ML20212J260
| ML20212J260 | |
| Person / Time | |
|---|---|
| Site: | Pilgrim |
| Issue date: | 03/31/1998 |
| From: | Lambright J, Rahbarkhatib, Sholly S ENERGY RESEARCH, INC. |
| To: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| Shared Package | |
| ML20212J215 | List: |
| References | |
| CON-NRC-04-95-050, REF-GTECI-102, REF-GTECI-147, REF-GTECI-148, REF-GTECI-156, REF-GTECI-A-46, REF-GTECI-NI, REF-GTECI-SC, RTR-NUREG-1407, TASK-***, TASK-103, TASK-147, TASK-148, TASK-156, TASK-A-45, TASK-OR ERI-NRC-96-504, GL-88-20, NUDOCS 9910050089 | |
| Download: ML20212J260 (80) | |
Text
F-ERI/NRC 96-504 TECHNICAL EVALUATION REPORT ON THE
" SUBMITTAL-ONLY" REVIEW OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS AT PILGRLM NUCLEAR POWER STATION FINAL REPORT March 1998 M. Khatib-Rahbar Principal Investigator q
i Authors:
2 L A. Lambright, S. C. Sholly, and R. T. Sewell Energy Research, Inc.
P.O. Box 2034 Rockville, Maryland 20847 i
Work Performed Under the Auspices of the United States Nuclear Regulatory Commission Office of Nuclear Regulatory ResearcL Washington D.C. 20$f; Contract No. 04-94 430 Formerly with Beta Corpornion International,6719-D Academy Ro d NE, Albuquerque, NM 87109: presently with LambrightTechnical Associates,9009 Lagnma de Oro Road, NE. Albuquerque, NM 87111 2
Preser.tly with EQE International,2942 Evergreen Parkway, Suite 302, Evergreen, CO 80439 9910050089 9?1001 i
.i PDR ADOCK 05000293 l
p PDR
)
M b;
^h TABLE OF CONTENTS 9
l EXECUTIVE
SUMMARY
..., vi L PREFA CE.............. -......................
.. - Au ABBREVIATIONS................................................... xiii.
- INTRODUCTION L..........................................
.1 Ll.1 Plant Characterization '........................,..............
1 1.2 Overview y M.'i Licensee's IPEEE Process and Important Insights..
........ 2 1.2.1 S eis mic.. -..... -,..................... -.............
2 2
1.2.2 - Fire '.........................
..4
- 1. 2. 3 ' HFO Events...................................... -... 4
' l.3.
Overview of Review Process and Activities........
...5 1.3.1 Seismic....................
.......5 1.3.2 Fire.........................................
....6 1.3.3 HFO Events................................
7 2-CONTRACTOR REVIEW FINDINGS............................
...8
'2.1-Seismic.........
.8
- 2.1.1. Overview and Relevance ot the Seismic IPEEE Process.............
8.
2.1.2 1 ogic Models.................
.8
.2.1.3 : Non-Seismic Failures and Human Actions...........
11 l
2,1.4 - Seismic Input (Ground Motion Hazard and Spectral Shape) 12
- 2.1.5. Structural Responses and Component Demands.
13 4.............
2.1.6 : Screening Criteria................................... 13
.2.1.7 Plant Walkdown Process...... -.........
13 t
2.1.8 Fragility Analysis................
. 14 15 2.1.9 A'ecident Frequency Estimates..,.....
l 2.1.10 Evaluation of Dominant Risk Contributors..................
16 16 2.1.1i Relay Chatter Evaluation...........
2.1.12 Soil Failure Analysis.,........................
17 2 1.13 Containment Performance Analysis........................
18 L
-. 2.1.' 4 Seismic-Fire Interaction and Seismically Induced Flood Evaluations.
19 1
2.1.15 Treatment of U SI A-45.............................
19 2.1.16 Other Safety lssues....................
20
- 2.1.17 Process to Identify, Eliminate, or Reduce Vulnerabilities.......
. 22
-2.1.18 Peer Review Process.................................
22 23 2.2 Fim..............................................
2.2.1 Overview and Relevance of the Fire IPEEE Process..............
23 2.2.2 Review ' f Plant information and Walkdown.
26 l
o 2.2.3 Fire-Induced initiating Events...
.........................27 28 2.2.4 ' Screening of Fire Zones....................
L 2.2.5 ' Fire Hazard Analysis.......
28
,2.2.6 Fire Growth and Propagation......,,...........
. 29 2.2.7 Evaluation of Component Fragilities and Failure Modes 30
- Energy Research; Inc.
ii ERI/NRC 96-50J j
i
s
~
2.2.8 Fire Detection and Suppression 33 2.2.9 Analysis of Plant Systems and Sequences 33 2.2.10 Fire Scenarios and Core Damage Frequency Evaluation 33 2.2.I1 Analysis of Containment Performance.
34 2.2.12 Treatment of Fire Risk Scoping Study Issues 34 2.2.13 USI A-45 Issue.
35 2.3 HFO Events.
35 2.3.1 High Winds and Tornadoes 36 2.3.1.1 General Methodology 36 2.3.1.2 Plant-Specific Hazard Data and Licensing Basis 36 2.3.1.3 Significant Changes Since Issuance of the Operating License..
37 2.3.1.4 Significant Findings and Plant-Unique Features 37 2.3.1.5 Hazard Frequency..
37 2.3.2 External Flooding 38 2.3.2.1 General Methodology 38 2.3.2.2 Plant-Specific Hazard Data and Licensing Basis 38 2.3.2.3 Significant Changes Since Issuance of the Operating License..
39 2.3.2.4 Significant Findings and Plant-Unique Features 39 2.3.2.5 Hazard Frequency 39 2.3.3 Transportation and Nearby Facility Accidents.
39 2.3.3.1 General Methodology 39 2.3.3.2 Plant-Specific Hazard Data and Licensing Basis 40 2.3.3.3 Significant Changes Since Issuance of the Operating License 41 2.3.3.4 Significant Findings and Plant-Unique Features 41 2.3.3.5 Hazard Frequency 41 2.3.4 Other HFO Events 41 ;
2.4 Generic Safety issues (GSI-147, GSI-148, GSI-156 and GSI-172) 41
'.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control Panel Interaction" 41 4.2 GSl~l48, " Smoke Control and Manual Fire Fighting Effectiveness" 42
.4.3 GSI-156, " Systematic Evaluation Program (SEP)"
42 2.4.4 GSI-172, " Multiple System Responses Program (MSRP)"
46 3
OVERALL EVALUATION AND CONCLUSIONS 51 3.1 Seismic.
51 3.2 Fire 53 3.3 HFO Events 54 4
IPEEE INSfGHTS, IMPROVEMENTS, AND COMMITMENTS 55 4.1 Seismic 55 4.2 Fire 56 4.3 HFO Events 56 5
IPEEE EVALUATION AND D ATA
SUMMARY
SHEETS 57 Energy Research, Inc.
iii ERI/NRC 96-504
r-J
=
6 REFERENCES,..
64 i
Energy Research, Inc.
jv ERI/NRC 96-504
o
..e
?
i' '
. LIST OF TABLES
- +
Table 5.1 -
External Events Results '....
........-58
- Table 5.2
. PRA Seismic Fragilitp ',........................
....... - 59
- Table 5.3
~ BWR Accident Sequence Overview Table - For Seismic PRA Only,........
60 Table 5.4 BWR Accident Sequence Detailed Table - For Seismic PRA only.........
61 Table 5.5 BWR Accident Sequence Overview Table - For Fire PRA Only.........
. 62-Table 5.6
= BWR Accident Sequence Detailed Table - For Fire PRA only 63 1
1
)
i i
i i
i Energy Research, Inc.
v ERI/NRC 96-504
1
),
EXECUTIVE
SUMMARY
This technical evaluation report (TER) documents a " submittal-only" review of the individual plant exammation of external events (IPEEE) conducted for the Pilgrim Nuclear Power Station (PNPS). This technical evaluation review was performed by Energy Research, Inc. (ERI) on behalf of the U.S. Nuclear l
Regulatory Commission (NRC). The submittal-only review process consists of the following tasks:
I Examine and evaluate the licensee's IPEEE submittal and directly relevant available documentation.
Develop requests for additional information (RAls) to supplement or clarify the licensee's IPEEE submittal, as necessary.
Examine and evaluate the licensee's responses to RAls.
Conduct a final assessment of the strengths and weaknesses of the IPEEE submittal, and develop review conclusions.
This TER documents ERI's ' qualitative assessment of the Pilgrim IPEEE submittal, panicularly with respect to the objectives described in Generic Letter (GL) 88-20, Supplement No. 4, and the guidance presented in NUREG-1407.
Boston Edison Company (BECo) is the licensee of the Pilgrim plant. The Pilgrim IPEEE was performed by the licensee, with st.pport from contractors Stevenson & Associates, Science Applications International Corporation (SAIC), Jack R. Benjamin and Associates, GEI Consultants Inc., and a number of individual consultants (Drs. Robert P. Kennedy, Eduardo A. M. Kausel, and Robert V. Whitman). The PNPS IPEEE considered a number of external initiators. and produced tindings with respect to the contribution to core damage frequency (CDF) for seismic and tire events; high winds, flooding, and other (HFO) events were screened-out on the basis of contributing less than 104 per reactor-year (ry) to die CDF.
Licensee's IPEEE Process For the PNPS IPEEE, the licensee used probabilistic risk assessment (PRA) methods for analyzing seismic and fire initiators, and a progressive screening approach to analyze IIFO initiators.
With respect to seismic events, BECo performed a new Level-1 seismic PRA (SPRA), with a simplified quantitative seismic containment performance analysis. The overall SPRA approach employed seismic margin assessment (SMA) plant walkdown and screening techniques (EPRI NP-6041, Rev.1) and also used the Generic implementation Procedure (GIP) for screening. The remainder of the analysis generally followed the guidance of NUREG-1407 and NUREG/CR-4840. An important aspect of the analysis was the use of a " surrogate elemer.t" to characterize the seismic capacity (fragility) of components which were screened out (based on seismic margin screening tables) at an equivalent median fragility of 0.3g PGA (actually, the screening approach follows the latest revision of EPRI NP-6041, which employs spectral-acceleration-based screening levels). This matter is discussed further under " Observations", below. The plant logic analysis was performed by modifying individual plant examination (IPE) event trees and fault trees. For the screenedeut components, the surrogate element was used to model the potential for multiple component failures that may lead to failure of one or more systems. Seismic structural responses and Energy Research, Inc.
vi ERI/NRC 96-504
component demands were determined using a new soil structure interaction (SSI) analysis, wi3 input based on the median 10,000-year spectral shape from NUREG/CR-5250, anchored to a peak ground acceleration (PGA) of 0.4g.
With respect to fire events, the licensee used a combination of the fire-induced vulnerability evaluation (FIVE) and PRA methods for the Pilgrim IPEEE evaluation. The fire analysis consisted of four ster (a) qualitative screening, (b) quantitative screening, (c) fire damage evaluation screening, and (d) fire scenario j
evaluation and quantification. Qualitative screening was aimed at identifying plant areas with no important components, or where fue will not induce a plant trip. Appendix R fire areas and zones were used as the basis for qualitative screening, with a review to assess the potential for cross area / zone propagation which resulted in combining some fire areas. Safety system components in each area were identified using a i
spatial database of equipment and cable routing. Possible fire-induced initiating events 'meluding manual j
trip) were analyzed for each area. Each area not containing equipment or cables needed to mitigate the
)
effects of an initiating event, was screened out from further analysis. Quantitative screening was
{
performed based on fire ignition frequencies for the area and the availability of mitigating safety systems outside the fire area. Fire ignition frequencies were obtained from the Electric Power Research Institute (EPRI) fire events database, with this data applied to plant-specitic areas based on actual components and combustible loads in the area. If the tire induced CDF was determined to be less than 104/ry, the area was screened out from further analysis. Areas surviving screening were evaluated in detail based on tire growth and propagation analysis, ad/or fire damage evaluation. Fire growth and propagation analysis was performed based on the FIVE worksheets and heat transfer equations. IPE models were applied to quantify fire-induced CDFs for each fire scenario in the remaining unscreened areas. The fire-related plant walkdowns, which were conducted by a team of tire protection and PRA engineers, were used to help detme fire areas and other important factors for the analysis. No credit was taken for hum:'n detection of tires, nor was credit taken for non-tire brigade manual suppression of tires, except in the case of control room fires. Sandia fire risk scoping study (FRSS) issues were treated via walkdowns and analysis.
With respect to HFO initiators, the licensee adopted a general methodology which follows that presented in NUREG-1407, and which includes the following major steps:
Review Pilgrim-specitic hazard data and licensing basis Identify significant changes since issuance of the plant operating license (OL)
Verify that the design meets 1975 Standard Review Plan (SRP) criteria Perform bounding hazard frequency analyses Document study approach and findings Key IPEEE Findings 4
The IPEEE results indicate that the CDF for PNPS, due to external events, is 8.02 x 10 /ry when the seismic CDF contribution (5.82 x 104/ry) is based on the 1989 EPRI seismic hazard curves, or 1.16 x 10" 4
/ty when the seismic CDF contribution (9.39 x 10 /ry) is based on the 1993 Lawrence Livermore National Laboratory (LLNL) seismic hazard curves. No outliers were identitied from the IPEEE, although the seismic analysis assumed implementation of certain upgrades to the plant.
From the seismic analysis, the overall plant high-confidence of low-probability of failure (HCLPF) capacity has been reported as 0.25g PGA with operator actions and random (non-seismic) failures included, or 0.32g PGA with these actions and failures excluded. The median plant capacity is reported as 0.48g Energy Research, Inc.
vii ERI/NRC 96-504
4, PGA with operator and random failures included, and 0.57g PGA without these factors included. The frequency of seismically initiated early containment failure was repc ted as 1.59x10 /ry based on the 4
EPRImean hazard curve, and as 3.17x 10 /ry using the 199311NL mean hazard curve. In terms of both 4
CDF and frequency of early containment failure, the surrogate element contributed less than 5 % of the total seismic risk; however, this result is obtained only due to the presence of relatively low capacity components and structures. Failure of high pressure inventory control and failure of containment heat removal were determined to be the important functional failures. This is true, however, because the automatic depressurization system (ADS) is not available in most seismically initiated sequences, due to the low seismic capacity of the nitrogen system and the high assumed human error rate for aligning contamment heat removal following large earthquakes. The dominant failures contributing to the seismic CDF are nine correlated failure pairs (involving electrical, pump, and surge tank failures), structural failures, and operator action failures (failure to complete procedures involving the station blackout [SBO]
diesel and containment heat removal). Single element cutsets (including building structural failures, damage to control rods and vessel internals leading to anticipated transient without scram [ATWS], and failure of control systems / electrical panels) account for 41 % of the total seismic CDF.
The fire-induced CDF was estimated to be 2.2 x 10 /ry. The major contributors to the fire CDF are tires 4
in switchgear rooms, the vital MG set room, the reactor building closed cooling water (RBCCW) pump room, the turbine building closed cooling water (TBCCW) pump room, the turbine building heater bay, the main control room, and the main transformer. No impacts on containment performance were identified for tire-initiated accident sequences.
For HFO events, based on the progressive screening approach, the licensee concluded that three classes of events needed to tie addressed in the IPEEE: high windt (hurricanes and wind-generated missiles),
tloods (including hurricanes, intense precipitation, storm surge, waves, and probable maximum floods),
and transportation and nearby facility accidents (including aircraft impacts, pipeline accidents, release of chemicals from the on-site storage of toxic gases, missiles generated by events near the site, explosions, and flammable vapor clouds). These event were evaluated for conformance to the NRC's 1975 SRP) and were found to comply with those criteria, with the exception of high winds, aircraft crashes, and intense precipitation, which were all determined to have low hazard frequency. A walkdown found no potential vulnerabilities related to these HFO events. Thus, these remaining three HFO initiators were screened out as insignificant CDF contributors based on the criteria of NUREG-1407, Section 5.2.3.
Generic Issues and Unresolved Safety Issues According to BECo, the seismic IPEEE resulted in closecut of Unresolved Safety Issue (USI) A-17 (systems interaction), USI A-45 (decay heat removal), and the Charleston earthquake issue (eastern U.S.
- seismicity). (However, see the " Observations" section below for a discussion on the validity of the basis for the licensee's resolution of the Charleston earthquake issue.)
The fire IPEEE considered USI A-45, Generic Issue (GI)-57, "Effect of Fire Protection System Actuations on Safety-Related Equipment," and the Sandia FRSS issues of NUREG/CR-5088. For USI A 45, decay bc -W F L.mphshed by the main condenser, residual heat removal (RHR) system, reactor water l
clean-up (RWCU) system, containment venting through the standby gas treatment (SBGT) system, and direct torus vent. The licensee considers this issue " closed out." The licensee also concluded that GI-57 and the Sandia FRSS issues were " closed out." In the treatment of the FRSS issues, six concerns were addressed. Control systems interactions were addressed in the context of control room tires, with the l
Energy Research, Inc.
viii ERl/NRC 96-504 l
r:
licensee concluding that all controls required for safe shutdown have transfer or isolation switches located outside the control room. Seismic-fire interactions were addressed by focusing on the potential for seistnie events to cause a release of flammable or combustible liquids / gases, by evaluating the potential for seismic actuation of tire suppression systems, and by examining the potential for seismically induced failure of fire suppression systems. However, the potential seismic-fire interaction due to a seismically induced electrical cabinet fire in the cable spreading room was not considered. Manual fire tighting effectiveness (including smoke control) was addressed by comparing the fire brigade and fire protection attributes of Pilgrim against the EPRI evaluation of the Sandia fire risk scoping study. The licensee concluded that Pilgrim meets all the attributes identified by EPRI. The potential adverse effects on piant equipment by combustion products was not addressed.
According to BECo, the HFO IPEEE resulted in closecut of USI A-17, USI A-45, and GI-103 (probable maximum precipitation issue from GL 89-22).
Some information is also provided in the Pilgrim IPEEE submittal which pertains to generie safety issue (GSI)-147, GSI-148, GSI-156, and GSI-172.
Vulnerabilities and Plant improvements No specific definition of vulnerability was provided in the IPEEE.
The licensee concluded that there are no vulnerabilities with respect to seismic events. Three improvements to the SBO diesel were assumed in the IPEEE: (a) stiffening of the SBO diesel muffler; (b) elimination of a seismic interaction failure of the main transformer bushing and/or the adjacent lightning arrestor; and (c) improvements to the friction-elip restraints connecting the A8 bus to its concrete foundation slab.
The licensee's response to RAls included a commitment to implement these improvements.
Regarding tire events, the licensee concluded that there are no significant vulnerabilities or outliers. As a result, no major safety enhancements have been identified, and consequently, no commitments were made that would require tracking by the NRC.
All HFO initiators were screened out in the Pilgrim IPEEE submittal. As a result, no major safety enhancements have been identified related to HF0 initiators, and consequently, no commitments were made that would require tracking by the NRC.
Observations For the seismic IPEEE, the licensee has creatively drawn on methods and data from both SPRA and SMA methodologies to efficiently analyze the seismic severe accident performance of the plant. No deficiencies in scope of evaluation are apparent in the submittal. The seismie portion of the IPEEE addresses the major elements specitied in NUREG-1407 as recommended items that should be considered for a seismic PRA.
7he Waa; %)f m t. clear description of the evaluation, and the documentation is considered to be well-written. The seismic fragilities, HCLPF capacities, and core damage /early release frequency results have provided valuable information on the capability of the plant structures and components in response to seismic initiating events.
Energy Research, Inc.
ix ERI/NRC 96-504
I The principal weak points of the seismic submittal are noted as follows:
The use of a surrogate element in a seismie PRA is justified only if the screening value used for the surrogate element does not result in the surrogate element becoming an important risk contributor. Components were screened at a spectral acceleration equivalent to 0.3g PGA. whleh is not appropriate for Pilgrim due to the vintage of the facility (commercial operation in 1972) and the comparatively high wismic hazard at the site (in comparison with other eastern U.S. nuclear power plant sites, based on both the EPRI and 1993 LLNL seismic hazard estimates). In addition, since Pilgrim is a 0.15g PG A SSE facility and since past seismic PRA experience indicates that much of the seismic core damage frequency arises from earthquakes with ground motica two to i
four times the SSE, screening at 0.3g PGA is inappropriate on this ground as well. The analysis perfonned by the licensee identified a plant HCLPF of 0.25g PGA with operator actions and non-seismic failures included, or 0.32g PGA with operator actions and non-seismic failures excluded.
In comparison with the NRC staff's intended 0.5g PGA seismic margin assignment for Pilgrim (as identified in NUREG-1407), this suggests that the seismic capacity of the plant may be relatively modest. Although the surrogate element contributes less than five percent of the estimated seismic CDF, it is still the fifth leading core damage " sequence". It is only because of some other low capacity components and structures that the contribution was so apparently modest. Since, as described in NUREG-1407, resolution of the Eastern U.S. seismicity issue (Charleston i
Earthquake) is contingent upon performance of a seismic IPEEE with a recommended Review I
Level Eanhquake (RLE) of 0.5g for Pilgrim, there is a concern with the validity of the licensee's resolution of this issue for Pilgrim due to screening structures and components at a levellower than the RLE.
As analyzed, the seismic CDF is 5.82 x 10 /ry using the EPRI seismic hazard or 9.39x 10'8/ry 8
using the 1993 LLNL seismic hazard. The seismic "large release" frequency is estimated to be 8
1.59x10 /ry using the EPRI seismic hazard or 3.17x10~8/ry using the 1993 LLNL seismic hazard. These results are high compared with other plants which have been reviewed and which performed a seismic PRA. In addition, the study results indicate that important components have relativelylow capacities. The nitrogen system which provides long-term capacity to depressurize the reactor has a median capacity of 0.16g PGA. Thus, in most seismic core damage sequences, the automatic depressurization system (ADS) is unavailable. The failed ADS fur.ction shows up in two of the three most likely seismically-initiated accident sequences. The emernevy diesel generators would appear as a major contributor to core damage frequency but for the existence of a non-safety " station blackout diesel"(SBO diesel). The importance of the SBO diesel is seen from the fact that among the dominant failures contributing to seismic CDF are an operator error in failing to complete a procedure to connect the SBO diesel to the emergency busses, and another operator error in failing to reset relays associated with bringing the SBO diesel online. It should be further noted that even the above results, indicating a relatively high seismic CDF and a relatively low plant capacity compared whh *e intended 0.5g PGA seismic margin assignment, were obtained assuming implementanon of cenain upgrades to the SBO diesel. Were "as-found" results reported, they would retlect an even higher seismic CDF and a lower capacity for the non-safety SBO diesel.
~
In the seismie IPEEE the 1993 LLNL seismic hazard analysis was used as the basis for defining the spectral shape. However, the 1989 EPRI seismic hazard analysis was used for the baseline seismic PRA calculations. This introduces an anomaly into the seismic CDF and other results of Energy Research, Inc.
x ERI/NRC 96-504
j the analysis. In addition, the spectral shape for Pilgrim was anchored at 0.4g rather than the NUREG-1407-recommended value of 0.5g.
