ML17335A168

Final TER on step-2 Review of IPEEE at DC Cook Nuclear Plant,Units 1 & 2, March 1998

ML17335A168
Person / Time
Site:	Cook
Issue date:	03/31/1998
From:	KAZARIANS M, KURITZKY A S, SEWELL R T ENERGY RESEARCH, INC.
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML17335A166	List: ML17335A168
References
CON-NRC-04-94-050, CON-NRC-4-94-50 ERI-NRC-95-501, NUDOCS 9808110237
Download: ML17335A168 (137)

Text

ERI/NRC 95-501 TCCHNICRL CVRLURTION REPORT ON THC"STGP-2" RGVIGN OF TH6 INDIVIDURL PLRNT EXRNIINRTION OF EXTERNRL EVENTS RT D.C.COOH NUCLGRR PLRNT, UNITS 1 RND 2 FINAL REPORT Completed:

April 1995 Revised: May 1995 Final: March 1998 Energy Research, Inc.P.O.Box 2034 Rockville, Maryland 20847-2034 Work Performed Under the Auspices of the United States Nuclear Regulatory Commission Office of Nuclear Regulatory Research Washington, D.C.20555 Contract No.04-94-050 9808ii0237 98080S PDR ADQCK OS0003iS P PDR ERI/NRC 95-501 TECHNICAL EVALUATION REPORT ON THE"STEP-2" REVIEW OF THE INDIVIDUAL PLANT KGkMINATION OF EXTERNAL EVENTS AT D.C.COOK NUCLEAR PLANT, UNITS 1 AND 2 FINALREPORT Completed:

April 1995 Revised: May 1995 Final: March 1998 M.Khatib-Rahbar Principal Investigator Authors: R.T.Sewell', A.S.Kuritzky, M.Kazarians', M.V.Frank', and R.J.Budnitz'nergy Research, Inc.P.O.Box 2034 Rockville, Maryland 20847 Work Performed Under thc Auspices of the United States Nuclear Regulatory Commission Office of Nuclear Regulatory Research Washington, D.C.20555 Contract No.04-94-050 Presently with EQE Internation'al, 2942 Everyeen Parkway, Suite 302, Ever~n, CO 80439 Kazarians and Associates, 425 East Colorado Street, Suite 545, Glendale, CA 91205 Safety Factor Associates, Inc., 1410 Vancssa Circle, Suite 16, Encinitas, CA 92024 Future Resources Associates, Inc., 2039 Shattuck Ave., Suite 402, Berkeley, CA 94704 ENCLOSURE 2 TABLE OF CONTENTS EXECUTIVE

SUMMARY

V11 PREFACE XV1 ABBREVIATIONS XV11 0~~0 0 INTRODUCTION.....

1.1 Plant Characterization 1.2 Overview of Licensee's IPEEE Process and Important Insights.1.2.1" Seismic....................

1.2.1.1 IPEEE Process for Seismic Events....

1.2.1.2 Seismic IPEEE Insights............

1.2.1.3 Summary Evaluation of Submittal 1.2.2 Fire 1.3 Overview of Audit Process 1.3.1 Seismic...

1.3.2 Fire....1.4 Pre-Site Visit Activities 1.4.1 Seismic..1.4.2 Fire...1.5 Site Visit Activities

.....1.5.1 Seismic.1.5.1.1 Information Audited..............

1.5.1.2 Personnel Interviewed 1.5.1.3 Areas Walked Down.1.5.1.4 Treatment of Principal Issues 1.5.2 Fire..1.5.2.1 Information Audited 1.5.2.2 Personnel Interviewed 1.5.2.3 Areas Walked Down..............

1.5.2.4 Treatment of Principal Issues 1.6 Post-Site Visit Activities 1.6.1 Seismic 1.6.2 Fire..~~~12 12 12 13 13 13 14 14 14 15 15 16 16 16 16 17 17 18 18 19 1......2......2 2 2 2.~AUDIT FINDINGS........2.1 Seismic...........

2.1.1 Relevance of IPEEE Process to Actual Plant and Configuration........

2.1.2 Accident Frequency Estimates..2.1.3 Logic Models..2.1.4 Process to Identify, Eliminate or Reduce the Effects of Vulnerabilities

2.1.5 Vulnerabilities

Requiring Further Analysis.....................

2.1.5.1 Vulnerabilities Affecting Accident Prevention.........

2.1.5.2 Vulnerabilities Affecting Containment Performance.....

20 20 20 20 20 20 21 21 21 Energy Research, Inc.ERIJNRC 95-501

2.1.6 Dominant Contributors:

Consistency with External Events PRA Insights..21 2.1.6.1 Dominant Contributors to Core Damage............

21 2.1.7 2.1.6.2 Dominant Contributors to Radioactive Release given Core Damage Evaluation of Decay Heat Removal Vulnerabilities.......

2.1.7.1 Evaluation of Process to Identify Vulnerabilities 2.1.7.2 Evaluation of Findings 22 22 22 22 2.1.8 Evaluation of Movable In-Core Flux Mapping System Vulnerabilities....

22 2.1.8.1 Evaluation of Process to Identify Vulnerabilities

...22 2.2 2.3 Fire 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 2.2.6 2.2.7 2.2.8 2.2.9 2.2.10 2.2.1 1 2.2.12 2.2.13 2.2.14 2.2.15 2.2.16 2.2.17 2.2.18 2.2.19 Generic 2.3.1 2.3.2 2.3.3 2.3.4 2.1.8.2 Evaluation of Findings Documents Reviewed....

Compliance with Supplement 4 to Generic Letter 88-20 and NUREG-1 Methodology Employed.Fire Susceptible Equipment and Cables...Fire-Induced Initiating Events Core Damage Frequency Model.Containment Systems Model..Fire Zone/Area Selection....Screening of Fire Scenarios...

Containment Performance....

Fire Occurrence Frequency..Fire Vulnerability

..Fire Protection Measures Fire Growth and Damage Assessment

.Damaging Effects of Fire Fighting...Walkdown.......

Uncertainties

.....Sandia Fire Risk Scoping Study Issues USI AP5 Safety Issues (GSI-147, GSI-148, GSI-156 and GSI-172)GSI-147,"Fire-Induced Alternate Shutdown/Control Panel Interaction" GSI-148,"Smoke Control and Manual Fire Fighting Effectiveness"..GSI-156,"Systematic Evaluation Program (SEP)".....GSI-172,"Multiple System Responses Program (MSRP)"~~~~24 25 25 25 25 25 26 26 26 26 27 27 27 27 28 28 28 28 28 28 29 32 23 23 23 407 24 AUDIT CONCLUSIONS AND RECOMMENDATIONS

..3.1 Seismic..........

3.2 Fire............

~.37 37 38 4: REFERENCES......

40 APPENDIX A:

SUMMARY

OF SEISMIC REVIEW FINDINGS A.1 Pre-Site Audit Findings, Questions and Concerns....

A.2 Site Audit Findings, Questions and Concerns A-1 A-1...A-12 APPENDIX B: Energy Research, Inc.

SUMMARY

OF FIRE REVIEW FINDINGS 1n B-1 ERI/NRC 95-501 B.1 Pre-Site Audit Findings, Questions and Concerns B.2 Site Audit Findings, Questions and Concerns B-1 B-15 Ener~Research, Inc.1V ERI/NRC 95-501 LIST OF TABLES Table 1.1 Disposition of Seismic Walkdown Findings....

Energy Research, Inc.ERI/NRC 95-501 fi LIST OF FIGURES Figure A.l Checklist ror Pre-Site Visit Audit...Figure A.2 Significant Issues, Objectives and Concerns to be Addressed.A-2 A-3 Figure A.3 Potential Related Site Visit Activities

.Figure A.4 Checklist for Post-Site Visit Audit..A-5 Energy Research, Inc.vi ERI/NRC 95-501 Ir

,EXECUTIVE

SUMMARY

This Technical Evaluation Report (VER)documents the Step-2 technical evaluation review of the Individual Plant Examination of External Events (IPEEE)submittal for the Donald C.Cook Nuclear Plant, Units 1 and 2.The Step-2 review process involved the following tasks: I a complete technical review of the licensee's IPEEE submittal and licensee responses to Step-1 questions and requests for additional information (RAIs);a site audit of IPEEE data, analyses and plant characteristics; development of additional information requests;and~a technical review of the licensee response to the additional information requests.American Electric Power Service Corporation (AEPSC)is the licensee of Cook Nuclear Plant (Cook).AEPSC has maintained administrative control over all major IPEEE activities, and has committed significant personnel and resources to project management, IPEEE involvement, and personnel training.Technical oversight of the IPEEE was performed by Westinghouse as prime contractor to AEPSC-.Westinghouse performed the systems modeling (including development of fault tree and event tree logic), the seismic fragility calculations, and the overall probabilistic risk assessment (PRA)quantification.

Westinghouse was supported by sub-contractors EQE International, Inc., and Paul C.Rizzo Associates.

EQE was the major participant in conducting plant walkdowns and in training AEPSC personnel on walkdown procedures.

Rizzo Associates performed a site-specific seismic hazard analysis, developed spectral-shape margin and variability factors, and developed soil-structure-interaction margin and variability factors.Stevenson&Associates was engaged by AEPSC as an independent reviewer, principally of the component seismic fragility analyses.The original Cook IPEEE was submitted on April 1992.A pre-site audit review and subsequent site audit visit (Jul'y 26-28, 1994)revealed a number of problems in the original analyses.Correspondingly, a number of questions and concerns were brought to the attention of the licensee at the site audit exit meeting.The licensee responded to these issues and made a presentation of IPEEE,modifications to the U.S.Nuclear Regulatory Commission (NRC)and its contracted reviewers at a meeting held on October 25, 1994.Remaining concerns of the'review team were presented to the licensee at the conclusion of this meeting.Subsequently, the licensee responded to the remaining concerns, and developed a revised IPEEE submittal for D.C.Cook (dated February 15, 1995).This TER provides a discussion of issues pertaining to the entire review process;however, the ultimate findings and conclusions of this report are.based upon the revised D.C.Cook IPEEE submittal.

I.icensee's IPEEE Process Seismic g p Energy Research, Inc.ERI/NRC 95-501 vii AEPSC has undertaken a newLevel-1 seismic PRA (SPRA), together with a qualitative containment performance assessment, for the Cook seismic IPEEE.This approach represents an acceptable methodolo~, in accordance with Section 3 of NUREG-1407.

Peak ground acceleration (PGA)was the round motion arameter used to characterize seismic capacity and hazard.The input spectral shape t

ultimately used for fragility assessment was that of the 10,000-yr median uniform hazard spectrum (UHS)developed by Lawrence Livermore National Laboratory (LLNL)in 1989 for the Cook site.The original seismic IPEEE analysis developed core damage frequency (CDF)estimates both for Rizzo Associates hazard input and the 1989 LLNL hazard results.The revised IPEEE analysis evaluated seismic CDF based on the Rizzo Associates input only.The latest (1993)LLNL seismic hazard curves were not considered in either the original or the revised IPEEE.The seismic IPEEE process involved a significant plant familiarization effort, including extensive seismic walkdowns.

The walkdowns were conducted in accordance with EPRI Seismic Margin Assessment (SMA)procedures, and thus satisfy NUREG-1407 (Section 3.1.1.4)guidelines for SPRA methodology enhancements.

Cook is a USI A-46 plant, and the plant seismic walkdowns also addressed USI A-46 concerns.The IPEEE documentation, however, is significantly independent of USI A-46 resolution, with the exception of IPEEE relay evaluation (which relies heavily on the VSI A-46 analysis).

The licensee's treatment of USI A-46 was not, therefore, a major consideration in the scope of the present review.The major elements of the Cook seismic PRA include: initiating events analysis, event tree analysis, systems analysis, systems-interaction analysis, seismic fragility analysis, Level-1 risk quantification, and containment performance assessment.

For the event tree and systems (fault tree)analyses, models were taken from the internal events analysis and modified as necessary for external events..In addition to these aspects of SPRA implementation, the Cook IPEEE involved the following elements: a limited evaluation of soil liquefaction potential; development of component HCLPF capacities; and an evaluation of."bad actor" relays.Hence, the IPEEE addresses all SPRA methodological enhancements as requested by NUREG-1407 (Section 3.1.1.4).Fire The licensee has adopted Level-1 fire PRA methodology for conducting the IPEEE, and has prepared a fire risk analysis.The Cook IPEEE used a common PRA-based approach in which a screening analysis eliminates all but a relatively few fire areas.A detailed event tree and fault tree analysis, with these models coming from the IPE, was used to assess the fire CDF due to local or global fires within the areas that survived the screening.

The licensee has provided a discussion of the criteria used to identify critical fire zones and areas.The licensee has provided discussions for fire initiation data base, event tree and fault tree modeling, dominant fire-induced core damage scenarios, core damage frequency, fire-induced containment failures, and fire risk scoping issues.The licensee and its contractors conducted two plant walkthroughs prior to the submittal of the IPEEE.These walkthroughs were performed using a standard checklist, with combustible loading of fire zones being verified, and the issues raised in the Sandia Fire Risk Scoping Study being addressed.

In the process of the preparation of the revised fire risk analysis, the analysis team revisited the site and conducted additional walkthroughs of the fire zones that were found to be risk significant.

Energy Research, Inc.viii ERI/NRC 95-501

Key IPEEE Findings Seismic The original Cook IPEEE submittal (dated April 1992)reported a seismic CDF of 1.83 x10'er reactor-year (ry)using a site-specific hazard curve (Rizzo Associates hazard curve)and 3.07 x10/ry using the 1989 LLNL seismic hazard results developed for D.C.Cook.A revised seismic CDF of 3.17 F10~/ry (using the Rizzo Associates hazard curve)was obtained after refinements were implemented in the fragility calculations and in the seismic intervals used for numerical integration.

The refinements were made in response to items identified prior to, and during, the site audit review that were believed to have a potential to mask the dominant risk contributors.

Based on a review of the revised fragility calculations, it is judged that the revised seismic CDF is a more realistic estimate of seismic risk at Cook than the original CDF result.The IPEEE submittal has demonstrated that the.plant seismic risk is low.Although this implication is drawn based on the seismic hazard input developed by Rizzo Associates, it is also expected to be true if the 1993 LLNL seismic hazard input is used.(The CDF based on the 1993 LLNL mean seismic hazard curve for PGA is roughly estimated to be about 10'/ry).A plant-level fragility curve or HCLPF capacity was'ot explicitly developed in the seismic IPEEE.Approximate values for these capacities, however, can be inferred based on results presented in the revised IPEEE submittal.

The following approximate plant-level capacity parameters have been estimated in this review: A=0.48g (PGA), Pc=0.27, and HCLPF=0.25g (PGA).The median and HCLPF capacities are anchored to the 10,000-yr median 1989 LLNL UHS spectral shape.Auxiliary Building (Failure of Steel Columns Supporting Crane Girders)The following items have been assessed as domihant contributors to the seismic CDF in the Cook revised IPEEE: 1.Loss of Electric Power Systems a.600 VAC Transformers (Block Wall Failure)b.Diesel Generator Fuel Oil Day Tank (Block Wall Failure)Turbine-Driven AF Pump (Random Failures)Lesser, but notable, contributors include: 4.250 VDC System 5.Reactor Protection System (Failure of Miscellaneous Panels)Ice Condenser The initiating events that dominate the seismic CDF were assessed as being: Loss of Offsite Power (Failure of Ceramic Insulators) 2.Energy Research, Inc.ERI/NRC 95-501 Ix Direct Core Damage (Dominated By Containment Structural Failure due to Soil Pressure) 3.The following three initiators have relatively equal contributions to core damage risk: a.Steamline/Feedline Break (Failure of Secondary Piping/Supports) b.Loss of Essential Service Water System (Screenhouse Failure)c.Large LOCA (Failure of Pressurizer Supports)That the auxiliary building is assessed as the dominant risk contributor is somewhat'unusual in comparison to results of other SPRA studies of PWRs.Review of the revised fragility calculation for the auxiliary building columns reveals potential sources of conservatism.

Block wall failures have been identified as items of concern from past seismic PRAs;hence, the identification of block wall failures as dominant risk contributors in the Cook IPEEE is not particularly surprising.

It is noted, however, that there is a reasonable probability that failure of the block wall separating the 600 VAC transformers will not lead to transformer failure;hence, the assumption that block wall collapse always leads to transformer failure is also conservative.

In contrast, analyses of other items appear to be somewhat nonconservative, and such items might be revealed as dominant contributors under meaningful variations in analysis assumptions.

For example, poor weld detailing of 4 kV switchgear (cabinet plug welded to shim plates)substantially limits seismic capacity, whereas a relatively high seismic design capacity was used as a basis for the fragility analysis.A realistic seismic capacity of component cooling water (CCW)heat exchanger supports is likewise thought to be somewhat lower than that developed in the revised Cook IPEEE fragility analysis.(It is worth noting that concerns with both of these items were noted in the IPEEE plant walkdowns and in the site audit review.The licensee then conducted revised fragility analyses for these items..These analyses were examined in detail as part of the present'Step-2 review.Based on this review[and as just noted above], the resulting capacities are still judged to be somewhat high.Further adjustments to these fragility calculations may place these components in the dominant contributor list;however, the licensee's analysis is sufficient to suggest that they are not likely to be the most important dominant contributors.)

For these reasons, among others, the dominant contributors assessed in the revised Cook seismic IPEEE are still considered to be somewhat questionable.

The current insights are, nonetheless, considered to be useful.However, more meaningful insights could perhaps be drawn if justified refinements and variations in analysis assumptions were considered.

Revisions to containment performance insights were not explicitly developed as part of the revised Cook IPEEE.The original IPEEE conclusions with respect to containment performance under seismic events include the following:

1., Containment mechanical penetrations and containment isolation valves were determined to have high capability to withstand direct failures due to seismic events.Hydrogen igniters were also found to be very rugged seismically (in withstanding direct failures), and were screened out of the containment-performance evaluation process.(However, failure of electric power to the igniters was evaluated.)

2.Reactor Protection System (RPS)failure, which results in failure to isolate the containment, and consequently was assumed to result in containment bypass, contributes less than 1%to the total seismic CDF.Direct seismic failure of the containment building (dominated by soil-pressure failure)contributes approximately 1%to the total seismic CDF.Energy Research, Inc.ERI/NRC 95-501 4.Direct seismic failure of the ice condenser was determined to have a notable contribution to~~seismic CDF.Some of the most damaging seismic sequences involve a loss of decay heat removal (failure of the Emergency Core Cooling System[ECCS]or of auxiliary feedwater[AFW]to the steam generators) in conjunction with failure of the containment spray system.(Although these sequences apparently have the largest contribution to seismic CDF among those sequences having inadequate containment performance, the IPEEE submittal does not provide a quantitative value of their relative CDF contributions.)

These conclusions may have slightly altered due to changes to Level-1 PRA results in the revised seismic IPEEE.Licensee response to a question (Seismic Question No.5), that was posed during the October 25, 1994 meeting, states that the primary difference in containment performance insights (for the revised vis-A-vis the original study)was a greater relative contribution to overall containment-failure risk due to containment soil-pressure failure.A review of the original fragility analysis conducted for the ice condenser containment revealed a number of problems in the methodology and calculations.

A revised seismic fragility analysis was conducted for the ice condenser, but the calculations were not reviewed.It is noted, however, that the resulting revised fragility parameters for the ice condenser now appear much more reasonable.(That is, reasonable values of A;P, and Phave been obtained.)

The revised seismic IPEEE submittal concludes that potential failure of the ice condenser is still a notable contributor to core damage risk.This conclusion is consistent with the original IPEEE observation that potential ice condenser failure contributes meaningly to the risk of poor containment performance, and is viewed to be substantially valid.Other noteworthy seismic IPEEE findings are documented as part of this TER.Fire The total fire CDF of 3.76x10'/ry is the sum of the eleven fire scenarios that survived the screening efforts.Eleven fire scenarios have been identified as the main contributors to the total fire CDF for one unit.The fire zones associated with the eleven scenarios include the following:

Two diesel generator rooms where other cables are also present Two fire zones associated with the essential service water (ESW)system Two 4 kV switchgear rooms One motor control center (MCC)room One battery room A general area within the Auxiliary Building The control room An area within the Turbine Building The list is the same for both units.The area in the Auxiliary Building is common to both units.xl In the case of nine of the eleven fire scenarios, the initiating event is loss of either CCW or ESW.In one case, the initiating event is loss of the 250 VDC system;and in the remaining case, the initiating event is assumed to be a general transient.

Energy Research, Inc.ERI/NRC 95-501 Generic Issues and Unresolved Safety Issues Seismic The present review has considered the licensee's treatment of GI-131,"Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants," and USI A-45,"Shutdown Decay Heat Removal Requirements." The licensee's treatment of GI-131 involved a review of the seismic adequacy of the flux-mapping cart upper supports.As a result of this evaluation, the hold-down straps attached to the top of the cart were redesigned, and the design changes were impfemented.

In addition, a lower lateral restraint to the fiux mapping cart was installed at an elevation-just above the seal table.Based on the design changes and results of the seismic walkdown, a HCLPF capacity of 0.32g was evaluated for failure of restraint of the flux mapping cart.This treatment of GI-131 is judged to satisfy the relevant concerns associated with this issue.Details of the licensee's treatment of USI A<5 were not documented in the Cook IPEEE submittal.

USI A-45 was, therefore, addressed in the site audit review.This review revealed that the seismic IPEEE process is capable of identifying vulnerabilities related to shutdown decay heat removal.To the extent that the seismic IPEEE realistically models severe-accident response, therefore, USI AQ5 will be meaninMlly addressed.

