ML17335A168

Final TER on step-2 Review of IPEEE at DC Cook Nuclear Plant,Units 1 & 2, March 1998

ML17335A168
Person / Time
Site:	Cook
Issue date:	03/31/1998
From:	KAZARIANS M, KURITZKY A S, SEWELL R T ENERGY RESEARCH, INC.
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
Shared Package
ML17335A166	List: ML17335A168
References
CON-NRC-04-94-050, CON-NRC-4-94-50 ERI-NRC-95-501, NUDOCS 9808110237
Download: ML17335A168 (137)

Text

ERI/NRC95-501TCCHNICRL CVRLURTION REPORTONTHC"STGP-2"RGVIGNOFTH6INDIVIDURL PLRNTEXRNIINRTION OFEXTERNRLEVENTSRTD.C.COOHNUCLGRRPLRNT,UNITS1RND2FINALREPORTCompleted:

April1995Revised:May1995Final:March1998EnergyResearch, Inc.P.O.Box2034Rockville, Maryland20847-2034 WorkPerformed UndertheAuspicesoftheUnitedStatesNuclearRegulatory Commission OfficeofNuclearRegulatory ResearchWashington, D.C.20555ContractNo.04-94-050 9808ii0237 98080SPDRADQCKOS0003iSPPDR ERI/NRC95-501TECHNICAL EVALUATION REPORTONTHE"STEP-2"REVIEWOFTHEINDIVIDUAL PLANTKGkMINATION OFEXTERNALEVENTSATD.C.COOKNUCLEARPLANT,UNITS1AND2FINALREPORT Completed:

April1995Revised:May1995Final:March1998M.Khatib-Rahbar Principal Investigator Authors:R.T.Sewell',A.S.Kuritzky, M.Kazarians',

M.V.Frank',andR.J.Budnitz'nergy

Research, Inc.P.O.Box2034Rockville, Maryland20847WorkPerformed UnderthcAuspicesoftheUnitedStatesNuclearRegulatory Commission OfficeofNuclearRegulatory ResearchWashington, D.C.20555ContractNo.04-94-050 Presently withEQEInternation'al, 2942EveryeenParkway,Suite302,Ever~n,CO80439Kazarians andAssociates, 425EastColoradoStreet,Suite545,Glendale, CA91205SafetyFactorAssociates, Inc.,1410VancssaCircle,Suite16,Encinitas, CA92024FutureResources Associates, Inc.,2039ShattuckAve.,Suite402,Berkeley, CA94704ENCLOSURE 2

TABLEOFCONTENTSEXECUTIVE SUMMARYV11PREFACEXV1ABBREVIATIONS XV110~~00INTRODUCTION.....

1.1PlantCharacterization 1.2OverviewofLicensee's IPEEEProcessandImportant Insights.1.2.1"Seismic....................

1.2.1.1IPEEEProcessforSeismicEvents....

1.2.1.2SeismicIPEEEInsights............

1.2.1.3SummaryEvaluation ofSubmittal 1.2.2Fire1.3OverviewofAuditProcess1.3.1Seismic...

1.3.2Fire....1.4Pre-SiteVisitActivities 1.4.1Seismic..1.4.2Fire...1.5SiteVisitActivities

.....1.5.1Seismic.1.5.1.1Information Audited..............

1.5.1.2Personnel Interviewed 1.5.1.3AreasWalkedDown.1.5.1.4Treatment ofPrincipal Issues1.5.2Fire..1.5.2.1Information Audited1.5.2.2Personnel Interviewed 1.5.2.3AreasWalkedDown..............

1.5.2.4Treatment ofPrincipal Issues1.6Post-Site VisitActivities 1.6.1Seismic1.6.2Fire..~~~12121213131314141415151616161617171818191......2......2222.~AUDITFINDINGS........2.1Seismic...........

2.1.1Relevance ofIPEEEProcesstoActualPlantandConfiguration........

2.1.2AccidentFrequency Estimates

..2.1.3LogicModels..2.1.4ProcesstoIdentify, Eliminate orReducetheEffectsofVulnerabilities 2.1.5Vulnerabilities Requiring FurtherAnalysis.....................

2.1.5.1Vulnerabilities Affecting AccidentPrevention.........

2.1.5.2Vulnerabilities Affecting Containment Performance.....

202020202020212121EnergyResearch, Inc.ERIJNRC95-501

2.1.6DominantContributors:

Consistency withExternalEventsPRAInsights..212.1.6.1DominantContributors toCoreDamage............

212.1.72.1.6.2DominantContributors toRadioactive ReleasegivenCoreDamageEvaluation ofDecayHeatRemovalVulnerabilities.......

2.1.7.1Evaluation ofProcesstoIdentifyVulnerabilities 2.1.7.2Evaluation ofFindings222222222.1.8Evaluation ofMovableIn-CoreFluxMappingSystemVulnerabilities....

222.1.8.1Evaluation ofProcesstoIdentifyVulnerabilities

...222.22.3Fire2.2.12.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.2.102.2.112.2.122.2.132.2.142.2.152.2.162.2.172.2.182.2.19Generic2.3.12.3.22.3.32.3.42.1.8.2Evaluation ofFindingsDocuments Reviewed....

Compliance withSupplement 4toGenericLetter88-20andNUREG-1Methodology Employed.FireSusceptible Equipment andCables...Fire-Induced Initiating EventsCoreDamageFrequency Model.Containment SystemsModel..FireZone/Area Selection

....Screening ofFireScenarios...

Containment Performance....

FireOccurrence Frequency

..FireVulnerability

..FireProtection MeasuresFireGrowthandDamageAssessment

.DamagingEffectsofFireFighting...Walkdown.......

Uncertainties

.....SandiaFireRiskScopingStudyIssuesUSIAP5SafetyIssues(GSI-147, GSI-148,GSI-156andGSI-172)GSI-147,"Fire-Induced Alternate Shutdown/Control PanelInteraction" GSI-148,"SmokeControlandManualFireFightingEffectiveness"

..GSI-156,"Systematic Evaluation Program(SEP)".....GSI-172,"Multiple SystemResponses Program(MSRP)"~~~~2425252525252626262627272727282828282828293223232340724AUDITCONCLUSIONS ANDRECOMMENDATIONS

..3.1Seismic..........

3.2Fire............

~.3737384:REFERENCES......

40APPENDIXA:SUMMARYOFSEISMICREVIEWFINDINGSA.1Pre-SiteAuditFindings, Questions andConcerns....

A.2SiteAuditFindings, Questions andConcernsA-1A-1...A-12APPENDIXB:EnergyResearch, Inc.SUMMARYOFFIREREVIEWFINDINGS1nB-1ERI/NRC95-501 B.1Pre-SiteAuditFindings, Questions andConcernsB.2SiteAuditFindings, Questions andConcernsB-1B-15Ener~Research, Inc.1VERI/NRC95-501 LISTOFTABLESTable1.1Disposition ofSeismicWalkdownFindings....

EnergyResearch, Inc.ERI/NRC95-501 fi LISTOFFIGURESFigureA.lChecklist rorPre-SiteVisitAudit...FigureA.2Significant Issues,Objectives andConcernstobeAddressed

.A-2A-3FigureA.3Potential RelatedSiteVisitActivities

.FigureA.4Checklist forPost-Site VisitAudit..A-5EnergyResearch, Inc.viERI/NRC95-501 Ir

,EXECUTIVE SUMMARYThisTechnical Evaluation Report(VER)documents theStep-2technical evaluation reviewoftheIndividual PlantExamination ofExternalEvents(IPEEE)submittal fortheDonaldC.CookNuclearPlant,Units1and2.TheStep-2reviewprocessinvolvedthefollowing tasks:Iacompletetechnical reviewofthelicensee's IPEEEsubmittal andlicenseeresponses toStep-1questions andrequestsforadditional information (RAIs);asiteauditofIPEEEdata,analysesandplantcharacteristics; development ofadditional information requests; and~atechnical reviewofthelicenseeresponsetotheadditional information requests.

AmericanElectricPowerServiceCorporation (AEPSC)isthelicenseeofCookNuclearPlant(Cook).AEPSChasmaintained administrative controloverallmajorIPEEEactivities, andhascommitted significant personnel andresources toprojectmanagement, IPEEEinvolvement, andpersonnel training.

Technical oversight oftheIPEEEwasperformed byWestinghouse asprimecontractor toAEPSC-.Westinghouse performed thesystemsmodeling(including development offaulttreeandeventtreelogic),theseismicfragility calculations, andtheoverallprobabilistic riskassessment (PRA)quantification.

Westinghouse wassupported bysub-contractors EQEInternational, Inc.,andPaulC.RizzoAssociates.

EQEwasthemajorparticipant inconducting plantwalkdowns andintrainingAEPSCpersonnel onwalkdownprocedures.

RizzoAssociates performed asite-specific seismichazardanalysis, developed spectral-shape marginandvariability factors,anddeveloped soil-structure-interaction marginandvariability factors.Stevenson

&Associates wasengagedbyAEPSCasanindependent

reviewer, principally ofthecomponent seismicfragility analyses.

TheoriginalCookIPEEEwassubmitted onApril1992.Apre-siteauditreviewandsubsequent siteauditvisit(Jul'y26-28,1994)revealedanumberofproblemsintheoriginalanalyses.

Correspondingly, anumberofquestions andconcernswerebroughttotheattention ofthelicenseeatthesiteauditexitmeeting.Thelicenseeresponded totheseissuesandmadeapresentation ofIPEEE,modifications totheU.S.NuclearRegulatory Commission (NRC)anditscontracted reviewers atameetingheldonOctober25,1994.Remaining concernsofthe'review teamwerepresented tothelicenseeattheconclusion ofthismeeting.Subsequently, thelicenseeresponded totheremaining

concerns, anddeveloped arevisedIPEEEsubmittal forD.C.Cook(datedFebruary15,1995).ThisTERprovidesadiscussion ofissuespertaining totheentirereviewprocess;however,theultimatefindingsandconclusions ofthisreportare.basedupontherevisedD.C.CookIPEEEsubmittal.

I.icensee's IPEEEProcessSeismicgpEnergyResearch, Inc.ERI/NRC95-501viiAEPSChasundertaken anewLevel-1 seismicPRA(SPRA),togetherwithaqualitative containment performance assessment, fortheCookseismicIPEEE.Thisapproachrepresents anacceptable methodolo~,

inaccordance withSection3ofNUREG-1407.

Peakgroundacceleration (PGA)wastheroundmotionarameterusedtocharacterize seismiccapacityandhazard.Theinputspectralshape t

ultimately usedforfragility assessment wasthatofthe10,000-yr medianuniformhazardspectrum(UHS)developed byLawrenceLivermore NationalLaboratory (LLNL)in1989fortheCooksite.TheoriginalseismicIPEEEanalysisdeveloped coredamagefrequency (CDF)estimates bothforRizzoAssociates hazardinputandthe1989LLNLhazardresults.TherevisedIPEEEanalysisevaluated seismicCDFbasedontheRizzoAssociates inputonly.Thelatest(1993)LLNLseismichazardcurveswerenotconsidered ineithertheoriginalortherevisedIPEEE.TheseismicIPEEEprocessinvolvedasignificant plantfamiliarization effort,including extensive seismicwalkdowns.

Thewalkdowns wereconducted inaccordance withEPRISeismicMarginAssessment (SMA)procedures, andthussatisfyNUREG-1407 (Section3.1.1.4)guidelines forSPRAmethodology enhancements.

CookisaUSIA-46plant,andtheplantseismicwalkdowns alsoaddressed USIA-46concerns.

TheIPEEEdocumentation, however,issignificantly independent ofUSIA-46resolution, withtheexception ofIPEEErelayevaluation (whichreliesheavilyontheVSIA-46analysis).

Thelicensee's treatment ofUSIA-46wasnot,therefore, amajorconsideration inthescopeofthepresentreview.ThemajorelementsoftheCookseismicPRAinclude:initiating eventsanalysis, eventtreeanalysis, systemsanalysis, systems-interaction

analysis, seismicfragility

analysis, Level-1riskquantification, andcontainment performance assessment.

Fortheeventtreeandsystems(faulttree)analyses, modelsweretakenfromtheinternaleventsanalysisandmodifiedasnecessary forexternalevents..InadditiontotheseaspectsofSPRAimplementation, theCookIPEEEinvolvedthefollowing elements:

alimitedevaluation ofsoilliquefaction potential; development ofcomponent HCLPFcapacities; andanevaluation of."badactor"relays.Hence,theIPEEEaddresses allSPRAmethodological enhancements asrequested byNUREG-1407 (Section3.1.1.4).

FireThelicenseehasadoptedLevel-1firePRAmethodology forconducting theIPEEE,andhaspreparedafireriskanalysis.

TheCookIPEEEusedacommonPRA-based approachinwhichascreening analysiseliminates allbutarelatively fewfireareas.Adetailedeventtreeandfaulttreeanalysis, withthesemodelscomingfromtheIPE,wasusedtoassessthefireCDFduetolocalorglobalfireswithintheareasthatsurvivedthescreening.

Thelicenseehasprovidedadiscussion ofthecriteriausedtoidentifycriticalfirezonesandareas.Thelicenseehasprovideddiscussions forfireinitiation database,eventtreeandfaulttreemodeling, dominantfire-induced coredamagescenarios, coredamagefrequency, fire-induced containment

failures, andfireriskscopingissues.Thelicenseeanditscontractors conducted twoplantwalkthroughs priortothesubmittal oftheIPEEE.Thesewalkthroughs wereperformed usingastandardchecklist, withcombustible loadingoffirezonesbeingverified, andtheissuesraisedintheSandiaFireRiskScopingStudybeingaddressed.

Intheprocessofthepreparation oftherevisedfireriskanalysis, theanalysisteamrevisited thesiteandconducted additional walkthroughs ofthefirezonesthatwerefoundtoberisksignificant.

EnergyResearch, Inc.viiiERI/NRC95-501

KeyIPEEEFindingsSeismicTheoriginalCookIPEEEsubmittal (datedApril1992)reportedaseismicCDFof1.83x10'erreactor-year(ry)usingasite-specific hazardcurve(RizzoAssociates hazardcurve)and3.07x10/ryusingthe1989LLNLseismichazardresultsdeveloped forD.C.Cook.ArevisedseismicCDFof3.17F10~/ry(usingtheRizzoAssociates hazardcurve)wasobtainedafterrefinements wereimplemented inthefragility calculations andintheseismicintervals usedfornumerical integration.

Therefinements weremadeinresponsetoitemsidentified priorto,andduring,thesiteauditreviewthatwerebelievedtohaveapotential tomaskthedominantriskcontributors.

Basedonareviewoftherevisedfragility calculations, itisjudgedthattherevisedseismicCDFisamorerealistic estimateofseismicriskatCookthantheoriginalCDFresult.TheIPEEEsubmittal hasdemonstrated thatthe.plantseismicriskislow.Althoughthisimplication isdrawnbasedontheseismichazardinputdeveloped byRizzoAssociates, itisalsoexpectedtobetrueifthe1993LLNLseismichazardinputisused.(TheCDFbasedonthe1993LLNLmeanseismichazardcurveforPGAisroughlyestimated tobeabout10'/ry).Aplant-level fragility curveorHCLPFcapacitywas'otexplicitly developed intheseismicIPEEE.Approximate valuesforthesecapacities, however,canbeinferredbasedonresultspresented intherevisedIPEEEsubmittal.

Thefollowing approximate plant-level capacityparameters havebeenestimated inthisreview:A=0.48g(PGA),Pc=0.27,andHCLPF=0.25g (PGA).ThemedianandHCLPFcapacities areanchoredtothe10,000-yr median1989LLNLUHSspectralshape.Auxiliary Building(FailureofSteelColumnsSupporting CraneGirders)Thefollowing itemshavebeenassessedasdomihantcontributors totheseismicCDFintheCookrevisedIPEEE:1.LossofElectricPowerSystemsa.600VACTransformers (BlockWallFailure)b.DieselGenerator FuelOilDayTank(BlockWallFailure)Turbine-Driven AFPump(RandomFailures)

Lesser,butnotable,contributors include:4.250VDCSystem5.ReactorProtection System(FailureofMiscellaneous Panels)IceCondenser Theinitiating eventsthatdominatetheseismicCDFwereassessedasbeing:LossofOffsitePower(FailureofCeramicInsulators) 2.EnergyResearch, Inc.ERI/NRC95-501IxDirectCoreDamage(Dominated ByContainment Structural FailureduetoSoilPressure) 3.Thefollowing threeinitiators haverelatively equalcontributions tocoredamagerisk:a.Steamline/Feedline Break(FailureofSecondary Piping/Supports) b.LossofEssential ServiceWaterSystem(Screenhouse Failure)c.LargeLOCA(FailureofPressurizer Supports)

Thattheauxiliary buildingisassessedasthedominantriskcontributor issomewhat'unusual incomparison toresultsofotherSPRAstudiesofPWRs.Reviewoftherevisedfragility calculation fortheauxiliary buildingcolumnsrevealspotential sourcesofconservatism.

Blockwallfailureshavebeenidentified asitemsofconcernfrompastseismicPRAs;hence,theidentification ofblockwallfailuresasdominantriskcontributors intheCookIPEEEisnotparticularly surprising.

Itisnoted,however,thatthereisareasonable probability thatfailureoftheblockwallseparating the600VACtransformers willnotleadtotransformer failure;hence,theassumption thatblockwallcollapsealwaysleadstotransformer failureisalsoconservative.

Incontrast, analysesofotheritemsappeartobesomewhatnonconservative, andsuchitemsmightberevealedasdominantcontributors undermeaningful variations inanalysisassumptions.

Forexample,poorwelddetailing of4kVswitchgear (cabinetplugweldedtoshimplates)substantially limitsseismiccapacity, whereasarelatively highseismicdesigncapacitywasusedasabasisforthefragility analysis.

Arealistic seismiccapacityofcomponent coolingwater(CCW)heatexchanger supportsislikewisethoughttobesomewhatlowerthanthatdeveloped intherevisedCookIPEEEfragility analysis.

(ItisworthnotingthatconcernswithbothoftheseitemswerenotedintheIPEEEplantwalkdowns andinthesiteauditreview.Thelicenseethenconducted revisedfragility analysesfortheseitems..Theseanalyseswereexaminedindetailaspartofthepresent'Step-2 review.Basedonthisreview[andasjustnotedabove],theresulting capacities arestilljudgedtobesomewhathigh.Furtheradjustments tothesefragility calculations mayplacethesecomponents inthedominantcontributor list;however,thelicensee's analysisissufficient tosuggestthattheyarenotlikelytobethemostimportant dominantcontributors.)

Forthesereasons,amongothers,thedominantcontributors assessedintherevisedCookseismicIPEEEarestillconsidered tobesomewhatquestionable.

Thecurrentinsightsare,nonetheless, considered tobeuseful.However,moremeaningful insightscouldperhapsbedrawnifjustified refinements andvariations inanalysisassumptions wereconsidered.

Revisions tocontainment performance insightswerenotexplicitly developed aspartoftherevisedCookIPEEE.TheoriginalIPEEEconclusions withrespecttocontainment performance underseismiceventsincludethefollowing:

1.,Containment mechanical penetrations andcontainment isolation valvesweredetermined tohavehighcapability towithstand directfailuresduetoseismicevents.Hydrogenigniterswerealsofoundtobeveryruggedseismically (inwithstanding directfailures),

andwerescreenedoutofthecontainment-performance evaluation process.(However, failureofelectricpowertotheigniterswasevaluated.)

