ML20212L354

Final Rept, Technical Evaluation Rept on Submittal-Only Review of IPEEE at San Onofre Nuclear Generating Station, Units 2 & 3

ML20212L354
Person / Time
Site:	San Onofre
Issue date:	11/30/1998
From:	Frank M, Khatibrahbar, Sewell R ENERGY RESEARCH, INC.
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML20212L336	List: ML20212L354
References
CON-NRC-04-94-050, REF-GTECI-***, REF-GTECI-045, REF-GTECI-057, REF-GTECI-103, REF-GTECI-131, REF-GTECI-147, REF-GTECI-148, REF-GTECI-NI, RTR-NUREG-1407, TASK-***, TASK-057, TASK-103, TASK-131, TASK-147, TASK-148, TASK-A-45, TASK-OR ERI-NRC-97-507, GL-88-20, NUDOCS 9910080024
Download: ML20212L354 (66)

Text

.

ERIlNRC 97-507 TECHNICAL EVALUATION REPORT ON THE SUBMITTAL-ONLY REVIEW OF THE INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS AT SAN ONOFRE NUCLEAR GENERATING STATION, UNIT 3 2 AND 3 FINAL REPORT November 1998 M. Khatib-Rahbar Principal Investigator Authois:

R. T. Sewell'. M.V. Frank:, M. Kazarians' and R. Vijaykumar Energy Research. Inc.

P.O. Box 2034 Rockville, Maryland 20847 Work Performed Under the Auspices of the United States Nuclear Regulatory Commission Otrice of Nuclear Regulatory Research Washmgton, D C. 20555 Contract No. 04-94-050

' Presently at: EQE International, Inc.,2942 Evergreen Parkway, Suite 302. Evergreen, CO 80439 8 Safety Factor Associates Inc.,1410 Vanessa Circle, Suite 16, Encuutas, CA 92024 1

3 Kazarians & Associates,425 East Colorado Street, Suite 545, Glendale, CA 91205 l

9910000024 990929 i

PDR ADOCK 05000361 1

F PDR

TABLE OF CONTENTS i

i P

V5 EXECUTIVE

SUMMARY

N PREFACE.........

..... ii x

ABBREVIATIONS

..I 1

INTRODUCTION..

I 1.1.

Plant Characterization.

1.2 Oveniew of Licensee's IPEEE Process and Important Insights 2

1.2.1 Seismic.......

...........2 3

1.2.2 Fire.....

4 1.2.3 HFO Events 4

1.3 Oveniew of Review Process and Activities

.5 1.3.1 Seismic 6

1.3.2 Fire 6

1.3.3 HFO Events 7

2 REVIEW FINDINGS 7

2.1 Seismic.

2.1.1 Oveniew and Relevance of the Seismic IPEEE Process.

.7 7

2.1.2 Logie Models.

9 2.1.3 Non-Seismic Failures and Human Actions..

10 2.1.4 Seismic input (GrounJ Motion Hazard and Spectral Shape) 1I 2,1.5 Structural Responses and Component Demands.

13 2.1.6 Screening Criteria.

13 2,1.7 PlantWalkdown Process.

14 2.1.8 Fragility Analysis 15 2.1.9 Accident Frequency Estimates.

16 2.1.10 Evaluation of Dominant Risk Contributors 16 2.1.11 Relay Chatter Evaluation 17 2.1.12 Soil Failure Analysis 18 2.1.13 Containment Performance Analysis.....

2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations.

19

. 21 2.1.15 Treatment of USl A-45.

21 2.1.16 Treatment of GI-131

. 21 2.1.17 Other Safety issues....

22 2.1.18 Process to Identify, Eliminate or Reduce Vulnerabilities 23 2.1.19 Peer Review Process.

. 23 2.2 Fire...

. 23 l

2.2.1 Oveniew and Relevance of the Fire IPEEE Process 24 2.2.2 Resiew of Plant Information and Walkdown....

26 2.2.3 Fire-Induced initiating Events..

27 2.2.4 Screening of Fire Zones 29 2.2.5 Fire Hazard Analysis.

ii ERl/NRC 97-507 Energy Research, Inc.

L

I EXECUTIVE

SUMMARY

This technical evaluation report (TER) documents a " submittal-only" review of the indisidual plant exanunation of extemal events (IPEEE) conducted for the San Onofre Nuclear Generating Station (SONGS),

Units 2 and 3. This technical evaluation review was performed by Energy Research, Inc. (ERI) on behalf of the U.S. Nuclear Regulatory Commission (NRC). He submittal-only review process consists of the following tasks:

Examine and evaluate the licensee's IPEEE submittal and directly relevant available documentation.

j Develop requests for additional infonnation (RAls) to supplement or clarify the licensee's IPEEE e

submittal, as necessary.

i Examine and evaluate the licensee's responses to RAls.

j l

Conduct a final assessment of the strengths and weaknesses of the IPEEE submittal, and develop review conclusions.

i This TER documents ERI's qualitative assessment of the SONGS IPEEE submittal, particularly with respect to the objectives described in Generic Letter (GL) 88-20, Supplement No. 4, and the guidance presented in f

NUREG-1407.

{

Southem California Edison (SCE) Company is the licensee of SONGS. Units 2 and 3. The SONGS IPEEE I

was conducted by SCE. with contractor assistance. The IPEEE submittal considers seismic; fire; and high winds. floods and other (HFO) initiators for the external events analysis. The seismic IPEEE process was i

based on a probabilistic risk assessment (PRA): the fire IPEEE was based on a combination of the Electric Power Research Institute's (EPRI's) fire-induced vulnerability evaluation (FIVE) approach and fire PRA methodology; and HFO events were evaluated using the screening approach from NUREG-1407 and GL 88-20.

Supplement 4. He submittal states that the SONGS IPEEE was performed in accordance with quality assurance procedures. In addition. the submittal notes that all portions of the IPEEE received several levels of review.

He SONGS IPEEE submittal specifies Cycle 7 as the freeze date for the modeling of plant configuration and operation. Documentation of the study was apparently completed in December 1995.

Licensee's IPEEE Process For the San Onofre seismic IPEEE. the licensee elected to perform a new seismic probabilistic risk assessment (SPRA). with a qualitative and quantitative seismic containment analysis. He overall SPRA process followed the methodology described in NUREG/CR-2300 and NUREG/CR-4840. The study employed state-of-the-art methods, current at the time of performance of the IPEEE, in the areas of hazard analysis. response analysis.

and fragility analysis. The SPRA developed a seismic event tree (SET) for modeling seismic damage states, and used the existing individual plant examination (IPE) Level-1 logic models to assess conditional core damage probabilities associated with non-seismic human errors and random failures. The existing IPE Level 2 containment event tree model was used for quantifying release category frequencies for seismic events. A new.

site-specific seismic hazard analysis was conducted by a group cf contractors and reviewers to determine seismic initiating event frequencies, and to characterize the seismic input for dynamic response analyses and ERFNRC 97-507 j

Energy Research. Inc.

v

walkdowns have been undertaken to assist in the resolution of these issues. Seismic-fire interaction issues have been addressed by exammation of the potentials for an earthquake-induced fire event, for inadvertent seismic actuation of the fire suppression system (considering resulting rdverse effects on safety equipment), and for seismically induced failure of the fire protection system. He submittal notes that there are no areas in the plant where inadvertent actuation of fire suppression systems could lead to safety equipment damage that was not already considered in a previous study. Specific inspection and testmg gedures have been instituted to verify the integrity of penetration seals, fire barriers, fire windows, and fi dampers. Regarding USI A-45, it is apparent that decay heat removal capabilities have been addressed in de fire analysis via the IPE models used in the fire CDF evaluation.

In the HF0 analysis, the submittal discusses the effects of the probable maximum precipitation (PMP) on the plant (relevant to GI-103) and notes that the new PMP levels are still lower than the SONGS design basis.

Some information is suppd in the IPEEE submittal which pertains to generic safety issues (GSIs) 147,148 and 172.

Vulnerabilities and Plant Improvements No seismic vulnerabilities were reported in the SONGS IPEEE. A number of anomalous conditions were observed during plant walkdowns; most of these concems were resolved through additional evaluations. but some were addressed by means of plant changes. Following are the plant modifications that have a beneficial impact in the face of seismic events:

Improvement in the reliability of cross-connecting emergency diesel generators between the two units.

Strengthening of the supports of an ammonia tank to eliminate a spill / flood hazard.

Removal of a floor grating surrounding AFW valve actuators to eliminate an interaction hazard.

Removal of a concrete plug surrounding the Unit 2 diesel generator fuel oil transfer piping to improve the seismic capacity of the pipe and to provide a plant configuration consistent with Unit 3.

Fastening together of adjacent electrical cabinets / panels to help prevent interactions and relay chatter.

Stabilizing light fixtures that may interact with electrical cabinets.

No fire-related vulnerabilities have been identified from the SONGS IPEEE. No improvements or commitments were deemed necessary to further reduce the fire risk at the plant.

He HFO analysis for SONGS identified no vulnerabilities from the perspective of severe accident risk due to HFO initiators. No plant enhancements or modifications were reported relevant to HFO initiators.

Obsen ations The SONGS seismic IPEEE has addressed the major elements recommended in NUREG-1407 to be considered for a westem U.S. SPRA plant. He submittal has a number of significant strengths, and no major weaknesses Energy Research. Inc.

viii ERI/NRC 97-507

have been revealed as a result of the present technical review. Some of the more notable strengths of the submittal are as follows:

State-of-the-art SPRA with plant-specific hazard curves, good systems analysis and Level-2 contamment performance analysis Dommant accident sequences clearly developed and described Comprehensive seismic fire / flood interaction walkdown and evaluation Rigorous relay chatter study with fragilities included in systems analysis Screening based on walkdown and a large number of capacity calculations j

+

l It should also be noted that results of the seismic PRA model have been observed to be sensitive to the rate of operator failures in recovering from chatter of diesel generator relays. This issue was investigated by the licensee, who found that resetting these relays is nearly an " automatic" operator action. The licensee also performed a cost benefit analysis. and found that changing the relays was not cost effective.

For the fire evaluation. the licensee has expended considerable effort on its IPEEE. The licensee has employed proper methodology (i.e., the EPRI FIVE methodology and fire PRA). and has employed proper data bases for fire occurrence and suppression system failure rates. The fire IPEEE submittal is well written, with a clear and well-organized presentation. Tables and figures provide considerable supporting information for the analysis and conclusions. The fmal conclusions are reasonable, and are within the range of results expected for a pressurized water reactor (PWR). Clearly, the licensee has gained useful insights from the task of inspecting every part of the plant for potential fire vulnerabilities.

i l

For the HFO evaluation. the licensee implemented the progressive screening method of NUREG-1407.

Verification walkdowns were performed appropriately. After identification of changes made since the OL, an evaluation to determine compliance with the current SRP criteria was performed. and all hazards were found to comply with current SRP cntena. During this process, data associated with the PMP and train, aircraft, sea and highway traffic were updated. The screening methodology appeared to be followed correctly and no significant weaknesses were noted during this review. A significant feature of this study is a detailed comparison of the SONGS 2/3 LTSAR criteria and analysis results with the 1975 SRP for each extemal event.

This comparison provides confidence that all significant HF0 events have been considered, and that no vulnerabilities from the perspective of severe accident risk due to HFO initiators exists at SONGS 2/3.

i Energy Research. Inc.

ix ERI/NRC 97-507

F~

I iI*

PREFACE The Energy Research, Inc., team members responsible for the present IPEEE review documented herein, include:

l Seismic R. T. Sewell*, M.V. Frank firs i

M. Kazarians l

High Winds. Flods and Other External Events R. Vijaykumar, Primary Reviewer R. T. Sewell. M.V. Frank. Secondary Reviewers j

l Review Oversight. Coordination and Integration M. Khatib Rahbar, Principal Investigator, and Review Integration A. S. Kuritzky, IPEEE Review Coordination This work was performed under the auspices of the United States Nuclear Regulatory Commission. Office of Nuclear Regulatory Research. The continued technical guidance and support of various NRC staffis j

acknowledged.

I 1

i l

l l

l

• Responsible for the initial seismic resiew as documented in the ERI/NRC preliminary report dated June 1997.

Energy Research, Inc.

x ERl/NRC 97-507 l

ABBREVIATIONS AC Alternating Current AFW Auxiliary Feed Water ASEP Accident Sequence Evaluation Program ATWS Anticipated Transient Without SCRAM CA Chatter Acceptable CCDP Conditional Core Damage Probability CCF Common Cause Failure CCW Component Cooling Water CDF Core Damage Frequency CFR' Code of Federal Regulations CS Contamment Spray CSS Contamment Spray System CST Condensate Storage Tank CU Chatter Unacceptable CVCS Chemical and Volume Control System DC Direct Current DHR Decay Heat Removal ECCS Emergency Core Cooling System EPRI Electric Power Research Institute ERI Energy Research. Inc.

FCIA Fire Compartment Interaction Analysis

' FIVE Fire Induced Vulnerability Evaluation Method FLB Feedline Break FPS Fire Protection System FRSS Fire Risk Scoping Study FSAR Final Safety Analysis Report FSS Fire Suppression System GERS Generic Equipment Ruggedness Spectrum GI Generic Issue GL Generic Letter GSI Generic Safety Issue HCLPF High Confdence of Low Probability of Failure (Capacity)

HEP Human Error Probability f

HFO High Winds, Floods and Other External Initiators HPSI High Pressure Safety Injection HRA Human Reliability Analysis HVAC Heating. Ventilation and Air Conditioning IN Information Notice IPE Individual Plant Examination IPEEE Individual Plant Examination of External Events IRS In-Structure Response Spectrum l

ISLOCA Interfacing Systems Loss of Coolant Accident LHS Latin Hypercube Sampling LLNL Lawrence Livermore National Laboratory LOCA Loss of Coolant Accident Energy Research, Inc.

xi ERI/NRC 97-507 Ia

LOSP Loss of Offsite Power LPG Liquefied Propane Gas LPSI Low Pressure SafetyInjection

'MCC Motor Control Center MOV Motor-Operated Valve MSLB Main Steamline Break MSRP Multiple System Response Program NEDO Nuclear Engineering Design Organization i

NRC United States Nuclear Regulatory Commission NSAC Nuclear Safety Analysis Center (of EPRI)

NSSS Nuclear Steam Supply System OA Operator Action OL Operating License PGA Peak Ground Acceleration i

PMP Probable Maximum Precipitation PRA Probabilistic Risk Assessment PSF Performance Shaping Factor PSV Pressurizer Safety Valve PWR Pressurized Water Reactor RAI Request for AdditionalInformation RCP Reactor Coolant Pump RCS Reactor Coolant System RLE Review Level Earthquake RPV Reactor Pressure Vessel RWST Refueling Water Storage Tank S.

Spectral Acceleration SBO Station Black-Out SCBA Self-Contained Breathing Apparatus SCE Southem Califomia Edison SDC Shutdown Cooling SDS Seismic Damage State SEL Seismic Equipment List SEP Systematic Evaluation Program SET Seismic Event Tree SEWS Seismic Evaluation Work Sheet SGTR Steam Generator Tube Rupture SMA Seismic Margins Assessment SONGS San Onofre Nuclear Generating Station (Units 2 and 3)

SPRA

' Seismic Probabilistic Risk Assessment SQUG Seismic Qualification Utility Group SRL Seismic Relay List SRP Standard Review Plan SRT Seismic Review Team SSE Safe Shutdon Earthquake

~SSI Soil-Structure Interaction SWC Saltwater Cooling TER Technical Evaluation Report Energy Research. Inc.

xii ERI/NRC 97-507

m i

UFSAR Updated Final Safety Analysis Report UFHA Updated Fire Hazard Analysis

-UHS Uniform Hazard Spectrum USI Unresolved SafetyIssue l

I i

1 5

Energy Research, Inc.

xiii ERI/NRC 97 507

o I'

INTRODUCTION

- This techmcal evaluation report (TER) documents the 'results of the "subnuttal-only" review of the indisidual plant exammaten ofetternal events (IPEEE) for the San Onofre Nuclear Generating Station (SONGS), Units 2 and 3 [1].. This technical evaluation review, conducted by Energy Research, Inc. (ERI), has considered various external initiators, including'scismic events; fires; and high winds, floods, and other (HFO) external events.

The U.S. Nuclear Regulatory Comnussion (NRC) objective for this review is to determme the extent to which the IPEEE process used by the bcensee, Southern Califomia Edison (SCE), meets the intent of Generic Letter (GL) 88-20, Supplement No. 4 [2]. Insights gained from the ERI review of the IPEEE submittal are intended to provule a reliable perspective that assists in makmg such a determmationc This review involves a qualitative evaluation of the licensee's IPEEE submittal, development of requests for additional information (RAls),

evaluation of the licensee responses to these RAls, and finalization of the TER.

. The emphasis of this review is on describing the strengths and weaknesses of the IPEEE submittal, particularly in reference to the guidelines established in NUREG-1407 [3]. Numerical results are verified for reasonableness, not for accuracy, however, when encountered. numerical inconsistencies are reported.

The remainder of this section of the TER describes the plant configuration and presents an oversiew of the licensee's IPEEE process and insights, as well as the review process employed for evaluation of the seismic, fire, and HFO events sections of the SONGS IPEEE submittal. Sections 2.1 to 2.3 of this report present ERI's detailed findmgs related to the seismic, fire, and HFO events reviews, respectively. Section 2.4 identifies the locations in the IPEEE submittal where information having potential relevance to generic safety issues (GSIs) 147,' 148 and 172 may be found. Sections 3.1 to 3.3 summanze ERl's overall evaluation and conclusions from the seismic. fire, and HFO events reviews. respectively. Section 4 summarizes the IPEEE insights, improvements, and licensee commitments. Section 5 includes completed IPEEE data summary and entry sheets. Finally. Section 6 provides a list of the references cited in the TER.

I,1 Plant Characterintion

. SONGS consists of two operating units Units 2 and 3, which received operating licenses in the early 1980's.

As oflate 1992, operations at Unit I were ceased. Units 2 and 3 are pressurized water reactor (PWRs), each with a nuclear steam supply system (NSSS) designed by Combustion Engineering. The plant is located on the Pacific coast of southem Califomia in San Diego County. approximately 62 miles southeast of Los Angeles and 51 miles northwest of San Diego. Unit 2 began conunercial operation in August 1983, and Unit 3 commenced commercial operation in April 1984.

Units 2 and 3 are essentially identical, and have provisions for limited sharing of altemating current (AC) power systems and cooling water intake structures. The units share a common control-room complex, radwaste facilities, instrument air / nitrogen system and emergency heating, ventilation, and air conditioning (HVAC) systems. The emergency core cooling system includes two refueling water storage tanks, instead of the usual

' single tank. with aspect ratios, measured from the water line, ofless than 1. Each unit has a conJensate storage tank which is required for successful operation of the auxiliary feedwater system.

There are only a few fire compartments shared between the two units. the most prominent being the control-room complex. The two horseshoe-shaped main control panels for the two units are contiguous. However, Energy Research. Inc.

1 ERI/NRC 97-507 e

/d

m each unit has its own cable spreading room. There are several fire compartments that contain offsite-power-related circuits from both units. 'Ihe two turbine generators are not covered with a roof. They are exposed to the elements from above.

(

The safe shutdown earthquake (SSE) for San Onofre is characterized by a 0.67g peak ground acceleration (PGA) for horizontal motion. The plant rests on a deep soil deposit, characterized in the submittal as stiff well-graded sands.

1.2 Overview of Licensee's IPEEE Process and Imnortant Insights 1.2.1 Seismic San Onofre is assigned. in NUREG-1407, as a westem U.S. plant where seismic margin methods do not apply.