It is judged that the revised Cook IPEEE adequately treats VSI A-45.It is noted, however, that it would be appropriate for the licensee to more fully document the basis for USI A-45 resolution, relevant to seismic concerns, in the seismic IPEEE submittal itself.Although USI A-17,"Systems Interactions in Nuclear Power Plants," is not explicitly included in the scope of this review, documentation concerning the walkdown process and systems interaction analysis suggests that this issue has been substantially addressed by the IPEEE.Some information is also provided in the Cook seismic IPEEE submittal which pertains to the following relevant generic safety issues (GSIs):~GSI-156,"Systematic Evaluation Program (SEP)"~GSI-172,"Multiple System" Responses Program (MSRP)" Fire The Sandia Fire Risk Scoping Study issues have been addressed explicitly.

For control room control circuit isolation, the Local Shutdown Indication (LSI)panels will be used.These panels are located at several spots in the auxiliary building.With respect to seismically induced fires, the Summary Report does not address this issue in Section 4.8.However, in the Licensee Response to NRC Questions (page 8), it is stated that cabinet movement, tank movement, and pump leakage is not a problem for the design-basis earthquake.

This is further discussed in the revised fire risk analysis.Special focus is given to the CO, tank.The licensee has stated that automatic fire suppression systems may not survive a strong earthquake.

Energy Research, Inc.xii ERI/NRC 95-501 I C USI A-45 has been addressed by the licensee.No information is provided except for a reference to'the internal events IPE report.Some information is also provided in the Cook fire IPEEE submittal which pertains to the following relevant generic safety issues (GSIs): GSI-147,"Fire-Induced Alternate Shutdown/Control Panel Interaction" GSI-148,"Smoke Control and Manual Fire Fighting Effectiveness" GSI-172,"Multiple System Responses Program (MSRP)" Vulnerabilities and Plant Improvements Seismic Although dominant risk contributors are noted in the Cook seismic IPEEE submittal, the study does not identify any specific seismic-related severe-accident vulnerabilities.

The submittal concludes that no significant seismic concerns were discovered during the seismic IPEEE.A number of minor plant improvements, however, have been implemented in response to the Cook seismic IPEEE, primarily related to walkdown findings.A table presented in the revised seismic IPEEE submittal contains a description of these plant improvements.

This table is duplicated in this TER as Table 1.1;it summarizes the items of concern identified during the plant walkdowns, together with the licensee's disposition of those items.It is noted, however, that this list of items does not include a number of.miscellaneous walkdown findings listed in the original IPEEE submittal, including:

poor fire-extinguisher mounting, potential interaction problems from fire protection pilot lines, and potential interaction problems from fluorescent lights in control room.Furthermore, a few additional items identified in the EQE walkdown reports have also not been included in Table 1.1.Based on the site audit and the collective body of IPEEE documentation, however, it is judged that all identified walkdown issues have been addressed in some manner by the licensee.The licensee's evaluation of USI AM concerns has also identified"bad actor" relays that will be replaced for cases where operability of safety related equipment is affected.It was confirmed during the site audit that the licensee's relay chatter evaluation included all items of equipment within the scope of IPEEE, including those that were not also in the scope of USI A-46.However, bad-actor relays were found to exist only in items of equipment common to both IPEEE and USI A-46.The specific disposition of identified bad-actor relays is, therefore, treated in the licensee's response to USI A<6.Fire It is claimed by the licensee that no fire vulnerabilities exist at D.C.Cook.Also, no related plant modifications were postulated, or deemed necessary.

Energy Research, Inc.xiii ERI/NRC 95-501

Observations Seismic The original Cook seismic IPEEE produced a substantially unrealistic (over-conservative) evaluation of seismic risk.There were a number of identified problems in the analysis, most significantly, the treatment of seismic fragility and HCI.PF calculations, and the crude definition of seismic intervals used for quantifying risk.In addition, a number of open issues were identified in the review of the original submittal.

These were largely addressed during the site audit;however, there were a number of concerns that remained after the site audit.In response to these concerns, the licensee undertook significant effort to correct problems in the analysis and to clarify/justify a number of issues.The resulting revised Cook seismic IPEEE is a significant improvement over the original submittal.

It adequately demonstrates that the seismic risk at Cook Nuclear Plant is low.Based on a detailed review of the revised seismic fragility calculations, it is believed that more realistic assumptions in the fragility analyses may likely alter the ranking of dominant contributors.

However, further refinement of the fragility analyses is considered to be unwarranted.

It is believed that, although the ranking of dominant contributors may not be precise, the collective set of contributors identified in the original submittal and the revised submittal encompass those conditions that are most likely to control plant capacity and risk.Based on statements in the revised seismic IPEEE submittal, the licensee is aware of other issues of potential concern, a'nd these are summarized in the body of this TER.Based on the site audit, and review of information supplied by the licensee, it appears that the licensee has developed an appreciation of severe accident behavior, gained a qualitative understanding of the overall likelihood of core damage, and adequately assessed containment performance.

As a result of the seismic IPEEE (primarily the walkdown effort), a number of plant improvements have been identified and implemented.

Also, the licensee appears to possess an understanding of likely severe accident sequences that could occur at its plant under full power operating conditions, though the relative ranking of these sequences may not be precise, due in part to a few questionable fragility analysis'assumptions.

Additional observations related to pre-site audit findings, site audit findings, and post-site audit findings, are sumniarized throughout this TER.Areas where the revised IPEEE submittal is judged to be weak are noted for the licensee's benefit in conducting any subsequent refinements to the IPEEE.Fire For internal fires, the licensee appears to have developed an appreciation of severe accident behavior, to have gained understanding of the most likely severe accident sequences that could occur at its plant under full power operating conditions, and to have gained a qualitative understanding of the overall likelihood of core damage and radioactive material releases.There are several items that have not been explicitly explained in the Summary Report, but subsequently submitted documentation provides sufficient information in this regard.Overall, the licensee has followed a methodology that is proper and has been widely used for fire PRAs.The data bases for fire occurrence frequencies, equipment and cable locations, and fire fighting capabilities, as well as the fire impact modeling (i.e., fault trees and event trees), are deemed to be proper.The application of the data bases and models in the revised fire risk analysis can be considered as appropriate.

The overall CDF from fire events has been assessed as being within a range typified by other fire PRAs.Notwithstanding the above conclusions, some shortcomings of the submitted information include the following:

Energy Research, Inc.xiv ERI/NRC 95-501 The licensee has not put forward a criterion for identifying a fire vulnerability.

There are several calculations ihat cannot be fully explained from the available information.

The possibility of active fire barrier failure and fire propagation between fire zones employing such equipment have not been adequately explained.

It is not clear whether the licensee has considered, in its fire vulnerability analysis, the degradation of such systems as containment isolation and containment cooling from a fire event.The licensee has not addressed uncertainties and.sensitivity issues associated with the data and models.Energy Research, Inc.xv ERI/NRC 95-501

PREFACE The Energy Research, Inc., team members responsible for the present IPEEE review documented herein, include: Sismic R.Sewell, Primar'y Reviewer M.Frank and R.Budnitz, Secondary Reviewers M.Kazarians, Primary Reviewer M.Frank, Secondary Reviewer M.Khatib-Rahbar, Principal Investigator, Report Review A.Kuritzky, IPEEE Review Coordination and Integration R.Sewell, Report Integration Dr.John Lambright, of Lambright Technical Associates, contributed to the preparation of Section 2.3 following the'completion of the draft version of this TER.This work was performed under the auspices of the United States Nuclear Regulatory Commission, Office of Nuclear Regulatory Research.The continued technical guidance and support of various NRC staff is acknowledged.

Energy Research, Inc.g xvi~ERI/NRC 95-501

ABBREVIATIONS AC AEP AEPSC AF AFW ATWS BWR CCW CDF CPI CRD CRDM CS CSS CST CVCS DBE DC DG ECCS EDG EPRI EPS ESFAS ESW FHA FSAR GDRS GI GIP GL GSI HCLPF HPSI HVAC IN IPE IPEEE LLNL LOCA LOSP LPSI LSI LSP MCC Alternating Current American Electric Power Service Corporation American Electric Power Service Corporation Auxiliary Feed Water Auxiliary Feed Water Anticipated Transient Without SCRAM Boiling Water Reactor Component Cooling Water Core Damage Frequency Containment Performance Improvement Control Rod Drive Control Rod Drive Mechanism Containment Spray Containment Spray System Condensate Storage Tank Chemical and Volume Control System Design Basis Earthquake Direct Current Diesel Generator Emergency Core Cooling System Emergency Diesel Generator Electric Power Research Institute Electric Power System Engineered Safety Features Actuation System Essential Service Water Fire Hazard Analysis Final Safety Analysis Report Ground Design Response Spectrum Generic Issue Generic Implementation Procedure (SQUG)Generic Letter Generic Safety Issue High Confidence of Low Probability of Failure (Capacity)

High Pressure Safety Injection Heating, Ventilation and Air Conditioning Information Notice Individual Plant Examination Individual Plant Examination of External Events Lawrence Livermore National Laboratory Loss of Coolant Accident Loss of Offsite Power Low Pressure Safety Injection-Local Shutdown Indicator Loss of Offsite Power Motor Control Center Energy Research, Inc.xvll ERI/NRC 95-501 0

MSIV NRC PGA PORV PRA PWR RAI RCP RCS RHR RPS RPV RWST SEWS SG SHA SI SMA SME SPRA SQUG SRT SSI SW SWGR SWS TER UFSAR UHS USI V VAC VCC VDC.Main Steam Isolation Valve Nuclear Regulatory Commission Peak Ground Acceleration Pressure Operated Relief Valve Probabilistic Risk Assessment Pressurized Water Reactor Request for Additional Information Reactor Coolant Pump Reactor Coolant System Residual Heat Removal Reactor Protection System Reactor Pressure Vessel Refueling Water Storage Tank Seismic Evaluation Work Sheet Steam Generator Seismic Hazard Analysis Safety Injection Seismic Margin Assessment Seismic Margin Earthquake Seismic Probabilistic Risk Assessment Seismic Qualification Users Group Seismic Review Team Soil-Structure Interaction Service Water Switch Gear Service Water System Technical Evaluation Report Updated Final Safety Analysis Report Uniform Hazard Spectrum Unresolved Safety Issue Volts Alternating Current.Voltage Valve Control Center Direct Current Voltage Energy Research, Inc.Xvlll ERI/NRC 95-501 1.INTRODUCTION This Technical Evaluation Report (TER)documents the results of the Energy Research, Inc.(ERI)Step-2 review of the seismic and fire portions of the D.C.Cook Individual Plant Examination of External Events (IPEEE)submittal[1], corresponding Licensee Responses to NRC (Step-1)Questions[2], Site Audit findings, and subsequent Licensee Responses to Remaining Questions and Concerns.The NRC review objective is to determine whether the licensee's'IPEEE process has met the intent of Generic Letter 88-20, Supplement 4[3].Insights gained from the ERI audit of the IPEEE submittal and supporting documentation provide a better perspective from which to evaluate the IPEEE, and allow a more accurate determination as to whether or not the licensee's IPEEE process meets the intent of Supplement 4 to Generic Letter 88-20.As noted, the review has involved a site visit and audit of"tier 2" information (e.g., event/fault trees, system notebooks, data, CDF/HCLPF calculations).

The review process has given a significant level of attention to details in all major elements of the IPEEE analysis.This TER complies with the requirements of the contractor task order for IPEEE Submittal Step-2 reviews.The remainder of this section provides an overview of the licensee's IPEEE process and insights, the audit process, pre-site visit activities, site visit activities, and post-site visit activities.

Sections 2.1 and 2.2 provide the audit findings related to the seismic and fire reviews, respectively, and Sections 3.1 and 3.2 contain the audit conclusions and recommendations from the seismic and fire reviews,'respectively.

Appendix A contains detailed information pertaining to the seismic review, and Appendix B contains similar information for the fire review.It is important to note that, due to concerns identified in the technical review prior to, and during, the D.C.Cook site audit, the original IPEEE submittal was updated with a revised IPEEE submittal[4].The final conclusions of this TER apply to the revised results;however, observations made throughout the Step-2 review process are also noted in this report.The following list of events, review tasks and meetings helps clarify the sequence of the'entire Step-2 review process:~Original IPEEE Submitted (April 1992)~NRC Step-1 Review and Questions (May 24, 1993)Licensee Responses to NRC Step-1 Questions (July 22, 1993)Step-2 Review of Original Submittal and Licensee Responses to NRC Step-1 Review Questions; Development of Step-2 Questions and Site Audit Plan;Draft TER Developed D.C.Cook Site Audit (July 26-28, 1994);Development of List of Site Audit Concerns and Questions Licensee Presentation of Responses to Site Audit Concerns to NRC and Reviewers (October 25, 1994);Identification by Reviewers of Remaining Questions, Concerns and Requests for Additional Information Revised IPEEE Submitted (February 15, 1995)Step-2 Review of Revised IPEEE Submittal and Licensee Responses; Final TER Developed Energy Research, Inc.ERI/NRC 95-501 t e 1.1 The D.C.Cook Nuclear Plant is a two-unit, 4-Loop PWR located on the southeastern shore of Lake Michigan near Bridgman, Michigan.(As stated in the IPEEE submittal, only Unit 1 was modeled for the base-case PRA analysis, however, differences between Units 1 and 2 were noted by the IPEEE team.During the site audit, the licensee stated that these differences would not meaningfully impact the seismic PRA.In addition, plant walkdowns of both units were performed.)

The plant is one among a few PWRs having an ice condenser containment.

The Cook IPE documentation provides more detailed information on plant configuration than provided in the IPEEE submittal.

f.2.1 Seismic 1.2.1.1 IPEEE Process for Seismic Events As documented in NUREG-1407

[5], the D.C.Cook plant is binned in the 0.3g focused-scope review category.The plant seismic design basis is characterized by a PGA (peak ground acceleration) value of 0.20g, anchored to a Housner spectral shape, The plant is founded on soil and is bordered on the east by a significant slope (approximately 2:1).American Electric Power Service Corporation (AEPSC), the licensee of the plant, elected to perform a Level-1 seismic probabilistic risk assessment (SPRA), with a qualitative seismic containment analysis, as part of the D.C.Cook IPEEE.The SPRA approach that was implemented followed the guidance described in NUREG/CR~[6]and Volume 3 of NUREG/CRP550

[7].Plant seismic walkdowns were conducted using the procedures described in EPRI NP-6041[8].To define the earthquake hazard, both plant-specific hazard curves and LLNL hazard curves were used in the SPRA quantifications.

The plant-specific hazard study produced hazard curves for peak ground acceleration (PGA)only.The IPEEE submittal states that the rankings of dominant contributors to seismic core damage frequency remained the same regardless of which set of seismic hazard curves was used.In the IPEEE analysis, walkdowns were performed for both reactor units of the plant.The walkdowns looked at components and structures within both containment buildings, the auxiliary and turbine buildings, the screen house, and the grounds immediately surrounding the plant.It is stated in the IPEEE submittal that, although differences were identified between reactor Units 1 and 2, only Unit 1 was modeled for the base SPRA analysis.During the site audit, the licensee stated that these differences would not meaningfully impact the'seismic PRA.In addition, plant walkdowns of both units were performed.

Accident event trees and plant system models used in the SPRA were taken from the internal events IPE for D.C.Cook[9], and these were modified as necessary for seismic events.Generally speaking, the scope and level of analysis that AEPSC has chosen to undertake for the IPEEE goes, beyond the minimum guidelines outlined in NUREG-1407 for the plant.In addition, as documented in its IPEEE submittal, the licensee's plan to maintain the IPEEE as a living study, and to substantially involve its staff in understanding and continuing the IPEEE process, all indicate a level of responsiveness consistent with the intent and spirit of the Severe Accident Policy Statement and with responsible seismic safety management.

The timeliness of the IPEEE submittal further reinforces that the licensee has been diligent in responding to the concerns of Generic Letter 88-20, Supplement 4.Energy Research, Inc.ERI/NRC 95-501 In the IPEEE submittal, AEPSC states that the IPEEE was conducted according to the applicable sections of 10 CFR 50, Appendix B.All aspects of the D.C.Cook IPEEE are stated to have been subject to an independent review.The present seismic audit of the D.C.Cook IPEEE has focused on evaluating the extent to which the licensee's IPEEE process and submittal meets the overall intent of severe-accident policy and the objectives of the IPEEE, as documented in Generic Letter 88-20, Supplement 4 (including the IPEEE guidance document NUREG-1407).

A general overview of the licensee's submittal, with respect to these objectives, is outlined as follows: (a)The first objective of the IPEEE is that the licensee develop an appreciation of severe-accident behavior.As documented in the IPEEE submittal, measures have been taken by the licensee to help insure that its staff develops a better appreciation for seismic severe-accident behavior of the plant;in addition, staff involvement in updating the IPEEE on a biannual basis will lead to continued and increased understanding of seismic response and risk.The pre-site audit review revealed specific technical areas where the licensee's IPEEE process and submittal were considered to be weak;consequently, it was felt that an incorrect understanding of severe-accident behavior could be developed based on the original IPEEE submittal.

Revisions implemented as a result of the site audit review and subsequent requests have helped alleviate many of these concerns.It is judged that the revised IPEEE submittal[4]substantially satisfies this IPEEE objective; i.e., the licensee has apparently gained a significant understanding of the potential seismically induced severe-accident sequences.(b)The second objective of the IPEEE is for the licensee to understand the most likely severe-accident sequences that could occur at the plant under full-power operating conditions.

The systems analysis and fragility assessment in a well-executed SPRA are clearly capable of revealing the most likely severe-accident sequences.

The general SPRA process utilized by the licensee is likewise capable of revealing the most likely severe-accident sequences that could occur at the D.C.Cook plant.A number of specific aspects of the licensee's submittal revealed during the pre-site visit and site visit activities (as discussed in greater detail later), however, raised questions as to whether or not the truly risk-dominant sequences and components had been identified.

The licensee undertook substantial effort to respond to these questions; for example, several fragility calculations were revised, implementing improved methodology.

The revised IPEEE[4]develops a much better understanding of the level of plant seismic risk.Nonetheless, a detailed review of the revised fragility calculations indicates that there exist a number of notable conservatisms and nonconservatisms in details of the fragility analysis for some important components.

These have the potential to distort understanding of the most likely severe-accident sequences.

It is thus judged that this second IPEEE objective is only partially met by the revised seismic IPEEE submittal.

Although this is the case, it is believed that the licensee can readily gain a better understanding of the most likely severe-accident sequences by considering the impacts of simple changes in a few fragility analysis assumptions.(Some such cases are discussed later in.this TER.)Energy Research, Inc.ERI/NRC 95-501 (c)The third objective of the IPEEE is for the licensee to gain a qualitative understanding of the overall likelihood of cor~damage and fission-product releases.The licensee's SPRA provides a quantitative assessment of the mean seismic core damage frequency.

The original IPEEE submittal's estimate of core damage risk was clearly over-conservative, and did not meet the objective for understanding the likelihood of core damage resulting from seismic events.(The fragility results were highly conservative, and there was a mistake in the licensee's numerical computation of seismic core damage frequency which needed to be rectified, among other issues.),The revised IPEEE submittal[4]produces a much more realistic understanding of core damage risk.The licensee's IPEEE process also includes a qualitative assessment of seismic containment performance.

This assessment does not address the impact of containment performance on the likelihood of fission-product releases (including a more-detailed qualitative description of the expected magnitude and timing of release).However, such an assessmerit is not explicitly requested according to NVREG-1407 guidelines.

Hence, although the IPEEE could extend the containment performance analysis to develop qualitative (and/or quantitative) insights related to risks of radiological releases, the submittal does achieve a satisfactory understanding of seismic containment performance.(d)'he fourth and final objective of the IPEEE is that the licensee should take measures to reduce the overall likelihood of core damage and radioactive material releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.

As documented in the original and revised IPEEE submittals

[1,4], no major plant changes were deemed necessary by the licensee based on the results of the D.C.Cook IPEEE.Some potential procedural changes and minor equipment enhancements did result from the study.Section 7.0 of the original IPEEE submittal stated that all findings in the (seismic)walkdowns have either been incorporated into the component iragility analysis, administratively addressed, fixed at Cook Nuclear Plant or placed into action item tracking status awaiting disposition.

Specific details concerning what items had been fixed were not generally noted in Section 7.0 of the original submittal.

Neither was it clear what was meant by the designations"administratively addressed" or"placed into action item tracking status awaiting disposition." During the site audit, the seismic walkdown findings were reviewed, together with the licensee's action-item tracking and disposition approaches.

An additional request was made of the licensee to tabulate all plant improvements suggested by the walkdown findings, together with their disposition status.This table of items was provided by the licensee, and is duplicated here as Table 1.1.The licensee's treatment of many walkdown findings (including relay evaluation findings in USI A-46 resolution) is judged to respond significantly to this IPEEE objective.

Within the body of the original IPEEE submittal, it is noted that specific changes were made as a result of plant review concerning GI-131,"Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants." Impleinentation of this plant improvement will reduce the potential for a small LOCA initiating event, and thus also responds to the fourth IPEEE objective.

