ML20212D641

Technical Evaluation Report on Submittal Only Review of Individual Plant Examination of External Events at Point Beach Nuclear Plant,Units 1 & 2. Final Rept

ML20212D641
Person / Time
Site:	Point Beach
Issue date:	03/31/1998
From:	Kazarians M, Modarres M, Sewell R AFFILIATION NOT ASSIGNED, EQE INTERNATIONAL, MARYLAND, UNIV. OF, COLLEGE PARK, MD
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20212D580	List: ML20212D577 ML20212D596 ML20212D641 ML20212D678
References
CON-NRC-04-94-050 ERI-NRC-96-505, NUDOCS 9909240037
Download: ML20212D641 (92)

Text

-

ERl/NRC 96-505 e

l TECHNICAL EVALUATION REPORT ON THE l

" SUBMITTAL-ONLY" REVIEUJ OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS l

AT POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 FINAL REPORT March 1998 1

l Energy Research, Inc.

P.O. Box 2034 Rockville, Maryland 20847-2034 Work Performed Under the Auspices of the United States Nuclear Regulatory Commission

' Office of Nuclear Regulatory Research Washington, D.C. 20555 Contract No. 04 94-050 /

l Attachment 1 i

99C 240037 990915 l PDR ADOCK 05000266 P PDR

7 l

1 ERI/NRC 96-505

(

1 l

TECHNICAL EVALUATION REPORT ON THE

" SUBMITTAL-ONLY" REVIEW OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS AT POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2 FINAL REPORT March 1998 M. Khatib-Rahbar PrincipalInvestigator Authors:

8 R. T. Sewell , M. Kazarians', and M. Modarres 8

Energy Research, Inc.

P.O. Box 2034 Rockville Maryland 20847 Work Performed Under the Auspices of the United States Nuclear Regulatory Commission Offee of Nuclear Regulatory Research Washington, D.C. 20555 Contract No. 04-94-050 3 Presently with EQE International, 2942 Evergreen Parkway, Suite 302, Evergreen, CO 80439 2 Kazanans & Associates,425 East Colorado Street, suite 545, Glendale, CA 91205 8 University of Maryland, Department of Matenals and Nuclear Engineering, College Park, MD 20 i

p

?'

l

< 1 TABLE OF CONTE!%TS EXECUTIVE

SUMMARY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vi PREFACE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv j

ABBREVIATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvi 1

1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1.1 Plant Characterization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I Overview of the Licensee's IPEEE Process and Important Insights . . . . . . . . . . . 2 1.2 2

1.2.1 Seismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1.2.2 Fire..............................................4  ;

l 1.2.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.3 Overview of Review Process and Activities . . . , . . . . . . . . . . . . . . . . . . . . . . 5 6

1.3.1 S eismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1.3.2 Fire..............................................7 7 l

1.3.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

8 2 CONTRACTOR REVIEW FINDINGS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1 S eismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1.1 Overview mi Relevance of the Seismic IPEEE Process . . . . . . . . . . . . .

8 2.1.2 Logic Mod e1s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10 2.1.3 Non-Sdamic Failures and Human Actions . . . . . . . . . . . . . . . . . . . . 11 1

l 2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape) . . . . . . . . . .

11  !

2.1.5 Structural Responses and Component Deman& . . . . . . . . . . . . . . . . . .

2.1.6 Screening Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 12 2.1.7 Plant Walkdown Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.1.8 Fragility Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.1.9 Accident Frequency Estimates . . . ........................14 16 2.1.10 Evaluation of Dominant Risk Contributors . . . . . . . . . . . . . . . . . . . .

18 2.1.11 ' Relay Chatter Evaluation . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . .

18 2.1.12 Soil Failure Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

19 l 2.1.13 Containment Performance Analysis . . . . . . . . . . . . . . . . . . . . . . . .

19 l 2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations . . . .

21 2.1.15 Treatment of USI A 45 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2.1.16 Treatment of GI 131 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 2.1.17 Other Safety lssues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . .

22 2.1.18 Process to identify, Eliminate, or Reduce Vulnerabilities . . . . . . . . . . .

22 2.1.19 Peer Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.2 Fire..................................................23 23 2.2.1 Overview and Relevance of the Fire IPEEE Process . . . . . . . . . . . . . .

24 ,

2.2.2 Review of Plant Information and Walkdown . . . . . . . . . . . . . . . . . . . 26 !

2.2.3 Fire-Induced Initiatmg Evems . . . . . . . . . . . . . . . . . . . . . . . . . . . l 27 2.2.4 Screening' of Fire Zow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

, 28 2.2.5 Fire Hazard Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11 ERI/NRC 96-505 Energy Research, Inc.

1 l

28 2.2.6 Fire Growth and Propagation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

30 2.2.7 Evaluation of Cornponent Fragilices and Failure Modes . . . . . . . . . . .

31 2.2.8 Fire Detection and Suppression . . . . . . . . . . . . . . . . . . . . . . . . . . .

32 2.2.9 Analysis of Plant Systems and Sequences . . . . . . . . . . . . . . . . . . . . .

............ 33 2.2.10 Fire Scenarios and Core Damage Frequency Evaluation 33 2.2.11 Analysis of Containment Performance . . . . . . . . . . . . . . . . . . . . . . .

34 2.2.12 Treatment of Fire Risk Scoping Study Issues ..................

35 2.2.13 U SI A-45 1ssue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 1

2.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . .. .... ............ 36 f 2.3.1 High Winds and Tornadoes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 2.3.1.1 General Methodology . . . . . . . . . . . . . . . . . . . . . . .

36 2.3.1.2 Plant-Specific Hazard Data and Licensing Basis . . . . . .

2.3.1.3 Significant Changes Since Issuance of the Operating 37 License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

37 2.3.1.4 Significant Findings and Plant-Unique Features . . . . . .

38 2.3.1.5 Hazard Frequency . . . . . . . . . . . . . . . . . . . . . . . . .

38 2.3.1.6 Boundmg Analysis . . . . . . . . . . . . . . . . . . . . . . . . .

38 2.3.1.7 PRA Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39 2.3.2 External Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

General Methodology . . . . . . . . . . . . . . . . . . . . . . . 39 2.3.2.1 Plant-Specific Hazard Data and Licensing Basis . . . . . . 39 2.3.2.2 2.3.2.3 Significant Changes Since Issuance of the Operating 40 License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

40 2.3.2.4 Significant Findings and Plant-Unique Features . . . . . .

40 2.3.2.5 Hazard Frequency . . . . . . . . . . . . . . . . . . . . . . . . .

40 2.3.2.6 Bounding Analysis . . . . . . . . . . . . . . . . . . . . . . . . .

41 2.3.3 Transportation auf Nearby Facility Accidents . . . . . . . . . . . . . . . . . .

General Methodology . . . . . . . . . . . . . . . . . . . . . . . 41 2.3.3.1 41 2.3.3.2 Plant-Specific Hazard Data and Licensing Basis . . . . . .

2.3.3.3 Significant Changes Since Issuance of the Operating 42 License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

42 2.3.3.4 Significant Findings and Plant-Unique Features . . . . . .

42 2.3.3.5 Hazard Frequency . . . . . . . . . . . . . . . . . . . . . . . . .

42 2.4 Generic Safety Issues (GSI-147, GSI-148, GSI-156 and GSI-172) ..........

42 2.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control Panel Interaction" .

GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" . . . . 43 2.4.2 43 2.4.3 GSI-156, " Systematic Evaluation Program (SEP)" . . . . . . . . . . . . . . .

47 2.4.4 GSI-172, " Multiple System Responses Program (MSRP)" . . . . . . . . . .

52 3 OVERALL EVALUATION, CONCLUSIONS, AND RECOMMENDATIONS . . . . . .

52 3.1 Seismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.2 Fire..................................................53 56 3.3 HFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

IPEEE INSIGHTS, IMPROVEMENTS, AND COMMITMENTS . . . . . . . . . . . . . . . 58 4

58-4.1 Seismic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4.2 Fire..................................................59 iii ERI/NRC 96-505 Energy Research, Inc.

4.3 NFO Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

~

5 IPEEE EVALUATION AND DATA

SUMMARY

SHEETS . . . . . . . . . . . . . . . . . . . 65 6 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 l

l i

l

• l l

1 i

l l

J l

1 1

i l

l l

Energy Research, Inc. iv ERI/NRC %-505 l

l

('

c .

j l

l LIST OF TABLES Table 4.1 List of SPSA Non-Screened Components Having Computed HCLPF Capacities 61 Below (or just at) the RLE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Table 4.2 List of Open Issues and Plt.nt Improvements, as Noted in the IPEEE, Which May Enhance Seismic Safety . . . . . . . . . . . . . . . . . ..................63 1 ..........,,.......66 Table 5.1 External Events Results . . . . . . . . . . . . . . . . .

67 Table 5.2 PRA Seismic Fragility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

68 Table 5.3 PWR Accident Sequence Overview Table - For Seismic PRA Only . . . . . . . . .

69 l Table 5.4 PWR amdent Sequence Detailed Table - For Seismic PRA Only . . . . . . . . . .

PWR Accident Sequence Overview Table - For Wind PRA Only . . . . . . . . . .

. 70 Table 5.5 71 Table 5.6 PWR Accident Sequence Detailed Table - For Wind PRA Only . . . . . . . . . . . .

1 v ERI/NRC 96-505 Energy Research, Inc.

l

. EXECUTIVE

SUMMARY

This technical evaluation report (TER) documents a " submittal-only" review of the individual plant examination of external evems (IPEEE) conducted for the Point Beach Nuclear Plant, Units I and 2. This technical evaluation review was performed by Energy Research, Inc. (ERI) on behalf of the U.S. Nuclear Regulatory Commission (NRC). The submittal-only review process consists of the following tasks:

l

• Examine and evaluate the licensee's IPEEE submittal and directly relevant available documentation.

• Develop requests for additional information (RAIs) to supplement or clarify the licensee's IPEEE submittal, as necessary.

• Examine and evaluate the licensee's responses to RAIs.

• Conduct a final assessment of the strengths and weaknesses of the IPEEE subminal, and develop review conclusions.

This TER docimenn ERI's qualitative assessment of the Point Beach IPEEE submittal, particularly with respect to the objectives described in Generic Letter (GL) 88-20, Supplement No. 4, and the guidan presented in NUREG 1407.

Point Beach Nuclear Plant, Units 1 and 2 (denoted as Point Beach in this report) are operated by Wisconsin Electric Power Company (WE). The Point Beach IPEEE was performed by licensee and contractor personnel. The IPEEE submittal considers seismic; fire; and high winds, fioods, and other (HFO) external initiators. Table E.1 below summarizes key quantitative findmgs of the Point Beach IPEEE. The IPEEE freeze date was September 5,1990.

External Events Core Damage Fremency (CDF) Estimates for Point Beach Nuclear Plant .

CDF Contribution  % Contribution to (per reactor year) IPEEE CDF External Event 5.1 x 10 8 75.9 %

Internal Fires 1.3 x 10'8 19.5 %

Seismic

1. 0.5%

High Winds / Tornadoes 3.4 x 10 Accidents at Nearby Industrial

< 1 x 10

1. <0.1%

Facilities

1. < 0.1 %

Transportation ' < 1 x 10 2.8 x 10 4 4.2%

External Flooding 6.7 x 10'8 100.0 %

Total vi ERI/NRC 96-505 Energy Research. Inc.

Ucensee's IPEEE Process For the Point Beach seismic IPEEE, the licensee elected to perform a new level-1 seismic probabilistic safety assessment (SPSA), with a brief qualitative and quantitative (level-2) seismic contamment analysis.

The SPSA uses the existing individual plant examination (IPE) level-1 logic models and the existing IPE l level-2 containment event tree model for quantifying seismic risk. The SPSA approach makes use of a surrogate element to represent the seismic failure effects of all components that were screened out at a high-confidence of low-probability of failure (HCLPF) peak ground acceleration (PGA) level of 0.3g.

Simplified fragility calculations and detailed fragility calculations were performed for components that were not screened out. Seismic structural responses and component demands were determined using new three dunensional nonhnaar sail structure-interaction (SSI) dynamic response calculations based on existing dynamic building models. " e 10,000 yr madian 1989 Lawrence Livermore National Laboratory (LLNL) uniform hazard spectrum @w NUREG/CR-5250) for the Point Beach site was used to characterize the seismic input for the SSI analyses. The overall SPSA approach that was implemented generally follows the guidance described in NUREG/CR-2300. Plant seismic walkdowns were conducted using the procedures described in EPRI NP-6041-SL and in the Generic Implementation Procedure (GIP).

Walkdown efforts were coordmmed for evalunions pertaimng to the IPEEE and to Unresolved Safety Issue (USI) A 46. Seismic evaluation work sheen (SEWSs) were completed as part of equipment reviews. In general, the study addresses the major elamann of concern for seismic probabilistic risk assessment (PRA) of a focused-scope plant, as idemified by NUREG-1407. Aside from issues directly pertaining to safe shutdown and containment performance, the study considers relay chatter, soil failures, seismic-fire interactions, and applicable generic issues (GIs) and USIs.

The fire IPEEE analysis was based on the fire-inducad vulnerability evaluation (FIVE) methodology. This methodology, similar to other fire analysis techniques, has a graduated focus on the most important fire zones using qualitative and quanntanve screening crnana. The fire zones or compartments were subjected to several screening stages. In the first stage, a zone was screened out if it did not contain any safety-related equipment. In the later stages, a CDF of 104/ry was used for screening. The plant information gathered for AppaaMr R compliance has been used arranuvely. The IPE model has been used to establish J the possibility of experiencing core damage from a fire initiating event. The conditional core damage probability was based on the equipment and systems unaffected by the fire. The unconditional CDF was obtained by multiplying the frequency of a fire in a fire zone with the conditional core damage probability for that fire zone. For determming fire occurrence frequencies in specific fire zones, the database provided in the FIVE document has been employed. The fire frequencies were specialized for specific fire compartments, using weightmg factors based on the combustible loading, type, and number of components in a compartment. For fire propagation, the formulations provided in FIVE have been used. The licensee clauns that the data has been modified, using the Electric Power Research Institute's (EPRI's) Fire PRA Implementauon Guide, to reduce the conservatism in FIVE fire propagation analysis. The human actions considered in the IPE plant model have been included in the fire impact assessment. The human error probabilities have been modified to take into account the additional stress that could be caused by the occurrence of a fire. In addition to evaluatmg the tire CDF, the possibility of containment failure has also been considered.

i The HFO IPEEE analysis was based on bounding and screening methods, supplemented with some probabilistic calculations. The submmal concludes that there are no plant-specific vulnerabilities to severe accidents due to HFO events at the Point Beach Nuclear Plant. The HFO IPEEE process involved: (1) identification of potentially important HFO events; (2) performance of a quantitative screening process Energy Research, Inc. vii ER1/NRC 96-505

F e 4 based on the frequency of HFO evenu; and (3) performance of a bounding analysis, supplemented with PRA calculations, for some HFO external events. Among all HFO evems, tornadoes and external flooding were funher analyzed using ==ri'*tive bounding and/or PRA evaluations. Historical data were used for detemunmg straight wind, tornado, and external flood frequencies. Some site-specific data were used for the analysis of aircraft crashes, land transportation accidents, and nearby hazardous facility events. No formal PRA or bounding analysis was performed for transponation and nearby facility accidents. These events were screened-out due to low frequency of occurrence. Walkdowns were performed to inspect areas that were potentially susceptible to HFO events, and the results were reponed in the submittal. The submittal. relied heavily on the results and methods used in the NRC's repon on USI A-45, " Shutdown

! Decay Heat Removal Requirements," (NUREG/CR-4458), in which Point Beach was analyzed. 'As needed, the results of USI A 45 were reviewed and updated by the licensee to include changes since the time ofissuance of the NUREG/CR-4458 report.

Key IPEEE Mndings In the seismic IPEEE, a total of 459 items of equipment were evaluated during the seismic walkdowns; of these,195 components did not screen out. Calculations of seismic capacities for screened-in items revealed 26 components with fragilities below, or just at, the review level canhquake (RLE). Table 4.1 of this TER provides a summary of these component fragilities. Cable trays inside the cable spreading room were found to have the controlling seism.:. capacity (0.23g PGA median capacity, equivalent to a HCLPF capacity of about 0.09g PGA).' Flat-bottomed tanks and block walls were also identified as low-capacity items. The overall plant median capacity has been reported to be equal to 0.45g PGA, and the plant HCLPF capacity has been assessed at 0.16g PGA; these results account for non-seismic failures human errors. Without non-seismic failures and operator errors, the median and HCLPF estimates are reponed as 0.69g and 0.25g PGA, respectively. (These capacity assessments have been performed w respect to the 1989 LLNL madian 10,000-yr uniform hazard specumu [ UHS] shape; this spectral shape is signi6cantly different from the NUREG/CR-0098 median, 5%-damped spectral shape which is recommended in NUREG-1407 as the basis for reporting HCLPF capacities in a seismic margin assessment.) Mean seismic CDF values of 1.40x 10-8 per reactor-year (ry) and 1.31 x10'8/ry have been reponed, respectively, for the 1989 EPRI hazard results and the 1993 LLNL hazard results. The seismi frequency of early large release (noble gases, and up to 10% of volatiles), as determined from the Poin Beach seismic comamment performance analysis, has been reported as 1.26 x 10'8/ry, which is very nearly the same as the seismic CDF itself, and points to a potential seismic vulnerability in the automatic comminment isolation systera. Plant changes to resolve seismic outliers identified as pan of USI A-46 have been reponed in the IPEEE submittal. These changes (including the resulting increases in capacities of cable trays) are found in tne submittal to increase the plant HCLPF capacity from 0.16g PGA to 0.20g PGA. The following failures have been identified in the submittal as being the dominant basic events / components that contribute significantly to seismic CDF:

Seismic failure of cable trays in the cable spreading room j 1.

2. Failure of operators to safely shutdown from the remote shutdown panel outside the control room l

3. Seismic failure of the surrogate element

4. Seismic failure of cable trays outside the cable spreading room l l

viii ERI/NRC 96-505

, Energy Research, Inc.

1

t

+ ,

The following failures were identified as being of secondary inrportance:

5. Correlated seismic failures of 4.16kV station service transformers (X13 and X14) l

6. Correlated seismic failure of 480V load centers (IB03, IB04,2B03 and 2B04)

J Failure of operators to provide service water backup to auxiliary feedwater suction

{

7.

8. Failure of operators to provide service water backup to auxiliary feedwater suction (when condensate storage tank [ CST) level instrumentation fails)

9. Failure oflevel transmitter for CST

10. Seismically induced failure of 120 alternating current voltage (VAC) instrument buses (2Y01, 2YO2,2YO3,2YO4,2YO5 or 2YO6) due to block wall failure

11. Seismically induced failure of 120 VAC instrument buses (1Y01,1Y02,1YO3 or 1YO4) due to block wall failure Considering the SPSA resuhs (includmg sensitivity evaluations), the licensee conclud.:s that no significan seismic concerns have been discovered during the IPEEE.

With respect to the fire analysis, the licensee has reached the overall conclusion that there are no sigmficant fire vulnerabilities at Point Beach. Despite the assumption that all cables and equipment are damaged in a fire area or compartment, no single fire area or compartment was determined to (by itse

- be assocised with core damage. Other failures in other areas are also required. The cable spreading room may be an exception to this staramant However, the plam can be shut down from outside the main co room using the alternate shutdown panel and a procedure specifically designed for this purpose. The overall fire CDF was estimated at 5.11x104/ry. This value is commensurate with fire PRA results obtained for other similar plants. 'Ihe dominant fire scenarios include fires in: the control room, the cable e,preading room, the auxiliary feedwater pump room, the gas turbine room, the vital and non-vital switchgear rooms, the diesel genecator rooms, and the monitor tank room. The dominant core damage scenarios involve early damage, where a reactor coolant pump (RCP) seal loss of coolant accident (LOCA) occurs, and where safety injection is nemmarl failed. Containment failure was addressed only through the possibility of failing to close containment isolation valves. To further reduce the overall plant risk, the licensee is in the process of implementing a set of modifications. Two new diesel generators, which will have their own dedicated vital switchgears, are being added at the plant. The control system for the ,

auxiliary feedwater pumps is being modified to make the pumps independent of the non-vital switchgear l

room. The control room / cable spreading room fire procedure has been updated to include additional valves that have been identified as a result of the IPEEE.

Of all HFO evems, floodmg of the turbine building was determined to be the largest risk contributor, with 4

an esumated CDF of 2.8 x 10 /ry. The CDF contribution due to high winds was determined to be 3.4 x 104 /ry. Overall, the CDF contribution from HFO events was determined to be slightly more than 4% of the total external events CDF. For high winds, the dominant core damage sequences involve failure of both diesel generators. (A principal issue raised in the USI A-45 study of Point Beach was the susceptibility of the diese'. generator exhaust stacks to winds exceeding 240 mph. The plant is currently ix ERI/NRC 96-505 Energy Research, Inc.

4 l

I

a , , )

I installing two new diesel genermors which are enclosed in a new, separate building designed to withstand winds of up to 300 mph. The new diesels were not credited in the IPEEE, although the calculation shows that they substantially further reduce the already low CDF contribution from high winds.) Considering the location of Point Beach, the CDF associated with transportation and nearby facility accidents was

- bounded at less than 10# /ry.

Generic Issues and Unresolved Safety Issues The seismic IPEEE includes discussions pertaining to GI-131, USI A45, USI A46, and the Charleston I Earthquake issue. GI-131 is not, strictly speaking, applicable to Point Beach, because the flux mapping cat is not movable. However, the stationary ten-path flux mapping frame has already been modified by J

the mMinan of two laeral struts. For USI A45, the licensee has chosen to subsume resolution within its USI A46 program. Hence, this TER does not assess the appropriateness of the licensee's USI A45 evaluation. However, the subauttal notes that the major comribution to seismic loss of decay heat removal is attributable to failure of cable trays, which 's being addressed as part of USI A46. A significant effort l

in coordinanon of USI A46 and the seisn. c IPEEE has taken place for the seismic evaluation of Point '

Beach; however, USI A46 is being resolved separately from the seismic IPEEE. The Charleston l

Earthquake issue is considered to be resolved with the submmal's use of LLNL seismic hazard resultsi With respect to fire evems, the generic issues raised in the Sandia fire risk scoping study, and issues related to USI A45, have been addressed in the IPEEE submittal. Traarmant of the majority of these issues was included as part of the plant walkdowns conducted for the fire analysis, or via special studies that had been conducted prior to the preparation of the IPEEE in response to NRC generic letters or information notices. Seismically induced fires have been addressed. Hydrogen piping; combustible oils; and flammable u lils storage, -i==% and piping were identified as potennal sources of fire during an ear *W The adequacy of the anchorage has been verified for these items. The failure of the fire suppression system and the possibility of inadvertent fire suppression activation as a result of an earthquake have been addressed. The adequacy of fire barriers has also been addressed. The sp inspection and maintenance procedures utilized by Point Beach personnel mimmi= the possibilit  ;

~ barrier failure. Manual fire fighting has been partially credited in the IPEEE. The plant rnamtains a fire brigade which is equipped for the job and is subjected to regularly scheduled traimng and drills. T of equipment survival under all adverse phenomena caused by a fire has been addressed explicit considering the effects of combustion products, spurious actuation of a fire suppression system, an operator actions. The IPEEE has addressed operator actions and equipment and cable failures.

treatment of USI A45, the submittal addresses the potential for loss of decay heat removal under fire conditions. The plant is equipped whh a steam driven auxiliary foodwater pump that can be started lo

. through manual actions.

For HFO events, the IPEEE submittal does not describe any formal analysis of other safety issues. It does, however, state that some GIs/USIs have been studied in the IPEEE process and are considered closed. The submittal is primarily based on the Sandia study of USI A45 for Point Beach, as reported in NUREG/CR-4458; No new vulnerabilities were found in the IPEEE, and therefore, the licensee considers USl A45 to be closed. The submittal concludes that Point Beach is not threatened by flooding based on the probable maximum precipitation criteria. Accordingly, GI-103, " Design for Probable Maximum Precipitation (PMP)," is also considered to be closed.

x ERI/NRC 96-505 Energy Research, Inc.

l Sorne information is also provided in the Point Beach IPEEE submittal which pertains to generic safety issue (GSI)-147, GSI-148, GSI-156, and GSI-172.

Vulnerabilities and Plant Improvements 1 From the seismic IPEEE, the submittal reports no seismic vulnerabilities or identified concerns. The following thresholds were used for assessing seismic vulnerabilities with respect to accident prevention and mitigation, respectively: seismic CDF goal ofless than 10d/ry; and a seismically induced large fission-product release frequency goal of 104/cy. Since the seismic CDF is well below 10"/ry, the licensee finds no ' seismic vulnerabilities with respect to accident prevention. The submittal notes that the seismic early

' large release frequency has been estimated to be nearly the same as the seismic CDF, due to assumed failure of automatic containment isolation. However, the submittal notes that there should be sufficient time for opersors to manually isolate containmant, and the licensee correspondingly judges that less than 10% of all seismic core damage sequences will actually be followed by a failure to isolate. This judgment effecovely invalidates the initial findmgs of the seismic containment performance analysis, producing an 4

early large release frequency, due to seismic events, ofless than 10 /ry. (It is not clear why this modeling judgment was not directly incorpormed within the seismic containment performance assessment.) On this basis, the licensee concludes that there are no vulnerabilities at Point Beach associated with accident mitigation. The licensee's USl A 46 program, which overlaps with the seismic IPEEE, has identified a number of open issues requiring resolution. The open issues are discussed / identified in Section 3.1.4.3, Table 3.1.5-2, Section 7.3.5, and Section 8.4 of the Point Beach IPEEE submittal, with information  !

pertaining to their agna=d resolutions. Not all USI A 46 outliers are mentioned in the IPEEE; a complete {

list is provided in the licensee's USI A 46 Seismic Evaluation Report. Plant improvements that are being made in response to the IPE, and that will also have a beneficial impact on seismic safety, are discussed in Sections 7.3.1,7.3.2, and 8.4 of the submittal report. Table 4.2 of this TER summarizes the available i I

IPEEE fiadiaen concerning open issues and plant improvements that are significant to seismic severe acculem capability. Plant enhancements / resolutions include: fixing anchorage deficiencies on cable trays I and numerous equipment, as identified in USI A 46 evaluation; addressing concerns associated with Westinghouse Model ITH relays, as. identified in the USI A 46 evaluation; and adding two diesel generators and their support systems, as identified in the IPE. These various plant enhancament</ resolutions are either being implemented or are being planned for implementation. It is important to note that, even with these plant improvament<, there still remain a number of SPSA components having comparatively low seismic capacities (i.e., having HCLPF capacities less than the RLE). .