In response to an RAI, the licensee identified that loss of decay heat removal is responsible for about one-third of the (comparatively high) seismic CDF. The licensee indicated that a substantial period of time is available for repair and recovery. However, no attempt was made by the licensee to mechanistically relate the substantial period of time to the seismic failure modes which give rise to the loss of decay heat removal. Thus, it is not possible to assess whether the amount of time available for repair and recovery is physically meaningful.
Finally, with a single exception (AC Bus A8), nine of the ten lowest capacity components and structures have identical uncertainty values of p, = 0.46 and Pc = zero. These fragility assignments imply an identical state of knowledge and uneenainty about diverse components, which is not credible. Further, this practice is inconsistent with the guidance in Section 3.1.1.3 of NUREG-1407 for seismic fragility estimates, and no justification is given for this fragility uncertainty assessment.
These matters are discussed in greater detail in Section 2.1 of this TER. Resolution of these weaknesses is important to ensure that the study's conclusions are fully justified and to ensure that the intent of GL 88-20 is met with respect to the seismic IPEEE analysis. Additionally, in order to address remaining open issues with respect to the present review of the Pilgrim seismic IPEEE, this TER recommends that the NRC perform various follow-up activities, as indicated in Section 3.1.
For the fire IPEEE, walkdown findings were appropriately used in detining potential tire targets. There are no fire areas which were found to be improperly screened out. A review of plant layout drawings and/or a plant walkdown would be required in order to ascertain whether or not the licensee gave adequate consideration to cross-zone tire and smoke spread, and to whether fire suppression activities could result in safety-related equipment damage in plant areas adjacent to tire locations. Generic nuclear industry data were used by the licensee to develop fire ignition frequencies; Pilgrim-specific data were utilized only to the extent that Pilgrim events were retiected in the generie industry data. The present review has found the treatment of human reliability in the case of control room tires to be inadequate, leading to a probable underestimate of CDF for such tires. In particular, the analysis of control room tires employs optimistie human error probabilities (HEPs), based on a single correct performance of a procedure during a simulated control room fire emergency. A single correct performance is not statistically significant, and cenainly not meaningful to the extent assumed in the licensee's analysis. Alternate calculations performed in the presetr review suggest a conditional probability of failure to correctly abandon the control room of 0.078, rather than the value of 0.0036 calculated in the IPEEE (i.e., about a factor of 22 increase). The optimistic treatment of operator recovery actions for control room fire scenarios has led to approximately an order of magnitude reduction in estimated fire-induced CDF as compared to the NUREG-1150 fire analyses. This use of optimistic analytical techniques has also led to a CDF notably less than values typical of past fire PRAs.
The HFO external events were analyzed by a progressive screening approach, to idemify any events with CDF contributions judged to be greater than 104/ry. The general methodology utilized in the HFO IPEEE has followed the procedure presented in NUREG-1407 for the analysis of other external events. For Pilgrim, all HFO events were screened out on the basis of conformance to SRP eriteria, or based on the finding of a bounding estimate of CDF less than 10 /ry.
4 Energy Research, Inc.
xi ERI!NRC 96-504
y
- =
ABBREVIATIONS AC '.
Alternating Current
-ADS
. Automatic Depressurization System
~ ASP
~ Alternate Shutdown Panel ATWS Anticipated Transients Without Scram BECo Boston Edison Company BWR Boiling Water Reactor :
CDF.
Core Damage Frequency CET Containment Event Tree CRD Control Rod Drive CST Condensate Storage Tank DC Direct Current DHR Decay Heat Removal ECCS-Emergency Core Cooling System EPRI Electric Power Research Institute ERF-Early Release Frequency ERI Energy Research, Inc.
FIVE Fire Induced Vulnerability Evaluation FRSS Fire Risk Scoping Study GE General Electric GI Generic Issue GIP Generic Implementation Procedures GL Generic Letter GSI.
Generic Safety Issue HCLPF.
High Contidence of Low Probability of Failure HEP Human Error Probability.
HFO High Winds, Flooding, and Other External Events HPCI High Pressure Coolant injection HRA Human Reliability Analysis HVAC Heating, Ventilation and Air Conditioning IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events LLNL Lawrence I ivermore National Laboratory
/
LOCA Loss-ofC Jant-Accident LPCI Low Pressure Coolant Injection MCC Motor Control Center MSL Mean Sea Level NFPA National Fire Protection Association NOAA National Oceanic and Atmospheric Administration NRC' Nuclear Regulatory Commission NWS National Weather Service OL Operating License PCIS Primary Containment Isolation System PGA Peak Ground Acceleration PMH Probsle Maximum Hurricane PMP Probable Maximum Precipitation Energy Research, Inc, xiii ERI/NRC 96-504
. < :.g.
PNPS Pilgrim Nuclear Power Station PRA Probabilistic Risk Assessment
' PSAR Preliminary Safety Analysis Report-
-PSF Performance Shaping Factor
- RAI Request for AdditionalInformation
}
Reactor Building Closed Cooling Water RCIC Reactor Core Isolation Cooling RHR Residual Heat Removal RLE Review Level Earthquake RO Reactor Operator RWCU Reactor Water Clean-Up SAIC -
Science Applications International Corporation SBGT Standby Gas Treatment SBO Station Blackout SCE Seismic Capability Engineer
.SER-Safety Evaluation Report SMA Seismic Margin Assessment
.SORV Stuck-Open Relief Valve SPRA Seismic Probabilistic Risk Assessment SRO Senior Reactor Operator SRP Standard Review Plan SRT Seismic Review Team SSE Safe Shutdown Earthquake
- SSI Soil Structure Interaction
. TBCCW Turbine Building Closed Cooling Water TER Technical Evaluation Report.
THERP Technique for Human Error Rate Prediction UFSAR Updated Final Safety Analysis Report UHS Uniform Hazard Spectra USI Unresolved Safety Issue Energy Research, Inc, xiv ERI/NRC 96-504
D, S
w 1
INTRODUCTION This technical evaluation report (TER) documents the results of the " submittal-only" review of the
' individual plant examination of external events (IPEEE) for the Pilgrim Nuclear Power Station (PNPS)
' [1]. This technical evaluation review, conducted by Energy Research, Inc. (ERI), has considered various external initiators, including seismic events; tires; and high winds, floods, and other (HFO) external events.
The U.S.' Nuclear Regulatory Commission (NRC) objective for this review is to determine the extent to which the IPEEE process used by the licensee, Boston Edison Company (BECo), meets the intent of Generic Letter (GL) 88-20, Supplement No. 4 [2]. Insights gained from the ERI review of the IPEEE submittal are intended to provide a reliable perspective that assists in making such a determination. This review involves a qualitative evaluation of the licensee's IPEEE submittal, development of requests for additionalinformation (RAls), evaluation of the licensee responses to these RAIs, and finalization of the TER.
The emphasis of this review is on describing the strengths and weaknesses of the IPEEE submittal, particularly in reference to the guidelines established in NUREG 1407 [3]. Numerical results are verified for reasonableness, not for accuracy; however, when encountered, numerical inconsistencies are reported This TER complies with the requirements of NRC's contractor task order for an IPEEE submittal-only
- review.
The remainder of this section of the TER describes the plant contiguration and presents an overview of the licensee's IPEEE process and insights, as well as the review process employed for evaluation of the seismic, fire, and HFO events sections of the PNPS IPEEE. Sections 2.1 to 2.3 of this report present ERI's findings related to the seismic, fire, and HFO events reviews, respectively. Sections 3.1 to 3.3 summarize ERI's evaluation and conclusions from the seismic, fire, and HFO events reviews, respectively.
Section 4 summarizes the IPEEE insights, improvements, and licensee commitments. Section 5 includes completed IPEEE data summary and entry sheets. Finally, Section 6 provides a list of references.
1.1 Plant Charneurization Pilgrim Nuclear Power Station is a single-unit, General Electric (GE) boiling water reactor (BWR), Model 4, housed in a Mark-I pressure-suppression containment. The plant is located in Plymouth County, Massachusetts, on the shore of Cape Cod Bay, approximately four miles southeast of the town of Plymouth, Massachusetts. The plant was designed and constructed by Bechtel. Pilgrim was placed in commercial operation in December 1972.
Limited information on plant configuration is provided in the IPEEE. The plant seismic design basis is defined by a safe shutdown earthquake (SSE) of 0.15g peak ground acceleration (PGA) for horizontal motion, with the spectral shape defined by a Housner spectrum, Energy Research, Ine.
1 ERl/NRC 96-504 o
s, 1.2 Overview of the Licensee's IP'EEE Process and Imoortant Insights 1.2.1 Seismic BECo committed to the NRC to perform a seismic probabilistic risk assessment (SPRA) prior to issuance of NUREG-1407, thus a seismic margin review-level earthquake (RLE) binning assignment was not made.
BECo undettook a new SPRA, including a qualitative and quantitative containment performance analysis, for the Pilgrim SPRA. The SPRA was based on the methods and models used in the Pilgrim individual plant examination (IPE) study, which used a fault tree linking approach that allows explicit modeling of dependencies, providing the ability to directly propagate seismic failures through frontline systems. The SPRA also includes a simplified contamment performance model developed to identify scenarios leading to significant early radiological releases arising from seismically initiated severe accidents. Pilgrim is a unresolved safety issue (USI) A-46 plant; the USI A-46 evaluation effort was coordinated, to the extent possible, with the seismic IPEEE effon. The SPRA, and the fragilities estimated for components, are based on the assumption that the US! A-46 program will be completed and that all potential USI A-46 outliers will be resolved.
The SSE for Pilgrim is characterized by a 0.15g PGA for horizontal motion. The design spectral shape is defined by a Housner spectrum. All Class I structures / rooms have been designed for seismic loads obtained from these motions. The reactor building and containment are founded on a common, rigid foundation mat; the turbine building is located on a separate foundation mat. These foundations rest on heavily compacted till materials with an approximate depth to bedrock of about tifty feet.
In the seismic IPEEE, more than one thousand SPRA structures and components were identified and addressed. Accessible components have been walked down, with application of Generie implementation Procedure (GIP) [4] and/or seismic margin assessment (SMA) [5] methods. Components which were screened out using these procedures were represented in the SPRA by means of a " surrogate element."
Screened-in components were assigned fragilities and included in the SPRA quantification.
The remainder of the analysis generally followed the SPRA guidance of NUREG-1407 (3], the PRA Procedures Guide [6], and NUREG/CR-4840 [7). The use of a " surrogate element" to characterize the sesmic capacity (fragility) of components which are screened out has been found to be acceptable in the past so long as the surrogate element has a sufficiently high fragility that it does not become a dominant contributor to seismic CDF. Although the analysis indicates that the surrogate element contributes less than five percent to both seismic CDF and seismie large release frequency, these results are obtained only because of the presence of low capacity components. The spectral acceleration used for the surrogate element is equivalent to a 0.3g PGA, which is less than the NRC staff's recommended 0.5g PGA seismic margin binaing for Pilgrim (as documented in NUREG-1407).
In defining the earthquake harard for use in the seismic IPEEE submittal for Pilgrim, BECo used both the 1989 Electric Power Research Institute (EPRI) (8) and 1993 Lawrence Livermore National Laboratory (LLNL) [9] hazard curves in the SPRA quantification. (Note, the 1989 LLNL hazard curves [10] were i
not used in defining ground motion exceedance frequencies, but were used to define the shape of the input response spectrum. Hence, a presumed minor inconsistency has been introduced with respect to ground motion input and hazard.) PGA was used as the ground motion parameter for developing fragility functions and for performing accident sequence quantifications. Only minor changes in the ranking of dominant contributors to core damage frequency (CDF) or early release frequency (ERF) resulted from i
Energy Research, ine.
2 ERl/NRC 96-504
)
5 using the 1993 LLNL hazard curve as opposed to the EPRI hazard curve (which was used as the base-case quantification).
o Detailed seismic walkdowns were performed, including extensive use of photography to document the as-found condition of the plant and to aid in fragility assignment. Accident sequence event trees and plant system models used in the SPRA were adapted from those used in the Pilgrim IPE analysis, and were modified as necessary to account for seismic events.
The basic elements of the Pilgrim seismic IPEEE were as follows:
Seismic initiating events analysis.
Construction of event trees which assume loss of offsite power (based on review of existing SPRAs which showed that little additional insight was gained by including sequences where offsite power is available).
Fault trees based on the internal events IPE.
Walkdowns by EPRI-trained te.ans using GIP and SMA guidance to address both IPEEE and USI A-46 issues.
Relay chatter evaluation based on NUREG-1407 recommendations.
Seismic hazard analysis using the 1989 EPRI mean seismic hazard curve [8].
Fragility analysis based on SMA componmt screening, initial fragility analysis, and refined l
fragility analysis, including detailed anchon analysis as a limiting basis for fragility. After use l
of fragilities based on median capacity (A,) and logarithmic standard deviation (pc), a sensitivity analysis was performed to identify candidates for refined fragility analysis which used estimated individual contributions from pa and pc instead of pc lone.
a l
[
Assignment of components satir#ying requirements for a 0.8-1,2g spectral acceleration to a l
surrogate element, which was calculated to insignificantly affect the SPRA results.
Development of response spectra using soil structure interaction (SSI) analysis, instead of simple scaling of demands derived from the design-basis response spectrum.
Risk quantification in two steps: initial quantification at 0.2g,0.4g, and 0.6g PGA (using the CAFTA code) to establish cutsets; and final quantification (using the SHIP code) of the plant logic model with the mean seismic hazard curve, to determine the frequency of core damage and establish a fragility curve and high confidence of low probability of failure (HCLPF) capacity for the plan:.
Additional details pertaining to the various major aspects of the seismic IPEEE process and findings are provided in Section 2.1.
Energy Research, Inc.
3 ERI/NRC 96-504
o 1.2.2 Fire The licensee has conducted an extensive and detailed analysis of potential fire events at Pilgrim. The licensee used a combination of the fire-induced vulnerability evaluation (FIVE) [11] and probabilistic risk assessment (PRA) methods for the Pilgrim IPEEE evaluation.' The fire analysis consisted of four steps:
(a) qualitative screening, (b) quantitative screening, (c) fire damage evaluation screening, and (d) fire scenario evaluation and quantification. The licensee has used plant data from the Appendix R effort to conduct the analysis. Fire-related plant walkdowns, which were conducted by a team of tire protection and PRA engineers, were used to help define fire areas and other important factors for the analysis. No credit was taken for human detection of fires, nor was credit taken for non-fire brigade manual suppression of fires, except in the case of control room fires. Sandia fire risk scoping study (FRSS) issues were treated via walkdowns and analysis.
Overall, the licensee has concluded that there are no significant fire vulnerabilities at Pilgrim. This review has the following concerns with analytical assumptions employed in the IPEEE:
The operator recovery probabilities for the control room fire scenarios are highly optimistie.
The time prior to firminduced cyrrol room abandonment is assumed to be 9.5 minutes, which is not representative of cabinet fire test data.
Seismic-fire interactions considering non-id electrical cabinets have not been addressed.
The potential for active fire barrier elemera failures was not considered.
The fire compamnent interactions analysis did not consider the fire brigade accessing the fire area through adjacent fire zones that contain cable and equipment from a redundant safety train.
1.2.3 HFO Events The licensee used a progressive screening approach based on Section 5 of NUREG-1407 [3] to assess HFO events (high winds, tornadoes, external tloods, transportation and nearby facility accidents, and other plant unique external events). The followmg steps were employed in the licensee's methodology:
Compilation of a complete listing of external events, considering the NRC PRA Procedures Guide
{6], the updated final safety analysis report (UFSAR) for Pilgrim, and the preliminary safety analysis report (PSAR) for Unit 2 (subsequently canceled).
Evaluation of this external events list using the PRA Procedures Guide screening criteria (Section 10.3.1 of the guide).
Consideration of conformance of the plant design to the NRC's 1975 Standard Review Plan (SRP) criteria.
j Performance of bounding hazard assessments.
i
)
l Energy Research, Inc.
4 ERl/NRC 96-504
o Based on this screening approach, the licensee concluded that three classes of events needed to be addressed in the IPEEE: high winds (hurricanes and wind-generated missiles), tlcods (including j
hurricanes, intense precipitation, storm surge, waves, and probable maximum floods), and transportation and nearby facility accidents (including aircraft impacts, pipeline accidents, release of chemicals from the onsite storage of toxic gases, missiles generated by events near the site, explosions, and flammable vapor clouds). These events were evaluated for conformance to the NRC's 1975 SRP, and were found to comply with those criteria, with the exception of high winds, aircraft crashes, and intense precipitation, which were determined to have low hazard frequency. A walkdown found no potential vulnerabilities related to these HFO events. Thus, these remaining three HFO initiators were screened out as insignificant CDF contributors, based on the criteria of NUREG-1407, Section 5.2.3 [3).
1.3 Overview of Review Process and Activities I
In its qualitative review of the Pilgrim IPEEE, ERI focused on the study's completeness in reference to NUREG-1407 guidance: its ability to achieve the intent and objectives of GL 88-20, Supplement No. 4; its strengths and weaknesses with respect to the stateof-the-art; and the robustness of its conclusions. This review did not emphasize confirmation of numerical accuracy of submittal results; however, any numerical i
errors that were obvious to the reviewers are noted in the review findings. The review process included
{
. the following major activities:
Completely examine the IPEEE and related documents Develop a preliminary TER and RAIs a
Examine responses to the RAIs a
Finalize this TER and its findings a
Because these activities were performed in the context of a submittal-only review, ERI did not perform a site visit or an audit of either plant configuration or detailec supporting IPEEE analyses and data.
Consequently, it is important to note that the ERI review team did not verify whether or not the data presented in the IPEEE matches the actual conditions at the plant, and whether or not the programs or procedures described by the licensee have indeed been implemented at PNPS.
1.3.1 Seismic In conducting the seismic review, ERI generally followed the emphasis and guidelines described in the report, Individual Plant Examination of External Events: Renew Guidance [12), for review of a seismic PRA, and 60 g* idance provided in the NRC report, IPEEE Step 1 Review Guidance Document [13]. In addition, on the basis of the Pilgrim IPEEE submittal, ERI completed data entry tables developed in the Lawrence Livermore National Laboratory (LLNL) document entitled "lPEEE Database Data Entry Sheet Package" [14].
In its review of the Pilgrim seismic IPEEE, ERI examined the IPEEE submittal report [1] (Sections 1.3.1, 1.4.1, 2.3.1, 6.1, 6.2, 6.3.1, and 7.2, and Chapter 3) and the licensee's response to RAls [15). The checklist ofitems identified in Reference [12] was generally consulted in conducting the seismic review.
Some of the primary considerations in the seismic review have included (among others) the following items:
i Energy Research, Inc.
5 ERI/NRC 96-504
\\
I i
1 Were appropriate walkdown procedures implemente', and was the walkdown effort sufficient to d
p accomplish the objectives of the seismic IPEEE?
Was the plant logic analysis performed in a manner consistent with state-of-the-art practices?
Were random and human failures properly included in such analysis?
Were component demands assessed in an appropriate manner, using valid seismic mot on input and i
structural response modeling, as applicable? Was screening appropriately conducted?
Were fragility calculations performed for a meaningful set of components, and are the fragility results reasonable?-
Has the surrogate element been used in such a manner so as to not obscure dominant risk contributors and to produce a valid numerical estimate of CDF?
Was the approach to seismic risk quantification appropriate, and are the results meaningful?
l Does the submittal's discussion of qualitative assessments (e.g., containment performance analysis, 1
seismic-fire evaluation) reflect reasonable engineering judgment, and have all relevant concerns been addressed?
Has the seismie IPEEE produced meaningful findings, has the licensee proposed valid plant improvements, and have all seismic risk outliers been addressed?
In some instances, quick calculations have been performed as part of the seismic review, in order to check the implications of various intermediate and final results.
i 1.3.2 Fire During this technical evaluation, ERI reviewed the fire events portion of the IPEEE for completeness and j
consistency with past experience. This review was based on consideration of Sections 1, 2, 4, 5, 6, 7, and 8 of Reference [1], and on the licensee responses to fire-related RAIs (15]. The guidance provided in l
References [12,13] was used to formulate the review process and organization of this document. The data entry sheets used in Section 5 have bem canpleted in accordance with Reference [14].
The process implemented for ERI's review of the fire IPEEE included an examination of the licensee's methodology, data, and results. ERI reviewed the methodology for consistency with currently accepted
' and state-of-the-art methods, paying special attention to the screening methodology to ensure that no fire 1
scenarios were prematurely eliminated. The data element of a fire IPEEE includes, among others, such items as:
Cable routing Fire zone / area partitioning L
Fire occurrence frequencies Event sequences Fire detection and suppression capabilities a
Energy Research Inc.
6 ERI/NRC 96-504 L
- b..
For a few fire zones / areas that were deemed imponant. ERI also verified the logical development of the screeningjustifications/ arguments (especially in the case of tire-zone screening) and the computations for
- fire occurrence frequencies and CDF.
1.3.3 HFO Events The review process for HFO events closely followed the guidance provided in the report. titled IPEEE Step 1 Retiew Guidance Document [13). This process involved examinations of the metho6dogy, the data used, and the results and conclusions derived in the submittal. Sections 1, 2, 5, 6, 7 and 8 of the IPEEE submittal [1], and licensee responses to RAIs [15), were examined in this HFO events review. The IPEEE methodology was reviewed for consistency with currently accepted practices and NRC recommended procedures. Special attention was focused on evaluating the adequacy of data used to estimate the frequency of HFO events, and on confirming that any analysis of SRP conformance was appropriately executed. In addition, the validity of the lice 4's conclusions, in consideration of the results reported in the IPEEE submittal, was assessed. Alsc, ' ounding hazard frequency analyses were checked for o
reasonableness. Review team experience was relied upon to assess the validity of the licensee's evaluation.
i I
I 1
Energy Research, Inc.
7 ERl/NRC 96-504 i
)
.2 CONTRACTOR REVIEW FINDINGS 2.1 Seismic A summary of the licensee's seismic IPEEE process has been described in Section 1.2.
Here, the licensee's seismic evaluation is described in detail, and discussion is provided regarding significant observations encountered in the present review.
2.1.1 Overview and Relevance of the Seismic IPEEE Process a.
Seismic Review Caregory As documented in NUREG-1407, PNPS is designated as a plant that will perform a seismic PRA.
However, NUREG-1407 identified the fact that Pilgrim would be placed in a 0.5g review level eanhquake bin for seismic margin purposes. The seismic IPEEE employed a screening level for the surrogate element equivalent to 0.3g PGA, rather than the 0.5g PGA value recommended by the NRC staff in NUREG-1407.
b.
Seismic IPEEE Process The licensee has undertaken a new Level-1 SPRA, together with a quantitative evaluation of contaitunent performance, for the IPEEE of PNPS. The SPRA has made use of the IPE logie models.
c.
Review Findings The licensee's overall seismic IPEEE process generally conforms to NUREG-1407 recommendations.