Also, Section 7.0 of the IPEEE submittal notes (under the heading")that procedural changes were implemented to help insure control-room habitability in the event of an earthquake-induced hydrazine spill.Energy Research, Inc.ERI/NRC 95-501 I I II I~I~I II I I~II~I'~I I~I~~I~I'l~~~~I I~~I I~~I~I~~'I'~~~I I I~~'I~I I~~'l~~~~I~II~~I~~~I~~~~~I~I II I~I 4I l\~0~I~~~~I I~I I'~ll I l\~~I'l~~~'I I I~I I~~I~I I~I~~~~I~I~~~II~I~I I~~I I I~I~I~~~I~I I I I I'I I~~~~~~I~I~I I II~I I I~~I I~~I~I~~I'I I I II~I~'~I I~~~II I~I~~~~I~I~~~I~I'I I~~II I'~~~I I~~~~I I~~I~I~~~II~~'1~~I~~I~I I I~I~'I I I~I I~~'I'll~~~~I I~I I I I~I I~I~I~I~~~I~I~I~~~~II I~I I~~I I'~I'I'~I'~l~~~~~'.I~I'~~~I I I~I I~I~~I I'~~~~I I II~~~m'I I~~I I'l~~~~'I~~I~I~I~I I~~I II~I~I~~~I~I'~I I~~I'I~~~I'I I I I I I I'I~I I I I'l~~I I~I I~'I I~~~I~~~~~~~

I I~~~~I I O'I I~~~I~'ll~'~II~~~~I~~~I I~~~~~I~~~~.I~II I'I~I'I'I~~I~~~~I I I I~'II'~I~I~I II'~II~~~~'~~I'l'~I~I~~~~~~I I I i I'I~I~I~I'~~'~~I~~'~~~II~~I I~~~~I I~I~I~~I~'11 I'I~~~~'I I~I~I~~'~~ll I~ll I~~~I~~'~~'~I~!~1~I I II~I~~'I I I'I I I~~~I~~~~I I~~~II I II II~I I~I~~~~~~~'I I~~~'I I I~I I I~~I~'I~I I'I'I I~I~~~~~~I~~I I~I I~I'I~~I I~~I I I I~I~~I~II~~~'~~I I~~I~I~~~I I'~~~~I I1~II I I~I~I~I II I~'I~I~I I'~'~~I~~~~I'~~~~~~~I~I~~I II I I~~II~I'I I'~~I'~I~I'I~I~I~~~~I'I I'I~I II I I I I II~~~I~I~~'~I~11 I~I~I

II~I~I~I~I~I I~'I~~~~I~~I I.I~I I~~I~I'~'I~~~I~I~I'l~I~I~I~~~I~'~~'I~~~'I I~~I I'll~~II I'I II~I~~I~I~~II I~I I~~~I'~~~~~~~~l I I~~I~~'~I~~I~0 II~I I~~I~II~~~'~I I~~~~~~III~~~'~'I~I I~I I~~~~'I~I I~~I~~~~'~~~~I I~~~~I'~~I~I~~~~~~~~~I'l I I I'I~I'I'~~'I II.I II I~II~~I'~~I I~~~~~'I~I~I I~'~I I~l I~I~~'I~~I~~~~~

Other specific potential seismic conce'ms are noted in the body of the IPEEE submittal, including the following items: (a)block walls, (b)fire-extinguisher mounting, (c)fire protection pilot lines, (d)fluorescent lights in control room, (e)missing/broken anchorage on some motor control centers, and (f)seismically induced fire due to failure of the support of a 17-ton CO, tank.Although most of these concerns could be rectified with low-cost improvements, the IPEEE submittal does not indicate that any changes will be made.The study specifically states or suggests that changes are not required to address items (c), (e), and (f).Based on the description provided in the IPEEE submittal,.it seems clear that (without further analysis)items (b)and (d)are likely candidates for rectification.

Because the costs of enhancements for items (e)and (f)would be low, it may also be prudent for these items to be rectified.

Seismic IPEEE Insights The licensee's original and revised IPEEE submittals

[1,4]reference a number of'important insights regarding walkdown-related seismic concerns and dominant contributors to seismic risk for this plant.In addition, this is the first instance that a fragility assessment has been conducted for an ice condenser containment.

Based on the pre-site visit audit of the licensee's submittal, and pending additional verification and review, the insights derived from the IPEEE could not be confirmed as being completely robust.This conclusion stemmed from the fact that a number of simplifying approximations were introduced at various points in the licensee's IPEEE process, and the effects of these simplifying assumptions were not adequately addressed in the IPEEE submittal and subsequent responses to NRC qu'estions.

In addition, the fragility analysis of the ice condenser required additional refinement.

The implication of these points was that the ranking of dominant risk contributors needed to be better justified, and could likely change.The preliminary insights as to the dominant seismic contributors to core damage, based on the licensee's IPEEE submittal[1], are summarized as follows: The initiating events which dominate the analysis are: 1.Loss of Offsite Power 2.Steamline/Feedline Break 3.Loss of Service Water System The dominant contributors to seismic core damage risk are: Loss of Electric Power Systems a.600 VAC Transformers b.Diesel Generator Fuel Oil Day Tank 2.Auxiliary Building Seismic Failure Secondary contributors to seismic core damage frequency are: 1.'.3.4.5.Energy Research, Inc.Reactor Protection System (RPS)Failures (Miscellaneous Panels)Turbine-Driven AFW Pump (Random Failures)Turbine Building Pedestal 250 VDC Panels 4160 VAC Switchgear ERI/NRC 95-501

Based on the revised IPEEE submittal[4], the foregoing insights changed only slightly, to the following:

The initiating events that dominate core damage risk in the revised analysis were assessed as: 1.Loss of Offsite Power (Failure of Ceramic Insulators) 2.Direct Core Damage (Dominated By Containment Structural Failure due to Soil Pressure)The following three initiators have relatively equal contributions to core damage risk: a.Steamline/Feedl inc Break (Failure of Secondary Piping/Supports) b.Loss of Essential Service Water System (Screenhouse Failure)c.'arge LOCA (Failure of Pressurizer Supports)The revised dominant contributors to seismic core damage risk are: 1.Auxiliary Building (Failure of Steel Columns Supporting Crane Girders)Loss of Electric Power Systems a.600 VAC Transformers (Block Wall FaHure)b.Diesel Generator Fuel Oil Day Tank (Block Wall Failure)3.Turbine-Driven AF Pump (Random Failures)Lesser, but notable, contributors include: 4.250 VDC System 5.Reactor Protection System (Failure of Miscellaneous Panels)6.Ice Condenser That the auxiliary building is assessed as a dominant risk contributor (in both the original and revised analyses)is somewhat unusual in comparison to results of other SPRA studies of PWRs.Review of the revised fragility calculation for the auxiliary building columns reveals potential sources of conservatism.

Specifically, the allowable ductility appears low (producing a low margin factor associated with inelastic energy dissipation).

The fragility analysis also states that peak seismic stresses for design basis loading exceed 80%of the design allowable stresses, and hence, no margin (or variability) pertaining to yield strength is used.In reality, however, some level of margin is likely indicated.

A review of all revised fragility calculations also reveals that there is no margin/variability associated with damping, and no variability associated with a failure criterion (e.g., failure ductility, failure drift, etc.).In addition, the revised fragility calculation submittal does not explain why spectral shape margin factors greater than unity are always used, whereas for high-frequency

()8 Hz)components, the site-specific PRA spectral ordinates exceed those for the design basis spectrum.These problems can lead to potential conservatisms or nonconservatisms in the fragility analyses.Energy Research, Inc.ERI/NRC 95-501 Block wall failures have been identified as items of concern from past seismic PRAs;hence, the identification of block wall failures as dominant risk contributors in the Cook IPEEE is not particularly surprising.

It is noted, however, that there is a reasonable probability that failure of the block wall separating the two (Unit 1 and Unit 2)600 VAC transformers will not lead to failure of either transformer; hence, the assumption that block wall collapse always leads to transformer failure is also conservative.

In contrast to these potential conservatisms, analyses of other items appear to be somewhat nonconservative, and such items could well be revealed as dominant contributors under meaningful variations in analysis assumptions.

For example, poor weld detailing of 4 kV switchgear (cabinet plug welded to shim plates)is likely to substantially limit the seismic capacity, whereas a relatively high seismic design capacity (which was not fully justified/developed in the revised IPEEE submittal) was used in the fragility analysis.The seismic capacity of CCW heat exchanger supports is likewise judged to be somewhat lower than that developed in the revised Cook IPEEE.For these reasons, and others, the dominant contributors assessed in the revised Cook seismic IPEEE are still considered to be somewhat questionable.

The current insights are, nonetheless, considered to be useful.However, more meaningful insights could perhaps be drawn if justified refinements and variations in analysis assumptions were considered.

Revisions to containment performance insights were not explicitly developed as part of the revised Cook IPEEE.The original IPEEE submittal conclusions with respect to containment performance under seismic events include the following[1]: Containment mechanical penetrations and containment isolation valves were determined to have high capability to withstand direct failures due to seismic events.Hydrogen igniters were also found to be very rugged seismically (in withstanding direct failures), and were screened out of the containment-performance evaluation process.(However, failure of electric power to the igniters was evaluated.)

2.Reactor Protection System (RPS)failure, which results in failure to isolate the containment, and consequently was assumed to result in containment bypass, contributes less than 1%to the total seismic core damage frequency.

3.Direct seismic failure of the containment building (dominated by soil-pressure failure)contributes approximately 1%to the total seismic core damage frequency.

4.Direct seismic failure of the ice condenser was determined to have a notable (yet low)contribution to seismic core damage frequency.

Some of the most damaging seismic sequences involve a loss of decay heat removal (failure of the Emergency Core Cooling System[ECCS]or of auxiliary feedwater to the steam generators) in conjunction with failure of the containment spray system.(Although these sequences apparently have the largest contribution to seismic core damage frequency among those sequences having inadequate containment performance, the IPEEE submittal does not provide a quantitative value of the relative contribution.)

Energy Research, Inc.10 ERI/NRC 95-501 0

These conclusions may have slightly altered due to changes to Level-1 PRA results in the revised seismic IPEEE.Licensee response to a question, related to revised containment-performance insights, that was posed during the'October 25, 1995 meeting, suggests that the relative contribution to overall containment-failure risk, of containment soil-pressure failure, has increased for the revised study (as compared to the original study).A review of the original fragility analysis conducted for the ice condenser containment revealed a.number o problems in the methodology and calculations.

A revised seismic fragility analysis was conducted for the ice condenser, but the calculations were not reviewed.It is noted, however, that fragility parameters for the ice condenser now appear much more reasonable.

The revised seismic IPEEE submittal concludes that potential failure of the ice condenser is still a notable contributor to core damage risk.This conclusion, and the original IPEEE observation that potential ice condenser failure contributes meaningfully to the risk of poor containment performance, are viewed to be valid.R elative to seismic containment performance, neither the original nor revised seismic IPEEE submittal provides insights regarding the expected timing and magnitude of radioactive releases associated with the plant damage states pertaining to the aforementioned categories of containment failure.In addition to the foregoing plant-specific insights (pertaining to dominant risk contributors) as erived/revealed from analysis, a number of important insights (pertaining primarily to non-design-related eficiencies) were also derived/revealed as a result of direct observation in plant seismic walkdowns.

hese walkdown-related insights were discussed above in Section 1.1.1.1, under IPEEE objective (d).They include concerns associated with the following items: block walls, fire-extinguisher mountings, fire protection pilot lines, fluorescent lights in control room, missing/broken anchorage on some motor control centers, seismically induced firedueto failureof thesupportofa 17-ton CO tank earth uak-d h drazine s ill and y'i, an seismic interactions involving the movable in-core flux mappin~system.M t f these w alkdown-related insights can be classified as generic insights applicable to all plants where such components can be found.1.2.1.3 Summary Evaluation of Submittal Based on the site audit, and review of information supplied by the licensee, it appears that the licensee has developed an appreciation of severe accident behavior, gained a qualitative understanding of the overall likelihood of core damage, and adequately assessed containment performance.

As a result of the seismic IPEEE (primarily the walkdown effort), a number of plant improvements have been identified and implemented.

Also, the licensee appears to possess an understanding of likely severe accident sequences that could occur at its plant under full power operating conditions, thou h the relative rankin f th s uencesma n eq y ot be precise, due in part to a few questionable fragility analysis assumptions.

1.2.2 Fire The fire portion of the Summary Report of the D.C.Cook IPEEE submittal[1]provides a concise view of the work done to identify the potential fire concerns.The report is based on the conditions set forth in Supplement 4 of Generic Letter 88-20[3].From the information provided in the Summary Report, the Licensee's Response to NRC Questions[2], initial fire risk analysis[10], and revised fire risk analysis[11]it can be concluded that the licensee has used a proper methodology and data base for conducting the fireEnergy Research, Inc.ERI/NRC 95-501

analysis.Level 1 fire PRA methodology has been employed that has included a screening procedure based on a screening criterion of 10'er reactor-year for core damage frequency.

The following are some general comments regarding the adequacy of the D.C.Cook IPEEE fire analysis: The overall fire core damage frequency (3.76x10~per year)is somewhat smaller than that typically concluded in other fire risk studies.No criterion has been set forth as to what constitutes a fire vulnerability, and no fire occurrence scenario has been.identified as unacceptable..

1.3.1 Seismic The seismic-related sections of this report document the results of a Step-2 seismic review of the D.C.Cook IPEEE.A Step-1 review was conducted by the NRC, resulting in a number of questions requiring further clarification from the licensee.The present Step-2 seismic review has audited information supplied in the licensee's original IPEEE submittal, as well as in the responses provided by the licensee to the 16 NRC questions related to seismic issues raised in the Step-1 review.The purpose of this Step-2 review is to address questions and concerns that were developed as a result of the Step-1 review and to provide an independent perspective on the strengths and weaknesses of the IPEEE submittal.

The emphasis and guidelines described in the NRC report, IPEEE Review Guidance Document[12], for the appropriate type of IPEEE study (i.e., a Seismic PRA in the present case), were followed in the seismic audit process.This process consists of four major aspects: (1)pre-site visit review, (2)site visit, (3)post-site visit evaluation, and (4)documentation of important findings.Execution of all relevant activities, and consideration of all issues, as described in Figure 3.1 of Reference[12](provided here as Figures A.l to A.4 of Appendix A)has helped serve as a systematic basis in evaluating strengths and weaknesses of the licensee's seismic IPEEE submittal, in evaluating whether or not the seismic IPEEE submittal meets the Guidelines of NUREG-1407, and in ascertaining the extent to which the seismic IPEEE submittal satisfies the overall objectives of the IPEEE and intent of Supplement 4 to Generic Letter 88-20.1.3.2 Fire The Summary Report of the D.C.Cook IPEEE, the Licensee's Response to NRC Questions, and the Appendix R submittal (" Safe Shutdown Capability Assessment, Propose Modifications and Evaluations"[13])were initially received and reviewed prior to the site visit.At this stage a preliminary review was conducted according to Section 4 of the IPEEE Review Guidance Document[12].From the preliminary review, an agenda was developed for a site visit and an interview of Licensee's personnel.

A site visit was conducted, which included a brief plant walkthrough and the review of several fire analysis related documents.

At this point, a copy of the fire risk analysis report[10]was received and reviewed by the audit team.A brief report of the review fiindings was presented to licensee personnel as part of the exit interview.

Energy Research, Inc.12 ERI/NRC 95-501 The licensee, based on the comments received during the site visit and exit interview, revisited the fire risk analysis and presented its prelim;nay results in a meeting with the NRC and the audit team on October 25, 1995.The audit team generated a second set of comments, which were presented to the licensee at the end of the meeting.The licensee reissued the fire risk analysis report[11]which served as the basis for the final conclusions of the audit team.1.4 1A.1, Seismic Pre-site visit activities consist of performing a detailed review of the IPEEE submittal and related licensee responses to NRC questions.

As discussed in Section 1.2.1, pre-site visit evaluation has been based on the pertinent checklist found in Reference[12], which is reproduced in this TER as Figure A.l.The objectives have been to evaluate as many of the issues identified in the checklist of Figure A.1 as possible, from the information provided in the IPEEE submittal, and to identify items requiring clariifiication and/or special attention in the site audit visit.N The seismic audit focuses on verifying whether or not the licensee's overall IPEEE process is a valid approach for assessing potential plant improvements, on judging whether or not the resulting insights are reasonable and technically well founded, and on ascertaining the strengths and weaknesses of the study.The audit is not intended to provide an exhaustive check on quantitative results;however, such results should be verified as reasonable and/or accurate for certain critical aspects of the analysis.In reviewing the D.C.Cook original IPEEE submittal, limited actual-verification of numerical results has been performed, primarily because insufficient analytical detail and associated plant data are provided in the submittal to check the analysis procedures.

The emphasis of the D.C.Cook submittal is on describing the overall procedures and the major findings of the SPRA.Supporting data and analytical reports are held by AEPSC and were made available during the site audit visit.The major portion of the pre-site visit seismic audit, therefore, has been involved with developing preliminary audit findings bas'ed on a paper review of the IPEEE submittal and with developing a site audit plan capable of finalizing the audit findings and identifying specific issues of concern, if necessary, through physical inspection.

Because complete modeling and analysis details (e.g., fragility calculations) were not provided in the IPEEE submittal, and because it was not possible to adequately review such details pertaining to critical elements of the IPEEE during the time period of the site visit, some aspects of numerical verification were conducted after the site visit.The licensee of the D.C.Cook plant had, however, submitted a somewhat detailed fragility assessment of the containment ice condenser, in response to NRC request.A review of this&agility analysis was performed as part of the pre-site visit activities.

Review of the site-specific hazard study for D.C.Cook was'performed internally within the NRC, and has not been a part of the pre-site visit effort in this audit.1.4.2 Fire 13 A review of the Summary Report of the D.C.Cook IPEEE, the Licensee's Response to NRC Questions, and the Appendix R submittal (" Safe Shutdown Capability Assessment, Propose Modifications and Energy Research, Inc.ERI/NRC 95-501 Evaluations")was conducted using Section 4 of the IPEEE Review Guidance Document[12].The first draft of this report and an agenda for the site visit were developed based on this initial review.Also, a'ist of information items that were necessary for completing the review was assembled.

1.51.5.1 Seismic C A site audit of the D.C.Cook nuclear plant and onsite review of IPEEE data and key plant configuration were conducted on July 26-28, 1994.Drs.R.T.Sewell and,M.V.Frank participated as contractor seismic reviewers.

The first day of the site audit consisted of the following two efforts: (1)NRC/Reviewer-Panel elicitation of Licensee/Contractor Panel responses to key questions/concerns that could be readily clarified, and (2)in4epth examination of data and analyses with input from licensee's IPEEE participants who developed and performed the relevant analyses.The first e8ort addressed those items identified in Section A.1 of this TER that could be answered.Those items requiring a more lengthy review, and/or one-on-one interview with the appropriate IPEEE participant, were addressed in the second effort.The second half of the first day of the site audit was spent primarily on reviewing detailed seismic walkdown methods and findings, fragility calculations, seismic event tree and systems analyses, and seismic risk quantification approach.The second day of the site audit was devoted to a walkdown of the accessible areas of the plant.The focus of the walkdown was on verifying the condition of major items identified from the IPEEE walkdown findings.These items included both non-safety-related issues and safety-related issues.Conditions that could potentially limit the seismic capacity of risk-significant components were examined.i The third day of the site audit involved examination of additional IPEEE data and analyses, development of a list of site audit questions and concerns, and an exit meeting with the licensee/contractor IPEEE participants to present the site audit review findings and observations.

Appendix A, Section A.2 presents a summary of the findings and concerns from the seismic site audit.A principal observation that was immediately evident from the site audit was that a much greater effort had been expended on the seismic IPEEE than indicated by the original IPEEE documentation.

The initial panel review, and subsequent in-depth discussions, were sufficient to alleviate a number of potential concerns based on the pre-site visit review alone.The willingness of licensee and contractor personnel to assist in the site audit review effort also assisted in expediting the disposition of many concerns.However, a number of notable concerns remained after the site audit, though the site audit helped to better focus the nature of these concerns (see Section A.2)..The following subsections describe various aspects of the site audit process.1.5.1.1 Information Audited The seismic site audit included an evaluation of the following information:

plant layout and configuration drawings, documentation from key UFSAR sections, seismic IPEEE walkdown reports (contractor reports), documentation of fragility analysis methodology, IPEEE fault trees and IPE fault trees, and relevant IPE documentation.

Energy Research, Inc.ERI/NRC 95-501

1.5.1.2 Personnel Interviewed The panel session was conducted among all attendees of the IPEEE site audit meeting.Specific individuals interviewed, on a one-on-one basis, during the seismic site audit included (in order of interview sequence):

Mr.Steven Harris, EQE, regarding IPEEE walkdown procedures and findings.Dr.William LaPay,'estinghouse, regarding fragility analysis methods and method for incorporating walkdown concerns in the fragility analysis process.Mr.Rick Bennett, AEPSC, regarding systems analysis and applicable IPE modeling and findings.Mr.Marty Camp, D.C.Cook Plant Operator (Labels Supervisor), regarding equipment locations during plant site audit walkdown.1.5.1."3 Areas Walked Down Several plant areas were walked down in the turbine building and auxiliary building, as well as portions of the grounds surrounding the plant.No walkdowns were performed in the containment building or screenhouse structure.