2.ReactorProtection System(RPS)failure,whichresultsinfailuretoisolatethecontainment, andconsequently wasassumedtoresultincontainment bypass,contributes lessthan1%tothetotalseismicCDF.Directseismicfailureofthecontainment building(dominated bysoil-pressure failure)contributes approximately 1%tothetotalseismicCDF.EnergyResearch, Inc.ERI/NRC95-501 4.Directseismicfailureoftheicecondenser wasdetermined tohaveanotablecontribution to~~seismicCDF.Someofthemostdamagingseismicsequences involvealossofdecayheatremoval(failureoftheEmergency CoreCoolingSystem[ECCS]orofauxiliary feedwater

[AFW]tothesteamgenerators) inconjunction withfailureofthecontainment spraysystem.(Although thesesequences apparently havethelargestcontribution toseismicCDFamongthosesequences havinginadequate containment performance, theIPEEEsubmittal doesnotprovideaquantitative valueoftheirrelativeCDFcontributions.)

Theseconclusions mayhaveslightlyalteredduetochangestoLevel-1PRAresultsintherevisedseismicIPEEE.Licenseeresponsetoaquestion(SeismicQuestionNo.5),thatwasposedduringtheOctober25,1994meeting,statesthattheprimarydifference incontainment performance insights(fortherevisedvis-A-vistheoriginalstudy)wasagreaterrelativecontribution tooverallcontainment-failure riskduetocontainment soil-pressure failure.Areviewoftheoriginalfragility analysisconducted fortheicecondenser containment revealedanumberofproblemsinthemethodology andcalculations.

Arevisedseismicfragility analysiswasconducted fortheicecondenser, butthecalculations werenotreviewed.

Itisnoted,however,thattheresulting revisedfragility parameters fortheicecondenser nowappearmuchmorereasonable.

(Thatis,reasonable valuesofA;P,andPhavebeenobtained.)

TherevisedseismicIPEEEsubmittal concludes thatpotential failureoftheicecondenser isstillanotablecontributor tocoredamagerisk.Thisconclusion isconsistent withtheoriginalIPEEEobservation thatpotential icecondenser failurecontributes meaningly totheriskofpoorcontainment performance, andisviewedtobesubstantially valid.Othernoteworthy seismicIPEEEfindingsaredocumented aspartofthisTER.FireThetotalfireCDFof3.76x10'/ry isthesumoftheelevenfirescenarios thatsurvivedthescreening efforts.Elevenfirescenarios havebeenidentified asthemaincontributors tothetotalfireCDFforoneunit.Thefirezonesassociated withtheelevenscenarios includethefollowing:

Twodieselgenerator roomswhereothercablesarealsopresentTwofirezonesassociated withtheessential servicewater(ESW)systemTwo4kVswitchgear roomsOnemotorcontrolcenter(MCC)roomOnebatteryroomAgeneralareawithintheAuxiliary BuildingThecontrolroomAnareawithintheTurbineBuildingThelististhesameforbothunits.TheareaintheAuxiliary Buildingiscommontobothunits.xlInthecaseofnineoftheelevenfirescenarios, theinitiating eventislossofeitherCCWorESW.Inonecase,theinitiating eventislossofthe250VDCsystem;andintheremaining case,theinitiating eventisassumedtobeageneraltransient.

EnergyResearch, Inc.ERI/NRC95-501 GenericIssuesandUnresolved SafetyIssuesSeismicThepresentreviewhasconsidered thelicensee's treatment ofGI-131,"Potential SeismicInteraction Involving theMovableIn-CoreFluxMappingSystemUsedinWestinghouse Plants,"andUSIA-45,"Shutdown DecayHeatRemovalRequirements."

Thelicensee's treatment ofGI-131involvedareviewoftheseismicadequacyoftheflux-mapping cartuppersupports.

Asaresultofthisevaluation, thehold-down strapsattachedtothetopofthecartwereredesigned, andthedesignchangeswereimpfemented.

Inaddition, alowerlateralrestraint tothefiuxmappingcartwasinstalled atanelevation-just abovethesealtable.Basedonthedesignchangesandresultsoftheseismicwalkdown, aHCLPFcapacityof0.32gwasevaluated forfailureofrestraint ofthefluxmappingcart.Thistreatment ofGI-131isjudgedtosatisfytherelevantconcernsassociated withthisissue.Detailsofthelicensee's treatment ofUSIA<5werenotdocumented intheCookIPEEEsubmittal.

USIA-45was,therefore, addressed inthesiteauditreview.ThisreviewrevealedthattheseismicIPEEEprocessiscapableofidentifying vulnerabilities relatedtoshutdowndecayheatremoval.TotheextentthattheseismicIPEEErealistically modelssevere-accident

response, therefore, USIAQ5willbemeaninMlly addressed.

ItisjudgedthattherevisedCookIPEEEadequately treatsVSIA-45.Itisnoted,however,thatitwouldbeappropriate forthelicenseetomorefullydocumentthebasisforUSIA-45resolution, relevanttoseismicconcerns, intheseismicIPEEEsubmittal itself.AlthoughUSIA-17,"SystemsInteractions inNuclearPowerPlants,"isnotexplicitly includedinthescopeofthisreview,documentation concerning thewalkdownprocessandsystemsinteraction analysissuggeststhatthisissuehasbeensubstantially addressed bytheIPEEE.Someinformation isalsoprovidedintheCookseismicIPEEEsubmittal whichpertainstothefollowing relevantgenericsafetyissues(GSIs):~GSI-156,"Systematic Evaluation Program(SEP)"~GSI-172,"Multiple System"Responses Program(MSRP)"FireTheSandiaFireRiskScopingStudyissueshavebeenaddressed explicitly.

Forcontrolroomcontrolcircuitisolation, theLocalShutdownIndication (LSI)panelswillbeused.Thesepanelsarelocatedatseveralspotsintheauxiliary building.

Withrespecttoseismically inducedfires,theSummaryReportdoesnotaddressthisissueinSection4.8.However,intheLicenseeResponsetoNRCQuestions (page8),itisstatedthatcabinetmovement, tankmovement, andpumpleakageisnotaproblemforthedesign-basis earthquake.

Thisisfurtherdiscussed intherevisedfireriskanalysis.

SpecialfocusisgiventotheCO,tank.Thelicenseehasstatedthatautomatic firesuppression systemsmaynotsurviveastrongearthquake.

EnergyResearch, Inc.xiiERI/NRC95-501 IC USIA-45hasbeenaddressed bythelicensee.

Noinformation isprovidedexceptforareference to'theinternaleventsIPEreport.Someinformation isalsoprovidedintheCookfireIPEEEsubmittal whichpertainstothefollowing relevantgenericsafetyissues(GSIs):GSI-147,"Fire-Induced Alternate Shutdown/Control PanelInteraction" GSI-148,"SmokeControlandManualFireFightingEffectiveness" GSI-172,"Multiple SystemResponses Program(MSRP)"Vulnerabilities andPlantImprovements SeismicAlthoughdominantriskcontributors arenotedintheCookseismicIPEEEsubmittal, thestudydoesnotidentifyanyspecificseismic-related severe-accident vulnerabilities.

Thesubmittal concludes thatnosignificant seismicconcernswerediscovered duringtheseismicIPEEE.Anumberofminorplantimprovements, however,havebeenimplemented inresponsetotheCookseismicIPEEE,primarily relatedtowalkdownfindings.

Atablepresented intherevisedseismicIPEEEsubmittal containsadescription oftheseplantimprovements.

Thistableisduplicated inthisTERasTable1.1;itsummarizes theitemsofconcernidentified duringtheplantwalkdowns, togetherwiththelicensee's disposition ofthoseitems.Itisnoted,however,thatthislistofitemsdoesnotincludeanumberof.miscellaneous walkdownfindingslistedintheoriginalIPEEEsubmittal, including:

poorfire-extinguisher

mounting, potential interaction problemsfromfireprotection pilotlines,andpotential interaction problemsfromfluorescent lightsincontrolroom.Furthermore, afewadditional itemsidentified intheEQEwalkdownreportshavealsonotbeenincludedinTable1.1.Basedonthesiteauditandthecollective bodyofIPEEEdocumentation, however,itisjudgedthatallidentified walkdownissueshavebeenaddressed insomemannerbythelicensee.

Thelicensee's evaluation ofUSIAMconcernshasalsoidentified "badactor"relaysthatwillbereplacedforcaseswhereoperability ofsafetyrelatedequipment isaffected.

Itwasconfirmed duringthesiteauditthatthelicensee's relaychatterevaluation includedallitemsofequipment withinthescopeofIPEEE,including thosethatwerenotalsointhescopeofUSIA-46.However,bad-actor relayswerefoundtoexistonlyinitemsofequipment commontobothIPEEEandUSIA-46.Thespecificdisposition ofidentified bad-actor relaysis,therefore, treatedinthelicensee's responsetoUSIA<6.FireItisclaimedbythelicenseethatnofirevulnerabilities existatD.C.Cook.Also,norelatedplantmodifications werepostulated, ordeemednecessary.

EnergyResearch, Inc.xiiiERI/NRC95-501

Observations SeismicTheoriginalCookseismicIPEEEproducedasubstantially unrealistic (over-conservative) evaluation ofseismicrisk.Therewereanumberofidentified problemsintheanalysis, mostsignificantly, thetreatment ofseismicfragility andHCI.PFcalculations, andthecrudedefinition ofseismicintervals usedforquantifying risk.Inaddition, anumberofopenissueswereidentified inthereviewoftheoriginalsubmittal.

Thesewerelargelyaddressed duringthesiteaudit;however,therewereanumberofconcernsthatremainedafterthesiteaudit.Inresponsetotheseconcerns, thelicenseeundertook significant efforttocorrectproblemsintheanalysisandtoclarify/justify anumberofissues.Theresulting revisedCookseismicIPEEEisasignificant improvement overtheoriginalsubmittal.

Itadequately demonstrates thattheseismicriskatCookNuclearPlantislow.Basedonadetailedreviewoftherevisedseismicfragility calculations, itisbelievedthatmorerealistic assumptions inthefragility analysesmaylikelyaltertherankingofdominantcontributors.

However,furtherrefinement ofthefragility analysesisconsidered tobeunwarranted.

Itisbelievedthat,althoughtherankingofdominantcontributors maynotbeprecise,thecollective setofcontributors identified intheoriginalsubmittal andtherevisedsubmittal encompass thoseconditions thataremostlikelytocontrolplantcapacityandrisk.Basedonstatements intherevisedseismicIPEEEsubmittal, thelicenseeisawareofotherissuesofpotential concern,a'ndthesearesummarized inthebodyofthisTER.Basedonthesiteaudit,andreviewofinformation suppliedbythelicensee, itappearsthatthelicenseehasdeveloped anappreciation ofsevereaccidentbehavior, gainedaqualitative understanding oftheoveralllikelihood ofcoredamage,andadequately assessedcontainment performance.

AsaresultoftheseismicIPEEE(primarily thewalkdowneffort),anumberofplantimprovements havebeenidentified andimplemented.

Also,thelicenseeappearstopossessanunderstanding oflikelysevereaccidentsequences thatcouldoccuratitsplantunderfullpoweroperating conditions, thoughtherelativerankingofthesesequences maynotbeprecise,dueinparttoafewquestionable fragility analysis'assumptions.

Additional observations relatedtopre-siteauditfindings, siteauditfindings, andpost-site auditfindings, aresumniarized throughout thisTER.AreaswheretherevisedIPEEEsubmittal isjudgedtobeweakarenotedforthelicensee's benefitinconducting anysubsequent refinements totheIPEEE.FireForinternalfires,thelicenseeappearstohavedeveloped anappreciation ofsevereaccidentbehavior, tohavegainedunderstanding ofthemostlikelysevereaccidentsequences thatcouldoccuratitsplantunderfullpoweroperating conditions, andtohavegainedaqualitative understanding oftheoveralllikelihood ofcoredamageandradioactive materialreleases.

Thereareseveralitemsthathavenotbeenexplicitly explained intheSummaryReport,butsubsequently submitted documentation providessufficient information inthisregard.Overall,thelicenseehasfollowedamethodology thatisproperandhasbeenwidelyusedforfirePRAs.Thedatabasesforfireoccurrence frequencies, equipment andcablelocations, andfirefightingcapabilities, aswellasthefireimpactmodeling(i.e.,faulttreesandeventtrees),aredeemedtobeproper.Theapplication ofthedatabasesandmodelsintherevisedfireriskanalysiscanbeconsidered asappropriate.

TheoverallCDFfromfireeventshasbeenassessedasbeingwithinarangetypifiedbyotherfirePRAs.Notwithstanding theaboveconclusions, someshortcomings ofthesubmitted information includethefollowing:

EnergyResearch, Inc.xivERI/NRC95-501 Thelicenseehasnotputforwardacriterion foridentifying afirevulnerability.

Thereareseveralcalculations ihatcannotbefullyexplained fromtheavailable information.

Thepossibility ofactivefirebarrierfailureandfirepropagation betweenfirezonesemploying suchequipment havenotbeenadequately explained.

Itisnotclearwhetherthelicenseehasconsidered, initsfirevulnerability

analysis, thedegradation ofsuchsystemsascontainment isolation andcontainment coolingfromafireevent.Thelicenseehasnotaddressed uncertainties and.sensitivity issuesassociated withthedataandmodels.EnergyResearch, Inc.xvERI/NRC95-501

PREFACETheEnergyResearch, Inc.,teammembersresponsible forthepresentIPEEEreviewdocumented herein,include:SismicR.Sewell,Primar'yReviewerM.FrankandR.Budnitz,Secondary Reviewers M.Kazarians, PrimaryReviewerM.Frank,Secondary ReviewerM.Khatib-Rahbar, Principal Investigator, ReportReviewA.Kuritzky, IPEEEReviewCoordination andIntegration R.Sewell,ReportIntegration Dr.JohnLambright, ofLambright Technical Associates, contributed tothepreparation ofSection2.3following the'completion ofthedraftversionofthisTER.Thisworkwasperformed undertheauspicesoftheUnitedStatesNuclearRegulatory Commission, OfficeofNuclearRegulatory Research.

Thecontinued technical guidanceandsupportofvariousNRCstaffisacknowledged.

EnergyResearch, Inc.gxvi~ERI/NRC95-501

ABBREVIATIONS ACAEPAEPSCAFAFWATWSBWRCCWCDFCPICRDCRDMCSCSSCSTCVCSDBEDCDGECCSEDGEPRIEPSESFASESWFHAFSARGDRSGIGIPGLGSIHCLPFHPSIHVACINIPEIPEEELLNLLOCALOSPLPSILSILSPMCCAlternating CurrentAmericanElectricPowerServiceCorporation AmericanElectricPowerServiceCorporation Auxiliary FeedWaterAuxiliary FeedWaterAnticipated Transient WithoutSCRAMBoilingWaterReactorComponent CoolingWaterCoreDamageFrequency Containment Performance Improvement ControlRodDriveControlRodDriveMechanism Containment SprayContainment SpraySystemCondensate StorageTankChemicalandVolumeControlSystemDesignBasisEarthquake DirectCurrentDieselGenerator Emergency CoreCoolingSystemEmergency DieselGenerator ElectricPowerResearchInstitute ElectricPowerSystemEngineered SafetyFeaturesActuation SystemEssential ServiceWaterFireHazardAnalysisFinalSafetyAnalysisReportGroundDesignResponseSpectrumGenericIssueGenericImplementation Procedure (SQUG)GenericLetterGenericSafetyIssueHighConfidence ofLowProbability ofFailure(Capacity)

HighPressureSafetyInjection Heating,Ventilation andAirConditioning Information NoticeIndividual PlantExamination Individual PlantExamination ofExternalEventsLawrenceLivermore NationalLaboratory LossofCoolantAccidentLossofOffsitePowerLowPressureSafetyInjection-LocalShutdownIndicator LossofOffsitePowerMotorControlCenterEnergyResearch, Inc.xvllERI/NRC95-501 0

MSIVNRCPGAPORVPRAPWRRAIRCPRCSRHRRPSRPVRWSTSEWSSGSHASISMASMESPRASQUGSRTSSISWSWGRSWSTERUFSARUHSUSIVVACVCCVDC.MainSteamIsolation ValveNuclearRegulatory Commission PeakGroundAcceleration PressureOperatedReliefValveProbabilistic RiskAssessment Pressurized WaterReactorRequestforAdditional Information ReactorCoolantPumpReactorCoolantSystemResidualHeatRemovalReactorProtection SystemReactorPressureVesselRefueling WaterStorageTankSeismicEvaluation WorkSheetSteamGenerator SeismicHazardAnalysisSafetyInjection SeismicMarginAssessment SeismicMarginEarthquake SeismicProbabilistic RiskAssessment SeismicQualification UsersGroupSeismicReviewTeamSoil-Structure Interaction ServiceWaterSwitchGearServiceWaterSystemTechnical Evaluation ReportUpdatedFinalSafetyAnalysisReportUniformHazardSpectrumUnresolved SafetyIssueVoltsAlternating Current.VoltageValveControlCenterDirectCurrentVoltageEnergyResearch, Inc.XvlllERI/NRC95-501 1.INTRODUCTION ThisTechnical Evaluation Report(TER)documents theresultsoftheEnergyResearch, Inc.(ERI)Step-2reviewoftheseismicandfireportionsoftheD.C.CookIndividual PlantExamination ofExternalEvents(IPEEE)submittal

[1],corresponding LicenseeResponses toNRC(Step-1)Questions

[2],SiteAuditfindings, andsubsequent LicenseeResponses toRemaining Questions andConcerns.

TheNRCreviewobjective istodetermine whetherthelicensee's'IPEEE processhasmettheintentofGenericLetter88-20,Supplement 4[3].InsightsgainedfromtheERIauditoftheIPEEEsubmittal andsupporting documentation provideabetterperspective fromwhichtoevaluatetheIPEEE,andallowamoreaccuratedetermination astowhetherornotthelicensee's IPEEEprocessmeetstheintentofSupplement 4toGenericLetter88-20.Asnoted,thereviewhasinvolvedasitevisitandauditof"tier2"information (e.g.,event/fault trees,systemnotebooks, data,CDF/HCLPF calculations).

Thereviewprocesshasgivenasignificant levelofattention todetailsinallmajorelementsoftheIPEEEanalysis.

ThisTERcomplieswiththerequirements ofthecontractor taskorderforIPEEESubmittal Step-2reviews.Theremainder ofthissectionprovidesanoverviewofthelicensee's IPEEEprocessandinsights, theauditprocess,pre-sitevisitactivities, sitevisitactivities, andpost-site visitactivities.

Sections2.1and2.2providetheauditfindingsrelatedtotheseismicandfirereviews,respectively, andSections3.1and3.2containtheauditconclusions andrecommendations fromtheseismicandfirereviews,'respectively.

AppendixAcontainsdetailedinformation pertaining totheseismicreview,andAppendixBcontainssimilarinformation forthefirereview.Itisimportant tonotethat,duetoconcernsidentified inthetechnical reviewpriorto,andduring,theD.C.Cooksiteaudit,theoriginalIPEEEsubmittal wasupdatedwitharevisedIPEEEsubmittal

[4].Thefinalconclusions ofthisTERapplytotherevisedresults;however,observations madethroughout theStep-2reviewprocessarealsonotedinthisreport.Thefollowing listofevents,reviewtasksandmeetingshelpsclarifythesequenceofthe'entire Step-2reviewprocess:~OriginalIPEEESubmitted (April1992)~NRCStep-1ReviewandQuestions (May24,1993)LicenseeResponses toNRCStep-1Questions (July22,1993)Step-2ReviewofOriginalSubmittal andLicenseeResponses toNRCStep-1ReviewQuestions; Development ofStep-2Questions andSiteAuditPlan;DraftTERDeveloped D.C.CookSiteAudit(July26-28,1994);Development ofListofSiteAuditConcernsandQuestions LicenseePresentation ofResponses toSiteAuditConcernstoNRCandReviewers (October25,1994);Identification byReviewers ofRemaining Questions, ConcernsandRequestsforAdditional Information RevisedIPEEESubmitted (February 15,1995)Step-2ReviewofRevisedIPEEESubmittal andLicenseeResponses; FinalTERDeveloped EnergyResearch, Inc.ERI/NRC95-501 te 1.1TheD.C.CookNuclearPlantisatwo-unit, 4-LoopPWRlocatedonthesoutheastern shoreofLakeMichigannearBridgman, Michigan.

