wind storms, with respect to tornadoes only. The design-

- basis tornado is a 300 mph wind with a 3-psi negative pressure for above grade structures. Most essential safeguard equipment is located in the auxiliary building below grade, which is claimed to withstand a 500 mph wind velocity. The grade slab of this building was designed to withstand falling debris. The emergency diesel generator enclosure and the spent fuel storage pool structure were also designed to withstand a 500 mph tornado.

2.3.1.3 Significant Changes Since Issuance of the Operating License

- A plant walkdown was conducted to ensure that the design basis was still valid. It apparently was found to be so, except for the walkdown findings discussed in the next subsection.

2.3.1.4 Significant Findings and Plant-Unique Features The walkdown found that offsite power is susceptible at any tornado intensity. Winds greater than 100 mph would topple the containment roof crane, which was assumed to fail the EFWST within the auxiliary building. 'Ibe EFWST is itself also susceptible to a tornado missile that may enter the skylights perpendicular to the building roof. Emergency switchgear in Room 5 below the EFWST was found to be susceptible to flooding fmm EFWST failure (should the floor of Room 81 also sustain damage). And, the exposed condensate storage tank and the diesel-driven fire water pump in the intake structure were found to be susceptible to tornado missiles launched in wind speeds greater than 206 mph. These findings served as the baris for the plant damage state definitions in the probabilistic bounding analysis.

Except for the CST, safety-related tanks :.re inside buildings. The control room air conditioners are shielded from high winds. The submittal makes a cryptic statement that " tornado missile protection was -

screened based on PRA" without further explanation. It is typical for older plants to have a susceptibility Energy Research, Inc. 26 ERI/NRC 96502

,' - to tornado missiles with respect to the control room HVAC intake and the diesel generator intake and muhaust ducts. The latter concern was not mentioned in the sub:nittal.

2.3.1.5 . Hazard Frequency and Probabilistic Bounding Analysis The licensee used data specific to the vicinity of the FCS site for defining tornado occurrences as a-function of Fujita intensity class. Tornado strike frequencies were determined from analysis of the National Severe Storm Forecast Center tornado database, using data from 1950 to 1990 over a radius of 125 nautical milt around the site. The tornado strike frequency was found to be about 2 x 10d/yr at the site.

The following plant damage states, all of which occur in conjunction with loss of offsite power, were defined:

e loss of EFWST

' . loss of CST

- loss of CST and fire pump in intake structure e loss of CST and EFWST

loss of EFWST and switchgear room e loss of EFWST, switchgear room, and CST The fire pump is used to transfer water to the EFWST. The CST is a back-up water source to the EFWST. Room 56 (switchgear room) floods if the EFWST fails and the intervening floor is damaged.

The missils strike probability was calculated individually for the CST, the fire pump, and the EFWST.

A conditional probability of 0.1 was assigned to the coincident damage of the floor, such that Room 56 becomes flooded. Except for the CST, the conditional probabilities of occurrence of the plant damage states were estimated from the individual tornado missile strike probabilities. The probability of CST failure was assessed as the combined probability of tornado missile strike and crane impact.

The weather-induced loss of offsite power IPE event-treelfault-tree model was modified to calculate the conditional core damage probability for each tornado class and plant damage state.

4 The overall tornado missile CDP was assessed as being about 5x10 /ry. Sensitivity studies were performed to investigate the effects of the assumed number of potential missiles at the site, the missile impact parameter for the EFWST, and the conditional probability of EFWST floor failure given failure by missile impact of the EFWST.

The overall process followed by the licensee appears to be consistent with the state-of-the-art.

2.3.2 External Flooding 2.3.2.1 General Methodology i i

Army Corps of Engineer estimates of frequency versus flood level were used for both periodic floods (owing to excessive precipitation along the Missouri river and its tributaries) and for flood caused by -

' upstream dam breaks. *ne assumed dam-break scenario would send a crest of water 25 feet above site grade approximate!y 3.9 days after breach of the Oahe earthen dam. This event was assumed t; cause core Energy Research, Inc. 27 ERI/NRC 96-502

' damage. A bounding probabilistic analysis was used for periodic floods, in which damage and conditional core damage probabilities were assessed as a function of flood level. A walkdown was performed to

~

- discover plant-specific flood vulnerabilities. The methodology appears sound and consistent with the state of the an. The licensee used the analysis as a basis for making plant improvements.

2.3.2.2 Plant Specific Hazard Deta and Licensing Basis The plant design-basis flood is 2 feet above grade, which at the time of issuance of the plant operating license, represented a conservative estimate of the 1000-year flood. There is no effective means of flood control if the water level rises more than 9.5 feet above grade. The probable maximum precipitation (PMP) for whhh site drainage will still be effective is 18 inches /hr. The submittal noted that building roofs have a6 equate drrinage capability, and that they can withstand a roof-ponding load caused by plugging of all drains.

2.3.2.3 Significant Changes Since Issuance of the Operating License Updated studies by the Army Corps of Fagin=s concluded that the dam-break flood would provide water levels 15 feet higher than was estimated for the operating licensee (OL). These updated studies also estimate that periodic flood levels are approximately three feet higher than were estimated for the OL.

Thus, the 1000-year flood is at least 5 feet over grade. A site walkdown searched for flood water entry locations and found two conduits, one leading into the intake structure and one leading into the auxiliary building. These conduits were plugged.

2.3.2.4. Significant Findings and Plant-Unique Features The periodic-flood CDF was assessed as being 2 x 10-8/ry, and the dam-break flood frequency was assessed 4

at 5 x 10 /yr. These results provided the licensee incennve to modify procedures and to stage four portable pumps that could draw flood water into either the EFWST or the steam generators. The procedures included actions to close flood doors, close flood gates, sandbag, and build temporary levees. The submittal states that these actions can retard the ingress of water such that plant shutdown is possible for a water level up to 9.5 feet above grade. Beyond this level, there is no effective means of preventing core damage. The submittal noted that the plant would flood approximately 2.6 days after a dam break. A

. peak flood elevation of 25 feet above grade would occur about 3.9 days after the original dam failure.

About 34 hours3.935185e-4 days 0.00944 hours 5.621693e-5 weeks 1.2937e-5 months notice would be provided for periodic floods.

Regarding GI-103, the effects of the PMP on site buildings and site grounds were addressed. The containment is dome shaped and does not collect water. The other buildings have multiple roof drains with

roofs that slope toward the drains, and the roofs have been designed to handle a roof-ponding load with all drains plugged. The site is on higher ground than the surrounding area, and the PMP will drain to the surrounding lower elevations.

2.3.2.5 Hazard Frequency and Probabilistic Bounding Analysis The assessment for dam-break floods, before plant improvements, was simply to assume core damage given a dam breach. The frequency, derived from the Army Corps of Engineers study, was given as .

4 5 x10 /yr. Failure of the four staged ponable pumps to provide cooling to the core, as described above, was then factored into the analysis. A reliability analysis of the four-pump installation showed an Energy Research, Inc. 28 ERI/NRC 96-502

unreliability of about 1.3 x 10 per demand. By applying this unreliability to the above calculated dam break frequency, the new CDF for dam break induced flood was estimated to be about 6x104 /ry.

Periodic floods at the plant site, owing to heavy rain or snow, would occur approximately 34 hours3.935185e-4 days 0.00944 hours 5.621693e-5 weeks 1.2937e-5 months after flooding of upstream tributaries (approximately 100 miles upstream of the site). Flood damage states at '

each level of flood, up to 9.5 feet above grade, were identified. A simplified probabilistic bounding analysis was conducted, as a function of flood level, using Army Corps of Engineers hazard data. The frequency associated with each flood level was developed from Army Corps of Engineers data. For example, flood levels in the interval 2 to 3.5 feet above grade have a return period of about 167 years, and flood levels in the interval 5.5 to 6.8 feet above grade have a return period of about 1667 years. The boundmg assessment took advantage of the procedural modifications that called for closure of flood gates i and sandbagging. As the water level reached the protected height of each power source (e.g.,161 kV and 1 345 kV) or building (e.g., intake structure, turbine, and auxiliary building) or structure (e.g., diesel oil storage vent, diesel air intake), all equipment within was assumed to fail. Conditional core damage i probabilities, given a flood level and assumed damage, were obtained from the IPE fault tree model for !

4 loss of offsite power. Before improved procedures, the estimated CDF for periodic flood was 2 x 10 /ry. !