Specific areas/components walked down include (roughly in order of sequence of walkdown):

Grounds to the northeast of the plant, including ground slope immediately east of the plant and areas around the Unit 1 RWST and CST Turbine building basement Essential Service Water (ESW)pump housing and adjacent strainer and supporting concrete pedestals AFW Pump Room ESW Piping/Bellows between Turbine and Auxiliary Buildings Diesel Generator Room (transformer, lube oil heater, lube oil sump tank, lube oil filter MCC), Fuel Oil Day Tank Enclosure (block walls)Switchgear Room (4 kV switchgear anchorage) and 600 VAC Transformer Area (including block wall)Battery Room (batteries and racks)Battery Chargers and Inverters Control Room (fluorescent lighting, miscellaneous panels, RPS cabinets, bracing of false ceiling)0 Energy Research, Inc.Hydrazine storage locations 15 ERI/NRC 95-501

Fire Extinguisher Mountings in Auxiliary Building RHR Heat Exchanger/Supports CCW Heat Exchanger/Supports CCW Pump Fire Protection Pilot Lines (one location)Halon Tanks MCCs located in Auxiliary Building 17-ton CO, Tank Control Room Cable Vault 1.5.1 4 Treatment of Principal Issues'presented in 1.5.2 Fire The principal issues of concern related to the fragility methodology, treatment of systems analysis dependencies, and disposition of walkdown findings.A list and description of principal items of concern identified as a result of the site audit, and presented to the licensee at the site audit exit meeting, is Appendix A, Section A.2.A site audit of the D.C.Cook nuclear plant and onsite review of IPEEE data and key plant confiiguration were conducted on July 26-28, 1994.Dr.M.Kazarians participated as the contractor fire reviewer.The following subsections describe various aspects of the site audit process.1.5.2.1 Information Audited A large array of documents were made available to the review team.The team focused particularly on References 10, 14, and 15.A copy of Reference 10 was provided for the review team to enable post-site audit review.Reference 10 was reviewed to understand the basis of the statements made by the licensee in References 1 and 2.Reference 15 was used for planning the plant walkthrough and review of specific fire zones addressed in the IPEEE.Reference 14 was subjected to a cursory review.It contains the input and output information for the COMPBRN runs used in the initial fire risk analysis.1.5.2.2 Personnel Interviewed The audit included an opening meeting, which involved members of the seismic audit, AEP engineers and the consultants involved in the preparation of the PRA and the fire risk analysis (References 10 and 14).Energy Research, Inc.16 ERI/NRC 95-501

As part of the opening meeting, the AEP team members provided a history of the fire risk analysis and fire IPEEE.After the initial opening discussions, two meetings were held on the first day of the visit, where fire IPEEE issues were addressed.

In the first meeting, J.Russell Sharpe, John Girlin and Mark Wilkins were interviewed.

In this meeting, the AEP team was asked to provide a step-by-step explanation of how the fire risk analysis was conducted.

Special attention was given to the screening procedure, and data used for conducting it.In the second interview, the use of the IPE systems and risk model for IPEEE fire scenario core damage analysis was reviewed with the same group of professionals from AEP, and their consultants.

1.5.2.3 Areas Walked Down A tour of the plant was conducted on the second day of the audit.The fire audit team was accompanied by the AEP fire risk analysis team and a plant-stationed employee familiar with Appendix R related issues and fire protection.

The areas visited by the fire audit team included the following:

Control rooms of Units 1 and 2 Control room cable vault for Unit 2 Turbine hall Erigineered safety system and MCC room Electric Power System (EPS)transformer room EPS motor control room EPS battery room Switchgear cable vault ESW pump room ESW motor control center Auxiliary Feedwater pump rooms Area 6N of Auxiliary Building Electrical Penetration Room In the auxiliary building, the various locations where Local Shutdown Indicator (LSI)panels are located were visited, and the LSI functions of those locations were reviewed.1.5.2.4 Treatment of Principal Issues The principal issues of concern related to gaining an understanding of (1)how the IPEEE was conducted, (2)what documentation was generated, (3)how this documentation supports the statements made in the Summary Report, and (4)how the plant is configured (layout), including the location of safety-related cables and equipment.

A list and description of principal items of concern identified as a result of the site audit, and presented to the licensee at the site audit exit meeting, is presented in Appendix B, Section B.2.Energy Research, Inc.17 ERI/NRC 95-501

1.6 1.6.1 Seismic In response to concerns raised during the site audit, AEPSC undertook a significant revision to the original Cook seismic IPEEE.It is assumed that, in developing this revised seismic IPEEE[4], the licensee considered all issues raised during the site audit, by either: verifying that they did not require additional special treatment; or explicitly and meaningfully accounting for their impacts on IPEEE modeling and results.Due to practical restraints that limit the depth and scope of the review process, it has not been possible to continually pursue all details of the licensee's IPEEE analysis at every step in the review process.The post-site visit review, therefore, has emphasized the major concerns that arose as a result'f the site audit, and that were judged to be of potential concern in the revised IPEEE.The licensee presented the approach and preliminary results of the revised seismic IPEEE at a meeting with the NRC held on October 25, 1994.Presentation of the revised seismic analysis focused on the following changes: revision to fragility analysis approach and calculations for selected components (including incorporation of Soil-Structure Interaction

[SSI]margin factors);refinements in seismic quantification process;analysis of liquefaction potential of slope at'the eastern border of the plant and of the intake structure foundation soil (along the shore of Lake Michigan);

and Level-1 risk re-quantification.

The preliminary revised analysis results (which are different from the final revised analysis results)produced a seismic CDF of 5.1x10/ry (as compared to the original CDF result of 1.83x10'/ry, and the final revised CDF result of 3.17x10~/ry).

The dominant contributors revealed from the preliminary revised analysis included: (1)auxiliary building, (2)cable trays, (3)4 kV switchgear, and (4)masonry wall enclosing the DG fuel oil day tank.These dominant contributors are noted to be different than those presented for the final revised analysis, which (significantly) does not list 4 kV switchgear.

As a result of the presentation of the preliminary revised seismic IPEEE, some remaining concerns/questions were noted and forwarded to the licensee.These seven questions are summarized in Section A.3 of this TER.Considering these questions, the licensee developed a final revised seismic IPEEE analysisand forwarded the results and responses to the NRC in a transmittal dated February 15, 1995.The final revised seismic IPEEE submittal and licensee responses to October 25, 1995 questions.were reviewed in detail to conclude the Step-2 IPEEE seismic review process for D.C.Cook.Included in the final IPEEE transmittal for Cook were a number of revised fragility calculations, explanation of SSI margin factors, and re-analysis results A particularly noteworthy observation from the revised IPEEE submittal[4]is that significant improvements were implemented in the fragility analysis methodology.

More realistic values of component median capacities and variability parameters were developed.(The original fragility results had unrealistically low medians, and P's of zero were assigned.)

Despite these dramatic improvements, cases of nonconservatisms and conservatisms have been identified during the review of the&agility re-analysis.

These challenge the ranking and list of dominant risk contributors.

For instance, 4 kV switchgear, which disappears from the dominant contributors list in the final revised IPEEE, would (in fact)be identified as a dominant contributor if j>>stifiable modifications were made in the analysis.For these reasons, the ranking of dominant contributors is not considered to be robust (and the seismic analysis, in general, would not be recommended as a model study).Nonetheless, a reasonably complete list of dominant contributors is confirmed/obtained as the collective set of dominant contributors from the original IPEEE, Energy Research, Inc.18 ERI/NRC 95-501 preliminary revised IPEEE, and final revised IPEEE.Even though the ranking of dominant risk contributors may not be precise, the IPEEE process has apparently identified the set of significant contributors.

Consequently, the license has reasonably demonstrated that no important contributors are being masked in the analysis.In addition, the demonstratedly low seismic risk also helps to alleviate concerns of the implications of potentially masked dominant contributors.

The post-site audit review has, therefore, been a key element in formulating a final position on the validity of the Cook seismic IPEEE findings.1.6.2 Fire In response to concerns raised during the site audit, AEPSC undertook a significant revision to the original fire analysis.The licensee presented the approach and preliminary results of the revised analysis at a meeting with the NRC held on October 25, 1994.The revised analysis had incorporated the proper assumptions regarding cable and equipment Mure, had revised the screening procedure, and had included analysis of fire zones that had been screened out based on engineering judgment.Based on the information presented in that meeting, additional comments and concerns were presented to the licensee.The licensee, using the comments presented to them, issued a revised fire risk analysis in February 1995.The comments and conclusions of this final TER are based, primarily, on the revised fiie risk analysis report.Energy Research, Inc.19 ERI/NRC 95-501

2.AUIHT FINDINGS 2.l SeiSmh A number of observations concerning the Cook seismic IPEEE and Step-2 review process have been described in the previous sections of this TER.This section presents the audit findings for major categories of seismic review.Preliminary and final audit findings are both described.

A more comprehensive list of specific issues identified during the audit process is provided in Appendix A.2.1.1 Relevance of IPEEE Process to Actual Plant and Configuration The licensee's overall seismic IPEEE process is highly relevant to assessing the resistance of D.C.Cook to potential severe seismic accidents.

The submittal itself does not convey significant information on the type, design, function, layout, operation, and other noteworthy aspects of the plant configuration.

Including additional basic plant data in the seismic IPEEE submittal would have enhanced its usefulness.

However, the site audit helped reveal that the IPEEE adequately models the actual plant configuration at D.C.Cook.The scope, procedures, and quality of plant seismic walkdowns, and the use of controlled plant data, have been sufficient in defining the state and configuration of the plant for purposes of evaluating its resistance to potential severe accidents initiated by seismic events.2.1.2 Accident Frequency Estimates The licensee's estimates of accident sequence frequencies were initially in error.Numerical errors in initiating event frequencies were found that needed to be rectified.

More importantly, a number of modifications in the fragility analyses (as described in Appendix A.1)needed to be incorporated to help insure accurate quantification of accident frequencies.

These changes have, for the most part, been implemented in the final revised seismic IPEEE[4].Consequently, there are no significant remaining concerns with the general level of accident frequency estimates.

2.1.3 Logic Models The plant logic models, including event trees, fault trees, minimal cutsets, plant seismic matrix, etc., needed to be reviewed and evaluated during the site visit, in order to assess the reasonableness and applicability of the systems analysis.Comments were made at the end of the site visit concerning needed improvements in the systems analysis.It is assumed that the licensee has appropriately addressed these improvements in the final revised IPEEE submittal.

2.1.4 Process to Identify, Eliminate or Reduce the Effects of Vulnerabilities The identification of physically evident seismic deficiencies in the plant walkdowns is considered to be well executed.Licensee's evaluation and treatment of cost-effective safety enhancements to eliminate or reduce the effects of these deficiencies originally appeared vague and largely unresponsive to the intent of severe-accident policy.Subsequent consideration of licensee actions in response to the seismic IPEEE, as revealed during the site audit, helped to demonstrate that meaningful plant improvements had been implemented.

Table 1.1 of this review, for instance, lists actions taken in response to walkdown findings.In addition, relay chatter evaluation (which was essentially treated in USI A-46)has identified bad-actor relays, which the licensee has targeted for replacement.

Energy Research, Inc.20 ERI/NRC 95-501

The overall (quantification) process used in identifying dominant risk contributors through analysis is now considered to be well executed.Problems in the original fragility evaluations posed a very real potential to invalidate the list of dominant contributors.

The ranking of dominant contributors is still not considered to be precise.The licensee has proposed no safety enhancements pertaining to dominant risk contributors, largely because the plant seismic risk has been demonstrated to be low.2.1.5 Vulnerabilities Requiring Further Analysis 2.1.5.1 Vulnerabilities Affecting Accident Prevention Some items identified in seismic walkdowns conducted by th'e licensee should be investigated in further detail.These items relate to: poor fire-extinguisher mountings, potential interaction problems with fire protection pilot lines, and potential interaction problems associated with fluorescent lights in the control room.These items may not be true outliers, at least with direct respect to seismic core damage risk;however, they may exacerbate problems experienced during seismic events, and they could potentially impact plant safety.2.1.5.2 Vulnerabilities Affecting Containment Performance The seismic IPEEE submittal does not specifically identify containment-performance concerns and potential opportunities for implementing cost-effective safety enhancements related to accident mitigation.

Given the scope of items associated with successful containment performance, it seems reasonable to question this result.Although not specifically included as part of IPEEE resolution, it would be of benefit for the licensee to address special Containment Performance Improvement (CPI)concerns that may arise from seismic initiators.

For PWR ice condenser containments, the principal CPI issue is that of evaluating vulnerability to interrupted power supply to hydrogen igniters, and need for improvement.

Since loss of station power is a significant contributor to seismic core damage at D.C.Cook, it would be worthwhile for the licensee to consider candidate actions for providing an alternate power supply to hydrogen igniters that is accessible following a major seismic event.Other candidate actions would be to improve the'apability and operator actions necessary to maintain containment spray function following an earthquake.

Operator actions related to hydrogen igniter control following seismically induced blackouts, and.subsequent power recovery, would also be worthwhile to consider.2.1.6 Dominant Contributors:

Consistency with External Events PRA Insights 2.1.6.1 Dominant Contributors to Core Damage The original seismic IPEEE submittal identified the following dominant risk contributors to core damage frequency:

600 VAC transformers (masonry wall failure), diesel generator fuel oil day tank (enclosing masonry wall), auxiliary building, reactor protection system (miscellaneous panels), turbine building pedestal, 250 VDC panels, 4160 VAC switchgear, and random failure of turbine-driven AFW pump.The preliminary revised seismic IPEEE identified the following list of dominant contributors:

auxiliary building, cable trays, 4 kV switchgear, and masonry wall enclosing the DG fuel oil day tank.The final revised seismic IPEEE further developed the following dominant-contributor list: auxiliary building (failure of steel columns supporting crane girders), 600 VAC transformers (block wa!1 failure), diesel generator fuel oil day tank (block wall failure), turbine-driven AF pump (random failures), 250 VDC system, reactor protection system (failure of miscellaneous panels), and ice condenser.

At the present Energy Research, Inc.21 ERI/NRC 95-501 I time, the ranking of dominant risk contributors cannot be considered as being very precise.However, the collection of items (i.e., union of items)identified as dominant contributors above is considered to be a fairly robust listing of the principal elements of seismic risk significance at D.C.Cook.The items in this list are, for the most part, consistent with insights developed in other seismic PRAs.2.1.6.2 Dominant Contributors to Radioactive Release given Core Damage The seismic IPEEE submittal does not specifically list dominant contributors to radioactive release given core damage.A qualitative description of seismic containment performance is provided.This qualitative description suggests that failure of the containment spray system accompanies many of the most damaging seismic sequences, and thus is a dominant contributor to failure of the accident mitigative function of the containment system.Direct soil failure of the containment and ice condenser failure also meaningfully impact the risk of poor containment performance.

2.1.7 Evaluation

of Decay Heat Removal Vulnerabilities 2.1.7.1 Evaluation of Process to Identify Vulnerabilities Details of the licensee's treatment of USI A-45 were not documented in the Cook IPEEE submittal.

USI A-45 was, therefore, addressed in the site audit review.This review revealed that the seismic IPEEE process is capable of identifying vulnerabilities related to shutdown decay heat removal.To the extent that the seismic IPEEE realistically models severe-accident response, therefore, USI A%5 will be meaningfully addressed.

It is judged that the revised Cook IPEEE adequately treats USI A-45.It is noted, however, that it would be appropriate for the licensee to more fully document the basis for USI A-45 resolution, relevant to seismic concerns, in the seismic IPEEE submittal itself.2.1.7.2 Evaluation of Findings No special concerns or needed plant improvements, related to shutdown decay heat removal requirements following seismic events, were encountered.

2.1.8 Evaluation

of Movable In-Core Flux Mapping System Vulnerabilities D.C.Cook is a Westinghouse plant having a movable in-core flux mapping system.The present review has considered the licensee's treatment of GI-131 (Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants).2.1.8.1 Evaluation of Process to Identify Vulnerabilities The licensee's treatment of GI-131 involved a review of the seismic adequacy of flux-mapping cart upper supports.As a result of this evaluation, the hold<own straps attached to the top of the cart were redesigned, and the design changes were implemented.

In addition, a lower lateral restraint to the flux mapping cart was installed at an elevation just above the seal table.Based on the design changes and results of the seismic wa>kdown, a HCLPF capacity of 0.32g was evaluated for failure of restraint of the flux mapping cart.Energy Research, Inc.22 ERI/NRC 95-501 2.1.8.2 Evaluation of Findings This treatment of GI-131 is judged to satisfy the relevant concerns associated with this issue.The resulting contribution of seal table failure to overall frequency of seismically induced small LOCA, however, was apparently not considered in the seismic PRA.2.2 The fire analysis part of the IPEEE was reviewed using the questions and topics provided in Section 4 of the IPEEE Review Guidance Document[12].A summary of the findings from that review is provided in Appendix B.l.Using the comments developed in response to those questions and topics, the following discussions are provided.2.2.1 Documents Reviewed The following documents were reviewed prior to the site visit: Donald C.Cook Nuclear Power Units 1 and 2, Independent Plant Evaluation, External Events, Summary Report, American Electric Power Service Corporation, April 1992[1].~Attachment to'he letter dated July 22, 1993 from E.E.Fitzpatrick, Vice President of Indiana Michigan Power, to T.E.Murley of U.S.Nuclear Regulatory Commission, Reference Number AEP:NRC:1082G

[2]."Safe Shutdown Capability Assessment, Propose Modifications and Evaluations

-10 CFR 50, Appendix R,Section III.G," Donald C.Cook Nuclear Plant Units 1 and 2, Indiana&Michigan Electric Company, American Electric Power Service Corporation, Revision 1, December 1986[13].The following documents were reviewed during the site visit:~Memorandum from J.M.McNanie to DC-N-6280-4, COMPBRN inputs/outputs attached to the memorandum, February 28, 1992[14].FHA drawings in D.C.Cook Fire Hazard Analysis, 1/31/92, Rev.6[15].~Cable routing information as part of Appendix R documentation.

The following document was reviewed during the site visit and a copy was made available for the fire audit team to allow post-site audit review: "Fire Risk Analysis," D.C.Cook PRA Volume 11, April 1992, Rev.0[10].Based on the comments generdted by this review team on Revision 0 of the fire risk analysis[10], licensee revised the analysis and then submitted the following documents:

Energy Research, Inc.23 ERI/NRC 95-501 Letter from E.E.Fitzpatrick of AEP to U.S.Nuclear Regulatory Commission, February 15, 1995[4].Attachment 1 to the above referenced letter,"Response to NRC Audit Concerns and Request for Additional Information"[4]."Donald C.Cook Nuclear Plant Units 1 and 2, Fire Analysis Notebook," Revision 1, February 1995[11].The information provided in the above referenced documents were used to generate the following comments.2.2.2 Compliance with Supplement 4 to Generic Letter 88-20 and NUREG-1407 The requirements set forth in Supplement 4 to Generic Letter 88-20 and in NUREG-1407

[5]are similar.Using Generic Letter instructions, the licensee prepared a summary report[1], which was submitted to the NRC.The summary report provides a short discussion of practically all the issues that are raised in the Generic Letter, and uses the format provided in Table C.1 of the Generic Letter for report organization.

The licensee has provided a discussion of the criteria to identify critical fire zones and areas.The licensee has provided discussions for fire initiation data base, event tree and fault tree modeling, dominant fire-induced core damage scenarios, core damage frequency, fire-induced containment failures, and fire risk scoping issues.The licensee has adopted Level 1 fire PRA methodology for con'ducting the IPEEE, and has prepared a fire risk analysis[10,11].Consecutive screening steps have been used to identify the most risk significant fire zones.Core damage frequency (CDF)is used for discriminating among different fire zones.In the revised fire risk analysis[11], the licensee has used industry historical fire data to establish fire occurrence frequencies for individual fire zones.For equipment and cable failure, the safe shutdown analysis and.cable routing information developed as part of Appendix R compliance have been used.The licensee and its contractors conducted two plant walkthroughs prior to the submittal of the IPEEE.These walkthroughs were performed using a standard checklist, with combustible loading of fire zones being verified, and the issues raised in the Sandia Fire Risk Scoping Study[16]being addressed.

In the process of the preparation of the revised fire risk analysis[11], the analysis team revisited the site and conducted additional walkthroughs of the fire zones that were found to be risk significant.

2.2.3 Methodology

Employed The D.C.Cook IPEEE used a common PRA based approach in which a screening analysis eliminates all but a relatively few fire areas.A detailed event tree and fault tree analysis, with these models coming from the IPE, is used to assess core damage frequency from local or global fires within the areas that survive the screening.

Eleven fire zones are identified as the most risk significant.

The method postulated complete unavailability of all components in a fire zone, determined the initiating event(s)caused by the unavailability;-

modified the fault trees of each of the relevant IPE event trees, and quantified a core damage frequency.

Energy Research, Inc.24 ERI/NRC 95-501 2.2.4 Fire Susceptible Equipment and Cables The equipment and cables that are considered for fire risk modeling are the same as those identified for safe.shutdown analysis (i.e., for Appendix R compliance).

Furthermore, the list of equipment used for fire impact modeling included motor control centers (MCCs)and valve control centers'(VCCs), which are typically not explicitly modeled in PRAs.For containment performance, the effects of fire, are analyzed qualitatively using analogies with the internal events Level 2 PRA.It is not clear, however, that the licensee has considered the degradation from a fire event of such systems as containment isolation and containment cooling.2.2.5 Fire-Induced Initiating Events The licensee has addressed fire-induced initiating events in the Licensee Response to NRC Questions[2], and the fire risk analysis reports[10,11], but does not discuss them in the Summary Report[1].Reactor trip is assumed for all fire zones/areas, and the transient event tree with the Power Conversion System available is used to model the fire impact.An exhaustive analysis of the possibility of initiating event occurrence from a fire has been presented.

RCP seal failure is addressed as part of component cooling water (CCW)system failure.2.2.6 Core Damage Frequency Model The PRA logic model has been employed to estimate fire-induced core damage frequencies.

The initiating event frequencies have been replaced with fire initiation frequencies.

The systems, trains and components within the respective fire zones have been assumed to be unavailable.

2.2.7 Containment

Systems Model In Reference 1 it is claimed that containment related systems have been addressed.

However, since the safe shutdown systems typically do not address containment isolation and containment cooling, such a claim should have been further substantiated.