The licensee performed a new Level-1 seismic probabilistic risk assessment (SPRA), with a qualitative and quantitative (Level-2) seismic contamment analysis. The overall SPRA process followed the methodology described in NUREG/CR-2300 [4] and NUREG/CR-4840 [5]. The SPRA developed a seismic event tree (SET) for modeling seismic damage states, and used the existing individual plant exammation (IPE) Level-1 logic models to assess conditional core damage probabilities associated with non-seismic human errors and random failures. The existing IPE Level-2 contamment event tree model was used for quantifying release category frequencies for seismic events. A new, site-specific seismic hazard analysis was conducted by the licensee to determine seismic initiating event frequencies and to characterize the seismic input for dynamic response analyses and fragdity calculations. Probabilistic calculations of structural responses and component demands were perfbrmed based on a suite of ground motions and dynamic modeling parameters developed by means of Latin Hypercube Sampling (LHS). New soil-stmeture-interaction (SSD dynamic response calculations were performed based on existing dynamic building models. Plant seismic walkdowns were conducted using the procedures desenbed in Electric Power Research Institute (EPRI) NP-6041-SL [6]. and seismic evaluation work sheets (SEWSs) were completed as part of equipment reviews.

In general. the study addresses all major elements of concem for SPRA evaluation. as recommended by NUREG-1407 for the IPEEE of a western U S. plant. Aside from issues directly pertaining to safe shutdown and containment performance. the study considers relay chatter. soil failures. seismic-fire interactions, seismically induced floods a few sensitivity analyses and applicable genene issues (Gls) and unresolved safety issues (USIs). The specific elements of the San Onofre seismic IPEEE. as described in the submittal report.

include:

Review of plant information Seismic hazard analysis Selection of systems and equipment Seismic plant walkdowns Analysis of plant systems Stmetural response evaluation Evaluation of component fragilities and failure modes

+

Consideration of non-seismic failures and human actions

+

Relay chatter evaluation Soil failure analysis (soil liquefaction and displacements / settlements)

+

Seismically induced flooding evaluation Consideration of seismically induced fires Energy Research. Inc.

2 ERI/NRC 97-507

L Risk quantification' and accident sequence assessment 4

Sensitivity' analyses Analysis of contamment performance

~

a ~

Evaluation of USI A-45, GI-131, and other seismic safety issues

+

Peer review -

Documentation A total of 594 items of equipment were evaluated during the seismic walkdowns, most of which were screened out from further evaluation Over 150 components were evaluated by means of either prelinunary or detailed fragility calculations, in addition to fragility evaluations for numerous relays (at least 30).

The seismic core damage frequency (CDF) was determined to be 1.7x104 per reactor year (ry). The plant median capacity was reported as approximately 1.7g for PGA, or 3.8g for spectral acceleration (S.) averaged over the frequency range of I to 10 Hz. The plant high-confidence oflow-probability of failure (HCLPF) capacity was reported to be about the same as the SSE. that is,0.67g PGA or 1.5g S,(1-10 Hz). From the submittal, it can be surmised that the following constitute the dommant contributors to the seismic CDF:

Failures of switchgear and motor control centers (MCCs)

I a

Failure of the auxiliary building i

Random failures of emergency diesel generators, auxiliary feedwater (AFW);

Human errors regarding condensate make-up and battery chargers.

' Quant:6 cation of seismic release category frequencies revealed oniv two early radiological release categories with measurable frequency (i.e. contributing at least 0.1% to total seismic CDF).. Rese two categories are f

. (1) contamment bypass with less than 0.1% of volatiles released (2.6x10 /ry), and (2) early/ isolation failure 4

with up to 10% of volatiles released (3.9x10 /ry).

d

- Based on the seismic IPEEE findings, the licensee reports no specific seismic vulnerabilities with respect to safe shutdown or contamment performance, but has identified six plant changes that have a beneficial impact on seismic safety.

1.2.2 Fire The licensee has conducted an extensive and detailed analysis of potential fire events at SONGS. Several data

- bases, related documentation. and calculation worksheets have been produced to establish, and keep track of, fire-related plant features, including fire zones and areas. Logic models developed for the IPE weie used in

' the fire analysis. Several extensive walkdowns of the plant have been conducted to support the analysis. A combination of EPRFs fire-induced vulnerability evaluation (FIVE) [7] and fire probabilistic risk assessment (PRA) methodologies has been used for the fire analysis. The fire frequency data and fire protection system unavailabilities 'provided in the FIVE documentation were used for fire scenario quantification. The formulations in EPRI's FIVE model and the COMPBRN IIIe [8] computer program have been used to evaluate fire propagation. detection and suppression. and cable and equipment damage. Special attention has been given to human actions. For evaluation of redundant-train failure probability, the IPE models of the plant have been l

used.

- Multi-stage screemng and detailed analyses were employed in three phases to identify the dominant contributors t

to fire CDF, De first two phases were identical to those prescribed in FIVE. Initially, Revision 0 of FIVE was Energy Research, Inc.

3 ERI/NRC 97-507 1

I

employed, and subsequently, the unscreened fire compartments were reanalyzed using the methodology as modified in Revision 1. In the third phase, plant areas that did not screen out in the first two phases were subjected to a detailed analysis using fault trees, COMPBRN IIIe, and other fire-PRA-style modeling techniques. The screening was based on deterministic factors (Phase I) and on a CDF threshold of 10 per 4

reactor year (ry).

The licensee has assessed the overall fire CDF for " unscreened" scenarios to be 1.6x10 /ry The main 4

contributors to this fire CDF are two switchgear rooms, two penetration rooms, the turbine building, the relay room, and the diesel generators. De licensee has addressed the potential for fires in the control room and cable spreadmg room of the plant, but both areas screened out at different stages of the analysis. The possibility of fire propagation among adjacent compartments has been addressed.

The licensee has also addressed Sandia's fire sisk scoping study (FRSS) issues and USI A-45. For both cases, the licensee's study has dealt with the relevant concerns, and has not revealed any outstanding problem areas, ne licensee has concluded that there are no significant fire vulnerabilities at SONGS. Sever.1 improvements are mentioned in the submittal. but all of them are attributed to a previously completed study.

1.2.3 HFO Events The licensee has conducted a screemng analysis for HFO events consistent with and exceeding the requirements of NUREG-1407. The licensee used Updated Final Safety Analysis Report (UFSAR) information, updated information from recent data collection efforts. a walkdown. and analyses completed since the issuance of the operating license to perform the IPEEE assessment. First, a generic list of external events was screened to detennine the significant HFO events at SONGS and to assure that essentially all hazards have been included in the review. High winds and tomadoes. extemal floods. and transportation and military facility accidems survived the screening. These events were reviewed to verify that the plant is stillin conformance with the j

UFSAR. which in tum. complies with the 1975 Standard Review Plan (SRP). A walkdown was performed and documented by the licensee staff to verify that the plant conditions and configuration with respect to the external hazards had not significantly changed since the UFSAR evaluation. The licensee also provided a detailed comparison of the SONGS 2/3 UFSAR enteria and analysis results with the 1975 SRP for each HFO extemal event.

Since the design of the San Onofre plant considered external events consistent with the 1975 SRP, all HFO initiators were screened out. The IPEEE for the San Onofre plant has identified no vulnerabilities associated with any severe-accident risk from HFO initiators. The licensee has not considered any plant-specific improvements. Hence, no fixes or commitments related to HFO events are planned.

1.3 Overview of Review Process and Activities In its qualitative review of the SONGS IPEEE. ERI focused on the study's completeness in reference to NUREG-1407 guidance; its ability to achieve the intent and objectives of GL 88-20, Supplement No. 4: its strengths and weaknesses with respect to the state-of-the-art: and the robustness ofits conclusions. This resiew did not emphasize confirmation of numerical accuracy of subinittal results; however, any numerical errors that were obvious to the reviewers are noted in the review findings. The review process includes the following major activities:

Energy Research. Inc.

4 ERI/NRC 97-507

m

)

Completely examine the IPEEE and related documents Develop a prelimmary TER and RAls Examme responses to the RAls Iinalize this TER and its findings Because these activities were performed in the context of a submittal-only review, ERI did not visit or an audit ofeither plant configuration or detailed supporting IPEEE analyses and it is important to note that the ERI review team did not verify whether or not the lata presented in matches the actual conditions at the plant, and whether or not the programs or procedures de licensee have indeed been implemented at SONGS.

1.3.1 Seismic In conducting the seismic review, ERI generally followed the emphasis and guidelines desc IndividualPlant Examination ofExtemalEvents: Review Guidance [9], for review of a seismic PRA. a guidance provided in the NRC report,IPEEEStep / Review Guldance Document [10]. In addition, on basis of the San Onofre IPEEE submittal. ERI completed data entry tables developed in the LawTen Livermore National Laboratory (LLNL) document entitled "lPEEE Database Data Enty Sheet In its review of the SONGS seismic IPEEE, ERI examined Sections 1. 2. 3, 4.6.1, 6. 7, and 8 of the IP subnuttal [1] as well as additional information provided by the licensee (including the licensee's r RAls) [12-14). The checklist ofitems identified in Reference [10] was generally consulted in con seismic r. view. Some of the primary considerations in the seismic review have included (among othe following items:

Were appropriate walkdown procedures implemented, and was the walkdown effort sufficient to accomplish the objectives of the seismic IPEEE?

Were proper methodology and data applied in the evaluation of seismic hazard, have the seismic hazard results been characterized in an appropriate way. snd do the results appear reasonable, including the uncertainties in seismic hazard?

Was the plant logic analysis performed in a manner consistent with state-of-the-art practices? Were random and human failures properly included in such analysis?

Were component demands assessed in an appropriate manner, using valid seismic motion input structural response modeling. as applicable? Was screening appropriately conducted?

Were fragility calculations performed for a meaningful set of components, and are the fragility resu reasonable?

Are there any under<onservatisms or significant over-ce'servatisms in the analysis that would act to

+

obscure dominant risk contributors and/or produce an invalid numcrical estimate of CDF?

Was the approach to seismic risk quantification appropriate, and are the results meaningful?

Energy Research. Inc.

5 ERI/NRC 97-507

Does the submittal's discussion of qualitative assessments (e g., containment performance analysis, a

seismic-fire evaluation) reflect reasonable engineering judgment, and have all relevant concerns been addressed?

Has the seismic IPEEE produced meaningful findings, has the licensee proposed valid plant improvements, and have all seismic risk outliers been addressed?

1.3.2 Fire During this technical evaluation, ERI reviewed the fire-events portion of the IPEEE for completeness and -

consistency with past experience. This review was based on consideration of Sections 1, 2,4,6, 7, and 8 of Reference [1], and Reference [14]. The guidance provided in References [9] and [10] was used to formulate the review process and the organization of this document. The data entry sheets used in Section 5 have been completed in accordance with Reference [11].

The process implemented for ERI's review of the fire IPEEE included an exammation of the licensee's methodology, relevant data, and results. ERI reviewed the methodology for consistency with currently ac and state-of-the-an methods, paying special attention to the screening methodology and to the procedure used for estimating the frequency of occurrence of a fire scenario, in order to ensure that no fire scenarios were prematurely eliminated. The data element of a fire IPEEE includes, among others, such items as:

cable routing a

fire zone / area partitioning

+

fire occurrence frequencies

+

e event sequences fire detection and cuppression capabilities a

The conditions desenbed and the information provided by the licensee were evaluated to detennine their reasonableness, and their similarity with other fire PRAs. For a few fire zones / areas that were deemed important, ERI also attempted to verify the logical development of the screening justifications / arguments (especiallyin the case of fire zone screening) and the computations for fire occurrence frequencies and CDF.

1.3.3 HFO Events The review process for HFO events closely followed the guidance provided in the report entitled 1PEEE 1 Review Guidance Document [10]. This process involved examinations of the methodology, the data used, and the results and conclusions derived in the submittal. Sections 1. 2,5, 6, 7 and 8 of the IPEEE submittal

[1] and were examined in this HFO-events review as well as additional information provided by the licensee in response to RAls [14]. The IPEEE methodology was reviewed for consistency with currently accepted practices and NRC recommended procedures. Special attention was focused on evaluating the adequacy o data used to estimate the frequency of HFO events, and on confirming that any analysis of SRP conformance was appropriately executed. In addition. the validity of the licensee's conclusions. in consideration of the results reported in the IPEEE submittal, was assessed. Also results pertaining to frequencies of occurrence of hazards and pertaining to estimates of conditional probabilities of failure, if any, were checked for reasonableness. Review team experience was relied upon to assess the validity of the licensee's evaluation.

Energy Research, Inc.

6 ERI/NRC 97-507

2 REVIEW FINDINGS l

2.1 Seismic A summary of the licensee's seismic IPEEE process has been described in Section 1.2. Here, the licensee's seismic evaluation is examined in detail, and discussion is provided regarding significant observations encountered in the present review.

2.1.1 Overview and Relevance of the Seismic IPEEE Process a.

Seismic Review Category and Review Level Earthquake (RLE) l NUREG-1407 identifies San Onofre as a western U.S. plant where seismic margin methods do not apply. An SPRA supplemented with the enhancements described in Section 3.1.1.4 of NUREG-1407, or other systematic exanunation method of equivalent or greater complexity and detail, has been recommended by the NRC for the SONGS seismic IPEEE process. As part of this IPEEE process, NUREG-1407 indicates that a site-specific seismic hazard analysis should be performed for the following purposes: (1) to develop a seismic hazard curve I

that enables the quantification of frequencies of seismic events (i.e., ground motion intervals); and (2) to define a RLE spectral shape for the plant, to be used in characterizing the seismic demand for component (stmeture and equipment) fragility analyses and other evaluations (e g., soil failure analyses).

b.

SeismicIPEEEProcess The licensee has elected to perform an SPRA following the general guidance outlined in NUREG-1407. The licensee undertook a site-specific seismic hazard analysis and conducted extensive plant walkdowns.

Qualitative assessment and quantitative analysis (Level-2 SPRA) were employed for the evaluation of seismic contamment performance.

To help ensure that the IPEEE findings would address both units of the plant, the licensee identified differences in the seismic con 6gurations of Units 2 and 3 by means of a walkdown. One modification was made to bring both units into closer confonnity with respect to seismic response. This involved removal of a concrete plug surrounding the Unit-2 diesel generator fuel oil transfer piping to improve the seismic capacity of the p.)e and to provide a plant configuration consistent with Unit 3. This allowed the study, which focused on Unit 2. to also apply to Unit 3.

c.

Review Findmgs The overall process undertaken for the San Onofre seismic IPEEE is consistent with the recommended guidelines ofNUREG-1407. The general seismic IPEEE methodology is appropriate and relevant to severe-accident analysis and vulnerability assessment.

2.1.2 Logic Models The SONGS SPRA plant logic analysis has included the following major aspects: (a) description of seismic initiating events. (b) development of a seismic event tree (SET) and fault trees, and (c) use ofIPE event trees and fault trees.

Energy Research. Inc.

7 ERl/NRC 97-507

a Seismicinitianng Events Occurrence of a seismic event (S) was defmed to be the initiator and the entry point to the plant seismic logic model(i.e.,is the Srst event in the SET). Frequencies of seismic events (ground motions) were derived from a seismic hazard curve.

b.

Seismic Event Tree A seismic event tree was constructed to map the seismic initiator, S, to seismic damage states (SDSs),

considermg the potential for seismically induced component failures. Some SDSs were characterized by core.

damage, whereas others defmed a degraded plant condition for which subsequent combinations of random and human failures could lead to core damage. Success / failure probabilities for SET top events were derived from supporting seismic fault tree models.

The SET top events included the following:

S Seismic initiator (occurrence of ground motion at the site)

OP Failure / success of offsite power IN Failure / success ofinstrumentation and control DC Failure / success of direct current (DC) power DG Failure / success of emergency electrical power supplied by diesel generators SL Occurrence /non-occurrence of a seismically induced small loss-of-coolant accident (LOCA)

SWR - Failure / success of emergency 4kV and 480V switchgear and MCCs CST Failure / success of condensate storage tanks (CSTs)

CC Failure / success of component cooling water (CCW) and saltwater cooling (SWC)

RW Failure / success of refueling water storage tank (RWST) for injection or emergency boration TD Failure / success of the turbine-driven AFW pump c.

Use ofIPE Event Trees and Faidt Trees SDSs associated with a degraded plant condition (other than core damage) constituted initiating events that were analyzed further by means of plant logic developed for the IPE program for analysis ofintemal events.

Applicable IPE event trees and fault trees were modified, as necessary, to be consistent with the seismic effects modeled in the SET. These models were quantified to evaluate a conditional core damage probability (CCDP) associated with each SDS. the SDS frequency multiplied by the CCDP produced a core damage frequency contribution essociated with the SDS.

As indicated in Table 3 2-1 of the submittal. a number of IPE initiating events were screened out of the IPEEE model, including the following:

Main steamline breaks (MSLB) and feedline breaks (FLB)

Medium and large LOCAs Steam generator tube ruptures Interfacing systems LOCAs (ISLOCAs)

Reactor pressure vessel (RPV) rupture Those initiatmg events that were incorporated in the IPEEE model were:

Energy Research. Inc.

8 ERI/NRC 97-507 i

Loss of offsite power / station blackout (SBO)

Anticipated transient without scram (ATWS)

Small LOCA and small-small LOCA Turbine trip and loss of power conversion system assumed to occur with loss of offsite power A seismic equipment list (SEL) was developed based on components included in the seismic plant model, as well as components included in other aspects of seismic evaluations (contamment performance, seismic-

' fire / flood interactions, etc.). A list of 594 coups for Unit 2 was provided in the submittal (Table 3.11-1).

' d.

Review Findings The logic modeling process for the San Onofre SPRA represents a meaningful and relevant approach with respect to NUREG-1407 guidelines.

2.1.3. Non-Seismic Failures and Human Actions a.

Overall Treatment For the San Onofre seismic IPEEE. the licensee has explicitly included the effects of non-seismic failures and human actions in the SPRA. The SET nodal equations incorporate the human actions required in the event of earthquake induced failures. The IPE event trees and fault trees model the effects of random failures and of human actions that may (post-initiator actions) or may not (pre-initiator actions) be impacted by the I

occurrence of an canhquake. To be consistent with conditions modeled in the SET, the IPE models were modified as needed for each seismic damage state.

b.

Human Reliability Analysis he submittal provides a description of the human reliability analysis (HRA) performed for the following two types of post-initiator operator actions: (1) actions that mitigate random. non-seismic failures: and (2) actions that mitigate seismically induced failures. Dese two actions are termed, respectively, seismic operator actions and non-seismic operator actions. The submittal provides a list of each of these types of actions. and therein indicates the initial (IPE) error rates and the error rates after application of performance shaping factors (PSFs). Noting the lack of technical guidance in this area. performance shaping factors were developed in the same spirit as those at Diablo Canyon. However, instead of using earthquake magnitude as the independent parameter, the SONGS study assumed a severe canhquake (one that would at least knock operators to the

. ground) and used time available for action as the independent parameter. The PSFs are shown belew:

Seismic PSF for.

Short tune available Moderate time available Long time available (less than 20 mini (between 20 and 60 min 3 (between 1 and 24 hrs)

Actions in control room 10 5

1 Actions outside of control 30 10 5

room Specific operator actions were included in the SPRA model for the recovery of relay chatter and to respond to other seismic-unique situations. The licensee has provided a list of human actions considered in the SPRA model, and has indicated the location where each action must be performed. Reference [13] prosides a detailed Energy Research, Inc.

9 ERI/NRC 97-507

description of the steps taken to develop the human error probabilities (HEPs). This included a walkdom of all operator paths to perform out of control room actions, and a qualitative assessment of the availability of the paths.

Each HEP is based on a thorough task analysis and the Accident Sequence Evaluation Program (ASEP)

I methodology. The task analysis includes accident sequence description, time line. competing actions, consequences of failure, quality of crew training and experience, clarity of procedures, availability of imiimimdqueues, consideration oflocal actions (if any) and communication with local operators, and stress level.

j c.