After improvements, and E-ring for the potential failure to successfully sandbag, a CDF of 3 x 104/ry was estimated. Sandbagging and flood gates can allow a safe shutdown up to 9.5 feet above grade. The ;

conditional core damage probability given a flood above this level is unity.

The licensee stated that portable pumps were not credited for the precipitation-induced periodic' floods, because such floods do not provide enough advance warning to provide sufficient time to set up the pumps.

An interesting paradox is mentioned in the submittal. Because there is sufficient advanced warning for ,

dam break induced floods, the procedure calls for cold shutdown with RHR system shutdown cooling !

mode. When the flood occurs, there is a possibility of a LOCA outside of containment if both the RHR suction valves are not closed and the emergency provision for steam generator cooling falls. Because there is insufficient advanced warning for periodic floods, the analysis assumed that RHR shutdown cooling mode is not entered. Thus, the analysis does not admit to a possibility of LOCA outside of containment for this scenario. It was stated that offsite releases would be minimal in the event of a LOCA outside of containment because the discharge would take place under the flood wate'rs.

2.3.3 Transportation and Nearby Facility Accidents 2.3.3.1 General Methodology The licensee surveyed owners and operators of transportation and nearby facilities within a five-mile radius of the plant, in an effort to obtain current information. The analysis evaluated the potential for point- 1 source explosions and vapor explosions to damage plant structures. The analysis also evaluated the CDF l associated with the potential for toxic material releases to incapacitate the operators. Conservative estimates of quantities of materials were made. The following hazards were considered:

1

Toxic material release, explosions, and fire on the Blair railroad track both offsite and on site i Toxic material release, explosion, or fire owing to rupture of a tank truck on U.S. Highway 73/75 { '

Toxic material release owing to rupture of tank trucks on U.S. Highway 30 -

Explosion owing to rupture and leak of liquid petroleum gas (LPG) and natural gas pipelines Toxic material release from nearby pipeline and fixed storage facility l

Energy Research, Inc. 29 ERI/NRC %-502 1

i

j i

l e

l Explosions at nearby gas stations, stone quarry, and manufacturing facilities j

Aircraft crashes e Barge explosion and Lxic material accidents on the Missouri River 2.3.3.2 Plant Speckfic Huard Data and Licensing Basis 1

The plant licensing basis was not discussed. Huard frequencies for release of toxic materials from pipelines, facilities, and transportation venues were provided without explanation or references, although they appear reasonable. Frequencies of explosions or fires were not developed because screening was based on potential overpressure at the site.

2.3.3.3 - Significant Changes Since Issuance of the Operating License l

The submittal does not contain information about relevant changes since the time of issuance of the plant j OL. The analysis reviewed any changes to facilities, pipelines, and transportation venues that the j licensee's survey uncovered.

2.3.3.4 Significant Findings and Plant Unique Features All hazards were screened out on the basis of: (1) low CDF for toxic materials; (2) no potential to damage the plant (for explosions and fires); or (3) low CDF for vapor explosions, owing to on-site rupture of a i rail tanker containing gasoline. . Plant-unique features were not identified, and were not evident. {

Aircraft crashes were screened out owing to: (1) a combination of distance and traffic of nearby airfields; and (2) a low frequency of crashes owing to overflights.

A screening analysis, starting with the huards listed in NUREG/CR-2300, demonstrated that no other huards are significant for FCS.

2.3.3.5 Hazard Frequency and Probabilistic Bounding Analysis With respect to toxic material releases, frequencies of accidental releases of materials were estimated, and a Gaussian dispersion model was used to predict the cloud movement toward the control room. Core damage frequency was estimated by using a conditional core damage probability of 104, which was based 1 i

on an assumed reactor trip with no operator action for four hours. Plant trip was selected as the initiating event because none of the hazards were found to damage buildings or equipment at the site. The CDP was estimated to be approximately 3 x 10*/ry.

With respect to explosion hazards, the more lenient of two plant damage criteria we used: 1 psi !

overpressure, or the force needed to withstand a 100 mph wind. A calculation was made of the quantity l of material necessary at the location of nearest approach, or fixed location, to cause the criterion to be met.

. In all cases, the potential storage or release of material was found to be less than the selected criterion.

Pipeline accidents assumed a full rupture for 15 minutes, followed by a 1-hour leakage duration for an j equivalent 1-inch diameser leak. Explosion was postulated to occur at the location of the lower !

flammability limit. . I The methods, assumptions, and results applied by the licensee for this analysis appear reasonable.

Energy Research, Inc. 30 ERI/NRC 96-502 j i

1

, . ~ ~ . . -__m. - . . _ - _ . . . - _ 1

2,4 Generic Safetv Issues (CRI-147. GSI-148. GSI-1M and GSI-172) 2.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control Panel Interaction" s GSI-147 addresses the scenario of a fire occurring in a plant (e.g., in the control room), and conditions which could develop that may create a number of potential control system vulnerabilities. Control system interactions can impact plant risk in the following ways:

Electrical independence of remote shutdown control systems

. Loss of control power before transfer

Totalloss of system function

Spurious actuation of components The licensee evaluated hot shorts leading to LOCAs and interfacing system LOCAs. Since the submittal has followed the guidance provided in FIVE concerning control system interactions, all circuitry associated with remote shutdown is assumed to have been found to be electrically independent of the control room.

2.4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" GSI-148 addresses the effectiveness of manual fire-fighting in the presence of smoke. Smoke can impact plant risk in the fo!!owing ways:

By reducing manual fire-fighting effectiveness and causing misdirected suppression efforts

By damaging or degrading electronic equipment

. By hampering the operator's ability to safely shutdown the plant

By initiating automatic fire protection systems in areas away from the fire Reference (16] identifies possible reduction of manual fire-fighting effectiveness and causing misdirected suppression effons as the central issue in GSI-148. Manual fire fighting was credited only in the control room analysis. No specific information was provided concerning the potential for smoke to reduce manual fire-fighting effectiveness or misdirect suppression effons.

2.4.3 GSI-156, " Systematic Evaluation Program (SEP)"

GSI-156 addresses issues encountered at plants that were licensed prior to the time the 1975 Standard Review Plan (SRP) was issued. Among other concerns, GSI-156 issues relate to seismic; fire; and high winds, floods, and other (HFO) external events. Reference [16] provides the description of each SEP issue stated below, and delineates the scope of information that may be reported in an IPEEE submittal relevant to each such issue. 'Ihe objective of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-156 may be found.

Settlement ofFoundations and Buried Eqsdpment Den rintion of the Teena [16): The objective of this SEP issue is to assure that saf."ty-related structures, systems and components are adequately protected against excessive settlement. The scope of this issue .

includes review of subsurface materials and foundations, in order to assess the potential static and seismically induced settlement of all safety-related structures and buried equipment. Excessive settlement Energy Research, Inc. 31 ERI/NRC 96-502

-<ea~

gm, . e ., -.

o; or collapse of foundations could result in failures of structures, interconnecting piping, or control systems, such that the capability to safely shutdown the plant or mitigate the consequences of an accident could be ;

comprised. This issue, applicable n'ainly to soll sites, involves two specific concerns:

)

e potential impact of static settlements of foundations and buried equipment where the soil might not have been properly prepared, and a seismically induced settlement and potential soil ilquefaction following a postulated seismic event.

Static settlements are not believed to be a concern, and the focus of this issue (when considering relevant information in IPEEEs) should be on seismically induced settlements and soil liquefaction. It is anticipated -

that full-scope seismic IPEEEs will address these concerns, following the guidance in EPRI NP-6041.

Section 3.1.1.1 of the Fon Calhoun IPEEE submittal provides a gewal discussion of site soil propenies.

FCS is a soil site, with buildings supported by pipe piles extending through about 65 to 75 feet of sandy soil to underlying bedrock. The seismic IPEEE has considered the potential for soil liquefaction. Sections 3.1.4.1.2, 3.1.4.3 (page 3-90), 3.1.4.3.1, and Tables 3.15, 3.19, and 3.21 of the submittal present information related to the significance of soil liquefaction in the IPEEE study. In addition, Section 5.4 (including Tables 5.4.1 and 5.4.2) of the submittal provide some brief information on justifications for screening out the following soil-related hazards: erosion, landslide, and soil shrink / swell.