With respect to fire events, as mentioned above, the licensee has concluded that there are no fire vulnerabilities at Point Beach. However, based on the IPEEE and other deterministi.c analyses, the licensee has adopted several plant improvements that will reduce the fire risk. These improvements are

. focused on emergency power, the auxiliary feedwater system, and control room evacuation after a fire.

The dominant fire scenarios include fires in: the control room, the cable spreading room, the auxiliary feedwater pump room, the gas turbine room, the vital and non-vital switchgear rooms, the diesel generator rooms, and the monitor tank room. The dominant chain of events caused by a fire that leads to core damage includes failure of RCP seals, resulting in a LOCA and early core damage.

The HFO IPEEE for Point Beach finds no severe-acchient-related vulnerabilities from HFO new diesel generators, housed in a separate building which is more resistant to high winds, are being built.

Although high winds were not identified as being risk significant even without the new diesel generators, Energy Research, Inc. xi ERI/NRC 96-505 1

i

1 1

. . 1 1

I the addition of the new diesel generators will clearly further improve plant safety with respect to high l winds and tornadoes. Since the frequencies of damagmg tioods, as well as transportation and nearby l facility accidents, were assessed as being low, no specific fixes related to these initiators are planned.

Observations 1

The Point Beach seismic IPEEE addresses the major elements recommended in NUREG-1407 to be considered for seismic PRA evaluation of a focused-scope plant. The submittal itself provides a clear description of the seismic evaluation, h provides excepoonally full details in several aspects of the analysis, and the documentation is generally well written. The study provides useful information conceming dominant sequences, systems, components, and ground motions. Even though they derive principally from USI A-46 evaluation and from IPE findmgs, the identification and implementation of plant safety ,

l enhancements, as a result of the plant walkdowns and the IPE probabilistic safety assessment (PSA), has I produced some =='=%1 insights in response to the objectives of GL 88-20, for a focused-scope plant.

Fragility calculations have provided valuable informarian on the capability of plant components. The most significant review observations / conclusions that pertain to limitations of the seismic IPEEE insights are l noted as follows:

I. As presented by the licensee, the highest reported plant HCLPF spectrum (i.e., the 1989 LLNL uniform hazard spectral shape anchored to a PGA value of 0.25g) does not exceed even the plant's design spm.L== for frequencies less than about 4Hz.

2. Review of the IPEEE submittal points to a pamarW seismic vulnerability with respect to automatic j

containment isolation which is manifested by a high probability of large, early release given a seismically induced core damage. However, the licensee has not addressed this potential vulnerability, but has simply assumed that manual isolation would be achieved with at least 90 %

probabilky. No jusofication is provuled for this assumption of operator effectiveness in achieving manumf isolation.

4

3. The licensee's conclusion that USI A 46 improvements do not have a significant impact on plant safety is misleading and not well justified. A clear understandmg of the full benefits of the improvements has not been obtained.

4. The licensee's relay chatter evaluation has not been fully expanded beyond the scope of USI A-46, in order to address allIPEEE only systems. The licensee claims that chatter is acceptable for the 4 unanalyzed systems, on the grounds that operators could reset the relays; however, the SPSA does not model the failure of operators to perform such actions.

5. Discussions in the seismic-fire imeracnons assessment, especially pertaining to inadvertent seismic actuation of fire suppression systems and seismically induced failure of fire protection systems, do not adequately address all relevant concerns.

6. Although safety enhancements are planned (primarily for USI A-46 and IPE), the licensee has not proposed plant improvements / resolutions for several remainmg components that have low seism capacities, and which cause the plant HCLPF to be significantly lower than the RLE. (Examples include anchorage concerns, interaction concerns, potential failures of block walls, and potential xii ERI/NRC 96-505 Energy Research, Inc.

sf

failures of flat-bottomed tanks.) Procedures to improve operator reliability for CDF-dominant human actions have also not been proposed.

7. The surrogate element has been identified as a dominant seismic CDF contributor, and hence, finding < pertaining to true dominant risk contributors may be masked.

Regarding the fire IPEEE, it can be said that the licensee has clearly expended a significant effort on inspecting the plant for potential fire vulnerabilLies. Overall, the licensee has employed proper methodology and daa. 'Ibe licensee has displayed the willingness to make conservative assumptions and a thorough effort was conducted on analyses of the various fire issues and phenomena. However, several shortcommgs have been idesfied by this review which can undermme the licensee's conclusions regarding potential vulnerabilities. The most significant review observations / conclusions that pertain to limitations of the fire IPEEE insights are noted as follows:

1. The treatment of ialad=g events other than reactor trip may not be complete. The licensee claims that cable routmg and equipment locanon were reviewed, and yet could not identify any common areas where loss of offsite power may occur.

2. The licensee claims that hot shorts have been considered in the analysis since Appendix R information had been used which includes hot shorts. However, from the submitted information it is not clear whether the licensee has considered all initiatmg events in its Appendix R effort. This omission implies that the hot short (or spurious actuation) phenomenon may not have been properly addressed in the Appendix R analysis of this plant for the complete set of initianng events.

3. The cable spreading room and electrical equipment rooms contain oil filled transformers. If the oil is combustible, there is a potannat for a large 6re from severe transformer failure. The submittal does not address the potannal for a large fire or explosion in a transformer. Transformer fire or explosion may have sufficient energy to jeopardize the integrity of fire boundaries.

4. For several fire scenarios, the licensee has used unreasonably small time periods for damage and suppression.

5. From the conclusions ranched in the submittal, it can be inferred that the licensee has not given proper weight to the effects of transient fuels. Several compartments include cables from redundant trains, and yet, the licensee could not find a fire that could damage both trains simultaneously.

6. For some scenarios the suppression system failure probability is multiplied with the fire initiation frequency. This is not a proper practice if there are critical sets of cables and equipment located in a small region of a compartment. Thus, the possibility of damage to a critical set of cables or equipment (especially when they are within a small region within.a room) before the medium discharging from the suppression system takes effect was not considered.

Regarding the HFO IPEEE, the licensee appears to have developed an appreciation of severe accident behavior. The licenbee has gained a : " "-We understanding of the effects of straight winds, tornadoes, and external floods, and a qualitanve understanding of transportation and nearby facility accidents evenu.

Since the HFO portion of the IPEEE analysis was carried out by the licensee, without outside help, the licensee has gained significant insights regarding the severe accident behavior of Point Beach for HFO Energy Research, Inc. xiii ,

ERl/NRC 96-505 -

g

..? .*

f events. The CDF calculation for high winds and tornadoes took credit for the recovery of offsite power in as little as 30 minutes. The treatment of external flooding requires more supporting analyses to ensure that key components are well protected. The treatment of transportation and nearby facilities accidents appears quite adequate. 'Ihe submittal reports that no changes that may affect HFO events have occurred since the time the plant's operating license was issued.

l 4

It should be noted that the dommant HFO contributor to CDF is external flooding (2.8 x 10 /ry), and that the reported CDF is based on the assumed effectiveness of sandbagging the turbine building door (per emergency procedure). Without the credit for sandbagging, the frequency of a flood with the potential to directly lead to core damage (due to consequential floodmg of the auxiliary building) is between 3.69 x 10~

lyr and 2.53 x10d/yr (based on values presented in submittal Table 5.2.5-4).

l f

4 i

l l

i l

xiv ERI/NRC 96-505 Energy Research, Inc.

1 i

. l PREFACE The Energy Research, Inc., team members responsible for the present IPEEE review documented herein, include:

Seismic R. T. Sewell Bra M. Kazanans Hieh Winds. Floods and Other Erternal Events M. Modarres Review Oversieht. Coordination and Inteerntion M. Khatib-Rahbar, Principal Investigator A. S. Kuritzky, IPEEE Review Coordination R. T. Sewell, Repon Integration Dr. John Lambright, of Lambright Technical Associates, contributed to the preparation of Section 2.4 i following the completion of the draft version of this TER. l This work was perfonned under the auspices of the United States Nuclear Regulatory Commission, Office of Nuclear Regulatory Research. The continued technical guidance and support of various NRC staff is acknowledged.

i l

Energy Research, Inc. xv ERI/NRC 96-505

ABBREVIATIONS AC Alternating Current AFW Auxiliary Feed Water ASDV ' Atmospheric Steam Dump Valve CCW Component Cooling Water CDF Core Damage Frequency ,

l CDFM Conservative Deterministic Failure Margin CFR Code of Federal Regulations COE U.S. Army Corp of Engineers CSR Cable Spreading Room CST Condensate Storage Tank CVCS Chemical and Volume Control System CW Circulating Water  ;

DC Direct Current DHR Decay Heat Removal ECCS Emergency Core Cooling System ECI Emergency Coolant Injection EPRI Electric Power Research Institute ERI Energy Research, Inc.

FCIA Fire Compartment Interaction Analysis FIVE Fire Induced Vulnerability Evaluation Method FPS Fire Protection System GI Generic Issue GIP Generic Implementation Procedure (SQUG)

GL Generic Letter GSI Generic Safety Issue HCLPF High Confidence of Low Probability of Failure (Capacity)

HEP Human Error Probability HFO High Winds, Floods and Other External Initiators HVAC Heating, Ventilation and Air Conditioning IGLD International Great Lakes Datum IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events 1RS In-Structure Response Spectrum LLNL Lawrence Livermore National Laboratory LOCA Loss of Coolant Accident

= LOOP Loss of Offsite Power LOSP Loss of Offsite Power MCC Motor Control Center MDP Motor Driven Pump NRC United States Nuclear Regulatory Commission OBE Operating Basis Earthquake OL Operating License PBNP Point Beach Nuclear Plant PCS Power Conversion System PGA Peak Ground Acceleration Energy Research, Inc. xvi ERI/NRC 96-505

PMP Probable Maximum Precipitation PORV Power-Operated Relief Valve PRA Probabilistic Risk Assessment PSA Probabilistic Safety Assessment PWR- Pressurized Water Reactor RAI Request for AdditionalInformation RCP Reactor Coolant Pump RHR Residual Heat Removal RLE Review Level Earthquake RWST -

Refueling Water Storage Tank SEWS Seismic Evaluation Work Sheet SGTR Steam Generator Tube Rupture SMA Seismic Margin Assessment SPSA Seismic Probabilistic Safeiy Assessment SQUG Seismic Qualification Utility Group SRP Standard Review Plan SRT Seismic Review Team SSE Safe Shutdown Earthquake SSEL Safe Shutdown Equipment List )

SSI Soil-Structure Interaction SW Service Water TER Technical Evaluation Report i

UHS Uniform Hazard Spectrum USI Unresolved Safety Issue VAC Alternating Current Voltage WE Wisconsin Electric Power Company l

l l

Energy Research, Inc. xvii ERUNRC %505 i

1 INTRODUCTION This technical evaluation report (TER) documents the results of the " submittal-only" review of the individual plant examination of external events (IPEEE) for the Point Beach Nuclear Plant, Units 1 and 4 2 [1]. This technical evaluation review, conducted by Energy Research, Inc. (ERI), has considered various external initiators, including seismic events; fires; and high winds, floods, and other (HFO) external events.

The U.S. Nuclear Regulatory Commission (NRC) objective for this review is to determine the extent to which the IPEEE process used by the licensee, Wisconsin Electric Power Company (WE), meets the intent of Generic Letter (GL) 88-20, Supplement No. 4 [2]. Insights gained from the ERI review of the IPEEE subantal are imandad to provide a reliable pmWve that assists in mahng such a determinanan. This review involves a qualitative evaluation of the licensee's IPEEE submittal, development of requests for addnional information (RAls), evaluation of the licensee responses to these RAls, and finalization of the TER.

The emphasis of this review is on describing the strengths and weaknesses of the IPEEE submittal, particularly in reference to the guidelines established in NUREG-1407 [3]. Numerical results are verified for reasonableness, not for accuracy; however, when encountered, numerical inconsistencies are reported.

This TER complies with the requirements of NRC's contractor task order for an IPEEE submittal-only review.

The ramminder of this section of the TER. describes the plant configuration and presents an overview of the licensee's IPEEE process and insights, as well as the review process employed for evaluation of the seismic, fire, and HFO-events sections of the Point Beach IPEEE submittal. Sections 2.1 to 2.3 of this report present ERI's findings related to the seismic, fire, and HFO event reviews, respectively. Sections 3.1 to 3.3 summarize ERI's conclusions and recommendations from the seismic, fire, and HFO event reviews, respectively. Section 4 summartzes the IPEEE insights, improvements, and licensee ,

commitments. Section 5 includes completed IPEEE data summary and entry sheets. Finally, Section 6

)

provides a list of references.

1.1 Plant Characte tration Point Beach Nuclear Plant is a dual-unit,2-loop Wesunghouse pressunzed water reactor (PWR), with large (970,000 cubic feet), dry containments, each designed to withstand a pressure load of 60 psig and a temperature of 286'F. The plant is located along the western shore of Lake Michigan in Manitowoc County, Wisconsin. Unit I commenced commercial operation in December 1970; Unit 2 began commercial operation in October 1972. The power rating of each Point Beach reactor is 1,518.5 MWt, with a net electrical output of 497 MWe, Each containment 'ouilding at Point Beach consists of a pre-stressed, post-tensioned reinforced concrete structure.

Many building compartments, systems, and components are shared among the two Point Beach reactor  !

units, including both the control room and cable spreading room. Both units share two motor-driven auxiliary feedwater pumps; one motor-driven pump (MDP) supplies water to the "A" steam generator of both units, and the other MDP supplies water to the "B" steam generator of both units. The auxiliary feedwater pumps require seal cooling that is provided by the service water system. There are only two -

diesel generators at the Point Beach plant. (Two new diesel generators are being added as a result of Energy Research, Inc. 1 ER1/NRC 96-505

individual plant examination [IPE] findings, but the IPEEE does not credit this plant improvement since it has not yet been completed.) The two units share both of these diesel generators; the "A" diesel generator powers the "A" train of safeguards on both units, and the "B" diesel generator powers the "B" train of safeguards on both units. The two units share DC battery power and battery charging capability.

Service water is shared among both units, by means of a common header, and each unit's component cooling water (CCW) system can be shared (cross-connected), although they are normally separated.

All redundant-train containment spray and safety injection pumps for both units (eight pumps in total) are located in the same general area. Also, an unusual feature penaining to this plant (as compared to other nuclear power plants) is that the cable spreading room contains oil-filled transformers.

The safe sinnslawn aanhquake (SSE) for Point Beach is characterized by a 0.12g peak ground acceleration (PGA) for horizontal motion. The plant operating basis earthquake (OBE) is 0.06g PGA. The design-spectral shape is denned by a Housner speum for soil. Category-I structures / rooms (e.g., the reactor contmnment buildings, the primary auxiliary buildmg, the control room, the circulating water pumphouse, the fuel oil pumphouse, pipeways, and a new diesel generator building) have been designed for seismic loads obtamed from the SSE and OBE design monons. The IPEEE submntal report notes that Category-III structures / rooms (e.g., turbine building and facade structures) have also been designed to SSE design crneria. The Point Beach site is a soil site, with the safety elmed plant structures founded on stiff to very-stiff glacial deposits over fractured dolomite bedrock, with a total depth of soil deposits of approximately 100 feet. (The upper 16 feet, or so, of site soil consists of a layer of very stiff glacial till; the next 35 feet define a layer of stiff glacial lacustrme deposits; and the bottom 50-foot layer consists of stiff to very stiff glacial till. The glacial till and glacial lacustrine deposits are comprised primarily of a stiff clay matrix, with some sands and gravels.) Point Beach is a member plant of the Seismic Qualification Utilities Group (SQUG), and has undertaken a program to address Unresolved Safety Issue (USI) A-46.

The plant is in compliance with AM R requirements, and all of the Appendix R related modificMions have been completed.

1.2 h J= af the i " - 's IP5TF Pracman and I-narrant Miehts 1.2.1 Seismic Point Beach is assigned, in NUREG-1407, to the 0.3g focused-scope review category. The licensee has elected to perform a new level-1 seismic probabilistic safety assessment (SPSA), with a brief qualitative and quantitanve (level-2) seismic contamment performance analysis. The SPSA uses the existing IPE [4]

level 1 logic models and the existmg IPE level-2 contamment event tree model for quantifying seismic risk.

. The SPSA approach makes use of a surrogate element to represent the seismic failure effects of all components that were screened out at a high-confidence oflow probability of failure (HCLPF) level of 0.3g PGA. Simplified fragility calculations and detailed fragility calculations were performed for ,

components that were not screened out. The Point Beach SPSA evaluation of seismic capacities thus j makes significant use of deternunistic seismic margin assessment (SMA) procedures and calculations, as opposed to entirely probabilistic methods. Point Beach is a USI A46/SQUG plant, and the USI A46 evaluatica effort was conducted jointly with the seismic IPEEE effort. (For example. SPSA walkdowns were coordinated with the USI A46 walkdowns; component fragilities used in the SPSA were frequently evaluated from results of USI A-46 calculations; and the relay chatter evaluation conducted for USI A46 effectively served as the IPEEE relay evaluation.)

ERI/NRC 96-505 Energy Research, Inc. ,

2

)

i o.

y.

1 In general, the study has addressed the major elements of concern for seismic probabilistic risk assessment (PRA) evaluanon of a focused-scope plant, as identified by NUREG-1407. These elements, as described in the submittal' report, include:

• Review of plant information

• Seismic plant walkdowns

• Analysis of plant systems

• Consideration of non-seismic failures and human actions

• Strucmral response evaluation ~

• Evaluation of component fragilities and failure modes a Relay chatter evaluation

• Block wall evaluation i

e Soil failure analysis (soil liquefaction and displacements / settlements) l

• Seismically induced floodmg evaluation

• Risk quantification and accident sequence assessment

• Sensitivity analyses

• Analysis of containment performance

• Evaluation of USI A 45 and other seismic issues

• Consideration of seismically induced fires

• Peer review A total of 459 items of d, = were evaluated durmg the seismic walkdowns; of these,195 components did not screen out. Calculmions of seismic capacities for screened-in items have revealed 26 components with HCLPF capacnies below, or just at, the review level canhquake (RLE). Cable trays inside the cable spreading room were found to have the controlling seismic capacity (0.23g PGA median capacity, equivalent to a HCLPF capacity of about 0.09g PGA). Flat-bottomed tanks and block walls were also idenafied as low capacity items. The overall plant median capacity has been reponed to be equal to 0.45g PGA, and the plant HCLPF capacity has been assessed at 0.16g PGA: these results account for non-seismic failures and human errors. Without non-seismic failures and operator errors, the median and HCLPF estimates are reponed as 0.69g and 0.25g PGA, respectively. Mean seismic core damage 4

I frequency (CDF) values of 1.40x10? per reactor-year (ry) and 1.31x10 /ry have been reponed,

! respeenvely, for the 1989 Electric Power Research Institute (EPRI) hazard results and the 1993 Lawrence Livermore National Laboratory (LLNL) hazard results. The seismic frequency of early large release (noble gases, and up to 10% of volatiles), as determined from the Point Beach seismic containment 4

performance analysis, has been reponed as 1.26x10 /ry, which is very nearly the same as the seismic l CDF ltself.

Plant changes to resolve seismic outliers identified as part of USI A 46 have been reponed in the IPEEE l

submittal. These changes (including the resulting increases in capacities of cable trays) are found in the submittal to increase the plant HCLPF capacity from 0.16g PGA to 0.20g PGA. A listing of the dominant basic events / components that contribute significantly to seismic CDF is provided in Section 4.1 of this TER.

l l

' Based on the SPSA results (together with sensitmty evaluanons), the licensee concludes that no significant

- seismic concerns have been discovered during the IPEEE.

' Energy Research, Inc. 3 ERI/NRC %-505

1.2.2 - Fire

%e fire IPEEE analysis was based on the fire-induced vulnerability evaluation (FIVE) methodology [5].

This me hodology, similar to other fire analysis techniques, has a graduated focus on the most important fire zones using qualitative and quantitative screening criteria. The fire ranes or compartments were subjected to several screening stages. In the first stage, a zone was screened out if it did 4

not contain any safety-related equipment. In the later stages, a core damage frequency (CDF) of 10 /ry was used for screening. The plant information gathered for Appendix R compliance has been used extensively. The IPE model has been used to establish the possibility of experiencing core damage from a fire initiating event. The conditional core damage probability was based on the equipment and systems unaffected by the fire. The unconditional CDF was obtained by multiplying the frequency of a fire in a fire zone with the conditional core damage probability for that fire zone. For deternumng fire occurrence frequencies in specific fire zones, the database provided in the FIVE document has been employed. The fire frequencies'were specialized for specific fire compartments, using weighting factors based on the combustible loading, type, and number of components in a compartment. For fire propagation, the fomadanons provuled in FIVE have been used. The licensee clauns that the data has been modified, using the Electric Power Research Instimte's (EPRI's) Fire PRA Implementation Guide [6], to reduce the conservatism in FIVE fire propagation analysis. The human actions considered in the IPE plant model have been included in the fire impact assessment. The human error probabilities have been modified to take into accoum the additional stress that could be caused by the occurrence of a fire. In addition to evaluating the fire CDF, the possibility of cornminment failure has also been considered.

The licensee has reached the overall conclusion that there are no significant fire vulnerabilities at Point Beach Despite the assumption that all cables and equipment are damaged in a fire area or compartment, no single fire area or compartment was determined to (by itself) be associated with core damage. Other failures in other areas are also regmred. He cable spreadmg room may be an exception te this statement.

However, the plant can be shut down from outside the main control room using the alternate shutdown panel and a procedure swhHy designed for this purpose. The overall fire CDF was estimated at 5.11 x 104 /ry. This value is commensurate with fire PRA results obtained for other similar plants. The

- dominant fire scenanos include fires in: the control room, the cable spreading room, the auxiliary feedwater pump room, the gas turbine mom, the vital and non-vital switchgear rooms, the diesel generator rooms, and the monitor tank room. The dommarw core damage scenarios involve early damage, where a reactor coolant pump (RCP) seal loss of coolant accident (LOCA) occurs, and where safety injection is assumed failed. Contamment failure was addressed only through the possibility of failing to close containment isolation valves. To further reduce the overall plant risk, the licensee is in the process of implememing a set of modifications. Two new diesel generators, which will have their own dedicated vital switchgears, are being added at the plant. The control system for the auxiliary feedwater pumps is being modified to make the pumps independent of the non-vital switchgear room. The control room / cable spreading room fire procedure has been updated to include additional valves that have been identified as a result of the IPEEE.

The licensee has clearly expended a significant effort on inspecting the plant for potential fire j

vulnerabilities. However, several shortcomings have been identified by this review which can undermine the licensee's conclusions regarding potential vulnerabilities.

Energy Research, Inc. 4 ERl/NRC %505

\

n 1.2.3 HFO Events The HFO IPEEE analysis was based on bounding and screening methods, supplemented with some probabilistic calculations. The HFO IPEEE process involved the fonowing aspects:

• . Identi5 cation of pa'an'i=11y important HFO events .

• Performance of a quantitative screening process based on the frequency of HFO events

• Performance of a more-detailed (bounding) analysis, supplemented with PRA calculations, for some HFO external events Among all HFO events, tornadoes and external floodmg were further analyzed using quantitative bounding and/or PRA evaluations. Historical data were used for determining straight wind, tornado, and external flood frequencies. Some she-specific data were used for the analysis of aircraft crashes, land L-@0naGon accidante, and nearby hazardous facility events. No formal PRA or bounding analysis was performed for transportation and nearby facihty accidents. These events were screened out due to lo frequency of occurrence.

Walkdowns were performed to inspect areas that were paraati=Ily susceptible to HFO events, and the resuhs were reported in the subminal. De submittal relied heavily on the results and methods used in the NRC's report on USI A 45, " Shutdown Decay Heat Removal Requirements," (NUREG/CR-4458) [7], in which Point Beach was analyzed. As needed, the results of USI A 45 were reviewed and updated by the licensee to include changes since the time of issuance of the NUREG/CR 4458 report.

External flooding was determined to be the largest HFO risk contributor, with an estimated CDF of 2.8x10 d/ry. The principal related concern a't the plar.t is flooding of Lake Michigan, which results in The CDF flooding of the turbine building, and leads to loss of the ability 4

to remove decay heat.

contribution due to high winds was deternuned to be 3.4 x 10 /ry. Loss of offsite power caused by high winds was treated as being recoverable. The dominant wind-induced core damage sequences were determined to involve failure of both diesel generators. A principal issue raised in the USI A-45 study of Point Beach was the susceptibility of the diesel generator exhaust stacks to winds exceeding 240 mph.

The plant is currently i==11iag two new diesel generators which are enclosed in a new, separate bu designed to witharand winds of up to 300 mph. De new diesels were not credited in the IPEEE, altho the calculation shows that they substantially further reduce the already low CDF contribution from high winds. Considering the location of Point Beach, the CDF associated with transportation and nearby 4

facility accidanet was bounded at less than 10 /ry. Overall, the CDF contribution from HFO events was determined to be slightly more than 4% of the total external events CDF.

The subnuttal concludes that there are no plant-specific vulnerabilities to HFO events at Point Beach.

Additionally, the licensee considers GI-103, " Design for Probable Maximum Precipitation (PMP)," to be closed for Point Beach.

I e

1.3 Cu Anw of Review N_m:: and Activ *1mm In its quahtative review of the Point Beach IPEEE, ERI foevsed on the study's completeness in referenc to NUREG-1407 guidance; its ability to achieve the intent and objectives of GL 88-20, Supplement No.

l 4; its strengths and weaknesses with respect to the state-of-the-att; and the robusmess of its conclusio '

This review did not emphasize confirmation of numerical accuracy of submittal results; however, any ,

5 ERI/NRC %-505 Energy Research, Inc.

I I

-. 2-ical errors that were obvious to the reviewers are noted in the review findings. The review process included the following major activities:

• Completely examine the IPEEE and related documents

• Develop a preliminary TER and RAls

• Examine responses to the RAls

• Finalize this TER and its findings Because these activities were performed in the context of a submittal-only review, ERI did not perform a site visit or an audit of either plant configuration or detailed supporting IPEEE analyses and data.

Consequently, it is important to note that the ERI review team did not verify whether or not the data presented in the IPEEE match = the actual conditions at the plant, and whether or not the programs or l procedures described by the licensee have indeed been implemented at Point Beach. l 1.3.1 Seismic In conducting the seismic review, ERI generally followed the emphasis and guidelines described in the report, Indivsdual Plant Examination of External Ewnts: Review Gddance (8], for review of a seismic PRA, and the guidance provided in the NRC report, JPEEE Step 1 RcWew Guidance Document [9]. In 3 I

=Mua, on the basis of the Point Beach IPEEE submittal, ERI completed data entry tables developed in the LLNL document entitled "IPEEE Database Data Entry Sheet Package" [10].