Random Failure Rates

)

Random failure rates used in the SPRA were taken from the IPE analysis.

d.

Review Findmgs The licensee's modeling of non-seismic failures and human actions is well explained and it is judged to satisfy the requested guidelines of NUREG-1407 for a seismic PRA. A review of the Operator Action Data Sheets

[13] indicates that the analysis was thorough and the results are reasonable. Approximately half of the HEPs were calculated as greater than 0.1, and all but two were greater than 3x10-2 after PSFs were applied.

The licensee performed a sensitivity study where HEPs for the seismic operator actions were set to 1.0, providing the insight that the seismic CDF increases by ab:,ut an order of magnitude if recovery of relay and process-switch chatter for the diesel generators does ncr. occur. This HEP is reasonably analyzed using the qualitative and quantitative procedure described above. It is a sine.>le and straightforward action done in the control room. Using ASEP methodology. the results of which are typically conservative, this HEP is 10" In response to an RAI. the licensee performed a cost benefit analysis which clearly indicated that replacement of the relays with a more rugged variety would not be cost effective.

2.1.4 Seismic Input (Ground Motion Hazard and Spectral Shape) a.

Seismic Ha:ard Analysts A detailed. site-speci6c seismic hazard study was pedormed specifically for the SONGS seismic IPEEE. This

)

analysis was conducted by a team of three contractors having the following responsibilities: (1) characterizing seismic sources. including their geometries and seismicity parameters; (2) recommending applicable ground-motion attenuation relationships; and (3) analyzing historical seismicity and performing hazard computations.

Uncertamties in tectonics and the characteristics of seismic sources, in seismicity parameters, and in ground-motion relations were included in the seismic hazard analysis. in order to derive an estimate of the overall uncertainty in hazard results. Site specific uniform hazard spectra were obtained to characterize the seismic input for response calculations and component fragility evaluations.

l b.

GroundMonon Charactert:ation The hazard results are applicable to free-field motions at the ground surface (top of soil). The ground motion parameter used as the basis for the seismic hazard curve was average spectral acceleration (SJ over the frequency range of I to 10 Hz.

Energy Research. Inc.

10 ERI/NRC 97-30?

c.

Review Findings The site-specific assessmem of seismic hazard was bast d on a state-of-the-art approach. The process followed in developing a seismic input spectrum and the ground motion hazard, for use in the SONGS seismic IPEEE, is consistent with the relevant guidelines presented in NUREG-1407.

2.1.5 Structural Responses and Component Demands The licensee generated new in-structure response spectra (IRS) based on time-history analysis of soil-structure-interaction (SSI) models, using existing three-dimensional stick-model representations of buildings. The following seismic Category-I structures were addressed in this analysis:

Auxiliary building Containment / intemal structure Safety equipment building Diesel generator building Condensate and refueling water storage tank enclosure building Intake structure Masonry block walls were not included in the assessment because there are no lightly reinforced masonry block walls that can adversely affect equipment on the SEL The few block walls in safety related buildings are not load bearing and consist ofloose solid blocks for fill of equipment access openings. 'Ihis fill is restrained on both sides by steel members (a typical detail is provided in reference [13]). Fragility calculations were not performed for block walls. The overall IPEEE approach for assessing structural responses and component demands consisted of the following steps:

Specify the free-field ground motion Develop soil models Compute free-field soil responses and determine strain-compatible soil properties Calculate foundation impedance functions and wave scattering effects Model the characteristics of the fixed-base structure Perform the SSI analysis for the coupled soil-structure system Conduct SSI analyses for a suite ofinput combinations to develop probabilistic re jonses Response calculations were performed for two levels of seismic excitation: (a) the SSE level, and (b) twice the SSE level. Each of the aspects of the preceding analysis is summarized briefly below.

a.

Free-Field GroundMotion Uniform hazard spectral (UHS) shapes (for exceedance probabilities consistent with the SSE and 2=SSE levels) were used to define the characteristics of the free-field motion (located a"he soil surface, away from structures). An ensemble of 26 empirical time histories consistent with the UHS shapes were developed. These motions were scaled to a common value of the ground motion parameter S,(1-10 Hz).

Energy Research, Inc.

I1 ERI/NRC 97-507 l

r b.

SollModeling A =impliM low-stram shear-wave velocity profile was developed considering the effect of structural weight on soil confmement An equation relating shear modulus to overburden pressure was used for evaluating shear wave velocities with depth, accounting for the buoyant effects of water pressures. This model was used as a

- single, best-estimate of the soil profile. The submittal notes that the average shear wave velocity in the upper 15 ft of soil was measured to be 930 feet per second. which is well within the empirical database as reported in reference [12].

Compute Free-Field Response and Determine Strain-Compatib e Soil Properties c.

Results of existing field seismic surveys and laboratory tests produced site-specific cun'es of shear modulus and damping as functions of soil shear strams These curves were used, together with ground motions defining the SSE and twice-SSE level. as inputs to the SHAKE computer program [15] for computing responses of the soil model.

d Calculate Foundanon Impedance Funcnons and Wave Scattering Effects Foundation impedances for surface-founded structures were calculated using the CLASS I computer code [16],

and corrections for embedment effects were determined from the CYLREC computer code [17]. Wave scattering effects were modeled using the SASSI computer code (18] Best-estimate properties of the soil profile for the SSE-level motion were used in performing the computations. For the twice SSE level. results were scaled from the SSE. accounting for modulus degradation and increased damping.

c.

Fi. red-Bascd StructuralModelmg Structural models ured for the IPEEE are essentially the same as those used in the original, %nt design. as described in the final safety arolysis report (FSAR). except for the safety equipment building (where a lumped-mass stick-model approximation of the original plate /shell finite-element model was developed). Soil-springs were removed from the existing models to obtain fixed-base models, and a different computer code (from the one used in the original design analyses) was implemented for the seismic IPEEE analyses. Effects (at various locations ofinterest) of foundation rocking for vertical input motion, and torsional responses for translational motion input. were modeled by use of massless springs attached to the structure with rigid elements.

f SSI Analyses ofthe Coupled System The characterizations of foundation impedances. wave scattering and structural models were used in the SSI substmeture framework / approach to calculate SSI responses for the coupled soil-structure system.

g.

Probabthstic Analysis Variability in soil shear modulus. soil damping. structural frequency, and structural damping were assigned and used to develop simulations for these parameters. Taese model parameters were then combined with the 26 motion time histories, according to the LHS approach. to develop 26 different realization = (of motion /SSI model parameters) for conducting SSI analyses. Results from the 26 response analyses were used to derive statistics of structural responses and component demands. including the median demands.

Energy Research. Inc.

12 ERl/NRC 97-507

y l

h.

Review Findings De hcensee has developed structural responses and component demrnds for the San Onofre IPEEE in a state-of the-art manner, consistent with the relevant guidelines presented in NUREG-1407. The probabilistic SSI

]

. analysis involved a significant effort, since a considerable suite of analyses, as opposed to a single analysis, have been performed.- The resulting IRS are used without peak brHening, and are demonstrated in the f

submittal to be notably different from the FSAR design demands.

I

~2.1.6 Screening Criteria De SPRA followed the walkdown procedures and screening methods described in EPRI NP-6041-SL [6].

- Column three (1.2g S.) of the EPRI screening tables (e.g., Tables 2-3 and 2-4) was used as guidance for the walkdown! The third screening column defines the highest screening level, and is roughly consistent with a -

HCLPF capacity cf at least 0.5g PGA, However, no structures or equipment were screened out on the basis of the walkdown alone, instead, the walkdowns verified that the caveats and anchorage criteria specified in

)

Reference [6] were met; ne walkdown findings were subsequently used to determine the most vulnerable elements and seismic fragilities were calculated for these elements. Prelimmary analyses were performed to 4

determine the screenmg level that would give a mean seismic failure frequency ofless than 10 /yr. This was found to equate to approximately 8g S,(1-10 Hz) assuming pg (logarithmic standard deviation in capacity due to randomness) and pc (logarithmic standard deviation in capacity due to uncertainty) uncertainty parameters of 0.3. Screcrung levels varied if the uncertamty parameters varied significantly from 0.3. However, the basic criterion ofless than a mean 10 /yr for a seismic failure was maintained. Components with median screening 4

fragilities greater than 10.0g S,(1-10 Hz) were screened out. components having a median screening capacity between 8-10g S,(1-10 Hz) were individually evaluated to detemune if seismically induced failure was less than the 10 threshold. and components having a median screening fragility up to 8g S,(1-10 Hz) were included in 3

the SPRA quantification process. This approach wasjustified, in the submittal, by stating that any component or' structure that contributes less than 10 /yr to the seismic core damage frequency was unlikely to be a 4

- vulnerability.

Because the licensee's screening approach has been designed to preserve components potentially contributing greater than 10 /ry to the seismic CDF, the screening criteria satisfies NUREG-1407 guidelines.

4 2.1.7. Plant Walkdown Process a.

Overall Treatment Seismic capability walkdowns were performed for components on the seismic equipment list and associated structures Additionally, the scope of plant walkdowns included a relay evaluation walkdown, a contamment systems walkdown. and a seismic-fire and seismic-flood walkdown. Walkdowns followed EPRI NP 6041-SL

[6] procedures, and focused on the following items: component load path or anchorage, Seismic 11/1 considerations, spatial Uteractions (including fire suppression equipment), relays. and seismically induced fire 1

and potential floodmg or fluid spray interactions, including multiple concurrent flooding sources. Screening evaluation work sheets (SEWS) were completed for SEL components. An initial systems and component selection walkdown was performed. and subsequent walkdowns were conducted in 1993 and 1995. Seismic housekeeping concems were also noted during the walkdowns.

i

\\

Energy Research. Inc.

13 ERI/NRC 97-507

{

b.

Walkdown Participants Walkdowns were conducted by eight seismic capability engineers, a civil engineer, and system analysts. The seismic capability engineers completed the Seismic Quahfication Utilities Group (SQUG) Walkdown Screening and Seismic Evaluation Training Course, as well as add-on Seismic IPE training. The walkdown participants were orgamzed into two teams, a SCE team devoted primarily to the Unit-2 walkdowns, and a contractor team (with an SCE engineer) devoted primarily to the Unit 3 walkdown.

c.

Walkdown ofUnit Differences The submittal notes that differences in the two units were walked down, revealing that the two units are essentially identical. The most notable exception was a concrete plug around Unit-2 fuel oil transfer piping that does not exist at Unit 3. The plug was removed to improve the semnic capacity of the pipe, and thus, the modified condition of Unit 2 fuel oil transfer piping is the same as for Unit 3.

d.

Treatment ofInaccessible Components Inaccessible components were evaluated by means of a drawing review.

e.

Walkdown Findings As a result of the seismic walkdown process. 30 anomalies were identified with respect to the following items:

Issues potentially affecting functionality (3 items)

Anchorage anomalies (3 items)

Load path anomalies (9 items)

Seismic II/I interaction concerns (9 items)

Commodity clearance concems (6 items)

Additionally. as indicated in submittal Table 3.11-1, of the 594 components considered in the walkdowns.

fragilities were calculated for over 150 components.

f Renew Findings From a review of the seismic IPEEE submittal. it is clear that the licensee has had a meaningful participation in seismic walkdowns. that a significant walkdown effort was undertaken. and that appropriate procedures were implemented. Thus it is deemed that the walkdown process has been completed in a manner consistent with the guidelines of NUREG-1407.

2.1.8 Fragility Analysis The submittal notes that the seismic fragility analysis for stmctures and equipment followed the overall methodology described in EPRI TR-103959, " Methodology for Developing Seismic Fragilities" (19]. Fragility evaluations for relays were calculated using relay test results and EPRI's generic equipment ruggedness spectra (GERS). The ground motion parameter used as the basis for fragility calculations is the same as that used to convey the seismic hazard, that is. the value of spectral acceleration averaged over the vibration frequency Energy Research. Inc.

14 ERI/NRC 97-507

1 1

range of 1 to 10 Hz, or S,(1-10 Hz). The fragilities were characterized in a conventional manner, using the three parameters A (median acceleration capacity), pg and pc.

Based on review of the submittal, the fragility analysis methodology employed in the San Onofre seismic IPEEE is consistent with the guidelines of NUREG 1407.

)

)

A comparison of selected fragility values from the licensee's study [13] with typical values of other plants [20]

shows that the SONGS values are generally consistent with previous studies. The difference in the RWST/ CST values may be attributable to the higher design basis and relatively low aspect ratio ofihese tanks at SONGS. The median capacity for PGA is roughly equal to the result for S,(1-10 Hz), divided by a factor of about 2.3.

Component Typical Range Highest Fragility SONGS SONGS (PGA)[20]

(PGA)[20]

Fragility Fragility (S )

(PGA)

)

480V Switchgear 2-4 6

5 2

RWST/ CST 0.4-1 1

8.7 4

CCW HX 1-2 10 7

3 Auxiliarv Building 1-1.5 2.6 5

2 Motor Control Centers 2 - 2.5 4

4.5 2

4160V Switchgear 1.5 - 2 3

6.8 3

2.1.9 Accident Frequency Estimates The submittal presents Boolean equations for each node of the seismic event tree. Based on these Boolean expressions, the logic of the SET, component fragility results. and seismic hazard results. frequencies of seismic damage states were quantified using the EQESRA computer code [21]. Seismic failure dependencies I

of similar, redundant and co-located components were treated in the most conservative way (i.e.. perfectly dependent for components in parallel. and perfectly independent for components in series). A total of 31 accident sequence /SDS frequencies were obtained from this initial quantification, as reponed in Table 3.6-5 of the submittal. Among these results.12 of the sequences were obsened to have a frequency exceeding a screening threshold of 10 /ry. Among these 12 sequences. seven were identified as leading to core damage 4

from seismic failures alone. without additional random equipment failures. For er.ch of the remaining five unscreened sequences. the IPE model (modified to reflect special conditions for a seismic event) was used to quantify CCDPs reflecting the effects of non-seismic random and human failures. The REBECA PRA software was used to evaluate the CCDPs for the five seismic damage states; these CCDPs were then multiplied by their respective SDS frequencies. in order to obtain core damage frequency contributions for these j

SDSs. In some instances. multiple CCDPs were obtained for a given SDS (to distinguish between occurrences of different random failures). so that the final number of reponed sequences exceeded 12 (a total of 17 were reported).

The licensee's approach to quantifying accident sequence frequencies appears appropriate and consistent with NUREG-1407 guidelines.

Energy Research. Inc.

15 ERI/NRC 97-507

I i

2.1.10 Evaluation of Dommant Risk Contributors :

Dommant accident sequences (Le., seismic damage states) were evaluated based on contribution to seismic core damage frequency. He 17 dommant sequences /SDSs, as well as important seismic and non-seismic failures, are identified in Section 3.6.8 and Table 3.6-7 of the IPEEE submittal. The top five accident sequences, contributing over 85% to the seismic CDF, include:

j Sequence 1: Seismically induced loss of offsite power (LOSP) and loss of emergency switchgear (39%

of the seismic CDF), dominated by seismic loss of MCCs.

Sequence 2: Seismically induced LOSP with seismic failure ofinstrumentation and control (19% of the seismic CDF), dominated by failure of the auxiliary building.

)

Sequence 3: Station blackout resulting from unrecoverable seismically induced LOSP, in combination with random failures, but no additional seismic failures (15% of the seismic CDF). This sequence is dominated by random failures of diesel generators or their support systems.

Sequence./: Seismic LOSP. with no additional seismic failures, but random failures of the condensate makeup system and auxiliary feedwater (AFW) pumps (8% of the seismic CDF). This sequence is dominated by random loss of AFW.

Sequence 5: Seismically induced LOSP and small loss of-coolant accident (LOCA), with loss of emergency switchgear (7% of the seismic CDF). dominated by seismic loss of MCCs Overall. the San Onofre seismic IPEEE has produced meaningful insights with respect to dommant risk contributors. in a manner consistent with the guidelines of NUREG-1407.

2.1.11 Relay Chatter Evaluation Relays for each component on the SEL were identified and placed on a seismic relay list (SRL). Consideration of relay chatter was addressed in at least the following three ways in the SONGS seismic IPEEE: (1) identification and classification of essential relays; (2) relay walkdown: and (3) SPRA modeling c? relay chatter, including fragility evaluations and consideration of operator recovery actions. Each of these aspects is discussed briefly below.

j a..

Identyication and Classtjication ofEssential Relays The relay chatter evaluation approach of EPRI NP 7148-SL [22] was used in the SONGS seismic IPEEE. On the basis of this methodology and additional guidelines presented on pages 3-29 and 3-30 of the submittal, each relay was designated as being either chatter acceptable (CA). chatter unacceptable (CU). or one where operator action (OA)is required to mitigate the impacts of chatter. He CU and OA relays were subsequently modeled in the SET. Of over 1300 relays on the SRL,191 relays were classified as CU,27 relays were classified as OA. and the remanung relays either screened out based on ruggedness, or were evaluated as CA. Of the 191 CU relays.171 are switchyard relays which. for modeling purposes. were grouped as a single component that was assigned a conservative fragility.

)

I Energy Research. Inc.

16 ERl/NRC 97-507

{

J

U

b.

. Relay Walkdown The relay walkdown followed the guidelines of EPRI NP 7148-SL, and had the following objectives:

l Identify cabinets containing essential relays, and determine cabinet dynamic amplifications for use in seismic capacity screenmg Spot check relay mountings Spot check relay types and locations. and check for vulnerable relays Verify the anchorage of cabinets / enclosures contaming the essential relays These aspects of the seismic walkdown were generally performed in conjunction with the equipment capacity walkdowns: the focus of the effort was on verifying relay mountings. Additional walkdowns were performed to determine the type, model, and location of relays.

Essential relays were generally found to be properly installed: no loose relay mountings were obsened during the walkdowns. However, the hinged interior doors on one set of cabinets were found to be missing the nuts for securing bolts to the cabinet frame: this situation was corrected by means of a maintenance action.

{

c.

SPRA Modeling CU and OA relays were modeled in the SET, and relay fragility curves were developed for SPRA

.quantifications. Relavs and process switches whose capacity would result in a seismic failure frequency of less than 5x10 /yr were screened out. Approximately 15 relay fragilities were incorporated into the seismic plant 4

model. For OA relays, operator rates for failing to reset the relays were also modeled in the SPRA.

I Chatter of switchyard relays was found to be an element of most dominant seismic damage states. In addition.

a sensitivity study revealed that operator failure to recover from relay / process switch chatter in the diesel

- generator circuitry can have a significant effect on the seismic CDF result. - This issue was investigated by the licensee, who found that resetting these relays is nearly an " automatic" operator acion. The licensee also performed a cost benefit analysis. and found that changing the relays was not cost effective.

d.

Review Findings The SONGS seismic IPEEE has included an evaluation of the potential and effects of relay chatter consistent with NUREG 1407 guidelines.

. 2.1.12 Soil Failure Analysis During construction of the San Onofre plant. about 70 ft of native soils (terrace deposits) were excavated. and

. plant structures were founded directly on the underlying San Mateo sand deposit / formation (which has a depth to bedrock'of about 900 feet). The submittal characterizes the San Mateo sands as very dense and well graded.

The subs.ml includes consideration of the following categories of potential soil failures:

I Energy Research. Inc.

17 ERl/NRC 97-507

1.

Ground failure of the San Mateo sands in the plant area.

2.

Liquefaction of filled cavities that formed adjacent to, or beneath, important structures during construction dewatering of the San Mateo sands.

3.

Development of blockages in offshore conduit caused by conduit separation and inflow of soils subjected to liquefaction.

4.

Failure of cut slopes in native terrace deposits adjacent to critical plant facilities.