Dam integrity and Site Flooding D-rintinn of the kene [16): The objective of this issue is to ensure the ability of a dam to prevent site flooding and to ensure a cooling water supply. The safety functions would normally include remaining stable under all conditions of reservoir operation, controlling seepage to prevent excessive uplifting water pressures or erosion of soil materials, and providing sufficient freeboard and outlet capacity to prevent overtopping. Therefore, the focus is to assure that adequate safety margins are available under all loading conditions, and uncontrolled releases of retained water are prevented. The concern of site flooding resulting from non-seismic failure of an upstream dam (i.e., caused by high winds, flooding, and other events) is addressed as part of the SEP issue " site hydrology and ability to withstand floods." The concerns of site flooding resulting from the seismic failure of an upstream dam and loss of the ultimate heat sink caused by the seismically induced failure of a downstream dam should be addressed in the seismic portion of the IPEEE. The guidance for performing such evaluations is provided in Section 7 of EPRI NP-6041. As requested in NUREG-1407, the licensee's IPEEE submittal should provide specific information addressing this issue, if applicable to its plant. Information included for resolution of USI A-45 is also applicable to this concern.

The IPEEE submittal considers the potential flooding effects of upstream dam breaks. Sections 5.2.1 to 5.2.4 of the submittal discuss this aspect of the external flooding analysis. In addition, Section 3.2.5.2 describes an analysis of external flooding due to seismically induced dam breaks.

Site Hydrology and ANiity to Withstand Roods Description of the haue [16): 'Ibe objective of this issue is to identify the site hydrologic characteristics, ,

in order to ensure the capability of safety-related structures to withstand flooding, to ensure adequate Energy Research, Inc. 32 ERI/NRC 96-502

. cooling water supply, and to ensure in-service inspection of water-control structures. This issue involves assessing the following:

s

Hydrologic conditions - to assure that plant design reflects appropriate hydrologic conditions.

Flooding potential and protection - to assure that the plant is adequately protected against floods. ,

a Ultimate heat sink - to assure an appropriate supply of cooling water during normal and emergency shutdown.

As requested in NUREG-1407, the licensee's IPEEE submittal should provide information addressing these concems. 'Ibe concern relatert to in-service inspection of water-control structures, a compliance issue, is not being covered in the IPEEE.

The IPEEE submittal includes an evaluation of external flooding, which considers periodic floods, i probable maximum precipitanon, and dam breaks. Section 5.2 of the submittal discusses these aspects of the external flooding analysis. In addition, Section 3.2.5.2 describes an analysis of seismically induced external flooding due to dam breaks.

1 IndustrialHazards Deerintion of the Tuna [16): The objective of this issue is to ensure that the integrity of safety-related structures, systems, and components would not be jeopardized due to accident hazards from nearby facilities. Such hazards include: shock waves from nearby explosions, releases of hazardous gases, or chemicals resulting in fires or explosions, aircraft impacts, and missiles resulting from nearby explosions. !

As requested in NUREG-1407, the licensee's IPEEE submittal should provide information addressing this issue. ,

The Fort Calhoun IPEEE stbmittal (Section 5.3) includes the following information of relevance to this issue: pages 5-26 and 5-27 provide a general discussion of transportation and nearby facility accidents; Section 5.3.1 discusses toxic chemical hazards; Section 5.3.2 discusses explosion hazards; Section 5.3.3 discusses aircraft accidents; and Section 5.4 provides a screening assessment of other hazards.

Tornado Mssiles Dwrintien cf the teen * [16]: The objective of this issue is to assure that plants constructed prior to 1972 (SEP plants) are adequately protected against tornadoes. Safety-related structures, systems, and components need to be able to withstand the impact of an appropriate postulated spectrum of tornado-generated missiles. As requested in NUREG-1407, the licensee's IPEEE submittal should provide information addressing this issue.

The Fort Calhoun IPEEE submittal provides significant discussion of tornado hazards, including tornado-induced missiles, in Section 5.1. An analysis of tornado missile strikes is presented in Section 5.1.3.2, including Tables 5.3 and 5.4.

Energy Research, Inc. 33 ERI/NRC 96-502

Sewre Weather Efects on Structures Description of the Icena [16): The objective of this issue is to assure that safety-re*ated structures, systems, and componems are designed to function under all severe weather conditious to which they may be exposed. Meteorological phenomena to be considered include: straight wind loads, tornadoes, snow

' and ice loads, and other phenomena judged to be significant for a particular site. As requested in NUREG-1407, the licensee's IPEEE submittal should provide information specifically addressing high winds and floods. Other severe weather conditions (i.e., snow and ice loads) were determined to have insignificant effects on structures (see Chapter 2 of NUREG-1407).

The Fort Calhoun IPEEE has included evaluations of high winds and external floods. Section 5.1 of the submittal discusses severe wind effects, focusing on tornadoes; and Section 5.2 of the submittal discusses external flooding effects from periodic floods, probable maximum precipitation, and dam breaks.

Additionally, Section 5.4-(including Tables 5.4.1 and 5.4.2) mentions the basis for screening out other severe weather effects.

Design Codes, Oiteria, and Load Combinations Description of the Teen * [16]: The objective of this issue is to assure that structures important to safety should be designed, fabricated, erected, and tested to quality standards commensurate with their safety function. All structures, classified as Seismic Category I, are required to withstand the, appropriate design conditions without impairment of structural integrity or the performance of required safety functions. Due to the evolutionary nature of design codes and standards, operating plants may have been designed to codes and criteria wM:h differ from those currently used for evaluating new plants. Therefore, the focus of this issue is to assure that plant Category I structures will withstand the appropriate design conditions (i.e.,

against seismic, high winds, and floods) without impairment of structural integrity or the performance of required safety function. As part of the IPEEE, licensees are expected to perfonn analyses to identify potential severe accident vulnerabilities associated with external events (i.e., assess the seismic capacities of their plants either by performing seismic PRAs or SMAs).

The Fort Calhoun IPEEE has included an evaluation of potential severe accident vulnerabilities associated with external events. The submittal does not systematically identify codes, criteria, and load comb m

ations used in design. However, Sections 3.1.3.1, 3.1.4.1.1, 3.1.4.1.2, and 3.1.4.2.1 provide some limited information on the seismic design criteria and loadings for building structures, mechanical / electrical equipment, and piping. Some criteria and information regarding the plant's design provisions for l withstanding other external events are provided in Sections 5.1.3.1,5.2.1,5.2.3, and 5.3 of the IPEEE submittal.

Seismic Design ofStrucrures, Systems, and Components n mintinn of the haue [16): The objective of this SEP issue is to review and evaluate the original seismic design of safety-related structures, systems, and components, to ensure the capability of the plant to withstand the effects of a Safe Shutdown Earthquake (SSE).

The Fort Calhoun IPEEE is based on a focused-scope seismic margin assessment following the NRC methodology, as documented in Section 3 of the submittal. Sections 3.1.3.1,3.1.4.1.1, 3.1.4.1.2, and 3.1.4.2 provide information related to the seismic design and capacities of structures and components.

Energy Research, Inc. 34 ERI/NRC 96-502

-____ _ _ _ _ _ _ _ ~ _ . - _ . _.. _ -_

. j l

I Shutdown Systems and Electricalinstrwnentation and Control Features D=nlatinn of the i== [16]: The issue on shutdown systems is to address the capacity of plants to ensure reliable shutdown using safety-grade equipment. The issue on electrical instrumentation and control is to assess the functional capabilities of electrical instrumentation and control features of systems required for safe shutdown, including support systems. These systems should be designed, fabricated, installed, and tested to quality standards, and remain functional following external events. In IPEEEs, licensees were requested to address USI A-45, " Shutdown Decay Heat Removal (DHR) Requirements," and to identify l potential vulnerabilities associated with DHR systems following the occurrence of external events. The i resolution of USI A 45 should address these two issues, i The licensee provides discussion ofits treatment for resolution of USI A 45 for external events in Sections 3.2.1 and 4.9.1 of the Fort Calhoun IPEEE submittal.

2.4.4 GSI-172, " Multiple System Responses Program (MSRP)"

Reference [16] provides the description of each MSRP issue stated below, and delineates the scope of information that may be reported in an IPEEE submittal relevant to each such issue. The objective of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-172 may be found.

Common Cause Failures (CCFs) Related to Human Errors D=nintinn of the i== [16): CCFs resulting from human errors include operator acts of commission or omission that could be initiating events, or could affect redundant safety-related trains needed to mitigate the events. Other human errors that could initiate CCFs include: manufacturing errors in components that affect redundant trains; and installation, maintenance or testing errors that are repeated on redundant trains.

In IPEEEs, licensees were requested to address only the human errors involving operator recovery actions following the occurrence of external initiating events.