(AsstatedintheIPEEEsubmittal, onlyUnit1wasmodeledforthebase-case PRAanalysis, however,differences betweenUnits1and2werenotedbytheIPEEEteam.Duringthesiteaudit,thelicenseestatedthatthesedifferences wouldnotmeaningfully impacttheseismicPRA.Inaddition, plantwalkdowns ofbothunitswereperformed.)

TheplantisoneamongafewPWRshavinganicecondenser containment.

TheCookIPEdocumentation providesmoredetailedinformation onplantconfiguration thanprovidedintheIPEEEsubmittal.

f.2.1Seismic1.2.1.1IPEEEProcessforSeismicEventsAsdocumented inNUREG-1407

[5],theD.C.Cookplantisbinnedinthe0.3gfocused-scope reviewcategory.

Theplantseismicdesignbasisischaracterized byaPGA(peakgroundacceleration) valueof0.20g,anchoredtoaHousnerspectralshape,Theplantisfoundedonsoilandisborderedontheeastbyasignificant slope(approximately 2:1).AmericanElectricPowerServiceCorporation (AEPSC),thelicenseeoftheplant,electedtoperformaLevel-1seismicprobabilistic riskassessment (SPRA),withaqualitative seismiccontainment

analysis, aspartoftheD.C.CookIPEEE.TheSPRAapproachthatwasimplemented followedtheguidancedescribed inNUREG/CR~

[6]andVolume3ofNUREG/CRP550

[7].Plantseismicwalkdowns wereconducted usingtheprocedures described inEPRINP-6041[8].Todefinetheearthquake hazard,bothplant-specific hazardcurvesandLLNLhazardcurveswereusedintheSPRAquantifications.

Theplant-specific hazardstudyproducedhazardcurvesforpeakgroundacceleration (PGA)only.TheIPEEEsubmittal statesthattherankingsofdominantcontributors toseismiccoredamagefrequency remainedthesameregardless ofwhichsetofseismichazardcurveswasused.IntheIPEEEanalysis, walkdowns wereperformed forbothreactorunitsoftheplant.Thewalkdowns lookedatcomponents andstructures withinbothcontainment buildings, theauxiliary andturbinebuildings, thescreenhouse,andthegroundsimmediately surrounding theplant.ItisstatedintheIPEEEsubmittal that,althoughdifferences wereidentified betweenreactorUnits1and2,onlyUnit1wasmodeledforthebaseSPRAanalysis.

Duringthesiteaudit,thelicenseestatedthatthesedifferences wouldnotmeaningfully impactthe'seismic PRA.Inaddition, plantwalkdowns ofbothunitswereperformed.

AccidenteventtreesandplantsystemmodelsusedintheSPRAweretakenfromtheinternaleventsIPEforD.C.Cook[9],andtheseweremodifiedasnecessary forseismicevents.Generally

speaking, thescopeandlevelofanalysisthatAEPSChaschosentoundertake fortheIPEEEgoes,beyondtheminimumguidelines outlinedinNUREG-1407 fortheplant.Inaddition, asdocumented initsIPEEEsubmittal, thelicensee's plantomaintaintheIPEEEasalivingstudy,andtosubstantially involveitsstaffinunderstanding andcontinuing theIPEEEprocess,allindicatealevelofresponsiveness consistent withtheintentandspiritoftheSevereAccidentPolicyStatement andwithresponsible seismicsafetymanagement.

Thetimeliness oftheIPEEEsubmittal furtherreinforces thatthelicenseehasbeendiligentinresponding totheconcernsofGenericLetter88-20,Supplement 4.EnergyResearch, Inc.ERI/NRC95-501 IntheIPEEEsubmittal, AEPSCstatesthattheIPEEEwasconducted according totheapplicable sectionsof10CFR50,AppendixB.AllaspectsoftheD.C.CookIPEEEarestatedtohavebeensubjecttoanindependent review.ThepresentseismicauditoftheD.C.CookIPEEEhasfocusedonevaluating theextenttowhichthelicensee's IPEEEprocessandsubmittal meetstheoverallintentofsevere-accident policyandtheobjectives oftheIPEEE,asdocumented inGenericLetter88-20,Supplement 4(including theIPEEEguidancedocumentNUREG-1407).

Ageneraloverviewofthelicensee's submittal, withrespecttotheseobjectives, isoutlinedasfollows:(a)Thefirstobjective oftheIPEEEisthatthelicenseedevelopanappreciation ofsevere-accident behavior.

Asdocumented intheIPEEEsubmittal, measureshavebeentakenbythelicenseetohelpinsurethatitsstaffdevelopsabetterappreciation forseismicsevere-accident behavioroftheplant;inaddition, staffinvolvement inupdatingtheIPEEEonabiannualbasiswillleadtocontinued andincreased understanding ofseismicresponseandrisk.Thepre-siteauditreviewrevealedspecifictechnical areaswherethelicensee's IPEEEprocessandsubmittal wereconsidered tobeweak;consequently, itwasfeltthatanincorrect understanding ofsevere-accident behaviorcouldbedeveloped basedontheoriginalIPEEEsubmittal.

Revisions implemented asaresultofthesiteauditreviewandsubsequent requestshavehelpedalleviate manyoftheseconcerns.

ItisjudgedthattherevisedIPEEEsubmittal

[4]substantially satisfies thisIPEEEobjective; i.e.,thelicenseehasapparently gainedasignificant understanding ofthepotential seismically inducedsevere-accidentsequences.

(b)Thesecondobjective oftheIPEEEisforthelicenseetounderstand themostlikelysevere-accident sequences thatcouldoccurattheplantunderfull-power operating conditions.

Thesystemsanalysisandfragility assessment inawell-executed SPRAareclearlycapableofrevealing themostlikelysevere-accident sequences.

ThegeneralSPRAprocessutilizedbythelicenseeislikewisecapableofrevealing themostlikelysevere-accident sequences thatcouldoccurattheD.C.Cookplant.Anumberofspecificaspectsofthelicensee's submittal revealedduringthepre-sitevisitandsitevisitactivities (asdiscussed ingreaterdetaillater),however,raisedquestions astowhetherornotthetrulyrisk-dominant sequences andcomponents hadbeenidentified.

Thelicenseeundertook substantial efforttorespondtothesequestions; forexample,severalfragility calculations wererevised,implementing improvedmethodology.

TherevisedIPEEE[4]developsamuchbetterunderstanding ofthelevelofplantseismicrisk.Nonetheless, adetailedreviewoftherevisedfragility calculations indicates thatthereexistanumberofnotableconservatisms andnonconservatisms indetailsofthefragility analysisforsomeimportant components.

Thesehavethepotential todistortunderstanding ofthemostlikelysevere-accident sequences.

ItisthusjudgedthatthissecondIPEEEobjective isonlypartially metbytherevisedseismicIPEEEsubmittal.

Althoughthisisthecase,itisbelievedthatthelicenseecanreadilygainabetterunderstanding ofthemostlikelysevere-accident sequences byconsidering theimpactsofsimplechangesinafewfragility analysisassumptions.

(Somesuchcasesarediscussed laterin.thisTER.)EnergyResearch, Inc.ERI/NRC95-501 (c)Thethirdobjective oftheIPEEEisforthelicenseetogainaqualitative understanding oftheoveralllikelihood ofcor~damageandfission-product releases.

Thelicensee's SPRAprovidesaquantitative assessment ofthemeanseismiccoredamagefrequency.

TheoriginalIPEEEsubmittal's estimateofcoredamageriskwasclearlyover-conservative, anddidnotmeettheobjective forunderstanding thelikelihood ofcoredamageresulting fromseismicevents.(Thefragility resultswerehighlyconservative, andtherewasamistakeinthelicensee's numerical computation ofseismiccoredamagefrequency whichneededtoberectified, amongotherissues.),The revisedIPEEEsubmittal

[4]producesamuchmorerealistic understanding ofcoredamagerisk.Thelicensee's IPEEEprocessalsoincludesaqualitative assessment ofseismiccontainment performance.

Thisassessment doesnotaddresstheimpactofcontainment performance onthelikelihood offission-product releases(including amore-detailedqualitative description oftheexpectedmagnitude andtimingofrelease).

However,suchanassessmerit isnotexplicitly requested according toNVREG-1407 guidelines.

Hence,althoughtheIPEEEcouldextendthecontainment performance analysistodevelopqualitative (and/orquantitative) insightsrelatedtorisksofradiological

releases, thesubmittal doesachieveasatisfactory understanding ofseismiccontainment performance.

(d)'hefourthandfinalobjective oftheIPEEEisthatthelicenseeshouldtakemeasurestoreducetheoveralllikelihood ofcoredamageandradioactive materialreleasesbymodifying, whereappropriate, hardwareandprocedures thatwouldhelppreventormitigatesevereaccidents.

Asdocumented intheoriginalandrevisedIPEEEsubmittals

[1,4],nomajorplantchangesweredeemednecessary bythelicenseebasedontheresultsoftheD.C.CookIPEEE.Somepotential procedural changesandminorequipment enhancements didresultfromthestudy.Section7.0oftheoriginalIPEEEsubmittal statedthatallfindingsinthe(seismic) walkdowns haveeitherbeenincorporated intothecomponent iragility

analysis, administratively addressed, fixedatCookNuclearPlantorplacedintoactionitemtrackingstatusawaitingdisposition.

Specificdetailsconcerning whatitemshadbeenfixedwerenotgenerally notedinSection7.0oftheoriginalsubmittal.

Neitherwasitclearwhatwasmeantbythedesignations "administratively addressed" or"placedintoactionitemtrackingstatusawaitingdisposition."

Duringthesiteaudit,theseismicwalkdownfindingswerereviewed, togetherwiththelicensee's action-item trackinganddisposition approaches.

Anadditional requestwasmadeofthelicenseetotabulateallplantimprovements suggested bythewalkdownfindings, togetherwiththeirdisposition status.Thistableofitemswasprovidedbythelicensee, andisduplicated hereasTable1.1.Thelicensee's treatment ofmanywalkdownfindings(including relayevaluation findingsinUSIA-46resolution) isjudgedtorespondsignificantly tothisIPEEEobjective.

WithinthebodyoftheoriginalIPEEEsubmittal, itisnotedthatspecificchangesweremadeasaresultofplantreviewconcerning GI-131,"Potential SeismicInteraction Involving theMovableIn-CoreFluxMappingSystemUsedinWestinghouse Plants."Impleinentation ofthisplantimprovement willreducethepotential forasmallLOCAinitiating event,andthusalsorespondstothefourthIPEEEobjective.

Also,Section7.0oftheIPEEEsubmittal notes(undertheheading")thatprocedural changeswereimplemented tohelpinsurecontrol-room habitability intheeventofanearthquake-induced hydrazine spill.EnergyResearch, Inc.ERI/NRC95-501 IIIII~I~IIIII~II~I'~II~I~~I~I'l~~~~II~~II~~I~I~~'I'~~~III~~'I~II~~'l~~~~I~II~~I~~~I~~~~~I~IIII~I4Il\~0~I~~~~II~II'~llIl\~~I'l~~~'III~II~~I~II~I~~~~I~I~~~II~I~II~~III~I~I~~~I~IIIII'II~~~~~~I~I~IIII~III~~II~~I~I~~I'IIIII~I~'~II~~~III~I~~~~I~I~~~I~I'II~~III'~~~II~~~~II~~I~I~~~II~~'1~~I~~I~III~I~'III~II~~'I'll~~~~II~IIII~II~I~I~I~~~I~I~I~~~~III~II~~II'~I'I'~I'~l~~~~~'.I~I'~~~III~II~I~~II'~~~~IIII~~~m'II~~II'l~~~~'I~~I~I~I~II~~III~I~I~~~I~I'~II~~I'I~~~I'IIIIIII'I~IIII'l~~II~II~'II~~~I~~~~~~~

II~~~~IIO'II~~~I~'ll~'~II~~~~I~~~II~~~~~I~~~~.I~III'I~I'I'I~~I~~~~IIII~'II'~I~I~III'~II~~~~'~~I'l'~I~I~~~~~~IIIiI'I~I~I~I'~~'~~I~~'~~~II~~II~~~~II~I~I~~I~'11I'I~~~~'II~I~I~~'~~llI~llI~~~I~~'~~'~I~!~1~IIII~I~~'III'III~~~I~~~~II~~~IIIIIII~II~I~~~~~~~'II~~~'III~III~~I~'I~II'I'II~I~~~~~~I~~II~II~I'I~~II~~IIII~I~~I~II~~~'~~II~~I~I~~~II'~~~~II1~IIII~I~I~IIII~'I~I~II'~'~~I~~~~I'~~~~~~~I~I~~IIIII~~II~I'II'~~I'~I~I'I~I~I~~~~I'II'I~IIIIIIIII~~~I~I~~'~I~11I~I~I

II~I~I~I~I~II~'I~~~~I~~II.I~II~~I~I'~'I~~~I~I~I'l~I~I~I~~~I~'~~'I~~~'II~~II'll~~III'III~I~~I~I~~III~II~~~I'~~~~~~~~lII~~I~~'~I~~I~0II~II~~I~II~~~'~II~~~~~~III~~~'~'I~II~II~~~~'I~II~~I~~~~'~~~~II~~~~I'~~I~I~~~~~~~~~I'lIII'I~I'I'~~'III.IIII~II~~I'~~II~~~~~'I~I~II~'~II~lI~I~~'I~~I~~~~~

Otherspecificpotential seismicconce'msarenotedinthebodyoftheIPEEEsubmittal, including thefollowing items:(a)blockwalls,(b)fire-extinguisher

mounting, (c)fireprotection pilotlines,(d)fluorescent lightsincontrolroom,(e)missing/broken anchorage onsomemotorcontrolcenters,and(f)seismically inducedfireduetofailureofthesupportofa17-tonCO,tank.Althoughmostoftheseconcernscouldberectified withlow-costimprovements, theIPEEEsubmittal doesnotindicatethatanychangeswillbemade.Thestudyspecifically statesorsuggeststhatchangesarenotrequiredtoaddressitems(c),(e),and(f).Basedonthedescription providedintheIPEEEsubmittal,

.itseemsclearthat(withoutfurtheranalysis) items(b)and(d)arelikelycandidates forrectification.

Becausethecostsofenhancements foritems(e)and(f)wouldbelow,itmayalsobeprudentfortheseitemstoberectified.

SeismicIPEEEInsightsThelicensee's originalandrevisedIPEEEsubmittals

[1,4]reference anumberof'important insightsregarding walkdown-related seismicconcernsanddominantcontributors toseismicriskforthisplant.Inaddition, thisisthefirstinstancethatafragility assessment hasbeenconducted foranicecondenser containment.

Basedonthepre-sitevisitauditofthelicensee's submittal, andpendingadditional verification andreview,theinsightsderivedfromtheIPEEEcouldnotbeconfirmed asbeingcompletely robust.Thisconclusion stemmedfromthefactthatanumberofsimplifying approximations wereintroduced atvariouspointsinthelicensee's IPEEEprocess,andtheeffectsofthesesimplifying assumptions werenotadequately addressed intheIPEEEsubmittal andsubsequent responses toNRCqu'estions.

Inaddition, thefragility analysisoftheicecondenser requiredadditional refinement.

Theimplication ofthesepointswasthattherankingofdominantriskcontributors neededtobebetterjustified, andcouldlikelychange.Thepreliminary insightsastothedominantseismiccontributors tocoredamage,basedonthelicensee's IPEEEsubmittal

[1],aresummarized asfollows:Theinitiating eventswhichdominatetheanalysisare:1.LossofOffsitePower2.Steamline/Feedline Break3.LossofServiceWaterSystemThedominantcontributors toseismiccoredamageriskare:LossofElectricPowerSystemsa.600VACTransformers b.DieselGenerator FuelOilDayTank2.Auxiliary BuildingSeismicFailureSecondary contributors toseismiccoredamagefrequency are:1.'.3.4.5.EnergyResearch, Inc.ReactorProtection System(RPS)Failures(Miscellaneous Panels)Turbine-Driven AFWPump(RandomFailures)

TurbineBuildingPedestal250VDCPanels4160VACSwitchgear ERI/NRC95-501

BasedontherevisedIPEEEsubmittal

[4],theforegoing insightschangedonlyslightly, tothefollowing:

Theinitiating eventsthatdominatecoredamageriskintherevisedanalysiswereassessedas:1.LossofOffsitePower(FailureofCeramicInsulators) 2.DirectCoreDamage(Dominated ByContainment Structural FailureduetoSoilPressure)

Thefollowing threeinitiators haverelatively equalcontributions tocoredamagerisk:a.Steamline/Feedl incBreak(FailureofSecondary Piping/Supports) b.LossofEssential ServiceWaterSystem(Screenhouse Failure)c.'argeLOCA(FailureofPressurizer Supports)

Thereviseddominantcontributors toseismiccoredamageriskare:1.Auxiliary Building(FailureofSteelColumnsSupporting CraneGirders)LossofElectricPowerSystemsa.600VACTransformers (BlockWallFaHure)b.DieselGenerator FuelOilDayTank(BlockWallFailure)3.Turbine-Driven AFPump(RandomFailures)

Lesser,butnotable,contributors include:4.250VDCSystem5.ReactorProtection System(FailureofMiscellaneous Panels)6.IceCondenser Thattheauxiliary buildingisassessedasadominantriskcontributor (inboththeoriginalandrevisedanalyses) issomewhatunusualincomparison toresultsofotherSPRAstudiesofPWRs.Reviewoftherevisedfragility calculation fortheauxiliary buildingcolumnsrevealspotential sourcesofconservatism.

Specifically, theallowable ductility appearslow(producing alowmarginfactorassociated withinelastic energydissipation).

Thefragility analysisalsostatesthatpeakseismicstressesfordesignbasisloadingexceed80%ofthedesignallowable

stresses, andhence,nomargin(orvariability) pertaining toyieldstrengthisused.Inreality,however,somelevelofmarginislikelyindicated.

Areviewofallrevisedfragility calculations alsorevealsthatthereisnomargin/variability associated withdamping,andnovariability associated withafailurecriterion (e.g.,failureductility, failuredrift,etc.).Inaddition, therevisedfragility calculation submittal doesnotexplainwhyspectralshapemarginfactorsgreaterthanunityarealwaysused,whereasforhigh-frequency

()8Hz)components, thesite-specific PRAspectralordinates exceedthoseforthedesignbasisspectrum.

Theseproblemscanleadtopotential conservatisms ornonconservatisms inthefragility analyses.

EnergyResearch, Inc.ERI/NRC95-501 Blockwallfailureshavebeenidentified asitemsofconcernfrompastseismicPRAs;hence,theidentification ofblockwallfailuresasdominantriskcontributors intheCookIPEEEisnotparticularly surprising.

Itisnoted,however,thatthereisareasonable probability thatfailureoftheblockwallseparating thetwo(Unit1andUnit2)600VACtransformers willnotleadtofailureofeithertransformer; hence,theassumption thatblockwallcollapsealwaysleadstotransformer failureisalsoconservative.