For overall ground failure. available documentation on soil properties was used to evaluate, and screen out, this failure potential. Liquefaction of the filled cavities had earlier been analyzed for SSE ground shaking, and that evaluation was used as the basis in the IPEEE to screen out soil liquefaction for ground motions 5.4g S,(1-10 Hz). Water velocity in offshore conduits was judged to be sufficiently high to remove any potential sand blockage caused by soil inflow between separations of adjacent pipe segments. Based on slope response analyses, the maximum potential deformations of nearby slopes were determined to be much smaller than the distances to critical plant facilities.

Thus. the licensee has screened out all of the preceding potential soil failures from further exammation. In general. minimal documentation of the licensee's treatment of soil failures is provided in the submittal.

However. the discussion and findings appear to be reasonable and generally consistent with NUREG 1407 guidelines.

2.1.13 Containment Performance Analysis The seismic containment perfonnance analysis addressed the potential for each of the following:

Containment bypass Loss of containment isolation

+

Loss of containment systems, including containment cooling Releases of radioactivity The evaluation of containment bypass considered the potential for seismically induced ISLOCAs. Potential ISLOCA paths were identified in the IPE. and valves in these paths mrc meluded in the seismic equipment list.

Relays associated with contamment isolation were included in the relay evaluat;on list. These components were included in the scope of seismic walkdowns. The potential for a seismically induced steam generator tube rupture (SGTR) was screened out at a high capacity, but the potential for a SGTR associated with high l

temperatures / pressures in the primary system resulting from core damage was considered in the Level-2 analysis.

Containment isolation was one of the safety functions included in developing the seismic equipment list, and hence, relevant valves. penetrations, and actuation systems were explicitly included in the seismic walkdown.

The containment isolation fault tree from the IPE was used directly in extending accident sequence event trees for the seismic Level-2 analysis. It was determined that this fault tree did not need to be modified for seismic events because high capacity was observed for the relevant systems and components that could affect the containment isolation fault tree. The submittal also notes that penetration cooling is not needed for short-term Energy Research. Inc.

18 ERI/NRC 97 507 j

intcgrity of the penetrations, that inflatable seals are not used at SONGS, and that air-operated containment isolation valves all fail closed on loss of air.

Contamment systems were exammed with respect to the potential for: (a) gross structural failure of the containment; (b) failure of major equipment or structures inside contamment; and (c) failure of components of the containment heat removal and pressure suppression systems, such as fan coolers, support systems, and system interaction effects (e.g., relay chatter). These items were all included in the scope of the SPRA evaluation.

Because unique contamment performance fmdings associated with seismic events were not identified, the IPE models were used directly to quantify seismic release category frequencies, using the frequencies of the seismic damage states developed from the Level-1 SPRA. Thus, the dommant seismic sequences were processed through the IPE extended event trees, plant damage : states, and contamment event trees. The following results were obtained for release category frequencies:

Category S (9.1x10dhy; 53% ofseismic CDF): Success; no contamment failure within 48 hour5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />s: less than 0.1% volatiles released Category L (7.5x104/ry; 43% of seismic CDF): Late contamment failure; up to 0.1% volatiles released 4

Category B (2.6x10 /ry; 1.5% of seismic CDF): Contamment bypassed; less than 0.1% volatiles released 4

Category W (2.4x10 /ry: 0.2% of seismic CDF): Late containment failure; more than 10% volatiles released. (This is an auxiliary feedwater system failure owing to operator error to refill the CST.)

l 4

Category G (3.9x10 /ry; 2.3% of seismic CDF): Early/ isolation failure: containment failure prior to or at time of vessel failure; up to 10% volatiles released i

Category D (0% of seismic CDF): Contairment bypassed; up to 10% volatiles released Category T (0% of seismic CDF): Containment bypassed: more than 10% volatiles released The submittal provides a detailed description of the most important seismic accident sequences for each release category.

The qualitative and quantitative aspects of the contairunent performance analysis conducted in the San Onofre seismic IPEEE meets NUREG-1407 guidelines. However, the quantitative radiological releases identified for categories B and W appear to be inconsistent (i.e., less than 0.1% volatiles released for an SGTR, and more than 10% volatiles released for a late containment failure).

2.1.14 Seismic-Fire Interaction and Seismically Induced Flood Evaluations Section 3.3.4 of the SONGS IPEEE submittal docummts the approach and fmdings of a comparatively detailed qualitative analysis of seismic-fire interactions and seismically induced floods. The seismic-fire interactions evaluation has considered the specific issues raised in NRC Information Notices (ins) 83-41 [23) and 94-12 (GI-57) [24J, as well as the following aspects:

l Energy Research, Inc.

19 ERl/NRC 97-507

p Seismicallyinduced fires a.

Seismic actuation of fire suppression systems

.~

Seismically induced failure of fire suppression capabilities

{

a 3

~

The evaluation of seismically induced floods has considered the following issues:

i

' Sensnue failures of tanks, piping expansionjo;nts, and seals that may lead to flooding or spray damage j

to vital cow.ycscas.

1

• ~

Seismically induced inadvertent actuations of fire protection s>mems (FPSs)' causing floodmg,

' spraying, or Cardox/Halon discharge that may damage vital equipment.

The IPEEE submittal's treatment of each of these issues is discussed below.

a.

' SeismicallyInducedFires '

g

' For seismically induced fire considerations, the seismic review team (SRT) evaluated potential fire sources,

. including transformers. and tanks and piping containing hydrogen, other flammable gases, or fuel / oil. The updated fire hazard analysis and Appendix R documents were used to identify potential fire sources. A seismic-fire walkdown was performed to evaluate the seismic capability of identified fire sources of significance. The walkdown results indicated that either the fire sources have high seismic capacity or there are no safety equipment or cabling in the vicinity of the source. Potential seismically induced fires were thus screened from SPRA evaluation.

b.

Inadvertent Seismic Actuanon ofFire Suppression Systems Inadvenent actuation of fire protection systems (FPSs) and discharge onto safety-related equipment, resulting from seismic events, were considered in the intcmal floodmg analysis of the San Onofre IPE. A walkdown was performed for this evaluation. The potential for spurious actuation of FPSs (Cardox. Halon. water etc.) due to relay chatter or dust spread was extensively uiscussed in the submittal (Pages 3-45 to 3-47) report. The submittal concludes that there are no safety equipment that may be affected by inadvenent actuation.

i c.

Seismically Induced Failure ofFire Suppression Systems Section 7.2 of the submittal notes: " Portions of the fire suppression system are designed to seismic category

- I. Also, fire tmeks and tankers are seismically restrained in an open area so as to be available following a seismic event." Page 3-47 of the submittal states: " SONG 2/3 has a specifically designed seismic fire protection water system. with tankers and headers." The submittal argues that because there are no fire sources which could fail during a seismic event and impact safety systems. fire protection system failure after an earthquake would not be risk significant.

d.

SeismicallyInduced Floods In addition to the treatment ofissues pertammg to seismically induced inadvertent actuation of FPSs, other potential flood sources, including non-safety tanks and piping, and expansion joints and seals, were identified and included in the plant seismic-fire / flood walkdown. The submittal states that only CCW seals were not

' Energy Research. Inc.

20 ER1/NRC 97-507

I screened out and included in the core damage model. The licensee concludes that there is no significant risk of core damage due to seismically induced floodmg e,

Review Findings The San'Onofre IPEEE has implemented detailed qualitative seismic-fire and seismically induced flood.

evaluations which meet the W= of NUREG-1407. De evaluation also exammed the potential for scumucally induced toxic matenal releases, and idenufied a plant improvement to the anchorage of an ammonia storage tank.

2.1.15 iTreatment of USI A-45 The SONGS seismic IPEEE has included a meaningful discussion of the treatment of USI A-45. He safety-related decay heat removal (DHR) systems at the plant include the following:

AFW system High pressure safety injection (HPSI)

Low pressure safety injection (LPSI)

Contamment spray (CS) system In addition. support systems needed for DHR include: electric power, cooling water ' chilled water, CCW, and

(

SWC), air / nitrogen. and HVAC, In the event of a transient or small LOCA. the AFW system prosides DHR capability via secondary side heat removal. Contamment fan coolers are also available as a means for contamment heat removal in the event of a LOCA. Long-term DHR capability is provided through the closed-loop shutdown cooling (SDC) system, utilizing the LPSI pumps and SDC heat exchangers. For LOCAs, inventory makeup and DHR can be established using the recirculation mode of the HPSL LPSI, or CS systems.

I All of the preceding frontline and support systems for DHR have been modeled in the seismic IPEEE, with pertment equipment generally found to be seismically rugged. With respect to DHR systems, multiple failures ofredundant equipment and failurcs ofpotential operator recovery actions were generally found to be required for core damage to occur. On the basis of the low computed seismic CDF, the licensee concludes that there are no DHR vulnerabilities at the plant. and that USI A-45 is closed with respect to seismic events.

The licensee's treatment of USI A-45 appears to be appropriate and consistent with the objectives of this issue.

2.1.16 Treatment of GI-131-Units 2 and 3 ofSONGS.are each PWRs having a' Combustion Engineering design. Since GI-131 is applicable to Weis@ouse PWRs only, this issue is not applicable to San Onofre. The licensee thus considers this issue

- to be closed;

)

' 2.1.17 Other Safety Issues

{

The IPEEE submittal provides brief discussions on the following additional seismic issues: USI A-46

(" Verification of Seismic Adequacy of Plant Safe Shutdown Equipment"). USI A-40 (" Seismic Design Criteria"

. Energy Research, Inc.

21 ERl/NRC 97-507 I

i

)

and " Seismic Capacity of Large Safety-Related Above-Ground Tanks"), USI A-17 (" System Interactions in Nuclear Power Plants"), the Eastem U.S. Seismicity (Charleston Earthquake) Issue, and GI-57 (" Effects of Fire Protection System Actuation on Safety Related Equipment").

The subnutta! notes that USI A-46, USI A-40 (" Seismic Design Criteria"), and the Eastern U.S. Seismicity Issue are not applicable to SONGS, and therefore, are considered to be closed.

According to the licensee, spatial interactions were specifically addressed in the IPEEE seismic capacity walkdowns and checklists, and the large safety-related yard tanks have been demonstrated in the submittal to

~ have high seismic capacities. On this basis, the bcensee considers USI A-17 and USI A-40 (" Seismic Capacity of Large Safety-Related Above-Ground Tanks") to be closed for SONGS.

The submittal also notes that items pertammg to GI-57 and fire risk scoping study issues have been addressed in the IPEEE treatment ofseismically induced fires / floods, and that these items are considered to be closed for SONGS.

2.1.18 Process to Identify. Eliminate or Reduce Vulnerabilities The licensee supplies the following definition of a vulnerability:

"A vulnerability in a PWR is a plant feature which contributes a disproportionately large percentage to either core damage or significant release probabilities which are in tum significantly higher than those of an average PWR."

The submittal indicates that no vulnerabilities were revealed with respect to safe shutdown and seismic containment performance. The IPEEE resulted in several plant modifications that provide substantive and cost-effective risk benefit. %ese changes were included in the plant model, and are reflected in the IPEEE results.

The changes related to seismic events included:

Improvement in the reliability of cross-connecting emergency diesel generators between the two units.

Strengthening of the suppons of an ammonia tank to eliminate a spill hazard.

Removal of a floor grating surrounding AFW valve actuators to eliminate an interaction hazard.

Removal of a concrete plug surrounding the Unit-2 diesel generator fuel oil transfer piping to improve the seismic capacity of the pipe and to provide a plant configuration co..sistent with Unit 3.

Fastening together of adjacent electrical cabinets / panels to help prevent interactions and relay chatter.

Stabilizing light fixtures that may interact with electrical cabinets.

The submittal notes a number of anomalies (approximately 30) that were identified as a result of the seismic capacity walkdowns. The majority of these werejudged to not be significant after additional consideration.

. whereas others were addressed by means of the preceding plant changes.

Energy Research, Inc.

22 ERI/NRC 97-507

2.1.19 Peer Review Process Licensee personnel and contractors / consultants both had a significant involvement in the IPEEE study and peer review,- De seismic hazard analysis was reviewed by an independent panel of three well-qualified, acknowledged experts (Dr. N. Abrahamson, and Professors K. Aki and C. Allen). De seismic equipment list

was reviewed by the Civil Engineering Group of the licensee's Nuclear Engmeering Design Organization (NEDO). The NEDO-Electrical Group reviewed the seismic relay list and relay chatter evaluation. The seismic HRA was reviewed by a senior reactor operator (Mr. R. Grabo) in the licensee's Nuclear Trammg Department, and by an irh cogmeer (Dr. M. Motamed). A member of the licensee's PRA Group (Mr.

T. Hook) and of the Assessment Engmeering Group (Mr. J. Thomas) provided reviews on specific aspects of the seismic analysis The submittal also notes that an infonnal, independent peer review oflimited scope was pwfm.ed by PG&E (Mr. T. Leserman), primarily for the purpose of comparing the seismic IPEEE findings

. with those for the Diablo Canyon Nuclear Plant.

Based on conclusions of the peer review that have been reported in the submittal, it appears that meamngful comments were received by peer reviewers, and that these comments have been resolved.

The peer review process employed for the SONGS seismic IPEEE appears to be consistent with NUREG-1407 recommendations.

2.2 Eitt A summary of the licensee's fire IPEEE process has been described in Section 1.2 of this TER. Here, the licensee's fire evaluatius is described in detail, and discussion is provided regarding significant observations enc Hmtered in the present review.

2.2.1 Oveniew and Relevance of the Fire IPEEE Process -

. A4 hodSelectedfor Fire JPEEE t

a.

The IPEEE submittal includes extensive discussions regarding the methods and data used in conducting the fire j

analysis. A combination of EPRI's fire-induced vulnerability evaluation (FIVE) [7] and fire PRA methodologies have been used in three phases. The first two phases are identical to those prescribed in FIVE.

Initially, Revision 0 of FIVE was_ employed, and subsequently, the unscreened fire compartments were reanalyzed using the methodology as modified in Revision 1. In the third phase, plant areas that did not screen out in the first two phases were subjected to a detailed analysis using fault trees, the COMPBRN Ille computer

- program, and other fire PRA-style modeling techniques. The licensee states that the methodology described

~ in Reference [4] has been used. In fact, the licensee has' employed methods and data that are more recent than those provided in Reference [4]. The licensee has conducted plant walkdowns to verify various information elements ne fire compartment interaction analysis (FCIA) methodology prescribed in Reference [7] was used to establish the possibility of multi-compartinent fire scenarios.

b.

Key Assumptions Used in Performing the Fire IPEEE The fire IPEEE submittal does not include an explicit listing of key assumptions and modeling conditions. The following list has been gleaned from the discussions provided in the submittal, and includes items deemed to have some notable effect on the final results of the fire analysis:

Energy Research. Inc..

23 ERI/NRC 97-507

1.

Reactor sub-criticality was assumed to be successful in all cases.

2.

All cables are IEEE 383 qualified.

j 3.

Fire barriers / boundaries are as good as their ratmg 4<

The fire protection system is designed and installed per proper codes and standards.

5.

Plant configuration is applicable to Cycle 7 (no funher details are provided regarding the significance and definitions of a cycle).

6.

L The operators do not turn off the heating, ventilation, and air conditioning (HVAC) system to an affected fire companment to ensure fire damper closure.

7.

Loss of the ventilation system does not lead to equipment failure. (This assumption has taken into account the fact that several hours are available benveen loss of HVAC and occurrence of equipment

'-t failures due to heat-up.)

8.

. Unit 3 is sufficiently similar to Unit 2; therefore, only a few of the Unit 3 compartments were sisited during the walkdown.

9.

One air compressor was assumed to be lost because its cable routing was not established.

10.

Appendix R exemptions were not taken into account.

I 1.

If offsite power is lost due to a fire incident. it will remain unavailable for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

12.

Diesel generator mission time was increased from 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (IPE) to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

c.

Status ofAppendix RModJIcanons l lt is inferred that all Appendix R related modifications had been implemented prior to the completion of the IPEEE fire analysis, although the submittal does not explicitly state this to be the case.

d.

New or Existing PRA The submittal does not mention whether the fire analysis is new, or a fire PRA had been completed prior to this

study,

~ 2.2.2 Review of Plant Information and Walkdown Plant information used in the IPEEE fire analysis was taken from Appendix R compliance documentation.

databases and analysis, the updated fire hazard analysis (UFHA), the SONGS IPE, plant drawings, system

' descriptions, tray and conduit plans, technical specifications. and emergency procedures. The type of information cited in the submittal is typical for a fire risk study.

Energy Research, Inc.

24 ERI/NRC 97-507 l

c4 De plant configuration is assumed to be that of Cycle 7 (as mentioned in the precedmg section), with several upgrades ' These upgrades are mamly in procedures for using or recovering various electric power sources, and for either stoppmg an HVAC system to insure Sre damper closure or using air ducts and gas-driven pumps to previsit room heat-up. It must be noted that no credit has been given to this possibility. However, it is not clear if the possibility of fire damper failure to close, and fire effects propagation from one compartment to an adjacent companment, have been included in the analysis.

'Although both units'.of SONGS were licensed to operate after January 1,1979 (i.e., SONGS is a post-Appendix R plant), the licensee refers to Appendix R to represent all those actisities that have been conducted and data bases that have been generated for compliance with fire regulations (i.e., BTP 9.5-1, etc.) The definitions'provided in Appendix R have also been used in the IPEEE fire analysis. For example, the definitions of fire areas and companments were used per Appendix R guidelines.

The Appendix R safe shutdown list has been used and updated for the purposes of the IPEEE fire' analysis.

The safe shutdown list, as presented in Section 4.2.1.2 of the submittal, includes such systems as the chemical and volume control system (CVCS), main feedwater, HVAC, and emergency chilled water. CVCS and main feedwater are typically not addressed as safe shutdown systems. The licensee has added several other components to the list to ensure that all the components needed for near-term shutdown were properly identi6ed, and their associated cables were traced He additional components, per Reference [14] and Section 4.2,1.4 of the submittal, include those that affect turbine trip, reactor coolant system (RCS) pressure-transnutters, and several valves from systems such as contamment emergency sump, emergency core cooling

- system (ECCS) mini-flow, etc. In addition to this list. per Reference [14], special circuit evaluations, or special

-analysis of cable routing or component availability, were performed for the following systems or components:

Condensate / main feedwater equipment. cables and suppon systems Equipment and cables that can cause a near term shutdown (per technical specifications requirements)

- or cause a reactor trip Loss of offsite power cables Normal HVAC for Class IE switchgear and distribution rooms a

Primaty coolant loop instrumentation circuits CCW room cooling fans -

Contamment' sump isolation valves In several cases, the analysts have made simplifying assumptions regarding the locations of cables. For example, for 36 fire companments. it is ' conservatively assumed that reactor trip would occur from a fire even though the analysts had the option of verifying whether or not there were actually reactor trip circuits in these companments.

At least three sets of fire walkdowns were conducted: (1) a FCIA walkdown, (2) a fire modeling walkdown, and (3) a seismic-fire interaction walkdown. The first two walkdowns are documented in detail as pan of the Phase I and Phase 11/111 fire IPEEE documentation (Tier 2 documentation). The last set of walkdowns are

- ' documented as pan of seismic IPEEE repons. The submittal does not provide a discussion regarding the nature, format, and contents of these documents.

No infonnation has been provided on walkdown dates and duration. Also, no information was prosided regarding the methods employed for conducting the walkdowns.

. Energy Research. Inc.

25 ERI/NRC 97-507 j

L

- a..

Walkdown Team Composition.

The first two fire walkdowns (i.e., walkdowns for FCIA and fire modeling) were conducted by the fire protection staff perfo ming the study. The walkdown on seismic-fire interactions was conducted by the fire

prrveina staff fo...

the IPEEE, seismic fragility experts, and PRA staff familiar with the systems. No i

further details are provided regarding the number of participants, expertise, and capabilities of.the fire

Walkdown teams b.