Information related to the treatment of operator recovery actions following seismic events is provided in the submittal in Sections 3.0 and 3.1.2, The submittal also includes fault tree logic models which explicitly contain human actions. The submittal addresses the treatment of operator recovery actions for fire events in Sections 4.0,4.6.7 and 4.8.4.

Non-Safety-Related Control System /Sqfety-Related Protection System Dependencies Danintian of the i== [16): Multiple failures in non-safety-related control systems may have an adverse irapact on safety-related protection systems, as a result of potential unrecognized dependencies between control and protection systems. The concern is that plant-specific implementation of the regulations regarding separation and independence of control and protection systems may be inadequate. The licensees' IPE process should provide a framework for systematic evaluation of interdependence between safety-related and non-safety-related systems, and should identify potential sources of vulnerabilities. The dependencies between safety-related and non-safety-related systems resulting from external events - i.e.,

concerns related to spatial and functional interactiors - am addressed as part of " fire-induced alternate shutdown and control room panel interactions," GSI-147, fur fire events, and " seismically induced spatial and functional interactions" for seismic events.

Energy Research, Inc. 35 ERI/NRC 96-502

.e ,

l Information provided in the Fort Calhoun IPEEE submittal pertaining to seismically induced spatial and fimetional interactions is identified below (under the heading Seismically Induced Spatial and Amerional interactions), whereas information pertaining to fire-induced alternate shutdown and control panel

-interactions has already been identified in Section 2.4.1 of this TER.

r Heat / Smoke / Water Propagation Efectsfrom Mres D=reintian of the funa [16): Fire can damage one train of equipment in one fire zone, while a redundant ,

train could potentially be damaged in one of following ways: I Heat, smoke, and water may propagate (e.g., through HVAC ducts or electrical conduit) into a second fire zone, and damage a redundant train of equipment. i A random failure, not related to the fire, could damage a redundant train.

Multiple non-safety-related control systems could be damaged by the fire, and their failures could affect safety-related protection equipment for a redundant train in a second zone.

A fire can cause unintended operation of equipment due to hot shorts, open circuits, and shorts to ground.

Consequently, components could be energized or de-energized, valves could fall open or closed, pumps l could continue to run or fail to run, and electrical breakers could fail open or closed. The concern of water propagation effects resulting from fire is partially addressed in GI-57, " Effects of Fire Protection System Actuation on Safety-Related Equipment." The concern of smoke propagation effects is addressed in GSI-148. The concern of alternate shutdown / control room interactions (i.e., hot shorts and other items ,

just mentioned) is addressed in GSI 147 -

Infonnation provided in the Fort Calhoun IPEEE submittal pertaining to GSI-147 and GSI-148 has already been identified in Sections 2.4.1 and 2.4.2 of this TER. Some information pertaining to this issue is provided in Sections 4.8.4 and 4.9.3 of the submittal.

Efects ofMre Suppression System Actuation on Non-Safety-Related and Safety-Related Equipment Demerintion of the Tuue [16): Fire suppression system actuation events can have an adverse effect on safety-related components, either through direct contact with suppression agents or through indirect interaction with non-safety related components.

Information pertaining to suppression-induced damage to equipment, as well as seismically induced inadvertent actuation of fire suppression systems, can be fourd, respectively, in Sections 4.8.4 and 4.9.3, and in Sections 4.8.1.2 and 4.8.1.3, of the IPEEE submittal.

l Ffects ofFlooding and/or Moisture intrusion on Non-Safety-Related and Safety-Related Equipment Darrintian of the Teena [16]: Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-related equipment. This type of event can result from external flooding events, tank and pipe ruptures, actuations of fire suppression systems, or backflow through parts of the plant drainage system. The IPE process addresses the concerns of moisture intrusion and internal floodmg (i.e., tank and pipe ruptures or backflow Energy Research, Inc. 36 ERI/NRC 96-502 w

a.

--w w,e d.o,4,--*e. m v ,w ,pp %_ m.ey wwe4=r v = - * --ew*++-, ;%e m , .. ~ + .n.- .-~

-i,

,. through part of the plant drainage system). The guidance for addressing the concern of external flooding is provided in Chapter 5 of NUREG-1407, and the concern of actuations of fire suppression systems is provided in Chapter 4 of NUREG-1407.

The following information is provided relevant to this issue: the Fort Calhoun IPEEE submittal discusses external flooding in Section 5.2; discussion is provided in Sections 4.8.4 and 4.9.3 regarding actuations of fire suppression systems; discussion of seismically induced inadvenent actuation of fire suppression systems is provided in Sections 4.8.1.2 and 4.8.1.3; and seismically induced internal and external floodmg is discussed in Section 3.2.5.

A Seismically induced Spatial and hnctional interactions Dancrintian of the T== [16]: Seismic events have the potential to cause multiple failures of safety-related systems through spatial and functional interactions. Some particular sources of concern include: ruptures in small piping that may disable essential plant shutdown systems; direct impact of non-seismically qualified structures, systems, and components that may cause small piping failures; seismic functional interactions of control and safety-related protection systems via multiple non-safety-related control systems' failures; and indirect impacts, such as dust generation, disabling essential plant shutdown systems. As pan of the IPEEE, it was specifically requested that seismically induced spatial interactions be addressed during plant walkdowns. The guidance for performing such walkdowns can be found in EPRI NP-6041.

The Fon Calhoun IPEEE has included a seismic walkdown which investigated the potential for adverse physical interactions. The submittal states that EPRI NP-6041-SL and GIP guidelines were followed in l the seismic walkdowns. Relevant information can be found in submittal Sections 3.0,3.1.1.2,3.1.4.1, l 3.1.4.2, 3.1.4.3, 3.2.5 and 4.8.1, as well as Table 3.19. In addition, the fault tree models explicitly include spatial and functional interaction failures as described in Section 3.1.2.2.

Seismicallyinduced Rres Dancrintinn of the Isena [16): Seismically induced fires may cause multiple failures of safety-related systems. - The occurrence of a seismic event could create fires in multiple locations, simultaneously degrade fire suppression capability, and prevent mitigation of fire damage to multiple safety-related systems. Seismically induced fires is one aspect of seismic fire interaction concerns, which is addressed

' as pan of the Fire Risk Scoping Study (FRSS) issues. (IPEEE guidance specifically requested licensees to evaluate FRSS issues.) In IPEEEs, seismically induced fires should be addressed by means of a focused seismic-fire interactions walkdown that follows the guidance of EPRI NP-6041.

The Fort Calhoun IPEEE submittal provides discussion regarding seismically induced fires in Sections 3.2.6 and 4.8.1.1.

\/ Seismically induced Mre Suppression System Actuation Dacerintian of the Teena [16): Seismic events can potentially cause multiple fire suppression system actuations which, in turn, may cause failures of redundant trains of safety-related systems. Analyses currently required by fire protection regulations generally only examine inadvenent actuations of fire suppression systems as single, independent events, whereas a seismic event could cause multiple actuations of fire supptassion systems in various areas.

Energy Research, Inc. 37 ERI/NRC %-502

, . . + . ~ . , - . . _ m-----e -.v.-.w.~- _, . . - . , _ .,,

Information pertaining to seismically induced inadvertent actuation of fire suppression systems can be found in Sections 4.8.1.2 and 4.8.1.3 of the IPEEE subtrattal.

d SeismicallyInduced Flooding Daccrintinn of the Icen* [16): Seismically induced flooding events can potentially cause multiple failures of safety-related systems. Rupture of small piping could provide flood sources that could potentially affect multiple safety-related components simultaneously. Similarly, non-seismically qualified tanks .are a potential flood source of concern. IPEEE guidance specifically requested licensees to address this issue.

The submittal provides discussion regarding seismically induced internal and external flooding in Section 3.2.5.

,/ Seismicallyinduced Relay Gatter Dacerintion of the funa [16): Essential relays must operate during and after an earthquake, and must meet I one of the following conditions:

remain functional (i.e., without occurrence of contact chattering); !

be seismically qualified; or

be chauer acceptable.

It is possible that contact chatter of relays not required to operate during seismic events may produce some unanalyzed faulting mode that may affect the operability of equipment required to mitigate the event.

IPEEE guidance specifically requested licensees to address the issue of relay chatter.

The Fort Calhoun seismic IPEEE has included a bad actor relay assessment. Relevant information is provided in Section 3.1.2.5 of the submittal.