2.2.8 Fire Zone/Area Selection The licensee has used the Appendix R information and Fire Hazard Analysis (FHA)for selecting fire zones/areas, combustible loading, cable pathways, and associated component connections'or each fire zone/area.

The licensee has used COMPBRN to verify the protection afforded by fire barriers.It is not clear if the licensee has considered mechanisms other than fire affecting a barrier.For example, in some special cases, the door to an area may be opened by the fire brigade to gain access to the fire.In such a case, the barrier would be breached, and additional fire zones may be exposed to a fire.Active fire protection systems have been used for defining the boundaries of several fire zones.The following areas have such characteristics:

Energy Res'earch, Inc.25 ERI/NRC 95-501 Between fire zones 45 and 46A (41 and 42A for Unit 1)there is a roll-up door that is normally kept open.Fire zone 29A and 29B are connected with an open doorway.In the cases of the roll-up doors and fire dampers, the fire risk analysis has not considered the possibility of failure of the boundary, and subsequent propagation of fire from one zone to another.2.2.9 Screening of Fire Scenarios Several screening tiers have been employed.In the first tier, those zones that do not contain any safe shutdown equipment or cables, or any of the equipment that was modeled in the transient event tree (TRA)of the Level 1 PRA, were screened out.In the second tier, assuming that all of the cables and equipment present in the zone have been damaged, the core damage frequency has been estimated using the Level 1 PRA event trees and fault trees.For this exercise, the proper initiating events have been used based on the cables present in the zone.Those fire zones with a calculated core damage frequency less than 10'/ry were screened out.2.2.10 Containment Performance For containment fires, it is argued that because of low combustible loading and large volumes, such fires are not considered as significant.

FIVE methodology is cited for eliminating this general area from further analysis.P Regarding containment performance, containment related equipment (e.g., containment isolation valves or containment cooling fans)were not included in the fire impact model.2.2.11 Fire Occurrence Frequency The licensee has used the Sandia fire occurrence database as represented in NUREG/CR-4586

[17]and the associated FIREDATA computer program.In applying the Sandia fire frequency database to their analysis, the licensee allocated the fire incidents from the 5 generic categories given in the database to the six D.C.Cook general zones.This approach has been used in many existing PRAs, where the fire frequency is estimated for generic categories of fire areas (building types).The frequencies of fires for specific zones/areas were obtained from ratioing the building fire occurrence history according to the characteristics of the specific fire zone.Thus, for areas where a fire has occurred in other plants, a fraction of the fire incidence data is assigned according to characteristics of the area.For areas where no fire incidence history exists, a fire frequency of 0.001 per year has been used.Plant-specific fire experience and uncertainties are not included in the fire frequency evaluation.

2.2.12 Fire Vulnerabilitv ERI/NRC.95-501 The total core damage frequency of 3.76x 10~per reactor-year is the sum of the eleven fire scenarios that survived the screening efforts.Eleven fire scenarios have been identified as the main contributors to the Energy Research, Inc.26 total core damage frequency for one unit.The fire zones associated with the eleven scenarios include the following:

Two diesel generator rooms where other cables are also present Two fire zones associated with the ESW system Two 4 kV switchgear rooms One MCC room One battery room A general area within the Auxiliary Building The control room An area within the Turbine Building The list is the same for both units.The area in the Auxiliary Building is common to both units.In the case of nine of the eleven fire scenarios, the initiating event is loss of either CCW or ESW.In one case the initiating event is loss of 250V DC system, and in the other the initiating event is assumed to be a general transient.

2.2.13 Fire Protection Measures The revised fire risk analysis[11]does not explicitly model the effects of fire detection and suppression systems on the CDF.In the case of some of the fire scenarios (e.g., control room and cable vault), the effects of fire protection systems is included implicitly.

2.2.14 Fire Growth and Damage Assessment The licensee has used, for a few fire scenarios, COMPBRN IIIe to conduct fire growth and damage assessment.

The results of these analyses have not been shown in Reference 11.However, during the site visit, the review team examined COMPBRN runs and co'ncluded that for those cases which belonged to the initial fire risk analysis, the program was used properly.2.2.15 Damaging Effects of Fire Fighting A thorough methodology has been employed to assess the adverse effects of fire fighting activities on safe shutdown equipment that are not affected by a fire.A detailed account of the methodology has been provided in the Licensee Response to NRC Questions[2].2.2.16 Walkdown The Summary Report[1]indicates that at least two walkthroughs were conducted; and special checklists were employed for that purpose.In the second walkthrough, the measurements needed for COMPBRN analysis were taken.In the Licensee Response to NRC Questions[2], it is indicated that only Unit 1 has been reviewed in detail.A Unit 2 walkthrough was conducted to verify the similarities between the two units.27 In addition to the walkthroughs for the initial submittal, the fire risk analysis team conducted walkthroughs of specific fire zones to support the revised fire risk analysis.Energy Research, Inc.ERI/NRC 95-501

2.2.17 Uncertainties The licensee has not produced an explicit discussion of uncertainties and sensitivity issues associated with the data, models and analyses results.However, the reports provide extensive lists of assumptions and discussions of conservatisms in the analysis.2.2.18 Sandia Fire Risk Scoping Study Issues The Sandia Scoping Study issues have been addressed explicitly.

For control room control circuit isolation, the Local Shutdown Indication (LSI)panels will be used.These panels are located at several~spots in the auxiliary building.With respect to seismically induced fires, the Summary Report does not address these in Section 4.8.However, in the Licensee Response to NRC Questions (page 8), it is stated that cabinet movement, tank movement, and pump leakage is not a problem for the design basis earthquake.

This is further discussed in the revised fire risk analysis.Special focus is given to the CO, tank.The licensee has stated that automatic fire suppression systems may not survive a strong earthquake.

2.2.19 USI A-45 USI AC5 has been addressed by the licensee.No information is provided except for a reference to the internal events IPE report[9].-4 2.3 2.3.1 GSI-147,"Fire-Induced Alternate Shutdown/Control Panel Interaction" GSI-147 addresses the scenario of fire occurring in a plant (e.g., in the control room), and conditions which could develop that may create a number of potential control system vulnerabilities.

Control system interactions can impact plant risk in the following ways: Electrical independence of remote shutdown control systems Loss of control power before transfer Total loss of system function Spurious actuation of components The licensee addressed fire-induced spurious actuation of components, as described in Sections 4.1 and 4.2 of Reference[11].Since the submittal has followed the guidance provided in FIVE concerning control system interactions, all circuitry associated with remote shutdown is assumed to have been found to be electrically independent of the control room.2.3.2 GSI-148,"Smoke Control and Manual Fire Fighting Effectiveness" GSI-148 addresses the effectiveness of manual fire-fighting in the presence of smoke.Smoke can impact plant risk in the following ways: ERI/NRC 95-501 By reducing manual fire-fighting effectiveness and causing misdirected suppression efforts Energy Research, Inc.28 Qi~By damaging or degrading electronic equipment By hampering the operator's ability to safely shutdown the plant~By initiating automatic fire protection systems in areas away from the fire Reference[18]identifies possible reduction of manual fire-fighting e6ectiveness and causing misdirected suppression efforts as the central issue in GSI-148.The submittal included manual suppression in the fire propagation analysis, and has employed a conservative approach in the screening phase, as described in Section 4.5 of Reference[1].2.3.3 GSI-156,"Systematic Evaluation Program (SEP)" Reference[18]provides the description of each SEP issue stated below, and delineates the scope of information that may be reported in an IPEEE submittal relevant to each such issue.The objective of this subsection is only to identify.the location in the IPEEE submittal where information having potential relevance to GSI-156 may be found.Settlement of Foundations and Buried Equipment[18]: The objective of this SEP issue is to assure that safety-related structures, systems and components are adequately protected against excessive settlement.

The scope of this issue includes review of subsurface materials and foundations, in order to assess the potential static and seismically induced settlement of all safety-related structures and buried equipment.

Excessive settlement or collapse of foundations could result in failures of structures, interconnecting piping, or control systems, such that the capability to safely shutdown the plant or.mitigate the consequences of an accident could be comprised.

This issue, applicable mainly to soil sites, involves two specific concerns:~potential impact of static settlements of foundations and buried equipment where the soil might not have been properly prepared, and seismically induced settlement and potential soil liquefaction following a postulated seismic event.Static settlements are not believed to be a concern, and the focus of this issue (when considering relevant information in IPEEEs)should be on seismically induced settlements and soil liquefaction.

It is anticipated that full-scope seismic IPEEEs will address these concerns, following the guidance in EPRI NP-6041.D.C.Cook Nuclear Plant is founded on soil and is located on the west side of a notable slope.The fragility analysis for the containment building was dominated by soil overpressure, as described on pages 3-12 and 3-17 of the IPEEE submittal.

The topic of soil liquefaction is discussed in Section 3.2.5 of the submittal.

Dam Integrity and Site Flooding overtoppmg.

Therefore, the focus is to assure that adeq: Energy Research, Inc.29 ERI/NRC 95-501[81: bi i i lily f flooding and to ensure a cooling water supply.The safety functions would normally irclude remaining stable under all conditions of reservoir operation, controlling seepage to prevent excessive uplifting water pressures or erosion of soil materials, and providing sufficient freeboard and outlet capacity to prevent uate safety margins are available under all loading conditions, and uncontrolled releases of retained water are prevented.

The concern of site flooding resulting from non-seismic failure of an upstream dam (i.e., caused by high winds, flooding, and other events)is addressed as part of the SEP issue"site hydrology and ability to withstand floods." The concerns of site flooding resulting from the seismic failure of an upstream dam and loss of the ultimate heat sink caused by the seismically induced failure of a downstream dam should be addressed in the seismic portion of the IPEEE.The guidance for performing such evaluations is provided in Section 7 of EPRI NP-6041.As requested in NUREG-1407, the licensee's IPEEE submittal should provide specific information addressing this issue, if applicable to its plant.Information included for resolution of USI A-45 is also applicable to this concern.The D.C.Cook IPEEE submittal states, in Section 5.2.1, that there are no dams in the proximity of D.C.Cook Nuclear Plant, and that dam failure and flooding from inland lakes and streams are not applicable to the plant site Site Hydrology and Ability to Withstand Floods Il8t Th bi i f i i i<>(SEP plants)are adequately protected against tornadoes.

Safety-related structures, systems, and components need to be able to withstand the impact of an appropriate postulated spectrum of tornado-generated missiles.As requested in NUREG-1407, the licensee's IPEEE submittal should provide information addressing this issue.The D.C.Cook IPEEE has involved an evaluation of tornadoes, including tornado-induced missles.Pages 5-9 and 5-10 (Sectiori 5.1.3.3)of the submittal provide discussion relevant to tornado missles.Severe TVeather sects on Structures

[18]: The objective of this issue is to assure that safety-related structures, systems, and components are designed to function under all severe weather conditions to which they may be exposed.Meteorological phenomena to be considered include: straight wind loads, tornadoes, snow and ice loads, and other phenomena judged to be significant for a particular site.As requested in NUREG-1407, the licensee's IPEEE submittal should provide information specifically addressing high winds and floods.Other severe weather conditions (i.e., snow and ice loads)were determined to have insignificant effects on structures (see Chapter 2 of NUREG-1407).

The D.C.Cook IPEEE has included evaluations of high winds (straight wind loads and tornadoes) and external floods.Section 5.1 of the submittal discusses severe winds and tornadoes, and Section 5.2 of the submittal discusses external floods.Design Codes, Criteria, and Load Combinations

[18]: The objective of this issue is to assure that structures important to safety should be designed, fabricated, erected, and tested to quality standards commensurate with their safety function.All structures, classified as Seismic Category I, are required to withstand the appropriate design conditions without impairment of structural intemity or the performance of required safety functions.

Due to the evolutionary nature of design codes and standards, operating plants may have been designed to codes and criteria which differ from those currently used for evaluating new plants.Therefore, the focus of this issue is to assure that plant Category I structures will withstand the appropriate design conditions (i.e., against seismic, high winds, and floods)without impairment of structural integrity or the performance of required safety function.As part of the IPEEE, licensees are expected to perform analyses to identify potential severe accident vulnerabilities associated with external events (i.e., assess the seismic capacities of their plants either by performing seismic PRAs or SMAs)., The D.C.Cook IPEEE has included an evaluation of potential severe accident vulnerabilities associated with external events.The submittal does not discuss the seismic Category classification of structures, and does not systematically identify codes, criteria, and load combinations used in design.Page 3-7 of the Energy Research, Inc.31 ERI/NRC 95-501 submittal provides a brief description of assumptions made in the seismic fragility analysis concerning load combinations and strength reserves.Seismic Design of Structures, Systems, and Components

[18]: The objective of this SEP issue is to review and evaluate the original seismic design of safety-related structures, systems, and components, to ensure the capability of the plant to withstand the effects of a Safe Shutdown Earthquake (SSE).The D.C.Cook IPEEE is based on a seismic PRA, which has evaluated failure probabilities of the plant and plant structures, systems, and components, at various ground motion levels.The related probabilistic analyses are documented in Sections 3.1.3 to 3.1.5 of the submittal.

Shutdown Systems and Electrical Instrumentation and Control Features 081: "'""'""" reliable shutdown using safety-grade equipment.

The issue on electrical instrumentation and control is to assess the functional capabilities of electrical instrumentation and control features of systems required for safe shutdown, including support systems.These systems should be designed, fabricated, installed, and tested to quality standards, and remain functional following external events.In IPEEEs, licensees were requested to address USI A-45,"Shutdown Decay Heat Removal (DHR)Requirements," and to identify potential vulnerabilities associated with DHR systems following the occurrence of external even'ts.The resolution of USI APS should address these two issues.The licensee's treatment of USI AQ5 is discussed in Section 3.2.3 of the D.C.Cook IPE submittal.

Sections 2.1.7 and 2.2.19 of this TER summarize review findings related to USI A-45, respectively, for seismic events and fire events.2.3.4 GSI-172,"Multiple System Responses Program (MSRP)" Reference[18]provides the description of each MSRP issue stated below, and delineates the scope of infoimation that may be reported in an IPEEE submittal relevant to each such issue.The objective of this subsection is only to identify the location in the IPEEE submittal where information having potential relevance to GSI-172 may be found.Common Cause Failures (CCFs)Related to Human Errors Ol:C"'"'""""'""'""'f" omission that could be initiating events, or could affect redundant safety-related trains needed to mitigate the events.Other human errors that could initiate CCFs include: manufacturing errors in components that affect redundant trains;and installation, maintenance or testing errors that are repeated on redundant trains.In IPEEEs, licensees were requested to address only the human errors involving operator recovery actions following the occurrence of external initiating events.Some information is provided on page 3-14 of the IPEEE submittal and Section 4.7.4 of Reference[11]concerning operator recovery actions.Energy Research, Inc.32 ERI/NRC 95-501 Non-Safety-Related Control System/Safety-Related Protection System Dependencies PSIMdp I i-fy-le ly yh d impact on safety-related protection systems, as a result of potential unrecognized dependencies between control and protection systems.The concern is that plant-specific implementation of the regulations regarding separation and independence of control and protection systems may be inadequate.

The licensees'PE process should provide a framework for systematic evaluation of interdependence between safety-related and non-safety-related systems, and should identify potential sources of vulnerabilities.

The dependencies between safety-related and non-safety-related systems resulting from external events-i.e., concerns related to spatial and functional interactions

-are addressed as part of"fire-induced alternate shutdown and control room panel interactions," GSI-147, for fire events, and"seismically induced spatial and functional interactions" for seismic events.Information provided in the D.C.Cook IPEEE submittal pertaining to seismically induced spatial and functional interactions is identified below (under the heading Seismically Induced Sparial and Funcrional Interacrions), whereas information pertaining to fire-induced alternate shutdown and control panel interactions has already been identified in Section 2.3.1 of this TER.Heat/Smoke/Water Propaganon sects from Fires[8]: 'f pi i f train could potentially be damaged in one of the following ways: Heat, smoke, and water may propagate (e.g., through HVAC ducts or electrical conduit)into a second fire zone, and damage a redundant train of equipment.

A random failure, not related to the fire, could damage a redundant train.~Multiple non-safety-related control systems could be damaged by the fire, and their failures could affect safety-related protection equipment for a redundant train in a second zone.A fire can cause unintended operation of equipment due to hot shorts, open circuits, and shorts to ground.Consequently, components could be energized or de-energized, valves could fail open or closed, pumps could continue to run or fail to run, and electrical breakers could fail open or closed.The concern of water propagation effects resulting from fire is partially addressed in GI-57,"Effects of Fire Protection System Actuation on Safety-Related Equipment." The concern of smoke propagation effects is addressed in GSI-148.The concern of alternate shutdown/control room interactions (i.e., hot shorts and other items just mentioned) is addressed in GSI-147.Information provided in the D.C.Cook IPEEE submittal pertaining to GSI-147 and GSI-148 has already been identified in Sections 2.3.1 and 2.3.2 of this TER.No information is provided in the submittal pertaining specifically to GI-57.Energy Research, Inc.33 ERI/NRC 95-501 Effects of Fire Suppression System Actuation on Non-Safety-Related and Safety-Related Equipment[18): Fire suppression system actuation events can have an adverse effect on safety-related components, either through direct contact with suppression agents or through indirect interaction with non-safety related components.

Some information pertaining to suppression-induced damage to equipment, as well as seismically induced inadvertent actuation of fire suppression systems, can be found, respectively, in Sections 5.3 and 5.8 of.Reference[11].Effects of Flooding and/or Moisture Intrusion on Non-Safety-Related and Safety-Related Equipment[18]: Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-related equipment.

This type of event can result from external flooding events, tank and pipe ruptures, actuations of fire suppression systems, or backflow through parts of the plant drainage system.The IPE process addresses the concerns of moisture intrusion and internal flooding (i.e., tank and pipe ruptures or backflow through part of the plant drainage system).The guidance for addressing the concern of external flooding is provided in Chapter 5 of NUREG-1407, and the concern of actuations of fire suppression systems is provided in Chapter 4 of NUREG-1407.

The D.C.Cook IPEEE submittal[1]discusses external floods in Section 5.2, and seismically induced flooding in Section 3.2.7.Futhermore, Reference[11]has some discussion of non-seismic actuations of fire suppression systems in Section 5.3, and seismically induced inadvertent actuation of fire suppression systems in Section 5.8.Seismically Induced Spatial and Functional Interactions PjS i i fi f fn-systems through spatial and functional interactions.

Some particular sources of concern include: ruptures in small piping that may disable essential plant shutdown systems;direct impact of non-seismically qualified structures, systems, and components that may cause small piping failures;seismic functional interactions of control and safety-related protection systems via multiple non-safety-related control systems'ailures; and indirect impacts, such as dust generation, disabling essential plant shutdown systems.As part , of the IPEEE, it was specifically requested that seismically induced spatial interactions be addressed during plant walkdowns.

The guidance for performing such walkdowns can be found in EPRI NP-6041.The D.C.Cook IPEEE has included a seismic walkdown which investigated the potential for adverse physical interactions.

The submittal states that EPRI NP-6041 guidelines were followed in the seismic walkdowns.

Relevant information can be found in Sections 3.1.2 and 3.1.6 of the D.C.Cook IPEEE submittal.

Seismically Induced Fires'18J: Seismically induced fires may cause multiple failures of safety-related systems.The occurrence of a seismic event could create fires in, multiple locations, simultaneously degrade fire suppression capability, and prevent mitigation of fire damage to multiple safety-related Energy Research, Inc.34 ERI/NRC 95-501

systems.Seismically.

induced fires is one aspect of seismic-fire interaction concerns, which is addressed as part of the Fire Risk Scoping St.dy (FRSS)issues.(IPBEE guidance specifically requested licensees to evaluate FRSS issues.)In IPEEEs, seismically induced fires should be addressed by means of a focused seismic-fire interactions walkdown that follows the guidance of EPRI NP-6041.'he D.C.Cook IPEEE submittal provides no discussion of seismically induced fires.A description of the seismic-fire interactions evaluation is provided in Section 5.8 of Reference[11].Seismically Induced Fire Suppression System Actuation[18]: Seismic events can potentially cause multiple fire suppression system actuations which, in turn, may cause failures of redundant trains of safety-related systems.Analyses currently required by fire protection regulations generally, only examine inadvertent actuations of fire suppression systems as single, independent events, whereas a seismic event could cause multiple actuations of fire suppression systems in various areas.Some information pertaining to seismically induced inadvertent actuation of fire suppression systems can be found in Section 5.8 of Reference[11].Seismically Induced Flooding D8I si i fi of safety-related systems.Rupture of small piping could provide flood sources that could potentially affect multiple safety-related components simultaneously.

Similarly, non-seismically qualified tanks are a potential flood source of concern.IPEEE guidance specifically requested licensees to address this issue.Section 3.2.7 of the licensee's submittal discusses seismically induced flooding.Non-seismic fire protection piping was included in the licensee's evaluation of seismically induced flooding.The submittal cites the licensee's internal flooding analysis for other related concerns.Seismically Induced Relay Chatter D Sl: one of the following conditions:

remain functional (i.e., without occurrence of contact chattering);

~be seismically qualified; or~be chatter acceptable.

It is possible that contact chatter of relays not required to operate during seismic events may produce some unanalyzed faulting mode that may affect the operability of equipment required to mitigate the event.IPEEE guidance specifically requested licensees to address the issue of relay chatter.As noted in Section 3.2.8 of the D.C.Cook IPEEE submittal, a relay chatter analysis for D.C.Cook was performed as part of USI AM,"Verification of Seismic Adequacy of Equipment in Operating Plants." The extent, if any, to which relay chatter impacts were modeled in the seismic PRA is not discussed in the submittal.