- Sigmfcant Walkdown Findirigs' From the findmgs of the first walkdown, the licensee concluded that the " electrical and cable tunnels" should be combined into one fire compartment, and that the main turbine building and service water pump room should be combined to form a new fire area. - From the second fire walkdown, the licensee concluded that there were no sigmficant devianons fmm the documented plant design and configuration information. From the third fire walkdown, the licensee concluded that there was no seismic-fire interaction potential that would require additional analysis.

c.

Sigmpcant Plant Features The two units at SONGS consist _of containment. penetration building, auxiliary building, safety equipment building, the turbine building, and the diesel generator building. The auxiliary building houses safety-related and other control, mstrumentation. and electric power panels and cables: the control room; the cable spreading rooms: and the radwaste-related equipment and areas. The safety equipment building houses safety-related pumps and heat exchangers. There is only one control room for both units. However, each unit has its own cable spreading room. -

2.23 Fire-Induced Initiating Events

- The safe shutdown systems and components defined as part of the Appendix R analysis have been used in the -

j fire IPEEE: additionally, for fire CDF quantification. the IPE logic models were employed. Reference [14]

provides an analysis where the possibility of a fire leading to an initiating event identified in the IPE was evaluated. A thorough analysis was conducted to identify system failures that would lead to plant trip. turbine trip. LOCA (various sizes), loss of CCW, loss of electric power, etc. Special emphasis was given to technical specification requirements regardmg plant shutdown after certain failures. Since Appendix R assumes loss of offsite power, the routing of the cables associated with offsite power were also identified. ' Although it is not specifically mentioned in References [1] and [14], it can be inferred that several fire scenarios include self-induced station blackout (SBO) as part of the procedure for mitigating the effects of the fire.

It was assumed that a fire cannot lead to an ATWS, a steam generator tube rupture, a secondary side-line break, or medium or large LOCAs.

a.'

Were initiating Events Other than Reactor Trip Considered?

The entire list ofinitiating events from the IPE internal events model have been addressed in the submittal and Reference [14]. The following initiating events have been concluded to be possible from a fire event:

_ Reactor trip -

Energy Research. Inc.

26 ERI/NRC 97-507

. Turbine trip Loss ofpower conversion system C

Loss ofoffsite power Small LOCA (via lifting of pressurizer safety valves (PSVs])

Reactor coolant pump (RCP) seal failure.

Loss of single 125 VDC bus

• ~

Loss of CCW and SWC Station black out -

' General transients

' As stated above,-ATWS, medium and large LOCAs, steam generator tube rupture, and secondary side-line -

break were assumed to be impossible as a result of a fire. The possibilities of containment bypass and mterfacing-systems LOCAs were addressed in the subnuttal, and it wm also concluded that such events cannot

~ be induced by a fire. The possibility of spurious opemng of decay heat removal isolation valves, CVCS letdown lines, or the pressurizer head vent valve has been considered. The likelihood of spurious opemng of these lines was concluded to be very small. since either two spurious actuations have to occur affecting fail closed type valves, or one of the motor-operated valves (MOVs) in the path needs to be de-energized.

b.

Were the Initiating Events AnalpedProperly?

Reference [14] indicates that a separate analysis was performed to determine which initiating events could possibly occur from a fire event. From the information provided in Reference (14), it can be concluded that the initiating events were analyzed properly.

2.2.4 Screening of Fire Zones i

. Was a Proper ScreeningMethodology Employed?

a.

Screening of fire zones appears to have been performed properly. Screening was conducted in multiple stages, using the protocol prescribed in the FIVE methodology. The first two phases of FIVE were used for screening fire compartments and fire areas. Per Resision 0 of FIVE, in Phase I of the analysis, a compartment was screened out if there was no safe shutdown component or it could be shown that there was no potential for reactor trip or manual shutdown as a result of the fire. Revision 1 of FIVE [7], however, recommends the use

. of "and" in place of "or" for meeting the two criteria. The licensee has revisited its analysis for those compartments that screened in Phase 1. and has used the resised criterion. Of 182 fire areas and compartments explicitly addressed in the fire analysis. 95 have been screened out in Phase 1, based on the aforementioned criteria, and 87 were retained for further (i.e., Phase II) analysis.

Of the 182 compartments, four are inside the containment which did not screen out in Phase L In Phase II, these compartments were screened out 'using qualitative arguments based on a minimum separation between redundant trains. Of the remaining 83 fire compartments, two more were screened out qualitatively using

" circuit analysis." The submittal does not provide any details regarding this analysis.

- In Phase II, quantitative methods were employed to screen compartments and areas. The fire frequencies were established using the data and methodology provided in FIVE. None of the fire initiation frequencies was found to be less than 10 '/yr. The CCDP for each compartment. assuming that all cables and equipment are failed because of the fire, was esumated using the IPE model. An initial quantitative screeriing was performed using Energy Research, Inc.

27 ERI/NRC 97-507

e...

these two parameters Compartments with a CDF less than 10'per year were screened out. Of the 81 uuttally Jun-screened w.ye.ws,50 additional compartments were screened out at this stage.

LIn the second part of Phase II analysis, a " simplified fire model" was employed using the worksheets, suppression system unavailabilities, and other relevant data from Sections 6.3.3 to 6.3.7 of Reference [7],

, where the probability of critical combustible loadmg (Pect) was estimated. Fixed and transient fire sources

, were considered in this step. For transient fires, the source was assumed to be 32 gallons of trash'(the exact dunensions were not specified).

~ Using Pect, the CDF was recalculated, and an additional 12 compartments were screened out. Nineteen compartments remained unscreened at this point, and these were evaluated in Phase III analysis.

b.

Have the Cable Spreading Room and the Control Room Been Screened Out?

ne cable spread:ng rooms were included in the screening process and were screened out. The fire occurrence frequency for the cable spreadmg rooms was smaller than what has typically been used in other IPEEEs.

Although no explicit justification has been provided in the submittal regarding the selected frequency, this is considered to be reasonable. De bcensee used a CCDP of 0.063, and a Pect of 0.0038, for these rooms. The ljusti6 cation for these two probability values is provided in Reference [14]. The CCDP includes control room t evacuations and using the altemate shutdown panel. The Pcci, for the cable spreading room is based primarily

- on transient combustible exposure, using the strict methodologv and data from FIVE. It is conservatively assumed that automatic suppression and manual fire fighting are unavailable or ineffective.

The control room was not screened out in Phases I and II. He discussion on the control room fire analysis is f

presented along with other detailed fire analyses, as part of Phase 111, in Section 4.4.2 of the submittal.

Reference [14] provides a description of the control room fire analysis. Six fire scenarios have been consideredc in all cases. it is assumed that control room evacuation is necessary. Five of the six fire scenarios are initiated from an in-situ ignition source. Multi-panel fire damage was modeled by postulating failure to extinguish the fire in 10 minutes. The data provided in NSAC-178L is used to establish the prchability of failure to extinguish.

The discussions provided on CDF evaluations for the control room fire scenarios do not include sufficient inforrnation on how the CCDPs were computed. It can be inferred that HEPs are an integral and important part of the CCDPs. Reference [14] provides a list of the HEPs that were used in evaluating the CCDPs. Most HEPs are reasonable and in several cases conservative. However, the HEP for " Operator fails to activate 4

instmetion SO23-13 Shutdon from outside the control room" is 3x10, which is smaller than the typical

= value used in other studies for such operator actions. This operator action can be interpreted as failure to use the ahernate shutdown panel A typical value used in several IPEEEs for this HEP is 0.05. It must be added that a significant majority of the CCDPs presented in Table 4-1 of Reference [14] are greater than lx10",

which indicates that other HEPs and equipment failure probabilities, besides the action listed above, were included in the CCDP evaluation.-

c.

Were There Any Fire Zones Areas That Have Been improperly Screened Out?

Sufficient discussion is provided in the submittal and in Reference [14] to justify the screenirg of various compartments, including the cable spreading rooms and cable riser galleries. He screening process and the results are considered to be' reasonable.

Energy Research, Inc.

28 ERI.NRC 97-507 o

2.2.5 Fire Hazard Analysis The data and methodology provided in Reference [7] has been used to estimate fire frequencies for indi5idual compartments and fire areas. He weighting factors provided in Reference [7] have been applied to apportion the overall fire frequency to the specific fire zones. Plant specific fire occurrence data has not been used.

However, for contamment fires, plant fire department records were reviewed. None of the records indicated a fire in the contamment. About 200 records, covering a five-year time period, were resiewed for this purpose.

2.2.6 Fire Growth and Propagation Fire growth analysis was conducted in Phases 11 and III. Phase 11 fire analysis was based on the worksheets and data provided in Reference [7], and Phase III was based on COMPBRN IIIe [8] computerized fire modeling. Rose fire areas and compartments that did not screen out in Phase I (i.e., the qualitative screening) and in the initial quantitative screening of Phase II (see Section 2.2.4), were analyzed per " simplified fire model." The simplified model was the same as the Phase 11 fire modeling formulations and data in the FIVE methodology. He worksheets provided in FIVE [7] were employed to evaluate damage probabilities to specific targets within a fire area or compartment. Fixed and transient fire sources were considered in this part of the analysis. The tarpt systems were taken based on the " worst case" among possible combinations of target cables and equipment. A worst-case system was the most significant contributor to the CCDP associated with the compartment.

In Phase III, several more-detailed fire scenarios were postulated for the fire compartments and areas that did not screen out in Phases I and 11. The fire propagation scenarios were based on the severity of the fire and on relative location of various target cables and equipment (i.e., safe shutdown cables and equipment) in the room.

COMPBRN was used for analyzing these specific scenarios, in order to establish the possibility of propagation and the probabilities of damage and non-suppression.

a.

Treatment ofCross-Zone Fire Spread and AssociatedMajor Assumptions ne possibility of fire growth beyond the compartment of origin was addressed through application of the fire 1

compartment interaction analysis (TCIA) methodology of Reference [7]. The criteria provided in the FIVE j

documentation was employed in this regard. About 1,000 compartment boundaries were reviewed by this approach. A specific plant walkdown was conducted in support of this effort (see Section 2.2.2). Four groups of fire compartments were identified as having inadequate boundaries among them. Thus, four fire areas were i

defined by combining the compartments within each group.

b.

Assumpnons Associated with Detecnon andSuppression The IPEEE methodology for fire detection and suppression analvsis was the same as that commoniv used in fire PRAs; that is, the time to damage was compared with the time to fire suppression. In Phase II, FIVE worksheets and suppression system unavailability data were used. In Phase Ill, the damage time obtained from COMPBRN analyses was used as a key parameter. He probability of non-suppression was derived from multiplying the probabilities of damage and non-suppression (the submittal refers to the latter as " frequency of non-suppression"). He submittal does not elaborate on how these values were obtained using the j

COMPBRN results.

1 Energy Research. Inc.

29 ERI/NRC 97-507

Treatment ofSuppression-Induced Damage to Equipment, ifAvailable c.

There is no discussion in the fire IPEEE submittal of suppression-induced damage. Potential effects would include damage to cables and equipment as a result of activation of a fire suppression system in extmguishing a small fire in a given area. A somewhat related issue was discussed as part of the Sandia fire risk scoping study issues. The " Total Environmental Equipment Survivability" issue addresses the survivability of safe shutdown equipment from spurious actuation of a suppression system.

d Computer Code Used, ifApplicable The only computer codes mentioned in the submittal are COMPBRN IIIe [8], which was used in Phase III for detailed fire propagation analysis, and REBECA. which was used for contamment response analysis.

2.2.7 Evaluation of Component Fragilities and Failure Modes Defnition ofFire-induced Failures a.

The submittal does 1ot include a separate discussion on fire-induced failures; however, some discussion is provided for cables. The analysis considered open circuit. wire to wire contact, short to ground. and hot short as possible cable faults. It was assumed that it is impossible to get three-phase hot shorts or a proper-polarity hot short in a DC circuit. The consequences of a cable fault were taken to be loss of control. loss of power, and spurious operation.

In Phase III analysis. the thermal properties of the elements in a propagation analysis were taken from COMPBRN. For electrical cabinets. it was assumed that they have the same properties as cables, with 400*F as the damage threshold temperature. It was assumed that a fully enclosed cabinet cannot contribute to the fire.

b.

Method Used to Determine Component Capactnes The submittal does not provide any discussion on component capacities (e g., a threshold temperature for cable failure). It is inferred that the capacities specified in FIVE [7] were used by the licensee. It should be noted that all safe shutdon cables are IEEE 383 qualified.

c.

Genenc Fragilines Used No specific discussion was provided in the submittal regarding equipment fragilities.

d Plant Specifc Fragthnes Used No plant-specific fragilities have been mentioned in the submittal.

Technique Used to Treat Operator Recovery Actions k

e.

Operator recovery actions have been included in the fire analysis. From the statements made in the submittal, I

it can be inferred that HEPs used in the IPE were revised to take into account the special conditions of the fire scenarios. Also, it is inferred that several new operator recovery actions were introduced into the model for addressing special conditions of specific fire scenarios. The screening HEPs used in the IPE have been used Energy Research. Inc.

30 ERl/NRC 97-507

]

i

p for some of the fire scenarios. One of the HEPs may be optinustic. The probability of operators failing to trip RCPs whm CCW is lost (presumably before seal failure) was taken as 5.2 x 10" Given that the available time window can be as snort as one-half hour, ard that the fire analyst does not have sufficient knowledge of other failures (especially instrumentation failures), this probability value seems to be optimistic. Reference [14]

provides some discussion on the basis of the HEPs, related fire areas, available time window, indications, etc.

Overall, the values assigned to the HEPs are reasonable. See Section 2.2.4(b) for a discussion on HEPs used in control room fire analysis.

2.2.8 Fire Detection and Suppression Fire detection and suppression was modeled explicitly for those fire scenarios where fire propagation analysis was performed. The combined time of detection and suppression was exanuned with respect to potential equipment and cable damage. In Phase 11, FIVE worksheets were used to estunate damage and suppression times. For those cases where fire damage occurs after fire suppression, the unavailability of the fire protection system was used for probability of non-suppression. The generic unavailabilities provided in Reference [7]

were used for this purpose The possibility ofmanual fire fighting has also been considered. From an analysis of the fire drills and fire incident reports. it was concluded that the average fire fighter response time is seven minutes. However, since for all fire scenarios. target damage was found to take place in less than seven minutes, it was concluded that credit could not be given to manual fire fighting. For transient fuel fire scenarios, it was concluded that damage occurs before suppression. Therefore, for transients, no credit was given to the possibilities of automatic and manual fire suppression.

' In Phase III, the damage time obtained from COMPBRN analysis was used. The submittal states that, the probability of non-suppression was derived by multiplying the probabilities of damage and non-suppression (the submittal refers to the latter as Pfrequency of non-suppression"). The submittal does not elaborate on how these values were obtained using the COMPBRN results.

2.2.9 Analysis of Plant Systems and Sequences Key Assumptions Inchedmg Success Criteria and Associated Bases a.

From the discussions provided in the submittal. it can be inferred that the success criteria were directly taken from the IPE analysis. without modification for the fire analysis.

b.

Event Trees (Fsmcrional or Systemic)

The submittal does not provide any information regarding the IPE plant logic model. Therefore, it is not clear whether functional or systemic event trees were employed in the fire analysis.

DependencyMatrix. Ifit is Di(ferentfrom thatfor Seismic Events c.

No dependency matrix has been provided in the submittal.

Energy Research. Inc.

31 ERI/NRC 97-507

F

d.

Plant-Unique System Dependencies The submntal does not present any unique system dapa wies. However, it should be noted that, for a few e.g

, a 6re can affect both units. This is especially the case for offsite power (i.e., there are several compartments where a fire may cause loss of offsite power to both units).

JMostSignifcant Human Actions

, e.

Human actions, as discussed above, have been considered as an integral part of the fire-risk quantification.

Based on the' discussions provided for the fire scenarios analyzed in Phase III of the analysis, it is not clear -

which actions were significant to the chain of events leadmg to core damage. From a review of Table 4.3-2 of the submittal, it can be concluded for the relay room (designated as 2-AC-9-17), that operator actions are krpwd in recovering a diesel generator fiom the contaof room. Also, it can be inferred that operator actions are Li@wd to turbine building 6re scenarios, since the availability of CCW is affected. The discussions on speci6c Phase III fire scenarios (submittal Section 4.4.2), provide sporadic mention of operator actions. For example, for diesel generator room fires, the possibility of recovering a failed switchgear is mentioned, but the probability values or related human error analysis are not discussed.

As it is mentioned in Section 2.2.7(e), Reference [14] provides comprehensive lists of operator actions, related HEPs and their bases. Also, Reference [14] provides detailed discussion of the hips used in control room fire analysis.

2.2.10 Fire Scenarios'and Core Damage Frequency Evaluation Several fire scenarios have been identified and analyzed m varvmg levels of detail. The analyses have taken into account numerous relevant issues; including the list of equipment and components failed by a Sre, the CCDP given damage caused by the fire. the conditional probability of failure to suppress the fire, etc. A large number of fire areas and compartments have been considered. and a summar,,f the analysis has been presented in the submittal.

Core damage frequencies were estimated in Phases II and 111 of the analysis. Phase II analysis was based on the assumption that all equipment and cables within a compartment are failed. The CCDPs for the unscreened fire compartments ranged from 3.5 = 10 to 1.0. In Phase 111, detailed fire scenarios were considered where a 4

specific set of equipment and cables were postulated to be affected by the fire. These sets are subsets of the equipment and cables assumed failed in the Phase 11 analysis of the same compamnent. In Phase III analysis.

the core damage frequencies for specific fire scenarios ranged from 4.8 = 10-"hy to 3.3 x 10 /ry. For some of 4

the 6re scenarios. it could be shown that damage to target cables and equipment is not possible. Although the individual fire scenarios were reported with such a wide range of core damage frequencies, the total CDFs for fire compamnents and areas fall within a smaller range. Alist of the major contributors to fire risk is presented in Table 2.1.

Energy Research. Inc.

32 ERI/NRC 97-507

f Table 2.1 Major Contributors to Fire Risk Fire Ignition Core Damage Area Systems / Equipment Frequency Frequency Affected by the Fire (per ry)

(per ry)

Switchgear room Loss of offsite power, train A 2.53 x 10'8 3.4 x 104 (2 AC 50 40) switchgear and main feeJwater Switchgear room Loss of offsite power, train B 2.65 x 10-2 3.1 x 10*

(2 AC-50-35) switchgear and main feedwater Electrical Penetration Room Loss of offsite power 2.54 x 10~'

2.4 x 104 (2-PE-63-3 B)

Turbine Building Loss of main feedwater 4.50 x 10 2 2.3 x 104 (2 TB-148)

Electrical Penetration Room Loss of offsite power 2.54 x 10

2.3 x 104 (3-PE-63-3B)

Electrical Penetration Room Loss of offsite power 2.54 x 10

l.5 x 10 4

(2-PE-45 3 A) 4 Relay Room Loss of offsite power 7.95 x 10" 1.2 x 10 (2-AC-9-17)

Diesel Generator Room Station black out 5.00 x 10" 1.2 x 104 (2 DG-30-155)

Diesel Generator Room Station black out 6.00 x 10" 1.2 x 104 (2 DG-30-158) l Switchgear Room Loss of offsite power 2.53 x 10

l.1 x 104 (2 AC-85 71)

There are some common fire compartments between Units 2 and 3. A fire in these areas can affect both units j

at the same time. The submittal mentions these commonalties, but does not show how the combined risk is different from the reported individual-unit fire risk level.

Core damage frequency was the pnncipal parameter used for quantitative screening and presentation of the j

fmal results in the fire analysis. The IPE logic models were used in this analysis. Fire ignition. propagation.

suppression, and damage to safe shutdonu cables and equipment were included in the analysis. The IPEEE submittal and Reference [14] present numetous tables that smnmarize different computations and numerical results; however. sufficient detail is not provided to enable a thorough verification of the infonnation provided j

in those tables.