In its review of the Point Beach seismic IPEEE, ERI examined Sections 1, 2, 3, 4.8.1, 6, 7, 8 and 9 of I the IPEEE submittal for Point Beach Nuclear Plant [1], and the licensee's response to RAls [11]. The checklist of items identified in Reference [9] was generally consulted in conducting the seismic review.

Some of the primary considerations in the seismic review have included (among others) the following items:

• Were appropriate walkdown procedures implemented, and was the walkdown effort sufficient to accomplish the objectives of the seismic IPEEE7

• Was'the plant logic analysis performed in a manner consistent with state-of-the-art practices? Were random and human failures properly included in such analysis?

• Were component demands assessed in an appropriate manner, using valid ' seismic motion input and

. structural response modeling, as applicable? Was screening appropriately conducted?

• Were fragibty calculations performed for a meaningful set of components, and are the fragility results reasonable?

• Has the surrogate element been used in such a manner so as to not obscure dominant risk contributors and to produce a valid numerical estimate of CDF?

• Was the approach to seismic risk quantification appropriate, and are the results meanir$17 Energy Research, Inc. 6 ERI/NRC 96-505 e

L- . ._ , . .

p

( ;. ,

• Does the submittal's discussion of qualitative assessments (e.g., containment performance analysis, seismic-fire evaluation) reflect reasonable engineering judgment, and have all relevant concerns been addressed? .

• Has the seismic IPEEE produced meaningful findings, has the licensee proposed valid plant improvements, and have all seismic risk outliers been addressed?

1.3.2 Fire During this technical evaluation, ERI reviewed the fire events portion of the IPEEE for completeness and consistency with past experience. This review was based on consideration of Sections 1,2,4,6,7, and 8 of Reference [1], and on the licensee responses to fire-related RAls [11]. The guidance provided in l

References [8,9] was used to formulate the review process and the orgamzation of this document. The data entry sheets used in Section 5 have been completed in accordance with Reference [10].

The process implemented for ERI's review of the fire IPEEE included an examiriation of the licensee's methodology, data, and results.. ERI reviewed the methodology for consistency with currently accepted and state of-the-art methods, paying special attention to the screening methodology to ensure that no fire j

l scenarios were prematurely eli=ia=M The data element of a fire IPEEE includes, among others, such stems as:

• - Cable routing

• Fire zone / area partitioning

• Fire occurrence frequencies

• Event sequences l

a Fire detection and suppression capabilities For a few fire zones / areas that were deemed important, ERI attempted to verify the logical development l q of the screening justifications / arguments (especially in the cas.e of fire-zone screening) and the i l co,mputations for fire occurrence frequencies.

L 1.3.3 HFO Events The review process for HFO events closely followed the guidance provided in the report entitled IPEEE Step 1 Review Guidance Document [9]. This process involved examinations of the methodology, the data used,'and the results and conclusions derived in the submittal. Sections 1, 2, 5, 6, 7, 8 and 9 of the IPEEE whminal [1], and licensee responses to RAls [11], were examined in this HFO events review. The i

IPEEE methodology was reviewed for consistency with currently accepted practices and NRC recommended procedures. Special attention was focused on evaluating the adequacy of data used to estimate the frequency of HFO events. In addition, the validity of the licensee's conclusions, in consideration of the results reported in the IPEEE submittal, was assessed. Also, results pertaining to frequencies of occurrence of hazards, and pertaining to estimates of conditional probabilities of failure, were checked for reasonableness. Review team experience was relied upon to assess the validity of the licensee's evaluation.

7 ERl/NRC 96-505

' Energy Research, Inc.

r l . .

L 2 CONTRACTOR REVIEW FINDINGS 1

l 2.1 Sdsmic A summary of the licensee's seismic IPEEE process has been described in Section 1.2. Here, the licensee's seismic evaluation is examined in detail, and discussion is provided regarding significant observations encountered in the present review.

! 2.1.1 Overview and Relevance of the Seismic IPEEE Process

a. Seismic Review Category and RLE Point Beach is assigned to the focused-scope seismic review category in NUREG-1407. The review level earthquake (RLE) for evaluation of the plant has been established a 0.3g PGA, with spectral shape defined by the NUREGICR-0098 [12] median spectrum for soil condmons.

1

b. SeismicIPEEEProcess The licensee has chosen to perform a seismic PRA (i.e., a seismic probabilistic safety assessment [SPS A])

I for its IPEEE. The overall SPSA approach that was implemented generally follows the PRA guidance described in NUREG/CR-2300 [13]. The conditiona4 probability of a seismically induced small LOCA, l and some other aspects of SPSA methodology / data were derived from NUREG/CR-4840 [14]. The SPSA makes use of a surrogate element to represent components that were screened out at the RLE. Seismic IPEEE and USI A-46 walkdowns were accomplished simultaneously.

c. Renewfindings The licensee's seismic IPEEE process for evaluation of Point Beach Nuclear Plant is a relevant approach with respect to NUREG-1407 guidelines.

2.1.2 Logic Models I

The plant logic analysis for Point Beach includes the following three major aspects: (a) seismic initiating events analysis, (b) event tree development, and (c) fault tree development. l

a. Seismic Initiating Ewnts Analysis Occurrence of a seismic event was defined to be the initiator. An entry seismic event tree (PBO) was developed to associate the seismic initiator with applicable IPE [4] event trees. The seismic event tree thus maps the occurrence of an earthquake to safe end states, to core damage end states, or to transfer branches to other event trees. Only seismic failures or seismic-related human actions are modeled in the entry seismic event tree; these include:

=- Site soil stability

• Building integrity

'* Reactor vessel integrity

• Surrogate element Energy Research, Inc. 8 ERI/NRC %-505

• Integrity of cable trays outside the cable spreading room (CSR)

• Integrity of cable trays inside the cable spreading room .

. Remote plant shutdown (includes operator fragility)

• Interfacing systems LOCA

• Offsite power

- Soil failures, building failures, and reactor vessel failures were screened out as potential accident initiators, and were embedded within the surrogate element.

Loss of the instrument air system, loss of the power conversion system (PCS), loss of the gas turbine (an j

alternate AC power source), and loss of reactor coolant pump (RCP) seal injection cooling via the chemical 1

and volume control system (CVCS)', were assumed for all seismic initiating events. In addition, the '

following items were not credited in the seismic model: normal charging to the primary system; recovery following loss of offshe power; system depressuruation via powereperated relief valves (PORVs) and/or auxiliary spray; prunary cooldown/deprensurization via the secondary system (auxiliary feedwater [AFW) and local / manual operation of steam generator atmospheric steam dump valves [ASDVs]); firewater l j

makeup for long-term pnmary/ secondary heat removal; and low pressure injection during a small break LOCA.

b. Ewnt Dee Modeling

~

Twenty (20) IPE event trees were used for modeling seismic accident sequences. Events not pertaining to seismic effects were removed from the IPE probabilistic safety assessment (PSA) trees. Success / failure branches in the IPE event trees modeled random and human failure events. Seismic failure / success branches were added next to the correspondmg random top events to model the similar seismic-caused events. The seismic event trees thus contain a significant number of top events (i.e., large event tree).

Medium LOCAs, large LOCAs, steam generator tube ruptures (SGTRs), and steamline/feedline t.reaks were all screened out at a HCLPF capacity level of 0.3g PGA, thus significantly reducing the potential extent of the seismic event tree modeling. These accident initiators were not simply ignored, but were

• subsumed into the surrogate element.

Branches in the seismic-modified IPE event trees resulted in safe end states, in core damage end states (plant damage states), or they transferred to branches in other event trees. Event trees for the following consideranons were included in the seismic model: @=ng current (AC) and direct current (DC) power system response given no loss of offsite power (LOSP); AC and DC power system response given LOSP; piping-integrity responses for the various cases of electrical power support system configurations for no LOSP occurrences; piping-integrity responses for the various cases of electrical power support system configurations for LOSP occurrences; frontline and support system responses for small LOCAs involving no LOSP; frondine and support system responses for small LOCAs involving LOSP; frontline and support system responses to transients involving no LOSP; and frontline and support system responses to transients involving LOSP.

Containment isolation and containment cooling were included as top events in the transient and small LOCA event trees. AFW was the only source modeled for secondary-side decay heat removal (DHR).

High pressure safety injection with established long-term cooling via recirculation mode was the only source modeled for direct primary DHR.

Energy Research, Inc. 9 ERI/NRC 96-505

c. Fault Tree Modeling

. Seismic top evems were further represemed by means of seismic fault tree mr,dels, which includea operator errors. In some instances, seismic fault tree logic consisted of just a smgle seismic basic event. All seismic fault trees included in the Point Beach SPSA model were presente.1 in the IPEEE submittal. In general, the seismic fault trees involve a comparatively small number of basic events, and hence, the trees I are not particularly complex. No random failures were included in the seismic fault tree logic. Fault trees for random failures had already been quantified in the IPE. Hence, the IPE success / failure probabilities of random top events were simply used for the SPSA quantification, without need of re-analysis of random-events fault trees. ,

The list of SPSA components was based on the IPE plant model and the results of walkdown activities.

There were 979 components in the IPE model. Some of these components were removed from the seismic ~

model, due to simplifying assumptions and the fact that credit was not taken for certain mitigating conditions, as discussed previously. The component list was further reduced by seismic screening of components and by functional screemng (via failure modes and effects analysis). The seismic logic model were correspondingly reduced to account for this screening. A total of 195 unsereened components remained; together, the surrogate element (which represents all screened-out components) and the 195 unscreened components served to define the complete list of seismic failures modeled in the SPSA.

The IPEEE submittal provides a discussion concerning treatment of seismically correlated equipment failures (i.e., for like equipment at similar locations / elevations). Seismic events that represent common cause failures were developed for these cases, and these were observed to have a significant role in the SPSA model.

d. ReviewRnding The logic modeling process for the Point Beach SPSA represents a meaningful and relevant approach respect to NUREG-1407 guidelines.

2.1.3 Non-Seismic Failures and Human Actions .

For the Point Beach seismic IPEEE, the licensee has explicitly included the effects of non-seismic failures and latent (pre-event) human actions by utilizing IPE logic models that account for these effects. Post-accident human actions have been included as basic events in the seismic fault trees. Rand and error rates for latent operator actions were based on the IPE model. Post accident human error l

probabilities (HEPs) have been evaluated from fragility curves, which were developed in the follow manner:

. For seismic demand PGAs0.12g; the seismic HEP equaled the internal events PSA value

. For seismic demand 0.12g< PGAs0.50g; the seismic HEP was evaluated from a log-linear function, with the internal events PSA value at 0.12g and 10 times the internal events PSA value at 0.5g

. For seismic demand PGA>0.5g; the seismic HEP equaled 0.1 for in-control room actions and 1.0 for actic 1 ouuide the control room 10 ERI/NRC 96-505 Energy Research, Inc.

l

=

The seismic HEPs were based on engmeermg judgment and are questionable, but are about as well as can be developed practically, with current knowledge. They account in an approximate fashion for the location of the post-accident operator actions, and they generally appear to be conservative. Because they are developed with great uncertamty, however, the resulting contribution of operator errors to seismic CD" must accordingly be assumed to be non-robust. Operator errors should thus not be used as a veil to obscure insights pertaming to seismic component failures.

It is noted that the licensee has not included in the SPSA model the potential for operators to fail to reset relays, even though the licensee has implicitly screened out some IPEEE-only relays (in its relay chatter evaluation) as being " chatter acceptable" based on the assumption that such actions will be completed.

Section 2.1.11 of this TER provides additional discussion on this issue.

In summary, the licensee has provided a list of human actions considered in the'SPSA model, and has indicated the locauon where each action must be performed. In addition, the licensee's modeling of non-seisanc failures and imman actions is well explamed, reasonable, and it is judged to satisfy the requested guidelines of NUREG-1407 for a seismic PRA.

2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape) 1 The SPSA used the revised,1993 LLNL seismic hazard estimates (NUREG-1488 [15]) for evaluating seismic initiating event frequencies. PGA was used as the ground motion parameter for defimng component HCLPF capacities and for performmg recident sequence quanufications. Seismic capacity evaluations were based on the motion spectral shape defined by the 1989 LLNL median,10,000-yr uniform hazard spectntm (UHS) for the Point Beach site, as presented in NUREG/CR-5250 [16].

Fragilities and HCLPF capacities have been reported with respect to the UHS spectral shape.

The seismic input spectrum and ground monon hazard used for the Point Beach IPEEE are consistent with the relevant guidelines presented in NUREG-1407.

2.1.5 Structural Responses and Component Demands The licensee generated tiew in-structure response spectra (IRS) based on time-history analysis of three-dimensional soil-structure-interacnon (SSI) models, using extsung stick-model representations of buildings.

The following SPSA structures were addressed in this analysis:

• Contamment struaure and internals

• Auxiliary build'.ng, central part -

• Auxiliary bu5 ding, north and south wings

., Control bu'.1 ding

• Pipeway No.1

• Pipeways No. 2 and 3

• Pipeway No. 4

• Fuel oil pumphouse

• Circulating water (CW) pumphouse

. The submittal notes that the SSI analysis implemented the requirements of the NRC Standard Review Plan I

(SRP) [17] (with three procedural exceptions aimed at increasing the realism of the analyses) and the Energy Research, Inc. 11 ERI/NRC 96-505  ;

i

guidelines in ASCE Standard 4-86 [18]. 'Ibe 1989 LLNL,10,000-yr median UHS was used to define the shape of the target response rg.ss. A PGA value of 0.4g was used to define the absolute motion level used for cM i baseline SSI responses. Structural damping for all modes was set to 7%, in accordance with EPRI NP-6041-SL [19].

Cornputer codes LAYSOL [20], SUPELM [21), and EKSSI [22), developed by Professor Eduardo Kause at MIT, were used by Stevenson & Associates in performmg the SSI analyses. Professor Kausel reviewed the overall calculational procedure and assumptions, and had some concerns with the approach, most notably with the treatment of eccentricities and theepataatinr ffects of interactions between neighborin buildings. It is not clear to what extent the licensee responded to these concerns.

The licensee presented the acceleration time history and power spectrum for the input ground motio unusual gaps in the power ryKEs (plotted for frequencies greater than 1 Hz) were evident. The tot duration of the input motion is 10.24 seconds, with the strong-motion phase being sigai&=atly less. The licensee's contractor has indicated that the selected duranon is in accordance with SRP 3.7.1.

Overall, the licensee has developed structural responses and component damanrk for the Point Beach

- IPEEE in a mannar that is consistent with the relevant guidelines presented in NUREG-1407.

2. I'.6 Screening Criteria The EPRI SMA screening critena described in EPRI NP-6041-SL defined the framework used in making screening decisions. The first and second screening columns of Tables 2-3 and 2-4 of EPRI NP-604 were used for the screemng process. All components meeting the screening criteria can be thus said to screen out at a HCLPF level of 0.3g PGA. The subnuttal also notes that the Generic Implementation l

Procedure (GIP) [23] screening criteria were applied for evaluation of components. In some instances, l

simplified fragility levels were assigned to IPEEE components based on conservative determinis n:argin (CDFM) calculations performed as part of the USI A-46 evaluation.

l The study has used a surrogate element to represent the potential failures of screened-out components. i The submittal has reported the surrogate element to be a dominant risk contributor, attributing 16% of j seismic CDF to the surrogate element. The principal (yet somewhat compensating) implications of this finding are: (1) that the source of 16% of the seismic CDF is (in reality) unknown, and that source represeen a single dominant CDF contnbutor or a set of dominant CDF contributors; but (2) tha l potential dominant CDF contributors would be associated with components having a seismic excess of the screening threshold of interes'. Hence, a higher screening threshold would be needed to reveal the complete set of dommant risk contributors for Point Beach; however, such a higher screeni threshold would be in excess of the (mininunn requested) RLE specified for Point Beach in NUREG-1407 Overall, the screening criteria and procedures used in the Point Beach seismic IPEEE are consistent w NUREG-1407 guidelines. However, the chosen screening threshold (which defines the surrogate element capacity) obscures understanding of the characteristics of a significant portion of the seismic C 4 2.1.7 Plant Walkdown Process  ;

1 Significant coordination of seismic walkdowns was implemented to achieve the objectives of the and of USI A-46. AllIPEEE components were documemed as USI A-46 items, even if they were not part 12 ER1/NRC 96-505 Energy Research, Inc.

of USI A 46. A screening evaluation work sheet (SEWS) was completed for each IPEEE equipment item, In accordance with GIP requirements, and a simplified, CDFM-based fragility value was developed for

- each component. GIP criteria and EPRI NP-6041 walkdown procedures were followed in the walkdowns.

Each team consisted of two seismic capability engineers trained by EPRI in SQUG/USI A-46 walkdown requie.. .a and in IPEEE add-on requirements. Seismic review team (SRT) members were drawn from WE staff and consulting organnations (Stevenson & Associates, Jack R. Benjamin & Associates, and RPK Structural Mechanics Consulting). The majority of walkdowns took place on September 28 and 29,1993; and on October 18 to 28,1993. Subsequent walkdowns took place during April, July, October and November of 1993, in order to complete walkdown assessments based. on equipment availability due to outages.

l In addnion to walkdown of structures and active aa@=at, safety-related piping, electrical raceways, and ductwork were also addressed. Relays were evaluated in the walkdown, in accordance with Section 6 of the GIP. A complete list of the 459 SPSA components nammad in the walkdown is provided in the IPEEE submittal report. After seismic screening and functional smening, this list was narrowed down to the 195 components modeled in the SPSA.

A seismic screemng peer review was conducted by Dr. P, Smith, and an SPSA systems list and modeling peer review was performed by Dr..R. J. Budnitz.

~

Overall, the walkdown process has been completed in a manner consistent with the guidelines of NUREG-1407 2.1.8 Fragility Analysis-Three types of fragility analysis were employed in the Point Beach seismic IPEEE:

1. Component screening, including surrogate-element fragility assessment

2. Simplified fragility assessment

3. Detailed fragility assessment Screening-based fragility designations / assignments have been made at four different levels in the Point Beach IPEEE:

SS: Screening at a median fragility of 1.2g PGA (0.5g PGA HCI.PF)

S: Screening at a median fragility of 0.8g PGA (0.3g PGA HCI.PF)

DB: Screening demonstrates design-basis capacity only; a median fragility is assigned to be 0.19g PGA

' NS: Screenmg could not be demonstrated at any of the preceding levels; a median fragility is assigned to be 0.lg PGA Follow-up anchorage analyses were performed to verify inclusion at the initial screening designation, or were used to produce a revised fragility value for individual components.

Energy Research, Inc. 13 ERl/NRC 96-505

l

- Components not belonging to SS or S were initially assigned a fragility based on either DB or NS. S components that still remained after the functional screemng, were either evaluated with a simplified detailed fragility nummant, or their initial fragility assignments were preserved. Of the 195 component items explicitly modeled in the SPSA, apparently none kept an NS fragility assignment. The CST leve transmitter (whose failure is governed by interaction with a block wall) is the only component for which the DB fragility assignment (median capacity of 0.19g PGA, with a value of C=0.40) was apparently ke SS and S fragility assignments, based on PGA screening levels of 1.2g and 0.8g, were preserved f and 61 component- items, respectively. Detailed fragility analysis was performed for 14 of the 195 component items indicated in Table 3.1.4-2 of the submittal. The remaining 46 component items we evaluated by means of simplified fragility assessment.

For all components belonging to SS or S designations, a single surrogate element fragility was u collectively describe their seismic capacity. The median PGA capacity of the surrogate element was obtained by enveloping the UHS spectral shape by the screening spectrum converted to a med A sg =b logarnhmic pandard deviation of 0.3 was used to define the variability in surrogate-elem capacity. A PGA value of 0.78g was determined as the surrogate-element median capacity.

Simplified fragilities (median capacities) were generally obtained from results of CDFM H evaluations (detailed anchorage analysis, fe.wiki analysis, USI A 46 equivalency analysis, detailed stre analysis). 'A composite logarithmic standard deviation of 0.40 was used for all simplified fraj methodology employed for detailed fragility assessment was the conventional approach based safety factors and derivation of combined variability from elemental safety-factor variabilities.

The implamantanan of the foregoing fragility analysis process has apparently resulted in a meaningful assessment of component fragilities for use in the Point Beach SPSA risk quantific Overall, the fragilhy analysis employed in the Point Beach seismic IPEEE is consistent with the of NUREG-1407.

2.1.9 Accident Frequency Estimates

a. Overall Approach Qusanfication of seismic accident sequences was p=fusred using the Jack R. Benjamin &

code. In this quantification, the seismic hazard curve was discretized to obtain initiating even for various ground motion levels. For each ground motion level, component fragilities were eva obtain basic event probabilities in the seismic fault trees. Operator error probabilities (derived f operator fragility curves) were obtained to quantify the systems fault tree logic. Probab from the 26 system fault trees define event tree top event failure / success probabilities. The SH Event tree accident sequence logic was used to used to evaluate a fragility curve for each top event.

quamify accident sequence frequencies from top event probabilities. The SHIP code w a sequence-level fragility curve for each end node of the event trees. In addition, a core curve was obtained by combining sequence-level fragility curves. The seismic CDF was obtainI appropriately combining the seismic hazard curves and plant-level fragility .urve:

. A total of 320 accident sequences were represented in the seismic SPSA logic model. Thirty f these sequences were quantified as having a measurable contribution to seismic CDF. Six (

14 ER1/NRC %-505 Energy Research, Inc.

sequences together comprise about 94%.of the seismic CDF. Fragility curves were developed for these 6 sequences and are presented in the submittal. System fragility curves were presented for the 24 non-trivial emiamic top evens (i.e., for top evens that involve more than one seismic basic event). The overall d and presente d in the submittal. From this curve, for motion

. plant-level fragdhy curve was also develope levels of 0.5g and above, operator error is seen to have a dommam influence on plant fragility.

b. Sensiristy Analyses The seismic IPEEE includes assessment of sensitivities for the following five cases:

- 1. Random and operator failure rates set to zero

2. USI A-46 outlier resolution program fixes

3. EPRI hazard curves versus 1993 LLNL hazard curves

4. Sc=0.46 versus pe=0.40 for component fragilities

5. Random and operator failure rates set to zero; infinite surrogate element capac,ity l

For the first sensitivity case, the plant HCLPF was found to increase from 0.16g to 0.25g; the plant median capacny increased from 0.45g to 0.69g. This sensitivity variation is meaningful and sugges a plant HCLPF of 0.25g may be reported for Point Beach. For the second case, the plant HC increased from 0.16g to 0.20g and the median capacity actually decreased from 0.45g to 0.44g. This sensitivity variation has limited value, because its true effect is obscured by operator error fragi (which are highly uncertain) and surrogate element modeling (which is fictitious). A more meaI effect is likely to be seen if, simultaneously, random and operator failure rates are set to zero and tI surrogate element capacity is set to infinity (i.e., a combination of sensitivity cases 2 and 5 abo the third case, the seismic core damage frequency for the 1989 EPRI hazard curves [24] was assess

~

being about 7% higher than for 1993 LLNL hazard curves. This sensitivity variation indicates tha

. is only a minor effect between use of the two sets of hazard curves. For the fourth case, the m capacity was found to decrease just slightly, from 0.16g to 0.15g, and the median capacity de 0.45g to 0.43g. Hence, the value of e does not have a significant effect on results. And finally, i fifth case, the HCLPF capacity increased from 0.16g to 0.25g and the median capacity increased fro 0.45g to 0.93g. This case reveals that modeling effects independent of the actual (calculated capability of components have, effectively, acted to limit plant seismic capacity in the licens Cou yosL4y, the "non-seismic" modeling effects have potentially obscured insights pertaining to importance of seismic contributors.

' In addition to the foregoing sensitivity analyses, the submittal provides a graph of the contributi vanous ground-monon intervals to seismic CDF. Little CDF contribution is seen to come from m in the range of 0.89-1.02g PGA. Therefore, it is expected that little CDF contribution derives from motions above 1.02g PGA, and there appears to be no need to perform a sensitivity analysis extendin motion truncation limit from 1.02g to 1.50g.

Due to the use of surrogate-elamam modeling at essennally the plant level (as opposed to the syste for instance), the seismic CDF estimate may be somewhat optimistic. The licensee has indicated consultants have performed studies that reveal the seismic CDF would be altered less than 10% i surrogate element were introduced into the SPSA model at the systems level. No reference for the consultants' studies (possibly these were informal analyses that were never documented); howeve this finding appears reasonable.

I 15 ERI/NRC %-505 Energy Research, Inc.

L

4 The licensee's assessment of accident sequence frequencies is clear, accurate and well-executed. The computer code used to develop accident frequency estimates has been subject to quality assurance procedures. 'Ibe submmal's presentation of' system-level, sequence-level, and plant-level fragility curves is viewed to be a significant strength of the study.

c. ReviewRndings The matmaamant and presentation of accident frequency estimates has been well executed. However, one sensitivity case is somewhat misleading, and has led to the erroneous conclusion that USI A 46 1-yme. do not notably etYect plant capacity. In addition, the reported seismic CDF result may have

. been underestimatad by about 10% due to the approach employed for logic modeling of the surrogate element.

2.1.10 Evaluation of Dominant Risk Cvou;;,-vie Dominant basic events / component failures that contribute to seismic risk were determined based on their concibution to plant fragility. Dommant accident sequences and plant systems were determined based on their contribution to seismic CDF. The submmal identifies important seismic failures, random failures,

- and human actions. I

a. Dominant Contributors to Core Danage The seismic IPEEE submittal has identified the following dominant risk contnbutors to core damage  ;

- l frequency:

j' Accident Saguancas

• ' PBO 2: Failure of cable trays inside the cable spreading room, leading to loss of indication / control, I combined with failure to shut down the plant remotely (61.7% of seismic CDF).

• PBO 4: Failure of the surrogate element (16.2%).

4

• PBO-3: Failure of cable trays outside the cable spreading room, leading to loss of power to all essential equipment (7.3%).

• PB2-3: Loss of offsite power, combined with failure of the fuel oil system, which leads to loss of emergency AC (3.3%).

• .TR3A-15: Failure of the AFW system, due pnmarily to failure of CST level transmitters (due to block wall failure) and to operator error (3.8%).

• - PB1-1: Failure of 120V AC Instrument Buses due to block wall failures (1.5%).