./ Emluation ofEarthquake Magnitudes Greater than the Safe Shutdown Eanhquake Description of the knue [16): The concern of this issue is that adequate margin may not have been included in the design of some safay-related equipment. As part of the IPEEE, all licensees are expected to identify potential seismic vulnerabilities or assess the seismic capacities of their plants either by parvisoir.g seismic PRAs or seismic margins assessments (SMAs). The licensee's evaluation for potential vulnerabilities (or unusually low plant seismic capacity) due to seismic events should address this issn.

The Fort Calhoun IPEEE has included a focused-scope NRC seismic margin assessment, as docume,nted in Section 3 of the submittal. The seismic input for the seismic margin assessment is described in Section 3.1.3 of the submittal.

v Efects ofHydrogen Dne Ruptures Descriptinn of the Teena [16]: Hydrogen is used in electrical gen::rators at. nuclear plants to reduce windage losses, and as a heat transfer agent. It is also used in some tanks (e.g., volume control tanks) as a cover gas. Leaks or breaks in hydrogen supply piping could result in the accumulation of a combustible mixture of air and hydrogen in vital areas, resulting in a fire and/or an explosion that could damage vital Energy Research, Inc. 38 ERI/NRC 96-502

, safety-related systems in the plants. It should be anticipated that the licensee will treat the hydrogen lines and tanks as potential fixed fire sources as described in EPRI's FIVE guide, assess the effects of hydrogen line and tank ruptures, and report the results in the fire portion of the IPEEE submittal.

In the IPEEE evaluation of seismically induced fires, attention was given to the potential for seismically induced failures of hydrogen lines and storage tanks. Relevant information can be found in Sections 3.2.6 and 4.8.1.1 of the subminal. Some related information, with respect to onsite explosion hnzards, is also provided in Section 5.3.2.

\

h l

Energy Research, Inc. 39 ERI/NRC 96 502

y

. 3 OVERALL EVALUATION AND CONCLUSIONS 3.1 Seismic

- The FCS seismic IPEEE appears to be a thorough and technically robust implementation of the NRC's seismic margin assessment (SMA) methodology, as documented in NUREG/CR-4334, with supplemental technology coming from EPRI-NP 6041 in the areas of response spectrum scaling, soil failure determination, and component screening guidance. The study took advantage of the coincidence of effort with the USI A-46 evaluation, by performing a combined set of seismic walkdowns. Particularly

- impressive was the manner in which the licensee's determination of plant HCLPF capacity was used to identify and correct potential seismic weaknesses at the plant. An extensive set of plant modifications, arising from correction of USI A-46 outliers, and from limiting core damage sequences, was documented in the submitta!.

The licensee has cited the conservative nature of the NRC SMA method it employed. The licensee used the SMA as a means of identifying potential seismic weaknesses at the plant. After identifying potential weaknesses, the licensee either performed additional analyses to discover seismic margin that was not

. apparent from the screening assessments, or scheduled plant modifications that it deemed cost-effective.

Due to the process of successive evaluations of plant HCLPF capacity, at increasing levels of ground motion, the licensee developed useful insights into the governing component failures as a function of ground motion.

Page 8-1 of the submittal, however, makes the claim that the plant HCLPF capacity increased from 0.02g PGA to 0.25g PGA, which corresponds to an approximate hundred-fold decrease in seismic risk because of plant improvements. This, somewhat ebullient claim belies a misunderstanding of the significance of the results of the SMA process that was used. A claim that, before plant improvements, core damage would occur at 0.02g cannot, in fact, be correct, unless the plant could not withstand its own SSE (or even its operating basis earthquake [OBE]). A closer look at the governing cutset shows that the 0.02g PGA 4 capacity was estimated based on relay chatter of six low ruggedness relays in the diesel geners'pr start )

- circuit. The diesel generators would not be called to start unless the plant suffered a loss of offsite power, which typically would not occur below an earthquake level of 0.lg PGA. The study, however, assumed a loss of offsite power as an initial condition regardless of earthquake level. The licensee, perhaps, temporarily confused a modeling artifact with reality. Therefore, the claim of a hundred-fold risk reduction and low initial plant HCLPF capacity should not be taken seriously.

Two major =p:nm had an interesting effect on the emphasis of the seismic study. The study's logic model for determining the plant HCLPF capacity assumed that offsite power and instrument air are unavailable (with unit probability) regardless of earthquake level. Thus, by assumption, potential success paths having to do with use of the PCS and closed-loop shutdown cooling are unavailable. (Closed-loop shutdown cooling mode uses the low pressure injection system, which depends on instrument air in that mode.) Auxiliary feedwater, backed up by feed and bleed, remains the only available st2ategy for core cooling. Identification of weaknesses that limit the plant HCLPF capacity focused on ensuring availability of the success paths that were part of the logic model. The licensee's efforts, therefore, focused on improving the' seismic margin of high pressure injection, long-term cooling with the auxiliary feedwater system, and electric power via MCCs.

l Energy Research, Inc. 40 ERl/NRC 96-502 1

i I

. . .,--~..-,,.nw.,~---..- - - ~ ~ ~ ~ ~ - ~ ~ ~ ~ ~ - - ~ . ~-

., )

i 4

, The licensee's staff was actively involved in the seismic study, and a competent peer review was provided.

' The submittal is complete enough to provide confidence that the guidance of NUREG-1407 was followed a with respect to seismic margin methodology. The comprehensive analysis performed in accordance with accepted practice, coupled with the peer review process employed, lends confidence with respect to the validity of the results and insights.

Susagths: )

1. The submittal was responsive to all elements of NUREG-1407 regarding the NRC seismic margins scope of work. l

2. The study took advantage of the coincidence of effort with the USI A-46 evaluation, by performing a combined set of seismic walkdowns.

3. The plant logic model included seismic, human, and random failures. Seismic failures also included spatial interactions and functional dependencies.

4.~ The determination of plant HCLPF capacity was used to identify and correct potential seismic weaknesses of the plant. ,

5. An extensive set of plant modifications, arising from correction of USI A 46 outliers and from limiting core damage sequences, was documented in the submittal.

6.- Spectral peik broadening was used as a way to account for uncertainties in demand response spectra. '

7. The walkdown findings inciuded discovery of plant anomalies and potential spatial interactions.

Seismic system interaction issues, concerning USI A-17, were e plicitly considered during the walkdown by development of spatial interaction tables, and spa.' interactions were included directly in the seismic logic models.

8. Liquefaction potential was assessed in a manner consistent with EPRI NP-6041.

9. 'An event tree based containment performance analysis was performed.

10. A seismically induced flood interaction study was performed, and its results led to improvements in plant procedures and to equipment modifications.

Weaknesses:

1. The assumptions ofloss of offsite power and loss of inw air for all sequences led to an overestimate of the significance of operator actions to replenish the EFWST, and prevented insights from being gained with respect to the PCS, instrument air system, and the RHR system.

2. The discussion of seismically induced fire issues did not include: (1) the effect of the proximity of non-lE cabinets to essential safety equipment; and (2) inadvertent fire protection system actuation.

Energy Research, Inc. 41 ERI/NRC 96-502

2,

, 3. The inference of the turbine building HCI2F capacity from the wind loading specifications may have underestimated the capacity and, thereby, overestimated the significance of the turbine building.

3.2 Bra The licensee expended considerable effon in the preparation of the fire analysis portion of its IPEEE. The IPEEE report complies with the conditions set fonh in Reference [3] The licensee has employed proper methodology and databases for conducting the fire analysis. Levels 1,2, and 3 PRA methodologies were employed, including a screening procedure and FIVE formulations for propagation analysis. The licensee has gained insights and an important experien::e from the exercise of inspecting every pan of the plant for fire vulnerabilities.

Strengths-

1. The submittal is well written. The overall presentation is clear and well organized. There are sufficient tables and figures to provide the necessary information to suppon the analysis and the conclusions.

2. The final core damage frequencies can be traced back to the initial fire frequencies. The reviewers were able to trace some of the calculations through the analysis.

3. State-of-the-art methodology and proper data have been used.

4. The multiw puumE fire propagation analysis is well presented. The overall methodology was proper and employs acceptable probabilistic arguments.

4

5. The screening of fire zones was based on a CDF threshold of 10 /ry, whereas typical industry practice uses 104/ry.

Weaknesses:

1. Sensitivity analyses have not been conducted. For example, the CDF associated with a fire in the cable spreading room was based on the frequency of fire and suppression system failure. It was i concluded that the CDF is less than 104 / ry. There are large uncenainties in this conclusion, since j the frequency is highly dependent on the assumptions of low fire ignition postibility and high fire suppression system effectiveness.