However, there are important weaknesses concerning the screening level for components and structures, the use of the surrogate element, the spectral shape used in the analysis, and the modeling of uncertainty in fragility of components which are contrary to NUREG-1407 guidance and good seismic PRA practic.
j The liceusee directed and had meaningful participation in all aspects of the study.
j 2.1.2 Logic Models The plant logie analysis for PNPS includes the following three major aspects: (a) seismic initiating events analysis, (b) event tree development, and (c) fault tree development.
a.
Seismic Initiaring Events Analysis l
Since piping was screened out from the analysis, seismic event trees were based on the IPE transient event I
tree model. The seismic event is, by definition in the SPRA, an event that causes a reactor trip. All other events were assumed to occur after reactor trip, and thus, the impact of other possible transient initiating events was captured by system and/or component failures occurring after reactor trip.
Seismic event trees defintd '.u c 251. ir.aude, a.
Seismic transient event b.
Seismic stuck-open relief valve (SORV)
Energy Research, Inc.
8 ERI/NRC 96-504 I
I-c.
Seismic small loss of coolant accident (LOCA) (combination of probability that the seismic event induced a small LOCA and the probability that a small LOCA will occur due to a random event 4
during the 24-hour mission time) d.
Seismic medium LOCA (probability that a medium LOCA will occur due to a random event during the 24-hour mission time) e.
Seismic large LOCA (probability that a large LOCA will occur due to a random event during the 24-hour mission time).
f, Seismic large LOCA outside containment (due to reactor building structural failures that cause piping failure) g.
Seismic interfacing LOCA h.
Reactor vessel rupture 1.
Anticipated transient without scram (ATWS)
A number ofinternal event IPE event trees were eliminated from the SPRA. These trees included station blackout (SBO) and reference leg break (the reference leg was assessed to be seismically rugged).
b.
Event Tree Modeling The SPRA models were developed using the following key assumptions, most of them unique to the SPRA:
Mission time of twenty-four hours.
Completion of USI A-46 program assumed in estimating fragilities.
Assumption of completion of plant improvements related to the station blackout diesel generator (SBO diesel).
Unrecoverable loss of offsite power, resulting in unavailability of feedwater and condensate systems for accident initisa;'un.
Failure of the nitrogen system, resulting in unavailability of the automatic depressurization system (ADS) and torus venting.
The core spray system was the only system credited for low pressure injection because it was the only system credited in the margin methodology for this function.
The residual heat removal (RHR) system was the only system credited for suppression pool cooling, because it was the only s'ystem credited in the margin method. ology for this function.
Energy Research, Inc.
9 ERl/NRC 96-504
The low-pressure coolant injection (LPCI) mode of RHR was not credited, nor was low pressure injection via the fire water pump cross-tie, because the margin methodology did not credit these systems.
Event trees were constructed by identifying the frontline safety systems and operator actions that respond to a seismic initiating event or mitigate failures of other frontline systems. The end states included: safe condition, transfers to other trees, core damage, or a plant damage state. ATWS sequences, seismically induced reactor vessel failures, interfacing system LOCAs, and large LOCAs outside contaimnent were all modeled as leading directly to core damage.
Three types of events were modeled in the plant logic model: (a) component failures initiated by seismic failures were the same as tirse used in the Pilgrim IPE plant model. There are major differences between events, (b) random (non-seismic) failures, and (c) operator actions following a seismic event. The random the IPE and SPRA event trees in terms of definitions of top events. These differences are summanzed as follows:
1 Top Event QU (high pressure coolant makeup) - In the IPE, accomplished via feedwater, high pressure coolant injection (HPCI) or reactor core isolation cooling (RCIC); in the SPRA, accomplished via HPCI or RCIC (but only for transients arr small LOCA).
Top Event X (depressurization)-In the IPE, accomplished via ADS; SPRA does not include ADS because the mt ogen supply to ADS valves is not credited due to seismic capacity concerts.
Top Event V (low pressure coolant makeup) - In the IPE, accomplished by core spray, LPCL feedwater, or fire water cross-tie; in the SPRA, accomplished by core spray only.
J Top Event W (containment pressure control)-In the IPE, accomplished by torus vent, condenser, suppression pool cooling, drywell spray, or tire water cross-tie to drywell spray; in the SPRA.
accomplished by suppression pool cooling only.
Top Event QUV (coolant injection following containment challenge) - In the IPE, accomplished via feedwater, condensate, or fire water cross-tie; not included in the SPRA.
c.
Fault Tree Modeling The SPRA was based on the methods and models (including fault trees) used in the Pilgrim IPE study, which used a fault tree linking approach. Once the seismic failure events were defined, these events were included in the IPE model by mapping the impact of interral random events with the seismically induced events. The mapping process was implemented as follows:
1.
A table for the seismically induced events was prepared which correlated the seismic failures to their random internal event failure counterparts. In cases where the seismically induced failure could be mapped to multiple or contlicting random failure events, these failures were assessed on a case-by-case basis.
Energy Research, Inc.
10 ERI/NRC 96-504
)
2.
Seismically induced events were developed and added to the failure database. Failure events were defined using the letter "E" before the event name to denote a new event for the seismic PRA, and by adding a letter "Z" to the end of the event name to denote a seismic failure mode.
3, New random events that correspond to the existing internal event failures were created with new names. This was done to include a random event in the SPRA model without introducing circular logic errors (so that the random event would not show up as an input to itself) during quantification.
4.
Seismically induced events and the new random events were mapped to the IPE random event using pre-defined gates in the flag models.
5.
Additional sei.;mic failures were mapped to the IPE random event if that component was vulnerable to failure due to the interactive effect of block wall collapse or other structural failures.
Details of this process are included in Appendix 3A of the Pilgrim IPEEE submittal.
d.
Review Findings Logic modeling for the PNPS seismic IPEEE appears to have been well ecnducted and adequately documented in accordance with NUREG-1407 guidance, with the exception that the surrogate element modeling did not conform to NUREG-1407 guidance (the surrogate element represents screened components, which were screened at approximately 0.3g PGA instead of the NRC staff recommended value of 0.5g PGA for Pilgrim). All other significant logic modeling issues were addressed in a meaningful way.
It should be recognized that, properly handled, the surrogate element accounts for screened-out components in a scrutable manner. Seismic PRAs which do not include a surrogate element simply eliminate from consideration those stnictures and components which are screened out on the basis of high capacity. The surrogate element provides a method (albeit approximate) of representing those screened-out structures and components, which is mathematically tractable and can be evaluated in an engineering sense as well (e.g.,
analysts and reviewers can track specific failure moces through the analysis). This approach works, however, only when the screening "g" level is chosen such that the surrogate element makes a small contribution to core damage frequency and risk.
The Pilgrim IPEEE addressed dependencies by means of detailed seismic walkdowns, and by the use of appropriate modeling of seismically correlated failure events. It is noted that the submittal conservatively assumes the unavailability of offsite power for all seismic events.
2.1.3 Non-Seismic Failures and Human Actions a.
Overall Approach Because seismic fault trees were linked with IPE fault trees, non-seismic failures, human actions, and test and maintenance unavailabilities were all explicitly included in the seismic IPEEE. With the exception of human failure events, the random and common cause events used in the IPE were also used in the IPEEE, Risk-significant random failures in the SPRA are listed in Table 3-4 of the IPEEE submittal, j
l Energy Research, Inc.
I1 ERI/NRC 96-504
Y b.
Hwnan Reliability Analysis The SPRA human reliability analysis (HRA) considered actions performed before and after the earthquake initiating event. Errorr, made before the eanhquake represent " latent" human errors, while those made after the earthquake are designated " seismic" human errors. Seismic human errors were quantified by a two-step process involving initial screening followed by detailed HRA. The screening analysis was performed by assigning values to human errors based on whether the actions could be performed inside or outside the control room. Errors outside the control room were assigned a human error probability (HEP) of 1.0, while errors inside the control room were assigned a value of 0.1 per demand. The SPRA models were quantified with the screening HRA values used to quantify the sequences and cutsets, and to identify the dominant seismic human errors. The dominant errors were then selected for detailed HRA using the
" Technique for Human Error Rate Prediction" (THERP) approach [16].
)
Seismic impacts on operator error rates were modeled by assignment of increasing probability of error for increasing levels of ground motion. At levels less than 0.15g, the IPE HEPs were used. The HEPs were increased linearly to ten times the HEP value at 0.5g. For ground motion larger than 0.5g PGA, a
" maximum reasonable HRA value was used," based on engineering judgment. Operator actions to reset relays were modeled in the seismic IPEEE.
Two important human errors that were identified in the IPEEE are: failure to realign RCIC suction from 1
the condensate storage tanks (CSTs) to the suppression pool (performed from the control room); and failure to line up suppression pool cooling. Since the CSTs have a relatively low seismic capacity, and manual alignment is required to switch suction from the CSTs to the suppression pool, failure to perform i
this action eliminates RCIC as a high-pressure injection source following many earthquakes. Similarly, aligning suppression pool cooling is a manual action, and failure to successfully perform this action represents a single element which fails all containment heat removal.
Risk-significant human errors are identified in Table 3-8 of the IPEEE submittal.
(
c.
Review Findings
)
BECo has explicitly included the effects of non-seismic failures and human actions by linking seismie fault tree logic with IPE logic models that account for these effects. The licensee has documented an approximate operator fragility method to account for seismic effects on human error rates. This methodology is simplified; however, the data and analytical methods do not yet exist to support a more detailed assessment. The licensee's treatment of non-seismic failures and human actions satisfies the guidelines of NUREG-1407 for a seismic PRA. If more data becomes available in the future concerning the impact of earthquakes on human reliability, the seismic IPEEE model can be adjusted accordingly.
j 2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape)
BECo has used the 1989 LLNL median,10,000-year uniform-hazard spectral shape (anchored to a peak ground acceleration of 0.4g) for characterizing ground motion input for the Pilgrim SPPA
~
recommended in NUREG-1407. The 1989 EPRI seismic hazard curve was used for quantification (8], and detailed sensitivity results for the 1993 LLNL seismic hazard curve were also presented [9]. The use of 1989 LLNL seismic hazard for spectral shap and 1989 EPRI seismic hazard for CDF quantification Energy Research, Inc.
12 ERl/NRC 96-504
introduces an anomaly into the analysis. Morever, the spectral shape was anchored at 0.4g rather than the NUREG-1407 recommendation of 0.5g for Pilgrim.
2.1.5 Structural Responses and Component Demands New floor response spectra were developed for the SPRA based on three-dimensional soil structure interaction (SSI) analysis, instead of scaling from the design basis response spectra. The uniform hazard spectmm (UHS) was used to define the seismic input. Structural damping for all modes was set to 7 %,
as outlined in EPRI NP-6041, Rev.t.
The development of structural responses and component demands in the Pilgrim IPEEE appears to be consistent with the relevant guidelines presented in NUREG-1407.
2.1.6 Screening Criteria The Pilgrim SPRA adopted a screening approach based on seismic margin assessment methodology, but with a screening "g" level which raises questions about whether significant risk insights have been preserved. Screening criteria were based on the EPRI NP-6041 SMA column 2 criteria (5). The GIP guidelines were also used (4). To ensure that the screened-out components were not important to risk insights, these components were represented by means of a surrogate element. This approach provides a reasonable cross-check against the selection of an optimistic screening "g" level. More than one thousand components were screened out and replaced by the surrogate element. Although the surrogate element vas calculated to contribute less than five percent to seismic CDF and seismic large release frequency, this result was obtained only due to the presence of relatively low capacity components. The screening "g" level adopted for the surrogate component is equivalent to 0.3g PGA, which is less than the NRC staff recommendation of 0.5g PGA for the Pilgrim review level earthquake.
In summary, the screening criteria and procedures used in the Pilgrim IPEEE do not fully conform to the NUREG-1407 guidance due to the use of a low screening value. The surrogate element constitutes only a minor contributor to core damage frequeney, however this occurs only due to the presence of components and structures which have even lower capacities than the screening value.
2.1.7 Plant Walkdown Process Walkdowns were conducted by seismic review teams (SRTs). The SRTs consisted of two seismic I
capability engineers (SCEs) trained by EPRI in both the USI A46 walkdown requirements and the IPEEE add-on requirements. BECo, Stevenson & Associates, Jack R. Benjamin & Associates, and RPK Structural Mechanics supplied the SCEs. One BECo engineer participated on each SRT.
Safety-related piping and electrical raceways and ductwork were specifically walked down to assess fragilities. Checks were made curia, wmLdowns to confirm the type, location, and installation adequacy r
of essential relays. During the walkdowns, the SRTs took more than 500 pictures to aid the SPRA and USI A-46 evaluations, to assist in the evaluation of the as-found condition of the plant, and to aid in l
l fragility calculations.
The seismic IPEEE walkdavns for Pilgrim involved a significant effort by trained licensee personnel and experienced consultants. The walkdown process appears to be a strong point of this study, particularly Energy Research, Inc.
13 ERl/NRC 96-504 l
L
the abundam use of photography as a reference point for further evaluations, to permit ready identification of deviations from the as-analyzed plant, and to permit ready implementation of plant design changes into the seismic PRA. The walkdown process uas based on appropriate criteria and methods, and has addressed all major items of concern.
Overall, the walkdown process conducted for the Pilgrim seismie IPEEE is judged to be well-executed; capable ofidentifying outliers with respect to anchorage, interaction, construction adequacy, and function; and is judged to provide an appropriate basis for evaluating component fragilities, j
2.1.8 Fragility Analysis A point estimate assessment of hagilities (i.e., evaluation of mean fragility function) is an appropriate approach for IPEEE purposes. The purpose of the seismic fragility assessment is to obtain reasonably realistic estimates of the probability distribution of seismic capacity for the components modeled in the PRA.
The approach implemented for component fragility evaluation in the Pilgrim SPRA is considered to be well-structured and meaningful. The use of simplified screening techniques to identify those components and structures for which detailed fragility estimates are needed is an appropriate process and an efticient approach. However, in this instance the screening value of the surrogate element was chosen at a low value (0.3g PGA) compared with NRC staff guidance for Pilgrim (0.5g PGA). This did not have a significant quantitative impact on the seismic PRA results cah due to the presence of componen.s and structures with even lower capacities.
The SPRA screened out components based on the second screening column of EPRI NP-6041, and established a surrogate element to represent the combined effect of all such components. The SMA procedure characterizes seismic ruggedness in terms of HCLPF capacity. The SPRA established a relationship where median capacity (A ) is equal to 2.1 times the HCLPF value. Use of the tirst two of m
the three progressively more restrictive screening rules in EPRI NP-6041 resulted in screening first at a HCLPF spectral acceleration capacity of 0.8g or 1.2g. The EPRI NP-6041 screening rules require that component anchorage also meet or exceed the screening level. Components meeting the screening conditions possess a minimum seismic ruggedness equivalent to the designated screening level.
The majority of the components considered in the SPRA met the screening conditions. Piping; heating, ventilation and air conditioning (HVAC); and electrical raceways were all screened out. Masonry block walls, building structures (including the reactor containment), and reactor vessel internals were not screened out.
The fragility analyses drew upon original design documentation for all buildings and some components, IE Bulletin 80-11 (17] for block wall calculations, EPRI NP-6041 [5] for screening fragilities, EPRI NP-5228 [18] for anchorage issues, and EPRI NP-7147 (19] for electrical cabinet amplification characteristics and relay generic seismic ruggedness.
For some unscreened components, subsequent detailed fragility analyses may have resulted in median fragility values greater than the screening level. These items nonetheless remained in the tinal SPRA model.
Energy Research, Inc.
14 ERI/NRC 96-504
y..
The surrogate element in the SPRA was represented (per recommendations in a draft EPRI report [20])
6
- as having a median capacity of 1.0g and a combined uncertainty (pc) of 0.5. Based on the quantitication of the SPRA models using the EPRI mean seismic hazard entve, the surroga'e element contributed 2.8%
of the total seismic core damage frequency (the corresponding value using the 1993 LLNL hazard curw was 5%).
Detailed SPRA fragility values are ' identified in Tabk 3-11 of the 1PEEE submittal. The fragilbies of seismically significant relays are provided in Table 3-12. With the exception of AC Bus A8, however, nine of the ten lowest capacity components and structures have identical fragility uncertainty parameters of pa = 0.46 and pc = zero. These fragility assignments imply an identiel state of knowledge and uncertainty about diverse components, which is not credible < Further, this practice is inconsistent with the guidance in Section 3.1.1.3 of NUREG-1407 for seismic fragility estim tes, and no justification is given for this flagility uncertainty assessment.
2.1.9 Accident Frequency Estimates Quantification of seismic accident sequences was performed using the Science Applications International Corporation (SAIC) code CAFTA, and the Jack R. Benjamin & Associates SHIP code. First, the plant logic model was quantified using CAFTA to establish cutsets for the seismic hazard quantification. Input to the logic model induded component fragilities, random (non-seismic) failure rates, and operator error rates. The plant logic model was solved at three point values for seismic fragility (0.2g,0.4g, and 0.6g._ ~
PGA) to enable understanding of the significance of the seismic failure probabilities, relative to the non-seismic failures, in assembling the final cutsets. The results of this quantification were usd to determine which seismic failures required more detailed fragility analysis and to determine where there was a need for more detaikd human reliability analyses. After revisiens, this analysis was requantified as before to provide input for final importance ranking and quintification.
Second, the logic model was integrated with the mean seismic hazard curve to determine the frequency of core damage using tne SHIP code. A fragility curve for 'he plant was generated, and a plant HCLPF capacity was estimated. The contribution of iriividual ground motion levels to the frequency of core j
damage was also calculated. The submittal presents plant-level fragility curves, core damage sequence i
frequencies, and overall CDF (for both the 1989 EPRI and the 1993 LLNL hazard curves).
l
{
The approach for the licensee's assessment of accident sequence frequencies is clear, and should yield 1
accurate results. The codes tsed (CAFTA and SHIP) are standard codes for the purposes used. The j
submittal provides a clear identification of the dominant accident sequences and a table of accident j
sequence frequencies. The comparison between results generated with the EPRI and 1993 LLNL hazard curves is clearly presented.
j Overall, the approach used to obtain accident frequency estimates appears to be sound. The frequencies j
are believed to be reasonable, with the surrogate element representing a small core damage frequency i
contribution. However, this is a result of a few relatively low capacity components which appear in seismic sequences which dominate the CDF. Were this not the case for Pilgrim, the surrogate elene~
would have been much more important to the seismic CDF.
9 i
Energy Research, Inc.
15 ERI/NRC 96-504
1 2.1.10 Evaluation or Dominant Risk Contributors Dominant cvents and component failures that contribute to seismic risk were determined based on their contribution to core damage frequency. Dominant accident sequences were similarly identified.
The IPEEE submitta! has identified the following dominant risk contributors to seismic core damage
)
frequency: operator actions, seismi: faults that lead directly to core damage (single element cutsets, such as building structural failure, ATWS, and failures of electrical panels), and failures of critical equipment j
items (such as the CST). A detailed listing is provided in Table 3-15 of the submittal. The CDF j
contributors listed in Table 3-15 account for 88% of the seismic core damage frequency, with single element cutsets accounting for 41% of the total. The dominant-event list may be meaningful, however, due to submittal weaknesses having to do with the screening level assigned to the surrogate element and the modeling of fragility uncertainty, it is not possible to be certain that this is the case.
A simplified Level-2 analysis was performed with the goal of identifying seismically initiated sequences which could lead to containment failure or bypass within 0-2 hours after shutdown. The SPRA does not specitically list additional dominant failures which contribute to early contai'r. ment failure or bypass.
In the Level-2 analysis, the early release frequency (ERF) was estimated using the SHIP code. The ERF contribution of the surrogate element did not involve a mechanistic assessment of the failure modes i
modeled in the surrogate element. Rather, it was based on the assumption that the ratio of ERF to the CDF for the surrogate element would be in the same proportion as the rado of the ERF to the CDF for the non-surrogate sequences. The licensee stated that since the seismic capacity of containment structures and equipment not explicitly modeled are high (far in excess of 1.0g), it was judged that assuming the same ratio of ERF to CDF was conservative for the surrogate sequences. This modeling is considered acceptable and is, as the licensee judged, a conservative estimate. (It is noted that the ratio is incorrectly listed as 30.2 % on page 3-112 of the submittal as a result of a clerical error during report assembly; the correct vrJue of 27.3% is retlected in Figure 3-23 on page 3-119a. It is further noted that the seismic capacity of stmetures and equipment modeled as tne surrogate element may not all be high due to the low screening value ced, equivalent to approximately 0.3g PGA.)
Overall, the Pilgrim seismic IPEEE probably provides a meaningful description of seismie failures dominating core damage frequency. The dommant sequences have been clearly identified, and the Level-2 results probably provide meaningful insighta with respect to containment performance in seismically initiated events. Without resolution of the issues associated with surrogate element modeling and assignment of fragility uncertainty parameters, however, a firm conclusion in this regard is not possible.
2.1.11 Relay Charter Evaluation The SPRA review of relay chatter was conducted in parallel with the USI A-46 relay review. Five important assumptions formed the foundation for the relay chatter evaluation:
The relays of concern are those relays in SPRA systems whose function eculd be affected by relay malfunction.
The relays are assumed to chatter during the short period of the earthquake.
Energy Research. Inc.
16 ERl/NRC 96-504 i
Spurious operation is a concern only if the spurious operation prevents the SPRA s.
., from 3
functioning.
The chatter median fragility gives an indication of the g-level at which a relay will chatter.
The configuration of the plant reflects the status of the plant following implementation of USI A-46, including replacement oflow ruggedness relays judged essential under the USI A-46 program.
Relays in the following frontline and support systems were evaluated in the relay chatter review:
Fmntline Systems: HPCI, RCIC, suppression pool cooling, and primary containment isolation system (PCIS)
Sunoort Systems: reactor building closed cooling water (RBCCW), alternating current (AC) power (including the SBO diesel), direct current (DC) power, emergency core cooling system (ECCS) initiation, and room cooling After the potentially vulnerable relays were identified, fragilities were assigned. As a result of this process, it was found that a large number of relay chatter events could be screened out by the surrogate element. Given the surrogate element median frag 3ity of 1.0g, all relays with e median fragility greater than 2.0g were not modeled because their failure is enveloped by the magnitude and consequences of the surrogate element. The relays remaining in the analysis after this screening process are listed on pages 3-45 and 3-46 of the IPEEE submittal.
The analysis relied on EPRI NP-7147 (19] for information on relay generic seismic ruggedness. The walkdowns performed for the SPRA included evaluation of essential relays based on circuit analyses and seismic screening rules. In accordance with the GIP, cheeks were made during walkdowns to confirm the type (model number and manufacturer), location, and installation adequacy of relays. Completion of USI A-46 resolution at Pilgrim was assumed for the SPRA. Recovery from relay chatter by operator action was explicitly modeled in the SPRA.
Overall, the licensee's evaluation of relay chatter for Pilgrim appears reasonable and consistent with NUREG-1407 guidelines.