Incontrasttothesepotential conservatisms, analysesofotheritemsappeartobesomewhatnonconservative, andsuchitemscouldwellberevealedasdominantcontributors undermeaningful variations inanalysisassumptions.

Forexample,poorwelddetailing of4kVswitchgear (cabinetplugweldedtoshimplates)islikelytosubstantially limittheseismiccapacity, whereasarelatively highseismicdesigncapacity(whichwasnotfullyjustified/developed intherevisedIPEEEsubmittal) wasusedinthefragility analysis.

TheseismiccapacityofCCWheatexchanger supportsislikewisejudgedtobesomewhatlowerthanthatdeveloped intherevisedCookIPEEE.Forthesereasons,andothers,thedominantcontributors assessedintherevisedCookseismicIPEEEarestillconsidered tobesomewhatquestionable.

Thecurrentinsightsare,nonetheless, considered tobeuseful.However,moremeaningful insightscouldperhapsbedrawnifjustified refinements andvariations inanalysisassumptions wereconsidered.

Revisions tocontainment performance insightswerenotexplicitly developed aspartoftherevisedCookIPEEE.TheoriginalIPEEEsubmittal conclusions withrespecttocontainment performance underseismiceventsincludethefollowing

[1]:Containment mechanical penetrations andcontainment isolation valvesweredetermined tohavehighcapability towithstand directfailuresduetoseismicevents.Hydrogenigniterswerealsofoundtobeveryruggedseismically (inwithstanding directfailures),

andwerescreenedoutofthecontainment-performance evaluation process.(However, failureofelectricpowertotheigniterswasevaluated.)

2.ReactorProtection System(RPS)failure,whichresultsinfailuretoisolatethecontainment, andconsequently wasassumedtoresultincontainment bypass,contributes lessthan1%tothetotalseismiccoredamagefrequency.

3.Directseismicfailureofthecontainment building(dominated bysoil-pressure failure)contributes approximately 1%tothetotalseismiccoredamagefrequency.

4.Directseismicfailureoftheicecondenser wasdetermined tohaveanotable(yetlow)contribution toseismiccoredamagefrequency.

Someofthemostdamagingseismicsequences involvealossofdecayheatremoval(failureoftheEmergency CoreCoolingSystem[ECCS]orofauxiliary feedwater tothesteamgenerators) inconjunction withfailureofthecontainment spraysystem.(Although thesesequences apparently havethelargestcontribution toseismiccoredamagefrequency amongthosesequences havinginadequate containment performance, theIPEEEsubmittal doesnotprovideaquantitative valueoftherelativecontribution.)

EnergyResearch, Inc.10ERI/NRC95-501 0

Theseconclusions mayhaveslightlyalteredduetochangestoLevel-1PRAresultsintherevisedseismicIPEEE.Licenseeresponsetoaquestion, relatedtorevisedcontainment-performance

insights, thatwasposedduringthe'October 25,1995meeting,suggeststhattherelativecontribution tooverallcontainment-failurerisk,ofcontainment soil-pressure failure,hasincreased fortherevisedstudy(ascomparedtotheoriginalstudy).Areviewoftheoriginalfragility analysisconducted fortheicecondenser containment revealeda.numberoproblemsinthemethodology andcalculations.

Arevisedseismicfragility analysiswasconducted fortheicecondenser, butthecalculations werenotreviewed.

Itisnoted,however,thatfragility parameters fortheicecondenser nowappearmuchmorereasonable.

TherevisedseismicIPEEEsubmittal concludes thatpotential failureoftheicecondenser isstillanotablecontributor tocoredamagerisk.Thisconclusion, andtheoriginalIPEEEobservation thatpotential icecondenser failurecontributes meaningfully totheriskofpoorcontainment performance, areviewedtobevalid.Relativetoseismiccontainment performance, neithertheoriginalnorrevisedseismicIPEEEsubmittal providesinsightsregarding theexpectedtimingandmagnitude ofradioactive releasesassociated withtheplantdamagestatespertaining totheaforementioned categories ofcontainment failure.Inadditiontotheforegoing plant-specific insights(pertaining todominantriskcontributors) aserived/revealed fromanalysis, anumberofimportant insights(pertaining primarily tonon-design-related eficiencies) werealsoderived/revealed asaresultofdirectobservation inplantseismicwalkdowns.

hesewalkdown-related insightswerediscussed aboveinSection1.1.1.1,underIPEEEobjective (d).Theyincludeconcernsassociated withthefollowing items:blockwalls,fire-extinguisher mountings, fireprotection pilotlines,fluorescent lightsincontrolroom,missing/broken anchorage onsomemotorcontrolcenters,seismically inducedfiredueto failureof thesupportofa 17-tonCOtankearthuak-dhdrazinesillandy'i,anseismicinteractions involving themovablein-corefluxmappin~system.Mtfthesewalkdown-related insightscanbeclassified asgenericinsightsapplicable toallplantswheresuchcomponents canbefound.1.2.1.3SummaryEvaluation ofSubmittal Basedonthesiteaudit,andreviewofinformation suppliedbythelicensee, itappearsthatthelicenseehasdeveloped anappreciation ofsevereaccidentbehavior, gainedaqualitative understanding oftheoveralllikelihood ofcoredamage,andadequately assessedcontainment performance.

AsaresultoftheseismicIPEEE(primarily thewalkdowneffort),anumberofplantimprovements havebeenidentified andimplemented.

Also,thelicenseeappearstopossessanunderstanding oflikelysevereaccidentsequences thatcouldoccuratitsplantunderfullpoweroperating conditions, thouhtherelativerankinfthsuencesmaneqyotbeprecise,dueinparttoafewquestionable fragility analysisassumptions.

1.2.2FireThefireportionoftheSummaryReportoftheD.C.CookIPEEEsubmittal

[1]providesaconciseviewoftheworkdonetoidentifythepotential fireconcerns.

Thereportisbasedontheconditions setforthinSupplement 4ofGenericLetter88-20[3].Fromtheinformation providedintheSummaryReport,theLicensee's ResponsetoNRCQuestions

[2],initialfireriskanalysis[10],andrevisedfireriskanalysis[11]itcanbeconcluded thatthelicenseehasusedapropermethodology anddatabaseforconducting thefireEnergyResearch, Inc.ERI/NRC95-501

analysis.

Level1firePRAmethodology hasbeenemployedthathasincludedascreening procedure basedonascreening criterion of10'erreactor-year forcoredamagefrequency.

Thefollowing aresomegeneralcommentsregarding theadequacyoftheD.C.CookIPEEEfireanalysis:

Theoverallfirecoredamagefrequency (3.76x10~

peryear)issomewhatsmallerthanthattypically concluded inotherfireriskstudies.Nocriterion hasbeensetforthastowhatconstitutes afirevulnerability, andnofireoccurrence scenariohasbeen.identified asunacceptable..

1.3.1SeismicTheseismic-related sectionsofthisreportdocumenttheresultsofaStep-2seismicreviewoftheD.C.CookIPEEE.AStep-1reviewwasconducted bytheNRC,resulting inanumberofquestions requiring furtherclarification fromthelicensee.

ThepresentStep-2seismicreviewhasauditedinformation suppliedinthelicensee's originalIPEEEsubmittal, aswellasintheresponses providedbythelicenseetothe16NRCquestions relatedtoseismicissuesraisedintheStep-1review.ThepurposeofthisStep-2reviewistoaddressquestions andconcernsthatweredeveloped asaresultoftheStep-1reviewandtoprovideanindependent perspective onthestrengths andweaknesses oftheIPEEEsubmittal.

Theemphasisandguidelines described intheNRCreport,IPEEEReviewGuidanceDocument[12],fortheappropriate typeofIPEEEstudy(i.e.,aSeismicPRAinthepresentcase),werefollowedintheseismicauditprocess.Thisprocessconsistsoffourmajoraspects:(1)pre-sitevisitreview,(2)sitevisit,(3)post-site visitevaluation, and(4)documentation ofimportant findings.

Execution ofallrelevantactivities, andconsideration ofallissues,asdescribed inFigure3.1ofReference

[12](provided hereasFiguresA.ltoA.4ofAppendixA)hashelpedserveasasystematic basisinevaluating strengths andweaknesses ofthelicensee's seismicIPEEEsubmittal, inevaluating whetherornottheseismicIPEEEsubmittal meetstheGuidelines ofNUREG-1407, andinascertaining theextenttowhichtheseismicIPEEEsubmittal satisfies theoverallobjectives oftheIPEEEandintentofSupplement 4toGenericLetter88-20.1.3.2FireTheSummaryReportoftheD.C.CookIPEEE,theLicensee's ResponsetoNRCQuestions, andtheAppendixRsubmittal

("SafeShutdownCapability Assessment, ProposeModifications andEvaluations"

[13])wereinitially receivedandreviewedpriortothesitevisit.Atthisstageapreliminary reviewwasconducted according toSection4oftheIPEEEReviewGuidanceDocument[12].Fromthepreliminary review,anagendawasdeveloped forasitevisitandaninterview ofLicensee's personnel.

Asitevisitwasconducted, whichincludedabriefplantwalkthrough andthereviewofseveralfireanalysisrelateddocuments.

Atthispoint,acopyofthefireriskanalysisreport[10]wasreceivedandreviewedbytheauditteam.Abriefreportofthereviewfiindings waspresented tolicenseepersonnel aspartoftheexitinterview.

EnergyResearch, Inc.12ERI/NRC95-501 Thelicensee, basedonthecommentsreceivedduringthesitevisitandexitinterview, revisited thefireriskanalysisandpresented itsprelim;nay resultsinameetingwiththeNRCandtheauditteamonOctober25,1995.Theauditteamgenerated asecondsetofcomments, whichwerepresented tothelicenseeattheendofthemeeting.Thelicenseereissuedthefireriskanalysisreport[11]whichservedasthebasisforthefinalconclusions oftheauditteam.1.41A.1,SeismicPre-sitevisitactivities consistofperforming adetailedreviewoftheIPEEEsubmittal andrelatedlicenseeresponses toNRCquestions.

Asdiscussed inSection1.2.1,pre-sitevisitevaluation hasbeenbasedonthepertinent checklist foundinReference

[12],whichisreproduced inthisTERasFigureA.l.Theobjectives havebeentoevaluateasmanyoftheissuesidentified inthechecklist ofFigureA.1aspossible, fromtheinformation providedintheIPEEEsubmittal, andtoidentifyitemsrequiring clariifiication and/orspecialattention inthesiteauditvisit.NTheseismicauditfocusesonverifying whetherornotthelicensee's overallIPEEEprocessisavalidapproachforassessing potential plantimprovements, onjudgingwhetherornottheresulting insightsarereasonable andtechnically wellfounded,andonascertaining thestrengths andweaknesses ofthestudy.Theauditisnotintendedtoprovideanexhaustive checkonquantitative results;however,suchresultsshouldbeverifiedasreasonable and/oraccurateforcertaincriticalaspectsoftheanalysis.

Inreviewing theD.C.CookoriginalIPEEEsubmittal, limitedactual-verification ofnumerical resultshasbeenperformed, primarily becauseinsufficient analytical detailandassociated plantdataareprovidedinthesubmittal tochecktheanalysisprocedures.

TheemphasisoftheD.C.Cooksubmittal isondescribing theoverallprocedures andthemajorfindingsoftheSPRA.Supporting dataandanalytical reportsareheldbyAEPSCandweremadeavailable duringthesiteauditvisit.Themajorportionofthepre-sitevisitseismicaudit,therefore, hasbeeninvolvedwithdeveloping preliminary auditfindingsbas'edonapaperreviewoftheIPEEEsubmittal andwithdeveloping asiteauditplancapableoffinalizing theauditfindingsandidentifying specificissuesofconcern,ifnecessary, throughphysicalinspection.

Becausecompletemodelingandanalysisdetails(e.g.,fragility calculations) werenotprovidedintheIPEEEsubmittal, andbecauseitwasnotpossibletoadequately reviewsuchdetailspertaining tocriticalelementsoftheIPEEEduringthetimeperiodofthesitevisit,someaspectsofnumerical verification wereconducted afterthesitevisit.ThelicenseeoftheD.C.Cookplanthad,however,submitted asomewhatdetailedfragility assessment ofthecontainment icecondenser, inresponsetoNRCrequest.Areviewofthis&agilityanalysiswasperformed aspartofthepre-sitevisitactivities.

Reviewofthesite-specific hazardstudyforD.C.Cookwas'performed internally withintheNRC,andhasnotbeenapartofthepre-sitevisiteffortinthisaudit.1.4.2Fire13AreviewoftheSummaryReportoftheD.C.CookIPEEE,theLicensee's ResponsetoNRCQuestions, andtheAppendixRsubmittal

("SafeShutdownCapability Assessment, ProposeModifications andEnergyResearch, Inc.ERI/NRC95-501 Evaluations"

)wasconducted usingSection4oftheIPEEEReviewGuidanceDocument[12].Thefirstdraftofthisreportandanagendaforthesitevisitweredeveloped basedonthisinitialreview.Also,a'istofinformation itemsthatwerenecessary forcompleting thereviewwasassembled.

1.51.5.1SeismicCAsiteauditoftheD.C.CooknuclearplantandonsitereviewofIPEEEdataandkeyplantconfiguration wereconducted onJuly26-28,1994.Drs.R.T.Sewelland,M.V.Frankparticipated ascontractor seismicreviewers.

Thefirstdayofthesiteauditconsisted ofthefollowing twoefforts:(1)NRC/Reviewer-Panel elicitation ofLicensee/Contractor Panelresponses tokeyquestions/concerns thatcouldbereadilyclarified, and(2)in4epthexamination ofdataandanalyseswithinputfromlicensee's IPEEEparticipants whodeveloped andperformed therelevantanalyses.

Thefirste8ortaddressed thoseitemsidentified inSectionA.1ofthisTERthatcouldbeanswered.

Thoseitemsrequiring amorelengthyreview,and/orone-on-one interview withtheappropriate IPEEEparticipant, wereaddressed inthesecondeffort.Thesecondhalfofthefirstdayofthesiteauditwasspentprimarily onreviewing detailedseismicwalkdownmethodsandfindings, fragility calculations, seismiceventtreeandsystemsanalyses, andseismicriskquantification approach.

Theseconddayofthesiteauditwasdevotedtoawalkdownoftheaccessible areasoftheplant.Thefocusofthewalkdownwasonverifying thecondition ofmajoritemsidentified fromtheIPEEEwalkdownfindings.

Theseitemsincludedbothnon-safety-related issuesandsafety-related issues.Conditions thatcouldpotentially limittheseismiccapacityofrisk-significant components wereexamined.

iThethirddayofthesiteauditinvolvedexamination ofadditional IPEEEdataandanalyses, development ofalistofsiteauditquestions andconcerns, andanexitmeetingwiththelicensee/contractor IPEEEparticipants topresentthesiteauditreviewfindingsandobservations.

AppendixA,SectionA.2presentsasummaryofthefindingsandconcernsfromtheseismicsiteaudit.Aprincipal observation thatwasimmediately evidentfromthesiteauditwasthatamuchgreaterefforthadbeenexpendedontheseismicIPEEEthanindicated bytheoriginalIPEEEdocumentation.

Theinitialpanelreview,andsubsequent in-depthdiscussions, weresufficient toalleviate anumberofpotential concernsbasedonthepre-sitevisitreviewalone.Thewillingness oflicenseeandcontractor personnel toassistinthesiteauditrevieweffortalsoassistedinexpediting thedisposition ofmanyconcerns.

However,anumberofnotableconcernsremainedafterthesiteaudit,thoughthesiteaudithelpedtobetterfocusthenatureoftheseconcerns(seeSectionA.2)..Thefollowing subsections describevariousaspectsofthesiteauditprocess.1.5.1.1Information AuditedTheseismicsiteauditincludedanevaluation ofthefollowing information:

plantlayoutandconfiguration

drawings, documentation fromkeyUFSARsections, seismicIPEEEwalkdownreports(contractor reports),

documentation offragility analysismethodology, IPEEEfaulttreesandIPEfaulttrees,andrelevantIPEdocumentation.

EnergyResearch, Inc.ERI/NRC95-501

1.5.1.2Personnel Interviewed Thepanelsessionwasconducted amongallattendees oftheIPEEEsiteauditmeeting.Specificindividuals interviewed, onaone-on-one basis,duringtheseismicsiteauditincluded(inorderofinterview sequence):

Mr.StevenHarris,EQE,regarding IPEEEwalkdownprocedures andfindings.

Dr.WilliamLaPay,'estinghouse, regarding fragility analysismethodsandmethodforincorporating walkdownconcernsinthefragility analysisprocess.Mr.RickBennett,AEPSC,regarding systemsanalysisandapplicable IPEmodelingandfindings.

Mr.MartyCamp,D.C.CookPlantOperator(LabelsSupervisor),

regarding equipment locations duringplantsiteauditwalkdown.

1.5.1."3AreasWalkedDownSeveralplantareaswerewalkeddownintheturbinebuildingandauxiliary

building, aswellasportionsofthegroundssurrounding theplant.Nowalkdowns wereperformed inthecontainment buildingorscreenhouse structure.

Specificareas/components walkeddowninclude(roughlyinorderofsequenceofwalkdown):

Groundstothenortheast oftheplant,including groundslopeimmediately eastoftheplantandareasaroundtheUnit1RWSTandCSTTurbinebuildingbasementEssential ServiceWater(ESW)pumphousingandadjacentstrainerandsupporting concretepedestals AFWPumpRoomESWPiping/Bellows betweenTurbineandAuxiliary Buildings DieselGenerator Room(transformer, lubeoilheater,lubeoilsumptank,lubeoilfilterMCC),FuelOilDayTankEnclosure (blockwalls)Switchgear Room(4kVswitchgear anchorage) and600VACTransformer Area(including blockwall)BatteryRoom(batteries andracks)BatteryChargersandInverters ControlRoom(fluorescent

lighting, miscellaneous panels,RPScabinets, bracingoffalseceiling)0EnergyResearch, Inc.Hydrazine storagelocations 15ERI/NRC95-501

FireExtinguisher Mountings inAuxiliary BuildingRHRHeatExchanger/Supports CCWHeatExchanger/Supports CCWPumpFireProtection PilotLines(onelocation)

HalonTanksMCCslocatedinAuxiliary Building17-tonCO,TankControlRoomCableVault1.5.14Treatment ofPrincipal Issues'presented in1.5.2FireTheprincipal issuesofconcernrelatedtothefragility methodology, treatment ofsystemsanalysisdependencies, anddisposition ofwalkdownfindings.

Alistanddescription ofprincipal itemsofconcernidentified asaresultofthesiteaudit,andpresented tothelicenseeatthesiteauditexitmeeting,isAppendixA,SectionA.2.AsiteauditoftheD.C.CooknuclearplantandonsitereviewofIPEEEdataandkeyplantconfiiguration wereconducted onJuly26-28,1994.Dr.M.Kazarians participated asthecontractor firereviewer.

Thefollowing subsections describevariousaspectsofthesiteauditprocess.1.5.2.1Information AuditedAlargearrayofdocuments weremadeavailable tothereviewteam.Theteamfocusedparticularly onReferences 10,14,and15.AcopyofReference 10wasprovidedforthereviewteamtoenablepost-site auditreview.Reference 10wasreviewedtounderstand thebasisofthestatements madebythelicenseeinReferences 1and2.Reference 15wasusedforplanningtheplantwalkthrough andreviewofspecificfirezonesaddressed intheIPEEE.Reference 14wassubjected toacursoryreview.Itcontainstheinputandoutputinformation fortheCOMPBRNrunsusedintheinitialfireriskanalysis.