2. The licensee has screened out areas or control room panels / electrical cabinets that contain j Appendix R shutdown related circuits or equipment, because it was concluded that reactor trip is not a possible consequence of such a fire. This approach can lead to optimistic results if an exhaustive analysis of reactor trip circuits is not conducted.

3. In modeling the heat emanating from a fire, a heat loss factor of 0.85 was used instead of 0.7 (the value accepted by the NRC in the context of FIVE methodology). This situation may have lead to optimisms in the final results.

I I

- Energy Research, Inc. 42 ERI/NRC 96-502 l

- x - . - _ --

1

1 3.3 HFO Events Since FCS is not .a plant originally licensed under the 1975 SRP, the licensee used deterministic bounding analyses aad simplified probabilistic bounding analyses to supplement comparisons of the plant design-basis with the 1975 SRP, in order to demonstrate that risks associated with HFO events are low. In generai, the methodology has followed the guidance in NUREG/CR-2300 and Reference [3].

The present review has found the assessment to be in concert with the procedures and intent of ;

NUREG-1407 and GL 88-20, Supplement 4. l StrenFths:

1. The deterministic and probabilistic bounding analyses were an effective way to demonstrate low risk owing to HFO events.

2. The licensee instituted plant and procedural char.ses tr counter the site flooding scenarios.

3. The walkdowns identified potential wind and flood vulnerabilities which were accounted for in probabilistic bounding analyses.

4. The survey of transportation and nearby facility accidents encompassed toxic materials, explosions, fires, and vapor explosions.

5. The submittal provided an overall screening survey to eliminate all other hazards from consideration as significant risk contributors.

Weaknesses:

No significant weaknesses were noted.

Energy Research, Inc. 43 ERI/NRC 96-502

3,

, 4 IPEEEINSIGHTS, IMPROVEMENTS, AND COMMITMENTS 4.1 Seismic The overall plant HCLPF capacity of 0.25g PGA is controlled by liquefaction of soil outside the region of Category-I buildings. Failures owing to liquefaction, that affect core damage scenarios, include: loss of diesel generator fuel oil storage tanks, and loss of raw water system piping between buildings. The most likely core damage scenario at this earthquake level is an RCP seal LOCA with loss of high pressure injection when the. diesels run out of fuel (in about 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months ). The conditional large early release probability, given core damage, was found to be about 1 %, indicating low vulnerability for earthquake )

scenarios.

In the absence ofliquefaction, the plant HCLPF capacity would be dominated by failure of MCCs (at 0.27g PGA) and failure of RWS pumps (at 0.29g PGA). Table 4.1 contains a more detailed description of actions taken by the licensee to increase the plant HCLPF capacity.

The key plant modifications to be performed include: replacement of bad actor relays in the diesel generator lockout circuitry; repair or improvement of anchorages of MCCs, particularly related to CCS operation; and raw water system tie-in to the EFWST. The key detailed SMA capacity assessments were those for valves in the safety injection system. Analyses to demonstrate that room heatup is not a problem for MCCs, upon failure of HVAC fan units, were also considered essential to the effort.

The licensee also took action to reduce weaknesses with respect to seismic-fire interactions and seismic-flood interactions as follows:

Anchorage of unanchored cabinets that store flammable liquids is being pursued. J The 30" sight glasses on the diesel generator day tanks will be replaced with a more robust material.

The diesel-driven fire pmnp fuel oil tank in the intake structure is being anchored.

The junction boxes in Room 23 for containment sump valves, which are required to mitigate a small LOCA, will be water-proofed.

A modification to the shutdown heat exchanger will be made to increase its HCLPF capacity from 0.17g PGA to 0.3g PGA.

I 4.2 Bra To identify vulnerabilities, a set of closure criteria based on the NEI 91-04 document [17] were adopted. l The criteria are based on the overall core damage frequency or containment failure frequency, and on l

_ percent contributions to the overall frequencies.

Overall, the licensee has concluded that there are no significant fire vulnerabilities at Fort Calhoun Station.

Despite the assumption that a't cables and equipment are damaged in a fire area, no single fire area as ;

defined in the study, can cause are damage; other failures in other areas are required to do so. The cable Energy Research, Inc. 44 ERI/NRC %502

E .

', 1

spreading room may be an exception to this statement. However, the plant can be shut down from outside

the main control room using a procedure speci6cally designed for this purpose. The licensee has concluded

- that there is no credible fire that can propagate from one fire area to another.

The overall core damage frequency due to fire events, before the implementation of two procedural E changes, was found to be 9.25 x108/ry. This value is commensurate with fire PRA results obtained for other similar plants.~ AAer the implementation of procedural changes, the licensee has concluded that the CDF drops to 2.74x10-8/ry. The dominant fire scenarios luclude De control room, the east basement of the auxiliary building, the turbine building, and one of the electrical penetration areas.

One procedural change addresses the revision of AOP-6 to instruct operators to de-energize the PORVs if a control room fire occurs that does not require control room evacuation. The other procedural change l is to remove power from two valves that are at the primary / secondary interface, so that a control room fire does not cause an interfacing systems loss of coolant accident (ISLOCA).

The dominant core damage scenarios involve delayed damage, where recirculation is failed either from the fire itself or from random failures in addition to the fire event. Stuck-open PORV and ISLOCA were found to be the dominant contributors before implementing the procedural changes.

Similar results (with respect to relative ranking of fire scenarios and plant impacts) are obtained when the containment failure modes are considered and the relative risk ranking of fire areas is based on plant damage state frequencies, or on radionuclide exposure frequencies at varying distances from the power plant.

To further reduce the risk of a fire affecting plant safety, the licensee is in the process of developing a severe accident management program, where all fire scenarios leading to core damage with a frequency above 104/ry will be addressed explicitly.

The entire fire IPEEE effort has provided an opportunity for licensee engineers to improve their knowledge of the characteristics of the plant, and of how the plant would behave under fire conditions.

4.3 ' HFO Events The HFO walkdown with respect to high winds / tornadoes found that: offsite power would not be available at any tornado intensity; winds greater than 100 mph would topple the containment roof crane, which was assumed to fail the EFWST within the auxiliary building; the EFWST may fail owing to a tornado missile that enters the skylights perpendicular to the building roof; emergency switchgear in Room 51 below the EFWST may flood from EFWST failure (should the floor of Room 81 also sustain damage); and the exposed condensate storage tank and the diesel-driven fire water pump in the intake structure may fail owing to tomado missiles launched in winds greater than 206 mph. These findings served as the basis for defining the plant damage states for the probabilistic bounding analysis, which found that the risk owing to tornadoes is below the IPEEE reponing threshold.

Initial results from probabilistic bounding analyses for floods provided the licensee incentive to modify procedures and stage four portable pumps that could draw flood water into either the EFWST or the steam generators. The procedures, documented in AOP-01, Acts of Nature, included actions to close flood l doors, close flood gates, sandbag, and build temporary levees. The submittal states that these actions can j Energy Research, Inc. 45 ERI/NRC 96-502

retard the ingress of water such that plant shutdown is possible for a water level up to 9.5 feet above

grade. ~ Beyond this level there is no effective means of preventing core damage. Two conduits, one entering the auxiliary building and one entering the intake structure, were plugged to stop potential flood paths. The submittal notes that the plant would flood approximately 2.6 days after a breach of the Oahe {

earthen dam. A peak flood elevation of 25 feet above grade would occur about 3.9 days after the original l dam failure. About 34 hours3.935185e-4 days 0.00944 hours 5.621693e-5 weeks 1.2937e-5 months notice would be provided for periodic floods. After improvements, the 4

estimated core damage frequency for the dam-break-induced flood is 6x10 /ry, and the estimated core damage frequency for periodic flooding is 3 x 104/ry.

All transportation and nearby facility hazards were screened out on the bcis of: (1) low CDF for toxic material releases; (2) no potential to damage the plant (for explosions and fires); or (3) low CDF for vapor explosions, owing to on-site rupture of a rail tanker containing. gasoline. Aircraft crashes were screened out owing to: (1) a combination of distance and traffic of nearby airfields; and (2) a low frequency of crashes owing to overflights.