When the surrogate element is eliminated from the SPSA model (i.e., when all screened-out components

. are ignored), the remaining dominant accident sequences are unchanged, but have the following revised seismic CDF contributions:

4 Energy Research, Inc. 16 ERI/NRC 96 505 Ll_ ' I

• PBO-2 (81%)

• PBO-3 (9%)

• - PB2-3 (4%)

• TR3A-15 (4%)

• PB1-1 (2%)

Wandnm Failum a No dominant random fadures were found Human Errors

• Failure to safely shut down from the remote shutdown panel

• . Failure to provide service water (SW) backup to AFW suction j

• Failure to provide SW backup to AFW suction when CST level transmitters fait 1 hiemie Fallum 1

)

e

• Cable trays inside cable spreading room 1

• Surrogate element -

• Cable trays outside cable spreading room

• Seismically correlated failure of both 4.16kV X13 and X14 large, step down transformers i Seismically correlated failure of 480V load centers 1803,1804,2B03,2B04 ,

• - CST level transmitter (block wall failure)

• Seismically induced failure of 120 alternating current voltage (VAC) Instrument Buses 2Y01, 2YO 2YO3, 2YO4, 2Y05 or 2YO6 due to block wall failure

• Seismically induced failure of 120 VAC Instrument Buses 1Y01, lYO2, lYO3 or 1YO4 due to bloc J

wall failure l

As already dim *M, the findmg that the surrogate element is a dominant contributor suggests limitati) with respect to the insights concerning dominant risk contributors.

b. Dominant Contributors to Radioacrin Release giwn Core Damage Containment safeguards were addressed as part of the level-1 analysis. The dominant containment fai mode ascertained from the level-2 analysis is: containment isolation failure prior to vessel failure, with noble gases and up to 10% of volatiles released.

]

c. Review Rndings -

The Point Beach seismic IPEEE has produced some meaningful insights with respect to dominant risk contributors. The fact that the surrogate element was identified as a dominant risk contributor, however, reveals that there may be additional dominant risk contributors that have not been identified.

17 ERI/NRC 96 505 Energy Research, Inc.

F~ . ]

I l

l

( 2.1.11 Relay Chatter Evaluation For focused-scope plams, NUREG-1407 provides separate guidance for USI A-46 plants and non-US1 A-46 plants. Point Beach' Nuclear Plant is a USI A 46 plant, and hence, NUREG-1407 states that the licensee should expand the scope of relay evaluation to include IPEEE only components, provided that low-seismic-ruggedness relays are found in the USI A-46 review.

A USI A-46 relay charter evaluation was conducted, in accordance with GIP requirements, for SSEL (safe shutdown equipment list) components. Low-ruggedness relays were not initially found from this evaluation. When the 4.16 kV switchgear - the last system to be considered in the USI A-46 relay evaluation - was analyzed, however, Westinghouse ITH relays were encountered in several breaker trip coillockout schemes. The USI A 46 relay review program has determined that these relays only appear in 4.16 kV switchgear. The USI A-46 relay review was expanded to include an evaluation of the control circuits of all of the breakers on the 480 VAC and 4.16 kV safety-related buses (which include components in IPEEE-only systems). No addmonal bad-actor relays were found in this expanded review. The licensee has noted that none of the remaining IPEEE only systems are required to function during earthquake shakmg, associated relays are thus " chatter acceptable," and should they reposition, they can be reset by operators prior to their being required to function. On this basis, the licensee has chosen not to further expand its relay evaluation to consider any other IPEEE-only systems.

Overall, the licensee's approach essentially achieves the guidelines requested in NUREG-1407 for relay evaluation of a focused-scope plant that is also in the USI A-46 program. However, the licensee's claim of " chatter acceptable" for certain IPEEE-only relays is predicated on the assumption that operators can and will reset relays following an earthquake. Despite this claim, the SPSA model has not included such operator actions. The licensee has reported the operator actions included in the SPSA model, as we where the actions need to occur. However, none of these reported actions are associated with resetting relays. It is unknown, therefore, whether or not relay chatter is risk significant.

2.1.12 Soil Failure Analysis The Point Beach IPEEE submittal includes analyses of the following three categories of potential soil failures:

1. Liquefaction,

2. Transient and permanent displacements and settlements of buildings, and

3. Displacements of buried piping from the screenhouse to the intake crib.

Soil response analyses were conducted for PGA values of 0.2g,0.5g and 0.8g. A brief description of s soils is provided in the submittal.

The submittal reports that the potential for soil liquefaction beneath power-block structures or the screenhouse structure is very unlikely (factors of safety of 9 and 3 were cited, respectively). The submittal reports computed maximum transiem and permanent displacements and settlements. These settleme used to conduct a fragility analysis for buried piping connecting the circulating water pumphouse to the

- intake crib. Based on the analysis, buried piping was screened out at a PGA level of 0.8g, and its fragility was subsequently represented by the surrogate element.

18 ER1/NRC %-505 Energy Research, Inc.

e The treatment of soil failures in the Point Beach seismic IPEEE is judged to satisfy the guidelines described in NUREG-1407 for a focused-scope plant.

2.1.13 Containment Performance Analysis

a. Qualitatin Assessment The level-1 SPSA examined containment safeguards systems significant to early large release including containment integrity, mechanical penetrations, contamment isolation, and containment cooling. This evaluadon included a qualitsive walkdown assessment. The evaluation led to the licensee conclusion that the containment, as well as the systems designed to ensure containment' isolation, are seismically sound, having no vulnerabilities.

b. Quantitatiw Assessment A level-2 quantitative assessment was also conducted, using the Point Beach IPE plant damage states, release categories, and containment response analysis, together with the seismic accident sequence frequencies. Only bypass sequences (release category D) and sequences involving containment isolat failure (release category G) were determined to meet a large early release condition. The frequency of release caegory D was found to be negligible for seismic core damage sequences. Release category G was found to be associated with nearly the entire seismic CDF. Hence, the conditional probability of large early release is assessed as being nearly 100%, given a seismically induced core damage. This finding results from the assumption that most sequences result in failure of the automatic containment isolation function, and hence, points to a potential seismic vulnerability with respect to automatic containment isolation. For contamment vulnerability assessment, the licensee effectively invalidates this finding by assuming that the containment will be isolated manually by operators at least 90% of the time in the event of a core damage where automatic isolation is failed. This informal argument, based on a largely arbitrary judgment, reduces by an order of magnitude the large release risk.

c. ReviewFindings The qualitative aspect of the containment performance analysis conducted in the Point Beach seismic IPEEE meets.NUREG-1407 guidelines. The quantitative level 2 assessment produces questionable findings pertaining to the conditional probability of large early release, given seismically induced core damage. The findings of the ==*= rive seismic contamment performance evaluation point to a poten seismic vulnerability in the automatic containment isolation system.

2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations Sections 3.1.3.2 and 4.8.1 of the Point Beach IPEEE briefly docmnent a qualitative analysis of seismic-fire interactions, which includes the following aspects: l

• Seismically induced fires

• Seismic actuation of fire suppression systems

• Seismically induced failure of fire suppression capabilities 19 ERl/NRC 96-505 Energy Research, Inc.

a. SeismicallyinducedFires For seismically induced fire considersions, the SRT evaluated tanks, vessels, and piping that may contain flammahle fluids or gases. All flammable gas lines and liquid storage vessels were found to be adequately surysmi and located where they would not present a vulnerability that would compromise the plant's safe shutdown capability following an earthquake.

b. Inadwnent Seismic Actuation ofFire Suppression Systems Inadvertent actuation of fire protection systems (FPSs) and discharge onto safety-related equipment and safe shutdown ==i:-= resulting from seismic activity, were considered in the internal flooding analysis of the Point Beach IPE. All safe shutdown equipment were walked down for this evaluation. The pr=*ial for spunous man = nan of FPSs (Cardox, Halon, etc.) due to relay chatter or dust spread were not specifically discussed in the submittal report.

I

^

c. Seismically induced Failure ofBre Suppression Systems j For sai<mically induced failure of fire suppression systems, components of the FPS were reviewed during -

plant walkdowns to ensure no interaction hazards exist with respect to safe shutdown equipment. No l documentarian concerning seismically induced failure of FPS capability itself was provided.

d. SeismicallyinducedFloods Section 3.1.3.3 of the submittal describes the qualitative seismically induced flood evaluation. This j documentation references the internal floodmg analysis conducted for the Point Beach IPE. With the exception of the refueling water storage tank (RWST), seismic failures of tanks and vessel were judged not to result in sufficient water volume to cause any unique plant damage states. Failure of the RWST could disable residual heat removal (RHR) pumps required for high pressure recirculation during a seismic-caused accident. However, failure of the RWST itself would disable high pressure injection anyway, regardless of RHR pump stams. Seismic failures of service water, circulating water, and fire water piping were also considered as potential flood sources. Selected pipe runs were walked down and screened out at a PGA HCI.PF level of 0.3g. Hence, the licensee considers potential seismically induced flood concerns to be adequately addressed.

e. RedewRndings The Point BeachIPEEE has implemented qunInnnve seismic fire and seismically induced flood evaluations which partially meet the guidelines of NUREG-1407. No discussions explicitly addressing potential spunous actuanons due to relay chanar and dust spread, nor concerning evaluation of seismically induced loss of fire suppression capability, were provided. ' Die licensee has taken the position [11): "... there is no potential for a seismically induced fire at Point Beach, therefore, the question of the survivability and operability of the Fire Protection System following a seismic event is not relevant." This position is unresponsive to the intent of the issue (i.e., of identifying ~ obvious concerns pertammg to the seismic capability of fire protection systems).

Energy Research, Inc. 20 ERI/NRC 96-505

2.1.15 Treatment of USI A45 Thelicensee has chosen to subsume its effort to resolve USI A-45 within its USI A-46 program. Hence, 1 this TER does not assess the appropriateness of the licensee's USI A-45 evaluation. Nonetheless, the licensee provides a brief discussion of decay heat removal (DHR) capabilities following a seismic event.

The SPSA, including seismic walkdowns, has modeled the systems available for DHR, which consist (for seismic everns) of auxiliary feedwater (AFW) and high pressure emergency core cooling system (ECCS) recirculation. CDF contributions, due to failure of DHR systems and support systems, are tabulated in the subminal. Eighty-five percent of the total seismic CDF can be attributed to sequences involving loss of DHR capability. Of these sequences. 4.0% are due to AFW failure, less than 0.1% are due to ECCS recirculation failure,94.4% are due to loss of electrical power,1.0% are due to loss of service water, and 0.6% are due to loss of component cooling water. The submittal notes that the major contributor to seismic loss of DHR is failure of cable trays, which are being addressed as part of USI A-46. Hence, plant improvemants resulting from the USI A 46 outlier resolution program will improve DHR seismic capability at Point Beach.

2.1.16 Trasement of GI-131 GI-131 is not, striedy speaking, applicable to Point Beach, because the Bux mapping cart is not movable.

Furthermore, the stanonary ten 9ath flux mapping frame has already been modified by the addition of two lateral struts. De Point Beach IPEEE submntal mentions that the flux mapping cart at Kewaunee Nuclear Plant is idemical to that at Poim Beach, except that the Kewaunee ten-path frame does not have the lateral struts. A dynamic analysis of the Kewaunee flux mapping assembly (as referenced in the Kewaunee IPEEE) demonstrated adequate lateral resistance without the struts. The Point Beach IPEEE submittal concludes that the Point Beach flux mapping assembly is stronger than Kewaunee's, and hence, GI-131 is resolved. Since the licensee has mentioned that the flux mapping assemblies at Point Beach and Kewaunee are identical, it'is signi6 cant to note that, as a result of the Kewaunee IPEEE, an admmistrative control was implemented to insure proper restraint of a chain hoist, in order to eliminate a potential interaction hazard with the ten-path assembly of the flux mapping system. De Point Beach IPEEE submittal omiu comment on this condition, and correspondmgly omits the proposition of implementing a similar administrative control at Point Beach.

2.1.17 Other Safety Issues

a. USIA-46 The IPEEE submittal provides brief discussions on the following additional seismic issues: USI A-46

(" Verification of Seismic Adequacy of Plant Safe Shutdown Equipment") and the Charleston Earthquake issue.

USI A-46 is being resolved separately from the IPEEE, although substantial coordination among the two efforts (primarily in walkdown evaluations) has taken place. The submittal notes that evaluations pertaming to USIs A-17 and A 40 are being subsumed within the USI A-46 program.

I l

Energy Research, Inc. 21 ERI/NRC %-505 l l

i i

b. Eanern U.S. Seismicity issue l

The submittal notes that LLNL seismic hazard curves were used for SPSA evaluation, thus fulfilling requirements penaining to the Charleston Earthquake issue.

c. Generic Safety Issues Some seismic-related information having relevance to Generic Safety issue (GSI)-156 and GSI-172 is

. provided in the submittal, as discussed in Sections 2.4.3 and 2.4.4 of this TER.

d. ReviewFindings The seismic IPEEE includes discussions concerning USI A 46 and the Eastern U.S. Seismicity issue; these issues are not considered funher in this review.

-2.I.18 Process to Identify, Eliminate, or Reduce Vulnerabilities The submittal reports no seismic vulnerabilities or concerns that have been identified as a result of the seismic IPEEE. Simple definitions of vulnerabilities, with respect to accident prevention and accident l mitigation, were employed for this putpose.

Plant improvemems, which will reduce the seismic CDF at Point Beach, are being planned as a result USI A 46 fW4 and IPE 6ndings. Table 4.2 of this TER summanzes the subset of such enhancements, as doct..ented in the IPEEE submittal report. These plant enhancements / resolutions include: tixing anchorage deficiencies on cable trays and numerous equipment, as identified in USI A-46 evaluation; addressing concerns associated with Westinghouse Model ITH relays, as identified in the USI A 46 evaluation; and adding two diesel generators and their support systems, as identified in the IPE. These various plant enhancements / resolutions are either being implemented or are being planned for implementation. It is important to note that, even with these plant improvements, there still remain a number of SPSA components having comparatively low seismic capacities (i.e., having HCLPF capacities less than the RLE). Table 4.1 helps to identify these componems.

A very significant finding of.the Point Beach seismic IPEEE is that the highest reported plant HCLPF capacity (1989 LLNL UHS shape anchored to a PGA value of 0.25g) does not even exceed the Hou design-basis spectrum (0.12g PGA) for frequencies less than 4 Hz. Undoubtedly, the plant is sensiti to ground-motions less than 4 Hz, and hence, it can DQt be said that the plant HCLPF capacity convincingly exceeds the SSE dhallenge.

2.1.19 Peer Review Process The Point Beach seismic IPEEE was undenaken with substantial effort by licensee and contractor personnel. Several consultants were used: J.R. Benjamin and Associates (for the seismic risk

. quantification and structural analyses); Stevenson & Associates (for the seismic analyses of eq structures); and SAIC (for the seismic systems analysis). The licensee created a Point Beach IPEEE team i

which managed the project and maintained involvement in the IPEEE analyses. Team members were drawn from the Point Beach IPE team and from WE st#f familiar with plant design and operation. The subnuttal notes that interaction between WE personnel and contractors took place on a continual basis to 22 ERI/NRC 96-505

, Energy Research, Inc.

resolve issues and incorporate plant-specific knowledge. WE IPEEE team members were trained and involved in all aspects of the IPEEE project. Plant walkdowns were performed jointly by consultants and utility personnel.

The entire Point Beach IPEEE submittal received an independent internal peer review by WE licensing staff. External peer reviews were also performed, for various aspects of the Point Beach IPEEE, by contractor personnel and by IPEEE personnel at Kewaunee Nuclear Power Plant. The seismic portion of the IPEEE was broken up into two ponions for external peer review. One portion involved the seismic hazard, fragibty, interactions, and screening evaluations, and was conducted by Dr. P. Smith. The other portion involved the seismic systems analysis and equipment selection, and the human reliability analysis, and was conducted by Dr. R.J. Budnitz. Both of these reviewers evaluated the entire submittal. The seismic IPEEE also received a review by the Nuclear Safety Analysis (NSA) group head.

All editorial commem on the submittal were documented and resolved. The licensee states that only two major technical comments were made regarding the seismic analysis, and that these were addressed and resolved by means of sensitivity analyses.

Overall, a peer review, consistent with NUREG-1407 shH=, was conducted as part of the Point Beach seismic IPEEE. From the present review, however, it is not clear whether or not peer-review comments made by Professor Eduardo Kausel (see Reference [11]), regarding the SSI analysis, were incorporated or resolved as part of the IPEEE (see also Section 2.1.5 of this TER).

2.2 Brg A summary of the licensee's fire IPEEE process has been described in Section 1.2. Here, the licensee's i fire evaluation is described in detail, and discussion is provided regarding significant observations encountered in the present review.

2.2.1 . Overview and Relevance of the Fire IPEEE Process

a. Methodology Selectedfor the Fire IPEEE The fire IPEEE analysis was based on FIVE methodology [5]. "Ihe licensee has followed this methodology very closely (i.e., all three phases (Phases I through III] and all the various steps as delineated in Reference

[5] have been employed). For fire propagation analysis, the formulations described in FIVE methodology have also been employed. However, the submittal claims that the input data for these formulations may have been gleaned from the EPRI Fire PRA Implementation Guide (draft version as published in 1994, Reference [6]) to reduce some of the conservatisms in the FIVE methodology.

For CDF evaluation, the internal events model of the PSA developed for the Point Beach IPE has been used. However, no credit was given to safety injection, feed and bleed, and long-term cooling. From the submittal, it is inferred that only secondary side cooling via the AFW system has been considered for the core damage assessment.

Energy Research, Inc. 23 ERI/NRC 96-505

b. Key Asswnprions Usedin Performing the Fire JPEEE A list of assumptions is provided in Section 4.1.3 of Reference [1]. The key assumptions, with respect to potennally significant effects on results, include:

1. Fire barriers / boundaries are assumed to be good as rated. Active elements of a barrier (i.e., self closing /normally open fire doors, louvers, etc.) have not been addressed explicitly.

2. The automatic fire suppression systems are assumed to be able to handle the entire spectrum of fire scenarios considered in the analysis.

l

3. Offsite power is assumed to remain available if associated electrical circuits are unaffected by fire.

l

4. All cables are assumed to be non-IEEE-383 rated, with polyethylene insulation.

'5. The mission time for the analysis is assumed to be 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In later discussions, the reviewers concluded that hot shutdown is considered to be an acceptable mode for safe plant condition, and cold l shutdown /long-term cooling was not modeled.

c. Status ofAppendix R Modifcations The AWir R effort has provided a large portion of the basic information used in the fire analysis. Per Section 4.1.1 of the submittal, " safe shutdown" equipment, as defined for Appendix R compliance, have been used in the IPEEE analysis as well. 'Ihe licensee has used fire zone / area / compartment definitions, combustible loadings of compalmants, and other information generated for compliance with Appendix R  ;

I requirements. Additional information has also been collected to support the analyses. However, the licensee has not elaborated on what equipment and cables were added to the list of safe shutdown

)

equipment that was gleaned from the Appendix R study.

1

! The licensee states that all Appendix R compliance issues have been resolved.

d. 'New or Existing PRA The fire IPEEE is n'new study.

2.2.2 Review of Plant Information and Walkdown l-1 a. Walkdown Team Composition According to the submittal, extensive walkdowns have been conducted by plant personnel and consultants responsible for performing the fire analysis. The walkdowns were conducted in late 1994, in a time-span

. of about three weeks. The methodology suggested for a FIVE, Phase-III analysis has been employed. No

" details have been provided regarding the actions taken during the fire walkdowns, nor how the walkdown observations were recorded. From the IPEEE submittal it can be inferred that the following issues have

' been considered during the walkdown:

. Implementation of housekeepmg pracuces l Energy Research, Inc. 24 ERI/NRC %505

• Implementation of welding procedures

• Fire penetration integrity

• . Verification of presence of combustibles in a compartrr.ent

• Verification of compartment boundaries

• Verification of equipment and train-wise separation in the compartments

b. Signifcant Walkdown Findings The licensee states that during the walkdowns, the plant was found to be in excellent condition. The submittal states that "All combustibles were properly covered." This statement refers, perhaps, to the collection and handling of trash. Also, the submittal states that the penetration seals were found to be in excellent condition.

c. Signifcant Plant Features The submittal provides some general information about the nuclear island, engineered safeguards, and supporting systems. However, it does not provide any information on buildings and compartments that provide separation among the different systems and trains. The following is a list of plant features that >

could be gleaned from the submittal, and are deemed to be important to fire risk- l

1. The plant is a two unit, two-loop Westinghouse PWR design with 1,518.5 MWt and 497 MWe capacity per unit.

2. Unit 1 stacd cciamercial operation in December 1970, and Unit 2 in October 1972.

3. The RCPs require either component cooling water (CCW) or the charging system to maintain seal integrity (i.e., to prevent occurrence of a seal LOCA). However, it may be noted that the IPEEE submittal models only the charging system with respect to RCP seal integrity protection.

4 Each unit is equipped with one steam-driven AFW pump.

5. The two units share systems, equipment, and a large number of fire compartments. The two units share a common control room and cable spreading room. At the time of Reference [1] preparation, the vital 4160 VAC switchgear room was also shared between the two units. The room was modified, as discussed in Reference [11). Only train "A" safeguards of both units are present in the switchgear room. There are also shared componems between the two units in both diesel generator rooms, in the AFW pump room, in the non-vital switchgear area, and in the monitor tank room.

6. There are motor-driven AFW pumps that service both uniu.

7. Auxiliary feedwater pumps require service water (SW) to remain functional (with the exception that the seals for the turbine-driven AFW pump can be cooled by fire water, if service water is unavailable).

8. There is only one cable spreadmg room for both units, and there are oil-filled transformers within this room.

Energy Research, Inc. 25 ERI/NRC 96-505 l

o

. l

9. All redundam train containmam spray and safety injection pumps for both units (eight pumps total) are located in the same general area.

10. All cable trays in the cable spreadmg room are completely covered by Knowool insulating material.

2.2.3 Fire-Induced Initiating Events

a. Were initiaring Ewnts Other than Reactor Trip Considered?

A separate discussion is not provided in the submittal regarding the possibility of initiating event occurrences from a fire event; reactor trip is taken to be the only viable initiating event. In Reference [1]

there is no discussion of the possibility of loss of offsite power, inadvertem openmg of primary loop valves, etc. However, in Reference (11), the licensee states that cables related to offsite power have been cansared. A separate study is incimlad in Reference [11] that addresses the possibility of PORV or steam dump valve opening from fire-caused failures of their associated control cables. This aspect of analysis is discussed further below.

b. Were the initiaring Ewnt: Analyzed Property?

Given that Reference [1] does not explicidy address the possibility of inadvertent valve or other equipment operation, loss of offsne power, or loss of secondary systems, one may conclude that the licensee has not

' addressed the initiating events properly, in Reference [11), the licensee discusses the possibility of loss of offsite power from a fire, and states that no compartment was idennfled where such an evem is possible. The licensee gives no information about the possibility of inadvertem opening of offsne power breakers resulting from a failure (induced by a fire) in the conuel cables associated with these breakers (i.e., the breakers connecting the offsite power sources to the vital switchgear). Such failure may occur, at mmimum, from a fire in the control room or cable spreading room. For example, a small commi panel fire may cause such control circuit failures that would lead to these breakers failing open (thus, leading to loss of offsite power). Similar failures may occur from a fire inna the cable sprendag room and other rooms where the cables or equipment associated with the control circuits of these breakers are present. This omission could potentially be significant and one cannot conclude that the licensee has conducted a conservative analysis.

Regardung hot shorts and cable failures leading to inadvertent operation of a component, the licensee re to the analysis performed for Appendix R compliance. The licensee argues that, Pice Appendix R has addressed hot short issues and the IPEEE effort is based on Appendix R results, the hot short issue is then properly addressed in the IPEEE fire analysis. However, it may be noted that Reference [1] does not include any discussion regarding the effects of inadvertent valve operation. Theoretically speaking, if a licensee conducts a comprehensive analysis of safe shutdown paths and potential failures from a fire, all relevant spurious actuations and other failures would be identified properly. In Reference [11), the licensee addresses the possibility of inadvertent opening of a PORV or an atmospheric steam dump valve.

1 The licensee shows that all fire compartments have been investigated for the possibility of these two imnasmg events. However, aside from these two events, no other imnating events are discussed. Although l the licensee does mention in Reference [11] the assumption that RCP seal integrity is solely dependent on the charging system, Reference [1] has not discussed the possibility of this initiating event. Component cooling is not credited for protecting the RCP seals.

I 26 ERI/NRC 96-505 Energy Research, Inc.

l

i In summarf, from Reference [11] it is not clear whether all initiating events were examined for the possibility of occurrence from a spurious actuanon of equipment. This omission implies that the hot short (or spurmus actuadon) phenomenon may not have been properly addressed in the Appendix R analysis of

' this plant for the complete set of W5 events. A comparanve review of the Appendix R safe shutdown model versus that for the IPE subminal may be warranted to identify those initiating events that may occur from a fire. One can then idendfy the circuits, and thus cables, the failure of which may lead to those initiating events. If those circuits and cables (with their proper failure modes) were included in the Appendix R analysis, the licensee's statemem would then be correct.

2.2.4 Screening of Fire Zones

a. Was a Proper Screening Medsodology Dyloyed?

Overall, h can be concluded that the licensee has used a proper screening methodology. Fire areas were screened out first. A fire area may contain several companments. The compartments were screened out in the next step by taldng into account the possibility of propagation of the adverse effects of a fire beyond the compartment of origin. The licensee has utilized the information gathered from the Point Beach internal flooding analysis to conduct an initial screening of the compartmems. The licensee has stated that the presence of electrical cables has been taken into account in this screening process.

In Step 4 of Phase I, fire asses nre screened out based on the presence of safe shutdown components and cables. Of 46 fire areas,24 were screened out in this step.

In Step 5 of Phase I, the fire compamnsus within the fire areas have been screened out, assuming that the fire does not propagate outside the compartmem. The descriptions provided in the submitral (Section 4.1.1) for Steps 4 and 5 of Phase I are rather poor, and h can be imerpreted that the licensee has used an incorrect approach for screening the companments.

In addition to individual compartment screening, in Step 6 of Phase I, the licensee has considered the possibility of tire affecong cables and eqmpment in more than one compartment, and has implemented the {

fire comparnnent interaction analysis (FCIA) methodology of FIVE. As a result of this step, a series of

" combined compartments

• have been identified following the instructions in FIVE.

1 In Phase II of the analysis, other screening steps have been used. In Step 1, ' Combined compartments" have been screened out based on a fire igmnon frequency of 104/yr. In Step 2, the unavailabilities of safe shutdown wei-:= = that can survive the fire have been computed; and, if the CDF was found to be less than 104/ry, the combined compartments were screened out. The process was repeated in Step 3, where the unavailabilities of suppression systems were introduced for CDF evaluation.