)

Self-induced station blackout is not explicitly mentioned in the submittal. However, from the discussions provided for these fire scenarios that lead to loss of offsite power, it can be inferred that in several cases the recovery procedure requires manual trip of power before restoration. The information provided in References

[1] and [14] is insufficient to draw any conclusions regarding the contribution of self-induced station blackout to the fire risk at San Onofre.

l l

i

)

l Energy Research, Inc.

33 ERl/NRC 97-507

l 2.2.11 Analysis of Contamment Performance Contamment failure analysis (i.e., Level-2 analysis) was conducted for those fire scenarios that were found to be risk-signi6 cant in Phase III. The event tree models and analytical methods used in the IPE were employed for this purpor.,

Sigmfcant Containment Performance Insights a.

The submittal includes discussions ofinside-and outside-containment fires. Inside-contamment fires were addressed in Phase I, and were found to be of httle significance because of sufficient separation among various safe shutdown elements. Outside-containment fires affect contamment isolation. An analysis of containment isolation valves was conducted for assessing the potential of a hot short in their control circuits, and it was concluded that none of the significant fire scenarios outside of the containment could affect the containment-related functions in an adverse fashion However, the submittal states that several of the containment isolation valves were not included in the Appendix R list of equipment and components. For thew valves, a special analysis was conducted. and it was concluded that isolation failure would not occur from a fire incident. This conclusion was based on the presence of check valves or nonnally closed valves in the line. Reference [14]

confirms that, in at least one case, normally closed valves are also kept de energized.

As a result of the Level-2 analysis, it was concluded that there are no new containment failure modes other than those identified as part of the IPE effort for internal initiators. The same models as those used in the IPE are applicable to the analysis of containment behavior in response to a fire incident. The distribution of occurrence of different plant damage states resulting from a fire is approximately the same as that concluded in the IPE for intemal events initiators.

b.

Plant-Umque Phenomenology Considered As mentioned above, the IPE model for the Level-2 analysis was used for the fire contamment performance analysis. The results are sinular to those found in the IPE analysis. No containment-related phenomena were identified as being unique to fire scenarios.

2.2.12 Treatment of Fire Risk Scoping Study issues 1

Assumptions Used to Address Fire Risk Scopmg Studyissues a.

All of the Sandia fire risk scoping study issues have been addressed and resolved. The licensee has presented

)

a detailed discussion pertaining to each issue, as summarized below.

1.

Seicmic-fire interaction is addressed as part of the seismic IPEEE A detailed discussion is provided in the submittal. A walkdown was conducted specifically for the evaluation of seismic-fire interactions. All plant areas have been investigated, flammable and combustible sources have been identified, and opinions expressed regarding the fragility of the equipment, the failure of which may lead to ignition and fire. The walkdown results show that all potential sources for fires are either seismically rugged (i.e.. can withstand a rather high seismic motion) or there are no safety-related equipment or cabling nearby.

Energy Research, Inc.

34 ERI/NRC 97-507 l

Be potential for inadvertent seismic actuation of a fire suppression system, and resulting effects on safety equipment were also addressed as part of the seismic analysis (Section 3.3.4.3 of the submittal).

Based on the seismic capacity walkdown and a seismic categories II/I analysis, it was concluded that safe shutdown equipment are not at risk of failure from fire suppression system failure during an earthquake.

"Ihe possibility of seismically induced failure of fire protection systems is addressed on page 3-47 of the submittal. Since the fire protection system was designed according to the seismic requirements of the region, it was concluded that this system is sufficiently rugged.

2.

A detailed discussion is prmided in the submittal related to fire barriers. Specific inspection and surveillance procedures and requirements are referenced that verify the integrity or operability of penetration seals, fire barriers, fire dampers, fire doors, and fire windows. The suney and analysis conducted as a result ofInformation Notice 89-52 is mentioned. where the effect of the ventilation system on damper closure was investigated. Administrative ventilation system shutdown was considered to ensure damper closure. It is not clear whether er not a human error probability associated with this action is included in the fire analysis. In fact, in Section 4.1.2 of the submittal.

it is stated that " operator actions to tum off the HVAC in order to ensure damper closure are not included in the fire models."

3.

The plant fire brigade is composed of professionally trained full-time fire fighters. A muumum of five fire fighters are on duty every shift. Also, a number of plant personnel are knowledgeable in the use ofportable fire ex:inguishers. Several procedures are implemented for fire detection. fire fighting. and fire brigade training and drills. The fire brigade undergoes extensive drills on a regular basis. It should also be mentioned that fire fighting procedures require that an operator accompany the fire brigade to fire locations, to insure proper knowledge of systems and equipment.

4.

Regarding equipment sunival under adverse emironments and operator effectiveness, the licensee conducted several analyses where the effects of fire suppression system actuation were investigated.

It was concluded that there would be no adverse effects on safe shutdown equipment. Several plant modifications had been implemented to minimize water egress into the control and switchgear rooms.

Regarding fire impacts on operator effectistness in carning out required tasks (from an emironmental standpoint), a special procedure has been implemented at SONGS for potential control room fires and control of vital plant functions from outside the control room. The submittal also mentions that self-contained breathing apparatus (SCBA) gear are provided for the operators.

5.

The submittal references a documented analysis of the adequacy of transfer switches and control circuit isolation from the control room. It also mentions upgrades in the isolation capability as a result of that analysis, b.

Sigmticant Fmdmgs No new insights were gained from the licensee's review of the isc 2es raised in Sandia's fire risk scoping study, other than those insights that had already been gained from other studies or from implementation of special.

relevant procedures and practices.

f Energy Research. Inc.

35 ERl/NRC 97-507

2.2.13 USI A-45 Issue a.

Methods ofRemoving DecayHeat The IPEEE fire malysis uses logic models developed for the IPE. which include the entire array of decay heat removal capabilities of the plant.

b.

Abtlity of the Plant to Feed and Bleed (PWRs)

The submittal does not specifically indicate whether the ability to feed and bleed exists at San Onofre.

c.

Credit Takenfor Feed and Bleed (PWRs)

The submittal does not specifically indicate whether credit has been taken for feed and bleed capability.

d Presence of Thermo-Lag Reference [1] does not mention the presence of Thermo-Lag at SONGS.

2.3 HFO Events A variety of extemal events have been considered in the original plant design. The general methodology for the HFO IPEEE analysis consisted of the following steps:

A screenmgprocess was performed in order to exclude insignificant risk contributors and to determira that no significant hazards have been onutted. An overall list of extemal events was compiled from the UFSAR and NUREG/CR 2300 [4). Updated plant specific data including relevant data about the region around the plant (e g. geological. meteorological, and hydrological conditions, and aircraft and sea vessel frequency data) was collected. Table 5.3-1 (pages 5-7 through 5-14) of the submital provides the results of the initial screening process. Except for high winds and tomadoes. extemal floods, and transportation and military facility accidents. all other extemal events were screened out l

based on the infonnation provided in the UFSAR and on additional data collected during the IPEEE.

l With respect to the remaining hazards, a review was performed to verify that the plant is still in conformance to the original design bases. which conforms to the 1975 Standard Review Plan criteria.

A wa/kdown was performed and documented by the licensee staff to verify that the plant conditions and configuration with respect to the extemal hazards had not changed since the UFSAR evaluation.

The walkdon concentrated on plant design features that could be affected by high winds floods,

)

external fires, and onsite storage of hazardous materials. The walkdown included items such as:

extemal flooding sources and targets; roof ponding potential; tomado missile sources and shielding; 3

biological fouling; non-engineered slope failure potential; and sources of toxic and flammable materials. From the walkdown, it was concluded that there were no identifiable hazards that had not been considered by the UFSAR. and that the mitigating design features were in place as documented by the UFSAR analyses.

Energy Research, Inc.

36 ERI/NRC 97-507

In response to an RAI, the liccnsee provided a detaded comparison of the applicable 1975 SRP criteria with the SONGS UFSAR criteria and analysis results [14]. This provides a good argument that the structures, systems and components important to safety at SONGS 2 and 3 are designed to withstand the effects ofnatural and man-made extemal hazards. For each extemal event, the plant was evaluated against the most severe case of that event consistent with the historical data with margin to account for uncertainty.

In summary, following events have been addressed in detail in the SONGS HFO IPEEE:

High winds and tornadoes External floodmg Nearby industrial, transportation, and military facility accidents

+

The licensee's analysis of each of these events is considered in more detail in the following subsections.

2.3 1 High Winds and Tomadoes 2.3.1.1 GeneralMethodology The high wind analysis for the San Onofre Plant is based primarily on the plant's UFSAR assessment. With respect to tomados, the submittal was based on a hazard analysis conducted in 1990, 1

The structumi integrity of seismic Category-I buildings was analyzed for three types of loads, namely, tornado-induced pressures. dynamic wind pressure. and missile impacts from t'ornadoes. Details of the analyses have not been provided in the IPEEE submittal. but rather, reference is made to a contractor report by ERIN Engmeering. The results of the analyses led to the conclusion that high winds and tomadoes are not a credible threat to the integrity of the plant.

In summary, the effects of high-wind loadmg. tomadic wind-loading. and the effects of tornado-generated missiles are stated to have been considered in the IPEEE submittal. No structures or components nilnerable to wind and tomadoes were identified.

2.3.1.2 Plant-Specific Hazard Data and Licensing Basis The design wind velocity for all Category-I structures is 100 mph. The highest wind velocity measured at the San Onofre meteorological tower at the 10 m level (since 1971) was 47.4 mph. and the highest wind velocity measured at a height of 40 m was 49 mph. Based on the data obtained over a minimum of twenty-five years in Los Angeles. San Diego, and the San Onofre site, the licensee states that a 100-year retum period maximum wind speed of 63 mph can be considered a conservative estimate for the San Onofre site. This value is significantly lower than the wind speed of 100 mph used as the design wind velocity of structures at San Onofre.

It is stated in the submittal that the only tornado capable of damaging safety-related structures and equipment is an F5 tornado.' The submittal states that no F4 or F5 tomadoes have occurred in Califomia in the time i

period between 1950 and 1975. The majority of tomadoes recorded in Califomia belong to Class F1 with a maximum wind velocity between 73 to 112 mph, and only one tornado with a speed of 157 mph has been recorded in the past twenty-five year period, t

Energy Research, Inc.

37 ERI/NRC 97-507

o The submitral states that hurricanes with wM velocities of more than 7,2 mph have never been observed in the southwestern United States, and, therefore, analysis of hurncane hazards is not required for the San Onofre Station.

2.3.1.3 Significant Changes Since Issuance of the Operating License he walkdown established that there were no significant changes that altered compliance with the operating license [14).

2.3.1.4 Significant Findings and Plant Unique Features a

The switchyard and the transformers are expected to be the most likely equipment to be damaged during a tomado. The threat to the plant is implicitly considered in the empirically based loss of oEsite power initiating event frequency.

High winds were screened out on the basis of NUREG-1407 screening guidance. Specifically, the plant's design hazard information and licensing basis were reviewed and compared to the 1975 SRP criteria, which was the plant's design basis. As verified by walkdowit. changes to the plant's stmetures since the issuance of the operating license conform to the 1975 SRP criteria [14]. In accordance with Section 5.2.3 of NUREG-4 1407, therefore, the high wind contribution to core damage frequency may be presumed to be less than 10 per reactor year.

2.3.1.5 Hazard Frequency An analysis of the tornado hazard at San Onofre was completed in 1990, and the probability of a tornado 4

strike of any size, at the site was established to be 4.5x10 per year. Since only the F5 tornadoes are stated to be capable of damaging safety-related equipment and stmetures. and since the probability of an F5 tomado strike is approximately 8x10 per year, it was concluded that the tomado design basis (260 mph) is sufficiently 4

conservative.

The IPEEE submittal concludes that the San Onofre plant has no Class-1 structure which is vulnerable to wind pressure differential pressure. or tornado-generated missiles.

2.3.2 Exterul Flooding 2.3.2.1 General Methodology The San Onofre IPEEE external flooding analysis considers potential flooding from two local flood sources.

as well as probable maximum precipitation (PMP), including the new PMP data from the National Oceanic and Atmospheric Administration (consistent with GI-103, " Design for Probable Muimum Precipitation").

The plant was evaluated assuming a completely failed roof drainage system.

2.3.2.2 Plant-Specific Hazard Daca and Licensing Basis Two areas in the vicinity of the site were considered to be potential flood sources. namely, the San Onofre Creek basin and the foothill drainage area. The distance from the mouth of the San Onofre Creek to the plant site, and the topographical features of the site, prevent flooding at the site. To prevent flooding of the site from Energy Research. Inc.

38 ERl/NRC 97-507 1

i j

the foodull dramage ama, a berm was erected (at the time of construction of the plant) to divert the water from the foothill dramage area to San Onofre Creek. ' As such, as discussed in Section 2.3.2.4 below, th'e

- thunderstorm PMP was determined to result in the maxunum flood level at.he site.

' 2.3.2.3 Significant Changes Since Issuance of the Operating License The submittal states that there have not been any significant developments affecting the origL,al design condition, with respect to floods, since the time ofissuance of the plant operating license (OL).

2.3.2.4' Significant Findings and Plant-Unique Features It was d&oied that the thunderstonn PMP causes higher flood levels than the frontal stonn flood levels, and hence, it was chosen as the design-basis event. The dramage system was assumed to malfunction (with all roof drams, floor drams, and catch basins plugged) to detennine the highest water level. It was determined that no -

safety-related equipment of any building would be affected during this PMP. The evaluation of the effect of the new PMP data on the maximum water level was completed in March 1990 for the San Onofre plant. The

. original precipitation data (in the FSAR) are stated to be more conservative than the new data. During an HFO

{

~walkdown performed for the IPEEE, some parapet scuppers designed for rainwater drainage from the auxiliary building roof were found to be closed. Based on the maximum probable precipitation data for thunderstorms, the highest water level on the auxiliary building roof caused by flow restriction, due to the reduced number of i

scuppers, was calculated to be 7 inches The resulting roofload was detennined to be much less than the roof design load.

2.3.2.5 Hazard Frequency External flooding was screened out for the San Onofre plant using a qualitative screening process, and no hazard frequency was calculated.

2.3.3 Transportation and Nearby Facility Accidents

'2.3.3.1 General Methodology

~ The San Onofre plant is located adjacent to two highways, namely, Highway 101, and the Interstate 5 freeway.

a railway track also runs near the plant. The plant site is situated on the Pacific coast; though commercial

. shipping lanes in the Pacific Ocean are reported to be more than 5 miles from the site. Accordingly, the San Onofre IPEEE submittal has addressed aircraft hazards. railway and road transportation accidents, and accidents occurring at nearby military facilities.

The licensee has made extensive efforts to obtain new or revised hazard data, and to update its UFSAR analysesf The calculated frequencies of highway and railway accidents that can generate an overpressure of at least 7 psid (i.e., the design pressure limit for plant structures). or that can lead to flammable vapor clouds 4

that can potentiallyjeopardize plant safety, were all less than the screening criterion of lx 10 per year. The data collected for total number of aircraft operations was less than the estimate given in the FSAR. and hence, aircraft hazards were also screened out.

Energy Research. Inc.

39 ERI/NRC 97-507

w 2.3.3.2 Plant-Speci6c Hazard Data and Licensing Basis For aircraA crashes and hazardous matenal transport by train and highway, the data used in the San Onofre LUFSAR was updated using plant-speedic data collected durmg 1993, and using new infonnation MaaA from

, the Federal Aviation Ad'aini*ation (FAA), as outlined in Section 2.3.3.5 below.

2.3.3.3 ' Significant Changes Since Issuance of the Operating License Changes since the operating license include updated air, land and sea transportation statistics.

2.3.3.4 Significant Findings and Plant-Unique Features The IPEEE submittal has identified no vulnerabilities with respect to transportation and nearby facility accidents.

2.3.3.5 Hazard Frequency The probabilistic analysis of accidents caused by transportation of hazardous materials', performed as a part

~of the UFSAR. was updated in 1993. As a part of this analysis. survey personnel were stationed next to the Interstate 5 freeway, for two weeks. to determine the contents of the trucks. Based on the overall hazardous material shipment frequency for two weeks, an annual shipment frequency was calculated. The updated shipment frequency.was used to calculate an updated hazard frequency, using the FSAR analyses. All shipments with the potential to generate more than 7 psid overpressure at the plant were evaluated together as a single eventi The frequency of truck related accidents capable of generating an overpressure of 7 psid was 4

found'to be 1.2x10 per year.

The data for railroad shipments was re-evaluated in 1993. The number of liquefied propane gas (LPG) shipments in 1992 was estimated to be 2,230. The frequency of LPG explosions capable of producing a 4

' differential pressure of 7 psid at the plant was estimated to be 1.5x10 per year. Flammable vapor clouds released by a transponation accident that may potentially jeopardize plant safety were also considered, and an 4

annual frequency of 6.2x10 was obtained.

The licensee utilized the information provided by the' U.S. Navy and Marine Corps to detennine tnat the maximum shipment of explosives passing the San Onofre site was 27,014 pounds. The maximum overpressure j

caused by explosion of the largest shipment was found to lead to a pressure of 4.7 psid at the plant. Thus, the assessment detemuned that explosion of military explosives along the highway is not a threat to the San Onofre plant.

AircraA operation data was updated (from the original 1975 data) based upon new infonnation obtained from

- the traffic control center of the FAA. The number of military aircraft operations has been reduced. but the 4

number ofcommercial operations has increased since 1975. The data was extrapolated to the year 2005, and

\\

. it was concluded that the number of operations in the vicinity of the San Onofre area would be about 92,300.

This esumate is less than half the esumate of 198,848 operations per year in the FSAR; hence, aircraA crashes are stated to not pose a risk to the operation of the San Onofre plant.

Energy Research, Inc.

40 ERI/NRC 97-507

2.4 Grneric Safety Issues (GSI-147. GSI-148. GSI-156 and GSI-172) 2.4.1 GSI 147, " Fire-Induced Alterrate Shutdown / Control Panel Interaction" Generic Safety Issue (GSI)-147 addresses the interactions between the main control panels and the alternate shutdown system, and potential vulnerabilities of the control circuits associated with these panels. The following items have been raised in this generic issue:

Electrical independence of remote shutdown control circuits Loss of control power before transfer from the main control room to the altemate shutdown panel Total loss of system function Spurious actuation of components

+

Reference [14) addresses this generic safety issue. Th.: possibility of using the alternate shutdown panel was addressed in several fire scenarios. The specific issues raised in this generic issue have been addressed in Reference [14].

2,4.2 GSI-148, " Smoke Control and Manual Fire Fighting Effectiveness" GSI 148 addresses the effectiveness of manual fire-fighting in the presence of smcke. Smoke can affect a fire scenario and operator actions in the following ways:

Reduce fire brigade's visibility, and cause misdirected suppression efforts Adversely affect electronic equipment Hamper the ability of operators in the control room to safely shut down the plant Initiate automatic fire suppression systems in areas away from the fire i

Reference (25] identifies possible reduction of manual fire-fighting effectiveness and causing misdirected

]

suppression efforts as the central issue in GSI 148. Although manual fire-fighting has been considered in the IPEEE submittal. it is not credited in any of the fire compartments. Therefore, the issues raised above have little effect on plant risk as it has been modeled by the licensee. Manual fire fighting was addressed as part of the assessments perfonned for issues raised in Sandia's fire risk scoping study.

2.4.3 GSI-156, " Systematic Evaluation Program (SEP)"

SONGS 2 and 3 were licensed under the 1975 SRP. This propm does not apply to these units.

2.4.4 GSI-172, " Multiple System Responses Program (MSRP)"

Reference [25] provides the description of each MSRP issue stated below, and summarizes the scope of infonnation that may be reported in an IPEEE submittal relevant to each such issue. The objective of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-172 may be found.

Energy Research. Inc.