2.1.12 Soil Failure Analysis
.A formal soil structure interaction (SSI) analysis was performed. The SSI analysis was performed in accordance with the NRC Standard Review Plan (SRP), Section 3.7.2, except that:
For the IPEEE input time history generation from the response spectrum, the time history does not envelope the prescribed response as required in the SRP. Instead, the time history matches
)
the response spectra on average.
The variation of soil shear modulus is based on the recommendations provided by Prof. Whitman of MIT for the IPEEE project, instead of the SRP requirement.
Energy Research, Inc.
17 ERI/NRC 96-504
e The spectral amplitude of the horizontal acceleration response spectra in the free field at the foundation depth is not limited by the required 60% of the corresponding design response spectra at the finished grade in the free field.
In cases where the SRP does not specify guidelines, the SSI analysis relied on ASCE Standard 4-86 [21].
The licensee contracted with GEI Consultants, Inc., to perform the investigation and evaluation of soil failures at Pilgrim. The Pilgrim sia consists of 30 to 50 feet of compacted fill materials above about 30 to 50 feet of glacial outwash deposits which are underlain by bedrock. The fill is heavily compacted and the outwash deposits are very dense as a result ofloading due to glaciation.
The soils at Pilgrim were found be stronger in their undrained state than in the drained state. Thus, liquefaction stability failures were assessed as being implausible regardless of magnitude and peak ground acceleration of the earthquake. A conservatively estimated factor of safety against soil failure of 1.9 was calculated for the drained shear strength. The SPRA considered the impact of settlements on the fragility analysis of components. The effect of rocking was found to be small due to the high stiffness of the soils at the site. The condensate storage tanks (CSTs) were found to be the most likely structures to be affected by rocking due to their high center of gravity and small depth of embedment, and were assessed as having a relatively low capacity due to structural interaction concerns.
The treatment of soil failures in the Pilgrim SPRA is judged to satisfy the NUREG-1407 guidelines.
2.1.13 Containment Performance Analysis A simplified containment perfonnance model was developed for the SPRA to identify sequences that result in early containment failure (i.e.,0-2 hours after plant shutdown) with significant release potential (i.e.,
an iodine release fraction of 10% or greater). This approach was based on NSAC 159 [22].
The simplified containment event tree (CET) is shown in Figure 3-23 of the IPEEE submittal. Prior to processing through the CET, core damage sequences were sorted into plant damage bins as shown in Table 3-17 of the submittal. Loss of containment heat removal sequences were excluded from containment release in the CET because the release occurs at a time greater than 0-2 hours after shutdown. These sequences comprise one-third of the core damage frequency.
t l
The total mean frequency of early release was determined as 1.59 x 10/ry, or about 27.3 % of the seismic CDF. The dominant contribut= m aly release frequency were identified by the submittal as:
Drywell liner melt-through,41.41 I
Containment structural failure before core damage, 32.6%
+
Containment isolation failure when drywell liner melt-through or structural failure do not occur,
+
18.5 1 Surrogate component,4.8%
Containment isolation failure when no structural failure occurs, 2.91
+
Energy Research Inc.
18 ERI/NRC 96-504
- e The licensee's approach to seismic containment performance analysis appears to be consistent with NUREG-1407 guidelines.
2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations The Pilgrim IPEEE treated seismic-fire interactions by addressing three issues: (1) seismically induced fires, (2) seismic actuation of fire suppression systems, and (3) seismically induced failure of tire suppression systems. The evaluation of seismic-tire interactions also included a plant walkdown, which consisted of a visual examination of fire hazards, consideration of the effects ofinadvertent suppression system interaction, and evaluation of fire suppression equipment and the effects of suppression in the event of an earthquake concurrent with loss of the suppression system integrity. The guidance within 0.5 of the FIVE methodology was used during the walkdown.
The licensee's analysts and walkdown team members concluded that there are two potential hazard areas with respect to seismic-fire interactions. These locations are switchgear room "B" and the turbine building truck lock area. The truck lock contains hydrogen and lube oil piping runs, and a hydrogen control station. Switchgear room "B" also contains lengths of piping which contain lube oil. The licensee concluded La consideration should be given to isolation of these combustible sources after an earthquake.
Regarding inadvertent suppression system actuation, the submittal reports that there are no automatic carbon dioxide suppression systems la the plant. Actuation of a Halon system in the computer and cable spreading rooms was assessed as having no immediate effects on the equipment, but possibly requiring a post discharge cleanup to remove residue from components. Actuation of water based systems would wet down cabling, but this was judged to have no effect in the short term. Spray shields protect equipment from water exposure from above at reactor building elevations 23'0" and 51'0", and these areas have berms and ramps to contain water from the water curtain to prevent.iooding of important equipment.
Finally, it was verified during the walkdown that the fire suppression system conformed to nationally recognized codes (such as the National Fire Protection Association). Based on this veritication, the licensee concluded that the support of the fire suppression systems was adequate.
Additional evaluation and review findings pertaining to seismic-fire interactions are addressed in Section 2.2.12 of this TER.
2.1.15 Treatment of USI A-45 Unresolved safety issue (USI) A-45 is concerned with the evaluation of vulnerabilities in decay heat removal systems. Since the systems and components for addressing USI A-45 have already been identified in the internal events IPE, the purpose of the seismic IPEEE is to identify any significant and unique seismic vulnerabilities in the decay heat removal function.
The assumption of unrecoverable loss of offsite power for seismically initiated sequences, as well as the nature of the walkdown findiam hunvail-VPty of the nitrogen system and ADS), dictated the systems available for decay heat removal in seismic scenarios. Systems available for decay heat removal (DHR) after seismic events are limited compared to internal events scenarios identified in the IPE (i.e.. only suppression pool cooling is available for decay heat removal). The licensee states that this is acceptable because the overall seismic core damage frequency and release frequency are acceptable. Moreover, the Energy Research, Inc.
19 ERI/NRC 96-504 L.
i
=.
licensee states that if decay heat removal fails after a seismic event, a significant amount of time is available to effect repair and recovery (34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br /> before design is exceeded, and 47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br /> before reaching the containment ultimate capacity). Since this time frame is beyond the 0-2 hour early containment failure j
period considered in the IPEEE, USI A-45 was considered to be resolved.
i i
The licensee considers USI A-45 to be resolved based on the lack of any new or unusual means by which core damage or containment failure occurs as compared to those in other PRAs, and based on the licensee's conclusion that the CDF results do not suggest that Pilgrim would not be able to meet NRC's safety goal for core damage frequency.
The unavailability of offsite power (assumed for all seismic events) and instrument nitrogen severely restricts the number of systems available to remove decay heat from the containment. The licensee relies on sufficient time being available for repair and recovery of the decay heat removal function before containment failure.
Loss of DHR' scenarios are responsible for about one-third of the seismic core damage frequency.
Moreover, although a substantial period of time may be available for repair and recovery, the licensee has not mechanistically related this conclusion to the failure modes which give rise to DHR failure. Thus, the reader / reviewer of the IPEEE is uninformed as to whether the long period for repair and recovery is physically meaningful in light of the actual DHR failure modes. This issue could not be resolved, in the present review, based on information contained in the IPEEE submittal report and the licensee's response to RAIs.
2.1.16 Other Safety Issues The IPFEE includes discussions pertauung to US! A-17, USI A-40, USl A-46, the Charleston earthquake issue (Eastern U.S. Seismicity), the seismically induced flooding issue, and the matter of seismically correlated failures.
a.
Eastern U.S. Seismicity issue
~
As a result cf probabilistic seismic hazard analyses performed for eastern U.S. plant sites, five plants were identified as outlier sites (Pilgrim among them). NUREG-1407 states that the IPEEE will provide a resolution for the outlier plants with no need for additional analyses or documentation from licensees.
Since the Pilgrim SPRA is based on the EPRI and 1993 LLNL hazard curves, which provide quantitative evaluation of the impact of the Charleston earthquake issue on seismic hazard, the licensee considered this issue to be resolved for Pilgrim.
The licensee relies on the NRC statement on page D-13 of NUREG-1407, that the Charleston Earthquake Issue has been resolved, to close out this issue for Pilgrim. However, it must be noted that resolution of this issue presumes that the study actually performed conforms to the appropriate NUd J.07 WAme.
In the case of Pilgrim, component and structural screening was performed at approximately 03.g PGA, as contrasted with the NRC staff recommendation of 0.5g PGA as identified in NUREG-1407. Thus, the licensee's basis for resolution. of this issue is in doubt.
Energy Research, Inc.
20 ERI/NRC 96-504
b.
USIA-17 The seismic walkdowns conducted for Pilgrim considered systems interactions. The licensee considers
. USI A-17 to be resolved for Pilgrim.
c.
USl A-40 The one remainmg element of USI A40 concerns the evaluation of tanks. The IPEEE seismic evaluation did not explicitly evaluate large tanks, but the USI A46 assessments did evaluate the tanks for the concerns raised in USI A40. The results of this evaluation are to be included in the licensee's response to USI A46.
d.
USI A-46 The SPRA project team performed the SPRA jointly with the USI A46 evaluations. The selection of SPRA systems and components sought to retain conunonality with the USI A46 equipment list to the extent practical. Seismic walkdown teams gathered data for both evaluations simultaneously. The USI A46 issue remains open pending the licensee's USI A46 submittal.
e.
Generic SafetyIssues Some seismic-related information having relevance to Generic Safety Issue (GSI)-156 and GSI-172 is provided in the submittal, as discussed in Sections 2.4.3 and 2.4.4 of this TER.
'f Seismically Induced Flooding The submittal also addressed seismically induced tlooding. The submittal states that the reactor building closed cooling water (RBCCW) system piping, which could cause tlooding, is designed as Class-1 piping to resist pipe breaks. Thit piping screened out and was represented by the surrogate element. Fire protection system pipe breaks were analyzed for their impact on safety equipment. The only area of potential concern identified was the switchgear rooms, which were subsequently eliminated as a concern since water-based fire protection systems do not protect these rooms and, although large-bore fire l
protection system piping passes through these rooms, wire mesh panels and doors prevent any water accumulation in these areas, i
t l
The submittal states that flooding due to feedwater pipe breaks would have no effect on the SPRA, since l
the feedwater system itself is already considered to be unavailable (due to the assumed loss of offsite i
power), and the control rod drive (CRD) system, which would be rendered inoperable due to submergence of its pumps, is also not credited in the SPRA.
Effects of seismically induced rupture of large capacity storage tanks were investigated. Tanks possibly affected are the CSTs, the fire water storage tanks, and the demineralized water storage tank. These tanks are all ground mounted, anchored, vertical storage tanks. The tanks were walked down by the SPRA lead analyst and an SRT engineer. These tanks are located outside process buildings on the north side of the site, between the reactor building and the ocean. They are located on open, tlat ground close to the ocean.
Natural drainage to the ocean from the fire water storage tanks and the demineralized water storage tanks eliminates these tanks as potential flooding concerns. The CSTs were found to have an interaction between Energy Research, Inc.
21 ERl/NRC 96-504
c, CST 105B and the cryogenic nitrogen storage tank T212. The interaction between these tanks was modeled as leading to the loss of the CSTs as a water source for HPCI and RCIC.
g.
Seismically Correlated Failures Seismically correlated failure events were developed to account for the failure oflike equipment that is located on the same elevation of the plant buildings. Like equipment is defined as the same manufacturer, same model, and same anchorage capacity. Such impacts are similar to common cause failures in the IPE models. Seismically correlated failure events are listed in Table 3-6 of the IPEEE submittal.
h.
Review Findings The seismic IPEEE has discussed USI A-17 USI A-40, and USI A46. These issues will be evaluated in the context of the licensee's USI A46 submittal. This TER does not include an evaluation of the licensee's treatment of these issues. Regarding USI A-17, it should be noted that the seismic walkdowns have considered systems interaction issues, and modeling was performed to account for seismically correlated failures. Due to discrepancies between the IPEEE methodology and NUREG-1407 guidance, the Charleston Earthquake Issue is not considered to be resolved.
2.1.17 Process to Identify, Eliminate, or Reduce Vulnerabilities The licensee stated that no significant vulnerabiliths were identified which would result in significant risk when compared to the NRC's proposed safety goals. No definition of vulnerability, nor systematic process to identify vulnerabilities, was documented in the submittal report (although in response to RAls, the licensee cited the IPE criteria of whether any new or unusual means were found to lead to core damage or containment failure, as compared to other PRAs, and whether the NRC's safety goal for core damage will be met).
The licensee has identified a number of safety enhancements, as previously described. No indication of the improvement in safety resulting from these enhancements is provided, hoivever, since the SPRA analysis assumes completion of the enhancements, and no " pre-tix" results are provided for comparison.
Overall, it may be stated that the SPRA is capable of finding seismic-related severe accident vulnerabilities, provided that the surrogate element is not a dommant contributor. That this occurred for Pilgrim was only due to the presence oflow-capacity components that relegated the surrogate element to a minor contributor to seismic CDF and seismic large release frequency. Absent thesa components, the surrogate element would have been much more important.
2.1.18 Peer Review Process The Pilgrim seismic IPEEE employed four levels of peer review. The first was a review of the assumptions used and the results of the study to ensure that they are consistent and correct. This review included verification by the BECo staff of most calet la% +4& ct 5 calculations either prepared or verified by consultants. (In the strictest sense, this is not a " peer review," but simply internal project quality assurance.)
Energy Research, Inc.
22 ERI/NRC 96-504
The second level of review cited in the IPEEE was an internal review conducted by independent engineers.
This review was performed to ensure the accuracy'of the documentation in the IPEEE report and to validate the process and results. The internal review team was composed of senior reactor operators
' (SROs); issue specialists; and operations, training, engineering and senior technical management.
' The thifd level of review was by an external peer review team composed of industry experts who reviewed
' the IPEEE for completeness and correctness of the methods used. The team also contrasted the Pilgrim
.IPEEE results against other studies with which they were familiar, in order to assure consistency.
Finally, utility peer reviewers, who had conducted IPEEEs on plants similar to Pilgrim, provided top-level reviews of the IPEEE submittal. in order to survey the IPEEE for ' big-picture" issues and selected topics.
The submittal states that all aspects of the SPRA were reviewed and all reviewer comments were resolved.
The peer review process appears to be meaningful and consistent with NUREG-1407 guidelines. The fact that the peer review failed to identify the weaknesses of the seismic IPEEE, however, raises questions about the scope and depth of the peer review performed.
I 2.2 Bre i
I
- A summary of the licensee's tire IPEEE process has been described in Section 1.2. Here, the licensee's fire evaluation is described in detail, and discussion is provided regarding significant observations encountered in the present review.
2.2.1 Overview and Relevance of the Fire IPEEE Process
. a.
Methodology Selectedfor the Fire IPEEE The Pilgrim fire analysis combines methods of fire PRA and the FIVE methodology (11). The methodology utilized by the licensee consisted of the following four phases:
Phase 1 - Qualitative Screening In this phase, plant areas with no important components, or where fire will not induce a plant trip, were screened out. Steps involved in this screening phase included:
1.1 Defnition of the Fire Areas to be Analy:ed - The Appendix R fire areas and zones were used as a basis for the study. These areas and zones were reviewed in order to assess the potential for cross-area / zone propagation. Some areas were combined in this analysis in order to streamline the screening process.
)
1.2 Idennfcarion of the Safety Systems / Components in Each Area - This step was performed by developing a spatial database of equipment and cable routing; for the defined fire areas.
A record was created for each component identified in the IPE process. This re.cid included the component locatios motive and comrol power supplies to the component and their location, and power and control cable locations. The Appendix R analysis was the principal source for defining equipment locations and cable routings. Information for equipment not addressed in the Appendix R report was obtained from plant arrangement drawings, walkdowns, and the cable raceway schedule.
Energy Research, Inc.
23 ERIlNRC 96-504
1.3 Idennfcanon ofthe Possible Initiating Events Induced by a Fire in Each Area - For each area, possible fire-induced plant events were analyzed involving manual and automatie 3
trips, inadvertent actuation of protective signals or inadvertent opening et valves, and LOCAs.
1.4 Screening - Each area which does not contain equipment or cables which could cause an initining event, or does not contain equipment or cables needed to mitigate the effects of an initiating event, was screened out from further analysis.
Phase 2 - Ouantitative Screening: In this phase, areas were screened out based on the fire ignition frequencies for the area, and on availability of mitigating safety systems outside of the area. Steps involved in this screening phase included:
2.1 Quantifcanon of Fire ignition Frequencies for Each Area - The fire ignition frequencies were developed based on the latest industry fire frequency data from the EPRI fire events database [23). This data was applied to plant-specific areas based on actual components and combustible loads in the area.
2.2 Identipcation of Mitigating Safety Systems Outside of the Area - For each area-based initiating event identitied from Step 1.3, mitigating systems were identified from IPE models. A mitigating system was considered to be outside the area it no component or cable which can jeopardize system coeration could be found in that area.
I 2.3 Screening - Plant response to a fire in each area was evaluated based on the IPE models and identified safety systems outside the area. (It was assumed that a tire in the area disables all equipment in the area.) If the fire-induced CDF was found to be less than 104/ry, the area was screened out from further analysis.
Note: The above steps were performed only for the areas which were not screened out in Phase 1.
Phase 3 - Fire Damage Evaluation Screening: In this phase, areas were screened out, or evaluated in detail, based on tire growth and propagation analysis, and/or fire damage evaluation. Steps involved in this screening phase included:
3.1 Evaluation offire Ha.ard Parameters - A fire hazard database was developed to provide the information necessary to support fire damage evaluation. For each area, this database i
contt ns information on tire detection, fire suppression, fire barriers, and types and amounts of combustibles.
l 3.2 Evaluation ofFire Growth and Propagation - For each area, target sets of interest were identitied. Fire growth and propagation analysis was performed based on the FIVE worksheets and heat transfer equations. For each target set, it was determined whether j
or not there is enough combustible material present in the area to cause damage, and if so, j
then the time it will take to cause damage and the time it will take to actuate detection or suppression were assessed. Each specific target set for which there are not enough combustibles present to cause damage to the target was screened out from further analysis.
j l
Energy Research Inc.
24 EPJ/NRC 96-504
E 3.3 Evaluation of Fire Suppression - Evaluation of automatic and manual suppression was performed for plant-specific systems and manual brigade response times.
3.4 Idenn)icanon ofFire Scenarios Within Each Area - Analyzed fires, or target sets, in each area were combined in the fire scenario, based on the induced initiating events and the plant response.
3.5 Quann)fcation ofFire Damage Probability - For each identified target set or tire scenario, the probability of damage due to tne fire was determined, based on the simplified FIVE equations. Each target set or fire scenario with a low probability of fire damage (less than 104/yr) was screened out from further analysis.
3.6 Detailed Evaluation - The frequeacies of fire scenarios were quantified as the sum of corresponding target set frequencies, which were based on the ignition frequency of the fire sources and the damage probabdity for the targets.
Note: The above steps were performed only for the areas which were not screened out in Phase 1 or Phase 2.
Ehase 4 - Fire Scenario Evaluation and Guantification: IPE models were applied to quantify the tire-induced core damage frequency for each fire scenario in the remaining unscreened areas.
The present review finds the overall fire analysis methodology employed by the licensee to constitute an acceptable alternate approach to a fire PRA.
b.
Key Assumptions Used in Performing the Fire IPEEE No list of assumptions is specifically provided in Reference [1]. However. some of the key assumptions, which are noted in the text of Reference [1], include:
1.
No credit was 'aken for the human detection of fires.
2.
Automatic fire suppression systems have been correctly designed and installed, based on good fire protection engineering pnneiples.
3.
No credit was taken for non-fire-brigade manual suppression, except in the case of control room fires.
4 The only seismically induced fire sources considered were releases of flammable or combustible liquids or gases.
5.
Inadvertent operation of Halon systems would not result in any equiprnent operability concerns.
6.
Fire protection systems have been installed in accordance with National Fire Protection Agency (NFPA) codes and standards. Therefore, adequate assurance is provided that fire protection systems will not fall onto safe shutdown components during a seismic event.
Energy Research, Inc.
25 ERI/NRC 96-504
7 Currently, the state-of-the-an in fire protection engineering does not permit an adequate j
assessment relative to non-thermal effects of combustion products.
This review finds that the licensee has identified essentially all of the key fire IPEEE assumptions, as requested in NUREG-1407 Section C.3.
c.
Stams ofAppendix R Modifcations The status of Appendix R modifications is not provided in the IPEEE submittal.
d.
New or Existing PRA The fire analysis is a new PRA which employs portions of the FIVE methodology.
2.2.2. Review of Plant Information and Walkdown a.
Walkdoun Team Composition The fire IPEEE plant walkdowns were conducted by a team of fire protection and PRA engineers.
b.
Signipcant Walkdoun Findings The following summarizes the findings identified by the plant walkdowns which were used in the fire analysis:
1.
Main Control Board - Closed doors are located at each end, and in the back, of the panel. The main panel sections are separated by heavy steel barriers which extend almost to the walkway
]
traveling down the middle of the control board. The majority of cables are contained in metal wireways, until they reach the indicators or control switches.
2.
Cable Screadine Room - The cable spreading room contains a number of electrical cabinets, in addition to the cable raceways supporting cabling leading to/from the control room (which is located directly above the cabling spreading room). Also, a number of train "A" power cables pass through a fire rated enclosure which is located on the north wall of the cable spreading room.
3.
Switchgear Room A This room, in addition to containing a number of AC and DC electrical cabiners, also has a vettical run of fire protection piping.
i 4.
Switchgear Room B - This room, in addition to containmg a number of AC and DC electrical cabinets, also has several tuns of piping consisting of water for fire protection, turbine building closed cooling water (TBCCW), and lube ot' sappisctuiti intes to the turbine generator.
5.
Reactor Building Ouad Rooms - The four Quad rooms (i.e., "A" RHR and core spray, CRD, "B" RHR and core spray, and RCIC) were examined with respect to their spatial and fire propagation relationship with elevation 23'-0" of the reactor building. Attributes investigated included the spatial arrangement of the Quad rooms, types of in-situ and transient combustibles, and l
Energy Research, Inc.
26 ERI/NRC 96-504
a.
I q
continement of combustibles (e.g., dikes, benns, floor slope, drains. etc.). It was determined that a fire in any Quad room would not propagate and damage equipment located on elevation 23'-0" a
i 6.
Reactor Buildint Various Elevations - The natural dow paths for the upper elevations of the l
reactor building were investigated. This investigation revealed that tires located on elevations 23'-
i 0", 51'-0", 74'-3" or 91'-3" would not impact elevations above or below, since the products of combustion (smoke and heat) would be transported up to elevation 117'-0" through vent paths located in the nonhwest corner (equipment hatch opening). northeast corner (personnel stairway),
and the southwest corner (personnel stairway).
7.
Reactor Auxiliary Building - The cable routing database and plant conduit drawings identified cables for TBCCW valves MO-4126 and 4127 traveling through the condensate transfer pump room, reactor building closed cooling water (RBCCW) 'A' and 'B' pump rooms, and then into the t
reactor building. In the RBCCW 'A' pump room, the drawing identifies this conduit traveling directly above the RBCCW pumps. Plant walkdowns located this conduit in the condensate transfer pump room and the reactor building. However, walkdowns were unsuccessful in locating this conduit in either RBCCW pump room. This conduit travels through an enclosed pipe chase that parallels the RBCCW 'A' pump room, and then travels along the east wall of the RBCCW pump rooms prior to entering the reactor building.