The addnional effort desenbod in Reference [11], in connection with PORV or steam dump openings, has lead to the identification of 12 compartments where such initiating events are possible. The licensee has computed the associated CDFs, and has concluded that the frequencies are significantly smaller than results associated with reactor trip. This conclusion is consistent with fire analyses performed for other PWRs.

Energy Research, Inc. . 27 ERI/NRC 96-505

b. Haw the Cable Spreading Room and the Control Room Been Screened Out?

Cable spreading room and control room fire events have been considered. Cable spreading room fire events have been treated in som: detail. It should be noted that the cable spreading room at Point Beach includes oil-filled transformers. The cable spreading room did not get screened out in any step of the analysis. In the last step, the room was subdivided into smaller areas, and fire propagation analysis was perfonned using FIVE formulations.

Per Section 4.6.4 of the subminal, control room fires have been screened out. However, this result is not supponed in Table 4.1.2-3, and the control room is discussed in submittal Sections 4.6.5 and 4.7. The CDF of 4.581 x 104/ry presented for the control room is not supported by Tables 4.1.2-1 through 4.1.2-3.

However, Reference [11] provides the basis for this CDF result in terms of four cabinet fires. The discussion does not specify the lahdag event that may result from these fires. It does state, however, that loss of AC power in a control room fire is not possible. This statement may not be valid since the ,

I controls for the breakers for offsite power connections to the vital switchgear may fail sad lead to inadvertent opening and loss of offsite power. 'lhe probability of operator failure to control the plant from the remote shutdown panel, following evacuation of the control room, was taken to be 0.05.

c. Were There Any Mre Zones / Areas That Han Been bnproperly Screened Out?

From a cursory review of the types of areas that have been' screened out in Table 4.1.1, it can be concluded that the licensee has selected a reasonable set of areas for detailed analysis. The same can be concluded with regard to Table 4.1.2-3, but with a lesser degree of certamty because (aside from the cable spreading room and comrol room) there are large differences in the cable rouang practices among nuclear power plants. : In short, from the information provided by the licensee, no fire zones could be identified as being unreasonably screened out.

2.2.5 Fire Hazard Analysis

@e fire ignition frequencies for various compartments have been established using the data and (

farmulations provided as part of the FIVE methodology. Since the cable spreading room of the plant l contains oil-filled transformers, and the cables are non-IEEE-383 rated, the ignition frequencies had to be adjusted to retlect these plant-specific conditions,  ;

I Plant-specific fire occurrences have not been used to generate the fire ignition frequencies. However, fire events for the past 5 years were reviewed by the licensee to ensure that there are no unusual recurrences of fires at Point Beach that would warrant a plant-specific fire frequency evaluation.

From an overall review of the licensee's approach, it is concluded that the fire frequencies used for the various compartments are within the range of values expected for the types of compartments under study.

2.2.6 = Fire Growth and Propagation

- The licensee has used the fire growth formulations of FIVE to assess the possibility of damage to various ,

targets and the pivpe.gica of fire to other combustibles, in several cases, the licensee has concluded that, l despite the presence of pumps or other ignition sources, damage to cables of redundant trains present in '

28 ERl/NRC 96-505 l Energy Research, Inc.

a compartment is not possible. A different conclusion may have been reached if the licensee had varied the severity of the ignition source.

Reference [11] states that some of the heat release rates and equipment damage temperatures that were n'ot provided in FIVE were gleaned from EPRI's Fire PRA Imp'ementation Guide (6). In this regard, it is important to note that the FIVE methodology has been approved by the NRC, whereas Reference [6] has not yet been approved, and the heat release rates provided in that document are considered to be optimistic.

1 As stated above, the cable spreading room did not get screened out, and in the last step the room was subdivided into smaller areas, and fire propagation analysis was performed using FIVE formulations. The subnuttal states that "Only fixed source / combustible configurations are modeled." It can be inferred from this statement that no transiem fuels have been comidered in the last step of the analysis. Given that there are many electrical equipment in the compartment, the conclusion regarding lack of transient fuels is optimistic.

The cable spreading room contains 480 V switchgear and oil-filled transformers. Such items have a greater chance of causing a large fire than other electrical equipment typically found in a nuclear power plant. In Reference [11], it is stated that all the cable trays inside the cable spreading room are covered with Kaowool insulating material. Assuming that there is no damage or misapplication of the insulating material, the long failure times would be proper only for localized fires. However, Kaowool may not provide the necessary protection in the case of a severe fire involving an oil-filled transformer.

The cable spreading room (Compartment 318) and electrical equipment rooms (Compartments 245 and 246) contain oil-filled transformers. If the oil is combustible, there is a potential for a large fire from severe transformer failure. Such fires are generally initiated with an explosion. The submittal does not address the potential for a large fire or explosion in a transformer, which may have sufficient energy to i

jeopardize the integrity of fire boundaries. Potential vulnerabilities may have been overlooked from the omission of fire scenarios involving an energetic rupture of a transformer or an extremely large fire in l these rooms,

a. Deatment of Cross Zone Fire Spread and Associated Major Assumptions Cross-zone fire spread has been included in the IPEEE analysis. The FCIA methodology of FIVE has been employed, which focuses on barrier integrity and fire loading in the compartment. Reference [11]

states that " active fire barrier like fire dampers are not required to be addressed per the NRC approved FIVE methodology." The main basis for this statement is that fire barriers are subjected to a strict periodic surveillance program.

It is difficult to follow the results of the FCIA as presented in the submittal. Table 4.1.1-2 mentions

" combined frequency compartments" without dedning the concept. For example, compartments 101 and 109 are shown as combined frequency compartments. However, in Table 4.1.2-2 of the submittal, separate frequencies are presented for these two compartments. Reference [11] indicates that the same frequency was employed for the combined frequency compartments. Also, several combined frequency compartments may include the same subset of compartments,. For example, compartments 101 and 109 appear by themselves and in another part of Table 4.1.1-2 with compartment 104. It is not clear what is being represented by these groups of compartments. In addition, the combined frequency compartments do not seem to have been utilized in later stages of the analysis for identifying potential fire vulnerabilities.

Energy Research, Inc. 29 ERI/NRC 96-505

., l

b. Assumptions Associated ukh Detection and Suppression Automatic and manual fit detecnon and suppression possibilities have been considered. The detection and suppression system failure probabilities given in the FIVE documentation have been used for the fire CDF evaluation. As part of Phase H, Step 3 of the analysis, suppression probabilities have been estimated using the standard set of unavaliabilities given in the FIVE documentation. The exact formulations used for establishing the Pcci values have not been provided for the fire compartments. However, the Pcci values can be obtained from comparing F3 in Table 4.1.2 3 and F2 in Table 4.1.2 2 of the submittal. In some cases Pcci is much less than 108. This value is much smaller than the suppression system unavailabilities provided in FIVE. Reference [11] provides some explanation as to how these small values have been obtained. Manual fire suppression has been modeled for five fire zones [11]. For all five cases, the licensee claims that a conservative time to suppression has been used.

c. Rearment ofSuppression induced Damage to Eqndpment, ifAntilable Suppression-induced damage has not been treated explicitly. However, as part of the response to the Sandia fire risk scoping study issues, the possibility of suppression system effects on safety-related equipment has been discussed. Separate studies have been conducted where this issue is addressed. It has been concluded that there is no possibility of adverse effects on safety systems caused by a suppression system.

The possibility of damaging equipment from a redundant train, when fighting a fire in the compartment that contains the other train has not been considered. In Reference [11], the licensee states that " operators are tramed to come imo the affected zone with a hose stream." Thus, if the compartment from wh :re the brigade attacks a fire contains the equipment redundant to those contained in the burning comparanent, there is a possibilhy of spraying and damagmg the train of equipment ontamad in the compamnant where there is no fire. This scenario has not been modeled explicitly, and the licensee states that such a failure scenario is beyond the scope of FIVE. Based on experience with other tire risk studies, this position may not represent a major omission.'

d. Compurer Codes Used, ifApplicable .

FIVE software (Version 0.8b, June 1994), the computer program that is tailored to implement the FIVE methodology, has been used in the preparation of the IPEEE submittal.

2.2.7 Evaluation of Component Fragilities and Failure Modes i

a. Defnition ofFire induced Failures Component fragilities have been addressed explicitly in the IPEEE submittal. From the discussions provided throughout the submittal, it is not clear that proper failure modes of cables and other equipment have been considered. There are no discussions ofinadvertent operation as a possible control cable failure mode that may lead to equipment actuation. Since the plant has several cross-connecting trains and i

equipment shared between the two uniu, consideration of inadvertent operation is especially important to l

ensure correct analysis of potential fire scenarios. l 30 ERI/NRC 96-505  :

Energy Research,Inc.

\

I

• O 1

Since the electrical cables are non-IEEE-383 qualified, the failure temperature was taken to be 4257.

Cabinet fires were assumed to remain within the cabinet if there are no openings at the top of the cabinets and there is an air gap between adjacent cabinets.

I

b. Method Used to Determine Component Capacities l

The data provided in EPRI documents (e.g., Reference [6]) have been used to establish component i

fragilities.

c. Generic Fragiliries l

The failure temperature for non-IEEE-383 qualified cables was assumed to be 4257, as taken from EPRI documents. This value is commanaurme with industry accepted practice.

d. Plant-Spect)fcFragilities No plant-specific fragilities have been used,

e. Technique Used to Deat Operator Recowry Actionr j

The EPRI Fire PRA Implementanon Guide [6] has been used to establish human error probabilities (HEPs). For control-room and long-term actions, the human error and recovery probabilities used in the screening phases of the IPE have been used. For time windows greater than one hour, if the operator has 4

to go through the fire area, a failure probability of 0.1 was used. For short-term actions near the fire, the '

failure pd,.r,"ity was set at 1.0. The human error rate of 0.1 for an action that requires the operator to travel through the fire zone could be optimistic. k is i;nportant to note that the licensee has applied this HEP to those human actiont that require more than 1 bour, and less than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

For cable spreading room and control room fires, HEPs have also been derived. For the cable spreading i I

room and vital switchgear room, the HEP to. fail to switch to alternate power and use the alternate shutdown coral pant! was taken to be 0.05. Although this value is within the range of HEPs deemed to be reasoaable, in the majority of IPEEE submittals, and in many PSAs, a value of 0.1 has been used.

The probability of failure to control the plant from the remote shutdown panel was taken to be 0.05.

The licensee states that the possibility of feed and bleed has not been considered, and the cables associated with these actions have not been traced. However, in Reference [11], the licensee shows a probability value for feed and bleed. It is not clear whetber or not the licensee has used this value in CDF assessment.

If it has been used, the results are certainly optimistic because the position of the associated cables was not known to the analysts.

2.2.8 Fire Detection and Suppression Fire initimion frequencies were multiplied by suppression failure probabilities. The failure probabilities

, suggested in the FIVE report have been used for this purpose. The time to equipment and cable damage, and the times to fire detection and s'uppression, have been modeled only for the dominant fire scenarios.

Energy Research, Inc. 31 ERl/NRC 96-505

L , '.

l-For several fire scenarios, the licensee has used unreasonably small time periods for damage and suppression. Specifically, for Compartment 156 (motor control center [MCC) room), Scenario 2, time to automatic da=*ian and suppression is 65 seconds. Such a short detection and suppression time is not supported by industry experience. The licensee cites FIVE formulations as the basis for the tmung. It can be concluded that the licensee has employed FIVE without examining the reasonableness of the results.

For this scenario Pcci is concluded to be 2.00x104, which leads to a small core damage frequency. For i

this specific sceaario, if the timing is modified, the core damage frequency may increase by at hsst one order of ==d=6 Similar conditions exist for Compartment 166 (MCC room), Scenarios 2 and 3. and Compartment 318 (cable spreading room), Scenario 3.

For some scenarios the suppression system failure probability is multiplied with the fire initiation frequency. This is not a proper practice if there are critical sets of cables and equipment located in a small region of a computment. Thus, the possibility of damage to a critical set of cables or equipment (especially when tby are within a small region within a room) before the medium discharging from the suppression system takes effect was not considered.

Section 2.2.6(b) of this TER provides further discussion on how fire detection and suppression have been considered in the Point Beach IPEEE.

2.2.9 Analysis of Plant Systems and Sequences

a. Key Assumptions Inchsting Success Criteria and Aisociated Bases The submittal does not discuss success criteria explicitly. It is inferred that success criteria were. taken from the IPE, by assuming that the same internal events model applies to the fire accident conditions.

Only secondary side cooling via AFW pumps has been considered. No credit was given to the possibility of feed and bleed and safety injection. Also, no credit was given to component cooling. RCP seats were ,

assumed to be dependent solely on charging system availability.

b. Event hees (Functional or Systemic)

The subminal does not provide a discussion of the internal events model employed for CDF assessment. ,

. j It is inferred that the fault trees and event trees of the IPE have been used to compute conditional core l

damage probabilities by flagging fire-failed components.

c. Dependency Matrix, ifit is Diferentfrom thatfor Seismic Events A dependsacy matrix was not provided in the submittal. l i

d. Plant-Unique System Dependencies ,

i:

I' The submmal does not identify any plant-unique system dependencies, though a number of unique unit-to-unit dependencies are identified, as discussed in the following section.

l-32 ERl/NRC 96-505 Energy Research, Inc.

L_

i .

e. Shared Systemspr Multi-Unit Plant Poim Beach is a two< nut plant with a high level of dependency between the systems of the two units. For example, the motor <triven APW pumps can provide cooling to the steam generators of both units. Given the vintage of the plant,' h is expected that there are strong interconnections in the electrical power distribution systems between the two units, although the IPEEE submittal does not discuss this point. In )

i terms of plam layout, the two units share the control room, the cable spreading room, and a large number

of other plam areas. Reference (11] states that, since the time the original IPEEE was submitted, the vital switchgear room has been modified and the current design contains only train "A" of both units.

Despite the large number of shared compartments, the subminal does not idennfy the related dependencies

' properly, and more importantly, does not provide a r'un'ive analysis of fire scenarios that may lead to simultaneous occurrence of core damage at both units. Although the possibility of dual-unit core damage has been discussed, the frequency of occurrence has not been estimatad.

f. Most Signifcant Human Actions The subminal claims that the dominant hmnan errors are associated with operators failing to establish RCP seal injection via the RWST. It is inferred that this findmg applies to all dommant fire scenarios.

2.2.10 Fire Scenanos and, Core Damage Frequency Evaluation Although a complete listing of fire areas and compartments has been provided, it is'not clear which accidem scenarios (in terms of systems failures) may occur given a specific fire event. Conditional core damage probabilities have been provided, but systemic failures have not been identified. The numerical results provided in various parts of the submittal are not well correlated. It is difficult to trace the frequencies across different tables and other quamitative information/ discussions. System failures associated with risk significant fire scenarios have not been idendfled. Tables'4.6.4-1 throug'a 8 of the subminal only provide fire related information and not system trains or equipm<.at (from the internal events model) affected by the fire scenarios. The initiating events that may be caused by a fire, and the system trains and functions that may be lost as a result of a fire, have not been listed.

2.2.11 Analysis of Containment Performance

a. Signifcant Containment Perprmance insights Containmant fires have not been discussed explicitly. It can be inferred that the licensee has concluded such fires to be insignificant for Point Beach. Containment failure has been analyzed in detail for the dommant fire scenanos. 'Ihe main failure path for the containment was taken to be the failure of isolation valves to close.

'b. Plant-Unique Phenomenology Considered .

l The level-2 analysis has not been discussed in the fire IPEEE submittal. Therefore, plant-unique phenomenology has not been addressed.

l 1

Energy Research, Inc. 33 ERI/NRC 96-505 t

2.2.12 Treatment of Fire Risk Scoping Study Issues

. a. Assumprions Used to Address Fire Risk Scoping Study issues

1. The possibility of seismically induced fires has been addressed as part of the seismic walkdown agenda. From walkdown observations it has been concluded that equipment and piping containing flammable materials and combustible liquids are properly anchored and supported.

2. The possibility of seismic actuation of suppression systems and spray or flooding of safety-related equipment has been analyzed in a separate study and as part of the IPEEE seismic analysis. The licensee has concluded that there is no possibility of adverse effects on safety-related equipment. More specific review comments are provided in Section 2.1.14 of this TER.

3. The possibility of failure of the suppression systems in case of seismic activity, with consequential physical impact on safety-related equipment, has been addressed. The licensee has concluded that there are no cases where safety-relateddi , == may be damaged from such a failure. More specific review com===< are provided in Section 2.1.14 of this TER.

4. Fire barriers have been addressed per FIVE, Appendix R, and other criteria. Special procedures are in place to ensure fire barrier integrity. These procedures address fire seals, installation of fire watches, and fire doors. A special study has been conducted to address these issues per NRC

. Information Notices IN 88-04 and 88-56. Similarly, the possibility of fire damper failure was addressed in a study conducted as a result ofIN 83-69 and IN 89-52. For fire wrappings and fire barriers installed to separate redundant trains, a separate report has been prepared that addresses 3M fire barriers, in response to NRC IN 93 48 and GL 92-08.

5. Point Beach maintains a fire brigade composed of the operations staff which conducts drills and training exercises on a regular basis. Fire brigade resources and practices have been described in the IPEEE submittal. Point Beach maintains detailed fire emergency and fire fighting plans.

6. The issue of equipment survival under all adverse phenomena caused by a fire has been addressed for combustion products, spurious actuation of a fire suppression system, and misdirected operator actions. It is argued that combustion products have a slow effect on the equipment. Fire suppression system actuation has been addressed as part of the seismic evaluation. Operator actions have been addressed as part of the fire IPEEE evaluation. There are three specific fire scenarios where manual local actions are required to prevent core damage. These scenarim have been explicitly addressed in the submittal.

7. Control system interactions have also been addressed. A discussion is provided of alternate shutdown capability and the possibility of switching away and isolating vital circuits from the control room.

Alternate shutdown is achieved by manipulating switches and observing plant conditions at several different points that are located outside the control room and cable spreading room. A special procedure is in place for unit shut down using the alternate shutdown features.

34 ERI/NRC 96-505 Energy Research, Inc.

o .

b. Signifcant Findings There are no significam Endmgs assocised with the Sar.dia fire risk' scoping study issues other than those mentioned above.

2.2.13 USI A45 Issue l

a. Methods ofRemonng Decay Heat The AFW system is credhed for providing decay heat removal (DHR) capability. The licensee claims that the FEEE submittal provides the analysis necessary to address USI A45. Given that the plant is equipped with a steam-driven AFW pump that can be started locally, through manual actions, no fires can, by themselves, result in a complete loss of DHR capability.

b. Ability of the Plant to Feed and Bleed The FEEE does not mention this capability. However, from Reference [11), it can be inferred that it is possible to accomplish DHR at the plant through a feed and bleed procedure.

c. Credit Takenfor Feed and Bleed .

No credit was given to the possibility of feed and bleed, nor safety injection.

d. Presence of Thermo-Lag .,

Thermo-Lag is not presem at Point Beach.

2.3 HFD Events The Point Beach FEEE finds no unduly significant sequences (vulnerabilities) with respect to HFO events.

The most important HFO event was found to be external flooding. External flooding makes up about 4%

of the external events CDF; high winds contnbute about 0.5% of the IPEEE CDF.

The general methodology unhmi in the HFO PEEE follows that presented in NUREG-1407, and involves the following steps:

1. HFO events involving high winds, external floods, and transportation and nearby facility accidents were selected for detailed analysis.

2. A scoping analysis was p=fvuoed for selected HFO events. For high-wind events, detailed bounding and probabilistic calculations were performed. External floods were also analyzed quantitatively.

Transportation and nearby facility accidents were screened out due to low hazard frequency.

3. The HFO events analysis was documented. .

In performing Step 2 above, the following efforts were performed:

Energy Research, Inc. 35 ERI/NRC 96-505

-

• Review of plant-specific hazard data and licensing basis.

• Deterar.ination of whether or not the hazard frequency is acceptably low.

• Performance of a scoping analysis, if necessary.

• Performance of a bounding analysis or PRA, if necessary.

Significant changes since the time the plant operating license (OL) was issued were' not identified. The licensee indicated that, since the IPEEE factored in the existing as-built conditions, the HFO analysis did not specifically credi: any original analysis pertaming to the OL. As such, OL changes were not identified as part of the progressive screening approach. Both units of the plant started commercial operation prior to 1975. Therefore, the study did not evaluate compliance with the 1975 Standard Review Plan (SRP) criteria.

2.3.1 ' High Winds and Tornadoes 2.3.1.1 General Methodology De wywech implemented for the analysis of high wind and tornadoes at Point Beach was to review and update the NRC's USI A 45 study performed by Sandia National Laboratories, and documented in NUREGICR 4458 [7). De Sandia study was based primarily on a PRA analysis; however, the IPEEE submittal relies on a simple event tree model. The approach included:

• Plant familiarization i Tornado and straight wind hazard analysis (estimarian of frequencies and intensities of tornadoes and high winds)

• Tornado missile and wind-pressure fragility analyses .

• System analysis and risk quaari& arian 2.3.1.2 Plant-Specific Hazard Data and Licensing Basis Historical high-wind events were considered in the analysis of Point Beach. Safety-related equipment is protected in Class-1 type structures. Class-1 structures were designed to withstand wind speeds of up to 300 mph. These structures can also withstand two types of missiles: a 4-inch by 12-inch by 12-foot wood board traveling at 300 mph, and a 4000 pound automobile traveling at 50 mph. The submittal reports that non-Class-1 sauctures remam imaet for winds of up to 108 mph. (It should be noted that the assumption regarding non-Class-1 structures may be overly optimistic.)

Point Beach is located in Region 1 of the NRC tornado r.sk regionalization. This region has the highest tornado hazard of the three NRC tornado regions. The tornado occurrence data were obtained from the National Severe Storm Forecast Center. From 1950 through 1983, a total of 456 tornadoes occurred

. within a 145-mile radms of Point Beach. Of these tornadoes,12 had a Fujita-Pearson (FPP) rating of F4 -

(207 to 260 mph), and one had a rating of F5 (261 to 318 mph). The FPP system includes six tornado intensity classifications ranging from F0 to F5. Since Class-1 buildings are designed to withstand wind speeds of up to 300 mph, the study assumes that FO to F5 winds will not cause any damage to these buildings, nor to the equipment inside them. Since no changes in the data and the plant were observed 36 ERI/NRC 96-505

' Energy Research, Inc.

i

since the USI A45 smdy was performed, the wind hazard analysis of that study was used in the submittal.

Ahhough families of hazard curves were generated as part of USl A-45, the IPEEE study used the mean curve. This is an adequate approach.

It was further assumed that F1 through F5 tornadoes lead to loss of safety systems not housed in Class-1 type structures, and cause initiating events. Although not directly stated, it appears that loss of offsite power (LOSP), with varying degrees of recovery probability, and subsequent damage to other equipment, constitutes the leadmg core damage sequence for high winds.

Based on the mean hazard curves of NUREG/CR-4458, Tables 5.1.4-1 and 5.1.4-2 of the submittal summarize tornado and straight-wind frequencies. The total frequency of any tornado is 5.38 x 10d/yr.

This value seems to be reasonable; however, the frequency of tornadoes of F5 scale that may exceed the design-basis accident appears to be somewhat low, especially when considering the one 65-mile-long F5 tornado historically observed.

Aside from direct wind damage to systems and structures, damage due to tornado-induced missiles was also considered. De IPEEE analysis used a simplified tornado missile analysis procedure adopted by the USI A 45 smdy. His sudy yielded a value for the frequency of impact per missile per unit of target area for various tornado intensities. Conditional probabilities of missile-induced failure of some hnportant 4

components have been reported. De most vulnerable componems are the RWST (4.3 x 10 ) and the CST 4

(2.40x10 ). Combined with the frequency of occurrence of a tornado, tornado-missile hazard was found to have a negligible contribution to the total CDF.

The possibility of tornadoes striking the transmissioglines, from the switchyard to the plant, is not discussed in the submittal. It is unclear whether or not a detailed analysis of LOSP events caused by tornadoes and high winds has been performed. The conditional probability of core damage from LOSP events is dominated by the failure of both emergency diesel generators due to wind-induced failure of the diesel exhaust stacks. Recovery of LOSP given a strong tornado is not usually credited in PRAs. The recovery actions suggested may not be practical in the presence of high wind and of possible major damage '

to the transmission lines.

The total CDF contribution due to high winds and tornadoes was reported at 2.6x 10 /ry. (This value, provided in Section 1.4 of the submmal, page 13 of 15, is inconsistent with the value given in Figure 1.4-1, which is 3.4 x 104 /ry).

2.3.1.3 Significant Changes Since Issuance of the Operating License The submittal does not report any major changes since issuance of the plant OL.

2.3.1.4 Significant Findings and Plant-Unique Features The submittal does not report any new findings beyond those presented in the USI A-45 report on Point Beach. De largest CDF contribution appears to come from winds exceeding 240 mph. Such winds may ,

cause failure of the diesel generator exhaust stacks, which leads to failure of the two diesel generators.

The design-basis' tornado, with wind speed of 300 mph, was considered to be harmless to Class-1 buildings. Missiles produced by tornadoes and high winds were found to pose no major threat to the plant.

No other significant findings were cited in the sub'nittal.

Energy Research, Inc. 37 ERI/NRC 96-505

2.3.1.5 Hazard Frequency Extreme tornadoes were characterized by F-scale intensities of the Fujita scale. The frequencies of tornadoes and straight winds of various wind speeds are given in Tables 5.1.4-1 and 5.1.4-2 of the subauttal. 'Ihe mEr+: probability that a missile hhs various exposed components was calculated and summarized in Table 4.1.4-4 of the submittal. The conditional probabilities of hitting various critical l 4 Due to these low components were determined to be low (ranging from 4.30x10 to 2.58x10").

l l conditional probabilities, wind-induced missiles were not considered as being important.

2.3.1.6 Boundmg Analysis i

The study has used a PRA analysis to fbrther analyze tornado events. Although Section 5.1.4 of the l subantal refers to bounding analysis, it appears from the content of that section that the submittal relies on a best estimate probabilistic trantment of wind hazard frequency, missile generation, and assessment of the probability of structural damage caused by wind. These aspects of the analysis have already b discussed in this review.

2.3.1.7 PRA Analysis The PRA analysis implemented the following steps:

l

1. . The probabilhy of any ==ia=== failure at each wind speed was calculated using the simple event tre shown in Figure 5.1.5-1 of the submittal. The equipment are shown in this event tree.