Energy Research, Inc.35 ERI/NRC 95-501 Evaluation of Earthquake Magnitudes Greater than the Safe Shutdown Earthquake

[18]: The concern of this issue is that adequate margin may not have been included in the design of some safety-related equipment.

As part of the IPEEE, all licensees are expected to identify potential seismic vulnerabilities or assess the seismic capacities of their plants either by performing seismic PRAs or seismic margins assessments (SMAs).The licensee's evaluation for potential vulnerabilities (or unusually low plant seismic capacity)due to seismic events should address this issue.The D.C.Cook IPEEE has included a seismic PRA, as documented in Section 3 of the submittal.

Effects of Hydrogen Line Ruptures[18]: Hydrogen is used in electrical generators at nuclear plants to reduce windage losses, and as a heat transfer agent.It is also used in some tanks (e.g., volume control tanks)as a cover gas.Leaks or breaks in hydrogen supply piping could result in the accumulation of a combustible mixture of air and hydrogen in vital areas, resulting in a fire and/or an explosion that could damage vital safety-related systems in the plants.It should be anticipated that the licensee will treat the hydrogen lines and tanks as potential fixed fire sources as described in EPRI's FIVE guide, assess the effects of hydrogen line and tank ruptures, and report the results in the fire portion of the IPEEE submittal.

The D.C.Cook IPEEE submittal does not address the possibility of accumulation of a combustible mixture of air and hydrogen in vital areas.This omission is not deemed to be significant since, based on the walkdown conducted as part of this review, no vital areas were identified where leaking hydrogen gas could accumulate.

The submittal does, however, indicate that hydrogen fires that have occurred in turbine buildings of nuclear power plants were included in the fire occurrence data used in estimating the fire initiation frequency for the Cook turbine building.Energy Research, Inc.36 ERI/NRC 95-501

3.AUDIT CONCLUSIONS AND RECOMMENDATIONS 3.1 5eigaic The original Cook seismic IPEEE[1]produced a substantially unrealistic (over-conservative) evaluation of seismic risk.There were a number of identified problems in the analysis, most significantly the treatment of seismic fragility and HCLPF calculations, and the crude definition of seismic intervals used for quantifying risk.In addition, a number of open issues were identified in the review of the original submittal.

These were largely addressed during the site audit;however, there were a number of concerns that remained after the site audit.In response to these concerns, the licensee undertook signifiicant effort to correct problems in the analysis and to clarify/justify a number of issues.The resulting final revised Cook seismic IPEEE[4]is a significant improvement over the original submittal.

It adequately demonstrates that the seismic risk at D.C.Cook is low.Based on a detailed review of the revised seismic fragility calculations, it is believed that more realistic assumptions in the fragility analyses may likely alter the ranking of dominant contributors.

However, further refinement of the fragility analyses is considered to be unwarranted.

It is believed that, although the ranking of dominant contributors may not be precise, the collective set of contributors identified in the original submittal and the revised submittals encompass those conditions that are most likely to control plant capacity and risk.Based on review of the final revised IPEEE submittal, the licensee is apparently aware of other issues of potential concern,'and these have been summarized in the body of this TER.Based on the site audit, and review of information supplied by the licensee, it appears that the licensee has developed an appreciation of severe accident behavior, gained a qualitative understanding of the overall likelihood of core damage, and adequately assessed containment performance.

As a result of the seismic IPEEE (primarily the walkdown effort), a number of plant improvements have been identified and implemented.'lso, the licensee appears to possess an understanding of likely severe accident sequences that could occur at its plant under full power operating conditions, though the relative ranking of these sequences may not be precise, due in part to a few questionable fragility analysis assumptions.

As judged Rom this Step-2 seismic audit process, the following items are viewed as the strengths and weaknesses of the final revised seismic IPEEE submittal for D.C.Cook: Rrenghs 1.The level of analysis (i.e., seismic PRA)employed for the overall seismic IPEEE process.2.The general approach to quantifying dominant risk-contributing components, sequences, and plant damage states.3.The effort put forth in plant seismic walkdowns, and the resulting insights achieved concerning non-design-related plant deficiencies.

4 The degree of licensee participation in the seismic IPEEE process and licensee's intent to make the IPEEE a living study.The effort put forth in revising the seismic IPEEE, and the willingness to respond to questions and concerns raised during the review process.7 Energy Research, Inc.37 ERI/NRC 95-501 New fragility analyses still contain some apparent inaccuracies (conservatisms/nonconservatisms and omissions of some margin factors)that may effect quantitative results.However, the new fragility analyses are significantly improved over their original counterparts.

New fragility results were not developed for all components.

Although generating new fragility results for all components (where plant-specific fragility assessment was employed)is not absolutely necessary, future IPEEE insights could be hindered if an unrevised fragility result would, in fact, alter the results of the seismic IPEEE (had the fragility been calculated correctly).

No plant improvements were apparently undertaken associated with the following identified items: poor fire extinguisher mounting;potential interaction problems with fire protection pilot lines;and potential interaction problems from control room fluorescent lights.The documentation related to seismic containment performance is considered weak.Little justification for the conclusions have been given, and their is no (qualitative or quantitative) discussion of the modes, timings, and likelihoods of radiological releases.Meaningful candidate containment performance enhancements were not addressed.

5.Treatment of human actions and operator error is not clear.3.2 Qrj;For internal fires, the licensee appears to have developed an appreciation of severe accident behavior, understands the most likely severe accident sequences that could occur at its plant under full power operating conditions, and gained a qualitative understanding of the overall likelihood of core damage and radioactive material release.There are several items that have not been explicitly explained in the Summary Report[1], but References 2, 10 and 11 provide sufficient information in this regard.Overall, the licensee has followed a methodology that is proper and has been widely used for fire PRAs.The data bases for fire occurrence frequencies, equipment and cable locations, and fire fighting capabilities, and the fire impact modeling (i.e., fault trees and event trees)are deemed to be proper.The application of the data bases and models in the revised fire risk analysis can be considered as appropriate.

The overall core damage frequency from fire events is within a range that is typical for a fire PRA.Notwithstanding the above conclusions, some shortcomings of the submitted information include the following:

The licensee has not put forward a criterion for identifying a fire vulnerability.

There are several calculations that cannot be fully explained from the available information.

The possibility of active fire barrier failure and fire propagation between fire zones employing such equipment are not adequately explained.

It is not clear whether the licensee has considered, in its fire analysis, the degradation of such systems as containment isolation and containment cooling from a fire event.Energy Research, Inc.38 ERUNRC 95-501

.The licensee has not addressed uncertainties and sensitivity issues associated with the data and models.Energy Research, Inc.39 ERI/NRC 95-501

4.REFERENCES"Donald C.Cook Nuclear Power Plant Units 1 and 2 Individual Plant Examination of External Events Summary Report," American Electric Power Service Corporation, April 1992."Individual Plant Examination of External Events/Response to NRC Questions," letter from E.Fitzpatrick, (Indiana Michigan Power Company)to T.E.Murley, (U.S.Nuclear Regulatory Commission), dated July 22, 1993.3."Individual Plant Examination of External Events (IPEEE)for Severe Accident Vulnerabilities-10CFR 50.54(f)," U.S.Nuclear Regulatory Commission, Generic Letter 88-20, Supplement 4, June 28, 1991.4"Individual Plant Examination of External Events/Response to NRC Audit Concerns and Request for Additional Information," letter from E.Fitzpatrick, (Indiana Michigan Power Company)to U.S.Nuclear Regulatory Commission, dated February 15, 1995.5.J.T.Chen, et al.,"Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE)for Severe Accident Vulnerabilities," U.S.Nuclear Regulatory Commission, NUREG-1407, Final Report, June 1991.6.'Procedures for the External Event Core Damage Frequency Analysis for NUREG-1150," U.S.Nuclear Regulatory Commission, NUREG/CRC840, September 1989.8."Analysis of Core Damage Frequency:

Surry I'ower Station, Unit 1 External Events," U.S.Nuclear Regulatory Commission, NUREG/CR-4550, Volume 3, Rev.1, Part 3, December 1990.r"A Methodology for Assessment of Nuclear Power Plant Seismic Margin," Electric Power Research Institute, EPRI NP-6041, October 1988.10."Donald C.Cook Nuclear Power Units 1 and 2, Individual Plant Examination, Summary Report," American Electric Power Service Corporation, April 1992."Fire Risk Analysis," American Electric Power Service Corporation, D.C.Cook PRA Volume 11, Rev.0, April 1992."Donald C.Cook Nuclear Plant Units 1 and 2, Fire Analysis Notebook," American Electric Power Service Corporation, Revision 1, February 1995.12."Individual Plant Examination for External Events: Review Guidance (Draft)," Energy Research, Inc., ERI/NRC 94-501, May 1994.13."Safe Shutdown Capability Assessment, Propose Modifications and Evaluations

-10 CFR 50, Appendix R,Section III.G," American Electric Power Service Corporation, Donald C.Cook Nuclear Plant Units 1 and 2, Indiana 4 Michigan Electric Company, Revision 1, December 1986.Energy Research;Inc.ERI/NRC 95-501 J

14.Memorandum from J.M.McNanie to DC-N-62804, Attached COMPBRN Inputs/Outputs, February 28, 1992.15.FHA Drawings in D.C.Cook Fire Hazard Analysis, American Electric Power Service Corporation, Rev.6, January 31, 1992..16."Fire Risk Scoping Study," U.S.Nuclear Regulatory Commission, NUREG/CR-5088, January 1989.17.18."User's Guide for a Personal Computer-Based Nuclear Power Plant Fire Data Base," U.S.Nuclear Regulatory Commission, NUREG/CR-4586, August 1986."Sta6'uidance of IPEEE Submittal Review on Resolution of Generic or Unresolved Safety Issues (GSI/US/," U.S.Nuclear Regulatory Commission, August 21, 1997.Energy Research, Inc.41 ERI/NRC 95-501 APPENDIX A:~~A.l

SUMMARY

OF SEISMIC REVIEW FINDINGS Figures A.l to A.4, taken from the IPEEE Review Guidance Document[12], present the format and significant elements of the seismic audit process undertaken for the D.C.Cook IPEEE.A summary of findings and comments for each of these elements is provided below.1.A review of the site-specific seismic hazard analysis was not conducted as part of this audit.2.Because a review of the site-specific seismic hazard analysis was not conducted as part of this audit, licensee treatment of the Charleston earthquake issue was not evaluated.

The walkdown procedures and seismic review-team composition appear adequate for gathering plant information and for identifying plant seismic deficiencies/outliers.

The IPEEE submittal notes that licensee staff had a meaningful degree of participation in the walkdowns, although the walkdowns were led by consultants.

Although walkdown information gathered for the IPE was used for the seismic IPEEE, specific seismic walkdowns were conducted for containment buildings, auxiliary and turbine buildings, the control room, the screen house, and the grounds immediately surrounding the plant.It is noted that the licensee has yet to complete a confirmatory

walkdown concerning mechanical penetrations inside of the Unit 1 containment.

The walkdown screening process implemented in the D.C.Cook seismic IPEEE, including application of generic fragility data and use.of screening tables, generally appear to be conducted in a meaningful and valid fashion, using modern procedures (e.g., EPRI NP-6041 guidelines) as directed by NUREG-1407.

Certain applications of generic fragility data, however, may be questionable, and should be evaluated further during the site visit.Licensee's identification of potential outliers and other seismic concerns, as a result of seismic walkdowns, appears generally reasonable.

Concerns identified in the plant walkdowns include the following items: block walls, fire-extinguisher mountings, fire protection pilot lines, fluorescent lights in control room, missing/broken anchorage on some motor control centers, support structure of a 17-ton CO, tank, potential for earthquake-induced hydrazine spill, and seismic interactions involving the movable in-core flux mapping system.The extent of concern that needs to be given to these items will be evaluated'uring the site visit.The site visit will, therefore, involve a walkdown of these items.The site visit should also involve a spot check for conditions identified in past PRAs that may have.been missed in the D.C.Cook seismic IPEEE.6.The SPRA initiating events analysis appears to have been well done, implementing reasonable assumptions.

The models and logic used in the initiating event analysis, however, need to be reviewed during the site visit.7.The seismic IPEEE submittal presents plant system event trees, and these appear to be valid and reasonable for modeling the seismic response of D.C.Cook.Treatment of non-seismic failures and human actions needs to be reviewed more closely during the site visit.Energy Research, Inc.A-1 ERI/NRC 95-501 0

Figure A.1 Checklist for Pre-Site Visit Audit Energy Research, Inc.A-2 ERI/NRC 95-501 Figure A.2 Significant Issues, Objectives and Concerns to be Addressed Energy Research, Inc.A-3 ERI/NRC 95-501

Figure A.3 Potential Related Site Visit Activities Energy Research, Inc.A-4 ERI/NRC 95-501 Qi Figure A.4 Checklist for Post-Site Visit Audit Energy Research, Inc.A-5 ERI/NRC 95-501 Fault trees were not presented in the seismic IPEEE submittal.

These need to be reviewed during the site visit.9.The development and definition of plant damage states appears to be reasonable and valid.I 10.The ground-motion target spectral shape used for structural response analyses in the D.C.Cook seismic IPEEE was the Cook nuclear plant ground design response spectrum (GDRS).Although use of this spectral shape is thought to be mostly conservative, there are a number of problems with the use of this spectral shape for SPRA input.The most notable of these problems are listed as follows: (a)The shape is not well representative of strong earthquake motions that might be experienced at the D.C.Cook plant site.(b)The shape is not consistent with either the LLNL or site-specific hazard curves which are used to evaluate ground-motion probabilities.(c)For high frequencies the shape is nonconservative.(d)Secause the GDRS has varying degrees of conservatism (dependent on vibration frequency) relative to a representative, site-specific spectral shape, relative conservatisms in fragility assessments of various components will vary (again, depending.

on the predominant frequencies of vibratory response of the components).

Consequently, there exists the very real possibility that the list of dominant contributors will not be properly ranked.AEPSC undertook a limited sensitivity study of the effects of input spectral shape.This sensitivity study, however, does not adequately address the above concerns, particularly concern (d).AEPSC treatment of input ground-motion spectral shape is, therefore, considered to be a significant weakness of the study.11.The seismic input motions used in structural response analyses for fragility analyses need to be reviewed during the site visit to assess their applicability.

12.Other inputs used in structural response analyses and/or soil-structure interaction analyses need to be reviewed during the site visit to assess their applicability.

13.Model parameters used in structural and/or soil-structure interaction analyses need to be reviewed during the site visit to evaluate their representativeness.

14.15.Results of structural dynamic properties, structural responses, and in-structure spectra need to be reviewed during the site visit to evaluate their reasonableness.

Licensee's use of existing FSAR analyses needs to be reviewed during the site visit.16.For critical components that have a significant impact on risk, details of fragility analyses, including assessment of failure modes, need to be evaluated during and after the site visit.Energy Research, Inc.A-6 ERI/NRC 95-501

17.Use of generic fragilities in the D.C.Cook seismic IPEEE submittal appears generally valid and appropriate.

AEPSC key personnel involved in the fragility assessment need to be interviewed during the site visit to obtain additional information on the use of generic fragilities.

18.Fragility results need to be spot checked during and after the site visit.It is clear, however, that a number of weaknesses exist in the licensee's plant-specific fragility analyses.These weaknesses are not satisfactorily resolved in the licensee's responses to NRC questions.

Particular concerns are noted as follows: The use of zero uncertainty in plant-specific fragility assessments is not only unconventional, but also incorrect.

Uncertainty (in component capacity)is fundamentally defined as that variability which could be eliminated with perfect nowwledge of component response/behavior to the array of possible input conditions.

In theory, uncertainty can be reduced to nearly zero, but only if a sufficient state of knowledge (and consensus of" knowledge) exists such that a complete, unquestionable understanding of response has been achieved.Uncertainty in fragility assessment derives from a variety of sources, including:

lack of knowledge of a precise failure mode, lack of knowledge of a precise failure criterion, lack of ability to exactly model dynamic properties, etc.In practice, uncertainty cannot be reduced to zero.Uncertainty is not dependent upon whether or not generic or plant-specific data is used.In addition, uncertainty is fundamentally different from variability due to randomness, which cannot be entirely eliminated.

Variations in material properties and input ground-motions, for instance, always exist despite the level of modeling sophistication.

Tne licensee's submittal reflects an inexperience with fragility analysis methods, particularly with respect to the proper treatment of the variability parameters P~and P.If the licensee desired to eliminate separate treatment of randomness and uncertainty (as allowed in NUREG-1407 guidelines), then mean fragility curves, characterized by a median capacity and a single/composite P,,could have been used.The licensee's use of assumed conservative median capacities does not accurately nor satisfactorily resolve the use of zero P.The primary concern is that the licensee's approach introduces the very real possibility that the ranking of dominant risk contributors will not be accurately represented.

A review of the ice condenser fragility assessment reveals further inaccuracies and errors introduced in both the treatment of variabilities and treatment and use of safety-margin factors in deriving median capacities and variabilities.

It is only reasonable to assume that similar errors exist in the fragility analyses of other components as well.19.A detailed review of fragility analyses should be conducted for the following components:

600 VAC transformers, diesel generator fuel oil day tank, auxiliary building, reactor protection system (miscellaneous panels), turbine building pedestal, 250 VDC panels, 4160 VAC switchgear, and ice condenser.

In addition, the basis for determination of key random failure rates (e.g., turbine-driven AFW pump failures)should also be reviewed during the site visit.One primary result of the review of plant fault tree logic (item 8 above)should be a list of all components that dominate the failure logic (e.g., single-point failures).

A spot-check of the fragility results for all Energy Research, Inc.A-7 ERI/NRC 95-501.

0 components in this list should be conducted to help insure that the licensee's submittal has not dismissed a significant contributor to risk based on a potentially erroneous assumption of high seismic capacity.20.If plant-level Boolean logic has been developed, it will need to be reviewed during the site visit.21.If plant-level fragility curves have been developed, these will need to be reviewed during the site visit.(The SPRA for D.C.Cook involves direct accident sequence quantification; hence, plant-level fragility curves may not exist.)If a plant matrix for seismic events has been developed and used in core damage frequency quantification, it will need to be reviewed during the site visit.22: The D.C.Cook seismic IPEEE submittal has an error in the computation of seismic-interval probabilities which are used as inputs for quantifying initiating event frequencies.

The error results in an under-estimation (i.e., non-conservative evaluation) of seismic core damage frequency, though it is not expected to alter insights concerning dominant risk contributors.

The error can be clearly identified in Table 3.1.1-1 of the licensee's IPEEE submittal.

Specifically, frequencies of occurrence of ground motions, a, in the following intervals are erroneously ignored: 0.25<as0.26, 0.50<as0.51, 0.75<as0.76, 1.00<as1.01, and 1.25<as1.26.

Although this error may be initially thought of as numerically insignificant, it is expected to alter the mean seismic core damage frequency by about 15%.More importantly, however, the error is of the type that suggests a lack of experience with PRA methods, and hence, raises concerns as to other errors that may have been introduced in the D.C.Cook IPEEE submittal.

For the frequencies of occurrence of seismic ground-motion intervals used in quantifications, the initiating event frequencies appear reasonable.

The results need to be evaluated further, however, while conducting the review of the initiating events analysis during the plant site visit.24.For the given input ground-motion occurrence frequencies, the resulting mean plant damage state frequencies and mean core damage frequencies appear reasonable.

The results need to be evaluated further, however, while conducting the review of the systems analysis during the plant site visit.25.Results for dominant core damage accident sequences (and related minimal cutsets), as reported in the IPEEE submittal, appear reasonable.

26.Results for dominant core damage plant damage states, as reported in the IPEEE submittal, appear reasonable.

27.Results for dominant component contributors to core damage, as reported in the IPEEE submittal, appear generally reasonable.

These results, however, should not be considered as robust, due to inaccuracies introduced in the fragility analyses (e.g., from both the input response spectral shape used and the assumption of zero uncertainty in median capacity for plant-specific fragility assessments).

28.As presented in the IPEEE submittal, the licensee's qualitative assessment of containment performance appears to be reasonable in terms of the scope of components considered, and the level of detail employed in walkdowns and analyses.However, the fragility analysis of the ice Energy Research, Inc.A-&ERI/NRC 95-501

"~

condenser appears to have been performed incorrectly.

Fragility analyses for other important components related to accident mitigative aspects of containment performance (e.g., containment spray system, RPS miscellaneous panels, and perhaps direct containment failure)need to be reviewed during the site visit.29.The qualitative discussion of containment performance contained in the licensee's submittal does not specifically address expected magnitude and timing of radioactive releases associated with each plant damage state.The submittal does not explicitly identify which components are dominant contributors to the risk of large-early, large-late, and small-early releases.30.The licensee's evaluation of containment performance appears to adequately address the scope of possible direct failures to the containment structure and containment internals that may compromise both accident prevention and mitigation.

31.Licensee's treatment of possible sequences leading to small or large containment bypass appears to be limited.The'only bypass scenario considered is failure of the RPS, leading to possible failure to isolate the containment.(Note, this scenario is more concerned with containment isolation, rather than with true containment bypass sequences, e.g., interfacing systems LOCAs or unisolated steam generator tube ruptures.)

32.The licensee's evaluation of containment performance appears to adequately address the scope of possible direct component failures that may compromise accident mitigation.

The licensee's evaluation of containment performance appears to adequately address the scope of possible failures of support systems that are required for accident mitigation.

Those components of support systems required to achieve accident mitigation, yet not required for accident prevention, need to be identified during the site visit, to ascertain if fragility analyses of such components need to be reviewed.34 The description of relay chatter evaluation in the D.C.Cook seismic IPEEE submittal appears to satisfy the procedural guidelines in NUREG-1407.