1.5.2.2Personnel Interviewed Theauditincludedanopeningmeeting,whichinvolvedmembersoftheseismicaudit,AEPengineers andtheconsultants involvedinthepreparation ofthePRAandthefireriskanalysis(References 10and14).EnergyResearch, Inc.16ERI/NRC95-501

Aspartoftheopeningmeeting,theAEPteammembersprovidedahistoryofthefireriskanalysisandfireIPEEE.Aftertheinitialopeningdiscussions, twomeetingswereheldonthefirstdayofthevisit,wherefireIPEEEissueswereaddressed.

Inthefirstmeeting,J.RussellSharpe,JohnGirlinandMarkWilkinswereinterviewed.

Inthismeeting,theAEPteamwasaskedtoprovideastep-by-step explanation ofhowthefireriskanalysiswasconducted.

Specialattention wasgiventothescreening procedure, anddatausedforconducting it.Inthesecondinterview, theuseoftheIPEsystemsandriskmodelforIPEEEfirescenariocoredamageanalysiswasreviewedwiththesamegroupofprofessionals fromAEP,andtheirconsultants.

1.5.2.3AreasWalkedDownAtouroftheplantwasconducted ontheseconddayoftheaudit.Thefireauditteamwasaccompanied bytheAEPfireriskanalysisteamandaplant-stationed employeefamiliarwithAppendixRrelatedissuesandfireprotection.

Theareasvisitedbythefireauditteamincludedthefollowing:

ControlroomsofUnits1and2ControlroomcablevaultforUnit2TurbinehallErigineered safetysystemandMCCroomElectricPowerSystem(EPS)transformer roomEPSmotorcontrolroomEPSbatteryroomSwitchgear cablevaultESWpumproomESWmotorcontrolcenterAuxiliary Feedwater pumproomsArea6NofAuxiliary BuildingElectrical Penetration RoomIntheauxiliary

building, thevariouslocations whereLocalShutdownIndicator (LSI)panelsarelocatedwerevisited,andtheLSIfunctions ofthoselocations werereviewed.

1.5.2.4Treatment ofPrincipal IssuesTheprincipal issuesofconcernrelatedtogaininganunderstanding of(1)howtheIPEEEwasconducted, (2)whatdocumentation wasgenerated, (3)howthisdocumentation supportsthestatements madeintheSummaryReport,and(4)howtheplantisconfigured (layout),

including thelocationofsafety-related cablesandequipment.

Alistanddescription ofprincipal itemsofconcernidentified asaresultofthesiteaudit,andpresented tothelicenseeatthesiteauditexitmeeting,ispresented inAppendixB,SectionB.2.EnergyResearch, Inc.17ERI/NRC95-501

1.61.6.1SeismicInresponsetoconcernsraisedduringthesiteaudit,AEPSCundertook asignificant revisiontotheoriginalCookseismicIPEEE.Itisassumedthat,indeveloping thisrevisedseismicIPEEE[4],thelicenseeconsidered allissuesraisedduringthesiteaudit,byeither:verifying thattheydidnotrequireadditional specialtreatment; orexplicitly andmeaningfully accounting fortheirimpactsonIPEEEmodelingandresults.Duetopractical restraints thatlimitthedepthandscopeofthereviewprocess,ithasnotbeenpossibletocontinually pursuealldetailsofthelicensee's IPEEEanalysisateverystepinthereviewprocess.Thepost-site visitreview,therefore, hasemphasized themajorconcernsthataroseasaresult'fthesiteaudit,andthatwerejudgedtobeofpotential concernintherevisedIPEEE.Thelicenseepresented theapproachandpreliminary resultsoftherevisedseismicIPEEEatameetingwiththeNRCheldonOctober25,1994.Presentation oftherevisedseismicanalysisfocusedonthefollowing changes:revisiontofragility analysisapproachandcalculations forselectedcomponents (including incorporation ofSoil-Structure Interaction

[SSI]marginfactors);

refinements inseismicquantification process;analysisofliquefaction potential ofslopeat'theeasternborderoftheplantandoftheintakestructure foundation soil(alongtheshoreofLakeMichigan);

andLevel-1riskre-quantification.

Thepreliminary revisedanalysisresults(whicharedifferent fromthefinalrevisedanalysisresults)producedaseismicCDFof5.1x10/ry(ascomparedtotheoriginalCDFresultof1.83x10'/ry, andthefinalrevisedCDFresultof3.17x10~/ry).

Thedominantcontributors revealedfromthepreliminary revisedanalysisincluded:

(1)auxiliary

building, (2)cabletrays,(3)4kVswitchgear, and(4)masonrywallenclosing theDGfueloildaytank.Thesedominantcontributors arenotedtobedifferent thanthosepresented forthefinalrevisedanalysis, which(significantly) doesnotlist4kVswitchgear.

Asaresultofthepresentation ofthepreliminary revisedseismicIPEEE,someremaining concerns/questions werenotedandforwarded tothelicensee.

Thesesevenquestions aresummarized inSectionA.3ofthisTER.Considering thesequestions, thelicenseedeveloped afinalrevisedseismicIPEEEanalysisand forwarded theresultsandresponses totheNRCinatransmittal datedFebruary15,1995.ThefinalrevisedseismicIPEEEsubmittal andlicenseeresponses toOctober25,1995questions

.werereviewedindetailtoconcludetheStep-2IPEEEseismicreviewprocessforD.C.Cook.IncludedinthefinalIPEEEtransmittal forCookwereanumberofrevisedfragility calculations, explanation ofSSImarginfactors,andre-analysis resultsAparticularly noteworthy observation fromtherevisedIPEEEsubmittal

[4]isthatsignificant improvements wereimplemented inthefragility analysismethodology.

Morerealistic valuesofcomponent mediancapacities andvariability parameters weredeveloped.

(Theoriginalfragility resultshadunrealistically lowmedians,andP'sofzerowereassigned.)

Despitethesedramaticimprovements, casesofnonconservatisms andconservatisms havebeenidentified duringthereviewofthe&agilityre-analysis.

Thesechallenge therankingandlistofdominantriskcontributors.

Forinstance, 4kVswitchgear, whichdisappears fromthedominantcontributors listinthefinalrevisedIPEEE,would(infact)beidentified asadominantcontributor ifj>>stifiable modifications weremadeintheanalysis.

Forthesereasons,therankingofdominantcontributors isnotconsidered toberobust(andtheseismicanalysis, ingeneral,wouldnotberecommended asamodelstudy).Nonetheless, areasonably completelistofdominantcontributors isconfirmed/obtained asthecollective setofdominantcontributors fromtheoriginalIPEEE,EnergyResearch, Inc.18ERI/NRC95-501 preliminary revisedIPEEE,andfinalrevisedIPEEE.Eventhoughtherankingofdominantriskcontributors maynotbeprecise,theIPEEEprocesshasapparently identified thesetofsignificant contributors.

Consequently, thelicensehasreasonably demonstrated thatnoimportant contributors arebeingmaskedintheanalysis.

Inaddition, thedemonstratedly lowseismicriskalsohelpstoalleviate concernsoftheimplications ofpotentially maskeddominantcontributors.

Thepost-site auditreviewhas,therefore, beenakeyelementinformulating afinalpositiononthevalidityoftheCookseismicIPEEEfindings.

1.6.2FireInresponsetoconcernsraisedduringthesiteaudit,AEPSCundertook asignificant revisiontotheoriginalfireanalysis.

Thelicenseepresented theapproachandpreliminary resultsoftherevisedanalysisatameetingwiththeNRCheldonOctober25,1994.Therevisedanalysishadincorporated theproperassumptions regarding cableandequipment Mure,hadrevisedthescreening procedure, andhadincludedanalysisoffirezonesthathadbeenscreenedoutbasedonengineering judgment.

Basedontheinformation presented inthatmeeting,additional commentsandconcernswerepresented tothelicensee.

Thelicensee, usingthecommentspresented tothem,issuedarevisedfireriskanalysisinFebruary1995.Thecommentsandconclusions ofthisfinalTERarebased,primarily, ontherevisedfiieriskanalysisreport.EnergyResearch, Inc.19ERI/NRC95-501

2.AUIHTFINDINGS2.lSeiSmhAnumberofobservations concerning theCookseismicIPEEEandStep-2reviewprocesshavebeendescribed intheprevioussectionsofthisTER.Thissectionpresentstheauditfindingsformajorcategories ofseismicreview.Preliminary andfinalauditfindingsarebothdescribed.

Amorecomprehensive listofspecificissuesidentified duringtheauditprocessisprovidedinAppendixA.2.1.1Relevance ofIPEEEProcesstoActualPlantandConfiguration Thelicensee's overallseismicIPEEEprocessishighlyrelevanttoassessing theresistance ofD.C.Cooktopotential severeseismicaccidents.

Thesubmittal itselfdoesnotconveysignificant information onthetype,design,function, layout,operation, andothernoteworthy aspectsoftheplantconfiguration.

Including additional basicplantdataintheseismicIPEEEsubmittal wouldhaveenhanceditsusefulness.

However,thesiteaudithelpedrevealthattheIPEEEadequately modelstheactualplantconfiguration atD.C.Cook.Thescope,procedures, andqualityofplantseismicwalkdowns, andtheuseofcontrolled plantdata,havebeensufficient indefiningthestateandconfiguration oftheplantforpurposesofevaluating itsresistance topotential severeaccidents initiated byseismicevents.2.1.2AccidentFrequency Estimates Thelicensee's estimates ofaccidentsequencefrequencies wereinitially inerror.Numerical errorsininitiating eventfrequencies werefoundthatneededtoberectified.

Moreimportantly, anumberofmodifications inthefragility analyses(asdescribed inAppendixA.1)neededtobeincorporated tohelpinsureaccuratequantification ofaccidentfrequencies.

Thesechangeshave,forthemostpart,beenimplemented inthefinalrevisedseismicIPEEE[4].Consequently, therearenosignificant remaining concernswiththegenerallevelofaccidentfrequency estimates.

2.1.3LogicModelsTheplantlogicmodels,including eventtrees,faulttrees,minimalcutsets,plantseismicmatrix,etc.,neededtobereviewedandevaluated duringthesitevisit,inordertoassessthereasonableness andapplicability ofthesystemsanalysis.

Commentsweremadeattheendofthesitevisitconcerning neededimprovements inthesystemsanalysis.

Itisassumedthatthelicenseehasappropriately addressed theseimprovements inthefinalrevisedIPEEEsubmittal.

2.1.4ProcesstoIdentify, Eliminate orReducetheEffectsofVulnerabilities Theidentification ofphysically evidentseismicdeficiencies intheplantwalkdowns isconsidered tobewellexecuted.

Licensee's evaluation andtreatment ofcost-effective safetyenhancements toeliminate orreducetheeffectsofthesedeficiencies originally appearedvagueandlargelyunresponsive totheintentofsevere-accidentpolicy.Subsequent consideration oflicenseeactionsinresponsetotheseismicIPEEE,asrevealedduringthesiteaudit,helpedtodemonstrate thatmeaningful plantimprovements hadbeenimplemented.

Table1.1ofthisreview,forinstance, listsactionstakeninresponsetowalkdownfindings.

Inaddition, relaychatterevaluation (whichwasessentially treatedinUSIA-46)hasidentified bad-actor relays,whichthelicenseehastargetedforreplacement.

EnergyResearch, Inc.20ERI/NRC95-501

Theoverall(quantification) processusedinidentifying dominantriskcontributors throughanalysisisnowconsidered tobewellexecuted.

Problemsintheoriginalfragility evaluations posedaveryrealpotential toinvalidate thelistofdominantcontributors.

Therankingofdominantcontributors isstillnotconsidered tobeprecise.Thelicenseehasproposednosafetyenhancements pertaining todominantriskcontributors, largelybecausetheplantseismicriskhasbeendemonstrated tobelow.2.1.5Vulnerabilities Requiring FurtherAnalysis2.1.5.1Vulnerabilities Affecting AccidentPrevention Someitemsidentified inseismicwalkdowns conducted byth'elicenseeshouldbeinvestigated infurtherdetail.Theseitemsrelateto:poorfire-extinguisher mountings, potential interaction problemswithfireprotection pilotlines,andpotential interaction problemsassociated withfluorescent lightsinthecontrolroom.Theseitemsmaynotbetrueoutliers, atleastwithdirectrespecttoseismiccoredamagerisk;however,theymayexacerbate problemsexperienced duringseismicevents,andtheycouldpotentially impactplantsafety.2.1.5.2Vulnerabilities Affecting Containment Performance TheseismicIPEEEsubmittal doesnotspecifically identifycontainment-performance concernsandpotential opportunities forimplementing cost-effective safetyenhancements relatedtoaccidentmitigation.

Giventhescopeofitemsassociated withsuccessful containment performance, itseemsreasonable toquestionthisresult.Althoughnotspecifically includedaspartofIPEEEresolution, itwouldbeofbenefitforthelicenseetoaddressspecialContainment Performance Improvement (CPI)concernsthatmayarisefromseismicinitiators.

ForPWRicecondenser containments, theprincipal CPIissueisthatofevaluating vulnerability tointerrupted powersupplytohydrogenigniters, andneedforimprovement.

Sincelossofstationpowerisasignificant contributor toseismiccoredamageatD.C.Cook,itwouldbeworthwhile forthelicenseetoconsidercandidate actionsforproviding analternate powersupplytohydrogenignitersthatisaccessible following amajorseismicevent.Othercandidate actionswouldbetoimprovethe'apability andoperatoractionsnecessary tomaintaincontainment sprayfunctionfollowing anearthquake.

Operatoractionsrelatedtohydrogenignitercontrolfollowing seismically inducedblackouts, and.subsequent powerrecovery, wouldalsobeworthwhile toconsider.

2.1.6DominantContributors:

Consistency withExternalEventsPRAInsights2.1.6.1DominantContributors toCoreDamageTheoriginalseismicIPEEEsubmittal identified thefollowing dominantriskcontributors tocoredamagefrequency:

600VACtransformers (masonrywallfailure),

dieselgenerator fueloildaytank(enclosing masonrywall),auxiliary

building, reactorprotection system(miscellaneous panels),turbinebuildingpedestal, 250VDCpanels,4160VACswitchgear, andrandomfailureofturbine-driven AFWpump.Thepreliminary revisedseismicIPEEEidentified thefollowing listofdominantcontributors:

auxiliary

building, cabletrays,4kVswitchgear, andmasonrywallenclosing theDGfueloildaytank.ThefinalrevisedseismicIPEEEfurtherdeveloped thefollowing dominant-contributor list:auxiliary building(failureofsteelcolumnssupporting cranegirders),

600VACtransformers (blockwa!1failure),

dieselgenerator fueloildaytank(blockwallfailure),

turbine-driven AFpump(randomfailures),

250VDCsystem,reactorprotection system(failureofmiscellaneous panels),andicecondenser.

AtthepresentEnergyResearch, Inc.21ERI/NRC95-501I time,therankingofdominantriskcontributors cannotbeconsidered asbeingveryprecise.However,thecollection ofitems(i.e.,unionofitems)identified asdominantcontributors aboveisconsidered tobeafairlyrobustlistingoftheprincipal elementsofseismicrisksignificance atD.C.Cook.Theitemsinthislistare,forthemostpart,consistent withinsightsdeveloped inotherseismicPRAs.2.1.6.2DominantContributors toRadioactive ReleasegivenCoreDamageTheseismicIPEEEsubmittal doesnotspecifically listdominantcontributors toradioactive releasegivencoredamage.Aqualitative description ofseismiccontainment performance isprovided.

Thisqualitative description suggeststhatfailureofthecontainment spraysystemaccompanies manyofthemostdamagingseismicsequences, andthusisadominantcontributor tofailureoftheaccidentmitigative functionofthecontainment system.Directsoilfailureofthecontainment andicecondenser failurealsomeaningfully impacttheriskofpoorcontainment performance.

2.1.7Evaluation ofDecayHeatRemovalVulnerabilities 2.1.7.1Evaluation ofProcesstoIdentifyVulnerabilities Detailsofthelicensee's treatment ofUSIA-45werenotdocumented intheCookIPEEEsubmittal.

USIA-45was,therefore, addressed inthesiteauditreview.ThisreviewrevealedthattheseismicIPEEEprocessiscapableofidentifying vulnerabilities relatedtoshutdowndecayheatremoval.TotheextentthattheseismicIPEEErealistically modelssevere-accident

response, therefore, USIA%5willbemeaningfully addressed.

ItisjudgedthattherevisedCookIPEEEadequately treatsUSIA-45.Itisnoted,however,thatitwouldbeappropriate forthelicenseetomorefullydocumentthebasisforUSIA-45resolution, relevanttoseismicconcerns, intheseismicIPEEEsubmittal itself.2.1.7.2Evaluation ofFindingsNospecialconcernsorneededplantimprovements, relatedtoshutdowndecayheatremovalrequirements following seismicevents,wereencountered.

2.1.8Evaluation ofMovableIn-CoreFluxMappingSystemVulnerabilities D.C.CookisaWestinghouse planthavingamovablein-corefluxmappingsystem.Thepresentreviewhasconsidered thelicensee's treatment ofGI-131(Potential SeismicInteraction Involving theMovableIn-CoreFluxMappingSystemUsedinWestinghouse Plants).2.1.8.1Evaluation ofProcesstoIdentifyVulnerabilities Thelicensee's treatment ofGI-131involvedareviewoftheseismicadequacyofflux-mapping cartuppersupports.

Asaresultofthisevaluation, thehold<ownstrapsattachedtothetopofthecartwereredesigned, andthedesignchangeswereimplemented.

Inaddition, alowerlateralrestraint tothefluxmappingcartwasinstalled atanelevation justabovethesealtable.Basedonthedesignchangesandresultsoftheseismicwa>kdown, aHCLPFcapacityof0.32gwasevaluated forfailureofrestraint ofthefluxmappingcart.EnergyResearch, Inc.22ERI/NRC95-501 2.1.8.2Evaluation ofFindingsThistreatment ofGI-131isjudgedtosatisfytherelevantconcernsassociated withthisissue.Theresulting contribution ofsealtablefailuretooverallfrequency ofseismically inducedsmallLOCA,however,wasapparently notconsidered intheseismicPRA.2.2ThefireanalysispartoftheIPEEEwasreviewedusingthequestions andtopicsprovidedinSection4oftheIPEEEReviewGuidanceDocument[12].AsummaryofthefindingsfromthatreviewisprovidedinAppendixB.l.Usingthecommentsdeveloped inresponsetothosequestions andtopics,thefollowing discussions areprovided.

2.2.1Documents ReviewedThefollowing documents werereviewedpriortothesitevisit:DonaldC.CookNuclearPowerUnits1and2,Independent PlantEvaluation, ExternalEvents,SummaryReport,AmericanElectricPowerServiceCorporation, April1992[1].~Attachment to'heletterdatedJuly22,1993fromE.E.Fitzpatrick, VicePresident ofIndianaMichiganPower,toT.E.MurleyofU.S.NuclearRegulatory Commission, Reference NumberAEP:NRC:1082G

[2]."SafeShutdownCapability Assessment, ProposeModifications andEvaluations

-10CFR50,AppendixR,SectionIII.G,"DonaldC.CookNuclearPlantUnits1and2,Indiana&MichiganElectricCompany,AmericanElectricPowerServiceCorporation, Revision1,December1986[13].Thefollowing documents werereviewedduringthesitevisit:~Memorandum fromJ.M.McNanietoDC-N-6280-4, COMPBRNinputs/outputs attachedtothememorandum, February28,1992[14].FHAdrawingsinD.C.CookFireHazardAnalysis, 1/31/92,Rev.6[15].~Cableroutinginformation aspartofAppendixRdocumentation.