2. The probability of each sequence was determined for each wind speed.

3. The total high-wind CDF was obtained by adding the frequencies of all high-wind sequences leading l

to core damage.

4. Recovery actions were applied.

The process above was performed separately for straight winds and tornadoes. The results were j added to find the total CDF contribution from high winds.

Overall, this process seems reasonable; however, several concerns with regards to the PRA analyses noted below:

• The event tree in Figure 5.1.5-1 of the submittal is not clear. The initiating event is cited under

' Function", and seems to be a " Support System" failure. This seems inconsistent with the discussi in the submittal, which indicates that the leading sequence is a station blackout sequence.

Furthermore, the two branch points of the tree are labeled as " Secondary Cooling (SEC)" and

" Emergency Coolant injection (ECI)". For these branch points, it is expected that more systems would be included than just those listed in the figure.

L . The calculation of component fragilities is summarized in Table 5.1.6-1 of the submittal. From the submittal, the most important component failure was found to be diesel generator exhaust stack 38 ERI/NRC % 505 Energy Research, Inc.

l L___

1

. damage, due to winds of greater than 240 mph. However, Table 5.1.6-1 does not report fragility values for wind speeds above 200 mph.

• The submittal reports, in Section 5.1.6.1, a " core melt probability due to straight winds without 4

recovery of 104 ." His value is inconnierant with the value of 10 reported in submittal Table 5.1.6-2.

a ne values for nonrecovery of LOSP and nonrecovery of diesel generators appear unjustified, given the adverse weather conditions. Another recovery action credited is repair of the damaged diesel generator exhaust stack. A nonrecovery probability of 0.1 was used, which also seems optimistic given the severe weather conditions.

• De equations used in Section 5.1.6.2 of the subminal are for P,(TM OR TW), not P,(TM AND TW).

• The role of common components between the two units, and aliga a-* issues, have not been discussed in the PRA.

Thi overall results of the PRA are inconsistent with the data provided. The licensee indicated that the details of the qvaatihadan can be found in the USI A 45 report (Appersdix G); however, the data inconsistencies listed above remain valid concerns. More rigorous presentation of the models might improve the understandmg and quality of the submittal. The addition of the two new diesel generators abould further reduce the estimated CDF due to high winds and tornadoes.

2.3.2 External Flooding i

2.3.2.1 General Methodology Point Beach is located on the west shore of Lake Michigan. As such, the principle sources of flooding are due to rising lake level combined with wind wave effects and water runup, local precipitation, and snow meltirtg. . No rivers or dams are located upstream of the plant site. Also, tsunami and ice floodmg are not considered as meaningful hazards for Point Beach. The submittal has systematically considered j the various factors that can contribute to external flooding, such as historical data on Lake Michigan floods, probable maximum precipitation (PMP), surges, hurricanes, and tsunamis. As part of the IPEEE i

study, the results of the USI A-45 study were reviewed and updated. The submittal cites a bounding l

analysis that was performed for turbine building floods.

l 2.3.2.2. Plant-Specific Hazard Data and Licensing Basis ,

The normal lake level is 578 ft International Great Lakes Datum (IGLD). Plant grade is 588.2 ft IGLD.

That is, Point Beach sits at 10.2 feet above normal lake level. The ground floor of the turbine buildmg  !

j is at 588.2 ft IGLD, and the floor of the service water pumphouse is at 587.2 ft IGLD.

l I

Flooding on Lake Michigan can occur due to storm surge. The maximum recorded lake level was 581.9 ft IGLD in 1886. The submittal mamly references the flood study performed by the U.S. Army Corps of Sa iam (COE) based on the statistical analysis oflake data [25). The results of the COE study are shown in Figure 5.2.2-1 of the submittal. The COE study log-linearly extrapolated the end part of the historical data to find the frequency of very high lake levels. The extrapolation approach was found to l

. have a significant effect on the resulting hazard For example, if the first half of the COE line was Energy Research, Inc. 39 ERl/NRC %-505

extrapolated (as opposed to the second half), the frequency of a flood at 589 ft IGLD (0.8 feet above plant 4 4 grade) was found to be 3 x 10 , as opposed to the value of 10 that the current extrapolation predicts.

The design-basis flood for Point Beach is 588.42 ft IGLD. This level is based on the maximum lake elevation and an estimmad maximum wave runup. Two natural creeks nearby drain precipitation water to Lake Michigan. The maximum recorded 24-hour precipitation for Point Beach is 6.17 inches. The drainage system allows the resulting flood to drain to the lake.

The Point Beach operating procedures require operators to respond to high lake water levels by

~

sandbagging doorways, such as access doors to the turbine building and the pumphouse.

2.3.2.3 Significant Changes Since Issuance of the Operating License he submittal does not idennfy any changes since the time of issuance of the plant OL.

2.3.2.4 Significam Findings and Plant-Unique Features No signincant findings were reported. It has been concluded thEt there are no plant vulnerabilities due to external Goods.

2.3.2.5 Hazard Frequency j

The design-basis precipitation for Poim Beach is 6.17 inches in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. This magnitude of rainfall i corresponds to an annual frequency of 10. The IPEEE included a study of the roof drainage due to i

design-basis precipitation, and the result has shown that the frequency of occurrence of a roof failure dl to design-basis precipitation is very low.

Flooding from Lake Michigan is a function of the stillwater level of the lake plus wind generated waves.

Therefore, the resultant 6nal shore elevation is equal to the level of the lake due to a storm surge or seiche, plus ti'e amous of runup on the shore due to breakmg waves. De study has updated the USI A-45l l

method of estimmung the frequency distribution of lake levels, using the 1988 COE assessment of the frequency of flooding. Tne U5I A45 study used a weighted combination of three distributions i

(Lognormal, Log-Pearson Type III ana Pearson Type III) fitted to historical data. It is unclear how the IPEEE combined the results. De results reported by the COE are slightly more conservative than the USI A-45 results. The hazard frequency of Lake Michigan flood levels, adjusted by the IPEEE, is reported in Table 5.2.5-2 of the subminal. Final hazard frequency due to flooding of Lake Michigan b discussed in Table 5.2.5-4 of the subminal. For example, the annual frequency of exceedance of a 588.8 ft IGLD flood (the turbine building floor level is 588.2 IGLD) is 3.69x 102, and of a 593.1 ft IGLD flood is 2.53 x 10". It is further usumed that the runup to elevation 592 ft IGLD would cause a one-foot water impound at the turbine building floor level.

2.3.2.6 Bounding Analysis The USI A-45 study included an evaluanon of component fragility in terms of flood elevations (ft IGLD).

The subminal uses these results to determine flooding frequency and associated consequences. The ,

fragility analysis gives credit to sandbags that mitigate leakage into the turbine building. It is unclear how )

adequately sandbags protect the buildings, especially in the presence of waves and runup. Safety l

40 ERI/NRC 96-505 Energy Research, Inc.

9 equipment (diesel generators, hnc-ies,4160 VAC switchgear, AFW pumps, containment and safety injection pumps, and service water pumps) fail at a stillwater lake level of 590 ft IGLD, and at a runup water level of 5% ft IGLD. The imponance of crediting sandbags is significant. A simple examination of Table 5.2.54 shows that, without sandbags, a 6-12 inch water level at the turbine building floor level causes safety ==d='a=* failures (with a frequency between 3.69 x 10'2 and 2.53 x101/yr). The frequency reduces to about 104/yr for 5% ft IGLD (which is closer to the level with sandbags). The plant emergency procedures call for saraibaggbg the turbine building door if there is a high lake level. Funher justification for the effectiveness of this flooding protection method is necessary. The probability of exceeding the height of the sandbags is reported as being 2.gx104/yr. Once the turbine building is Gooded, the auxiliary buddag can also be flooded, resulting in failure of safety injection, RHR, charging pumps, CCW, and conmimn= sprays, thus leading to core damage. Hence, the licensee's reported CDF d

for external Gooding is 2.8x10 /ry.

In summary, it is the finding of this review, that some concerns still exist with the external flooding analysis for Point Beach. Specifically, there is concern over: (1) whether the reported annual frequencies of exceedance for water level at the turbine building include wave run-up and wind effects; (2) the effectiveness credited to the use of sandbags (since the submittal repons a reduction of over two orders of ===='ade in the turbine buildmg flooding frequency when sandbags are credited); and (3) whether the turbine building walls are concrete all around, and if not, whether sandbags are used all around the building, or only at the doors.

2.3.3 Transportation and Nearby Facility Accidents i 2.3.3.1 General Methodology The Point Beach IPEEE submittal has addressed aircraft crashes; water, rail, and highway transportation events; and nearby facility accidents.

The submittal uses the 10 CFR Part 100 criteria for aircraft crashes into the site. These criteria include addressing all airports within 25 statute miles of the plant, the number of operations per year, and a

- number-distance criterion calculated as a function of distance from the airport. The analysis results for Point Beach are listed in Table 5.3.1-1 of the submittal.

2.3.3.2 Plant-Specific Hazard Data and Licensing Basis There are four airports within 26 statue miles of the site, and they all meet the acceptance criterion of 10 CFR Pan 100. As such, according to the criterion, the frequency of crashes at the site can be considered to be less than 103 /yr.

No heavily traveled highway passes close to the site. Therefore, no hazard from land transponation was considered in the submittal.

No water transpon danger exists for Point Beach, since the plant location and intake facilities of the plant keep water traffic away from the plant.

No hazardous pipelines run in the vicinity of the plant. As such, no vulnerabilities to nearby facility accidents were considered.

Energy Research, Inc. 41 ERI/NRC 96-505

- The submittal does not consider other transportation and nearby facility hazards, although no licensing basis or other information is provided for not considering such hazards.

2.3.3.3 Significant Changes Since Issuance of the Operating License The submittal does not indicate any major changes since the time of issuance of the plant OL.

2.3.3.4 Significant Findings and Plant-Unique Features No significant findings are discussed in the submittal for any of the transportation and nearby fac accidents.

2.3.3.5 Hazard Frequency 4

For aircraft crashes into the site, a frequency of occurrence of less than 10 /yr was estimated, by relying on the 10 CFR Part 100 acceptance criterion. This result constitutes the impact frequency, and does not represent the frequency of core damage. Since this frequency is small, the submittal reports t analysis was p=fus.si for calculating the conditional probability of core damage given a crash.

No hazard frequency esnmawa were made for any other transportation and nearby facility acciden l

Quahtsnve pt=== bave been used to screen out all of the rammining events. The submittal states '

the frequency of explosion from onsite pipelines is small.

Since all of the transportation and nearby facility accidents were screened out due to their low freque '

of occurrence, no bounding or PRA calculations were performed.

2.4e- termev h==== (cu-ut. cm-ua. cm 1M ==d co-172) 2.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control PanelImeraction" .

GSI-147 addresses the scenario of a fire occurring in a plant (e.g.,' in the control room), and conditio which could develop that may create a number of potential control system vulnerabilities. Control sys interactions can impact plant risk in the following ways:

• Electrical independence of remote shutdown control systems

• Loss of control power before transfer

• Totalloss of system function

• Spurious actuation of components l The licensee claims that hot shorts have been considered in the analysis since Appendix R informa been used which includes hot shorts. In Reference [11] (in response to RAI No.4), the licensee address the possibility of inadvertent opemng of a PORV or an atmospheric steam dump valve. Sin has followed the guidance provided in FIVE concermng control system interactions, all circuitry as with remote shutdown is assumed to have been found to be electrically independent of the control room 42 ER1/NRC 96-505 Energy Research, Inc.

l l

l

2.4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" GSI-148 addresses the effectiveness of manual fire-fighting in the presence of smoke. Smoke can impact plant risk in the following ways:

• By reducing manual fire-fighting effectiveness and causing misdirected suppression efforts

• By damaging or degrading electronic equipment

• By hampering the operator's ability to safely shutdown the plant

• By initiating automatic fire protection systems in areas away from the fire Reference [26] identifies possible reduction of manual fire-fighting effectiveness and causing misdirected suppression efforts as the central issue in GSI-148. Manual fire-fightmg was credited in the analysi specific mformation was prcmded concermng the pM for smoke to reduce manual fire-fightmg effecoveness or sbduc suppression efforts.

2.4.3 GSI-156, " Systematic Evaluation Program (SEP)"

GSI-156 addresses issues encountered at plants that were licensed prior to the time the 1975 Standard Review Plan (SRP) was issued. Among other concerns, GSI-156 issues relate to seismic; fire; and high winds, floods, and other (HFO) external events. Reference (26] provvies the description of each SEP issue stated below, and delineates the scope of information that may be reponed in an IPEEE submittal relevant to each such issue. 'Ihe objective of this subsecnon is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-156 may be found.

Settlement of Foundations and Buried Eqdpment Damerintian nf the T==n* [26]: The objective of this SEP issue is to assure that safety-related structures, systems and components are adequately protected against excessive settlement. The scope of this iss includes review of subsurface materials and foundations, in order to assess the potential static and seismically induced settlement of all safety-related structures and buried equipment. Excessive settlemen or collapse of foundations could result in failures of structures, interconnecting piping, or control systems, such that the capability to safely shutdown the plant or mitigate the consequences of an accident could be comprised. This issue, applicable mamly to soil sites, involves two specific concerns:

• potential impact of static settlements of foundations and buried equipment where the soil might not have been properly prepared, and a seismically induced riettlement and potential soil liquefaction following a postulated seistric event.

Static settlements are not believed to be a concern, and the focus of this issue (when considering relevant information in IPEEEs) should be on seismically induced seulements and soil liquefaction. It is anticipated that full-scope seismic IPEEEs will address these concerns, following the guidance in EPRI NP-6041.

Sections 3.1.2.1 and 3.1.3.10 of the Point Beach IPEEE submittal provide a general discussion of site soil properties. The Point Beach site is a soil site, with the safety-related plant structures founded on sti very-stiff glacial deposits over fractured dolomite bedrock, with a total depth of soil deposits of approximately 100 feet. (The upper 16 feet, or so, of site soil consists of a layer of very stiff glacial till:

43 ERI/NRC 96-505 Energy Research, Inc.

I the next 35 feet derme a layer of stiff glaciallacustrme deposits; and the bottom 50-foot layer consists of stiff to very stiff glacial till. The glacial till and glaciallacustrine deposits are comprised primarily of a stiff clay matnx, with some sands and gravels.) The seismic IPEEE has included analyses of the following

. three categories of potential soil failures: (1) liquefaction, (2) transient and permanent displacements and setdaments of buildings, and (3) displacements of buried piping from the screenhouse to the intake crib.

Soil response analyses were conducted for PGA values of 0.2g, Q.5g and 0.8g. The evaluations of these potential soil failures are discussed in Section 3.1.4.2 (pages 148 and 149) of the submittal.

Dant intepity and Site Flooding D-ere=rian of the 1*= [26]: The objecuve of this issue is to ensure the ability of a dam to prevent site flooding and to ensure a cooling water supply. The safety functions would normally include remaining stable under all conditions of reservoir operation, controlling seepage to prevent excessive uplifting water pressures or erosion of soil materials, and providing sufficient freeboard and outlet capacity to prevent overtopping. Therefore, the focus is to assure that adequae safety margins are available under all loading conditions, and uncontrolled releases of retained' water are prevemed. The concern of site floodmg j

resulting from non-seismic failure of an upstream dam (i.e., caused by high winds, floodag, and other l

events) is addressed as part of the SEP issue " site hydrology and ability to withstand floods." The concerns of site floodmg resulting from the seismic failure of an upstream dam and loss of the ultimate heat sink caused by the seismically induced failure of a downstream dam should be addressed in the seismic portion of the IPEEE. De guidance for performing such evaluations is provided in Section 7 of EPRI NP-6041. As requested in NUREG-1407, the licensee's IPEEE submittal should provide specific information addressing this isme,if applicable to its plant. Information included for resolution of USI A-45 is also applicable to this concern.

De Point Beach IPEEE submittal states, in Table 5.2.2-1 (page 30 of Section 5), that there are no dams located upstream of the plant site.

Site Hydrology an'd Ability to 91dnstand Floodt .

l I

Daerr=rian of the i== [26]: The objective of this issue is to identify the site hydrologic characteristics, in order to ensure the capability of safety-related structures to withstand floodmg, to ensure adequate

' cooling water supply, and to ensure in-service inspection of water-control structures. This issue involves assessing the following:

i

• Hydrologic conditions - to assure that plant design reflects appropriate hydrologic conditions.

• Flooding potential and protection - to assure that the plant is adequately protected against floods.

• Ultimate heat sink - to assure an appropriate supply of cooling water during normal and emergency shutdown.

As requested in NUREG-1407, the licensee's IPEEE subminal should provxie information addressing these concerns. The concern related to in-service inspection of water-control structures, a compliance issue, is not being' covered in the IPEEE.

l Energy Research, Inc. 44 ERI/NRC 96-505

The Point Beach IPEEE has included an evaluation of external floods (Section 5.2 of the submitta including flooding on Lake Michigan,' wave run-up, and local flooding due to intense precipit snowmelt (including roof ponding effects). Section 5.2.2 of the submittal describes flood screenin assessments for Lake Michigan flooding and for local precipitation and snow effects; Section 5.2.

provides flood design-basis infus.adon; Section 5.2.4 describes an analysis of Lake Mic Section 5.2.5 summarizes results of the analyses for lake flooding and local precipitation; Sect

. describes the approach and results of roof floodmg analysis; and Section 5.2.7 describes component vulnerabilities to floodmg. With respect to flooding, the IPEEE submittal cites information and ana included in NRC's report on USI A-45 [7].

IndustrialHazards Da=crintian of the i==na [26):

The objecove of this issue is to ensure that the integrity of safety-related structures, systems, and components would not be jeopardized due to accident hazards fro facilities. Such hazards include: shock waves from nearby explosions, releases of hazardous gases, chemicals resulting in fins or explosions, aircraft impacts, and missiles resulting from nearby e As requested in NUREG-1407, the licensee's IPEEE submittal should provide informati issue.

The Point Beach IPEEE submittal (Section 5.3) includes the following information of relevance t issue: Seenon 5.3.1.1 discusses potennal aceviana at nearby industrial facilities; Section 5.3.1.2 d potential ground, water, and air transportation accidents; page 56 of Section 5 notes that th pipelines in the vicinity of Point Beach Nuclear Plant; and Section 5.4 discusses the po of turbine missiles from a conventional standby power gas turbine located onsite.

Tornado Mssiles Da=reinrian of the kana [26): The objective of this issue is to assure that plants constructed prior to Safety-related structures, systems, and

'(SEP plants) are adequately protected against tornadoes.

components need to be able to withstand the impact of an appropriate postulated spectru generated missiles. As requested in NUREG-1407, the licensee's IPEEE submittal sho information addressing this issue.

The Point Beach IPEEE has involved an evaluation of tornado-induced missiles, as documented

' 5.1.1,5.1.4.1,5.1.4.4,5.1.5.1.2, and 5.1.6.2 of the submittal. With respect to tornadoes, the submittal cites information and analyses included in NRC's report on USI A 45 [7].

Sewre Weather Efects on Structures Decerintinn of the Teen [26): The objective of this issue is to assure that safety-related structures, systems, and components are designed to function under all severe weather conditions to whi be exposed. Meteorological phenomena to be considered include: straight wind loads, tornadoe and ice loads, and other phenomena judged to be significant for a particular site. As requested in N 1407, the licensee's IPEEE submittal should provide information specifically addressing high w floods. Other severe weather conditions (i.e., snow and ice loads) were determined to have insignifican effects on structures (see Chapter 2 of NUREG-1407).

45 ERI/NRC 96-505 Energy Research, Inc. 1

)

/

1

The Point Beach IPEEE has included evaluations of high winds (straight wind loads and tornadoes) and external Soods. Section 5.1 of the submittal discusses severe winds and tornadoes, and Section 5.2 of the submittal discusses external floods.

Design Codes, Criteria, and Load Combinations Duccintinn of the t==n* [26): The objective of this issue is to assure that structures i'nportant to safety should be designed, fabricated, erected, and tested to quality standards commensurate with their safety function. All strucares, classified as Seismic Category I, are required to withstand the appropriate design conditions without impairinent of structural integrny or the performance of required safety functions. Due to the evolutionary nature of design codes and standards, operating plants may have been designed to cod r.nd critana which differ from those currently used for evaluating new plants. Therefore, the focus of this issue is to assure that plant Category I strucmres will withstand the appropriate design conditions (i.e.,

against seismic, high wmds, and floods) without impairment of structural integrity or the performan required safety function. As part of the IPEEE, licensees are expected to perform analyses to iden l

p=*ial severe accident vulnerabilities associated with external events (i.e., assess the seismic c) of their plants either by, performing seismic PRAs or SMAs).

j The Point Beach IPEEE has included an evaluation of p=*ial severe accident vulnerabilities associated I with external events. The submmal does not systematically identify codes, criteria, and load combinations used in design. Sections 3.1.2, 3.1.3.9, and 3.1.4.2 (page 147) of the submittal provide some brief information on the seismic category classification and seismic design criteria and loadings for building structures. Design crueria and information regarding the plant's design provisions for withstanding high wind effects and flood effects are prtmded, respecovely, in Secnon 5.1.3, and in Sections 5.2.3 and 5.2.6,  !

of the IPEEE submittal.

Seismic Design of Structures, Systems, and Components Descrintinn nf the i==n* [26): The objecove of this SEP issue is to review and evaluate the original seismic design of safety-related structures, systems, and components, to ensure the capability of th to withstand the effects of a Safe Shutdown Earthquake (SSE).

The Poim Beach IPEEE is based on a seismic PRA, which has evaluated failure probabilities of the plan and plam suuctures, systems, and componems, at various ground motion levels. The related analyses are documented in Sections 3.1.2 to 3.1.5 of the submittal.

Shutdown Systems and ElectricalInstrumentation and Control Features n=criptinn of the i==ne [26]: The issue on shutdown systems is to address the capacity of plants to en reliable shutdown using safety-grade equipment. The issue on electrical instrumentation and control is t assess the functional capabilities of electrical instrumentation and control features of systems required safe shutdown, including support systems. These systems should be designed, fabricated, installed, a tested to quality standards, and remam functional following external events. In IPEEEs, licensees wer requested to address USI A45, " Shutdown Decay Heat Removal (DHR) Requirements," and potential vulnerabilities associated with DHR systems following the occurrence of external ev resolution of USI A45 should address these two issues.

46 ERI/NRC %-505 Energy Research, Inc.

The licensee provides some brief sharnanian of its treatment for resolution of USI A-45 for external events in Sections 3.2 (page 207 of Section 3) and 4.9 (page 109.of Section 4) of the Point Beach IPEEE

' submittal. These discussions, and the HFO portion of the submittal, extensively cite information from Reference [7], a previous USI A 45 study for Point Beach sponsored by the NRC.

2.4.4 ' GSI 172, " Multiple System Responses Program (MSRP)"

Reference [26] provides the description of each MSRP issue stated below, and delineates the scope of information that may be reported in an IPEEE subminal relevant to each such issue. The objective of this subsection is only to identify the location in the IPEEE submsual where information having potential relevance to GSI-172 may be found.

Common Cause Failures (CCFs) Related to Bonan Errors Dascription of the haue [26): CCFs resultag from human errors include operator acts of commission or omission that could be ! Nag events, or could affect redundant safety-related trains needed to mitigate the events. Other human errors that could initiate CCFs indude: manufacturing errors in components that affect rarkmrtant trains; and inaranannn, rnninranance or testag errors that are repeated on redundant trains.

In IPEEEs, licensees were requested to address only the human errtsrs involving operator recovery actions following the occurrence of external intiating events.

Information related to operator' recovery actions following seismic events is provided in the following locations of the submittal: Sections 3.1.3.1,3.1.3.6, and 3.1.5.3. The submittal addresses operator recovery actions for fire events in Sections 4.6.2, 4.8.4.3, and 8.2.2. Additionally, the submittal's discussion of high winds provides some brief information on operator recovery actions in Sections 5.1.5 and 5.1.6; and the discussion of external flooding, in Section 5.2.7, cites possible human actions with respect to sandbagging operations.

Non-Sqfery-Related Control System /Sqfety-Related Protection System Dependencies D-intian of the Teena [26]: Multiple failures in non-safery-related control systems may have an adverse impact on safety-related protection systems, as a result of potential unrecognized dependencies between control and protection systems. The concern is that plant-specific implementation of the regulations regarding separation and independence of control and protection systems may be inadequate. The licensees' IPE process should provide a framework for systematic evaluation of interdependence between safety-related and non safety-related systems, and should identify potential sources of vulnerabilities. The

' dependencies between safety-related and non-safety-related systems resulting from external events - i.e.,

concerns related to spatial and functional interactions - are addressed as part of " fire-induced alternate shutdown and control room panel interactions," GSI-147, for fire events, and " seismically induced spatial and functional interactions" for seismic even:s.

Information provided in the Point Beach IPEEE submittal pertammg to seismically induced spatial and functional interactions is identified below (under the heading Scismically Induced Sparial and Functional

. Inreractions),' whereas information pertaming to fire ~mduced alternate shutdown and control panel interactions has already been identified in Section 2.4.1 of this TER.

47 ER1/NRC 96-505 Energy Research, Inc.

i Heat / Smoke / Water Propagation Efeusfom Fires Daa~imian of the t==na [26]: Fire can damage one train of equipment in one fire zone, while a redundant train could potentially be damaged in one of following ways:

• Heat, smoke, and water may propagate (e.g., through heating, ventilation and air conditioning

[HVAC) ducts or electrical conduit) into a second fire zone, and damage a redundant train of equipment.

• A random failure, not related to the fire, could damage a redundant train.

• Multiple non-safety-related control systems could be damaged by the fire, and their failures could affect safety-related protection equipment for a redundant train in a second zone.

A fire can cause unintended operation of equipment due to hot sboits, open circuiu, and shorts to ground. 1 Consequently, components could be energized or de-energized, valves could fail open or closed, pumpsl could continue to run or fail to run, and electrical breakers could faii open or closed. The concern of water propagation effects resulting from fire is partially addressed in GI-57, " Effects of Fire Protec System Actuation on Safety-Related Equipment." The concern of smoke propagation effects is al in GSI-148. 'Ihe concem of alternate shutdown / control room interactions (i.e., hot shorts and other items -l l

just mentioned) is addressed in GSI-147.

Information provided in the Point Beach IPEEE submittal pertaining to GSI-147 and GSI-148 has alread been identified in Sections 2.4.1 and 2.4.2 of this TER. Some informanon pertaining to this issue is provided in Section 4.8.4 of the submittal.

Efeas of Rre Suppression System Actuation on Non-Safety-Related and Safety-Related Equipment Bacrintinn of the t==n* [26): Fire suppression system actuation events can have an adverse effect on safety-related components, either through direct contact with suppression agents or through indirect imeraction with non-safety related components.