A list of"bad actor" relays found in safety related equipment modeled in the SPRA, and yet not falling within the scope of USI AC6, should be obtained and evaluated during the site visit.35.Licensee's treatment of soil liquefaction concerns appears to be generally reasonable, although additional data will need to be reviewed during the site visit to confirm adequacy of the analysis.The IPEEE submittal states that the potential for earthquake induced landsliding does not exist at D.C.Cook.This claim should be confirmed in a walkdown of the grounds surrounding the plant during the site visit.36.Licensee's IPEEE submittal does not provide a very detailed consideration of the potential for flooding due to a possible earthquake-induced seiche on Lake Michigan.37.Licensee's assessment of seismic-fire interaction issues appears to be generally valid.This aspect of the analysis should, however, be discussed at the site visit (in conjunction with the review of the internal fire IPEEE)to insure that any potential concerns are identified and resolved.Energy Research, Inc.A-9 ERI/NRC 95-501 38.During the site visit, the licensee should provide a description of components and sequences that dominate the risk of not achieving accident mitigation, particularly for components required to mitigate accidents that could lead to large release (early or late)or small-early release.39.D.C.Cook is a Westinghouse plant having a movable in-core flux mapping system.The IPEEE submittal description of the licensee's evaluation and treatment of potential seismic interactions involving the movable inure flux mapping system appears to fully satisfy the concerns of GI-131.However, design details of straps and restraints intended to brace the flux mapping cart should be examined during the site visit, and details of the HCLPF calculation for the flux mapping cart should be reviewed and evaluated.

Licensee's submittal says that external event findings related to USI A-45 (" Shutdown Decay Heat Removal Requirements")were combined with findings from the internal analysis (Section 3.4.3 of the IPE).The treatment of USI AP5 relative to seismic events needs to be given attention during the site visit, and Section 3.4.3 of the IPE needs to be reviewed for seismic-related findings.41.A meaningful qualitative discussion of the potential impacts of uncertainty on the seismic IPEEE findings has not been included in the licensee's submittal.

The submittal's treatment of issues related to uncertainty is a significant weakness of the study.42 Sensitivity studies conducted by AEPSC do not adequately resolve significant concerns related to the seismic IPEEE procedures and findings, particularly in demonstrating the robustness of ranking of the dominant risk contributors.

In many instances, licensee responses to NRC questions are inadequate, and further analysis would be needed to satisfactorily resolve the issues raised in those questions.

43.During the site visit, IPE data pertaining to aspects of the seismic IPEEE will need to be reviewed and evaluated.

Particular areas to consider include the use of internal events system modeling to develop a seismic plant model, consistency of assessment of non-seismic failures and human actions, treatment of USI A-45, and other aspects related to seismic issues.D.C.Cook is a USI AM plant.The seismic IPEEE submittal makes reference to GIP procedures implemented in some aspects of seismic walkdowns and in relay chatter evaluation.

Other aspects of USI AP6 resolution should be reviewed in the licensee's USI A-46 submittal.

No particular concerns related to coordination of USI AM and seismic IPEEE evaluations were apparent in the seismic IPEEE submittal.

accident pohcy Energy Research, Inc.ERI/NRC 95-501 A-10 Licensee's seismic IPEEE submittal does not fully satisfy IPEEE objectives and pertaining NUREG-1407 guidelines.

The deficiency in the submittal is not in the overall approach, but rather in a number of specific important evaluation details.These details pertain mostly to methods and results of the fragility evaluations, and their impacts on dominant risk contributors.

In addition, the submittal's description concerning disposition of identified seismic concerns and dominant risk contributors is clearly inadequate and non-responsive to the associated IPEEE objective.

It is judged that a moderate effort on the part of the licensee will be required to revise the seismic IPEEE procedures and submittal to fully satisfy the guidance of NUREG-1407 and resolve severe-concerns.

46.Licensee's general overall IPEEE process in developing findings regarding potential plant improvements identified in seismic wa!kdowns and regarding dominant risk contributors evaluated through risk analysis is well executed.Its suggested treatment of seismic concerns, however, is weak and largely unresponsive to severe-accident policy concerns.In particular, a key objective of Generic Letter 88-20, Supplement 4, is to identify and implement low-cost, effective safety enhancements.

It is judged that the seismic IPEEE submittal does indeed identify a number of areas where significant safety enhancement would be achieved at low cost, yet the submittal suggests that these items will not be implemented.

Examples include: fixing missing/broken anchorages, strengthening the support bracing of a CO, tank to reduce seismically induced fire hazard, repairing fire extinguisher mountings, insuring proper mounting of fluorescent lighting, and implementation of other simple modifications.

Licensee's seismic IPEEE submittal needs to give greater attention to implementation of potential safety enhancements, and provide justification in instances where its evaluation does not support implementation of a potential safety enhancement.

47.The seismic IPEEE submittal does not specifically identify containment-performance concerns and potential opportunities for implementing cost-effective safety enhancements related to accident mitigation.

Given the scope of items involved, it seems reasonable to question this result.Additional review and evaluation during the site visit may help develop a better basis for supporting or refuting this result.48.As described in the seismic IPEEE submittal, considerable effort has been expended by the licensee in involving its staff in the IPEEE process.In addition, the licensee intends to maintain its IPEEE as a living study.This degree of participation is a clear strong point of the licensee's overall I&BEE effort.Energy Research, Inc.A-11 ERI/NRC 95-501

A.2~~The following is the D.C.Cook IPEEE site audit exit report for seismic.Plant D.C.Cook Seismic IPEEE Site Audit Exit Report By Drs.R.T.Sewell and M.V.Frank The seismic audit was undertaken with the objective of determining whether or not the licensee's submittal meets the intent of severe-accident policy and meets the IPEEE guidance provided in NUREG-1407.

The seismic audit of the D.C.Cook IPEEE focused on collection of information, and its evaluation, with respect to the following items: Seismic Walkdowns Seismic Systems Evaluation Seismic Fragility Assessment Disposition of Walkdown Findings/Recommendations 3.1 Plant Walkdowns The audit revealed the plant walkdowns to be well executed and documented.

There appears to have been good communication, generally insuring that all items identified in the walkdowns were treated in the seismic fragility assessment and/or tracked for subsequent disposition.

3.2 Plant Modeling and Analysis The systems event tree/fault tree methodology followed standard practice.However, both inadvertent modeling errors and simplifying assumptions have led to a model that does not have sufficient resolution to provide a robust determination of specific risk contributors.

The assumptions also have the effect of providing a very conservative estimate of core damage frequency.

Indeed, the assessment leads a reviewer to conclude that the plant has essentially no seismic margin to resist earthquakes more severe than the DBE.The fragility analysis introduces excessive conservatisms, which is a major factor in the evaluation of low-to-no seismic margin.This is an artificial result;whereas the IPEEE submittal suggests (roughly)plant-level median and HCLPF capacities, respectively, of about 0.3g and 0.2g, it is'xpected that the plant has a significantly greater seismic capabili:y.

Despite the IPEEE result, however, a low seismic core damage risk is still suggested for Cook.Energy Research, Inc.A-12 ERI/NRC 95-501

The major problem with the fragility analysis is that it does not properly represent realistic insights, particularly the list and ranking of dominant risk contributors for D.C.Cook.Other problems in plant modeling and analysis include: Assumptions suggesting that 4160 V, 600 V, and 250 V electric power systems each fail entirely if any component in the fragility list of pertinent components fails.CCW system was not correctly modeled, and therefore, erroneously was not part of the dominant contributor list.Assessed auxiliary building and screenhouse conditional failure probabilities were too high, and masked individual component failure probabilities.

~Assessed electrical power system failure probabilities may also be too high, possibly masking the risk contribution coming from mechanical components.

A final point is that a condition with a weak pedestal support on a CCW heat exchanger appears to be overlooked in the IPEEE submittal, although this condition may control the failure probability of the CCW system and may be a likely significant risk contributor.