41 ERI/NRC 97-507

Common Cause Failures (CCFs) Related to Human Errors Descriotion of the Issue [25]: CCFs resulting from human errors include operator acts of commission or omission that could be initiating events, or could affect redundant safety-related trains needed to mitigate the events. Other human errors that could initiate CCFs include: manufacturing errors in components that affect redundant trains, and installation, maintenance or testing errors that are repeated on redundant trains. In IPEEEs, licensees were requested tc address only the human errors involving operator recovery actions following the occurrence of external initiating events.

The SONGS 2/3 SPRA included detailed assessment of post initiator operator actions that would result from an canhquake. This is described in submittal Sections 3.6.4 and 3.6.7 and in reference [14].

Non-Safety-Related Control SystenvSafety-Related Protection System Dependencies Descrintion of the Isms [25]: Multiple failures in non-safety-related control systems may have an adverse impact on safety-related protection systems, as a result of potential unrecognized dependencies between control and protection systems. The concem is that plant-specific implementation of the regulations regarding separation and independence of control and protection systems may be inadequate. The licensees

• IPE process should provide a framework for systematic evaluation ofinterdependence between safety-related and mn-safety-related systems, and should identify potential sources of vulnerabilities. The dependencies between safety-related and non-safety-related systems resulting from extemal events -- i.e., concems related to spatial and functional interactions - are addressed as pan of " fire induced attemate shutdown and control room panel interactions," GSI 147, for fire events, and " seismically induced spatial and functional interactions" for seismic events.

Information provided in the San Onofre IPEEE submittal penaining to seismically induced spatial and fu. :tional interactions is identified below (under the heading Seismically Induced Spatial and Funcnonal Interacnons), whereas infommtion pertaining to 6re-induced altemate shutdown and control panel interactions has already been identified in Section 2.4.1 of this TER.

Heat Smoke Water Propagation Effectsfrom Fires Descriotion of the Issue [25]: Fire can damage one train of equipment in one fire zone, while a redundant train could potentially be damaged in one of following ways:

Heat. smoke, and water may propagate (e.g., through HVAC ducts or electrical conduit) into a second fire zone, and damage a redundant train of equipment.

A random failure, not related to the fire, could damage a redundant train.

Multiple non-safety-related control systems could be damaged by the fire, and their failures could affect safety-related protection equipment for a redundant train in a second zone.

A fire can cause unintended operation of equipment due to hot shorts, open circuits, and shorts to ground.

Consequently, components could be energized or de-energized. valves could fail open or closed. pumps could continue to run or fail to run. and electrical breakers could fail open or closed. The concern of water propagation effects resulting from fire is panially addressed in GI-57, " Effects of Fire Protection System Energy Research,Inc.

42 ERI/NRC 97-507

~

Actuation on Safety-Related Edmme " he concern of smoke propagation effects is addressed in GSI 148.

He concern of attemate shutdown / control room interactions (i.e., hot shorts and other items just mentioned) is addressed in GSI-147.

. infonnation provided in the San Onofre IPEEE submittal pertaining to GSI-147 and GSI-148 h: already been idemified in Sections 2.4.1 and 2.4.2 of this TER. Some information pertauung to this issue is pro ided in Sections 4.2.1.7,4.3.2, and 4.3.3 of the submittal.

Effects ofFire Suppression System Actuation on Non-Safety-Related and Safety-Related Equipment Deemiotion of the Icen* [25] Fire suppression system actuation events can have an adverse effect on safety-related cow.cnts, either through direct contact with suppression agents or through indirect interaction with non-safety related components.

The SONGS IPEEE does not address the effects cf fire protection system actuation on non-safety-related equipment. He effects of seismicallyinduced FPS acnation on safety-related equipment have been addressed q

in detail in the submittal Section 3.3.4.

Effects ofFloodmg and or Moisture intrusion on Non-Safety-Related and Safety-Related Equipment Description of the Issue [25]: Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through floodmg or moisture intrusion of multiple trains of non-safety-related equipment.

This type of event can result from extemal flooding events. tank and pipe ruptures, actuations of fire suppression systems. or backflow through parts of the plant drainage system. The IPE process addresses the concems of moisture intmsion and internal flooding (i e., tank and pipe ruptures or backflow through part of the plant dramage system). The guidance for addressing the concem of extemal flooding is prosided in Chapter 5 of NUREG-1407. and the concern of actuations of fire suppression systems is provided in Chapter 4 of NUREG-1407.

Seismically induced flooding was addressed with respect to affecting equipment in the SEL as described in submittal Section 3.3.4. His includes inadvertent FPS actuation. External flooding is treated in Section 5.5.

Seismically Induced Spanal and Funcnonal Interacnons Descrintion of the Issue [25]: Seismic events have the patential to cause multiple failures of safety-related systems through spatial and functional interactions. Some particular sources of concem include: ruptures in small piping that may disable essential plant shutdown systems: direct impact of non-seismically qualified structures, systems, and components that may cause small piping failures; seismic functional interactions of control and safety-related protection systemt via multiple non-safety related control systems' failures; and indirect impacts. such as dust generation. disabling essential plant shutdown systems. As part of the IPEEE, it was speci6cally requested that seismically induced spatial interactions be addressed during plant walkdowns.

The guidance for performing such walkdowns can be found in EPRI NP-6041.

He SONGS IPEEE has included a' seismic walkdown which investigated the potential for adverse physical interactions among safety related equipment, with respect to FPS sprinkler heads, and with respect to Category II/I interactions as desenbed in submittal Section 3.3. Affects of building failures on SEL equipment are included in the seismic core damage model per submittal Sections 3.6.5 and 3.6.6.

Energy Research, Inc.

43 ERI/NRC 97-507

SeismicallyInducedFires Descrintion of the krue [25): Seismically induced fires may cause multiple failures of safety-related systems.

The occurrence of a seismic event could create fires in multiple locations, simultaneously degrade fire suppression capability, and prevent mitigation of fire damage to multiple safety-related systems. Seismically

)

induced fires is one aspect of seismic-fire interaction concerns, which is addressed as part of the Fire Risk Scoping Study (FRSS) issues. (IPEEE guidance specifically requested licensees to evaluate FRSS issues.)

In IPEEEs, seismically induced fires should be addressed by means of a focused seismic-fire hiteractions walkdovm that follows the guidance of EPRI NP-6041.

The SONGS IPEEE has included an assessment of seismically induced fires in a detailed evaluation of seismic-fire interactions in submittal Section 3.3.4.

SeismicallyinducedFire Suppression System Actuation Description of the Issue [25]: Seismic events can potentially cause multiple fire suppression system actuations which. in tum, may cause failures of redundant trains of safety-related systems. Analyses currently required by fire protection regulations generally only examine inadvenent actuations of fire suppression systems as single. independent events, whereas a seismic event could cause multiple actuations of fire suppression systems in various areas.

The SONGS IPEEE has included an assessment of seismically induced fire suppression system (FSS) actuation in a detailed evaluation of seismic-fire interactions in submittal Section 3.3.4.

SeismicallyInduced Floodmg Descriotion of the Issue [25]: Seismically induced flooding events can potentially cause multiple failures of safety-related systems. Rupture of small piping could provide flood sources that could potentially affect multiple safety-related components simultaneously. Similsrly, non-seismically qualified tanks are a potential flood source of concem. IPEEE guidance specifically requested licensees to address this issue.

The SONGS IPEEE has included a detailed assessment of seismically induced flooding in submittal Section 3.3.4 including inadvertent FRSS actuation.

SeismicallyInduced Relay Charter Description of the Issm [25]: Essential relays must operate during and after an earthquake, and must meet one of the following conditions:

remain functional (i.e., without occurrence of contact chattering):

be seismically qualified; or

+

be chatter acceptable.

It is possible that contact chatter of relays not required to operate during seismic ' on may produce some unanalyzed faulting mode that may affect the operability of equipment required to nuu

• the event. IPEEE s

guidance specifically requested licensees to address the issue of relay chatter.

Energy Research, Inc.

44 ERI/NRC 97-507

The licensee performed a relay chatter evaluation as part of the seismic IPEEE. Refer to submittal Sections 3.2.1,3.3.3 and 3.6.3 discussions of the evaluation.

Evaluation ofEarthquake Magnitudes Greater than the Safe Shutdown Earthquake Descrintion of the Issue [25): The concem of this issue is that adequate margin may not have been included in the design of some safety-related equipment. As part of the IPEEE, all licensees are expected to identify potential seismic vulnerabilities or assess the seismic capacities of their plants either by performmg seismic PRAs or seismic margins assessments (SMAs). He licensee's evaluation for potential vulnerabilities (or unusually low plant seismic capacity) due to seismic events should address this issue.

A SPRA evaluation has been undertaken as part of the SONGS IPEEE. Motions in excess of the SSE have been considered in this evaluation as described in submittal Section 3.0.

I Energy Research. Inc.

45 ERI/NRC 97-507

3 OVERALL EVALUATION, CONCLUSIONS AND RECOMMENDATIONS l

I 3.1 Sciamic The seismic IPEEE of San Onofre Nuclear Generating Station addresses all major elements specified in

~ NUREG-1407 as recommended items that should be considered for S?RA of a western U.S. plant where seismic margin methods do not apply. The submittal itself provides a clear description of the seismic evaluation, it provides excq*innally full detads in several aspects of the analysis, and the documentation is well orgamzed he study prmides useful information conceming dommant sequences, systems, components, and j

ground motions.

Asjudged from the present submittal-only review, the following items are siewed as the pnmary strengths of I

the SONGS seismic IPEEE submittal (no weaknesses were identified):

r 1.

The licensee undenook a state-of-the-an SPRA study with plant specific hazard curves, good systems analysis and Level-2 contamment performance analysis.

2.

The IPEEE documentation is clear, well-explained, and provides a detailed presentation of various aspects of the analysis'.

3.

The licensee apparently had a meaningful panicipation in the seismic IPEEE process.

4.

Dominant accident sequences have been clearly developed and described.

5.

A number of anomalies have been reported, and some relevant plant improvements have been proposed.

6.

A comprehetsive seismic fire / flood interaction walkdown and evaluation has been performed.

7.

A rigorous relay chatter study with fragilities included in the systems model was included.

8.

Screening was based on both walkdown and capacity calculations.

The SONGS seismic IPEEE submittal has also considered a number of related generic issues and unresolved safety issues, and has deemed these issues to be closed either because they are not applicable to SONGS or because they were adequately addressed in the IPEEE.

One additional observation from the review of the SONGS seismic IPEEE submittal is that the results of the seismic PRA model have been observed to be sensitive to the rate of operator failures in recovering from chatter of diesel generator relays. This issue was investigated by the licensee, who found that resetting these relays is nearly an " automatic" operator action. He licensee also perfonned a cost benefit analysis, and found that changing the relays was not cost effective.

3.2 Eiri The licensee has expended considerable effon in the preparation of the fire analysis portion of the SONGS IPEEE. The SONGS fire IPEEE addresses all major elements specified in NUREG-1407. The licensee has Energy Research. Inc.

46 ERI/NRC 97-507 u

employed proper methodology (i.e., a combination of the FIVE and PRA methodologies) and has used proper 6te occurrence and suppression system failure data bases for conducting the fire analysis.

f The submittal provides a comprehensive description of the fire evaluation and the documentation is well '

organized. He study provides usefulinformation concerning dommant fire scenarios.

Asjudged from the present submittal-only review, the following items are siewed as the prunary strengths of the SONGS fire IPEEE submittal:

1.

The Sre analysis portion of the IPEEE submittal is well written. He overall presentation is clear and well orgaruzed Tables and figures provide considerable supporting information for the analyses and conclusions.

2.

Acceptable methodology and data have been used.

3.

The final conclusions are reasonable and within the range of results expected for a /WR.

4.

It is clear that the analysis conducted in support of the fire IPEEE is very thorough and addresses issues that are typically not considered in other fire PRAs and IPEEE submittals.

No significant weakness have been identified in the fire IPEEE; however, the following observations should be noted:

1.

Sensitivities of the Snal results to specific assumptions were not detennined, in the screening analysis, there vxre several cases where the core damage frequency was only dightly smaller than the threshold value. Clearly, for these cases the resulting conclusion to screen the fire scenarios is highly sensitive to underlying assumptions.

2.

The fire initiation frequency for the cable spreading rooms is small compared to the r,pical frequency employed for such rooms, and sufficient justification is not provided to explain why it diffe.s from other studies.

3.

The human error probability for proper usage of thi altemate shutdown panel is small compared to the typical failure probability employed for such actions, and sufficientjustification is not prosided to explain why it differs from other studies.

4.

There is only one control room that serves both units. The submittal does not include an explicit discussion of the possibility ofinteractions between the two reactor units.

3.3 HFO Events HFO evaluation implemented the progressive screening method of NUREG-1407. Performance of verification walkdowns were done appropriately. After identification of changes made since the operating license (OL),

an evaluation to determine the compliance with the current SRP criteria was perfonned. There were no significant plant changes. However, data associated with PMP, train, aircraft, sea traffic and highway traffic were updated. The screening methodology appeared to be followed correctly and no significant weaknesses Energy Research. Inc.

47 ERI/NRC 97-507

were noted dunng this review. The following are considered to be the major strengths of the submittal (no weaknesses were identi6ed):

1.

The HFO pornon of the IPEEE submmal has been camed out by the licensee (with technical guidance provided by one outside contractor),~and the licensee has gamed insights with respect to potential vulnerabilities due to HFO events affecting the San Onofre site.

. 2.

A significant feature of the study was the detailed companson of the applicable 1975 SRP criteria with the SONGS UFSAR criteria and analysis results [14]. This added substantial documentation to the origmal submmal [1]. This comparison provides confidence that all significant HFO external events have been considered and that none should be considered a vulnerability, s

Energy Research. Inc.

48 ERI/NRC 97-507 t...

4 IPEEE INSIGHTS, IMPROVEMENTS AND COMMITMENTS 4.1 Sciamic The seismic CDF was determmed to be 1.7x10 per reactor year. The plant median capacity was reported as 4

approximately 1.7g for PGA, or 3.8g for S, averaged over the frequency range of 1 to 10 Hz. The plant HCLPF capacity was reported to be about the same as the SSE, that is,0.67g PGA or 1.5g S,(1-10 Hz).

Following are listed the top five accident sequences (seismic damage states), together contributing over 85%

to the seismic CDF, as well as their dommant component or random failures:

Sequence 1: Seismically induced LOSP and loss of emergency switchgear (39% of the seismic CDF),

dominated by seismi: loss of MCCs.

Sequence 2: Seismically induced LOSP with seismic failure ofinstrumentation and control (19% of the seismic CDF), dominated by failu c of the auxiliary building.

Sequence 3: Station blackout resulting from unrecoverable seismically induced LOSP, in combination with random fadures. but no additional seismic failures (15% of the seismic CDF). This sequence is dominated by random failures of diesel generators or their support systems.

Sequence./: Seismic LOSP, with no additional seismic failures, but random failures of the condensate makeup system and auxiliary feedwater (AFW) pumps (8% of the seismic CDF). This sequence is dominated by random loss of AFW.

Sequence 5: Seismically induced LOSP and small loss-of-coolant accident (LOCA), with loss of i

emergency switchgear (7% of the seismic CDF), dominated by seismic loss of MCCs i

Quantification of seismic release category frequencies revealed only two early radiological release categories with measurable frequency (i.e., contributing at least 0.1% to total seismic CDF). These two categories are (1) containment bypass with less than 0.1% of volatiles released (2.6x10 /ry), and (2) early/ isolation failure 4

with up to 10% of volatiles released (3.9x10 /ry). The bypass scenario involves steam generator tube rupture.

d Based on the seismic IPEEE findings the licensee reports no specific seismic vulnerabilities with respect to safe shutdown or containment performance. During the seismic walkdowns, approximately 30 anomalous conditions were observed. most of which were resolved through additional consideration. In some instances.

however, a plant modification has been proposed. Following are the six plant changes reported in the submittal as having a beneficial impact on seismic safety:

Improvement in the reliability of cross-connecting emergency diesel generators between the two units.

Strengthening of the supports of an ammonia tank to eliminate a spill hazard.

Removal of a floor grating surrounding AFW valve actuators to eliminate an interaction hazard.

Removal of a concrete plug surrounding the Unit-2 diesel generator fuel oil transfer piping to improve the seismic capacity of the pipe and to provide a plant configuration consistent with Unit 3.

Energy Research. Inc.

49 ERI/NRC 97-507

Fastenmg together of adjacent electrical cabinets / panels to help prevent interactions and relay chatter.

Stabi'izing light fixtures that may interact with electrical cabinets.

4.2 Eirt Overall, the licensee has concluded that there are no significant fire vulnerabilities at SONGS. He licensee states the following:

"a vulnerability in a PWR is a plant feature which contnbutes a disproportionately large p;rcentage to either core damage or significant release probabilities which are in turn significantly higher than those of an average PWR."

The total fire CDF from " unscreened" scenarios was estimated at 1.6 = 10'5/ry. This result is within the range

. of fire-induced CDF values obtained for other nuclear power plants. The dominant contributors to the fire CDF are: the two switchgear rooms, the two penetration rooms, the turbine building, the relay room, and the diesel generators. The licensee addressed the potential for fires in the control room and cable spreading room of the plant, but both areas screened out at different stages of the analysis. The possibility of fire propagation among adjacent compartments was also addressed.

No improvements or comnutments were identified as being necessary to further reduce the fire risk at SONGS.

Several improvements are mentioned in the submittal. but all of them were attributed to a presiously completed study.

The entire fire analysis effort has provided an excellent opportunity for licensee engineers to improve their knowledge of the characteristics of the plant, of how the plant would behave under fire conditions, and of what human actions would be necessary to protect the core from any adverse mitiators.

4.3 liFO Events Based on plant-specific analyses, results from the updated FSAR. and new hazard data collected as a part of the present IPEEE analyses the submittal concludes that all HFO events can be screened out. The submittal has followed the screenmg approach suggested in NUREG-1407. Correspondingly. no vulnerabilities or plant safety enhancements have been identified. and no conunitments for plant improvements related to HFO initiators have been made.

Energy Research, Inc.

50 ERUNRC 97 507

f 5

IPEEE DATA

SUMMARY

AND ENTRY SHEETS Completed data entry sheets for the SONGS IPEEE are provided in Tables 5.1 to 5.5. These tables have been completed in accordance with the descriptions in Reference [11]. Table 5.1 lists the overall external events results. Table 5.2 summarizes the important seismic PRA fragility values. Tables 5.3 and 5.4 provide, respectively, the PWR Accident Sequence Overview table and Detailed table for seismic events. Table 5.5 provides the PWR Accident Sequence Overview table for internal fire events. (Note that this table has been only partially completed due to the limited information on Sre accident sequences available in the submittal.)

Because of the lack ofinformation on system failures in a fire scenario, the PWR Accident Sequence Detailed table for fire events is not provided in this report. Also, no PRA or bounding analysis was performed as pan of the SONGS HFO-events IPEEE; hence, no data summary tables are provided pertammg to evaluation for these externalinitiators.

i 1

4 4

Energy Research. Inc.

51 ERI/NRC 97 507 j

i u.

70 5-79 tna C

p R

l s

d N

e e

/

I t

d o

us R

N e

E lct na it s

s e

is g

y a

lam n a Ad

)g

)

(

y z

i F

le A

t P

ta 0 G L

1 C

im P

1 x

( g H

o

,7 r

S 6

tn p

g S. 0 a

p A

lP I

s t

luse R

s y

y 1

s

'h is t

5 n F

y l

ee D

0 0

a 2

1 1

n 5

l v

C

'6 b

a aE Tl 7

g 1

n 1

a i

n d

r n

e u

t o

x B

E

=

O S

tuo d

g en n

e i

e n

r e

O O

S O

S O

c e

S rc

=

S O

s is ly ana ic n

e p

e f

f ts ic r

o n

ts e

ne d

s O

d c

i t

n i

c c

n c

I n

g c

A la t

a n

n y

A P

h S

e i

d ity it s

c v

d n

=

r v

E e

o n

ic c

t S

e e

l i

e l

it io a

r o

r m

i F

W i

a A

a s

F F

F r

e t

a a

l e

l a

n a

y ic o

g R

l p

s n

N n

n r

n b

m s

r y

n e

i g

r r

e n

r r

t e

e r

e a

s a

h e

r t

t t

n x

x x

t e

ie r

t re e

n a

E E

E N

S T

O n

I c

lP S

E

i 3.