8.
Reactor Building Elevation 23'-0" - An earlier walkdown revealed that floor plugs at reactor building elevation 23'-0", which form the area's tire barrier, had been removed. Discussions with plant personnel revealed that these plugs are removed prior to an outage, in order to support pre-staging of outage related activities. Therefore, during this time, sub-areas l A, IG, and 1N would have a fire propagation path between each other. Due to the relatively short period of time in this configuration, as compared to the normal configuration (plugs inserted), the risk of tire propagation between zones was considered to be negligible.
c.
Significant Plant Features The significant plant features have been noted above.
2.2.3 Fire-Induced Initiating Events Were initiating Events Other than Reactor Trip Considered?
a.
The fire initiating event sequences which were modeled in the IPEEE include:
Reactor trip Loss of offsite power Main steam line isolation Loss of feedwater, condensate, or condenser vacuum Loss of AC power The fire methodology specifically considered LOCAs and inadvertent opening of valves (refer to TER Section 2.2.2, Step 1.3).
Energy Research, Inc.
27 ERl/NRC 96-504
to.,
l
- These initiating events are typical of those considered in past fire PRAs.
' b.
Were the Initiating Events Analyzed Properly?
Generally, a fire scenario would result in one of the above event sequences, depending upon the location of the fire and the equipment affected. However, depending on random equipment failures, the scenario may propagate into a consequential LOCA.
j i
For each scenario described in the submittal, a listing of equipment damaged was provided. Therefore, the initiating events which result from fire damage could be verified. In the present review, a verification was performed for a few fire scenarios. For these fire scenarios, it was found that the initiating events were analyzed properly.
2.2.4-Screening of Fire Zones a.
Was a Proper Screening Methodology Employed?
The licensee's screening methodology has been described in detail in Section 2.2.2 of this TER. Proper screening criteria were applied by the licensee to screen all tire areas.
b; Have the Cable Spreading Room and the Control Room Been Screenid Out?
Neither the cable spreading room nor the control room were screened out.
c.
Were There Any Fire Zones / Areas that Have Been Improperly Screened Out?
There are no tire areas which were found to be improperly screened out. However, without either plant layout drawings or the benefit of a plant walkdown, this review could not determine whether or not adequate consideration was given to cross-zone fire and smoke spread, or to tire ruppression activities which could result in safety-related equipment damage in adjacent plant areas.
2.2.5 Fire Hazard Analysis 1
The development of Pilgrim fire ignition frequencies was based upon nuclear industry data assembled in the EPRI fire events database [23), considering the area loads with fire sources and combustibles (i.e.,
based on the method recommended in the EPRI fire events database).
Plant-specific fire event data has been utilized to develop industry-wide generic fire frequencies. A search of the Sandia fire events database [24] revealed that four fires have occurred in safety-related plant areas at Pilgrim (i.e., turbine building - 5/5/80, reactor building - 2/24/81, auxiliary building - 4/8/83, and control room - 9/13/83). Information supplied by the licensee indicated that plant-specific fire data was properly considered.
l Energy Research, Inc.
28 ERI/NRC 96-504
T
\\
4..
2.2.6 Fire Growth and Propagation Treatment of Cross-Zone Fire Spread and Associated hiajor Assumptions l
a.
The Pilgrim IPEEE does not provide any information regarding the treatment of cross-zone tire sprea and consequently, any associated major assumptions. However, consideration of cross-zone tire and j
smoke spread is specifically called out (refer to TER Section 2.2.1, Step 1.1). Of particular note, the potential for active fire barrier element failures was not considered, and the tire compartment interactions analysis did not consider the fire brigade accessing the fire area through adjacent fire zones that contain cable and equipment from a redundant safety train.
b.
Assumptions Associated uith Detection and Suppression The licensee's assumptions associated with detection and suppression of fires include the following:
No credit was taken for human detection of fires.
a 1
l The automatic fire suppression systems were designed correctly and installed based on good tire protection engineering principles. (This assumption was verified by plant walkdown.)
l
{
No credit was taken for non-fire-brigade manual suppression, except in the case of control room a
fires.
Treatment ofSuppression-induced Damage to Equipment. if Available c.
The licensee looked at what impact iradvertent actuation of fire suppression systems would have on plant equipment. For the most part, the licensee concluded that actuation of water-based systems would wet down cabling. It was assumed that, for the short duration of wetting, cables will be unaffected. In other cases, the plant design basis has already accounted for a suppression actuation and potential damage to plant equipment. For example, in the reactor building, at elevations 23'-0" and 51'-0", there are berms and ramps to contain wate tom the water curtain, thus preventing the flooding of important equipment.
These areas also have spray shields to protect equipment from water exposure from above.
There are no automatic CO: suppression systems at Pilgrim. A Halon system protects the computer and cable spreading rooms. Actuation of these systems would have no immediate effect on equipment. A post-discharge clean-up may be required in the long term, in order to remove potential residue from components. Based on a walkdown, it was concluded by the licensee that inadvertent tire suppression system actuation effects have been considered.
d.
Computer Codes Used, if Applicable The FIVE methodology was used as a basic screening methodology in evaluating tire growth and propagation. His methodology provided the means to make estimates about co*nn tY q Y develop at a target as a result of a specified fire. These conditions were then compared with target damage threshold criteria (temperature or heat flux); and, if the criteria were not exceeded, the specified fire could be screened out from fuAer analysis. Otherwise, more analysis was required. This methodology employed look-up tables, rather than utilizing a tire propagation computer code.
Energy Research, Inc.
29 ERI/NRC 96-504
2.2.7 Evaluation of Component Fragilities and Failure Modes a.
Depnition ofFire-Induced Failures Fire-induced failures were defined as loss of function of equipment associated with damaged cables, damaged motor control centers (MCCs), or damaged equipment itself.
b.
Method Used to Determine Component Capacities For every identified target set, the geometric relationship between potential targets and fire sources was determined. Three general fire-type scenarios were considered:
1.
Targets located in the plume, directly above a fire source 2.
Targets located in the hot gas layer (outside the plume, but possibly in the ceiling jet) 3.
Targets exposed to heating by thermal radiation, located next to a fire source This analysis used basic FIVE methodology damage-threshold criteria. The key criteria are repeated below:
A temperature of 125'F was used as the failure temperature criterion for non-IEEE-383 qualified cables. This estimate of the ignition temperature of non-IEEE-383 qualified cables was selected because the ignition temperature of the cable will be reached before cable function is lost.
I Other equipment (switchgear cabinets, pumps. motors) have a higher tolerance to increased temperature environments. The FIVE methodology imposes a critical heat tlux of 0.44 Bru/seelft' for equipment potentially subjected to radiant heat.
c.
Generic Fragilities Generic fragilities have been utilized for cabling in the fire-related damage evaluation.
d.
Piant-Specifc Fragilities Plant specific fragilities have not been utilized for cabling in the fire-related damage evalunion.
e.
Technique Used to Treat Operator Recovery Actions Reference [1] does not discuss in detail the technique used to treat operator recovery actions. Nonetheless, the only human reliability analysis (HRA) method identified in Section 4.10.1 of the fire IPEEE submittal is Swain and Guttmann's handbook [16). For fire-initiated sequences, there are performance shaping factor (PSF) issues which are unique to fire situations, and these would not have to be assessed in the IPE internal events HRA. These PSF issues relate primarily to environmental stress factors (e.g., the impact of smoke and suppression agents, reduced visibility, and impaired communications due to the use of breathing apparatus), as well as psychological stress factors (i.e., the occurrence of an unexpected event such as tire of sufficient severity to cause equiprent failures).
Energy Research, Inc.
30 ERI/NRC %504
c.
The fire HRA considers human error probabilities (HEPs) for four steps needed to evacuate the control room and take control of the plant locally: (a) recognition of the tire and the need to evacuate the control room; (b) correct execution of evacuation procedure: (c) correct swapping of controls to the alternate shutdown panels (ASPS); and (d) selection of the proper controls for system operation at the ASPS. Failure of any of these four steps was modeled as causing failure of shutdown from outside the control room (refer to Figure 4-5 in the IPEEE for the relevant event tree).
To model the first step, the IPEEE considered a worst case fire" being detected in two minutes after ignition. The analysis estimates a failure probability of 10" for this step, referring to Table 20-16. Item 2 of Reference [16]. Table 20-16 provides modifications to estimated HEPs only for the effects of stress and experience levels. The fire IPEEE incorrectly refers to a PSF of( x2), whereas Table 20-16, Item 2 refers to a PSF of(x 1), regardless of skill level. However, Item 2 refers to conditions of " optimum stress" and following a " step-by-step" procedure. The text of the submittal's discussion of this event refers to "high" stress. It is assumed that this refers to " moderately high" stress (" heavy task load") in the language of Reference [16]. Use of the " step-by-step" task description also appears to be in error.
Reference [16] provides the following explanation of the difference between " step-by-step" and " dynamic" tasks:
Step-by-step tasks are routine, procedurally guided tasks, such as carrying out written calibration procedures.
Dynamic tasks require a higher degree of man-machine interaction, such as decision-making, keeping track of several functions, controlling several functions, or any combination of these. These requirements are the basis of the distinction between step-by-step tasks and dynamic tasks, which are often involved in responding to an abnormal event.
Considering the relative rarity of control room fires of any severity (9.6x 10'2/yr in the IPEEE, or one -
every 104 years), the fact that the control room fire in this instance is of sufficient severity to require control room abandonment (which has not yet occurred in more than a thousand reactor-years of commercial light water reactor operating experience), and the fact that shutdown from outside the control room is not a routine task, the choice of step-by-step modeling in this case appears to be inappropriate.
Funher, there are other PSFs which should have been considered (as discussed above). It would have been more appropriate to model this step as involving a dynamic task carried out under moderately high stress.
This treatment would have resulted in use of a PSF of(x5), which accounts for correctly modeling the situation, as well as allowing for other PSFs not explicitly treated (but clearly present, as discussed previously).
A basic HEP of 10" was used in the fire IPEEE for failure to respond, citing page 11-45 of Reference
[16). The HEP of 10" is applicable only to a situation where one (and only one) alarm comes in, and only for a single operator, as identified in Table 11-13 of Reference [16]. If multiple alarms come in closely in time (within several seconds, or within a time period such that the operator perceives them as a group of signals), the HEP rises rather rapidly. For example, for two alarms, the basic (median) HEP is 6.0 x 10" For three alarms, the median HEP is 10'3 The " worst case fire" identified by the IPEEE results in failure of AC power (see page 4-121 of Reference [1]). Loss of AC power will result in a very large number of alarms (likely dozens to hundreds). Thus, the IPEEE's implicit assumption of a single alarm is incorrect. For a single operator with more than 40 alarms, the basic HEP is 0.25 (Table 11-13 of Reference [16]). This value accounts for the stress explicitly, and it is not necessary to use the (x5) PSF discussed above.
Energy Research, Inc.
31 ERI/NRC 96-504
Again, these values are for one operator, In reality, there would be at least three licensed operators (two i
reactor operators [ROs] and one senior reactor operator [SRO]) on duty in the control room. For abnormal conditions, a high level of dependence is assumed (page 11-48 and Table 20-4 of Reference [16]). Table 7-3 of Reference [16] provides nominal models for various levels of dependence. The basic HEP is 0.25 due to the large number of alarms which are expected for the worst case situatien leading to loss of AC power. HEPs for the second and third operators, assuming high depende ae, are 0.5 and 0.55, respectively. Thus, the total HEP is the product of these values, i.e., (0.25)(0.5)(0.55), or 0.069. Even using lower uncenamty bounds for the dependence calculation results in a value of (0.25)(0.25)(0.28), or 0.018. The HEP for the first step is considered best represented by the nominal value of 0.069.
The second step required to be performed is correct execution of the evacuation procedure. The IPEEE analysis considers a high stress, dynamic action for this step. The shon procedure value applies here (according to the IPEEE submittal) and the IPEEE identifies a nominal HEP of 10, but lowers this value by a factor of 3 due to the successful performance of a shutdown outside the control room. This issue is repeated for each of the next two steps, and thus deserves some discussion here.
The single correct performance of a procedure during a simulated emergency does not provide a meaningful basis for an across-the-board lowering of basic HEPs. The operators are considered to be skilled, and the correct performance of procedures during simulated emergencies is expected to represent the norm rather than the exception. If the procedure were performed correctly for a large number of trials, then there might be a basis for assessing an across-the-board reduction in basic HEPs, on the grounds that superior performance is indicated. A single correct performance is not to be regarded as statistically significant or even particularly remarkable. Thus, the lowering of the basic HEPs by a factor of three, as was done in the fire IPEEE, is considered to be unwarranted. Based on this evaluation, the HEP for the second step should have been determined as the basic HEP of 10-2 times the ( x 5) PSF, yielding a value of 5.0 x 10
Similarly, the basic HEP for the third step should have been 10 Considering a short procedure (less than 10 steps), and continuing with moderately high stress, but switching to a step-by-step task (since the dynamic portion already occurred with the decision to evacuate the a>ntrol room, ar.d the operators are left with the more mechanical task of performing the procedural step), a PSF of ( x2) should have been used, based on Table 20-16 of Reference [16]. Thus, the HEP for the third step should be (0.001)(2), or 2.0 x 10
The HEP for the fourth step was assessed in the IPEEE as a step-by-step task under moderately high stress. The basic HEP of 0.001 and the PSF of(x2) a'as ti4 y here, yielding an HEP of 2.0 x 10'.
1 The total HEP for failure to recover the plant from outside the control room is then calculated from the event tree on page 4-132 of the IPEEE, using the revised HEPs estimated above. The final value should be 7.8 x 10, rather than the value of 3.6 x 10 calculated in the IPEEE - an increase of a factor of 21.6.
It should be noted that the value ut i.6 x IU~ is comparable to that calculated for Peach Bottom in the 4
NUREG-1150 fire analysis (6.4x 10-2) (25]. The licensee's optimistic treatment of operator recovery l
actim +or rnt- ! iccm fire scenarios has led to approximately an order of magnitude reduction in estimated fire-induced CDF, as compared to the NUREG-1150 fire analyses.
l 1
Energy Research, Inc.
32 ERI/NRC 96-504 2
e 2.2.8 Fire Detection and Suppression The automatic fire suppression systems at Pilgrim consist of water and Halon-based systems. The system unavailabilities utilized in the IPEEE are consistent with probabilities reported in past fire PRAs.
Non-fire-brigade manual fire suppression was credited implicitly for control room fire scenarios, and not credited for all other fire areas. Fire brigade manual suppression was credited for all plant areas. Manual suppression is considered to have been treated properly by the licensee.
2.2.9 Analysis of Plant Systems and Sequences a.
Key Assumptions including Success Criteria and Associated Bases The success criteria were taken directly from the IPE.
b.
Event Trees (Functional or Systemic)
Only a limited number of the internal event trees were determined by the licensee to be relevant to fire CDF quantification. These included:
Reactor trip Loss of offsite power Main steam line isolation a
Loss of feedwater, condensate, or condenser vacuum a
Loss of AC power These applicable event trees are typical of those reported in past fire PRAs.
c.
Dependency Afatrix, ifit is Differentfrom thatfor Seismic Events No dependency matrix was provided in the submittal.
d.
Plant-Unique System Dependencies It is unknown, from a review of the submittal, if there are any plant-unique system dependencies.
e.
Afost Signipcant Human Actions The only recovery action listed in Reference [1] involves the evacuation of the control room due to a fire in either the cable spreading room or the main control room. It is typical of past fire PRA results that the most critical human recovery actions involve evacuation of the control room.
2 710 Fire Sm-r?cs and Core Damage Frequency Evaluation The licensee has properly demonstrated and summarized how the core damage frequency was estimated for each fire scenario. Only in the case of the control room fire scenarios have unrealistically optimistic Energy Research, Inc.
33 ERl/NRC 96-504 l
I analytical techniques (i.e., human recovery probabilities) led to a core damage frequency less than that I
which is typical of past fire PRAs.
' 2.2.11 Analysis of Containment Performance a.
Sigmpcant Containment Performance Insights The following containment failure modes were identified and evaluated by the licensee:
Containment structure Containment response to core damage event Containment isolation / bypass failure The licensae reviewed the contribution of fire-initiated events to containment isolation failure, containment bypass, and containment overpressure failure, and concluded that fires were insignificant contributors to these failure modes. This result is typical of what has been reported in past tire PRAs.
b.
Plant Unique Phenomenology Considered No plant-unique phenomenology was considered.
2.2.12 Treatment of Fire Risk Scoping Study Issues a.
Assumptioris Used to Address Fire Risk Scoping Study Issues The following assuitptions were used to address the Sandia fire risk scoping study issues [26];
The only seismically induced tire sources considered were releases of flammable or combustible liquids or gases.
Inadvertent operation of Halon systems would not result in any equipment operability concerns.
Fire protection systems have been installed in accordance with NFPA codes and standards.
Therefore, adequate assurance is provided that fire protection systems will not fall onto safe shutdown components during a seismic event.
Currently, the state <f-the-art in fire protection engineering does not permit an adenuate assessment relativa to non-thermal effects of combustion products, l
b.
Signifcant Findings The following are the significattt review findings pertaining to the fire risk scoping study issues:
Fire barrier failures were not analyzed.
Potential adverse effects on plant equipment by combustion products were not addressed.
Energy Research, Inc.
34 ERI/NRC 96-504
- 4 Seismic-tire interactions were addressed by focusing on the potential for seismic events to cause a release of flammable or combustible liquids or gases, by evaluating the potential for seismic actuation of fire suppression systems, and by examining the potential for seismically induced failure of fire suppression systems. However, the potential seismic-tire interaction due to a seismically induced electrical cabinet fire in the cable spreading room was not considered.
Previous studies have found this to be an important risk contributor at another nuclear power plant which has a configuration similar to Pilgrim.
Manual fire fighting effectiveness (including smoke control) was addressed by comparing the fire brigade and fire protection attributes of Pilgrim against the EPRI evaluation of the tire risk scoping study. The licensee concluded that the fire protection program meets all attributes listed by EPRI.
All controls for systems required to achieve and maintain safe shutdown in the event of a fire within the control room have transfer or isolation switches located outside the control room.
Procedures are in place which outline the shutdown procedure utilizing the remote shutdown system and actions to be taken prior to evacuating the control room in the event of a fire.
Therefore, the licensee concluded that the issue of control system interactions had been adequately addressed.
2.2.13 USI A-45 Issue a.
Methods of Remodng Decay Heat The main condenser, RHR system, reactor water clean-up (RWCU) system, containment venting through the standby gas treatment (SBGT) system, and direct torus vent. are the methods considered for decay heat removal during and after a fire event.
b.
Presence of Thermo-Lag Thermo-lag is not present at Pilgrim.
2.3 HFO Events The HFO external events were analyzed by a progressive screening approach, to identify those events with j
CDF contributions judged to be greater than 10 /ry [1].
4 The general methodology utilized in the HFO IPEEE has followed that presented in NUREG-1407 for the analysis of other external events. The HFO assessment included the following three steps:
1.
Hazard analysis 2.
Plant response (fragility) analysis 3.
Risk determination and documentation Guidelines provided in GL 88-20, Supplement 4 [2]; NUREG-1407 [3]; NUREG/CR-2300 [6]; and NUREG/CR-5042, Supplement 2 [27], are referenced in the IPEEE as the basis for completion of Step 1.
Energy Reseatch, ine.
35 ERI/NRC 96-504
W m-t f ', y.
9.i..
Progressive screening consists of the following steps:
i,
^
A Reviewing plant-specific hazard data and licensing bases ia
-Identifying signiticant changes since issdance of the plant operating license (OL)
> Establislung whether or not the plant and facilities designs comply with the 1975 Standard Review Plan (SRP) criteria Determining whether or not the hazard frequency is acceptably low, if necessary T*1
' Performing a bounding analysis, if necessary Performing a probabilistic risk assessment, if necessary The following subsections provide a summary of the analysis performed for each hazard.
-2.3.1.
High Winds and Tornadoes 2.3.1.1 General Methodology The progressive screening approach was used for evaluating tornadars and other high-wind hazards at Pilgrim, in accordance with NUREG-1407. Aher a plant review to establish the plant licensing basis and to identify plant changes since issuance of the operating license, the as-built tornado /high-wind design basis
!was checked against the SRP. If the as-built design was determined to meet the 1975 SRP criteria, the results were documented, otherwise turther analysis was conducted. This further analysis was in the form -
of a hazard frequency analysis, a bounding analysis, or a PRA. For tornado /high wind-related accidents,
. the following sections of the SRP were considered:
. SRP No. 2.3.1, Regional Climatology -
' SRP No. 3.3.1, Wind Loadings
. SRP No. 3.3.2, Tornado Loadings SRP No. 3.5.1.4, Missiles Generated by Natural Phe'nomena 2.3.1.2 Plant-Specific Hazard Data and Licensing Basis-In~ general, all Class-I structures and Class-II structures bousing Class-I equipment, except the main stack, are designed to withstand the effects of tornadoes to the extent necessary to protect Class-I equipment.
The Class-I structures and Class-II structures housing Class-I equipment include the reactor building, turbine building, radwaste building, diesel generator building, and the intake structure. The basic design criteria for tornado effects at Pilgrim are as follows:
1,.
The velocity components are applied as a 300 mph horizontal wini.
- .o ft.1 Lam of the structure.
2.
The pressure differential is applied as 3 psi internal (bursting) pressure occurring in 3 seconds.
Energy ~ Research, Inc, 36 ERI/NRC 96-504
3.
The design missiles include: a 4,000 lb automobile flying through the air at 50 mph, but not more that 25 ft above the ground; a 4-in by 12-in by 12-ft plank (108 lb) traveling end-on at 300 mph
+
ovn the full height of the structure; and a 3-in diameter Schedule 40 pipe,10 ft long, traveling ena+n at 100 mph over the full height of the structure. In addition, the differential pressure shall vary from zero to 3 psi at 1 psi /sec, remain at 3 psi for 2 see, and then return to zero at I psi /sec.
The as-built plant wind design does not satisfy the SRP criteria. However, the IPEEE screening criteria are satistled. The plant walkdown has identified vents to the diesel generator fuel tanks that are not protected against tornado missiles. The annual probability of diesel generator failure, given a crimping of the diesel day tank vent lines due to tornado missiles, was estimated by the licensee to be less than 104
/yr, which satisfies the IPEEE screening criteria. The present review has performed a simplified bounding calculation which confirmed that the licensee's estimate is reasonable.
2.3.1.3 Significant Changes Since Issuance of the Operating License No signincant changes to plant structures or systems affecting wind design have occurred since issuance of the plant operating license. However, in 1987, Class-I electrical conduits were identified in Class-II portions of the reactor building auxiliary bay and water intake structure of PNPS. Original design basis calculations could not be found that defended the acceptability of this condition. A site-specific tornado hazard analysis was performed to evaluate this situation. The study concluded that the as-built designs for the auxiliary bay and the water intake structure are acceptable. The basis for this conclusion was a probabilistic analysis of the tornado hazard with respect to these structures.