A screening analysis, starting with the hazards listed in NUREG/CR-2300, demonstrated that no other ;

hazards are significant for FCS. l l

i 1

I l

1 i

l i

1 l

Energy Research, Inc. 46 ERI/NRC 96-502

-~ _ _ . _ . . . . . . _ , _ ._ . . _ _ - . _ . _ _ . _ _ - _ . . ..

r ,

. j

. Table 4.1 Summary of HCLPF-Limiting Failure Modes and Plant Modifications i Plant HCLPF IJmiting Failure Mode Dominant Cut Sets Scheduled Modification Capacity (PGA) 0.Olg Chatter of six diesel Loss of offsite power; Replace relays with those generator lockout relays failure of at least one diesel having HCLPF capacity generator owing to lockout above 0.3g .

relay chatter; and additional non-seismic failures 0.05g Insufficient anchorage of Loss of offsite power and Weld MCCs to increase MCC-3B3, MCC-4C4, loss of component cooling anchorage HCLPF capacity MCC 4C2, when combined which causes loss of RCP to above 0.3g with non-seismic failure, seal cooling, RCP seal ca'tses loss of CCW failure, and failure of l shutdown cooling (via heat I exchangers)

O.lg Service building failure Loss of offsite power; Raw water system flow path causes HCV-2861 valve seismically induced small modified to remove need !

failure which, in turn, LOCA; failure ofloug- for HCV-2861 I causes flow diversion that term cooling owing to ,

falls raw water system. service building failure, '

which fails the RWS system.

Seismic failure of fire Loss of offsite power; Raw water system tie-in to pump or valve needed to seismic failure of the fire refill EFWST refill the EFWST after 8 pamps; turbine building hours of emergency failure causing failure to feedwater (EFW) refill the EFWST; and operation. operator failure to initiate alternate long-term cooling Paths Seismic failure of the loss of offsite power; Raw water system tie-in to turbine building fails an seismically induced small refill EFWST alternate make-up path te LOCA; failure oflong-term the EFWST, and also fails cooling owing to turbine diesel driven EFW pump building failure, which falls FW 54. Other non-seismic the RWS system failures are needed for core damage.

Energy Research, Inc. 47 ERI/NRC 96-502

e.

e 0.17g Diesel generator start air Loss of offsite power; Pre-tension air receiver receivers fail, thereby seismically induced failure retaining straps to improve preventing start of a diesel of two air receivers; and HCLPF capacity to 0.3g generator non-seismie failure of other diesel generator.

RWS heat exchanger Loss of component cooling Anchorage improvements anchorages fail,jeoparizing results, and other non. for those anchors that could heat removal from the seismic failure results in . not be demonstrated, by CCW system unmitigated seal LOCA. detailed SMA, to have a HCLPF capacity above 4 0.3g Failure of the CST fails Loss of offsite power; Raw water system tie-in to primary make-up supply to failure oflong-term cooling refill EFWST to be the EFWST owing to inability to make- installed up EFWST; and operator failure to initiate other cooling paths 0.24g Failure of MCC-4A1 and Seismically induced small Maintenance request to MCC-3B1, owing to loose LOCA or seal LOCA; replace anchor initiated, anchor bolt, falls CCW and failure of HPSI Final HCLPF capacity HPSI, causing seal LOCA estimated to be 0.27g with and no inventory control replaced anchor.

0.25g Soil failure results in Seismically induced seal No cost-effective failures of diesel generator LOCA (with loss of offsite modifications (DG) fuel oil storage tank, power); failure of diesels CST, RWS piping, service after 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

building equipment, and turbine building equipment; also causes small LOCA !

' and loss ofinventory control after day tank emptied.

Failure of TIC-3A 480 to Anchor replacement. Final 120V transformer, owing HCLPF capacity to be ;

to loose anchors 0.27g. '

i i

l Energy Research, Inc. 48 ERI/NRC 96-502 ;

, ~ , . _ . , . . . . ~ . -

4 4

0.27g Anchorage-governed Loss of offsite power; All well-anchored MCCs failures of several vital failure oflong-term were found to have a alternating current (AC) cooling, owing to failure of HCLPF capacity at this power MCCs .the MCCs and other level, and no cost-effective !

failures modifications were j identified.

0.29g Anchorage-governed Seismically induced seal No cost-effective )

failures of raw water LOCA (with loss of offsite modifications I system pumps power); failure to initiate HPSI or failure to initiate l

j long-term cooling (if HPSI succeeds)

I 1

l l

I l

l Energy Research, Inc. 49 ERI/NRC 96-502

c .,

i l 5 5 IPEEE EVALUATION AND DATA

SUMMARY

SHEETS Completed data entry sheets for the FCS IPEEE are provided in Tables 5.1 through 5.5. These tables have been completed in accordt.nce with the guidelines of Reference [12]. Table 5.1 lists the overall external events results. Plant-specific analyses were performed for earthquakes, fires, and external flooding. A seismic CDF is not provided because the NRC seismic margins methodology was conducted by the licensee, and a seismic CDP was not reported. Table 5.2 summarizes the lowest HCLPF capacities for important components. Table 5.3 provides the accident sequence overview for the seismic margins method. In completing this table, the review team's judgment was used to assign sequences, because the fault tree linking method was used, and specific cutsets are not provided in the submittal. Review team judgment was also used to identify systems considered in the analysis, because the relationships between systems and individual components and structures were not provided in the submittal. Descriptions of seismic accident sequences were not provided in the detail needed to complete the accident sequence detailed table for a seismic margins study. Tables 5.4 and 5.5 provide the fire overview and detailed sequence tables, respectively. Note, these tables are only partially completed due to the limited information on fire accident sequences available in the submittal.

1 I

l l

Energy Research, Inc. 50 ERI/NRC %-502 I

L . _ .._

7 -

e 2 0

5 n

d o %

o i n

l o e C f

r,m R k

s e a e

=

q N

/

t r i I o b l R

N m t

u E a o d ht i

r fo w _

l g _

a 7 _

t 2 t

o 0 _

)g _

( _

F _

P L 5 C 2 H 0 t

n l

a P

t s

l u

s e

R s 1 s t r

y r i s

5een F f /y y 6 5 l a

l v D 4 0- n 1

bE C E E a 5 a 4 3 g Tl a n n

r i

d n

e u t

x o E B

=

O S

t u

o g

n _

i n

e O S O S O S O O M u e

r S S _

c = _

S _

O _

s _

=

i _

sy _

l a

n a =

c m f i

u t s s i c

l w n e

t n e p

l a di e s di c. =

C c c t

n n t g c c a I _

A t

F n n y A l P h e

v i

d d s y i t

n c _

E e o n e it v o = r a

e i r

l o i r

l i

c i

t c

i t S e m F F W i F F a A t a s e

a l a

l a e l c

r o :g R N n r

n r

m e

a n br y i p s s r

n y t e e r r m s n e i.

g n t x

t x

t x t e a e ie a ht w r _

a E E E n N r e l

P I S T O u n _

S E _

!i !:

e 2

0 5-6 9

C R

ht N

/

I a R P E sn s

ei o ct cp ur i Sc s ce iD m

i s

)

0 e

1 S

n a

ht s

s l

e

(

F

)

r P

e L ht C o H e c X r

o t

s n en 2 e U Q c

w uo qit 2 T y i f l o e p Q S t

i c ht Si r i i

l i

g e

p i cc i s s r a

r S w me sD @ o

2. F t e r o

i e

r o U i 2 S c S ei S )

s U X Q

, t n S T T 2 b m S l

s e S S S 5 ai H n @ @ @

TeS U o p

n m M i a o c

M S

d e l l

)

g m a (

(

L F N E P L L L L R C r t e H 5 7 9 a e 2 2 e m 2 y 0 0 0 t

0 0 o n

0, o 0

1 d

, h 0 c e 8 6 i

h n 3 n

9 1 w 0 0 s 0 de i

e t R

n h )

g C i

u e m

t n

n ( / G p e s p

u e G n o k E C i u o s m h a u R R q e p r u t

a q U N m e P c ht N 8

, d n o t

n e m c.

n r

a 9 a C C e I R E :

0 s l t

s y

e0 ^ .

o S l p aR n r e w. o 4

t e v n r e hC , i t o e m S/ c C t

a a L l G v. f a

W R N w aE trR i

u e r o y t e c c u q t w s n

a i

v eU t s i o a i l

P R e

S(

pN i L

L M R rm l E

! 4 ; eI ll l ; ji: ,

lii }

t

, , )

_ I A d 2

_ *: 5 l 8 S, i e 0 T- 4 l 5 I

V, A "s e 6 r R O, e 9 -

e s -

e t e ,

O l

3 A %

C _

- u /

V O e s R .

b R T. ee N m i t

t r

O B

0 8

F N,

n u,

/

I R

I A S T-

. A y r E

, R I, a L L T 3 C m m

1 I 0 a 1 T 8 A s u

T- V e C, H, r a

s n R R B B

2 C e e

o P P L A S i

t c H, H 8 V r

e n U T- H, em u U C, I a F M M O C e n

d S S D A d e S, S I V a l

i , S H f a I P

I P

I P T-,

I

(

F W, T H H H W S N F E. E X 2 V E 5 F, T- A I t

S C, r W, E, R o

p F I S

l e p 4 J

S A

P _

b u I S C, a S C T- E, I S

T s A E

U, C D

P C,

w m , M E, R _

i e I W W J 1 C E _

r v S C S T- A I, _

e E A E P, E, t

f ) _

v y C C I, da -

l n R O T-D, R F

l b

3 e O S, W C H. b e

5c n t H t y -

le e M n e U C, 4

F H,

a m 3 bu aq M S E v T-,

5 C

X PW E i Fa s

5 TeS r i t

n P

O P

O W U D - (

t o I T A

A, S C N n F O 3 C

d e W L W -

T- X R R T, I i T- T- T T, U N- RO .

c T A, I c T- 2 5 O, A

) X, C C B g X R, R F(

R U R S, T- O R W J' P, A,

3 D TO P I C O U S D

D B C N H I C R I N

T- A, U, h 2 U M I.

t n- B 8 t

( C 5 T.