Some information perQ to suppression-induced damage to equipment, as well as seismically induced inadvertent actuation of fire suppression systems, can be found, respectively, in Sections 4.8.1.2 and 4.8.4.2 of the IPEEE submittal.

Efects of Flooding and/or Moisture intrusion on Non-Safety-Related and Safery Related Equipmen Ducrintinn nf the lgggg [26)* Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-relat equipment. This type of event can result from external flooding events, tank and pipe ruptures, a of fire suppression systems, or backflow through parts of the plant drainage system. The IPE process addresses the concerns of moisture intrusion and internal fioodmg (i.e., tank and pipe ruptures or backflow through part of the plant dramage system). The guidance for addressing the concern of external flo is provided in Chapter 5 of NUREG-1407, and the concern of actuations of fire suppression sys provided in Chapter 4 of NUREG-1407.

48 ERI/NRC 96-505 Energy Research, Inc.

The following information is provided relevant to this issue: the Point Beach IPEEE submittal discusses external flooding in Section 5.2; discussion is provided in Section 4.8.4.2 regarding actuations of fire suppression systems; discussion of seismically induced inadvertent actuation of fire suppression systems

' is provided in Section 4.8.1.2; and seismically induced internal flooding is discussed in Section 3.1.3.3.

Seismically Induced Sparial and Funcrional interactions s Dacerintinn of the fama [26): Seismic events have the potential to cause multiple failures of safety-related systems through spanal and hach=1 interactions. Some particular sources of concern include: ruptures in small piping that may disable essential plant shutdown systems; direct impact of non-seismically q j

qualified structures, systems, and components that may cause small piping failures; seismic functiona '

interactions of control and safety-related protection systems via multiple non-safety-related control systems' failures; and indirect impacts, such as dust generanon, disabling essential plant shutdown systems. As part of the IPEEE, it was = pari &=lly requested that seismically induced sparial interactions be addressed during plant walkdowns. The guidance for performing such walkdowns can be found in EPRI NP-6041. ,

The Point Beach IPEEE has included a seismic walkdown which investigated the potential for adverse physical interactions.- The submittal states that EPRI NP-6041-SL and GIP guidelines were followed i the seismic walkdowns. Relevant informarinn can be found in Sections 3.1.2.3, 3.1.3.2, 3.1.3.3, 3.1.4.2, and 4.8.1 of the submittal.

Seismically laduced Mres Descrintinn of the h=a [26]: Seismically induced fires may cause multiple failures of safety-related I systems. The occurrence of a seismic event could create fires in multiple locations, simultaneously degrade fire suppression capability, and prevent mitigation of fire damage to multiple safety-related l

systems. Seismically induced fires is one aspect of seismic-fire interaction concerns, which is addressed as part of the Fire Risk Scoping Study (FRSS) issues. (IPEEE guidance specifically requested licensees l

to evaluate FRSS issues.) In IPEEEs, ammically induced fires should be addressed by means of a focused seismic fire interactions walkdown that follows the guidance of EPRI NP-6041. l l

The Point Beach IPEEE submittal provides discussion regarding seismically induced fires in Sections i 3.1.3.2 and 4.8.1.1.

Seismically Induced Rre Suppression System Actuation Damerintinn of the fema [26]; Seismic events can potentially cause multiple fire suppression system actuations which, in turn, may cause failures of redundant trains of safety-related systems. Analyses currently required by fire protection regulations generally only examine inadvertent actuations of fire suppression systems as single, independent events, whereas a seismic event could cause multiple actuations of fire suppression systems in various areas.

Some informanon pertaining to seismically induced inadvertent actuation of fire suppression systems can be found in Section 4.8.1.2 of the IPEEE submittal.

Energy Research, Inc. 49 ERI/NRC %-505

1 Seismically induced Flooding D=cemeinn of the t=== [26):- Seismically induced flooding events can potentially cause multiple failures of safety-related systems. Rupture of small piping could provule flood sources that could potential Similarly, non-seismically qualified tanks are a multiple safety-related components simuhaneously.

posantial flood source of concern. FEEE guidance specifically requested licensees to address The submittal provides discussion regarding seismically induced internal flooding in Section 3.1.

Related infonnation is provided in Section 4.8.1.2 with respect to seismically induced inadvertent ac of fire protection systems. The IPEEE external flooding analysis does not address seismical external floods, but notes that there are no dams upstream of the plant site.

Seismically Induced Relay Oatter D=erintion of the i=== [26): Ennantini relays must operate durmg and after an earthquake, and must meet one of'the following conditions:

a remain functional (i.e., without occurrence of contact chattering);

• . be seismically qualified; or l a be chatter acceptable.

It is possible that contact chatter of relays not reqmrod m operate during seismic events ma unanalyzed faulting mode that may affect the operability of equipment required to mitigate the  ;

IPEEE guidance specifically requested licensees to address the issue of relay chatter.

The Point Beach seismic IPEEE has included an evaluation of relay chatter (based predominan detailed relay chatter evaluation performed for US! A-46). Relevant information is provided in 3.1.2.3 and 3.1.4.2 (page 146 of Section 3) of the IPEEE submittal.

Evaluation of Eanhquake Magnitudes Greater than the Saft Shutdown Earthquake The concern of this issue is that adequate margin may not have been Dancrintinn of the itana' [26): l included in the design of some safety-related equipment. As part of the IPEEE, all licensees a) to identify potential seismic vulnerabilities or assess the seismic capacities of their plants el paforming seismic PRAs or seismic margms naamammants (SMAs). The licensee's l vulnerabilities (or unusually low plant seismic capacity) due to seismic events should address th The Point Beach IPEEE has included a seismic PRA, as documented in Section 3 of the subm seismic input for the PRA is described in Sections 3.1.1, 3.1.3.9, and 3.1.4. As noted in th evaluated plant high-confidence oflow-probability of failure capacity spectrum does not ex plant's design (SSE) spectrum over some important frequency ranges.

Efects ofHydrogen Line Ruptures Decerintion of the 1==n= [26]: Hydrogen is used in electrical generators at nuclear plants to reduce windage losses, and as a heat transfer agent. It is also used in some tanks (e.g., volume co >

a cover gas. Leaks or breaks in hydrogen supply piping could result in the accumulation o 50 ERI/NRC 96-505

, Energy Research, Inc.

d mixture of air and hydrogen in vital areas, resulting in a fire and/or an explosion that could damage vital safety related systems in the plants. It should be anticipated that the licensee will treat the hydroge and tanks as potential fixed 6te sources as described in EPRI's FIVE guide, assess the effects of hydro line and tank ruptures, and report the results in the fire portion of the IPEEE submittal.

The Point Beach IPEEE submittal provides no systematic evaluation of the potential and effects of hydrogen line and tank ruptures. However, in the evaluation of seismically induced fires, some at was given to the potential for seismically induced failures of components containing hydrogen. Re information can be found in Sections 3.1.3.2 and 4.8.1.1 of the submittal.

/

i 1

i I

l 9

51 ERl/NRC 96-505 EnerFy Research, Inc.

i -

3 OVERALL EVALUATION, CONCLUSIONS, AND RECOMMENDATIONS 3.1 Seismic The seismic IPEEE of Poira Beach Nuclear Plant addresses the major elements specified in NUREG-1407 as recommended items that should be considered for seismic PRA evaluation of a focused-scope plant.

The submittal itself provides a clear description of the seismic evaluation, it provides exceptionally full details in several aspects of the analysis, and the documentation is generally well-written. The study 4 provides usefulinformation concerning dominant sequences, systems, components, and ground motion Even though they derive principally from USI A-46 evaluation and from IPE findings, the identification and implamaaMon of plant safety enhancements, as a result of the plant walkdowns and the IPE PSA, have produced some meaningful insights in response to the objectives of GL 88-20, for a focused-scope .

plant. Seismic margin results (i.e., HCLPF capacities) have provided valuable information on the capability of plant components.

As judged from the present n '=d-only review, the following items are viewed as the primary strengths and weaknesses of the seismic IPEEE submittal for Point Beach.

Strengths

1. The licensee undertook a SPSA sady witti a level-2 containment performance analysis; this process goes beyond the effort requested in NUREG-1407 for a focused-scope plant.

2. The IPEEE documentation is clear, well explamed, and particularly detailed for various aspects of the l

analysis. l

3. Apparently, a substandal effort was involved in seismic plant walkdowns and in the walkdown peer review. 'Ibere appears to have been good coordination among efforts for the seismic IPEEE and USI-A-46 programs.

4. Plant improvements to increase cable tray capacities, to correct deficient equipment anchorages, an to add two new diesel generators will significantly enhance the seismic safety of the Point Beach Nuclear Plant. ,

5. The quantification approach is exceptionally clear and logical. HCLPF results have been obtaine individual accident sequences, individual plant systems, and for the overall plant-level capacity.

Meaningful sensitivity studies have been presented.

6. The licensee apparently had a meaningful participation in the seismic IPEEE process.

Weaknesses

1. As presented by the licensee, the highest. reported plant HCLPF spectrum (i.e., the 1989 LLNL uniform hazard spectral shape anchored to a PGA value of 0.25g) does not exceed even the plant's design spectrum for frequencies less than about 4Hz.

52 ERl/NRC 96 505 Energy Research, Inc.

i

\

\

2. Review of the IPEEE submittal poims to a potential seismic vulnerability with respect to automatic containment isolation which is manifested by a high probability of large, early release given a seismically induced core damage. However, the licensee has not addressed this potential vulnerability, but has simply assumed that rnannal isolation would be achieved with at least 90% probability. No justification is provided for this assumption of operator effectiveness in achieving manual isolation.

3. The licensee's conclusion that USI A 46 improvements do not have a significant impact on plant safety is misleading and not well justified. A clear understandmg of the full benefits of the improvements has not been obtained.

4. The licensee's relay chatter evaluation has not been fully expanded beyond the scope of USI A-46, in order to address all IPEEEely systems. De licensee claims that chatter is acceptable for the unanalyzed systems, on the grounds that operators could reset the relays; however, the SPSA does model the failure of operators to perform such actions.

5. Discussions in the seismic-fire interactions assessment, especially pertaining to inadvenent seismic actuanon of fire suppression systems and seismically induced failure of fire protection systems, do not adequately address all relevam concerns.

6. Although safety enhancan=nts are planned (primarily for USI A-46 and IPE), the licensee has not proposed plant improvements / resolutions for several remaining components that have low sei capacities, and which cause the piant HCLPF to be significantly lower than the RLE. (Examples include anchorage concerns, interacnon concenis, potential failures of block walls, and potential failures of flat bottomed tanks.) Procedures to improve operator reliability for CDF-dominant human actions have also not been proposed.

In addnion to.the foregoing, the use of the surrogate element in the Point Beach seismic IPEEE has create(

some minor problems with respect to achieving full SPSA insights. First, the surrogate element has bee found to be a dominant contributor to seismic CDF, which means that the real source of a significant contribution to seismic CDF is not fully understood. (However, it is known that individual components that participate in the surrogate-element CDF contnbution [i.e., components modeled collectively by l:

surrogate element] have been screened out as having HCLPF capacities in excess of the RLE.) Seco the logic modeling of the surrogate element in the Point Beach SPSA at the plant level (i.e., as a singll

- component in series with remaining plant core damage logic), rather than at the systems level, coul) to roughly a 10% underestimate of the seismic CDF.

Since the reponed seismic capacity for Point Beach is low, it is recommended here that the NRC perfol a follow-up investigation to determine the adequacy and impacts of proposed hcensee improvements.

Overall, however, the Point Beach SPSA has provided valuable insights, contributing significantly to the licensee's understanding of plant response to potential seismic effects.

3.2 E tt ne licensee has expended considerable effon on the preparation of the fire IPEEE. The IPEEE repon complies with the conditions set forth in Reference [3). The licensee has employed proper methodology l

53 ERI/NRC 96-505 Energy Research, Inc.

and data for conducting the fire analysis. De FIVE methodology and data have been closely implemented to comply with IPEEE objectives.

Based on the present submittal-only review, the following are the strengths and weaknesses of th IPEEE for Point Beach.

Su:RDgdia

1. The Wh1 discusses many diverse issues, and includes tabulations of fire areas and compartments supporting the analysis and the conclusions.

2. Stateef-the-art methodology and proper data have been used.

3. Multi-compartmem Sre propagation analysis has been conducted, and the overall methodol an accepted approach.

4. The FIVE methodology has been employed methodically, with little deviation from the ma the approach.

Weaknasaet

1. The si- '=! often falls short of clearly explaining what was done. It can be inferred that the licensee has indeed addressed all diverse issues of fire analysis. However, the submitral does not pr suhimnr or accurate dinniesinen to allow significant verification of the analysis. For exampl case of FCIA, it is not clear what is meant by " combined frequency compamnents," how th information was used, etc. As another example, in Table 4.1.1-2 of the submittal, a list of It is not clear what compartmanen is pmvided under the column heading of " Potential PTI and SSD."

is meant by the entries in this column. 'Ibe licensee states that Pcci in many cases reflects t of transient fuels, and was quannfleil per FIVE marhndnlogy and data. However, from ot the -Ac'=t, h can be inferred that the licensee has not modeled transient fuels properly be several cases, cables present in a room are concluded to be unaffected by fire.

2. Cross-zone analysis has been conducted: however, the analysis has not been carried th scenarios identified in cross-zone analysis have not been addressed in later stages of the a

3. ' The treatment of initiating events other than reactor trip may not be complete. The lic that cable routmg and equipment location were reviewed, and yet could not identify any common where loss of offsite power may occur. The licensee gives no information about the pos  ;

inadvertent openmg of offsite power breakers resulting from a failure (induced by a f cables associated with these breakers. - Such failure may occur, at minimum, from a fire room or cable spreadmg room. For example, a small control panel fire may cause such '

failures that would lead to these breakers failing open (thus, leading to loss of offsite powe failures may occur from a fire inside the cable spreading room This andomission other rooms could where the c equipment associated with the control circuits of these breakers are present.

potentially be significant and one cannot conclude that the licensee has conducte analysis.

1 1

54 ERI/NRC %505 Energy Research, Inc.

t

4. The licensee claims that hot shorts have been considered in the analysis since Appendix R information had been used which includes hot shorts. Theoretically speaking, if a licensee conducts a coiividamive analysis of safe shutdown pahs and potential failures from a fire, all relevant spurious acmaions and other failures would be idenrified properly. However, from Reference [11] it is not clear whether the licensee has considered all initiatmg events in its Appendix R effort. This omission implies that the hot short (or spurious actuation) phenomenon may not have been properly addressed in the Appendix R analysis of this plant for the complete set of initiating events. A comparative review of the Appendix R safe shutdown model versus that for the IPE submittal may be warranted to identify those initiating events that may occur from t fire. One can then identify the circuits, and thus cables, the failure of which may lead to those initiatmg events. If those circuits and cables (with

' their proper failure modes) were included in the Appendix R analysis, the licensee's statement would J

then be correct.

5. The cable spreading room (Compartment 318) and slectrical equipment rooms (Compartments 245 and 246) contam oil filled transformers. If the oil is combustible, there is a potential for a large fire from severe transformer failure. Such fires are generally initiated with an explosion. The submittal does not address the potential for a large fire or explosion in a transformer. The licensee has subdivided the cable spreadmg room into small areas for a detailed fire analysis. This approach applies only to smal fires. Transformer fire or explosion may have sufficient energy to jeopardize the integrity of fire boundaries. Potential vulnerabilities may have been overlooked from the omission of fire scenarios involving an energetic tupture of a transformer or an extremely large fire in these roo.ms.

6. For several fire scenarios, the licensee has used unreasonably small time periods for damage and suppression. Seny, for Cvoy.i s 156 (MCC room), Scenario 2, time to automatic detection and suppression is 65 seconds. Such a short dataman and suppression time is not supported by industry experience. The licensee cites FIVE formulations as the basis for the timing. It can be concluded that the licensee has employed FIVE without examining the reasonableness of the results.

4 For this scenario Pcci is concluded to be 2.00x10 , which leads to a small core damage frequency.

For this specific scenario, if the timing is modified, the core damage frequency may increase by at least one order of- =?=e= Similar condmons exist for Compartment 166 (MCC room), Scenarios 2 and 3, and Compartment 318 (cable spreading room), Scenario 3.

7. Sensitivity analysis has not been M* For example, in several instances, it has been concluded that, despite a fire in the area, cables from redundant trains present in the compartment will not be .

l damaged. Clearly, such a conclusion is completely dependent on the basic assumptions regarding fue '

loading and heat transfer awhani==<. As another example, the licensee has not postulated the possibility of failure of active fire barriers. However, if one does postulate the possibility of such failures, there might be a few adjacent compartments that, when combined, contain a critical set of redundant components and are separated by an active fire barrier.

8. From the conclusions reached in the submittal, it can be inferred that the licensee has not given proper ,

l weight to the effects of transient fuels. Several compartments include cables from redundant trains.  !

and yet, the licensee could not find a fire that could damage both trains simultaneously.

i

9. The numerical results provided in various parts of the subminal are not well correlated. It is difficult '

to trace the frequencies across different tables and other quantitative inforination/ discussions. System failures associated with risk significant fire scenarios have not been identified. Tables 4.6.4-1 through 55 ER1/NRC 96-505 Energy Research, Inc.

l

i l

' 8 of the subminal only provide fire related information and not system trains or equipment (from the internal events model) affected by the fire scenarios. The initiatmg events that may be caused by a fire, and the system trains and functions that may be lost as a result of a fire, have not been lis

10. For some scenarios the suppression system failure probability is multiplied with the fire initiation frequency. This is not a proper practice if there are critical sets of cables and equipment lol a small region of a compamnent. Thus, the possibility of damage to a critical set of cables or j l

equipment (especially when they are within a small region within a rc,om) before the m I discharging from the suppression system takes effect was not considered.

11. The p-Altity of dual-unit core damage has been discussed, but the frequency of occurre been estimmmi.

The fire analysis, as is evident from the above discussions, included several weaknesses that undermine the final conclusions. It is not clear whether the licensee has gained a proper pe potential fire vulnerabilities at Point Beach Nuclear Plant. .

3J HFO Events The Point Beach HFO IPEEE generally addresses the major elements specified in NUREG-following, the strengths and weaknesses of the submittal are summartzed:

Stranyths

1. The analysis of high winds and tornadoes was detailed and has used the USI A45 a Beach.

. 2. The analysis was mainly performed and reviewed by WE, using their in-house expertise  ;

==imimi the licensee's appreciation of severe accident behavior and understanding of the most

• important sequences and contributors to core damage frequency. '

Weaknessas 4

1. The dominant HFO contributor to CDF is external floodmg (2.8x 10 /ry), and the repor based on the assumed effectiveness of sandbaggmg the turbine building door (per emergency procedure). Without the credit for sandbagging, the frequency of a4 flood with the lead to core damage (due to cor==?'*ial flooding of the auxiliary building) is between 3.69 J d

. and 2.53 x 10 lyr (based on values presented in submittal Table 5.2.54).

l Specifically, there is concern over: (1) whether the reported annual frequencies!

water level at the turbine building include wave run-up and wind effects; (2) the effectiven to the use of sandbag: (since the submittal reports a reduction of over two orders of mag turbine building floodmg frequency when sandbags are credited); and (3) whether the tu walls ar* concrete all around, and if not, whether sandbags are used all around the build at the dwrs.  ;

i I

56 ER1/NRC 96-505 Energy Research, Inc.

1 l

2. Other than sandbagging, the submittal does not discuss flood protectien devices (e.g., levees and waming systems).

3. Significant changes since the time the plant operating license was issued were not identified for external floods, as well as for transportation and nearby facilities accidents.

4. The PRA analysis of tornadoes and high winds is not clear, and there are inconsistencies in the presentation of relevant data and results.

J 1

i

\

i I

l Energy Research, Inc. 57 ERI/NRC 96-505

1 4 IPEEE INSIGHTS, IMPROVEMENTS, AND COMMITMENTS

' 4.1 Seismic Among a total of 459 items of equipment evaluated during the seismic walkdowns, fragilities were computed for 195 screened-in components. At least 26 components were found to have HCLPF PGA capacities lower than, or comparable to, the plant RLE PGA of 0.3g. Table 4.1 provides a summary of the fragility results for these componems. Cable trays inside the cable spreading room were found to have

' the controlling seismic capacity (0.23g PGA median capacity, equivalent to a HCLPF capacity of about 0.09g PGA). Plat-busused tanks and block walls were also identified as low-capacity items. The overall plant median capacny has been reported to be equal to 0.45g PGA, and the plant HCLPF capacity has been assessed at 0.16g PGA; these results account for non-seismic failures and human errors. Without non-seismic failures and operator errors, the median and HCLPF estimaram are reported as 0.69g and 0.25g

' PGA, respectively. Mean seismic CDF values of 1.40x10'8/ry and 1.31 x 10'8/ry have been reported, respecovely, for the 1989 EPRI hazard results and the 1993 LLNL hazard results. The seismic frequency of early large release (noble gases and up to 10% of volatiles), as determmed from the Point Beach seismic containment performance analysis, has been reported as 1.26x 10'8/ry, which is very nearly the same as the seismic CDF itself, and points to a potential seismic vulnerability in the automatic containment isolation system.

Seismic capacity mat =mann have been performed with respect to the 1989 LLNL median 10,000-yr UHS shape; this spectral shape is significantly different from the NUREGICR0098 median,5% damped spectral shape which is recommended in NUREG-1407 as the basis for reporting HCLPF capacities. It is @i E to note that the licensee's highest reported HCLPF spectrum is exceeded by the SSE spectrum (0.12g PGA, Housner) for all frequencies less than 4 Hz. Also, the HCLPF spectrum never exceeds the

. 0.3g PGA NUREGICR-0098 spes-L over any frequency.

The USI A 46/IPEEE open issues are @~~@iannned in Section 3.1.4.3, Table 3.1.5-2, Section 7.3.5, and Section 8.4 of the Point Beach IPEEE submittal, with information pertaining to their expected resolutions. Not all USI A-46 outliers are mentioned in the IPEEE; a complete list is provided in the licensee's USI A-46 Seismic Evaluation Report. Plam improvements that are being made in response to the IPE, but that will also have a beneficial impact on seismic safety, are discussed in Sections 7.3.1, 7.3.2, and 8.4 of the subminal report. Table 4.2 of this TER summanzes the available IPEEE findings concernmg open issu'es and plant improvements that are significant to seismic severe accident capability.

Plant enhancements / resolutions include: fixing anchorage deficiencies on cable trays and numerous l equipment, as identified in USI A-46 evaluation; addressing concerns associated with Westinghouse Mo l'

ITH relays, as identified in the USI A 46 evaluation; and adding two diesel generators and their support systems, as identified'in the IPE. These various plant enhancements / resolutions are either being implememed or are being planned for implementation. It is important to note that, even with these plant improvements, there will still remain a number of SPSA components (many of those identified in Table 4.1) having comparatively low seismic capacities (i.e., having HCLPF capacities less than the RLE).

The following failures have been identified in the submittal as being the dominant basic events / components that contribute signi&aady to seismic core damage frequency:

1. Seismic failure of cable trays in the cable *preading room 58 ERI/NRC 96-505 Energy Research, Inc.

l

2. Failure of operators to safely shutdown from the remote shutdown panel outside the control room

3. Seismic failure of the surrogate element

4. Seismic failure of cable trays ouuide the cable spreading room

' The following failures were identified as being of secondary importance:

5. Correlated seismic failures of 4.16kV station service transformers (X13 and X14)

6. Correlated seismic failure of 480V load centers (IB03, IB04,2B03 and 2B04)

7. Failure of operators to provide service water backup to auxiliary feedwater suction

8. Failure of%se to provute service water backup to auxiliary feedwater suction (when condensate storage tank [ CST) level instrumentarian fails)

9. Failure oflevel transmitter for CST

10. Seismically induced failure of 120 VAC insuument buses (2Y01, 2YO2, 2YO3, 2Y04, 2YO5 or 2YO6) due to block wall failure

11. Sannically induced failure of 120 VAC instrument buses (1Y01,1Y02,1YO3 or 1Y04) due to block wall failure Considering the SPSA results (including sensnivity evaluations), the licensee concludes that no significant )

seismic concerns have been discovered during the IPEEE.

4.2 B ra Overall, the licensee has concluded that there are no significant fire vulnerabilities at Point Beach. Despite the assumpoon that all cables and equipment are damaged in a fire area or compartment, no single fire area or companment was found to cause core damage; other failures in other areas were determined to be required. The cable spreading room may be an exception to this statement. However, the plant can be shutdown from outside the main control room using a procedure specifically designed for this purpose.

4 The overall fire core damage frequency was estimated at 5.11 x 10 /ry. This value is commensurate with fire PRA results obtained for other similar plants. The dominant fire scenarios include: the control room, the cable spreadmg room, the auxiliary feedwater pump room, the gas turbine room, the vital and non-vital switchgear rooms, the diesel generator rooms, and the monitor tank room.

The dominant core damage scenarios involva early damage, where RCP seal LOCA occurs and safety injection is assumed to be failed. The licensee has not utilized the complete breadth of the internal PSA model for the analysis of fire core damage sequences, and has not addressed the possible occurrence of initiating events other than reactor trip.

Energy Research, Inc. 59 ERI/NRC E505 9

Containment failure was addressed 'only through the possibility of failing to close containment isolation valvas. The licensee has not carried the analysis forward to level-2 PSA.

' The licensee is in the process of implementing a set of modifications that will reduce the fire risk. Two new diesel generators, which have their own dedicated vital switchgear, are being added at the plant. The control system for the auxihary feedwater pumps is being modified to make them independent of the non-vital switchgear room. Also, the control room / cable spreading room fire procedure has been updated to include additional valves that have been identified as a result of the IPEEE.

4.3 HFO Events 4

The dommant HFO event contributor to CDF is external flooding (2.8 x 10 /ry), followed by high winds and tornadoes (3.4 x 10 4 /ry). All other HFO events were either screened out or assessed to have a CDF ofless than 10 4 /ry. Since the contribution from HFO events to the total external event CDF is relatively minor, the submittal finds no wanimannes or vulnerabilities with regard to severe accident risk from HFO events at Point Beach. As a result, no safety enhancements have been identified, and consequently no commitments were made. Note, as part of a previous commitment, Point Beach is installing two new diesel generators which are located in a new building with additional safety features and greater resistance to external events.

i i

l 1

60 ERIINRC %505 Energy Research, Inc.

Table 4.1 List of SPSA Non-Screened Components Having Computed HCLPF Capacities Below (or just at) the RLE

' Seismic Basic Event Description Median pc PGA PGA HCLPF (g)

Capacity (g) 120-BS-BW-1Y1-4 Seismically induced failure of 120 VAC 0.71 0.40 0.28 Instrument Buses 1Y01-1YO4 due to Block Wall failure 120-BS-BW-2Y1-6 Seismically induced failure of 120 VAC 0.70 0.40 0.27 Instrument Buses 2Y01-2YO6 due to Block Wall failure .