2.3.1.4 Significant Findings and Plant-Unique Features No significant findings are cited in the submittal. A summary of the walkdown procedures used by the licensee., and the qualification of the team members performing the walkdown, are not provided in the submittal.
A walkdown of the diesel generator building (ground level and roof) identified several vent pipes that are not protected from tomado missiles. Vents to the two main diesel storage tanks are located along the north wall of the diesel generator building. Since both main storage pipes are within a few feet of each other, both could be hit by the same tornado missile. The day-tank vents are about 20 ft apart. If impacted by a tornado missile, there is a small probability that these vents could crimp shut, resulting in a vacuum in the tanks as fuel is drained from the tanks. Without venting of the day tanks, the diesel generators will fail from fuel starvation, leading to a loss of standby AC power and a potential pathway to core damage.
However, as previously discussed, this scenario was found to have a frequency ofless than 10 /ry.
4 2.3.1.5 Hazard Frequency NUREG/CR-4461 and WASH-1300 hazard curves were used for the evaluation of hazard frequency for high winds and tornado hazards, respectively. In both cases, the frequency of hazard exceeding the design 4
basis was estimated to be less than 10 /yr. The licensee has thus correctly screened out tornadoes and high winds as insignificant contributors to external events risk.
Energy Research, Inc.
37 ERI/NRC 96-504
?
2.3.2 External Flooding 2.3.2.1 General Methodology The licensee's external flood evaluation was performed in two prts. The first part consisted of following the methodology oudined in NUREG-1407 for the site design-basis flood. For PNPS, the controlling site design flood is a probable maximum hurricane (PMH). The second flood evaluation addressed the NRC request in NUREG-1407 to evaluate the latest PMH criteria published by the National Weather Service (NWS).
2.3.2.2 Plant-Specific Hazard Data and Licensing Basis The first step in the licensee's evaluation included a comprehensive review of the applicable sections of the UFSAR and both the construction and operating versions of the safet/ evaluation report (SER). The purpose of the review was to establish the basis for the site design flood. Historical information on ocean flooding at the site and local vicinity was also reviewed. In addition to the historical tlooding described in the UFSAR, information on two notable 1991 east coast storms was obtained from the National Oceanic and Atmospherie Administration (NOAA).
PNPS is located adjacent to the Atiantic Ocean on Cape Cod Bay in southeastern Massachusetts. Site grade varies between about 20 ft mean sea level (MSL) to 22 ft MSL. Minimum entrance elevation for all safety-related ponions of plant structures is 23 h MSL. Ocean dooding along the southeast Massachusetts coast has historically been caused by hurricanes and " northeasters", both of which were considered durin'g the development of the design-basis flood level.
The controlling storm surge for the site was determined to be a PMH. The maximum still water level associated with the PMH was estimated at + 13.5 ft MSL. This design level is 3 ft above the historical maximum for the area, which occurred about 270 years ago.
The effects of wave setup and wave runup were considered in wave action model studies. The purpose of the model studies was to assist in the design of the shoreline and offshore stmetures which provide flood protection for the site. These structures consist of breakwaters, jetties, and revetments which, in addition to flood protection, provide shoreline stabilization.
The results of the model tests indicated some minor overtopping of the revetment adjacent to the intake structure. Yard flooding was limited to open space northeast of the reactor building. The reactor building was found te not be subjected to tlooding. Additionally, a series of model tests run at a still water level of + 14.7 n MSL (1.2 tt above the PMH) confirmed that storm wave action at the intake structure would not adversely affect circulating water or service water pump operation.
An indepvment esessment of the probable maximum flood level was made by the NRC and their 1
consultant, Coastal Engineering Research Center. The NRC estimated a PMH maximum still water level of + 14.8 ft MSL, which is 1.3 ft above the UFSAR estimate. The SER further addressed the NRC wave action and runup analysis, and concluded that the station elevation and minimum entrance elevations far i
structures is adequate at the higher surge height level. In conclusion, the licensee notes that storm flooding would not prevent safe shutdown of PNPS.
Energy Research, Inc.
38 ERl/NRC 96-504 i
2.3.2.3 Significant Changes Since Issuance of the Operating License The submittal does not identify any significant changes since issuance of the operating license.
2.3.2.4 Significant Findings and P! ant-Unique Features No significant findings are cited in the submittal. A summary of the walkdown procedures used licensee, and the qualification of the team members performing the walkdown, are not provided in submittal. No plant unique features were noted.
2.3.2.5 Hazard Frequency The probable maximum hurricane was screened out based on conformance with the SRP. With r the NWS probable maximum precipitation (PMP) criteria, a hazard assessment was performed.
This assessment found the frequency of these events to be below 104/yr. The hazard frequencies assign the licensee to extreme precipitation and to NWS PMP criteria appear to be reasonable.
The licensee reported that the hazard frequency of exceeding the design structural capacity of the roofs to extreme precipitation is about 104/yr or less. Conditional core damage frequency, given some localized breach of the water tightness of the roof, was judged to be less than 0.1. As a result, the IPEEE scrf criteria were determined to be satisfied; i.e., local site runoff and roof ponding screened out based upi hazard frequency assessments, f
The licensee has correctly screened out external tiooding as an insignificant contributor to external events risk.
j 2.3.3 Transportation and Nearby Facility Accidents 2.3.3.1 General Methodology An evaluation of transponation and nearby facility accidents was performed in accordance with the re.ommended screening approach of NUREG-1407. The methodology used for this analysis consisted of first identifying the proximity of the site to the hazard. For aircraft crash accidents, a review of aircraft traffic in the vicinity was conducted.
l Regulatory Guide 1.78 was consulted to identify those chemicals that could result in loss of control room habitability. Regulatory Guide 1.78 provides screening criteria in terms of proximity (within a tive-mile radius) and frequency of shipment (10/ year for highway, 30/ year for rail, and 50/ year for water traffic).
A representative list of hazardous chemicals and their toxicity limits is also provided.
I For those chemicals not eliminated by the proximity or frequency screening criteria, Regulatory Guide 1.78 provides a methodology to calculate concentration versus time after an accidental release. The
" toxicity limit" acceptance criterion requires that the time from detection to the time when toxicity is reached must be at least tTo minutes, in order to allow the control room operators to take protective action.
Energy Research, Inc.
39 ERI/NRC 96-504
=.
In addition, Regulatory Guide 1.91 was consulted to determine if explosions are a concern. Regulatory Guide 1.91 establishes a method to calculate " safe distances" from critical plant structures to a transportation route beyonti which any explosion that might occur is not likely to have an adverse effect on plant operation or to prevent a safe shutdown.
2.3.3.2 Plant-Specific Hazard Data and Licensing Basis The licensee stated that only highway and water modes of transport are located within five miles of PNPS.
There is no nearby railroad. Chlorine and propane were considered as potential hazards due to highway transport. In either case, the release of the largest single container meets the two-minute " toxicity limit" for the control room specified in Regulatory Guide 1.78.
Only one water transport route was found by the licensee to be within five miles of the plant. Most materials shipped via this route are fuels. PNPS developed a procedure to enable operators to take protective action to place the plant in a safe mode in the event of an offshore oil spill.
There are nine airports within about 30 miles of PNPS. The nearest airport is the Plymouth Airport, which is approximately 8 miles west of PNPS. The next closest airport is the Marshfield Airport, which is about 11 miles north of PNPS. The most active airport in the area is Logan Airport in Boston, which is 36 miles to the north-northwest.
The nearest military facilities are the 'Weymouth Naval Air Station and Otis Air Force Base. The Weymouth Naval Air Station is about 23 miles to the nonhwest, and Otis Air Force Base is about 20 miles to the south.
The licensee utilized SRP 3.5.1.6 to estimate the probability of aircraft crash. Further analysis of aircraft crash is required if either of the following conditions are met:
An airport is located within 5 miles of the site, or 2
An airport with projected operations greater than 500 d movements per year is located within 10 2
miles of the site, or an airport with projected operations greater than 1000 d movements per year is located beyond 10 miles from the site, where 'd' is the distance in miles from the site.
All of the airports, except Plymouth Airport, are beyond 10 miles from the site and satisfy the SRP criteria. For Plymouth Airport, the annual crash probability was estimated by the licensee to be less than 104/yr.
Walkdowns were conducted by the licensee to. identify the hazardous chemicals stored in sufficient quantities to present a hazard to control room habitability or safety-related structures. The walkdowns identified four bulk-stored chemicals as potential hazards: hydrogen, nitrogen, carbon dioxide, and propane. Hydrogen and propane are flammable, as well as asphyxiants. Nitrogen and carbon dioxide are only asphyxiants. Two other bulk-stored chemicals, sodium hydroxide and oxygen, were not deemed hazardous. Sodium hydroxide is a liquid with low volatility, oxygen is an oxidant but not deemed a explosion potential or a control room habitability hazard.
Energy Research, Inc.
40 ERI/NRC 96-504
s.
The licensee stated that SRP criteria were met because control room habitability will be maintained according to Regulatory Guide 1.78, and because propane storage meets the Regulatory Guide 1.91
- safe distance" explosion criteria.
2.3.3.3 Significant Changes Since issuance of the Operating License The submittal did not identify any significant changes since the operating license.
2.3.3.4 Significant Findings and Plant-Unique Features No significant fmdings were cited in the submittal. A summary of walkdown procedures used by the licensee, and the qualification of the team members performing the walkdown, were not provided in the submittal.
2.3.3.5 Hazard Frequency Air transponation accidents from Plymouth Airpon were identified as the only hazard source explicitly screened out based on hazard frequency. Other transportation and nearby facility accidents were eliminated from funher consideration based upon conformance with SRP criteria or establishment of plant operating procedures (for water transport accidents only).
i
)
The licensee has thus correctly screened out transportation and nearby facility accidents as insignificant contributors to external events risk.
2.3.4 Other HFO Events To determine the other extemal events for consideration at PNPS, a screening assessment was performed of all external events potentially applicable.
The screening assessment identified lightning as an external event that has affected the operation of PNPS.
In the past, possibly as many as tive lightning strikes have caused loss of offsite power at PNPS. Loss of offsite power was addressed during the PNPS internal events IPE [28]. Because lightning has caused I
only loss of offsite poer at PNPS, and because that issue was addressed in the internal events IPE. the licensee stated that further consideration of lightning effects is not warranted per guidance given in NUREG-1407.
l The screening of other HFO events by the licensee is thus deemed to be proper.
2.4 Generic Safety Issues (GSI-147. GSI-148. GSI-156 and GSI-172) 2.4.1 GSI-147, " Fire-Induced Alternate Shutdown / Control Panel Interaction" GSI-147 addresses the scenario of a fire occurring in a plant (e.g., in the control room), and conditions i
which could develop that may create a number of potential control system vulnerabilities. Control system interactions can impact plant risk in the following ways:
Electrical independence of remote shutdown control systems Energy Research, Inc.
41 ERI/NRC 96-504
Loss of control power before transfer Tota' loss of system function Spudous actuation of components The licensee considered hot shorts leading to LOCAs or interfacing system LOCAs. All circuitry associated with remote shutdown was found to be electrically independent of the control room. The submittal has followed the guidance provided in FIVE concerning control systems interactions.
2.4.2 GSI 148, " Smoke Control and Manual Fire Fighting Effectiveness" 6SI 148 addresses the effectiveness of manual fire-fighting in the presence of smoke. Smoke can impact plant risk in the following ways:
By reducing manual fire-fighting effectiveness and causing misdirected suppression efforts By damaging or degrading electronic equipment By hampering the operator's ability to safely shutdown the plant By initiating automatic Bre protection systems in areas away from the fire i
Reference [29] identifies possible reduction of manual fire-fighting effectiveness and causing misdirected j
suppression efforts as the cenaal issue in GSI-148. Manual fire-fighting was credited in the analysis. No 1
specific information was provided concerning the potential for smoke to reduce manual fire-tighting
{
effectiveness or misdirect suppression efforts.
j i
2.4.3 GSI-156, " Systematic Evaluation Program (SEP)"
GSI-156 addresses issues encountered at plants that were licensed prior to the t me the 1975 Standard I
i Review Plan (SRP) was issued. Among other concerns, GSI-156 issues relate to seismic; fire; and high winds, floods, and other (HFO) external events. Reference [29] provides the description of each SEP issue j
stated below, and delineates the scope of information that may be reported in an IPEEE submittal relevant j
to each such issue. The objecti/e of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-156 may be found.
Sirttement of Foundations and Buded Equipment Descrintion of the issue {29]: The objective of this SEP issue is to assure that safety-related structures, systen s and components are adequately protected against excessive settlement. The scope of this issue includes review of subsurface materials and foundations, in order to assess the potential static and seismically induced settlement of all safety-related s'.ructures and buried equipment. Excessive settlement or collapse of foundations could result in failmes of structures, interconnecting piping, or control systems, such that the capability to safely shutdown the plant or mitigate the mnsequences of an accident could be comprised. This issue, applicable mainly to soil sites, involves two specific concerns:
potential impact of static setdements of foundations and buried equipment where the soil might not a
have been properly prepared, and seismically induced settlement and potential soil liqvefaction following a postulated seismic event.
Energy Research, Inc.
42 ERI/NRC 96-504
p
(..
t Static settlements are not believed to be a concern, and the focus of this issue (when considering relevant information in IPEEEs) should be on seismically induced settlements and soil liquefaction, it is anticipatd that full-scope seismic IPEEEs will address Gese concents, following the guidance in EPRI NP-6041.
Sections 3.1.2.1 and 3.1.4.2 (page 3-81) of the Pilgrim irEEE submittal provide a general description of site soil properties. The Pilgrim site consists of 30 to 50 feet of compacted fill materials above about 30 to 50 feet of glacial outwash deposits which are underlain by bedrock. The fill is heavily compacted and the outwash deposits are very dense as a result of loading due to glaciation. The seismic IPEEE has included analyses of the following categories of potential soil-related failures: (l) soil liquefaction, (2) differential soil displacement effects on buried components, and (3) soil settlement effects on component failures. The evaluations of these potential soil failures are discussed in Section 3.1.4.2 (pages 3-80 to 3 82) of the submittal. Information on soil-structure-interaction analysis is provided in Section 3.1.4.3.
Additionally, Table 5-5 of the submittal provides some brief justification for screening out the following soil-related hazards: erosion, landsliding, and soil shrink-swell.
Dam Integrity and Site Flooding Descrintion of the issue [29): The objective of this issue is to ensure the ability of a dam to prevent site flooding and to ensure a cooling water supply. The safety functiens would nunnally include remaining stable under all conditions of reservoir operation, controlling seepage to prevent excessive uplifting water pressures or erosion of soil materials, and providing sufficient freeboard and outlet capacity to prevent overtopping. Therefore, the focus is to assure that adequate safety margins are available under all loading conditions, and uncontrolled releases of retained water are prevented. The concern of site flooding resulting trom non-seismic failure of an upstream dam (i.e., caused by high winds, tiooding, and other events) is addressed as part of the SEP issue " site hydrology and ability to withstand tioods." The concerns of site flooding resulting from the seismic failure of an upstream dam and loss of the ultimate heat sink caused by the seismically induced failure of a downstream dam should be addressed in the seismic portion of the IPEEE. The guidance for performing such evaluations is provided in Section 7 of EPRI NP-6041. As requested in NUREG-1407, the licensee's IPEEE submittal should provide specitic informanon addressing this issue, if applicable to its plant. Information included for resolution of USI A-45 is also applicable to this concern.
The Pilgrim IPEEE submittal states that the controlling flood is due to hurricanes. Flooding due to dam failures is not discussed. - Section 5.2.1 of the submittal (page 5-8) brietly mentions canals and reservoirs at the site which are used to transport and impound plant cooling water.
1 Site flydrology and Ability to Withstand Floods Descrintion of the Issue [29]: The objective of this issue is to identify the site hydrologie characteristics, in order to ensure tia capability of safety-related structures to withstand tlooding, to ensure adequat-cooling water supply, and to ensure in-service inspction of water-control structures. This issue involves assessing the following:
Hydrologic conditions - to assure ths.t plant design retlects appropriate hydrologie conditions.
Flooding potential and protection - to assure that the plant is adequately protected against 11oods.
Energy Research. Inc.
43 ERI/NRC 96-504 l
k.
w L
' Ultimate heat sink - to assure an appropriate supply of enoting wcc: during normal and eme shutdown.
~
' As regeested in NUREG-1407, the licensee's IPEEE submittal should provide information addressing th concerns. The concern related to in4ervice inspection of water-control structures, a compliance issue, is -
not being covered in the IPEEE.
The Pilgrim IPEEE has involved an evaluation of external floods (Section 5.2 of the submittal), includi
~
flooding due to hurricanes (including wave setup and_ wave run-up), and effects of local intense
- precipitation (including roof ponding); Section 5,2.1 of the submittal (page 5-8) briefly mentions canals and reservoirs at the site which are used to transport and impound plant cooling water.
IndustdalHazards Description of the issue [29):. The objective of this issue is to ensure that the integrity of safety-related structures, systems, and components would not be jeopardized due to accident hazards from nearby facilities. Such hazards include: shock waves from nearby explosions, releases of hazardous gases, or chemicals resulting in fires or explosions aircraft impacts, and missiles resulting from nearby explosions.
As requested in NUREG-1407, the licensee's IPEEE submittal should provide information addressing this issue.
The Pil, rim IPEEE submittal (Section 5.3) includes the following information of relevance to this issue:
t Section 5.3.1 discusses potential transpottation accidents: Section 5.3.2 discusses potential aircraft crashes; and Sections 5.3.3 and 5.3.4, respectively, discuss potential onsite and offsite chemical releases.
Tornado Missiles Descrintion of the issue [29]: The objective of this issue is to assure that plants constructed prior to 1972 (SEP plants) are adequately protected against tornadoes. Safety-related structures, systems, and components need to be able to withstand the impact of an appropriate postulated spectrum of tornado-generated missiles. As requested in NUREG-1407, the licensee's IPEEE submittal should provide information addressing this issue.
The Pilgrim IPEEE has involved an evaluation of tornadoes, including brief consideration of tornado-induced missiles, as documented in Section 5.1 of the submittal.
Sewre Weather Efects on Structures i
Descrintion of the issue [29): The objective of this issue is to assure that safety-related stmetures, systems, and components are designed to function under all severe weather conditions to which they may be exposed. Meteorological phenomena to be considered include: straight wind loads, tornadoes, snow
' and ice loads, and other phenomena judged to be significant for a particular site. As requested in NUREG-1407, the licensee's IPEEE submittal should provide information specifically addressing high winds and floods. Other severe weather conditions (i.e., snow and ice loads) were determined to have insignificant effects on stmetures (see Chapter 2 of NUREG-1407).
Energy Research, Inc.
44 ERI/NRC 96-504
E The Pilgrim IPEEE has included assessments of high wmds (straight wind loads and tornadoes) and external floods. Section 5.1 of the submittal discusses severe winds and tornadoes, and Section 5.2 of the submittal discusses external tloods. In addition, Table 5-5 of the submittal presents brief justification for screening out other severe weather hazards.
Design Codes, Cn'teria, andload Combinations Descrintion of the issue [29]: The objective of this issue is to assure that structures important to safety should be designed, fabricated, erected, and tested to quality standards commensurate with their safety function. All structures, classified as Seismic Category 1, are required to withstand the appropriate design conditions without impairment of structural integrity or the performance of required safety functions. Due to the evolutionary nature of design codes and standards, operating plants may have been designed to codes and criteria which differ from those currently used for evaluating new plants. Therefore, the focus of this issue is to assure.that plant Category I structures will withstand the appropriate design conditions (i.e.,
against seismie, high winds, and floods) without impairment of structural integrity or the performance of required safety function. As part of the IPEEE, licensees are expected to perform analyses to identify potential severe accident vulnerabilities associated with external events (i.e., assess the seismic capacities of their plants either by performing seismic PRAs or SMAs).
The Pilgrim IPEEE has included an evaluation of potential severe accident vulnerabilities associated with external events. The submittal does not systematically identify codes, criteria, and load combinations used in design. Sections 3.1.2.1,3.1.2.2, and 3.1.4.2 of the submittal provide some information on the seismic category classification and seismic design criteria and loadings for building structures. Additionally, design criteria and information regarding the piant's design provisions for withstanding effects of high winds, floods, and transportation / facility accidents are provided throughout Section 5 of the submittal.
Seismic Design ofStrucmres, Systems, and Components pescrintion of the issue [29]: The objective of this SEP issue is to review and evaluate the original seismic design of safety-related structures, systems, and components, to ensure the capability of the plant to withstand the effects of a Safe Shutdown Earthquake (SSE).
The Pilgrim IPEEE is based on a seismic PRA, which has evaluated failure probabilities of the plant and plant structures, systems, and components, at various ground motion levels. The related probabilistic analyses are documented in Section 3.1 of the submittal.
Shutdown Systems and ElectricalInstnamentation and Control Features Description of the issue [29]: The issue on shutdown systems is to address the capacity of plants to ensure reliable shutdown asing safety-grade equipment. The issue on electrical instrumentation and control is to assess the functional capabilities of electrical instrumesum...re wrarol teatures of systems required for safe shutdown, including support systems. These systems should be designed, fabricated, installed, and tested to quality standards, and remain functional following external events. In IPEEEs, licensees were l
requested to address USI A-45, " Shutdown Decay Heat Removal (DHR) Requirements," and to identify potential vulnerabilities associated with DHR systems following the occurrence of external events. The resolution of USI A-45 should address these two issues.
Energy Research, Inc.
45 ERI/NRC 96-504 iL
The licensee provides some brief discussion of its treatment for resolution of USI h-45 for external events
'in Sections 3.2.1 and 4.13 of the I"lgrim IPEEE submittal.
2.4.4 GSI-172, " Multiple System Responses Program (MSRP)"
Reference [29] provides the description of each MSRP issue stated below, and delineates the scope of information that may be reported in an IPEEE submittal relevant to each such issue. The objective of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-172 may be found.
Common Cause Failures (CCFs) Related to Human Errors Descrintion of the Issue [29]: CCFs resulting from human errors include operator acts of commission or omission that could be initiating events, or could affect redundant safety-related trains needed to mitigate the events. Other human errors that could initiate CCFs include: manufacturing errors in components that affect redundant trains; and installation, maintenance or testing errors that are repeated on redundant trains.
In IPEEEs, licensees were requested to address only the human errors involving operator recovery actions following the occurrence of external initiating events.
Information related to operator recovery actions following seismic events is provided in the following locations of the submittal: Sections 3.0.2, 3.0.4, 3.1.3.1, 3.1.3.2, 3.1.3.2.5 (detailed consideration of human reliability analyses),3.1.5.2, and 3.1.5.3 (sensitivity analysis). The submittal addresses operator recovery actions for fire events in Section 4.10.1.