Thefollowing documentwasreviewedduringthesitevisitandacopywasmadeavailable forthefireauditteamtoallowpost-site auditreview:"FireRiskAnalysis,"

D.C.CookPRAVolume11,April1992,Rev.0[10].Basedonthecommentsgenerdted bythisreviewteamonRevision0ofthefireriskanalysis[10],licenseerevisedtheanalysisandthensubmitted thefollowing documents:

EnergyResearch, Inc.23ERI/NRC95-501 LetterfromE.E.Fitzpatrick ofAEPtoU.S.NuclearRegulatory Commission, February15,1995[4].Attachment 1totheabovereferenced letter,"Response toNRCAuditConcernsandRequestforAdditional Information"

[4]."DonaldC.CookNuclearPlantUnits1and2,FireAnalysisNotebook,"

Revision1,February1995[11].Theinformation providedintheabovereferenced documents wereusedtogeneratethefollowing comments.

2.2.2Compliance withSupplement 4toGenericLetter88-20andNUREG-1407 Therequirements setforthinSupplement 4toGenericLetter88-20andinNUREG-1407

[5]aresimilar.UsingGenericLetterinstructions, thelicenseepreparedasummaryreport[1],whichwassubmitted totheNRC.Thesummaryreportprovidesashortdiscussion ofpractically alltheissuesthatareraisedintheGenericLetter,andusestheformatprovidedinTableC.1oftheGenericLetterforreportorganization.

Thelicenseehasprovidedadiscussion ofthecriteriatoidentifycriticalfirezonesandareas.Thelicenseehasprovideddiscussions forfireinitiation database,eventtreeandfaulttreemodeling, dominantfire-inducedcoredamagescenarios, coredamagefrequency, fire-induced containment

failures, andfireriskscopingissues.ThelicenseehasadoptedLevel1firePRAmethodology forcon'ducting theIPEEE,andhaspreparedafireriskanalysis[10,11].Consecutive screening stepshavebeenusedtoidentifythemostrisksignificant firezones.Coredamagefrequency (CDF)isusedfordiscriminating amongdifferent firezones.Intherevisedfireriskanalysis[11],thelicenseehasusedindustryhistorical firedatatoestablish fireoccurrence frequencies forindividual firezones.Forequipment andcablefailure,thesafeshutdownanalysisand.cableroutinginformation developed aspartofAppendixRcompliance havebeenused.Thelicenseeanditscontractors conducted twoplantwalkthroughs priortothesubmittal oftheIPEEE.Thesewalkthroughs wereperformed usingastandardchecklist, withcombustible loadingoffirezonesbeingverified, andtheissuesraisedintheSandiaFireRiskScopingStudy[16]beingaddressed.

Intheprocessofthepreparation oftherevisedfireriskanalysis[11],theanalysisteamrevisited thesiteandconducted additional walkthroughs ofthefirezonesthatwerefoundtoberisksignificant.

2.2.3Methodology EmployedTheD.C.CookIPEEEusedacommonPRAbasedapproachinwhichascreening analysiseliminates allbutarelatively fewfireareas.Adetailedeventtreeandfaulttreeanalysis, withthesemodelscomingfromtheIPE,isusedtoassesscoredamagefrequency fromlocalorglobalfireswithintheareasthatsurvivethescreening.

Elevenfirezonesareidentified asthemostrisksignificant.

Themethodpostulated completeunavailability ofallcomponents inafirezone,determined theinitiating event(s)causedbytheunavailability;-

modifiedthefaulttreesofeachoftherelevantIPEeventtrees,andquantified acoredamagefrequency.

EnergyResearch, Inc.24ERI/NRC95-501 2.2.4FireSusceptible Equipment andCablesTheequipment andcablesthatareconsidered forfireriskmodelingarethesameasthoseidentified forsafe.shutdownanalysis(i.e.,forAppendixRcompliance).

Furthermore, thelistofequipment usedforfireimpactmodelingincludedmotorcontrolcenters(MCCs)andvalvecontrolcenters'(VCCs),

whicharetypically notexplicitly modeledinPRAs.Forcontainment performance, theeffectsoffire,areanalyzedqualitatively usinganalogies withtheinternaleventsLevel2PRA.Itisnotclear,however,thatthelicenseehasconsidered thedegradation fromafireeventofsuchsystemsascontainment isolation andcontainment cooling.2.2.5Fire-Induced Initiating EventsThelicenseehasaddressed fire-induced initiating eventsintheLicenseeResponsetoNRCQuestions

[2],andthefireriskanalysisreports[10,11],butdoesnotdiscussthemintheSummaryReport[1].Reactortripisassumedforallfirezones/areas, andthetransient eventtreewiththePowerConversion Systemavailable isusedtomodelthefireimpact.Anexhaustive analysisofthepossibility ofinitiating eventoccurrence fromafirehasbeenpresented.

RCPsealfailureisaddressed aspartofcomponent coolingwater(CCW)systemfailure.2.2.6CoreDamageFrequency ModelThePRAlogicmodelhasbeenemployedtoestimatefire-induced coredamagefrequencies.

Theinitiating eventfrequencies havebeenreplacedwithfireinitiation frequencies.

Thesystems,trainsandcomponents withintherespective firezoneshavebeenassumedtobeunavailable.

2.2.7Containment SystemsModelInReference 1itisclaimedthatcontainment relatedsystemshavebeenaddressed.

However,sincethesafeshutdownsystemstypically donotaddresscontainment isolation andcontainment cooling,suchaclaimshouldhavebeenfurthersubstantiated.

2.2.8FireZone/Area Selection ThelicenseehasusedtheAppendixRinformation andFireHazardAnalysis(FHA)forselecting firezones/areas, combustible loading,cablepathways, andassociated component connections'or eachfirezone/area.

ThelicenseehasusedCOMPBRNtoverifytheprotection affordedbyfirebarriers.

Itisnotclearifthelicenseehasconsidered mechanisms otherthanfireaffecting abarrier.Forexample,insomespecialcases,thedoortoanareamaybeopenedbythefirebrigadetogainaccesstothefire.Insuchacase,thebarrierwouldbebreached, andadditional firezonesmaybeexposedtoafire.Activefireprotection systemshavebeenusedfordefiningtheboundaries ofseveralfirezones.Thefollowing areashavesuchcharacteristics:

EnergyRes'earch, Inc.25ERI/NRC95-501 Betweenfirezones45and46A(41and42AforUnit1)thereisaroll-updoorthatisnormallykeptopen.Firezone29Aand29Bareconnected withanopendoorway.Inthecasesoftheroll-updoorsandfiredampers,thefireriskanalysishasnotconsidered thepossibility offailureoftheboundary, andsubsequent propagation offirefromonezonetoanother.2.2.9Screening ofFireScenarios Severalscreening tiershavebeenemployed.

Inthefirsttier,thosezonesthatdonotcontainanysafeshutdownequipment orcables,oranyoftheequipment thatwasmodeledinthetransient eventtree(TRA)oftheLevel1PRA,werescreenedout.Inthesecondtier,assumingthatallofthecablesandequipment presentinthezonehavebeendamaged,thecoredamagefrequency hasbeenestimated usingtheLevel1PRAeventtreesandfaulttrees.Forthisexercise, theproperinitiating eventshavebeenusedbasedonthecablespresentinthezone.Thosefirezoneswithacalculated coredamagefrequency lessthan10'/rywerescreenedout.2.2.10Containment Performance Forcontainment fires,itisarguedthatbecauseoflowcombustible loadingandlargevolumes,suchfiresarenotconsidered assignificant.

FIVEmethodology iscitedforeliminating thisgeneralareafromfurtheranalysis.

PRegarding containment performance, containment relatedequipment (e.g.,containment isolation valvesorcontainment coolingfans)werenotincludedinthefireimpactmodel.2.2.11FireOccurrence Frequency ThelicenseehasusedtheSandiafireoccurrence databaseasrepresented inNUREG/CR-4586

[17]andtheassociated FIREDATAcomputerprogram.InapplyingtheSandiafirefrequency databasetotheiranalysis, thelicenseeallocated thefireincidents fromthe5genericcategories giveninthedatabasetothesixD.C.Cookgeneralzones.ThisapproachhasbeenusedinmanyexistingPRAs,wherethefirefrequency isestimated forgenericcategories offireareas(building types).Thefrequencies offiresforspecificzones/areas wereobtainedfromratioingthebuildingfireoccurrence historyaccording tothecharacteristics ofthespecificfirezone.Thus,forareaswhereafirehasoccurredinotherplants,afractionofthefireincidence dataisassignedaccording tocharacteristics ofthearea.Forareaswherenofireincidence historyexists,afirefrequency of0.001peryearhasbeenused.Plant-specific fireexperience anduncertainties arenotincludedinthefirefrequency evaluation.

2.2.12FireVulnerabilitv ERI/NRC.95-501Thetotalcoredamagefrequency of3.76x10~perreactor-year isthesumoftheelevenfirescenarios thatsurvivedthescreening efforts.Elevenfirescenarios havebeenidentified asthemaincontributors totheEnergyResearch, Inc.26 totalcoredamagefrequency foroneunit.Thefirezonesassociated withtheelevenscenarios includethefollowing:

Twodieselgenerator roomswhereothercablesarealsopresentTwofirezonesassociated withtheESWsystemTwo4kVswitchgear roomsOneMCCroomOnebatteryroomAgeneralareawithintheAuxiliary BuildingThecontrolroomAnareawithintheTurbineBuildingThelististhesameforbothunits.TheareaintheAuxiliary Buildingiscommontobothunits.Inthecaseofnineoftheelevenfirescenarios, theinitiating eventislossofeitherCCWorESW.Inonecasetheinitiating eventislossof250VDCsystem,andintheothertheinitiating eventisassumedtobeageneraltransient.

2.2.13FireProtection MeasuresTherevisedfireriskanalysis[11]doesnotexplicitly modeltheeffectsoffiredetection andsuppression systemsontheCDF.Inthecaseofsomeofthefirescenarios (e.g.,controlroomandcablevault),theeffectsoffireprotection systemsisincludedimplicitly.

2.2.14FireGrowthandDamageAssessment Thelicenseehasused,forafewfirescenarios, COMPBRNIIIetoconductfiregrowthanddamageassessment.

TheresultsoftheseanalyseshavenotbeenshowninReference 11.However,duringthesitevisit,thereviewteamexaminedCOMPBRNrunsandco'ncluded thatforthosecaseswhichbelongedtotheinitialfireriskanalysis, theprogramwasusedproperly.

2.2.15DamagingEffectsofFireFightingAthoroughmethodology hasbeenemployedtoassesstheadverseeffectsoffirefightingactivities onsafeshutdownequipment thatarenotaffectedbyafire.Adetailedaccountofthemethodology hasbeenprovidedintheLicenseeResponsetoNRCQuestions

[2].2.2.16WalkdownTheSummaryReport[1]indicates thatatleasttwowalkthroughs wereconducted; andspecialchecklists wereemployedforthatpurpose.Inthesecondwalkthrough, themeasurements neededforCOMPBRNanalysisweretaken.IntheLicenseeResponsetoNRCQuestions

[2],itisindicated thatonlyUnit1hasbeenreviewedindetail.AUnit2walkthrough wasconducted toverifythesimilarities betweenthetwounits.27Inadditiontothewalkthroughs fortheinitialsubmittal, thefireriskanalysisteamconducted walkthroughs ofspecificfirezonestosupporttherevisedfireriskanalysis.

EnergyResearch, Inc.ERI/NRC95-501

2.2.17Uncertainties Thelicenseehasnotproducedanexplicitdiscussion ofuncertainties andsensitivity issuesassociated withthedata,modelsandanalysesresults.However,thereportsprovideextensive listsofassumptions anddiscussions ofconservatisms intheanalysis.

2.2.18SandiaFireRiskScopingStudyIssuesTheSandiaScopingStudyissueshavebeenaddressed explicitly.

Forcontrolroomcontrolcircuitisolation, theLocalShutdownIndication (LSI)panelswillbeused.Thesepanelsarelocatedatseveral~spotsintheauxiliary building.

Withrespecttoseismically inducedfires,theSummaryReportdoesnotaddresstheseinSection4.8.However,intheLicenseeResponsetoNRCQuestions (page8),itisstatedthatcabinetmovement, tankmovement, andpumpleakageisnotaproblemforthedesignbasisearthquake.

Thisisfurtherdiscussed intherevisedfireriskanalysis.

SpecialfocusisgiventotheCO,tank.Thelicenseehasstatedthatautomatic firesuppression systemsmaynotsurviveastrongearthquake.

2.2.19USIA-45USIAC5hasbeenaddressed bythelicensee.

Noinformation isprovidedexceptforareference totheinternaleventsIPEreport[9].-42.32.3.1GSI-147,"Fire-Induced Alternate Shutdown/Control PanelInteraction" GSI-147addresses thescenariooffireoccurring inaplant(e.g.,inthecontrolroom),andconditions whichcoulddevelopthatmaycreateanumberofpotential controlsystemvulnerabilities.

Controlsysteminteractions canimpactplantriskinthefollowing ways:Electrical independence ofremoteshutdowncontrolsystemsLossofcontrolpowerbeforetransferTotallossofsystemfunctionSpuriousactuation ofcomponents Thelicenseeaddressed fire-induced spuriousactuation ofcomponents, asdescribed inSections4.1and4.2ofReference

[11].Sincethesubmittal hasfollowedtheguidanceprovidedinFIVEconcerning controlsysteminteractions, allcircuitry associated withremoteshutdownisassumedtohavebeenfoundtobeelectrically independent ofthecontrolroom.2.3.2GSI-148,"SmokeControlandManualFireFightingEffectiveness" GSI-148addresses theeffectiveness ofmanualfire-fighting inthepresenceofsmoke.Smokecanimpactplantriskinthefollowing ways:ERI/NRC95-501Byreducingmanualfire-fighting effectiveness andcausingmisdirected suppression effortsEnergyResearch, Inc.28 Qi~Bydamagingordegrading electronic equipment Byhampering theoperator's abilitytosafelyshutdowntheplant~Byinitiating automatic fireprotection systemsinareasawayfromthefireReference

[18]identifies possiblereduction ofmanualfire-fighting e6ectiveness andcausingmisdirected suppression effortsasthecentralissueinGSI-148.Thesubmittal includedmanualsuppression inthefirepropagation

analysis, andhasemployedaconservative approachinthescreening phase,asdescribed inSection4.5ofReference

[1].2.3.3GSI-156,"Systematic Evaluation Program(SEP)"Reference

[18]providesthedescription ofeachSEPissuestatedbelow,anddelineates thescopeofinformation thatmaybereportedinanIPEEEsubmittal relevanttoeachsuchissue.Theobjective ofthissubsection isonlytoidentify.

thelocationintheIPEEEsubmittal whereinformation havingpotential relevance toGSI-156maybefound.Settlement ofFoundations andBuriedEquipment

[18]:Theobjective ofthisSEPissueistoassurethatsafety-related structures, systemsandcomponents areadequately protected againstexcessive settlement.

Thescopeofthisissueincludesreviewofsubsurface materials andfoundations, inordertoassessthepotential staticandseismically inducedsettlement ofallsafety-related structures andburiedequipment.

Excessive settlement orcollapseoffoundations couldresultinfailuresofstructures, interconnecting piping,orcontrolsystems,suchthatthecapability tosafelyshutdowntheplantor.mitigatetheconsequences ofanaccidentcouldbecomprised.

Thisissue,applicable mainlytosoilsites,involvestwospecificconcerns:

~potential impactofstaticsettlements offoundations andburiedequipment wherethesoilmightnothavebeenproperlyprepared, andseismically inducedsettlement andpotential soilliquefaction following apostulated seismicevent.Staticsettlements arenotbelievedtobeaconcern,andthefocusofthisissue(whenconsidering relevantinformation inIPEEEs)shouldbeonseismically inducedsettlements andsoilliquefaction.

Itisanticipated thatfull-scope seismicIPEEEswilladdresstheseconcerns, following theguidanceinEPRINP-6041.D.C.CookNuclearPlantisfoundedonsoilandislocatedonthewestsideofanotableslope.Thefragility analysisforthecontainment buildingwasdominated bysoiloverpressure, asdescribed onpages3-12and3-17oftheIPEEEsubmittal.

Thetopicofsoilliquefaction isdiscussed inSection3.2.5ofthesubmittal.

DamIntegrity andSiteFloodingovertoppmg.

Therefore, thefocusistoassurethatadeq:EnergyResearch, Inc.29ERI/NRC95-501[81:biiililyffloodingandtoensureacoolingwatersupply.Thesafetyfunctions wouldnormallyircluderemaining stableunderallconditions ofreservoir operation, controlling seepagetopreventexcessive uplifting waterpressures orerosionofsoilmaterials, andproviding sufficient freeboard andoutletcapacitytopreventuatesafetymarginsareavailable underallloading conditions, anduncontrolled releasesofretainedwaterareprevented.

Theconcernofsitefloodingresulting fromnon-seismic failureofanupstreamdam(i.e.,causedbyhighwinds,flooding, andotherevents)isaddressed aspartoftheSEPissue"sitehydrology andabilitytowithstand floods."Theconcernsofsitefloodingresulting fromtheseismicfailureofanupstreamdamandlossoftheultimateheatsinkcausedbytheseismically inducedfailureofadownstream damshouldbeaddressed intheseismicportionoftheIPEEE.Theguidanceforperforming suchevaluations isprovidedinSection7ofEPRINP-6041.Asrequested inNUREG-1407, thelicensee's IPEEEsubmittal shouldprovidespecificinformation addressing thisissue,ifapplicable toitsplant.Information includedforresolution ofUSIA-45isalsoapplicable tothisconcern.TheD.C.CookIPEEEsubmittal states,inSection5.2.1,thattherearenodamsintheproximity ofD.C.CookNuclearPlant,andthatdamfailureandfloodingfrominlandlakesandstreamsarenotapplicable totheplantsiteSiteHydrology andAbilitytoWithstand FloodsIl8tThbiifiii<<il6'nordertoensurethecapability ofsafety-related structures towithstand

flooding, toensureadequatecoolingwatersupply,andtoensurein-service inspection ofwater-control structures.

Thisissueinvolvesassessing thefollowing:

Hydrologic conditions

-toassurethatplantdesignreflectsappropriate hydrologic conditions.

Floodingpotential andprotection

-toassurethattheplantisadequately protected againstfloods.Ultimateheatsink-toassureanappropriate supplyofcoolingwaterduringnormalandemergency shutdown.

VAsrequested inNUREG-1407, thelicensee's IPEEEsubmittal shouldprovideinformation addressing theseconcerns.

Theconcernrelatedtoin-service inspection ofwater-control structures, acompliance issue,isnotbeingcoveredintheIPEEE.TheD.C.CookIPEEEhasincludedanevaluation ofexternalfloods,including floodingonLakeMichiganandlocalfloodingduetointenseprecipitation.

Theevaluation ofexternalfloodsispresented inSection5.2ofthesubmittal.

IndusmalHazards[18]:Theobjective ofthisissueistoensurethattheintegrity ofsafety-related structures, systems,andcomponents wouldnotbejeopardized duetoaccidenthazardsfromnearbyfacilities.

Suchhazardsinclude:shockwavesfromnearbyexplosions, releasesofhazardous gasesorchemicals resulting infiresorexplosions, aircraftimpacts,andmissilesresulting fromnearbyexplosions.