3.3 Personnel Interviews

~~~Personnel were highly cooperative in assisting with the audit.Interviews were conducted with AEPSC personnel, Westinghouse personnel, and EQE personnel, plus plant operators.

They were all very helpful and willing to help.3.4 Disposition of IPEEE Findings Plant audit walkdown looked at plant conditions relative to recommended fixes from the IPEEE seismic-walkdowns.

In many instances, the recommended fixes had not been implemented (only two fixes were verified).

AEPSC's process for disposition of the recommended fixes was reviewed;however, the bases for rejecting recommended fixes were not clear because independent calculations that were made were unavailable.

4 I 4.1 Evaluation of Strengths and Weaknesses The major strengths of the study include the following:

1.Licensee expended significant effort with respect to the depth and breadth of the study.2.The overall methodology for conducting the IPEEE appears fully adequate, and represents sound practice, as far as IPEEE is concerned.

3.Energy Research, Inc.A-13 A particular strength of the study was a well-executed plant walkdown.EM/NRC 95-501 J'

Qa The significant weaknesses of the study include: Fragility method is inaccurate, calculations are over-conservative, and the overall analysis is flawed such that the dominant risk contributors may have not been identified.

2.Systems analysis made significant simplifying assumptions and omissions, masking dominant risk contributors.

The net effect of (1)and (2)is that the calculated result of plant capacity artificially suggests that there exists no seismic margin (i.e., capacity in excess of the DBE)at D.C.Cook.4 The intent of Generic Letter 88-20 is not met because the IPEEE has not revealed the dominant risk contributors, thus leading to erroneous appreciation of severe-accident behavior, including understandings and insights related to expected plant response in an earthquake.

Concerning the fragility calculations/analyses, removing simplifiications and correcting omissions will alter calculated risk contributors and core damage frequency.

5.The interaction plans between USI AM and the IPEEE were reviewed.The licensee has agreed to insure that USI A-46 findings are passed to IPEEE for evaluation of potential impacts.IPEEE findings have already been passed to USI A-46.(Note: It is not clear that this passing of information will necessarily insure that impacts of USI A-46 findings on IPEEE fragility assessments will be incorporated.)

Energy Research, Inc.A-14 EJU/NRC 95-501

cV APPENDIX B:~~B.1

SUMMARY

OF FIRE REVIEW FINDINGS The fire analysis part of the D.C.Cook IPEEE was reviewed using the questions and topics provided in Section 4 of the IPEEE Review Guidance Document[12].The notes obtained in performance of that review are provided below.Review the summary report, assembled documentation and reports, to ascertain that sufhcient information is provided for the reviewer to form an understanding of the salient features of the power plant, and the informanon cited in the summary report is properly supported.

The following documents were available for review prior to the site audit: Donald C.Cook Nuclear Power Units 1 and 2, Independent Plant Evaluation, External Events, Summary Report, American Electric Power Service Corporation, April 1992.Attachment to the letter dated July 22, 1993 from E.E.Fitzpatrick, Vice President of Indiana Michigan Power, to T.E.Murley of U.S.Nuclear Regulatory Commission, Reference Number AEP:NRC:1082G."Safe Shutdown Capability Assessment, Propose Modifications and Evaluations

-10 CFR 50, Appendix R,Section III.G," Donald C.Cook Nuclear Plant Units 1 and 2,'ndiana&Michigan Electric Company, American Electric Power Service Corporation, Revision 1, December 1986.Much information is cited in the Summary Report[1], but very few items had been substantiated by reference documents or supporting information.

On page 1-1 of the Summary Report, the licensee states"AEPSC has retained all supporting analyses, descriptions and files pertaining to the IPEEE." It would have been helpful in planning the site visit if a list of these supporting descriptions and files were provided in the IPEEE submittal.

The following information were made available during the site audit:~"Fire Risk Analysis," D.C.Cook PRA Volume 11, April 1992, Rev.0.~Memo from J.M.McNanie to DC-N-6280<, COMPBRN input/outputs attached to the memo, February 28, 1992.FHA drawings in D.C.Cook Fire Hazard Analysis, January 31, 1992, Rev.6.Calculation sheets and other supporting documents for fire frequency evaluation for each fire zone.(These were part of the fire risk analysis document.)

COMPBRN inputs and outputs (memo by J.M.McNanie).ERI/NRC 95-501 V , A description of the fire-induced initiating event analysis (e.g., reactor trip, transients and LOCAs)(included in the fire risk analysis report).Energy Research, Inc.B-1

'4~I' Sample cable routing information (which was reviewed during site visit).Information on the model used for fire-induced core damage (i.e., the IPE/PRA core damage model).Based on the comments generated by this review team on Revision 0 of the fire risk analysis (Reference 10), the licensee revised the analysis and then submitted the following documents:

Letter from E.E.Fitzpatrick of AEP to U.S.Nuclear Regulatory Commission, February 15, 1995.Attachment 1 to the above referenced letter,"Response to NRC Audit Concerns and Request for Additional Information.""Donald C.Cook Nuclear Plant Units 1 and 2, Fire Analysis Notebook," Revision 1, February 1995.The information provided in the above referenced documents was used to generate the following comments.Note the overall methodology that has been employed (i.e., whether the methodology is FIVE, PRA or a combinanon of the two).Level 1 PRA methodology is employed to conduct the fire IPEEE analysis.The licensee claims that this was done according to NUREG-1407.

It is also claimed that"the fire analysis for the IPEEE utilized the internal events Level 2 PRA to identify containment performance issues." It has been assumed that a fire at any zone would lead to at least a reactor trip.A'n exhaustive analysis of the initiating events has been presented in the fire risk analysis report that has concluded that LOCA'other than RCP seal failure from loss of CCW)and loss of offsite power are not possible to occur as a result of a fire at D.C.Cook.The D.C.Cook IPEEE used a common PRA based approach in which a screening assessment.

eliminates all but a relatively few fire areas.A detailed event tree and fault tree analysis, with these models coming from the IPE, is used to assess core melt frequency Rom local or'global fires within the areas that survive thescreening.

Severalfireareassurvivedthescreeningprocess.

Detailed PRA methods wereused, which postulated complete unavailability of all components in an area, determined the initiating event(s)caused by the unavailability, modified the fault trees of each of the relevant IPE event trees, and quantified a core damage frequency.

2.Review the equipment and associated cables selected for fire damage assessment.

Reviewer should ascertain that: addres Energy Research, Inc.B-2 ERI/NRC 95-501 The list coincides completely with the equipment used in the model.&e model can be either the IPE fault trees and event trees or the safe shutdown list (e.g., those used in the Appendix R submittal).

Such passive equipment as pipes and check valves may not be sed in the review.

J This issue is mentioned in Sections 3.1.1, 4.1 (assumption 2)and 4.3, which state that IPE and safe shutdown equipment and cables (i.e., Appendix R equipment) are included in the fire zone screening process.The safe shutdown (per Appendix R definition) equipment and cables were used.Furthermore, the list of equipment used for fire impact modeling included motor control centers (MCCs)and valve control centers (VCCs)which are typically not explicitly modeled in PRAs.The list includes electrical cabinets and buses of the electric power distribunon system modeled in the IPE or internal events PRA, and associated control circuit cabinets.Per site visit observations, it can be concluded that electrical cabinets have been modeled.The list includes equipment and cables that are associated with containment performance.

The effect of fire on containment performance is analyzed qualitatively (Section 4-9 of Reference 11)using analogies to the internal events Level 2 PRA.3.Review the initiaring events and fire impact model.Ascertain that all possible iniriating events (e.g., reactor trip, transients and LOCAs)have been idenrified, and those identified can indeed be caused by a fire.An exhaustive analysis of the possibility of occurrence of the initiating events from a fire has been conducted.

To establish the frequencies of the initiating events for some of the fire zones, event tree type of models have been used in Reference 11 to account for partial failure from a fire event (Figures 1 through 10 of Reference 11).There are some calculational discrepancies in these event trees that have not been explained in the text.For example, in Figure 1 the frequencies of the bottom two sequences should be 1.1E-07 and 1.1E-09, whereas 1E-08 and 1E-10 are shown on the figure.Similar error is noted in almost all of the figures.More specifically, ascertain that the Reactor Coolant System and Power Conversion System boundaries have been analyzed for the possibility of loss of integrity from a fire.Reference 11 does not address the possibility of a fire affecting high and low pressure interface failure from a fire event.That is, the occurrence of a LOCA from inadvertent opening of isolation valves has not been considered in this IPEEE.However, on page 4 of the Licensee Response to NRC Questions[2]this issue has been raised, and it is concluded that"within a reasonable probability" such an event is not possible.Generally, such events are very unlikely to occur.The possibility of transients is properly accounted for.Reactor trip is assumed for all fire zones/areas, and the transient event tree with the Power Conversion System available is used to model the fire impact.The discussions regarding loss of ESW in the fire risk analysis report do not address the open passage between the two ESW pumps, and the lack of barriers between the two trains of ESW MCCs.Energy Research, Inc.B-3 ERI/NRC 95-501 lg t Loss of 250 VDC power is explicitly addressed.

One of the significant scenarios is later found to include this initiating event.The possibiliries of Reactor Coolant Pump seal failure and transient-induced LOCAs are analyzed.The possibility of RCP seal failure is addressed in Reference 11, as part of CCW failure occurrence.

The fi re impact model (i.e., the internal events core damage and containment failure model modrfred for+re analysis)is reasonable.

The IPE model is used for cor'e damage assessment.

Use of such a model is proper and reasonable.

The initiating event frequencies, and associated system unavailabilities, have been modified to reflect fire induced failures.Review the ftre zonelarea definitions.

Select a sample Pom the fire zones (e.g., the control room, cable spreading areas, pump rooms, and cable vaults)and study them based on the licensee's Fire Hazard Analysis, Appendix R and walk-down notes to see whether proper artenrion is paid to idenrifying the boundaries of the pire zonelarea and potennal propagarion paths among the zones and areas.Fire zone/area definitions are based on the fire hazard analysis done as part of the D.C.Cook Appendix R submittal.

It is not clear if the licensee has considered mechanisms other than fire affecting a barrier.For example, in some special cases the door to the affected area may be opened by the fire brigade to gain access to the fire.In such a case the barrier would be breached, and additional fire zones may be exposed to a fire.During the site visit the areas visited included the control room, the cable vault, 4 kV switchgear rooms, fire zones 45, 46A, 44S, 44N, 60, 29A, 29B, 29E, 29F, 17D, 17E, 17F, 17G, and 17A, and LSI locations in the auxiliary building.For several fire zones, the boundaries w'ere compared with those presented in the FHA fire zone drawings.No deficiencies were identified.

The following addirional quesrions may also be considered by the reviewer: Is the fire zonelarea selection identical to that used in the Appendix R submittal?

If not, what are the differences, and has rhe licensee selected the ftre zoneslareas reasonably?

The licensee has used the Appendix R information and Fire Hazard Analysis (FHA)for selecting fire zones/areas, and has used those reports and a walk through for combustible loading, cable pathways, and associated component connections for each fire zone/area (assumption 10, in Section 4.1 of Reference 11).Are acrive fire prorecrion features used for ftre zone jarea dejinirion?

If yes, has the.failure probabiliry of the ftre prorecrion feature been considered during fire zone screening?

Active fire production systems have been used for defining the boundaries of several fire zones.The following areas have such characteristics:

Energy Research, Inc.BP ERI/NRC 95-501 Between fire zones 45 and 46A (41 and 42A for Unit 1)there is a roll-up door that is normally kept open.Fire zone 29A and 29B are connected with an open doorway.Fire zone 17A has fire dampers that open into the turbine building (fiire zone 60).In all cases, the isolation devices close automatically upon fire detection.

However, the fire risk analysis does not address the possibility of failure for these isolation devices (assumption.9 in Section 4.1 of Reference 11).Has the entire plant been mapped by fire zones and areas?If not, is there documentarion to support the reasons for excluding these areas?All areas of the plant that contain equipment or cables that are associated with safe shutdown or the PRA event tree models, have been mapped properly into fire zones.5.Review equipment and cable locarions.

Select a sample offire zones (at least three diferent zones)and ascertain that the list of equipment and cables are properly used and tabulated, and thus there are no inconsistencies.

Panicular attention should be paid to the equipment and cables which are incorporated into the plant IPE model.During the site visit, the fire audit team reviewed"Safe Shut Down System Analysis" Volumes I, II and IH.These provide several cross tabulations of components, associated cables, fire areas and fire zones.6.Review the fire screening methodology and consider the following questions:

Is the methodology reasonable and conservarive, and does it cover all possible condirions that may arise in afire situation?

A screening methodology has been used for identifying the risk significant fire zones.The methodology includes several tiers of screening.

In the initial tier, the fire zones that do not contain any safe shutdown equipment or cables are eliminated from further analysis.As part of the initial step, the containment fire zones are also eliminated without further analysis, based on the argument that other fire PRAs have not shown any risk significant containment fire scenarios.

This conclusion is most likely to be correct.However, there is a slight possibility that the layout of Cook'containment is different from the average PWR, and may include a unique potential concern.After the initial screening based on zones with no safe shutdown equipment, a second screening was conducted by assuming that a fire made all the equipment in the affected room unavailable.

Zones were screened out if the calculated core damage frequency was less than 10'/yr.The PRA event tree and fault trees were used for this screening.

The PRA event t'ree is the Level 1 tree for a transient with the Power Conversion System available.

Is the method for assigning fire occurrence frequency for each room conservative?

Energy Research, Inc.B-5 ERI/NRC 95-501

The fire frequency for each fire zone is conservative.

A thorough analysis of fire initiation frequency has been conducted by partitioning fire occurrence data among those fire zones where similar fires could occur.For areas where a fire event could not be assigned, a frequency of 1.0E-03 per year has been assigned.Isit assumed that in the first tier of screening, all equipment and cables fail in the worst possible manner?In the screening stages it is assumed that the equipment and cables fail immediately.

No information is provided as to whether there are equipment that may fail in more than one mode, and whether the analysts have identified the worst failure mode, and assumed that mode for screening purposes.Is core damage frequency used as the screening measure?If not, idenrify the method used for screening and determine ifit is reasonable.

The first screening is based on presence of safe shutdown equipment (this in effect deals with core damage, but does not explicitly verify the possibility of occurrence of core damage).In the second tier of screening, core damage frequency is used for screening.

Is the threshold core damage frequency for screening sugctently small to avoid discarding fire scenarios that when added together may significantly increase the core damage frequency?

The threshold fire-induced core damage frequency is set at 10'er year.Table 12 of Reference 11 lists the CDF for all fire zones that survived the first screening test.From this list it is seen that many of the CDF are sufficiently small, such that their cumulative effect on total fire CDF is minimal.Are the equipment and cables that contribute to the containment failure mode included in the screening process?If not, are these equipment and cables treated properly?Section 4.7 of the Summary Report and Section 4.9 of Reference 11 address containment performance.

Containment related equipment (e.g., containment isolation valves or containment cooling fans)were not included in the fire impact model.7.Review the fire occurrence frequencies.

Review the overall methodology for estimaring the fire frequency for each zone.The following questions may be considered:

Is the overall model for fire frequency based on generic categories of fire areas?If not, does the model properly urilize the overall industry experience?

The IPEEE has used the approach of many existing PRAs, where the fire frequency is estimated for generic categories of fire areas (building types).The plant specific fire area frequencies are developed by rationing the fire frequency among different fire zones of a building, according to the fire history of the specific area using industry-wide fire occurrence data.Thus, for areas where a fire has occurred in the industry, a fraction of the fire incidence data is assigned according to the characteristics nf the area.For areas where no fire incidence history exists, a fire frequency of 0.001 per year has been used.Energy Research, Inc.B-6 ERI/NRC 95-501 I

In applying the Sandia fire frequency database to the D.C.Cook analysis, the fire incidents from the five generic categories given in the database were allocated to the six D.C.Cook general zones.In one cas=, this allocation can be nonconservative.

In Section 4.4.1 of Reference 11, it is stated that all reactor building experience from the Sandia database was allocated to the D.C.Cook containment.

It is not clear how reactor building fires are interpreted.

Reactor building fire experience is largely from BWRs.BWR reactor buildings have equipment that is found in PWR auxiliary buildings.

Thus, a certain fraction of reactor building fire experience should have been allocated to the D.C.Cook auxiliary building.Subsequently, in the D.C.Cook analysis, all containment locations were screened out on essentially the same basis as in the FIVE methodology.

This, in effect, removes relevant fire data from the analysis.Is the generic fire occurrence data Pom a credible and accepted source (e.g., NUREGICR-4586 or Table 1.2 of the FIVE report)?The D.C.Cook IPEEE used a credible source of generic fire frequency data, i.e., the Sandia fire database as represented in NUREG/CR-4586 and the associated FIREDATA computer program.Have shutdown Pres been included in the power operation fire occurrence data base?In the Licensee Response to the NRC Questions[2]and,in Section 4.4.1 of Reference 11, it is mentioned that the Sandia fire data has been screened for hot and cold shutdown fires that could occur during power operation.

Have plant-speci Jt c fire occurrence data been used for evaluating the fire frequencies?

No plant-specific fire data was used.It was claimed that including the one applicable plant-specific fire would not change any results.Is the fire frequency of each fire zonelarea obtained from panitioning the fire frequency of a collection of zones and areas?If not, is the total fire frequency for the plant consistent with the industry experience?

The fire frequency was obtained from partitioning the building fire frequency to specific zones.Rationing by area has a fundamental pitfall.It begs the question of how fine the original fiie area database can be divided up into pieces.If small enough areas are considered, it can always be shown that the product of the area ratio and the fire area frequency is less than whatever screening criteria (e.g., 10'er year)is chosen.No such abuse of the methodology has been noted in the D.C.Cook IPEEE.Furthermore, the licensee has assigned a standard 1.0E-03/year frequency to all those areas where a historical fire could not be assigned to.This practice should lead to a conservative total frequency of fire for a'given building or general fire area.If a building fire frequency is panirioned for obtaining the fire frequency of specific zoneslareas, is it.done based on flammablelcombusrible materials loading, ignirion sources nndlor transient fuel loading?The allocation of the general zone fire frequencies to specific areas was based on historical fire events for the specific area.The licensee has redone this part of the analysis since its initial submittal of the IPEEE.Energy Research, Inc.B-7 ERI/NRC 95-501 8.Sum the core damage frequencies conservarively assigned to the screened out fire zones and areas.Does this sum represent a s.'gnificant fraction of the total IPE core damage frequency?

Is the core~damage frequency properly us d for fire outlier identification?

As a result of the interviews during the site visit and a review of the initial fire risk analysis report, it was concluded that fire core damage frequency was underestimated significantly.

The current fire risk analysis (i.e., Reference 11)is based on more reasonable assumptions and analysis than the initial study, and therefore the results are considered credible for identifying meaningful plant improvements.

The sum of fire scenario CDFs given in Table 12 of Reference 11, that are screened out, is 3.0E-06 per year.TMs is about the same as the total CDF based on the final list of significant fire scenarios.

It can be argued that if the screened out scenarios were analyzed further, the total screened out CDF may end up being significantly smaller than that given above.Has the control room been screened out?Review the method to ascertain that proper considerarion has been given to control circuit failures and operator acrions during an accident sequence.Have the possibilities of equipment failure and inadvertent operanon been considered?

Has the procedure for control room fire suppression been considered?

Have the procedures for retrearing from the control room been analyzed?The initial fire risk an'alysis screened out the control room by taking credit for the other unit's (Unit 2)Auxiliary Feedwater System (AFWS).The revised fire risk analysis (Reference 11)follows the example of the Seabrook PRA, where three fire damage scenarios are postulated.

The analysis for D.C.Cook (Section 4.8.17 of Reference 11)does not indicate whether the analysts have reviewed the control panel layout of the control room to ascertain that no other component/equipment groupings are possible.From the statements made in that section, it is concluded that the control panel layout of D.C.Cook (i.e., location of different control switches, indicators, controllers and other devices)is very similar to that of the Seabrook control room.From the discussions provided in Section 4.8.17, it can be inferred that the analysts have indeed looked into the layout of the control panel, and determined such factors as the conditional frequency of damage at a certain point, given a fire event in the control room.The analysts have used probability values for control room evacuation and human error.10.Have cable spreading areas been screened out?Review the method to ascertain that proper considerarion has been given to control circuit failures and operator acnons during an accident sequence.Have the possibiliries of equipment failure and inadvertent operarion been considered?

Has the damage associated with fire suppression activities been considered?

Has the site review, the walk-down, and the analysis considered redundant train co-location?

Similar to the control room, the initial study had written these rooms off as risk insignificant.

There are several areas at D.C.Cook that have the characteristics of a typical cable spreading room.These areas have been analyzed explicitly in the revised fire risk analysis report (Reference 11).The equipment failure and event sequence analysis is taken to be similar to that of the control room.However, the frequency of fire occurrence is taken to be 1.3E-05 per year.This frequency is quite lower than that Energy Research, Inc.B-8 ERI/NRC 95-501 used for other areas of the plant for which historical fire data do not exist.For those areas, the analysts have used 1.0E-03 per year.The analysts have not made an analysis of the layout of the cables in the cable vaults, and have assumed that the area ratios used for control room fire scenarios are applicable to this area.The basis of this argument is weak.It is quite possible that the same ratio may be applicable.

It is not clear whether there could be other areas within the vaults where several opposite train cables come together in one small area.Il.What assumptions have been made with regard to the failure or egecriveness of fire barriers?In the initial study, a COMPBRN analysis is mentioned for checking the effectiveness of the barriers.However, the following issues have not been addressed in that analysis, and they are applicable to the revised analysis as well: Possibility of barrier failure due to fire fighting activities (e.g., door opened to access another room).Possibility of fire wrapping failure from open bolt ends (observed in area 6N).Possibility of fire damper or fire door failure to close automatically.

12.Has the failure of the Auxiliary Shutdown Panel (or its equivalent) been considered in terms of smoke ingress from the fire, the operator's path to approach the panel, the procedure that initiates the transfer, and the possibility of confusion between tw0 operators (i.e., operators working simultaneously from two diferent locations, e.g., the control room, the control circuit isolation cabinet and the auxiliary panel)?The equivalent of the Auxiliary Shutdown Panel at D.C.Cook is referred to as the Local Shutdown Indicator (LSI)panels.It is a collection of 6 local panels in the auxiliary building that contain various key control and instrumentation functions.

The LSI has been considered, but not modeled explicitly.

The control room and cable vault analyses in the revised fire risk analysis report computes CDFs without modeling usage of LSI.This simplifies the analysis and does not diminish the results.13.Have the fire fighting practices been reviewed as part of the IPEEE to ascertain that in no cases would the pire fighting effortjeopardize the separarion between redundant trains?Will ftghring the fire or gemng to the fire cause fire barriers to be opened or breached?The revised fire risk analysis (Reference 11)does not explicitly model the effects of fire detection and suppression systems on the CDF.In the case of some of the fire scenarios (e.g., control room and cable vault), the effects of fire protection systems is included implicitly.

The licensee, however, in its IPEEE submittal has discussed an assumption that 10 minutes is a representative manual suppression time for all locations, and has assigned a probability of 0.5 for failure to suppress a fire manually.This may be realistic for some zones, conservative for some others, and non-conservative for the rest.The net affect on the risk assessment is hard to estimate without proper consideration as to the fire set-up of each zone with respect to the fire brigade's training, location, type of manual fire fighting equipment, etc.The FIVE methodology recommends, however, zone specific manual suppression times based on fire drill data.If Energy Research, Inc.B-9 ERI/NRC 95-501

~~, I a single average suppression time is used for all locations, a sensitivity study should be performed on the effect of realistic variations on this time.The licensee has conducted an extensive analysis of the adverse effects of fire suppression activities on safe shutdown components.

14.Select atleast two fibre zonesiareas that have been analyzed in detail and conduct a thorough review of the analysis.Has the fire zone/area been subdivided iruo smaller areas?Is the subdivision based on equipment and cable distriburion in the fire zoneiarea?

In the case of control room fire analysis, the area has been subdivided into smaller areas, where CCW and ESW systems can be affected.In the case of Fire Zone 6N, the area is effectively divided into smaller areas.The analysts have focused-only on one area where CCW failure is possible.No other areas of this fire zone are found to be risk significant.

However, the analysts have elected not to use area ratios to adjust the frequency of fire initiation for CCW damage.15.Has fire propagation analysis been performed?

For pire propagarion analysis (e.g., using COMPBRN, FSM, or.other methodology) review the following:

If COMPBRNis used, which version of the program has been employed?COMPBRN IIIe has been used for fire propagation analysis.In the initial fire risk analysis, and in the revised version, several references are made as to the use of this code for verifying the propagation characteristics of a fire in a compartment.

Is the model representative of the condirions of the fire zonelarea?

During the site visit, sample cases of COMPBRN models were examined, and the fire propagation analysis was found to be properly done.Is the selecrion of pilot fire reasonable?

From the information provided in the submittal and initial fire risk assessment, it has been concluded that the licensee used the same pilot fire for all fire propagation cases, and based on that selection, they were able to conclude that for several locations propagation was not possible.The pilot fire described on page 9 of the Licensee Response to NRC Questions[2]is 1mm deep.The burning duration of such a fuel is rather small, and therefore, there would be insufficient time to heat up target cables and equipment to the damage or ignition point.Assuming a pilot fire with a smaller burning surface but larger depth than that described on page 9 may lead to a different conclusion.

In general, it is not good practice to use only one pilot fire size.As a practical matter, a variety of pilot fire sizes are plausible, each with its own probability of occurrence.

Thus, a correct methodology would be to perform the calculations probabilistically over a range of pilot fire sizes.It is quite possible that the Energy Research, Inc.B-10 ERI/NRC 95-501 F minimum pilot fire size that would lead to propagation is unrealistically large.This should be expre'ssed probabilistically, or included in the sensitivity analysis.Are the physical characteristics (i.e., materials of construcrion, melting point, chemical composirion, combusrion heat, etc.)and damage thresholds for cables and other ftre susceptible items reasonable?

Has the licensee provided the basis for selecring cable material characterisrics?

These issues were not audited.How are the results usedin the analysis?Is the nme to damage a crirical set of equipment and cables the obj ecnve of the analysis?The time to damage has been the main objective of the analysis.Have several pilot Pres been used to establish the minimum-pilot size needed to inflict damage to the critical set of equipment and cables?Only in one case several pilot fires were used.Generally, only one pilot fire has been used.This was further discussed above.Are the results of the detailed jire analysis reasonable?

Although, the following comments may not be valid for the revised fire risk analysis, several statements in the submitted documents need to be reviewed here.On page 10.of the Licensee Response to NRC Questions, regarding Zone 41, it is mentioned that cable trays are not vulnerable to fire-induced damage.This is contrary to general opinion of fire susceptibility.

Furthermore, on page 11, it is indicated that it is assumed that cables in closed cable trays and conduits are not susceptible to fire.This assumption needs to be substantiated, since the cables may fail without burning.On page 22, it is indicated that no quantification was performed for the cable enclosure beneath the mezzanine area (Zone 41-3).However, certain cable fires that are not modeled properly in this IPEEE may occur and propagate inside the vault.On page 23, for Zone 44N, three corners of the zone are addressed, but the southwest corner is not mentioned in the discussions.

The revised fire risk analysis (Reference ll)has not been audited in detail.However, based on the information provided in that document, it is inferred that the above comments may no longer be valid.16.How haveflre suppression considerations been included in the model.The revised fire risk analysis (Reference 11)does not provide explicit models for the effectiveness of the fire suppressions systems.What are the salient features of the model?ERI/NRC 95-501 The models reviewed as part of the submittals prior to the revised risk analysis had numerous important deficiencies which were mentioned to the licensee during the site visit.Review of those models at this point is deemed to be'immaterial.

\Energy Research, Inc.B-11 J

Is the timing for detecting and suppressing a pire quantified explicitly?

In the submittals, other than the revised risk analysis, one representative time is used for all cases.This is further discussed in the response to the previous question.Is the availability of the suppression system included in the model?In the submittals, other than the revised risk analysis, the unavailability of the suppression systems have been included in the analysis.Are plant specific data and features used for esrimaring the availability of the suppression system?In the submittals, other than the revised risk analysis, generic unavailability values have been used for the suppression system.'owever, for manual fire fighting, plant specific information has influenced the estimation of the time to suppress the fire.Has the possibility of eq'uipment failure from flre suppression activities been considered and modeled.'detailed account of the methodology for analyzing the damaging effects of fire suppression activities has been provided on pages 12 through 14 of the Licensee Response to NRC Questions[2].The revised fire risk analysis discusses this issue in a short paragraph in Section 5.3.17.Have the results of the walk down been appropriately factored into the rest of the analysis?Has the walk-down verifie the assumprions made about fire protection features, flre barriers, key ignition sources, and the height of targets above the pilot pire?The Summary Report indicates that at least two walk-downs were conducted, and special checklists were employed for this purpose.In the second walk-down, the measurements needed for COMPBRN analysis were taken.In the Licensee Response to NRC Questions (page 6), it is indicated that only Unit 1 has been reviewed in detail.A Unit 2 walk-down has been conducted to verify the similarities between the two units.The revised fire risk analysis refers to additional walkthroughs conducted after the audit team's site visit.In these walkthroughs, risk significant areas have been reviewed in detail.18.Have the IPE or PRA event trees and fault trees been modifie to modelflire scenarios?

Have the proper event treelfault tree models been employed for the speciflcflre scenarios that are analyzed in detail?Has the correctiniriating event been selected?Have probabiliries of equipment damage been altered to reflect flre condirions?

What is the basis for the condirional probability of equipment damage from aflre?The Summary Report[1]mentions that the PRA model has been modified to address the impact of fire on equipment and cables.However, the logic model was not modified.Truncated versions of core damage sequences were used with fire frequencies appropriately used for initiating events, and system unavailabilities modified per affected cables and equipment list.The truncated model was suspected to Energy Research, Inc: B-12 ERI/NRC 95-501 yield optimistic results when fire-induced core damage is considered.

This was mentioned to the licensee during the site visit.From the revised fire risk analysis report[11], it can be inferred that the IPE models have been used for CDF estimation.

The conditional failure probabilities and initiating event frequencies have been altered to reflect the effects of a given fire.19.Has the core damage frequency been esrimated for each frre scenario?As part of the screening process, the core damage frequency has been estimated for all fire zones and areas that survived the first round of screening.

20.Is the core damage frequency obtained in Step 8 a large fraction of the total fire-induced core damage frequency?

As mentioned previously, the total CDF of screened out fire zones (from Table 12 of Reference 11)is found to be almost the same as the total CDF of risk significant fire scenarios.

However, further analysis of these scenarios may lead to a considerably smaller total screened out CDF.21.What are the criteria for identifying vulnerabilities?

Have the criteria been employed properly?None of the documents have included a discussion of the criterion for establishing a fire vulnerability.

22.Have uncertainries been addressed in the fire analysis?Have the uncertainnes influenced rhe vulnerabi.i'ty assessment issues?Section 5.7 of Reference 11 addresses the issue of uncertainties by simply mentioning the parameters of fire risk analysis that entail uncertainties.

None of the documents available to the reviewers contains an explicit discussion of the uncertainties in the analysis and in the results.Reference 11, however, does include a discussion in Section 6.0 on areas of conservatism.

The list includes such issues as the lack of including the effects of fire detection and suppression systems in the analysis, and the protection afforded by fire retardant insulations and shields.23.Have the Sandia Scoping Study issues (NUREGICR 5088)been addressed explicitly (e.g., Attachment 10.5 to the FIVE Report)?If yes, have rhe issues been addressed completely and properly?The Sandia Scoping Study issues have been addressed explicitly in Section 5 of the revised fire risk analysis.The safe shutdown panel is not independent of the control room.However, Local Shutdown Indication (LSI)panels can be used to respond to a control room or cable vault fire.With respect to seismically induced fires, the Summary Report does not address these in Section 4.8.However, in the Licensee Response to NRC Questions (page 8), it is stated that cabinet movement, tank movement, and pump leakage is not a problem for the design basis earthquake.

In Section 5.8 of the Energy Research, Inc.B-13 ERI/NRC 95-501

revised fire risk analysis, the seismic and fire interaction is discussed in terms of CO, tank fragility.

It is concluded that fire suppression may be hampered because of seismic activity.\24.Has the decay heat removal issue of USI A-45 been addressed?

If yes, has the issue been addressed completely and properly?USI A-45 has been addressed by the licensee in the Summary Report[1].No information is provided except for a reference to the IPE report.Energy Research, Inc.B-14 ERI/NRC 95-501

g B.2 0 The following is the D.C.Cook IPEEE site audit exit report for fires.D.C.Cook IPEEE Site Visit General Conclusions on Fire Issues By Dr.M.Kazarians 1.Licensee has expended significant effort in conducting the fire analysis.2.The overall methodology and data, with the exception of some cases that have been identified, are proper.3.Licensee has been exceptionally cooperative, helpful, and open about how IPEEE was conducted, where the data came from, and in guiding the review team through the plant.0 1.There are several calculations that cannot be explained from the available information, and seem to be inaccurate.

2.The specific assumption made regarding fire suppression failure, the evaluation of fire frequencies, and the corresponding initiating event frequencies, do not reflect the state-of-the-art, and in some cases are optimistic.

Fire propagation between fire zones is not adequately considered.

4.If the above-mentioned weaknesses are rectified properly, the ranking of major contributors to core damage will certainly change.Especially, there will be more fire zones requiring detailed quantification.

Licensee does not provide a definition for"vulnerability".

1.Revisit the fire frequency evaluation and use a partitioning method that includes ignition sources, personnel traffic, and other zone occupancy characteristics.

2.Revisit all core damage computations to assure that the conditional frequencies are computed accurately.

Energy Research, Inc.B-15 ERI/NRC 95-501 Qi 3.Postpone consideration of the use of suppression systems failure until the relative location of, cables and other critical equipment are identified within each zone to assure that a small fire cannot damage the cables and equipm;nt of interest.'.Analyze control room and cable vault (all 3 vaults)fires as special causes, and incorporate in the analysis the use of LSI.Special attention should be given to smoke propagation.

Review the analysis for those fire zones that have normally open fire dampers or doors, and properly model the possibility that damper/door failure can lead to a multi-zone fire scenario.Also, look into fire barrier failure from exposed bolts penetrating the barrier.Include plant-speciifiic data on deficient barrier penetration seals.Review the local fire protection features carefully for those zones that detailed quantification will be done to assure that special weaknesses (e.g., distance between sprinkler heads and ceiling)are taken into account.Review specific system analyses to assure applicability to fire conditions (e.g., Auxiliary Feedwater system availability).

Use entire IPE model on a much larger set of cutsets to perform screening calculations.

Correct logic in detection/suppression event tree used in screening analysis.1.Appreciation of severe accident Since almost all fire zones have been screened out, the licensee could not gain an appreciation of what severe accidents could possibly occur.Understand the most likely severe accidents Since there are many errors and optimistic assumptions in the computations for the core damage frequency, it cannot be ascertained that the licensee has gained an understanding of the most likely severe accidents.

3.Qualitative understanding of the overall likelihood of core damage Since many fire zones could be screened out, the licensee has gained an overall understanding of the overall likelihood of core damage.4 Reduce the overall likelihood of core damage Since the overall likelihood was found to be small, no changes/recommendations have been suggested.

Energy Research, Inc.B-16 ERI/NRC 95-501

'<r%i~f