70 2

5 h

y ta b

7 P

9 s

+

e C

6 u

R la w

v N

/

e

-S v

I c

o R

b E

i m

a s

e

)

e h

i t

y S

e t

ic d

i o

l iv eV d,

e l

c A

a n

G eg

)g t r

u P

( c q

f ep e

o S

S i%

s c

m A

m er G

l s

t aP ie n

c(

e S

i i

t r

r u

s V )z i

e e

l u

a l

H f

av 0

m t

1 e

F ig P

t 1

s

(

5 0

7 7

3 6

5 5

0 5

0 L

t ys F

.C S

P 1

3 5

0 6

9 8

9 6

6 7

l al o

L 0

0 1

2 1

1 I

1 2

2 2

t f r_

t t

1 r

e C

)

imdn t

l 1

e u

l b a y

0 h

b u

t t

1 i

o ir s n l

a i

)

o r

t Ei n

4 9

8 8

5 1

7 6

4 3

5 d

g gt o

r c

c d

5 3

2 2

4 4

4 4

4 4

4 Ee a

(

o e

I Em

2. F 7

m i

h f

0 0

0 0

0 0

0 0

0 0

0 P

5 6

o c

i I e i

c c

r e

t ei 0

f p

h e a 3

r b m 5

4 0

0 5

8 6

8 5

3 5

f m 5

l s

s w

u d

4 3

2 2

2 2

2 2

2 3

2 oi s

e l

ai ai e

)

nx Te nn it 0

0 0

0 0

0 0

0 0

0 0

0 Oro t c s

1 S

o np ow n

r S

ap A

a ir l

l h

0 0

0 0

7 0

9 6

6 8

7 S a R

a U

d 3

2 2

2 3

3 3

3 3

2 3

e i t

n l

r P

I F s

0 0

0 0

0 0

0 0

0 0

0 ht t n

s a

En

) a e

fb l

o ci oo Si id t

(

f Sta i

e s

o

)

1 e

ic cm n (g

6. );

t r

b t

i pL c

ia i

N a

di 5

7 0

m ty 2

4 3

2 0

2 2

2 4

0 3 1 V S 5

1 4

6 1

2 5

1 p

e c 0

0 3

4 4

5 5

5 7

7 7

le1 eL r

a o

t Mp b0 a

SiL c

f a1 n

r ic a

T-

,a C

I o

IRe m

n (,

ita P y s

iS d

i r E0 e

e or e

0 s

df le L, 0, t

i s

ve cc N0 e

or 1

r a A L(

w L

o ps 3

s m l

d a

(

l h

n r

h i

a t

S sa t

c i

cv 2

c c H w

i t

i o

f U

s e

iF s S s

r v

igLP i

l t

c c n

t e

e l

i s

a n e c

z E

n m

k ta V

aC

)

t U e o if i

rI e

r n

G g

f a S c H n,

n f

a r

n f

o I

r c

e. e e o 0 o

s T

it o

s i

od g

r v it i,

p n

u n

s i

l t

t d

n s

r r

n a

S f

1 o A S q

m a

p d

r e

e U

iu in n

s c

e r

u n

te v

g B

a n

e 1

t t

o T

e l

O i

o n

g o

n r

d C

k S

S n

y a

C e

r i

G a

e t

tei I

t d

n n

n n

e l

r a

r M

e C

a h

i m

me a

e h

s g

e d

p c

l e

a e e e

ia l

h pm c

S e m :e D.

m x

t l

l r

s n

i t

r o

g iu u

E C

p t

l x

n a

r h

iu c e s

msp8 e

os e

a h

e y

y is o

tc B

P t

u d

y e a ea n

c n

l t

i a

c h

e r

P s

o A

s h "g r

e n

q D

C w

y W

ma e

E AT R

a S

p r

apA l

S a

F i

m v

h r

l g

y y

r T" o

e i

a r

c a

r Ndd m

C o

V l

A W

e e

g r

t i

r r t

t x

t f c

a a co s

i W

o 0

t f

r 8

u D

C m

e n zz et t

e w

r i

a a aa pu R

S P

S M

s 4

A T

C E

S n

i lPHHSC L

• t E

r

)

e A

d 7

IS l

w 0

o S,

S e

fi 5

p T

4 A

"s 7

e s

V, 1

t O,

e 9

t s

R o

tf t

O 3

N C

f o

l O

"e R

A o

n e

/

e M

r V

s

)

h h

e u

M U

i R

T, N

l t

b I

a O

e

/

n S

I I

s I

I N.

u, R

m e

S e

T-A n

A

-1 E

i h

I t

I, R

gn T

3 d

O C

u S

A n

V i

l T,

l r

c e

n i,

C l,

a s

I 2

h e

R C

t t

R c

5 A

u

)

n I

r

=w R

ll l

W e

S I

d' V

o L

l l

u t

q T-P d

!t I,

n S

e n

M M

M C

M s

S P

S l

C, a

I u

F S

R S

S S

l O

C h

d I

S S

R, a

t B.

A 4

I s

l I

P e

V a

e a

I t

F I

k S

f i

i l,

i a

T, W

T

(

sed W

S N

E, E

l F

a V,

o t

X 2

f t

E S

u F

e n

A T,

S I

i g b

r C,

h u

t s m o

toni W

W W

E.

s S

S h

I' I

R s

ad e

f tr S

S P

T t

t i A

E W;

W E

t M.

A p

C e

C T

C E

C, l

u D

i r E

I D

C f

e p

t e

A o

b S

E k

C W

7 l

S y

T, E.

I S

a s a s

i C

C 6

C P

e el C

C 3

1I i

u e

M D

C, x

l e

E R

m a N

N.

w C,

P.

o a

e l

y n

T, T

A I.

iv F

E l

l r

n D

P, P.

)

e O

C C

C, l,

n k

v D,

a R

R P

l O

A T.

W I

b e

3, e R

I, 2

2 2

2 s

C I

b S

l m

4 l

y S,

S S

P P

5 a.

P t

P P

P P

)

)

h C,

tP a

n P,

P, P

P, e

U

)

D e

P D

e X

M 4

i, 5

c v

M M

M M

T4 i

)

D t

T, C

P l

l d

E A

A 1

i N

M A

A M

X f

b o.

S IX E

ie S

n 1

I 1

l a

m t

A A

I 5

l l

I I

T 1

T T

I D

F i

I T

T T

T T

T T

0 T

A, W

t

(

S M

e 0

C i A

3 tn S

1 T-C R

II e

r ly X

T, I

r d

o a

T, I

N R

s t

e A,

I O,

n 1

ic F

n m

2 S

T, r

c

)

u y

y y

y y

y y

y y

y o

l X

X I

C C

M f

A

!r

/r

/r

>r r

r

/r er er

/r o

n R l.

I R.

S, i

g R

F 0

1 1

1

'01

'01

'01

'01

'01

'0 i

ec a

t R

0 0

0 1

r e

- r

)

Ti A,

I F

1 d

s R

D W

C 5

1 7

6 8

7 u

h P

5 1

4 3

1 0

3 5

1 8

t P te M

I 7

8 1

u a

1 S

S 3

m t

3 x

c

)

t 6

3 2

I 1

8 5

4 3

1 e

M i

y C

s, J r l

R.

N C

D I

e T. w 1

M r

- a A,

1 I,

e r

h t

e

) n 2

d l

D d

ly x r t

S e

lu

- p l

S l

e T.

xl l

S u

p C

P l

f

(

P, S

e l

V. s A,

c o

u S

n E

i t

D A A, l It S

I a

P a

r t

n Y

t a

t 4

u 3

o S, t Ck T,

l i i

).

s n

I, d

x b

p n N A, l e

n e

u 2 o S

s a

I S, t Cb

W a

lo r

i s

S o

3 e

t a

p e

r m

h 1

a r

e e

i Ae g

T n

m s

3

b m A t

g o

'h e

i ge gy w

g e

n

- f s

h

/c r

i a

2 nr s

t o

tc n

s na c

i ti n

t r

o n

iwm l

i n

iw )x a

w o

w i

r r

id e

C ia W w r

r n

..C w

U s

w e s e t e

e e

s e

r r

r ox lod n

e a

o lo(

l f

o wy wt w

n w

y v

i

_W e

m l

loi e

l W

e n

os c

, e p

u t

p in o

o s

o c

l e

o c o

f F h

o a

,S p

S i

s, f )m e

e n

r pn pn pr a g

l e/

e s t

f

,r

/

e(

f u

f e

nAWt nAW e

y e

m e

u:

e u e

. eAc nW i

ddW nA h e h

n teg eu te C

o e

o i r d n s

lah to2

c A f 3 t

e i

h c

t if fo O.f f oAC 7

i t t t

e e

IW

. sCw s

sCCf sC C s

l f y s

i fC s

f A e

t s

s aF fr s r s

n O

foe fsd if f

f c

a f

e f

If m

f o V, i

e

)

Cs f

a A

f e

oS f

foC v

u oC tt o

I oa foc oA r t

o 1

e fl f et

.f fI f f I f ff ff fI n4 i

f

. o l

ol o f

.d nr w4 oo n

f f ff f

e h

ol o oll o oo oo oll s s o

o t

u r

oo oo o w o

- s a

o mo l

l s

s s s s s n s s

. s s es s as s s s s s a s s s ia s ee Op dW a

r u

h c

10Me S

s s s s s e o al oe w l

sl loo ool lomloo s ns s

o s n s

e s s s s s

n t

r i p n S.

a o

l or o o o osl l

r n l_

l l lool l

eii c r

u u

t t

sl nn l.

sI pl i o

n3 A

o c

s n r2 i aF t

S r i c

i h

i.

ii a a c

ec n

m m i. m

2. i ce w e e e

mM 5

uh uiu w ca n

k e

v f a (-

AW e

t R

mh e u

t m

S nm&&

u nto&

r t as ti T e

n n

a.

c

e n

r s

n n

n

' Li o

w s

s

. s e

r DiI i

r ts s n n

S, s

e s s nn SL" S !a hNR SNR S

S"- W

". S s

sl s oa e

n oa e

e e

i a

A ei k.

s~

m i

e L

SSRR e e o

c e

e r

2 d

S M )r, i W n

s y

e a

u u

e N

g s

e n

F t

r w h i

S, u

d b

e t

0 E

t S

n s

I 2

3 4

5 6

7 8

9 O

d M le ir m T a

t n

1 i

t E

a t

(

nT I

S F

A l

t I

P

,secn eu 7

q 0

e 5

i s

3 7

l T

r t

la 9

o oN s

C e

b R

h i

N u

/

s l

i RE l

I M

x a

I I)

I t t

t RF i

m b

GN u

I s

I CI 2 e

T h

N t

E CI 1

f M

o N

C I

I 7

A T

FC2 6

N

)

3 e

G FC1 e

te l

l b

CS2 a

p T

m CS3 o

F cn AM3 D

i C

s YI AM2 i

e AW AMl ic e

Y R

m lb l

DY s

a i

t b

N N AFW X

X x

X c

is T

a s

I nVI NI SP e

h T

N h

t d

IS I MFW ft fo e

y o

y li l

SU t

a n

/.

i r

te O

0 o

t TI j

D 0

a j

A RY HSIV m

1 c

4 e.

R AT y

e DI l

5 r P

N G a

ll N

TT r

e a c

MI n

s

) E e

5 l

5GA b q i(

a e m

i t r

n 5

i SI o

m 5G5 f

TS s

i u

g t

e AR2 n

lo n

S i

c e

Y t

d r

Y ARi n

e R

o I (

u s

i ATR

. Pk X

o e

c F

lM N.H 1

cc h

1 1

c t

t A

i VI R 1 PR X

a te R

lNI

't l PN r

le

,e W

p I

e h

m P

AI2 o

d c

.I e

Y AII d

ly Y*N u

l R( o MN I AP?

lc f

AI l E

u n

RI ER LPI i.

o e

t Vf el P NN 1 PI X

aa t

II 8

rb la l

t I

si CI PI ea i

c v m

na b

RCP5 4

I e s u

ui s

d YT PAD 2 qr e

n RI ee h

a AI s w H

t 3

MG PADI s

Ri PSRV ep in t

o n

I l i

P t

N d e d

n it e

U I

PPORv ci d

s cf i

af v

e H1 X

o o

r c

I r

f X

e p

i o

R RP3 mr c

n s e is ih n

O c

I s w i

h l

n 7 e ta a

ah s c 1 s e

c S

f a a

E c) f o d

r r

3(

oh a

t c

N 5 e t

l hle n o

n s

e g

e e

E i

t o

m lQ T 9 pi ic R

a t n

i aN E

r od T

y ec t

u f

S e s u

g S d elc s

e t

(

r n

l n n

e a

l l

' i I

n P

E 0

e I

2 3

a s

6 7

s 9

1 t

a h

C Y

y H

c Q

d k

h M

M.

d

n N

k

'O O

55 c

p I

E 5

E e

g.

w n

z n

5 5

5 3

E E

N d

m e

a m

a m

g e

E I

l H

-a e

6

}

5 a

m m

s 2

c t

b M

H k

t' D.

a g

n 2

k r

~

d z'

e-D" I

k y

E k

V.

a e

s 5

E

=

=

g e

e H

z g

.~

8 N.

2 N

m o F

g Ww d

E 1 E

f I

A p

5=

2 e

e e

e2

+

aF w

1 e

= >,

H*

Z "Y

/

a.*

E k

M' h

C 5

m 85

=

r.

- 2

• O N-

$' h w

h N

2:

E i.e

.t

.t

.t

.t

.t d[

C ei y

6 m.

m o

o o

o g

o c

3 S

S E

E E

cl d

~ h hg 3

m n

g g

e

=

w 4

.o a

a i

a et 5 E w

=.

=

c M

.5 c.

a a

t A

A

=

=

M M

M y

v v

.3 E

O a*

2 E

4 2

4 W

M'

.E E

E I

E I

E 4

I E

k.

L L

L L

L L

u 6

2

=

=

=

=

=

G c

$d g

R g

g m

m E

g h

jf,

]O l

l, l,

th 5

s E

2,

jI j j,

-W W

W W

j t a f. J.

i gy g~-

3 r

r r

g 3

l 2ei

,E e$

5 j

j H

E a

g 1JE T 3

~.

6 g

[

@i ew

• 5 53 a

e m

a u

O IV j

3 3

3 I Et ~ T C

V y 3 o

E Ir ! a@

j e

g W

eW i

• 3.

F c

m

._5 a r e a. an-e a n-e as a a

o a

-Es L ER h p-g R

.h w+

r

a.. 1

.a E

w+Ei e

x w 38 s

e g

4..g a-

.,n g m' } 3k

-.1.

n ai e. l. n"i 4

5 q; 4

.B h q

4

.G g' '

E j,\\

y y

n e n

- e e gg m,

z

~

z J Is a

n m

c w

m n, J

ee a

m

.y H3] $$

C

.2 n

m e

e 4

A

-Be

-m w

L 6

REFERENCES 1.

"IP Plant Exammanon for Extemal Events for San Onofre Nuclear Generating Stations Units

~

2 & 3," Southem California Edison, December 1995.

2.

" Individual Plant Examination of Extemal Events (IPEEE) for Severe Accident Vulnerabilities -

10CFR50.54(f)," U. S. Nuclear. Regulatory Commission Generic Letter 88-20, Supplement 4, June 28,1991.

3.

J. T. Chen, et al., " Procedure and Submntal Guidance for the Indisidual Plant Exammation of Extemal Events (IPEEE) for Severe Accident Vulnerabilities," U.S. Nuclear Regulaton Commission, NUREG-1407, May 1991.

4.

"PRA Procedures Guide - A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants " U. S. Nuclear Regulatory Commission, NUREG/CR-2300, January 1983.

5.

" Procedures for the Exterrn! Event Core Damage Frequency Analysis for NUREG-1150," U.S.

Nuclear Regulatory Commission. NUREG/CR-4840, November 1990.

6.

"A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power Research Institute, EPRI-NP-6041-SL, Revision 1, August 1991.

7.

" Fire-Induced Vulnerabihty Evaluation (FIVE)," Electric Power Research Institute, EPRI TR-100370, Rev.1, September 1993.

8.

Ho. V., S. Chien, and G. Apostolakis. "COMPRN IIIe: An Interactive Computer Code for Fire Risk Analysis," University of California at Los Angeles. EPRI NP-7282, May 1991.

9.

R. T. Sewell, et al., " Individual Plant Exammation for Extemal Events: Resiew Guidance," ERl/NRC 94-501 (Draft). May 1994.

10.

"IPEEE Step 1 Review Guidance Document," U.S. Nuclear Regulatory Commission, June 18,1992.

I 1.

S. C. Lu, and A. Boissonnade, "IPEEE Database Data Entry Sheet Package," Lawrence Livermore National Laboratory, December 14,1993.

12, "lPEEE-Seismic Ha:ard Analysis San Onofre Units 2 and 3," Presentation to the NRC. by SCE, Woodward Clyde Consultants, Geomatrix, and Risk Engineering, November 29,1994.

13.

" Individual Plant Exammation of Enemal Events San Onofre Nuclear Generating Station, Units 2 and 3," Letter from J.L. Rainsberry of Southem Califomia Edison to U.S. Nuclear Regulatory Commission. Docket Nos. 50-361 and 50-362, December 15,1997.

14.

" Individual Plant Exammation of Extemal Events San Onofre Nuclear Generating Station, Units 2 and 3," Letter from J.L. Rainsberty of Southem California Edison to U.S. Nuclear Regulaton>

Commission. Docket Nos. 50-361 and 50-362. March 16,1998.

Energy Research, Inc.

57 ERl/NRC 97-507

n 1

15.

Schnabel, P. B., J. Lysmer, and H. B. Seed, " SHAKE - A Computer Program for Earthquake Response Analysis of Horizontally Layered Sites," Earthquake Engmeering Research Center, University of California, Berkeley, EERC 72-12, December 1972.

16.

Wang, H. L. And J. E. Luco, " Soil-Structure Interaction: A Linear Contmium Mechanics Approach

- (CLASS I)," Department of Civil Engmeering, University of Southem California.1980.

17.

" Quality Assurance Documentation for the CYLREC CODE," EQE Document No. AA-QA-017, Revision 1.

18.

Lysmer, J., et al., "SASSI - A System for Analysis of Soil-Structure Interaction," University of Califomia, Berkeley, UCB/GT/81-02,1981.

19.

" Methodology for Developing Seismic Fragilities," Electric Power Research Institute, EPRI TR-103959, Final Report, June 1994.

20.

R. Budnitz, et.al., " Approach to the Quantification of Seismic Margins in Nuclear Power Plants, NUREG/CR-4334, Appendix C, August 1985.

21.

"EQESRA User's Mancal," Version 3.0, Revision 1, May 12,1995.

22.

" Procedure for Evaluating Nuclear Power Plant Relay Seismic Functionality," MPR Associates, Inc.,

EPRI NP-7148-SL, April 1992.

23.

" Actuation of Fire Suppression Systems Causing Inoperability of Safety Related Equipment," NRC Information Notice 83-41.

24.

" Insights Gained From Resching Generic Issue 57: Effects of Fire Protection System Actuation on Safety-Related Equipment." NRC Information Notice 94-12.

25.

" Staff Guidance ofIPEEE Submittal Review on Resolution of Generic or Unresolved Safety Issues (GSI/USI)," U.S. Nuclear Regulatory Commission, August 21,1997.

Energy Research, Inc.

58 ERI/NRC 97-507