Non-Safety-Related Control System / Safety-Related Protection System Dependencies Descrintion of the issue [29]: Multiple failures in non-safety-related control systems may have an adverse impact on safety-related protection systems, as a result of potential unrecognized dependencies between cont ol and protection systems. The concern is that plant-specific implementation of the regulations i
regarding separation and independence of control and protection systems may be inadequate. The I
licensees' IPE process should provide a framework for systematic evaluation of interdependence between safety-related and non-safety-related systems, and should identify potential sources of vulnerabilities. The dependencies between safety-related and non-safety-related systems resulting from external events -- i.e.,
concerns related to spatial and functional interactions - are addressed as part of " fire-induced alternate shutdown and control room panel interactions," GSI-147, for fire events, and " seismically induced spatial and functional interactions" for seismic events.
Information provided in the Pilgrim IPEEE submittal pertaining to seismically induced spatial and functional interactions is identified below (under the heading Seismically Induced Spatial and Functional Interactions), whereas information pertaining to fire-induced alternate shutdown and control panel interactions has already been identified in Section 2.4.1 of this TER.
Heat / Smoke / Water Pr:per'~.Y~r, vr: 1Tres Descrintion of the Issue [29): Fire can damage one train of equipment in one fire zone, while a redundant train could potentially be damaged in one of following ways:
Energy Research, Inc.
46 ERI/NRC 96-504
o lleat, smoke, and water may propagate (e.g., through HVAC ducts or electrical conduit) into a second fire zone, and damage a redundant train of equipment.
A random failure, not related to the' tire, could damage a redundant train.
Multiple non-safety-related control systuns could be damaged by the fire, and their failures could affect safety-related protection equipment for a redundant train in a second zone.
A fire can cause unintended operation of equipment due to hot shorts, open circuits, and shorts to ground.
Consequently, components could be energized or de-energized, valves could fail open or closed, pumps could continue to run or fail to run, and electrical breakers could fail open or closed. The concern of water propagation effects resulting from tire is partially addressed in GI-57, " Effects of Fire Protection System Actuation on Safety-Related Equipment." The concern of smoke propagation effects is addressed in GSI-148. The concern of alternate shutdown / control room interactions (i.e., hot shorts and other items just mentioned) is addressed in GSI-147.
Information provided in the Pilgrim IPEEE submittal pertaining to GSI-147 and GSI-148 has already been identified in Sections 2.4.1 and 2.4.2 of this TER. Some briefinformation pertaining to this issue is provided in Section 4.12 (page 4-138) of the submittal.
Effects ofFire Suppression System Actuation on Non-Safety-Related and Safety-Related Equipment Descrintion of the Issue [29]: Fire suppression system actuation events can have an adverse effect on safety-related components, either through direct contact with suppression agents or through indirect interaction with non-safety related components.
Some brief information pertaining to suppression-induced damage to equipment, as well as seismically induced inadvertent actuation of tire suppression systems, can be found in Section 4.12 of the JPEEE submittal.
Effects of Flooding and/or Moisture intrusion on Non-Safery-Related and Safety-Related Equipment Description of the issue [29): Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety related equipment. This type of event can result from external flooding events, tank and pipe ruptures, actuations of fire suppression systems, or hdh through parts of the plant drainage system. The IPE process addresses the concerns of moisture intrusion and internal flooding (i.e., tank and pipe ruptures or backtlow through pan of the plant drainage system). The guidance for addressing the concern of external flooding i
is provided in Chapter 5 of NUREG-1407, and the concern of actuations of tire suppression systems is provided in Chapter 4 of NUREG-1407.
The following information is provided relevant to this issue: the Pilgrim IPEEE submittal discusses external flooding in Section 5.2; brief discussion is provided in Section 4.12 regarding non-seismic and seismic actuations of tire suppression systems (pages 4-136 to 4-138); and seismically induced internal flooding is discussed in some detail in Section 3.1.3.1.11.
Energy Research, Inc.
47 ERl/NRC 96-504
Nj
- e Seismically Induced Soarial and Functional Interactions Deerintinn of the hwa [29}; Seismic events have the potential to cause multiple failures of safety-related
~
systems through spatial and functional interactions. Some particular sources of concern include: ruptures in small piping that may disable essential plant shutdown systems; direct impact of non-seismically qualified structures, systems, and components that may cause small piping failures: seismic functional interactions of control and safety-related protection systems via multiple non-safety-related control systems failures; and indirect impacts, such as dust generation, disabling essential plant shutdown systems. As pan of the IPEEE, it was specifically requested that seismically induced spatial interactions be addressed during plant walkdowns. The guidance for performing such walkdowns can be found in EPRI NP-6041.
The Pilgrim IPEEE has included a seismic walkdown which investigated the potential for adverse physical interactions. The submittal states that EPRI NP-6041-SL and GIP guidelities were followed in the seismic walkdowns. Relevant information can be found in Sections 3.0.1, 3.1.2, 3.1.3.1.11, 3.1.4.1, 3.1.4.2, and 4.12 of the submittal.
Seismically Induced Fires Descrintion of the Issue [29]: Seismically induced fires may cause multiple failures of safety-related systems. The occurrence of a seismic event could create fires in multiple locations, simultaneously -
' degrade fire suppression capability, and prevent mitigation of fire damage to multiple safety-related systems. Seismically induced fires is one aspect of seismic-fire interaction concerns, which is addressed as pan of the Fire Risk Scoping Study (FRSS) issues. (IPEEE guidance specifically requested licensees to evaluate FRSS issues.) In IPEEEs, seismically induced fires should be addressed by means of a focused seismic-fire interactions walkdown that follows the guidance of EPRI NP-6041.
The Pilgrim IPEEE submittal provides some discussion regarding seismically induced fires in Section 4.12.
Seismically Induced Fire Suppression System Actuation Descrintion of the issue [29]: Seismic events can potentially cause multiple fire suppression system i
actuations which, in turn, may cause failures of redundant trains of safety-related systems. Analyses I
currently required by fire protection regulations generally only examine inadvertent actuations of fire suppression systems as single, independent events, whereas a seismic event could cause multiple actuations of fire suppression systems in various areas.
Briefinformation penaining to seismically induced inadvenent actuation of fire suppression systems can be found in Section 4.12 of the IPEEE submittal.
SeismicallyInduced Flooding Dawrintinn of the hma [29): Seismically induced flooding events can potentially cause multiple failures of safety-related systems. Rupture of small piping could provide flood sources that could potentially affect multiple safery-related components simultaneously. Similarly, non-seismically qualified tanks are a potential flood source of concern. IPEEE guidance specifically requested licensees to address this issue.
Energy Research, Inc.
48 ERl/NRC 96-504 l
i The submittal provides significant discussion regarding seismically induced internal flooding in Section 3.1.3.1.11.
Related information is provided in Section 4.12 with respect to seismically induced inadvertent actuation of fire protection systems. The IPEEE external flooding analysis does not address seismically induced external floods.
SeismicallyInduced Relay Chaner Descrintion of the issue [29]: Essential relays must operate during and after an earthquake, and must meet one of the following conditions:
remain functional (i.e., without occurrence of contact chattering):
be seismically qualified; or be chatter acceptable.
It is possible that contact chatter of relays not required to operate during seismic events may produce some unanalyzed faulting mode that may affect the operability of equipment required to mitigate the event.
IPEEE guidance specifically requested licensees to address the issue of relay chatter.
The Pilgrim seismic IPEEE has included evaluation and PRA modeling of relay chatter. Relevant information is provided in Sections 3.0.1, 3.1.2.2, 3.1.2.3, 3.1.3.2, 3.1.3.2.3 (detailed discussion of relay chatter events), 3.1.3.2.5.2 (pages 3-65 and 3-68), 3.1.4.2 (page 3-78), and Table 3-12 of the IPEEE submittal.
Evalua: ion of Earthquake Magnitudes Greater than the Safe Shutdown Earthquake Descrintion of the issue [29]: The concern of this issue is that adequate margin may not have been included in the design of some safety-related equipment. As pan of the IPEEE, all licensees are expected to identify potential seismic vulnerabilities or assess the seismic capacities of their plants either by performing seismic PRAs or seismic margins assessments (SMAs). The licensee's evaluation for potential vulnerabilities (or unusually low plant seismic capacity) due to seismic events should address this issue.
The Pilgrim IPEEE has included a seismic PRA, as doumented in Section 3 of the submittd. The seismic input for the PRA is described in Sections 3.1.1. 3.1.4.1, 3.1.4.2, and 3.1.4.3 (description of seismie input to soil-structure interaction analyses). The submittal has not demonstrated that the evaluated plant high-confidence of low-probability of failure capacity spectrum exceeds even the plant's design (SSE) spectrum over all important frequency ranges.
Effects of Hydrogen Line Ruptures Descrintion of the Issue [29]: Hydrogen is used in electrical generators at nuclear plants to reduce' windage losses, and as a heat transfer agent. It is also used in some tanks (e.g., volume control tanks) as a cover gas. Leaks or breaks in hydrogen supply piping could result in the accumulation of a combustible mixture of air and hydrogen in vital areas, resulting in a fire and/or an explosion that could damage vital safety-related systems in the plants. It should be anticipated that the licensee will treat the hydrogen lines and tanks as potential fixed fire sources as described in EPRI's FIVE guide, assess the effects of hydrogen line and tank ruptures, and report the results in the fire portion of the IPEEE submittal.
Energy Research, Inc.
49 ERI/NRC 96-504
r
. ~,
The Pilgrim IPEEE submittal provides no systematic evaluation of the potential and effects of hydrogen line and tank ruptures. However, in the eva!uation of seismicali induced fires, some attention was given f
to the potential for seismically induced failures of components containirg hydrogen. Relevant information can be found in Section 4.12 of the submittal. Additionally, Section 5.3.3 provides information on a walkdown performed to identify hazardous chemicals onsite, including hydrogen.
Energy Research, Inc.
50 ERI/NRC 96-504
3 OVERALL EVALUATION AND CONCLUSIONS 3.1 Seismic For the seismic IPEEE, the licensee has creatively drawn on methods and data from both SPRA and SMA methodologies to analyre the seismic severe accident performance of the plant. The seismic IPEEE of Pilgrim addresses the major elements specified in NUREG-1407 as recommended items that should be considered for a scismic PRA. The submittal itself gives a clear description of the evaluation, and the documentation is considered to be well-written. The seismic fragilities, HCLPF capacities, and core damage /early release frequency results have provided valuable information on the capability of the plant structures and components in response to seismic initiating events.
However, six important weaknesses were identified which raise questions about whether the licensee has met the intent of GL 88-20. Based on this submittal-only review, the following items are viewed as strengths and weaknesses of the seismic IPEEE submittal for Pilgrim:
Strenoths 1.
The level of analysis (SPRA) employed for the overall seismic IPEEE process and the effective use of seismic margin methods for screening and fragility assessments.
2.
The clear and comprehensive documentation provided in the submittal.
The walkdown process, including extensive use of photography.
The useful sensitivity analyses.
The degree of licensee participation in the seismic IPEEE.
Weaknesses 1.
The surrogate element component and structure screening level was not consistent with NUREG-1407 guidance. The screening took place at approximately 0.3g PGA, in contrast with the NUREG-1407 recommendation of a 0.5g PGA review leve! earthquake (RLE) for Pilgrim. The significance of this issue was masked by the fact that there are low capacity components and structures which are below the 0.3g PGA screening level. (It should be noted that the calculated plant HCLPF of 0.25g FGA with operator actions and non-seismic failures and 0.32g PGA with these factors excluded is well below the 0.5g PGA RLE.)
2.
The "as-fixed" seismic CDF and seismic large release results are high compared to other eastern U.S. plants which have performed seismic PRAs. The "as-found" results were not reported. Given the reliance on a non-safets SBO di~e' (including upgrades to that diesel) to perform as an emergency power source (the safety-related emergency diesels are affected by a seismic interaction), additional information and clrdication should have been provided in the submittal.
The significance of the "as-fixed" SBO diesel and the seismic interaction which fails the safety-related diesels is seen in the fact that notwithstanding the fixes, operator errors associated with bringing the SBO diesel online are important contributors to the comparatively high seismic CDF.
Energy Research, Inc.
51 ERl/NRC 96-504 k
o ap 3.
An anomaly of uncertain significance has been introduced into the study and its results by the use of 1989 LLNL seismic hazard values to define the spectral shape, and the use of 1989 EPRI seismic hazard as the basis for CDF and large release quantitication.
4 The seismic fragility assessment did not conform to NUREG-1407 guidance (specifically Sectjon 3.1.1.3 of NUREG-1407). Identical uncertainty parameters were assigned without explanation or justification to diverse components and structures.
5.
The justification provided in response to an RAI regarding the acceptability ofloss of decay heat removal contributing one-third of a comparatively high seismic CDF was inadequate. The licensee stated that a substantial period of time is available for repair and recovery, however this period of time was not mechanistically related to the actual failure modes so that it is not possible to know whether the period of time available for repair and recovery is physically meaningful. This provides an unclear basis for resolving USI A-45.
6.
The basis for resolving the Eastern U.S. Seismicity Issue (Charleston Earthquake) is not correct.
Reliance on NUREG-1407 for resolving this issue is only proper if the study basis is adequate, and the study used a screening value for components and structures which was well below the RLE (0.3g PGA vs. 0.5g PGA). In addition, the study results indicate that the plant HCLPF, either with (0.25g PGA) or without (0.32g PGA) consideration of operator actions and non-seisuuc failures, is well below the RLE (0.5g PGA).
Based on the present review of the seismie IPEEE submittal, it is not clear that the licensee has developed:
(1) an understanding of severe accident behavior in response to earthquakes that may occur at the Pilgrim site, including familiarity with the most likely seismically induced severe accident sequences that could occur at its plant under full-power operating conditions; (2) qualitative and quantitative insights of the overall likelihood of core damage and tission product releases due to earthquakes; and (3) meaningful plant enhancements to reduce the risk of severe accidents, as compared with the "as-found" condition of the plant. Some plant improvements have been committed to in the IPEEE related to the SBO diesel, but it is unclear whether these improvements are soundly based due to deficiencies in the submittal.
In order to address remammg open issues with respect to the present review of the Pilgrim seismic IPEEE.
the review team recommends that the NRC perform the follow-up activities indicated below:
1.
Request the licensee to re-analyze the plant for seismic contribution to severe accidents using an appropriate screening level (0.5g PGA as recommended in NUREG-1407).
2.
Request the licensee to either re-analyze the plant using consistent seismic spectral shape and sdsmic hazard bases or explain why the existing anomalous modeling does not significantly affect the results or insights drawn from the analysis.
3.
Request the licensee to either justify its fragility uncettainty parameter selections or to perform a credible fragility analysis.
4 Request the licensee to mechanistically relate the available time for repairs and recovery of decay heat removal to the seismic failures chich are predicted to occur, and to address whether the available time period is physically meaningful in light of the predicted failures.
Energy Research, Inc.
52 ERI/NRC 96-504
~
5.
Regaest additional information from the licensee concerning the failure mode (s) of the safety-related diesel generators and concerning the rationale for making improvements to the non-safety SB0 diesel instead of the safety-related emergency cliesel generators. Cost-benefit calculations should be requested as well.
6.
Based on the additional information requested above, and the statrs evaluation thereot', consider whether a site audit is needed in order to verify or evaluate the relevance and adequacy of the licensee's proposed plant improvements to the SBO diesel.
Resolution of these items is important to ensure that the study's conclusions are fully justified. Despite these remaining open issues, it is clear that the licensee has benetitted substantially from the USI A-46/IPEEE effort, and that the licensee has improved its understanding of plant behavior in response to potential severe accidents caused by earthquakes.
It is important to make note of the following points with respect to the Pilgrim seismie IPEEE:
The study results assume that plant enhancements have already been made; results for the "as-found" plant condition were not reported.
Resolution of USI A-46 concerns impacts seismie IPEEE issues and results.
Even after plant enhancements, the seismie risk results ti.e., for core damage frequency and early
+
release frequency) for Pilgrim are high in comparison to other plants.
3.2 Eire The licensee has expended considerable effort in the preparation of the tire analysis ponion of the IPEEE.
For the most part the IPEEE report complies with the conditions set fonh in Reference [2].
The following items are identified as the primary strengths and weaknesses of the submittal:
Strermths
)
1.
The submittal is very well written. The overall presentation is clear and well organized. There are suf6eient tables and figures to provide the necessary information to support the analyses and the conclusions.
2.
The final CDFs can be traced back to the initial assumptions and frequencies. As part of this review, some of the calculations were traced through the analysis.
3.
The licensee has done a good job of qualitatively addressing uncertainties. The study event tree / fault tree methodology is sound, and the selection of initiating events makes sense. The study's logie in the development of initiating-event frequencies, and in combining fire frequencies with random failures, is sound.
l Energy Research, Inc.
53 ERl/NRC 96-504
m
,-' :s y y-
'Weakneues 1
1; -
The. operator recovery probabilities for the control room fire scenarios are highly optimistic.
' 2.
T6e time prior to tire-induced control room abandonment'was assumed to be 9.5 minutes, which is not representative of cabinet fire test data.
3.
Seismic-fire interactions (concerning non-!EEE eierit-ical cabinets) have not been adequately
. addressed.
4.
' The potential for active fire barrier element failures was not considered.
5.
The fire compartment interactions analysis did not consider the fire brigade accessing the fire area through adjacent fire zones that contain cable and equipment from a redundant safety train.
3.3 HFO Events The HFO events portion of the IPEEE submittal has generally followed the recommended guidelines and basic steps for analyzing and reporting potential accident scenanos~due to other external events. As judged from this submittal only review, the following items are viewed as strengths and weaknesses of the HFO a
IPEEE submittal for Pilgrim:
Strenphs 11.
The HFO analysis is clearly described.
2.
' The screening basis employed (conformance is SRP criteria or hazard frequency) is clearly identified and referer ed explicitly back to the guidance in NUREG-1407.
- Weaknesses
' No specific weaknesses were identitied.
)
Energy Research, Inc.
54 ERI/NRC 96-504
r l4
-4 IPEEE INSIGHTS, IMPROVEMENTS, AND COMMITMENTS -
i 4.1
. Seismic The' IPEEE results indicate that the CDF for PNPS, due to external events, is 8.02 x 10'8/ry when the seismic CDF contribution (5.82x10/ry) is based on the 1989 EPRI seismic hazard curves, or 1.16 x l'0"
/ry when the seismic CDF contribution (9.39x10/ry) is based on the 1993 Lawrence Livermore National
' Laboratory (LLNL) seismic hazard curves.
The plant high-confidence oflow-probability of failure (HCLPF) capacity has been reported as 0.25g PGA with operator actions and random (non-seismic) failures included, or 0.32g PGA with these actions and failures excluded. The median plant capacity is ren.4 ed as 0.48g PGA with operator and random failures included, and 0.57g PGA without these factco neluded. The frequency of seismically initiated early containment failure was reported es 1.59 x 10/ry based on the EPRI mean hazard curve, and ::s 3.17 x 10'8/ry using the 1993 LLNL mean hazard curve. In terms of both CDF and frequency of early containment failure, the surrogate element contributed less than 5% of the total seismic risk. Failure of high pressure inventory control and failure of containment heat remod were determined to be the important functional failures. This is true, however, because the automatic depressurization system (ADS).
is not available in most seismically initiated sequences, due to the low seismic capacity of the nitrogen I
system an<l the high assumed human error rate for augning containmee heat removal following large earthquakes. The dominant failures contributing to the seismic CDF are nine correlated failure pairs (involving electrical, pump, and surge tank failures), structural failures, and operator action failures (failure to complete procedures involving the station blackout [SBO) diesel and containment heat removal).
1 Single element cutsers (including building structural failures, damage to control rods and vessel internals leading to anticipated vansient without scram [ATWS), and failure of control systems / electrical panels) account for 41 % of the total seismic CDF.
I During the conduct of the seismic PRA, a number of potential plant improvements were identified.
1 Although design details were not available, the SPRA analysis was conducted assuming these issues were addressed and resolved. The following improvements were assumed to have been implemented in the SPRA:
For the emergency diesel generator buildings, the north walls of the structures were identified as potentially limiting for fragility calculations. Sensitivity testing using the SPRA model identified the station blackout diesel (SBO diesel) as an alternative path for emergency power. Walkdowns of the SBO diesel identind o potential weakness in the support of the muffler. Stiffening modifications were assumed in calculating an acceptable ruggedness for this component.
- Power from the SBO diesel passes through Bus A8. Inclusice of this bus in the analysis resulted in identification of two concerns
- (a) a seismic interaction hazard due to potential failure of the main transformer bushing and/or of the adjacent lightning' arrestor; and (b) potential weakness of the friction clip restramts connecting the A8 bus to its concrete foundation slab. These issues were assumed to be resolved in the SPRA.
The licensee has committed to implement these changes.
Energy Research, Inc.
55 ERl/NRC 96-504 I
4.2 Eire The licensee has stated: "Imponant fire sequences are functionally similar to the important internal events sequences. This analysis further supports the IPE insights as to the importance of support systems as: AC power, TBCCW, RBCCW, and SSW. The results show that the fire risk, even conservatively estimated,
' does not present a significant contributor to the overall plant risk. They also show that Pilgrim Station does not contain any significant vulnerabilities or
- outliers' in the tire risk." As a result, no major safety enhancements have been identified by the licensee, and consequently, no commitments were made that would require tracking by the NRC.
The entire fire IPEEE investigation, of course, has provided an excellent opponunity for the licensee's engineers to better learn about the characteristics of the plant, how the plant would behave under fire conditions, and what human actions would be necessary to protect the reactor core from any adverse effects.
,- 4,3 HFO Events With regard to the IPEEE approach and major tindings for HFO events, Reference [1] summarizes:
"PNPS meets SRP criteria or the IPEEE progressive screening approach for all external events except for on-site flooding and roof ponding associated with the new NWS PMP of.17 inches of rain in one hour. ~ The probability of this rainfall is estimated at substantially less than ! x 10*."
As a result, no major safety enhancements have been identitied related to HFO initiators, and consequently, no commitments have been made that would require tracking by the NRC.
i i
j Energy Research, Inc.
5')
ERl/NRC 96-504 i
o 5
IPEEE EVALUATION AND DATA SDDIARY SIIEETS Completed IPEEE evaluation and data summary sheets for the Pilgrim IPEEE are provided in Tables 5.1 to 5.6. These tables have been completed in accordance with the descriptions in Reference [14). Table j
5.1 lists the overall external events results. Table 5.2 summarizes the important seismic PRA fragility i
values. Tables 5.3 and 5.4 provide the BWR Accident Sequence Overview and Detailed tables, l
respectively, for seismic events; and Tables 5.5 and 5.6 provide the BWR Accident Sequence Overview and Detailed tables, respectively, for fire events. The IPEEE submittal does not perform PRA calculations pertammg to any HFO initiator; hence, no data summary tables are provided penaining to the HFO events evaluation.
I J
.i i
i Energy Research, Inc.