P, S S V. A, E S D A, I

U D S

AP P 3 B ). Y 8, T, C B, 2 A, kna N I R 5, L CM S W 1 m Ae T 5 n - b x

2 s

u t

e a

sy ue U v n s m, nu s s h

m u

o e

c n

e u

2 Q

1 S @

a s

f o

ue td e

Fos)a foSy/ fA e

^

isd ll f

tC ei e o(F %A%

d f

e i

o s

u e s

c n

l a q @ o V, m f o I C e r U et w4 s s S o nr a ,

L F U S

Xa 2

v a

O pl ypn a r

o uo t

t e

m S, u

W s

m m

a s t e

e a -

oSi m S s s A AWs3 a t

e n

s a

e4p ss aTo u r o (m ot s s

er S, m2 a mm t

m m

a t

A.

s n

R w

N t kr e nrd ee s sW m 4 e s

s y g

Su S, u t 1 n v0 o d r a E 0) sM e ts e l te4n mT l

ia m n P h T (- I S F A E f ! ,!j!lijii ' ! !$ k . !i j '

, l

1

2 0

5-i 6

r s 9 o e t

u C b R

- n .

N c t t /

I _

A R I

E _

4 -

a F

de l

i a

F t

r o

p p

l e u b S a s T m I

w i

e v

r y e l v n O O 4 e A t n

5c n R e l

ee P v 4 b p e E 5 aae r i t

TSt i F I n

n r e o d F i

c c

A w.

R /y r r

/y r

/y v

/y r

/y i

e v

F e W D 6 6 6 6 6 s P C E 0 E 0-E 0-E 4

E 0-E C

R 2 0 0 4 5 9 N

8 0 7 e 7 0 1 l r

5 4 4 3 2 1 i

e r

p l

a mu i

n S i m

D 5 8 0 7 3 s P 3 2 0 2 1 7 E 3- 3.- 5 3

3 4- E

- E S S S S S S F D D D D D D I n

P P P P P P o d

e n

e b

i s

n u

n a

o s b m .

h e m c l

a N r n C fo I P

t 4 C A

2 L

A 2 6 B

4 6 B

2 i

n e

s e

h c

r 4 3 4 3 0 4 b a e

A A A A A A a e

e s

m F F F F F F h e a T R N y g

t # 1 2 3 4 5 6 n : r e

a s l

P e

e n N E

,l .li':

1iIliI !

it! j

n f,

2 i

. 0 5

r o n. C R

R N m i. U HUM .

., R E

1 RF C,.

IGN r.

T a.

N CI2 E u.

M CI I N

I A I C .

T n.

N .

O FC2 .

C FCI w. .

CS2 6 7

CSI .

o AM3 n AM2 YY .

RR AMI .

AU DT C.

e NN AFW e l OE CV b

a BN NI 5 m.

SI T MFW r-d SG .

l e .

i .

a l y Y TB .

t e n RY T MSI

.c D AI O DR 5 ec 5 n l

e eu A

R P

NG

)

XT KNI I

S B

TT SGA 5GS

t. 5 b q .. 5 ae e r AR2 .

TSt i F Y a

YR C AR1 w n r R UR -

d e o A TI MNC LPR i..

i c

F I RVR EB c P HPR .

N .

A I CHP c.

a, R AI 2 W -

YRYN AI I P O RU1 ATI AcC .

C MNC I E E LPI R J

R P VN NI N.

I IPI I .,

w CHP ,

RCP YT Rf Ai MG Y

t B

PAD PAD m

nW E

s e.

I RT PSR r FNI i.. nh e PP0 V a

X R

RI RP5 wh e. c m.n h.

h c

. e

.s

.n I c.

n

. .e ,

F t C A

N I 6 8 6 8 wd h c

2 A 4 4 3 0 2 4

.,.m. r 4 2 A A A A . a

A F

3 A F F F F a, h e s

w. 3 F

. e R

N y ma s ru l , 1 2 3 4 5 6 P .

N E

!l: i! th l l I

e no I

6 REFERENCES a

1. " Enclosure to LIC-95-0130, Individual Plant Examination of External Events for Fort Calhoun I Station: Seismic, Fire, Tornado, Flooding, Transportation and Nearby Facilities Accidents, and Others Including Updates on Flooding, Transportation and Nearby Facilities Accidents," Omaha Public Power District, June 30,1995.

2. " Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities -

10CFR50.54(f)," U. S. Nuclear Regulatory Commission, Generic Letter 88-20, Supplement 4, June 28,1991.

3. J. T. Chen, et al., " Procedure and Submittal Guidance for the Individual Plant Examination of !

External Events (IPEEE) for Severe Accident Vulnerabilities," U.S. Nuclear Regulatory Commission, NUREG-1407, May 1991.

. 4. R. J. Budnitz, et al., "An Approach to the Quantification of Seismic Margins in Nuclear Power ;

Plants," NUREG/CR 4334, August 1985.

- 5. "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power ,

Research Institute, EPRI NP-6041-SL, Revision 1, August 1991. ;

6. "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power Research Institute, EPRI NP-6041, October 1988.

7. " Fire Induced Vulnerability Evaluation Methodology (FIVE) Plant Screening Guide," Electric Power Research Institute, TR-100370, April 1992.

8. " Fire PRA Implementation Guide (Draft)," EPRI Report Project 3385-01, January 1994.

9. "PRA Procedures Guide," American Nuclear Society and Institute of Electrical and Electronic Engineers, U.S. Nuclear Regulatory Commission, NUREG/CR-2300, January 1983.

{

(

10. R. T. Sewell, et al., " Individual Plant Examination for External Events: Review Guidance,"

l ERI/NRC 94-501 (Draft), May 1994.

11. "IPEEE Step 1 Review Guidance Document," U.S. Nuclear Regulatory Commission, June 18, 1992.

12. S. C. Lu, and A. Boissonnade, "IPEEE Database Data Entry Sheet Package," Lawrence Livermore National Laboratory, December 14, 1993.

y

13. " Response to Request for Additional Information (RAI) on Individual Plant Examination of External Events (IPEEE) (TAC No. M83623)," letter from T.L. Patterson, Omaha Public Power i District, to U.S. Nuclear Regulatory Commission, August 19,1996. i l

14. "Use of 0.85 Heat I.oss Factor iu IPEEE Fire Analyses," letter from S.K. Gambhir, Omaha Public l

Power District, to U.S. Nuclear Regulatory Commission, April 7,1997. 1

[

15. " Fire Events Database for U.S. Nuclear Power Plants," NSAC 178L, June 1992.

]

l Energy Research,Inc. 56 ERI/NRC 96-502 I

\

. . - - . . . . . -- . . ~ . .

-- - - . - . . ~ ...

c ,

- qo

16. " Staff Guidance ofIPEEE Submittal Review on Resolution of Generic or Unresolved Safety Issues (GSI/USI)," U.S. Nuclear Regulatory Commission, August 21,1997.

17. " Severe Accident Issue Closure Guidelines (Rev.1)," NEI 9104, December 1994.

I 1

l l

)

1 Energy Research,Inc. 57 ERI/NRC 96-502 k

ML20206M286

Contents

Text

SUMMARY

SUMMARY

SUMMARY

Navigation menu

ML20206M286

Text

SUMMARY

SUMMARY

SUMMARY

Navigation menu

Search