Asrequested inNUREG-1407, thelicensee's IPEEEsubmittal shouldprovideinformation addressing thisissue.TheD.C.CookIPEEEsubmittal includesthefollowing information ofrelevance tothisissue:Section5.3Aofthesubmittal discusses aircraftcrashes;Section5.3Bofthesubmittal discusses potential accidents EnergyResearch, Inc.30ERI/NRC95-501

~~fromshipimpacts;Section5.3Cofthesubmittal discusses offsitehazardous materialreleasesandexplosions; Section5.4Adiscusses msitehazardous materialaccidents; andSection5.4Bofthesubmittal discusses turbinemissiles.

TornadoMssiles081.:bifbiiiUHi9>>(SEPplants)areadequately protected againsttornadoes.

Safety-related structures, systems,andcomponents needtobeabletowithstand theimpactofanappropriate postulated spectrumoftornado-generated missiles.

Asrequested inNUREG-1407, thelicensee's IPEEEsubmittal shouldprovideinformation addressing thisissue.TheD.C.CookIPEEEhasinvolvedanevaluation oftornadoes, including tornado-induced missles.Pages5-9and5-10(Sectiori 5.1.3.3)ofthesubmittal providediscussion relevanttotornadomissles.SevereTVeathersectsonStructures

[18]:Theobjective ofthisissueistoassurethatsafety-related structures, systems,andcomponents aredesignedtofunctionunderallsevereweatherconditions towhichtheymaybeexposed.Meteorological phenomena tobeconsidered include:straightwindloads,tornadoes, snowandiceloads,andotherphenomena judgedtobesignificant foraparticular site.Asrequested inNUREG-1407,thelicensee's IPEEEsubmittal shouldprovideinformation specifically addressing highwindsandfloods.Othersevereweatherconditions (i.e.,snowandiceloads)weredetermined tohaveinsignificant effectsonstructures (seeChapter2ofNUREG-1407).

TheD.C.CookIPEEEhasincludedevaluations ofhighwinds(straight windloadsandtornadoes) andexternalfloods.Section5.1ofthesubmittal discusses severewindsandtornadoes, andSection5.2ofthesubmittal discusses externalfloods.DesignCodes,Criteria, andLoadCombinations

[18]:Theobjective ofthisissueistoassurethatstructures important tosafetyshouldbedesigned, fabricated, erected,andtestedtoqualitystandards commensurate withtheirsafetyfunction.

Allstructures, classified asSeismicCategoryI,arerequiredtowithstand theappropriate designconditions withoutimpairment ofstructural intemityortheperformance ofrequiredsafetyfunctions.

Duetotheevolutionary natureofdesigncodesandstandards, operating plantsmayhavebeendesignedtocodesandcriteriawhichdifferfromthosecurrently usedforevaluating newplants.Therefore, thefocusofthisissueistoassurethatplantCategoryIstructures willwithstand theappropriate designconditions (i.e.,againstseismic,highwinds,andfloods)withoutimpairment ofstructural integrity ortheperformance ofrequiredsafetyfunction.

AspartoftheIPEEE,licensees areexpectedtoperformanalysestoidentifypotential severeaccidentvulnerabilities associated withexternalevents(i.e.,assesstheseismiccapacities oftheirplantseitherbyperforming seismicPRAsorSMAs).,TheD.C.CookIPEEEhasincludedanevaluation ofpotential severeaccidentvulnerabilities associated withexternalevents.Thesubmittal doesnotdiscusstheseismicCategoryclassification ofstructures, anddoesnotsystematically identifycodes,criteria, andloadcombinations usedindesign.Page3-7oftheEnergyResearch, Inc.31ERI/NRC95-501 submittal providesabriefdescription ofassumptions madeintheseismicfragility analysisconcerning loadcombinations andstrengthreserves.

SeismicDesignofStructures, Systems,andComponents

[18]:Theobjective ofthisSEPissueistoreviewandevaluatetheoriginalseismicdesignofsafety-related structures, systems,andcomponents, toensurethecapability oftheplanttowithstand theeffectsofaSafeShutdownEarthquake (SSE).TheD.C.CookIPEEEisbasedonaseismicPRA,whichhasevaluated failureprobabilities oftheplantandplantstructures, systems,andcomponents, atvariousgroundmotionlevels.Therelatedprobabilistic analysesaredocumented inSections3.1.3to3.1.5ofthesubmittal.

ShutdownSystemsandElectrical Instrumentation andControlFeatures081:"'""'"""reliableshutdownusingsafety-grade equipment.

Theissueonelectrical instrumentation andcontrolistoassessthefunctional capabilities ofelectrical instrumentation andcontrolfeaturesofsystemsrequiredforsafeshutdown, including supportsystems.Thesesystemsshouldbedesigned, fabricated, installed, andtestedtoqualitystandards, andremainfunctional following externalevents.InIPEEEs,licensees wererequested toaddressUSIA-45,"Shutdown DecayHeatRemoval(DHR)Requirements,"

andtoidentifypotential vulnerabilities associated withDHRsystemsfollowing theoccurrence ofexternaleven'ts.Theresolution ofUSIAPSshouldaddressthesetwoissues.Thelicensee's treatment ofUSIAQ5isdiscussed inSection3.2.3oftheD.C.CookIPEsubmittal.

Sections2.1.7and2.2.19ofthisTERsummarize reviewfindingsrelatedtoUSIA-45,respectively, forseismiceventsandfireevents.2.3.4GSI-172,"Multiple SystemResponses Program(MSRP)"Reference

[18]providesthedescription ofeachMSRPissuestatedbelow,anddelineates thescopeofinfoimation thatmaybereportedinanIPEEEsubmittal relevanttoeachsuchissue.Theobjective ofthissubsection isonlytoidentifythelocationintheIPEEEsubmittal whereinformation havingpotential relevance toGSI-172maybefound.CommonCauseFailures(CCFs)RelatedtoHumanErrorsOl:C"'"'""""'""'""'f" omissionthatcouldbeinitiating events,orcouldaffectredundant safety-related trainsneededtomitigatetheevents.OtherhumanerrorsthatcouldinitiateCCFsinclude:manufacturing errorsincomponents thataffectredundant trains;andinstallation, maintenance ortestingerrorsthatarerepeatedonredundant trains.InIPEEEs,licensees wererequested toaddressonlythehumanerrorsinvolving operatorrecoveryactionsfollowing theoccurrence ofexternalinitiating events.Someinformation isprovidedonpage3-14oftheIPEEEsubmittal andSection4.7.4ofReference

[11]concerning operatorrecoveryactions.EnergyResearch, Inc.32ERI/NRC95-501 Non-Safety-Related ControlSystem/Safety-Related Protection SystemDependencies PSIMdpIi-fy-lelyyhdimpactonsafety-related protection systems,asaresultofpotential unrecognized dependencies betweencontrolandprotection systems.Theconcernisthatplant-specific implementation oftheregulations regarding separation andindependence ofcontrolandprotection systemsmaybeinadequate.

Thelicensees'PE processshouldprovideaframework forsystematic evaluation ofinterdependence betweensafety-related andnon-safety-related systems,andshouldidentifypotential sourcesofvulnerabilities.

Thedependencies betweensafety-related andnon-safety-related systemsresulting fromexternalevents-i.e.,concernsrelatedtospatialandfunctional interactions

-areaddressed aspartof"fire-induced alternate shutdownandcontrolroompanelinteractions,"

GSI-147,forfireevents,and"seismically inducedspatialandfunctional interactions" forseismicevents.Information providedintheD.C.CookIPEEEsubmittal pertaining toseismically inducedspatialandfunctional interactions isidentified below(undertheheadingSeismically InducedSparialandFuncrional Interacrions),

whereasinformation pertaining tofire-induced alternate shutdownandcontrolpanelinteractions hasalreadybeenidentified inSection2.3.1ofthisTER.Heat/Smoke/Water Propaganon sectsfromFires[8]:'fpiiftraincouldpotentially bedamagedinoneofthefollowing ways:Heat,smoke,andwatermaypropagate (e.g.,throughHVACductsorelectrical conduit)intoasecondfirezone,anddamagearedundant trainofequipment.

Arandomfailure,notrelatedtothefire,coulddamagearedundant train.~Multiplenon-safety-related controlsystemscouldbedamagedbythefire,andtheirfailurescouldaffectsafety-related protection equipment foraredundant traininasecondzone.Afirecancauseunintended operation ofequipment duetohotshorts,opencircuits, andshortstoground.Consequently, components couldbeenergized orde-energized, valvescouldfailopenorclosed,pumpscouldcontinuetorunorfailtorun,andelectrical breakerscouldfailopenorclosed.Theconcernofwaterpropagation effectsresulting fromfireispartially addressed inGI-57,"EffectsofFireProtection SystemActuation onSafety-Related Equipment."

Theconcernofsmokepropagation effectsisaddressed inGSI-148.Theconcernofalternate shutdown/control roominteractions (i.e.,hotshortsandotheritemsjustmentioned) isaddressed inGSI-147.Information providedintheD.C.CookIPEEEsubmittal pertaining toGSI-147andGSI-148hasalreadybeenidentified inSections2.3.1and2.3.2ofthisTER.Noinformation isprovidedinthesubmittal pertaining specifically toGI-57.EnergyResearch, Inc.33ERI/NRC95-501 EffectsofFireSuppression SystemActuation onNon-Safety-Related andSafety-Related Equipment

[18):Firesuppression systemactuation eventscanhaveanadverseeffectonsafety-related components, eitherthroughdirectcontactwithsuppression agentsorthroughindirectinteraction withnon-safety relatedcomponents.

Someinformation pertaining tosuppression-induced damagetoequipment, aswellasseismically inducedinadvertent actuation offiresuppression systems,canbefound,respectively, inSections5.3and5.8of.Reference

[11].EffectsofFloodingand/orMoistureIntrusion onNon-Safety-Related andSafety-Related Equipment

[18]:Floodingandwaterintrusion eventscanaffectsafety-related equipment eitherdirectlyorindirectly throughfloodingormoistureintrusion ofmultipletrainsofnon-safety-related equipment.

Thistypeofeventcanresultfromexternalfloodingevents,tankandpiperuptures, actuations offiresuppression systems,orbackflowthroughpartsoftheplantdrainagesystem.TheIPEprocessaddresses theconcernsofmoistureintrusion andinternalflooding(i.e.,tankandpiperupturesorbackflowthroughpartoftheplantdrainagesystem).Theguidanceforaddressing theconcernofexternalfloodingisprovidedinChapter5ofNUREG-1407, andtheconcernofactuations offiresuppression systemsisprovidedinChapter4ofNUREG-1407.

TheD.C.CookIPEEEsubmittal

[1]discusses externalfloodsinSection5.2,andseismically inducedfloodinginSection3.2.7.Futhermore, Reference

[11]hassomediscussion ofnon-seismic actuations offiresuppression systemsinSection5.3,andseismically inducedinadvertent actuation offiresuppression systemsinSection5.8.Seismically InducedSpatialandFunctional Interactions PjSiififfn-systemsthroughspatialandfunctional interactions.

Someparticular sourcesofconcerninclude:rupturesinsmallpipingthatmaydisableessential plantshutdownsystems;directimpactofnon-seismically qualified structures, systems,andcomponents thatmaycausesmallpipingfailures; seismicfunctional interactions ofcontrolandsafety-related protection systemsviamultiplenon-safety-related controlsystems'ailures; andindirectimpacts,suchasdustgeneration, disabling essential plantshutdownsystems.Aspart,oftheIPEEE,itwasspecifically requested thatseismically inducedspatialinteractions beaddressed duringplantwalkdowns.

Theguidanceforperforming suchwalkdowns canbefoundinEPRINP-6041.TheD.C.CookIPEEEhasincludedaseismicwalkdownwhichinvestigated thepotential foradversephysicalinteractions.

Thesubmittal statesthatEPRINP-6041guidelines werefollowedintheseismicwalkdowns.

Relevantinformation canbefoundinSections3.1.2and3.1.6oftheD.C.CookIPEEEsubmittal.

Seismically InducedFires'18J:Seismically inducedfiresmaycausemultiplefailuresofsafety-related systems.Theoccurrence ofaseismiceventcouldcreatefiresin,multiplelocations, simultaneously degradefiresuppression capability, andpreventmitigation offiredamagetomultiplesafety-related EnergyResearch, Inc.34ERI/NRC95-501

systems.Seismically.

inducedfiresisoneaspectofseismic-fire interaction

concerns, whichisaddressed aspartoftheFireRiskScopingSt.dy(FRSS)issues.(IPBEEguidancespecifically requested licensees toevaluateFRSSissues.)InIPEEEs,seismically inducedfiresshouldbeaddressed bymeansofafocusedseismic-fire interactions walkdownthatfollowstheguidanceofEPRINP-6041.'heD.C.CookIPEEEsubmittal providesnodiscussion ofseismically inducedfires.Adescription oftheseismic-fire interactions evaluation isprovidedinSection5.8ofReference

[11].Seismically InducedFireSuppression SystemActuation

[18]:Seismiceventscanpotentially causemultiplefiresuppression systemactuations which,inturn,maycausefailuresofredundant trainsofsafety-related systems.Analysescurrently requiredbyfireprotection regulations generally, onlyexamineinadvertent actuations offiresuppression systemsassingle,independent events,whereasaseismiceventcouldcausemultipleactuations offiresuppression systemsinvariousareas.Someinformation pertaining toseismically inducedinadvertent actuation offiresuppression systemscanbefoundinSection5.8ofReference

[11].Seismically InducedFloodingD8Isiifiofsafety-related systems.Ruptureofsmallpipingcouldprovidefloodsourcesthatcouldpotentially affectmultiplesafety-related components simultaneously.

Similarly, non-seismically qualified tanksareapotential floodsourceofconcern.IPEEEguidancespecifically requested licensees toaddressthisissue.Section3.2.7ofthelicensee's submittal discusses seismically inducedflooding.

Non-seismic fireprotection pipingwasincludedinthelicensee's evaluation ofseismically inducedflooding.

Thesubmittal citesthelicensee's internalfloodinganalysisforotherrelatedconcerns.

Seismically InducedRelayChatterDSl:oneofthefollowing conditions:

remainfunctional (i.e.,withoutoccurrence ofcontactchattering);

~beseismically qualified; or~bechatteracceptable.

Itispossiblethatcontactchatterofrelaysnotrequiredtooperateduringseismiceventsmayproducesomeunanalyzed faultingmodethatmayaffecttheoperability ofequipment requiredtomitigatetheevent.IPEEEguidancespecifically requested licensees toaddresstheissueofrelaychatter.AsnotedinSection3.2.8oftheD.C.CookIPEEEsubmittal, arelaychatteranalysisforD.C.Cookwasperformed aspartofUSIAM,"Verification ofSeismicAdequacyofEquipment inOperating Plants."Theextent,ifany,towhichrelaychatterimpactsweremodeledintheseismicPRAisnotdiscussed inthesubmittal.

EnergyResearch, Inc.35ERI/NRC95-501 Evaluation ofEarthquake Magnitudes GreaterthantheSafeShutdownEarthquake

[18]:Theconcernofthisissueisthatadequatemarginmaynothavebeenincludedinthedesignofsomesafety-related equipment.

AspartoftheIPEEE,alllicensees areexpectedtoidentifypotential seismicvulnerabilities orassesstheseismiccapacities oftheirplantseitherbyperforming seismicPRAsorseismicmarginsassessments (SMAs).Thelicensee's evaluation forpotential vulnerabilities (orunusually lowplantseismiccapacity) duetoseismiceventsshouldaddressthisissue.TheD.C.CookIPEEEhasincludedaseismicPRA,asdocumented inSection3ofthesubmittal.

EffectsofHydrogenLineRuptures[18]:Hydrogenisusedinelectrical generators atnuclearplantstoreducewindagelosses,andasaheattransferagent.Itisalsousedinsometanks(e.g.,volumecontroltanks)asacovergas.Leaksorbreaksinhydrogensupplypipingcouldresultintheaccumulation ofacombustible mixtureofairandhydrogeninvitalareas,resulting inafireand/oranexplosion thatcoulddamagevitalsafety-related systemsintheplants.Itshouldbeanticipated thatthelicenseewilltreatthehydrogenlinesandtanksaspotential fixedfiresourcesasdescribed inEPRI'sFIVEguide,assesstheeffectsofhydrogenlineandtankruptures, andreporttheresultsinthefireportionoftheIPEEEsubmittal.

TheD.C.CookIPEEEsubmittal doesnotaddressthepossibility ofaccumulation ofacombustible mixtureofairandhydrogeninvitalareas.Thisomissionisnotdeemedtobesignificant since,basedonthewalkdownconducted aspartofthisreview,novitalareaswereidentified whereleakinghydrogengascouldaccumulate.

Thesubmittal does,however,indicatethathydrogenfiresthathaveoccurredinturbinebuildings ofnuclearpowerplantswereincludedinthefireoccurrence datausedinestimating thefireinitiation frequency fortheCookturbinebuilding.

EnergyResearch, Inc.36ERI/NRC95-501

3.AUDITCONCLUSIONS ANDRECOMMENDATIONS 3.15eigaicTheoriginalCookseismicIPEEE[1]producedasubstantially unrealistic (over-conservative) evaluation ofseismicrisk.Therewereanumberofidentified problemsintheanalysis, mostsignificantly thetreatment ofseismicfragility andHCLPFcalculations, andthecrudedefinition ofseismicintervals usedforquantifying risk.Inaddition, anumberofopenissueswereidentified inthereviewoftheoriginalsubmittal.

Thesewerelargelyaddressed duringthesiteaudit;however,therewereanumberofconcernsthatremainedafterthesiteaudit.Inresponsetotheseconcerns, thelicenseeundertook signifiicant efforttocorrectproblemsintheanalysisandtoclarify/justify anumberofissues.Theresulting finalrevisedCookseismicIPEEE[4]isasignificant improvement overtheoriginalsubmittal.

Itadequately demonstrates thattheseismicriskatD.C.Cookislow.Basedonadetailedreviewoftherevisedseismicfragility calculations, itisbelievedthatmorerealistic assumptions inthefragility analysesmaylikelyaltertherankingofdominantcontributors.

However,furtherrefinement ofthefragility analysesisconsidered tobeunwarranted.

Itisbelievedthat,althoughtherankingofdominantcontributors maynotbeprecise,thecollective setofcontributors identified intheoriginalsubmittal andtherevisedsubmittals encompass thoseconditions thataremostlikelytocontrolplantcapacityandrisk.BasedonreviewofthefinalrevisedIPEEEsubmittal, thelicenseeisapparently awareofotherissuesofpotential concern,'andthesehavebeensummarized inthebodyofthisTER.Basedonthesiteaudit,andreviewofinformation suppliedbythelicensee, itappearsthatthelicenseehasdeveloped anappreciation ofsevereaccidentbehavior, gainedaqualitative understanding oftheoveralllikelihood ofcoredamage,andadequately assessedcontainment performance.

AsaresultoftheseismicIPEEE(primarily thewalkdowneffort),anumberofplantimprovements havebeenidentified andimplemented.'lso, thelicenseeappearstopossessanunderstanding oflikelysevereaccidentsequences thatcouldoccuratitsplantunderfullpoweroperating conditions, thoughtherelativerankingofthesesequences maynotbeprecise,dueinparttoafewquestionable fragility analysisassumptions.

AsjudgedRomthisStep-2seismicauditprocess,thefollowing itemsareviewedasthestrengths andweaknesses ofthefinalrevisedseismicIPEEEsubmittal forD.C.Cook:Rrenghs1.Thelevelofanalysis(i.e.,seismicPRA)employedfortheoverallseismicIPEEEprocess.2.Thegeneralapproachtoquantifying dominantrisk-contributing components, sequences, andplantdamagestates.3.Theeffortputforthinplantseismicwalkdowns, andtheresulting insightsachievedconcerning non-design-related plantdeficiencies.