57 ERI/NRC 96-504
1 0
n ni 5
u d s n e Ftcd tn Pe n C
a sLpe P eCs m R
l ruI dm N
n
.l I
r
/
io eei ao I
vvfa gz c R
t r r ae la uu r'
E ccm2 h u
o3 s
n a lc ddrd0 a r
F aa rFe am a
aa nsi c
z zaid n
D hhdP mi c
C nn nL r e aces ap aa r
eesI s
o y
e f
mmnI d
t o e0 e o
d Litct I
h0 s N
e R
a
, 0, b s
P Na u
E Lr s0 r 1 8 A
L o to! 9 9
R 8 3 tacI 0 aN0.
P 9 9 r 9 ef d
p L Rs 1
n n
o eL i
1 s
Cs a
ogh e9/ y nt g
es i h 8Gl y
di a
t lo s u wt 9En n1 Ra a
s o
b 5i of h oUn d
0 et i
o i? lui eNg s -
r us h
1 e9 a u na t
m in3v;nh e
a d
m a9Fe ot v=Pd ic e
e c
I r
c FFL ud e m c
e I
n n
n V
n
)
eh l
s s
n n
s o
o o
I o
Dl n
n n
F n
CC!!Ccn a taci o
o t
l ib r s n
n use R
)
h g
1 s
5 n F
is
(
t s
ee P.
ly a
8 bE C
l v
g n
I 5
5 a
a 2
f g
Tl I
a 0
in t
n n
r d
a e
n lP n
tx o
E H
=
O y
y S
r r
/
/
5 5
t; F
0 n
0 D
o E
C E
2 d
2 M
e 2
n 5
eerc S
g
=
n O
ine 0
O O
S 0
S O
0 e
S r
S is c
sy S
lana b
f m
ts i
s c
n t
e i
e n
p e
id e
s r
d c
t c
n
. g c
ic n
I l
i c
a P
n A
l tn i
s y
A P
h e
o n
ty e
d d
i i.
n
=
r t
c v
s o
e E
ir o
i e
li it ta s
a m
F F
W i
c c
i S
l r
e F
a A
t e
F a
e la y
.ic o
g R
N l
l r
a a
n n
m p
s in r
r e
n b
t e
e r
r i
m s
r y
n t
t t
e a
s n
e n
g a
h e
a x
x s
t c
.ic r
t i
n r
i n
c e
E E
l i
N S
T O
lP c
S E
2 N.
D*
40 5
h
-(>
ta P
9 s n C
s o ei R
ct ep A
A A
A A
A A
A A
A N
ni
/
/
/
/
/
/
/
/
/
/
/
r S c N
N N
N N
N N
N N
N l
imD iR s
ce l
isc S
ecn d
d d
d d
d d
d d
d en e
e e
ie e
e e
e e
e uo i
i i
i i
i i
i i
f f
atp it i
f f
f f
f f
Si n
t i
i i
if if i
i i
gi n
t t
t t
t t
t t
n n
n n
n n
n n
r e
e e
e e
e e
e e
e cc d
d ime id d
id d
d i
id d
d i
s i
i i
i i
t isD o
t t
t t
t t
t t
t o
o o
o o
o o
o o
n n
n n
n n
n n
n n
e c
r S
u ila f
)r m
e
)
e g
h t
(
t s
o y
F A
A A
A A
A A
A A
A r
s
)
o P
/
/
/
/
/
/
/
/
/
/
g o
L N
N N
N N
N N
N N
N
(
c t
C if c
I y
d i
l I
c it e
e ir b
p t
l r
s o
t ig n
t o
e n
a e
f
- 2. F i
c j
r r
s t
h 5
o S
ic c
n l
ei l
h 9
b m l
U w
0 0
0 0
0 0
0 0
0 4
l 0
0 0
0 0
0 0
0 0
7 5
s a
(/
ai c
n l
i Te i
ia t
P 0
0 0
0 0
0 0
0 0
0 S
d r
e e
n A
V m
a h
6 6
6 6
6 6
6 6
6 7
R I
t A
1 4
4 4
4 4
4 4
4 3
P N
ss 0
0 0
0 U
0 0
0 0
0 L
e
)
l(
c L
i s
)
f r
i a
ic g
c e
t n(
ep y
ic a
S a
ity 6
1 I
7 2
7 2
4 4
6
)
m p
d i 1
6 6
6 7
7 H
8 9
9 c
e te 0,
a a
U 0
0 0
0 0
0 0
U 0
c Mp
)
i 0
)
S
(
ic I.
ic a
g ty C
1
(
m 5
o R
s P
ic c
l S
1 e
E 0
V l
t l
s u
d L
U s
la e
e la r
N L
w ir t
t n
c L
N h
o e
L L
lo ia z
p
(
i S
L ht f
r L
8 B
o 9
iw A
/
l s
A A
G N
9 t
5 5
l E
P L
1 n
L r
e tn 0
O S
(
a S
9 c
m e
1 n
I 9
e ip n
To g
g T
8 v
d o
i A
H i
n t
in n
2 k
k u
p c
i G
H f
q m
a a l
i B
n 1
3 c
o m
la a
c n
P i
e s
t t
n i
0 e
d C
et c
c n
e I
r l
e e
t s
rk r
n n
gn b
g c
t 1
s n
a a
i r
a ai c
e 0
0 y
a h
r P
c c
m n_
I.
5 9
n o
o r
t o n a
a e
e t
t a
5 4
g 0
e ts a
r n
s m
s p
s s
o ic t
A D
4 6
i l
c ta A
e e
n 2
g e
e a
e a
e H
s n
n p
p l
l d
l m
r r
s h
m a
S N
d d
l "g
p s g x
o la la i
a a e l
s R
a p
A m
n o A
o.
w u
u w
n i
y s
b c
a e r I
I e
h r
T o
dt k
k k
V d
g r
r n
n l
R c
c G
c t
a a
tc o
n i R
l h
l E
r r
e o
i o
D o
0 n
l r
f c
P 8
o C
e la a
a p
t t
u s
o i
i i
i.
Ct R
i B
I I
4 C
A n
R l
P S
C i
l l
I l
^
~
1 3=
g~
)
4 s
g ih 3
0 M
5 w
r s
T g
t I
(
c o
e I.
g C
t u
M M
M S
S t
b in k
i U
lU U
g, N
t I
R I
l S
t I
I I
V.
A
/
tA o,
i I
i lt R
U v'l t
l A
O, g
R O
W S
S N,
g T
sn P
P r
C o
E E
l N.
m I
I I
i D
S D
S S
I'a I
tc P
P n
S p
S A
u C
S C
A c
T I,
g F
C C
/
1 R
R R
R N
M C
n d
L P
L L
I e
P P
P A
t I
I l
V l
P I.
i I
I t
l, m
a l
i S
F I
I 2
T, C
h W
A R
V X
II m
I s
E l,
d' m
t C
T, r
h o
AV H-p W
l a
e p
l l,
i(
l' l
u f
b S
I W
I A
a S
t T
w lT.
R s
o.
I.
I l
2 V
I I
S e
P-A g.
y N.
i r
n l
S, g
v e
T I
p l
v O
1, p,
S 3
tC t
A g
O A
i S.
e, 3 e R
t P
P 1
C l,
g l'
3 5 c n
C fc,
)
f' I
)
n l'
e t
ee v
O O
A T.
1 O
q ic u
E O
O 2
i l
/
A l
C, R
h S
s it.
L L
S S
m N
l A
l' A
a e
I, la TS ie I
T T
I l'
l b
n 1
l e
T.
=
m.
t K
n S
S I,
h e
r W
I R
y u
4 l
d o
IA IN i,
h C
l n
c F
i i
t c
l' ec T.
l A,
f 11 A
y y
y s
/
/
i y
y y
I 2
P, l
r r
r r
r T.
R
/
/
/
/
0 0
0 1
A l
tk C
F 5
5 6
6 6
6 I',
Il S
l W
D 1
1
)
i 1
4 4
X l
l B
C E
E E
E E
E I
A, (C
to.
t t
7 o.
0 3
6 5
T lil NI S,
3 A,
n 2
2 4
3 1
1 M
l T
I l
M
)
C i
A 1
S t
2 C i
.n T.
t i
)
i n.
R, T.
1 t
lCI x
d R
S s
O e
S D
l N
l V.
1l m
1 1A, b I
I' D
A D
l A
(
D A
1 l
l
/
l A.
icd S
y S
lY I
P il I
a C
I 1
R l,
l S,
Al 2
l ie g
W n
a 5,
i C'l i T r
w A
1 e
A(
o C
S tu gA l
g lo g
n m
v r
sV, h
n n
f e
i y
e nikW t
k m
a e
ll tn bC o
l f
e t
I f
o o
e IeI e
e c
U f
n W
2 I
a m
L L
g R
C c
m e
Q r
I I
S o
V ie lp u
T T
S t
e d i i t
c h
l n
f n
t f
o T, i
q r
f r
I o
p I
I o
I t
o g
e S
S S
S u
S e
i w4 o
c i,
s n
is t
m li S
S O
la to S, A
t r
e P
m s W t
ir lc 1
t r
k a
o tp lm3
- u e
e tu o AW m n
s s
a r )m n
l t
o h
t e
N Ii gt r S, A
R u
i i
i s 2
t d
r mW
'u o
n
-s 1
2 3
4 5
w Ae u S.
l t
y i
afe e
g r
t m
n
(
r d
ti n
r a
I
(
s t
K i
r e
l e
l l T- )u e T l
t i
P fu a
t r
ro (-
I S
l' A
l
.p f.
'n Sh g v
v 0
,. 4
..a.
<r.
m v.
M c
f4 E
=
s a
sg Au a
0 3
i.
C" 3
3
.e a.,E
.e a g
.=n,k,
.a w
e
. a u
.i u
~
u
?
[
t:
t3 u
Z L 's L
3}5 L
L~
3
- 1 e
e I, 2
{
e i
4si i
- i..s !
.1 s
s 6
=
Ix a
e y
aC
-g.u u.h y
+
T TU 3 w Jg
~
I k
e g
I J4E
.I.
Efg 1
a a r.:
.a a
=*
m
=t tc m
C 3
2 u3 g
P a
P 5 5 s
u
~s1 w
31
=*
z r,2 s'I
.3 3 2 dj I
a g,s s
>=
a eJ P
eJ 7
.C A
d de d
4 e o
8 E
g=
1 E
hg1-E
.c 2
- z a
5 5
h
)h
== 2 x
x x
33
-cz 23
-:z
-z=ms w
M z.:
et
==
g, 4
22 C
rs L.
r
<a
- a a?
tm x
< -u.
5 3
. =
o A
g e, a
X 7."3 x
rs.
x x
U f 4a S
.N
-~
.= =-
=z
- 4 m-
[ Gr]
3$
L-x U
OGk
-=
m
-=
..re x
h2
.g 6
g.,
x M
- "d u-
=
= L ei E>
=z es*
m a CO E 2E3 x
x c e r*
~d3 23LO id z mL-L x
x
= L *.== % = L *. e x
x H=>
x x
EE>
<OEL H
OIE e=
2m->
&EW
=xE
<=n x
x b5-mz>m X % C ** M L d
O20m 7
Fr mWL E
w
.$ r
<u-
- J er
=
M 3L@
_A
- .s y
1
[
C P
g
=
5 g.
C 3
M" r
=
u x.
e e
e E
e v
=
m M
=
.-2 3
+
e M
I I
I
=
a g
1 a
s.
0 5
p l
4 W
s I
C 6
r e
t C
o u
M M
M u
M y
g l
i u
b t
e i
U U
u I
lu I
l l
R U
i r
e l
l h
t l
t l
l I
l I
m o^- !)
lN 4
S A
I
/
m k
R i
4 ic 3
V 0
"sf E
s m
e n
P P
P P
P P
P t
w-to o
E E
E E
E E
E s
N S
i I
I D
D D
D D
D D
T N.
t P
C, IT l'w c
P P
I m
L L
S S
S S
S S
S L
l N.
H t
a C
C C
C C
C C
w F
L I
I, P
P R
R R
R R
R R
P S
A L
u.
d l
{
l v
e l
{
I I
I l.
I I
L T
I.
e l
P P
P P
P P
P l
l m
ia l
I l
I l
l l
C, C
F l
I l
I l
l l
u A
e-
)
e V
l.
l n
is I.
e r
2 a
T, C
h W
W W
W W
W W
W A
5 t
s S
S S
S S
S S
F y
t o
E E
E E
E E
E N
g W
r g
e W
W W
W, W'
W W
C T.
g, l
p E
n p
c a
u h
A t
S C
C.
C C
C.
C C
A W
g a
y 4
L L
L L
l g
1 c
t I
i s
I I
l h
o C
C C
C C
C C
1 w,
0 k.
a L
B B
B B
B B
B T
T R
R R
R R
R R
T, N
w l
n, l
L e
ki s
Y sA F.
N.
i r
y l
s.
I v
e T
Il, C.
t l
i v
n C,
s s
tn W
W W
W W
P W
W V
P i
s O
O l
a I'
t n
R L
L L
L 1
M O
l E,
tC.
ev F
F F
F F
O F
F I
O C
5 e C
5 c A
E M
M M
M A
O S
S 1
1 M
L f
c H
i
)
L e e P
it l
I 1
T.
T-T-
T-T-
T-T-
E T
T-T T-i A
6 n
lb u t
2 s
i,
q e
l C,
r A,
I a
e r
l E
I.
TS i
i F
C.
l l
T.
t r
D.
I.
n o
S e
d F
W R
4 l'
y y
y y
y y
y y
y y
C i
I i
r r
r r
s r
r r
r r
X l.
N f
I' c
/
/
/
/
/
/
/
/
/
/
c F
6 6
6 6
6 6
6 7
7 7
T, t
11 c A
D 0
0 0
0 0
0 0
0 0
0 T
A, I,
C E
E E
E E
E E
E T
2 l'
1 R
1 1
C E
l.
l.
4 l.
0 5
5 H.
7 5
T, N
D m W
6 3
2 2
2 1
1 9
9 9
X I
S t
R I
A.
C -
t 3
R lT, l
T, 3
H
)
I N
n S
I I
I i
I I
I I
I I
IM C
I D
N N
N N
N N
N N
N N
2A, )
-S P
I
. C n T,
F A r
)
N :
R, a
x I i l
A i
m m
p Cl it e
e o
m V.
A, i
(
e u
1 1
t y s
y r
o u
A.
in m e n,
i r
F Fi R
y P
1 iCs n
g a
e 5,
i.
B W
W i
2 l.
A n
o te C
C F
- s. i C,u g
m m
e t
r o
o S
r n.
r o i e
A m v o
o e
r a
i C
ts C
r m
t ta S
- C l
e R
R t
c B
F D
e o
~
m n
k ga o
c r
r a
I g
T T
W v
f n
a a
r I
o n
i y
m, e
e c
c e
/
r e
/
R o
h r
e m
a u
g g
n g
e i
Wr gr g
k tn e
n W
m F
liw t
n q
h h
e i
C f
F b C.
o r
Ci ini i
F in b
e e
c c
d i
w i
G l
C f
r i
r i
o m
C d
'l d
l m
lwI e
n S
it t
e n
o y
fo T.
t
~,
w C
e l
a d
te a n h
s r
c e
u B
s o
Bm in2 e
f g
e w
n r
B Rri a
R Ro Un r
o e
S S
t u
o s
I o
o p
c s
tw4 n
f r
B A
M i
nm i
t inp w
m __
lc i,
e BF T
lo oita c
s mt s
AR r o i
S b
l t
P n
u n
n r
(
ms b
n t
l r
b w
i A.
r t
i ia ta e r e ia o n
m v
c i
)
n a
a ui r o a
a a e r
e e:
r r
i i tp t
n m
T T
C TP RE C
t o
Aw
- s o
r u el a
s s.
i e
e i
o n
s R
a i
t i
i N
ff t
mw i r
s n 2 w
d c
'i y
n t
i 2
3 4
5 6
7 8
9 a
m f
s, g
c o
n i
n 1
i m.
E
- s d
l a
)
r e
e t
x
- r. ul l
n P
I
(
I s
F i
n a
l
. g.
N$
eO 9
'r v
u u
a v
)
a 2
2 5
.1 e
c 3
5 5
5 5
x Y
4 4
I E
3 9
w o
u
[
g r
r
~
g g,
{
w 5
4 4
4 4
4 N
b t
s 3
2 2
2 2
21 E
E
=
=
=
=
=
M 5
E E
I T
T 0
W" I
=
i I
.E w.
3 g
.g s
.s
.s s
.s J
J 5
I
-r c
a g
~
w w
e e
9 I
s l
3 j
i a
s
[
Y I
I
=
=
3 3
=
=
=
2 2 x
x x
x x
x 33
-02
=k
-z 1
"" Z '3J M b H
2; L,
=C
< a.
L Z-r=
<M
'y M me y
ZA p
<MLL
-.=
03L GF cam x
x
.u e0
- LL X
X
< n y
a
~
M s
AL"
$=4L m=
2
. e, -. e x
x x
Y' $
.C=
E i
~~
t)
LA x
x x
w C k u
\\
bZ I"""
- aL-x x
x l
l c
w
- : ~
O W
8W'9 Pe M
7 y
z^
s
- E 249 x
x x
x x
x x
x x
x A*
- #a
=. 4 ;
g$.=-=
y E,Z
's8"
~~
2L-L X
X x
x x
x x
x x
x a-E ELL-*
LLM x
x x
X X
X X
X X
X r==>
...>p E*-
(OEL OIE yE?
2m->
i
=*
- (k (Om x
x x
x x
x x
2 a G
.m ML L2OM C"
>E C-ra ; O
'Z
.Ih
<2-3
% A EM h
.j A
i e, v N,2 3
F5 3e e
No e
.c
=
s,a z
.=
E gg r-z m u i
Z 4I 5$
EE8 I"
E a
a
.e E. e d" _a.s ~ g T=
< f '1 s ",
3 r.
-s x
.s -
ms C
- g,
.N.
23%
.s -
!)Z 3.a.
E-ee sM s3 A.
.a o p.
g x
G.n e u
e.
/
3 Y,
g
,M' s
s 8v y
j 3*
x
.a e
e Y~
g 3
3 g
g h-
)
g 5
e a
e x
2 r
-:D
=m
==
N
~
w e
e c
en cP M
a===
m
- I A
6 REFERENCES LU A j
1.
" Pilgrim Nuclear Power Station Individual Plant Examination for External Events (GL 88-20),"
Boston Edison Company, Rev. O, July 1994.
2.
" Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities -
10CFR50.54(f)," U.S. Nuclear Regulatory Commission, Generic Letter 88-20, Supplement 4, June 28,1991.
3.
J. T. Chen, et al.,_" Procedure and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," U.S. Nuclear Regulatory i
Commission, NUREG-1407, May 1991.
4.
" Generic Implementation Procedures (GIP) for Seismic Verification of Nuclear Plant Equipment,"
Revision 2, Seismic Qualification Utility Group (SQUG), Febmary 14, 1992.
5.
"A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power Research Institute, EPRI NP-6041-SL, Rev.1, August 1991.
6.
"PRA Procedures Guide," American Nuclear Society and Institute of Electrical and Electronic Engineers, U.S. Nuclear Regulatory Commission. NUREG/CR-2300, January 1983.
7.
" Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150," Sandia l
National Laboratories, NUREG/CR-4840, November 1990.
8.
"Probabilistic Seismic Hazard Evaluation at Nuclear Plant Sites in Central and Eastern United States: Resolution of the Chadeston Issue," Electric Power Research Institute, EPRI NP-6936-D, April 1989 [ Proprietary]
9.
" Revised Livermore Seismic Hazard Estimates for 69 Nuclear Power Plant Sites East of the Rocky Mountains,"'U.S. Nuclear Regulatory Commission, NUREG-1488, April 1994.
10.
" Seismic Hazard Characterization of 69 Nuclear Pour Plant Sites East of the Rocky Mountains,"
Vols.1-8, U.S. Nuclear Regulatory Commission, NUPEG/CR-5250, January 1989.
11.
" Fire Induced Vulnerability Evaluation Methodology (FIVE) Plant Screening Guide," Professional Loss Control, Inc., Electric Power Research Institute, November 1991.
12.
R. T. Sewell, et al., " Individual Plant Examination for External Events: Review Guidance,"
ERI/NRC 94-501, Draft, May 1994 13.
"IPEEE Step 1 Review Guidance Document," U.S. Nuclear Regulatory Commission, June 1992.
14.
S. C. Lu and A. Boissonnade, "IPEEE Database Data Entry Sheet Package," Lawrence Livermore National Laboratory, December 1993.
15.
" Response to Request for Additional Information Regarding the Pilgrim Individual Plant Examination of External Events (IPEEE), (TAC NO. M83660)," letter no. 2.96-081 from E. T.
Boulette, Boston Edison Company, to U. S. Nuclear Regulatory Commission, September 5.1996.
Energy Research. Inc.
64 ERI/NRC 96-504
U 16.
Ie
" Handbook ofliuman Reliability Analysis with Emphasis on Nuclear Power Plant Applica Final Report," Sandia National Laboratories, NUREG/CR-1278, August 1983.
17.
" Masonry Wall Design," U.S. Nuclear Regulatory Commission, IE Bulletin 80-11,1980.
18.
- Seismic Verification of Nuclear Plant Equipment Anchorage, Rev.1," Electric Power Research Institute, EPRI NP-5228, June 1991.
19.
" Seismic Ruggedness of Relays," Electric Power Research Institute, EPRI NP-7147, Febr 1991.
20.
J.W. Reed and R.P. Kennedy, " Methodology for Developing Seismic Fragilities," Electric Power Research Institute, draft, August 1993.
21.
" Seismic Analysis of Safety Related Nuclear Structures and Commentary on Standard for Seismic Analysis of Safety Related Nuclear Structures," U. S. Nuclear Regulatory Commission, ASCE 4-86, September 1986.
22.
" Generic Framework for IPE Back End Analysis," Nuclear Safety Analysis Center, NSAC 159.
October 1991.
23.
" Fire Events Database for U.S. Nuclear Power Plants," Nuclear Safety Analysis Center, Electric Power Research Institute, NSAC-178L, July 1992. [ Proprietary]
24.
" Users' Guide for a Personal-Computer-Based Nuclear Power Plant Fire Data Base," Sandia National Laboratories, NUREG/CR-4586. September 1993.
25.
" Analysis of Core Damage Frequency: Peach Bottom. Unit 2 External Events," Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Rev.1, Part 3 December 1990.
26.
J. A. Lambright, et al., " Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," Sandia National Laboratories, NUREG/CR-5088, January 1989.
27.
" Evaluation of External Hazards to Nuclear Power Plants in the United States, Other External Events," Lawrence Livermore National Laboratory, NUREG/CR-5042, Supplement 2, February 1989.
28.
" Pilgrim Nuclear Power Station Individual Plant Examination for Internal Event per GL 88-20,"
Boston Edison Company, September 1992.
29.
" Staff Guidance ofIPEEE Submittal Review on Resolution of Generic or Unresolved Safety Issues (GSI/US1)," U.S. Nuclear Regulatory Commission, August 21,1997.
Energy Research. Inc.
65 ERI/NRC 96-504
)