120-DP-BW-DCP-N Seismically induced failure of 125V DC 0.74 0.40 0.29 Distribution Panels D-18, D-19, D-22 due to Block Wall failure 120-DP-BW-DCP-S Seismically induced failure of 125V DC 0.55 0.40 0.21 Distribution Panels D-16 and D-17 due to Block Wall failure 480-BS-SC-B0304 480V Safeguards Load Center 0.45 0.23 0.26 1B43 480-BS-SC-B0304 480V Safeguards Load Center 0.45 0.23 0.26 1B44 480-BS-SC-B0304 480V Safeguards Load Center 0.45 0.23 0.26 2B-03 480-BS--SC-B0304 480V Safeguards bad Center 0.45 0.23 0.26 2B44 AF-LT-BW-04038 Seismically induced failure of CST Level 0.19 0.40 0.07 Transmitter due to Block Wall failure AF-T-SC-024AB Condensate Storage Tank 0.67 0.40 0.26 T-24A AF-T-SC-024AB Condensate Storage Tank 0.67 0.40 0.26 T-24B CABLETRAY-SC- Electrical Raceways (Cable Trays) inside 0.23 0.40 0.09 IN . Cable Spreading Room CABLETRAY-SC- Electrical Raceways (Cable Trays) outside 0.46 0.40 0.18 OUT Cable Spreading Room Energy Research, Inc. 61 ERI/NRC 96-505

l Table 4.1 List of SPSA Non Screened Components Having Computed HCLPF Capacities i Below (or just at) the RLE (Continued)

Seismic Basic Event Description Median p, PGA PGA HCLPF Capacity (g)

CC-HX-SC-12A-D Component Cooling Water Heat Exchanger 0.76 0.40 0.30 1HX-12A CC-HX-SC-12A-D Component Cooling Water Heat Exchanger 0.76 0.40 0.30 2HX-12D CC-HX-SC-12A-D Component Cooling Water Heat Exchanger 0.76 0.40 0.30 HX-12B CC-HX-SC-12A-D Component Cooling Water Heat Exchanger 0.76 0.40 0.30 HX-12C ESF-PNL-EQ-156-7 Safeguards Train A Relay Cabinets 0.45 0.23 0.26 ESF-PNL-EQ-166-7 Safeguards Train B Relay Cabinets 0.45 0.23 0.26 ESF-PT-BW-19478 Seismically induced failure of PT-947 due to 0.75 0.40 0.29 Block Wall failure RP-PNL-EQ-151-5 RP Train A Relay Cabinets 0.45 0.23 0.26 1C-151-155 RP-PNL-EQ-151-5 RP Train A Relay Cabinets 0.45 0.23 0.26 2C-151-155 RP-PNL-EQ-161-5 RP Train B Relay Cabinets 0.45 0.23 0.26 1C-161-165 RP-PNL-EQ-161-5 RP Train B Relay Cabinets 0.45 0.23 0.26 2C-161-165 SI-T-SC-12T13 Rei'veling Water Storage Tank with'6 0.59 0.40 0.23 Immersion Heaters SW-HX-EQ- Residual Heat Removal Pump Area Cooling 0.59 0.40 0.23 l OHX98 Coil Energy Research, Inc. 62 ERI/NRC %-505

Table 4.2 List of Open Issues and Plant Improvements, as Noted in the IPEEE, Which May Enhance Seismic Safety Component Description of Condition and illant Source /

Improvement / Resolution Program Diesel Generators and Two new diesel generators are being added, IPE Auxiliaries including seismically designed enclosure and support systems Seismic Equipment Anchorages Numerous pieces of equipment were found to USI A-46 have marginal or deficient anchorage. The and SPSA licensee has committed to fix identified anchorage deficiencies by February 1998, as part J of its USI A-46 outlier resolution program. (A complete list of USI A-46 outliers is provided in the Point Beach USI A 45 Seismic Evaluation Report.) ,

Cable Trays inside the Cable These components have poor mountings. The USI A-46 Spreading Room licensee plans to fix this problem in its USI A-46 and SPSA resolution program. The proposed fixes have been determined to double the median capacity of the cable trays from 0.28g to 0.56g PGA.

Buses and Instrumentation & These components have questionable anchorage, 'USI A-46 Control Panels in the Cable primarily due to lack of available documentation. and SPSA Spreading Room They are conservatively assumed to be unanchored in SPSA detailed fragility calculations. These components are being addressed in the licensee's USI A-46 resolution program. They are expected to screen out of the SPSA model after being fixed.

Large Step-Down These transformers are anchored by friction USI A-46 Transformers 1 and 2X-13/14 clips, and they thus have a low capacity as and SPSA determined from SPSA detailed fragility calculations. These components are being  :

addressed in the licensee's USI A-46 resolution program. They are expected to screen out of the SPSA model after being fixed.

RHR Pump Area Cooler This component has its seismic capacity governed USI A-46 by the anchorage resistance of the base neoprene and SPSA isolators it has a low capacity as determined from SPSA detailed fragility calculations. This 1 component is being addressed in the licensee's USI A-46 resolution program. It is expected to screen out of the SPSA model after being fixed.

Energy Research, Inc. 63 ERI/NRC %-505

, Table 4.2 List of Open Issues and Plant Improvements, as Noted in the IPEEE, Which May Fnhance Seismic Safety (Continued)

Component Description of Condition and Plant Source /

Improvement / Resolution Program CST and RWST Low seismic capacities have been computed from USI A-46 detailed SPSA fragility calculations. No and SPSA resolution is planned.

Relay Chatter Westinghouse ITH bad-actor relays have been USI A-46 found in 4.16 kVAC switchgear at Point Beach, affecting several breaker trip coil lockout schemes. This relay issue is being resolved as pan of the licensee's USI A-46 outlier resolution program.

i Energy Research, Inc. 64 ERI/NRC 96 505 l

5 IPEEE EVALUATION AND DATA

SUMMARY

SHEETS j Complaed data entry sheets for the Point Beach IPEEE are provided in Tables 5.1 to 5.6. These tables

, have been completed in accordance with the descriptions in Reference [10). Table 5.1 lists the overall external events results. Table 5.2 summarizes the important seismic PRA fragility values. Tables 5.3 and 5.4 provide, respectively, the PWR Accident Sequence Overview table and Detailed table for seismic j events. No sequence overview or detailed tables are provided for fire events, since the IPEEE submittal has not provided sufficient information regarding core damage sequences and system failures, in order to summarize the main core damage contributors. Tables 5.5 and 5.6 provide, respectively, the PWR 1 Accident Sequence Overview table and Detailed table for wind events. Note, if a ilood enters the turbine bu0 ding, there would be a turbine trip, and water could enter into the auxiliary building. Subsequently, there would be a loss of auxiliary feedwmer and all safety injection capabilities. However, since the exact scenano of events following a turbine building flood was not reported in the submittal, accident sequence tables could not be completed for external floods.

i l

l i

i Energy Research, Inc. 65 ERI/NRC 96-505 i

. 4 5

0 y

g d!

(

5-l o t n  %

e o e rd o m C i

f h e1: R ew l

ient N m ee t l I

I s a R e gF t

oP E N

o dEcF i

V I rL r

uC s g sI r n s I foi s scA s u uG i ,

s A P Fa De S g r P 3 Ca S0

)

s e

r l

u ia f

r t

o

)g s i

)

(

F y P mln L d o C ns ae r H u t ml n oi a dn f l

a P aic r _

t s h m l t s u

s i

wsc i

e ( (

R 65 1 2 i s

s 1 st 00 l y

5een a n 6 6

l v ) ) a bEa 3 9 9 8 g

n Tl a 9 9 1

i d

n y LI 1

y n r y u e y r

y r

'/

r /

r NR /

4 r

B o

t x */ '/ o 3

0 L EP 0 E F 0 0 t 1 L(

(

1

=

D 1 1 x x yr y x O C x x 0 r 0 S 8 4 1

1

'/ '/ l 3

l 0 0  ;

2 5 < 1 1

< t x 0x u o

1 4 d.

1

3. l m s

u 2 S g =

d n n O a i n .

e O S S O S O  ;

s 1

s va is t c y i

n S lan U a c

h i f

c s d a t s

e e n e

t n g B e c d

i d t n t

n c c

i c n I i g c a ,

o t n A y A l

P h c _

P n i s y it n r e d d it v o = a v e o n e S e e E r o i r

l i

c i

t c

i t

a s iF l

F W i F a A e m e F t

r o

g R _

a l a

l a l a y ic p s n y N n r

n r

m e n r

br m s n

r e

i n g _

t e e r e a s a ht e r _

n t x

t x

t x t n e i c r e r

e n

l a E E E I N S T O c E

P S

w 5

0 5-h 6 ta 9 P

C

=n ei o R rtp N

/

i r I _

, Sc s R _

ce E iDm i

s c

S _

x--

n

- i o

e p t Si r _

icc s _

me sD i

e e r S l

u i _

)

g fa

(

m ) _

t e g s (

y F 7 9 1 3 3 6 6 6 7

) s P 0 0 2 2 2 2 2 2 2 r o

~

0 l e t L 0 0 0 0 0 0 0 0 _

a c

ht e C _

i t

o t u H _

y r r b _

t e o i r

i l

i V i c t n 0 3 3 0 g 0 0 0 0 0 f

o a i c

e c A 4 4 4 0

4 0

4 0

4 0

2 0

2 0

4 0

2.

5 c 4I p s

h i

c 0 0 7

ei t e h 6 _ .

l i w

t t

ai m

s )i n ) S s

, )

0 A .

TeS )gr o i c H 1

( t f

i U n a

c e A e a n ht _

R P

2 1 S p

h i d

a s s

A _

l e e e 0_Soi i S

t m

l

( _

l a r s ) _

, L e g _

t ne I R N i n( _

on t

L i c ay 5 9 9 7 5 5 0 z s P a it 9 3 7

i u E L p di c 1 2 5 5 5 6 4 4 r o oH

, r a a ea Mpa 0 0 0 0 0 0 0 0 0 l L e c f (

) N y c w C y L 0 a _

L t

i 0 s E

c ( 0, s o 0 e S l e I s 7 S R 1 V P

( t s

e r

e 1,

6 E S t l

a H w t t 1 n 2

e r 9 U l o i m P

- e i

d c 8 s m _

n a 9 n ht n s n

a 1 a i a

l e s I h, -

i d w T

r n a

t c

t s

n s A L e s P s n t

N M t n l e

l r i b

I i

n G L e t n v C i

o t e a C U P L L e e D C n C A

(

N m n e h

3 L ip o L V g C y V A 9 i p T 5 n a 0 c 9 L p S i

d le

= G 1 s m 2 l o a 2 n

"- P 9 8

e o C 1

/ o o R 1

/

I _

d C /e e C L P c ,

t n

t n

9 m n n r s R r6 h r e 1

a h u a dr luO c i

o e i 2

0 s i l

i e d i Y r a

P t e a e

t n a a A

r a n Fa2- e m

s s p 1 e F s F ug a 1 s a e a n l y l p s l 0 e fe l l l

e s m

r a s h S "g

o p a a r

a m u a dr a W2 aY R a p A l a " m W T W T P S u y g

N dr dr r T o k e k c S R V g k s c e r t a a t c

I o c c o

l b o W T G rc o su e n z z e t u

t s l a l H E R a l n

a a a p i B C B R R C 4 S BB E l

P l

l H S C L

. )

I.

A d 5 S ic 0 S -

5, i l 5-4 s T, A "s I

t e

o V

R O, e

di  %

f o t n D W

3 A

N C i

s -

/

V O "e R t

l

• T, ht N w A M M t I

e s /

I U U S- N, u, R H H T, A y a

r E I

R I, s T 3 s t o G C e c

u W t

S- A e o d e Vl n

e I- n n S T, r o m l, a x

--- o o t ueg C l 2 ht t

nr s t C

s y .-

n e

i W s a J I A 5

r n

o nl e ot m d a i..oepw F am s a S- V 1

d

/o io A e sd T, 1, n i

t e n C I a c tam r n ne C F

n u ic e dR n

w t

e 4s 4n se y

c ig l

a ir dn co O

I J

l S

V I

A ht 4

f a

d I n a n ng o en - I, i(

ht o or mi T, e

o dow l t i ie s W T cm ul t l

i a

r s t

c t

l W S N t

nt n n ne ia tr u F E, E F ou o s s V fu fu ro f n er X 2 Ch S i

t c l l r

o i f y E. S A

F, I

f oo n l ar l l aa Ut a ol t T. S C, t u s e sn i s c W E.

s si l f

l l

i w l ir ao Mr Sp e er I

- 1 R

S e oa l A Fp ao Fn SO m. d i M S A

P l LF I L- S C, b E, I

S a T. C P T ^

s t n

li M D C, s -

R oi e E.

e N.

"a. l y

t r

o p

t u

o t

r p ei n l T

- C A

P.

l, 1

, E, o

n p u f-wu oq P,

C C 7 )

k n

v O S --

pe R- D, 1,

R a O A t s -

c l a l P M 3 e o ,_t l T. W I e

5 cn R L mp r

o ai t sn C S

I C I, I

b y

P l e C I I C, P a 8 ee c l p i s A A t 4

l l, m 6 As u a s -

l l

baqu i Fe E V T, C X

P E

d l

e e m s

S It D i F

TS i e

y a

r t

n ei d e s e

s W

1 A

A, 3

S C Mt

- (

t n S Ted e l s bt u C R, f

e r o

t ei m au U B T-, X T li CO I

d n l s e P t T t N t l

F e bai n l O n T O i

c v E ce O M e A, I S

),

A c E Cer e i r mlu L S

S n

n T-, 2 C C M cu u t

t a si X X R, I i i g i a r R- I S.

R n mla T- T- I t SeF y t

i o s T, A, M R I i r n N T W S eF r u Ta r I P I

3 U

I

- US P T-S T T- M A

H S

C )

C R, I

1 A, N y y y y y y y r

y T, 2 l

l l, _

r r r r

'I r

'/

r

'/ /

r )

x f M 1

• / */ '/ '/ f( x R S 1 F

D 1 0 7 % 0%2 0% 0%3 0%6 1 1

~

1 1

~

0' %

1 5

0%

1 3

l x%

(

- I C

S P,

1, S

x1 x6 x 3 x x x x 0 V. A, E S C 6 21 67 33 02 3 1 87 9

0 0 A, l

D AP

0. 6 1 5 3 4 9 U S Y 0 3 H CLn NT, 2 8 2 9 4 3 1 9 3, k l I.

d 2 A, a S n 5 IS W a t l

a CM  :

g T S n Ae I

s l l l l

E '

l

. e  : b gy inv A S E E E t g c s ne n F

i t

n D -

i F m a n iwon k s. ,

P F l U T- T- T T i w

o y r lod l l fo e

"o_

i l

b)d f'ei e ht e

e en=

. I l _

l f ,

e(

= ht se ht C f

o e c _

f s

y" , fA e e

ht I

n _

E- e oS e o o V, h r

lo ,

e c 5 nro t w4 t

s h n a 1 O pla t u c.

r: c i

e c - t s W u n he r P

o i

g 2-0 4-O 3

0 3

2

- A 3

l I

- [uo s eSi pi s a

a S, s 3 A i t e

s a

e _

c l a4p t

s _

e S 9 B 9 B R B lsToo s

AW s n

i e

P P P P 7 P s s

S, s

a i R

m i i r s ets t ds A

a 2 a f skr e n s y N 5 0 eeef ssW i

s F u t e g .

2 3 4 5 6 3 62 St hr e u S, s n r _

t n # 1 7

33 I 0 )x S

sM d

e i i e _

a w4x aT d a

i s

r n _

l P l o T (- I S F A E .

i !llllll

5 e e 0 d e e s g

i e ts i er ss e 5-a es e isnseees a.a d

e e

yd d E.l su s y ul t 6 I

I en ca ea ia b cn 9 y

e s_e mdtu c r eo o e e e eples e '

- f s e e f

o 3

3 g

g e

r l e" iende n e=

Me -fensI ekm m

_.n aMrdoma ou l

t s a

m f m de e

n n

l s b c c

foce ue s a nd e

K I

S t

t s

e eis ncdd =

e a ==

mt r

=

de C

R N

c vmlys u m de p o r e d s se s

-eb h i

/

e f on fd e 'u en t s r l el e u n s mae o o l h

S eb l ee.

r u d ue s - me e n c

t es e isWn e c is vr e oen s

s n R

s t fs ss se s Fm s mne Te u esu E I ieo l e

I u

a s o 3d l s F e e a l l t I l k X X kF I GN T CI2 i N

E CII M

N I I C A

T N FC2 O

C FC8 CS2 CS1 AM3

's e AM2 h YY a RR AMl AU T DT NN AFW X _

d OE _

l e y CV N NISF _

i l I _

SI a n MFW -

t e O SG D A 4 + TB R Y Y 5 - P R T AI MSI V 9 _

l e- c DI I 6 NG TT

, i b -

a m OT Ti d i

s e

I F

S I 1

N SGA

'S 0 S e

s S d r AR2 i

c o Y c F Yt R HC ARI A A1R 1 I' .PR R MHK I EI 8

TV R 8 1 PR W B N

I P CI PR I

AI 2 Y4 AI l Y

Rt RM AcC A

MNE 13 1

l El t i 8 .PI I

l' V N NI I

1 P1 1

2 d C18 PI n

a RCP5 Y T I

s 1 PAI )2 t Rt t i Al i PAI D n MM I U t k1 L

PSRV

. PNI h .

c PP8 RV4 c

a n e H1 I B X ,

t k RP5 h i

n c o r P a 5 e e

m

,p 2

0 4

o 3

0 3

2 I

A 8

8 R

s e

9 w 9 9 G 9 .

m 1 I 1 9 1 I 1 a T y N 3 g r

t n e a , 2 3 4 3 6 n i

E l _

P _

)

t. A 5

S M e 0 S -

S, i f 5-4 T, A 's 6 V le 9

• K I

O O, e s

f o e B 3 A

N C t

t u S /

V O "e R e b e ht N

e i r l R T, h t b O I w /

I S t a S N, u, R I

A r e T, A y E

v o R I, 3 -

c I C

e u A R S -

V T, I e r

S I, a n K' 2 ht o

I I C 5 i I A r t

c S- V n T I I,

&o n

u a F M I C ht d 3 A 4 e J t V a l I i S- f a T I, I

(

F W T W, S N F E, E X 2 V E S F, s T-, A t

S IC, a W E, R p F I S

S e p P l u M. A C, l

S b S T- E, I

S a t I. P T

s o t f X t C, L k w C N- E. R i

e A I

- C P.

v y E T, A l, I

r l P E, P. )

e n C C I, dn v

O O R- D R P W a

W, 5 e A t n

T.

s '.

I I, h e

5 cn R e l

I t

C, t

r y e 0 ee P v l' 4

I I, ne 7 l

baqu d E T- C P Wc n t S, X E D

i e i I

TS i Wr I n P W T

t A, S CM F(

t O A )

n I

O C R, M e o L T- X T I d

i F T, l t

N R c 1 A, I

- O, c T-, 2 S A C C o t X X R, R F '0 R.

I l

E R IS, l a

D 1

T, A, u W C A x

• M ) N T I

- G s

u n

P 3 M J

R I

S C

S L

b u

A s I C R, I

A, I N w T-, I I, la

)

m f2 M t i n

a- R S i l

I S T, a

( C P, S d i

V. A, E S v o

S 1

e A. ll D S

AP r p

2 D t o 3 M I

) T, Y n P 3, Ck H, ie d

n N 2 Ana N I S e

s a IS, l C, W S.

m r

I S

a A. b e , M ra ir A n s te . y i

i t a . a g s n

n .

m .m  ?

i n e U -

y r

a r 4

._d f w o

ri t

- e l n

l i

f _)d s i 11 h W &

c e c e mw e( r t

I i

c a i o e v e n ht ee s f y n lp s

e ls C fo A e e

ht e n B -. oS p o V, r

i f

o t

o n

I

= e d ,

t n ntr su w4 t s

e e s h i

o h Opaol t t

s W u ht r

i S c r

P i pn o S, m D a r uo O s e Si t m3 m d e

P e e B S

i e (- p To M. W ne e n Wa e s e

m I sm r o o, st t s S, s A t

c R a (

r s

n 2 im - s i lp y N es w h

)r f e

e e e W e S, I u- s c

u A p g r

t # I r n E.

t 0 )x S l dc A s

e a s u 4x i

m T k d a

er n l

P l i

T (- I S F A s

I E

5 0

0 9 5-

_ i 5

e 6

Mu 9 r

o g r e

v C

R o

R c

e N w

s

/

l R

I 8 l M 1 l E

RF _

I I ( N T cI 2 N _

ii eI 1 _

M N

I A

T N

iC FC2 -

O C PC1 CS2 CS1 AM3 YY AM2 _

RR AMl e AU DT l NN AFW b OE a CV BN NI 5P T SI MFW d _

l e SG _

i y a l TB t

e n Y D O R TY Ai MSI V 6 e A Di NG t

TT 5 w - R DH T l

e P C BN I 5GA I 7

S d $G5 b4 T

a d

i W

n Y

AR2 s

r Y R R C ARI e

d o A DR Tt LPR i

c F MNr t iH c ulR P V I PR I

A N I

Cl Pa R I AI 2 W

P Y. N Ail YR RDIO ACC ATT MNE .PI I

k EM 8 P V NI N

I 1 PI 1

CHPI 2 RCPS t

Y m YT RI PAD 2 a AR I

MN 1

PADI I I s RT PSRV i

t PNI n _

U PPORV h HI c X a R Rl ' S e c B I n

t ,

i n h o c r

P M 0 D

5 a

e s

e W e

_ n r

S R a y N g r

t n e a i I n

l P E

~

6 REFERENCES

1. " Summary Report _ on Individual Plant Examination of External Events for Severe Accident Vrinerabilities, Point Beach Nuclear Plant, Units 1 and 2," Wisconsin Electric Power Company Point, Docket 50-266 and 50-301, June 30,1995.

2. " Individual Plant Eraminatian of External Events (IPEEE) for Severe Accident Vulnerabilities -

10CFR50.54(f),' U. S. Nuclear Regulatory Commission (USNRC) Generic Letter 88-20, Supplement

4. June 28,1991.

3. J. T. Chen, et al., " Procedure and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," U.S. Nuclear Regulatory Commission.

NUREG-1407, May 1991.

4. " Point Beach Nuclear Plant Individual Plant Framination (IPE) Summary Report," June 30,1993.

5.

• Fire-Induced Vulnerability Evaluation (HVE)," Electric Power Research Institute, EPRI TR-100370, Rev.1, September 1993.

6. "EPRI Fire PRA Implementation Guide," Electric Power Research Institute, Project 3385-01, Draft Report, January 31,1994.

7. W. R. Cramond, et al., " Shutdown Decay Heat Removal Analysis of a Westinghouse 2-Loop Pressurized Water Reactor, Case Study," Sandia National Laboratories, NUREG/CR-4458, March 1987.

8. R. T. Sewell, et al., " Individual Plant Framinanan for Extemal Events: Review Guidance," ERI/NRC 94-501 (Draft), May 1994.

- 9. "IPEEE Step 1 Review Gmdance Document," U.S. Nuclear Regulatory Commission, June 18, 1992.

10. S. C. Lu, and A. Boissonnade, "IPEEE Database Data Entry Sheet Package," Lawrence Livermore National Laboratory, December 14, 1993.

11. " Response to Request for Additional Information Regarding NRC Review of the IPEEE for Severe Accident Vulnerabilities Submical for Point Beach Nuclear Plant, Units 1 and 2," letter from B. Lin, Wisconsin Electric Power Company, to U.S. Nuclear Regulatory Commission, August 15,1996.

12. " Development of Criteria for Seismic Review of Selected Nuclear Power Plants," U.S. Nuclear Regulatory Commission, NUREGICR 0098, May 1978. .

13. "PRA Procedures Guide - A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants," U. S. Nuclear Regulatory Commission, NUREG/CR-2300, January 1983.

14. " Procedures for the External Event Core Damage Frequency Analysis for NUREG-1150," U.S.

. Nuclear Regulatory Commission, NUREG/CR-4840, November 1990.

15. P. Sobel, " Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains," U.S. Nuclear Regulatory Commission, NUREG-1488, October 1993.

' 72 ERI/NRC 95-505 Energy Research, Inc.

16. " Seismic Hazard Charactenzation of 69 Nuclear Power Plant Sites East of the Rocky Mountains," U.

S. Nuclear Regulatory Commission, NUREG/CR-5250, Vols.1-8, January 1989.

17. " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," U. S.

Nuclear Regulatory Commission, NUREG-0800, LWR Edition, July 1981.

.18. " Seismic Analysis of Safety-Related Nuclear Structures and Commentary on-Standard for Seismic Analysis of Safety-Related Nuclear Streutures," ASCE Standard, ASCE 4-86, September 1986.

19. "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power Research Institute, EPRI-NP-6041-SL, Revision 1, August 1991.

)

20. E. Kausel, "LAYSOL - A Program for the Dynamic Response Analysis of Layered Soils," Version 3.1, 1992.

21. E. Kausel, *SUPELM Version 2.0 - Foundation Embedded in Layered Media: Dynamic Stiffnesses and Response to Seismic Waves," 1992.

22. E. Kausel, "EKSSI Version 2.0 User's Manual," Massachusetts Institute of Technology,1992.

23. " Generic Implementation Procedure (GIP) for Seismic Verification of Nuclear Plant Equipment,"

Revision 2, Seismic Qualification Utility Group (SQUG), February 14,1992.

24. "Probabilistic Seismic Hazard Evaluations at Nuclear Plant Sites in the Central and Eastern United

. States; Resolution of the Charleston Earthquake Issue," Electric Power Research Institute, EPRI NP-J 6395-D, April 1989.

25. " Revised Report on Great Lakes Open-Coast Flood Levels," U.S. Army Corps of Engineers, Phase 1, prepared for the Federal Emergency Management Agency,1988.

26. " Staff Guidance of IPEEE Submittal Review on Resolution of Generic or Unresolved Safety Issues (GSI/USI)," U.S. Nuclear Regulatory Commission, August 21,1997.

. Energy Research, Inc. 73 ERI/NRC 95-505