4Thedegreeoflicenseeparticipation intheseismicIPEEEprocessandlicensee's intenttomaketheIPEEEalivingstudy.TheeffortputforthinrevisingtheseismicIPEEE,andthewillingness torespondtoquestions andconcernsraisedduringthereviewprocess.7EnergyResearch, Inc.37ERI/NRC95-501 Newfragility analysesstillcontainsomeapparentinaccuracies (conservatisms/nonconservatisms andomissions ofsomemarginfactors)thatmayeffectquantitative results.However,thenewfragility analysesaresignificantly improvedovertheiroriginalcounterparts.

Newfragility resultswerenotdeveloped forallcomponents.

Althoughgenerating newfragility resultsforallcomponents (whereplant-specific fragility assessment wasemployed) isnotabsolutely necessary, futureIPEEEinsightscouldbehinderedifanunrevised fragility resultwould,infact,altertheresultsoftheseismicIPEEE(hadthefragility beencalculated correctly).

Noplantimprovements wereapparently undertaken associated withthefollowing identified items:poorfireextinguisher mounting; potential interaction problemswithfireprotection pilotlines;andpotential interaction problemsfromcontrolroomfluorescent lights.Thedocumentation relatedtoseismiccontainment performance isconsidered weak.Littlejustification fortheconclusions havebeengiven,andtheirisno(qualitative orquantitative) discussion ofthemodes,timings,andlikelihoods ofradiological releases.

Meaningful candidate containment performance enhancements werenotaddressed.

5.Treatment ofhumanactionsandoperatorerrorisnotclear.3.2Qrj;Forinternalfires,thelicenseeappearstohavedeveloped anappreciation ofsevereaccidentbehavior, understands themostlikelysevereaccidentsequences thatcouldoccuratitsplantunderfullpoweroperating conditions, andgainedaqualitative understanding oftheoveralllikelihood ofcoredamageandradioactive materialrelease.Thereareseveralitemsthathavenotbeenexplicitly explained intheSummaryReport[1],butReferences 2,10and11providesufficient information inthisregard.Overall,thelicenseehasfollowedamethodology thatisproperandhasbeenwidelyusedforfirePRAs.Thedatabasesforfireoccurrence frequencies, equipment andcablelocations, andfirefightingcapabilities, andthefireimpactmodeling(i.e.,faulttreesandeventtrees)aredeemedtobeproper.Theapplication ofthedatabasesandmodelsintherevisedfireriskanalysiscanbeconsidered asappropriate.

Theoverallcoredamagefrequency fromfireeventsiswithinarangethatistypicalforafirePRA.Notwithstanding theaboveconclusions, someshortcomings ofthesubmitted information includethefollowing:

Thelicenseehasnotputforwardacriterion foridentifying afirevulnerability.

Thereareseveralcalculations thatcannotbefullyexplained fromtheavailable information.

Thepossibility ofactivefirebarrierfailureandfirepropagation betweenfirezonesemploying suchequipment arenotadequately explained.

Itisnotclearwhetherthelicenseehasconsidered, initsfireanalysis, thedegradation ofsuchsystemsascontainment isolation andcontainment coolingfromafireevent.EnergyResearch, Inc.38ERUNRC95-501

.Thelicenseehasnotaddressed uncertainties andsensitivity issuesassociated withthedataandmodels.EnergyResearch, Inc.39ERI/NRC95-501

4.REFERENCES "DonaldC.CookNuclearPowerPlantUnits1and2Individual PlantExamination ofExternalEventsSummaryReport,"AmericanElectricPowerServiceCorporation, April1992."Individual PlantExamination ofExternalEvents/Response toNRCQuestions,"

letterfromE.Fitzpatrick, (IndianaMichiganPowerCompany)toT.E.Murley,(U.S.NuclearRegulatory Commission),

datedJuly22,1993.3."Individual PlantExamination ofExternalEvents(IPEEE)forSevereAccidentVulnerabilities-10CFR50.54(f),"

U.S.NuclearRegulatory Commission, GenericLetter88-20,Supplement 4,June28,1991.4"Individual PlantExamination ofExternalEvents/Response toNRCAuditConcernsandRequestforAdditional Information,"

letterfromE.Fitzpatrick, (IndianaMichiganPowerCompany)toU.S.NuclearRegulatory Commission, datedFebruary15,1995.5.J.T.Chen,etal.,"Procedural andSubmittal GuidancefortheIndividual PlantExamination ofExternalEvents(IPEEE)forSevereAccidentVulnerabilities,"

U.S.NuclearRegulatory Commission, NUREG-1407, FinalReport,June1991.6.'Procedures fortheExternalEventCoreDamageFrequency AnalysisforNUREG-1150,"

U.S.NuclearRegulatory Commission, NUREG/CRC840, September 1989.8."Analysis ofCoreDamageFrequency:

SurryI'owerStation,Unit1ExternalEvents,"U.S.NuclearRegulatory Commission, NUREG/CR-4550, Volume3,Rev.1,Part3,December1990.r"AMethodology forAssessment ofNuclearPowerPlantSeismicMargin,"ElectricPowerResearchInstitute, EPRINP-6041,October1988.10."DonaldC.CookNuclearPowerUnits1and2,Individual PlantExamination, SummaryReport,"AmericanElectricPowerServiceCorporation, April1992."FireRiskAnalysis,"

AmericanElectricPowerServiceCorporation, D.C.CookPRAVolume11,Rev.0,April1992."DonaldC.CookNuclearPlantUnits1and2,FireAnalysisNotebook,"

AmericanElectricPowerServiceCorporation, Revision1,February1995.12."Individual PlantExamination forExternalEvents:ReviewGuidance(Draft),"

EnergyResearch, Inc.,ERI/NRC94-501,May1994.13."SafeShutdownCapability Assessment, ProposeModifications andEvaluations

-10CFR50,AppendixR,SectionIII.G,"AmericanElectricPowerServiceCorporation, DonaldC.CookNuclearPlantUnits1and2,Indiana4MichiganElectricCompany,Revision1,December1986.EnergyResearch; Inc.ERI/NRC95-501 J

14.Memorandum fromJ.M.McNanietoDC-N-62804, AttachedCOMPBRNInputs/Outputs, February28,1992.15.FHADrawingsinD.C.CookFireHazardAnalysis, AmericanElectricPowerServiceCorporation, Rev.6,January31,1992..16."FireRiskScopingStudy,"U.S.NuclearRegulatory Commission, NUREG/CR-5088, January1989.17.18."User'sGuideforaPersonalComputer-Based NuclearPowerPlantFireDataBase,"U.S.NuclearRegulatory Commission, NUREG/CR-4586, August1986."Sta6'uidance ofIPEEESubmittal ReviewonResolution ofGenericorUnresolved SafetyIssues(GSI/US/,"

U.S.NuclearRegulatory Commission, August21,1997.EnergyResearch, Inc.41ERI/NRC95-501 APPENDIXA:~~A.lSUMMARYOFSEISMICREVIEWFINDINGSFiguresA.ltoA.4,takenfromtheIPEEEReviewGuidanceDocument[12],presenttheformatandsignificant elementsoftheseismicauditprocessundertaken fortheD.C.CookIPEEE.Asummaryoffindingsandcommentsforeachoftheseelementsisprovidedbelow.1.Areviewofthesite-specific seismichazardanalysiswasnotconducted aspartofthisaudit.2.Becauseareviewofthesite-specific seismichazardanalysiswasnotconducted aspartofthisaudit,licenseetreatment oftheCharleston earthquake issuewasnotevaluated.

Thewalkdownprocedures andseismicreview-team composition appearadequateforgathering plantinformation andforidentifying plantseismicdeficiencies/outliers.

TheIPEEEsubmittal notesthatlicenseestaffhadameaningful degreeofparticipation inthewalkdowns, althoughthewalkdowns wereledbyconsultants.

Althoughwalkdowninformation gatheredfortheIPEwasusedfortheseismicIPEEE,specificseismicwalkdowns wereconducted forcontainment buildings, auxiliary andturbinebuildings, thecontrolroom,thescreenhouse,andthegroundsimmediately surrounding theplant.Itisnotedthatthelicenseehasyettocompleteaconfirmatory

walkdown concerning mechanical penetrations insideoftheUnit1containment.

Thewalkdownscreening processimplemented intheD.C.CookseismicIPEEE,including application ofgenericfragility dataanduse.ofscreening tables,generally appeartobeconducted inameaningful andvalidfashion,usingmodernprocedures (e.g.,EPRINP-6041guidelines) asdirectedbyNUREG-1407.

Certainapplications ofgenericfragility data,however,maybequestionable, andshouldbeevaluated furtherduringthesitevisit.Licensee's identification ofpotential outliersandotherseismicconcerns, asaresultofseismicwalkdowns, appearsgenerally reasonable.

Concernsidentified intheplantwalkdowns includethefollowing items:blockwalls,fire-extinguisher mountings, fireprotection pilotlines,fluorescent lightsincontrolroom,missing/broken anchorage onsomemotorcontrolcenters,supportstructure ofa17-tonCO,tank,potential forearthquake-induced hydrazine spill,andseismicinteractions involving themovablein-corefluxmappingsystem.Theextentofconcernthatneedstobegiventotheseitemswillbeevaluated'uring thesitevisit.Thesitevisitwill,therefore, involveawalkdownoftheseitems.Thesitevisitshouldalsoinvolveaspotcheckforconditions identified inpastPRAsthatmayhave.beenmissedintheD.C.CookseismicIPEEE.6.TheSPRAinitiating eventsanalysisappearstohavebeenwelldone,implementing reasonable assumptions.

Themodelsandlogicusedintheinitiating eventanalysis, however,needtobereviewedduringthesitevisit.7.TheseismicIPEEEsubmittal presentsplantsystemeventtrees,andtheseappeartobevalidandreasonable formodelingtheseismicresponseofD.C.Cook.Treatment ofnon-seismic failuresandhumanactionsneedstobereviewedmorecloselyduringthesitevisit.EnergyResearch, Inc.A-1ERI/NRC95-501 0

FigureA.1Checklist forPre-SiteVisitAuditEnergyResearch, Inc.A-2ERI/NRC95-501 FigureA.2Significant Issues,Objectives andConcernstobeAddressed EnergyResearch, Inc.A-3ERI/NRC95-501

FigureA.3Potential RelatedSiteVisitActivities EnergyResearch, Inc.A-4ERI/NRC95-501 QiFigureA.4Checklist forPost-Site VisitAuditEnergyResearch, Inc.A-5ERI/NRC95-501 Faulttreeswerenotpresented intheseismicIPEEEsubmittal.

Theseneedtobereviewedduringthesitevisit.9.Thedevelopment anddefinition ofplantdamagestatesappearstobereasonable andvalid.I10.Theground-motion targetspectralshapeusedforstructural responseanalysesintheD.C.CookseismicIPEEEwastheCooknuclearplantgrounddesignresponsespectrum(GDRS).Althoughuseofthisspectralshapeisthoughttobemostlyconservative, thereareanumberofproblemswiththeuseofthisspectralshapeforSPRAinput.Themostnotableoftheseproblemsarelistedasfollows:(a)Theshapeisnotwellrepresentative ofstrongearthquake motionsthatmightbeexperienced attheD.C.Cookplantsite.(b)Theshapeisnotconsistent witheithertheLLNLorsite-specific hazardcurveswhichareusedtoevaluateground-motion probabilities.

(c)Forhighfrequencies theshapeisnonconservative.

(d)SecausetheGDRShasvaryingdegreesofconservatism (dependent onvibration frequency) relativetoarepresentative, site-specific spectralshape,relativeconservatisms infragility assessments ofvariouscomponents willvary(again,depending.

onthepredominant frequencies ofvibratory responseofthecomponents).

Consequently, thereexiststheveryrealpossibility thatthelistofdominantcontributors willnotbeproperlyranked.AEPSCundertook alimitedsensitivity studyoftheeffectsofinputspectralshape.Thissensitivity study,however,doesnotadequately addresstheaboveconcerns, particularly concern(d).AEPSCtreatment ofinputground-motion spectralshapeis,therefore, considered tobeasignificant weaknessofthestudy.11.Theseismicinputmotionsusedinstructural responseanalysesforfragility analysesneedtobereviewedduringthesitevisittoassesstheirapplicability.

12.Otherinputsusedinstructural responseanalysesand/orsoil-structure interaction analysesneedtobereviewedduringthesitevisittoassesstheirapplicability.

13.Modelparameters usedinstructural and/orsoil-structure interaction analysesneedtobereviewedduringthesitevisittoevaluatetheirrepresentativeness.

14.15.Resultsofstructural dynamicproperties, structural responses, andin-structure spectraneedtobereviewedduringthesitevisittoevaluatetheirreasonableness.

Licensee's useofexistingFSARanalysesneedstobereviewedduringthesitevisit.16.Forcriticalcomponents thathaveasignificant impactonrisk,detailsoffragility

analyses, including assessment offailuremodes,needtobeevaluated duringandafterthesitevisit.EnergyResearch, Inc.A-6ERI/NRC95-501

17.Useofgenericfragilities intheD.C.CookseismicIPEEEsubmittal appearsgenerally validandappropriate.

AEPSCkeypersonnel involvedinthefragility assessment needtobeinterviewed duringthesitevisittoobtainadditional information ontheuseofgenericfragilities.

18.Fragility resultsneedtobespotcheckedduringandafterthesitevisit.Itisclear,however,thatanumberofweaknesses existinthelicensee's plant-specific fragility analyses.

Theseweaknesses arenotsatisfactorily resolvedinthelicensee's responses toNRCquestions.

Particular concernsarenotedasfollows:Theuseofzerouncertainty inplant-specific fragility assessments isnotonlyunconventional, butalsoincorrect.

Uncertainty (incomponent capacity) isfundamentally definedasthatvariability whichcouldbeeliminated withperfectnowwledge ofcomponent response/behavior tothearrayofpossibleinputconditions.

Intheory,uncertainty canbereducedtonearlyzero,butonlyifasufficient stateofknowledge (andconsensus of"knowledge) existssuchthatacomplete, unquestionable understanding ofresponsehasbeenachieved.

Uncertainty infragility assessment derivesfromavarietyofsources,including:

lackofknowledge ofaprecisefailuremode,lackofknowledge ofaprecisefailurecriterion, lackofabilitytoexactlymodeldynamicproperties, etc.Inpractice, uncertainty cannotbereducedtozero.Uncertainty isnotdependent uponwhetherornotgenericorplant-specific dataisused.Inaddition, uncertainty isfundamentally different fromvariability duetorandomness, whichcannotbeentirelyeliminated.

Variations inmaterialproperties andinputground-motions, forinstance, alwaysexistdespitethelevelofmodelingsophistication.

Tnelicensee's submittal reflectsaninexperience withfragility analysismethods,particularly withrespecttothepropertreatment ofthevariability parameters P~andP.Ifthelicenseedesiredtoeliminate separatetreatment ofrandomness anduncertainty (asallowedinNUREG-1407 guidelines),

thenmeanfragility curves,characterized byamediancapacityandasingle/composite P,,couldhavebeenused.Thelicensee's useofassumedconservative mediancapacities doesnotaccurately norsatisfactorily resolvetheuseofzeroP.Theprimaryconcernisthatthelicensee's approachintroduces theveryrealpossibility thattherankingofdominantriskcontributors willnotbeaccurately represented.

Areviewoftheicecondenser fragility assessment revealsfurtherinaccuracies anderrorsintroduced inboththetreatment ofvariabilities andtreatment anduseofsafety-margin factorsinderivingmediancapacities andvariabilities.

Itisonlyreasonable toassumethatsimilarerrorsexistinthefragility analysesofothercomponents aswell.19.Adetailedreviewoffragility analysesshouldbeconducted forthefollowing components:

600VACtransformers, dieselgenerator fueloildaytank,auxiliary

building, reactorprotection system(miscellaneous panels),turbinebuildingpedestal, 250VDCpanels,4160VACswitchgear, andicecondenser.

Inaddition, thebasisfordetermination ofkeyrandomfailurerates(e.g.,turbine-driven AFWpumpfailures) shouldalsobereviewedduringthesitevisit.Oneprimaryresultofthereviewofplantfaulttreelogic(item8above)shouldbealistofallcomponents thatdominatethefailurelogic(e.g.,single-point failures).

Aspot-check ofthefragility resultsforallEnergyResearch, Inc.A-7ERI/NRC95-501.

0 components inthislistshouldbeconducted tohelpinsurethatthelicensee's submittal hasnotdismissed asignificant contributor toriskbasedonapotentially erroneous assumption ofhighseismiccapacity.

20.Ifplant-level Booleanlogichasbeendeveloped, itwillneedtobereviewedduringthesitevisit.21.Ifplant-level fragility curveshavebeendeveloped, thesewillneedtobereviewedduringthesitevisit.(TheSPRAforD.C.Cookinvolvesdirectaccidentsequencequantification; hence,plant-levelfragility curvesmaynotexist.)Ifaplantmatrixforseismiceventshasbeendeveloped andusedincoredamagefrequency quantification, itwillneedtobereviewedduringthesitevisit.22:TheD.C.CookseismicIPEEEsubmittal hasanerrorinthecomputation ofseismic-interval probabilities whichareusedasinputsforquantifying initiating eventfrequencies.

Theerrorresultsinanunder-estimation (i.e.,non-conservative evaluation) ofseismiccoredamagefrequency, thoughitisnotexpectedtoalterinsightsconcerning dominantriskcontributors.

Theerrorcanbeclearlyidentified inTable3.1.1-1ofthelicensee's IPEEEsubmittal.

Specifically, frequencies ofoccurrence ofgroundmotions,a,inthefollowing intervals areerroneously ignored:0.25<as0.26, 0.50<as0.51, 0.75<as0.76, 1.00<as1.01, and1.25<as1.26.

Althoughthiserrormaybeinitially thoughtofasnumerically insignificant, itisexpectedtoalterthemeanseismiccoredamagefrequency byabout15%.Moreimportantly, however,theerrorisofthetypethatsuggestsalackofexperience withPRAmethods,andhence,raisesconcernsastoothererrorsthatmayhavebeenintroduced intheD.C.CookIPEEEsubmittal.

Forthefrequencies ofoccurrence ofseismicground-motion intervals usedinquantifications, theinitiating eventfrequencies appearreasonable.

Theresultsneedtobeevaluated further,however,whileconducting thereviewoftheinitiating eventsanalysisduringtheplantsitevisit.24.Forthegiveninputground-motion occurrence frequencies, theresulting meanplantdamagestatefrequencies andmeancoredamagefrequencies appearreasonable.

Theresultsneedtobeevaluated further,however,whileconducting thereviewofthesystemsanalysisduringtheplantsitevisit.25.Resultsfordominantcoredamageaccidentsequences (andrelatedminimalcutsets),

asreportedintheIPEEEsubmittal, appearreasonable.

26.Resultsfordominantcoredamageplantdamagestates,asreportedintheIPEEEsubmittal, appearreasonable.

27.Resultsfordominantcomponent contributors tocoredamage,asreportedintheIPEEEsubmittal, appeargenerally reasonable.

Theseresults,however,shouldnotbeconsidered asrobust,duetoinaccuracies introduced inthefragility analyses(e.g.,fromboththeinputresponsespectralshapeusedandtheassumption ofzerouncertainty inmediancapacityforplant-specific fragility assessments).

28.Aspresented intheIPEEEsubmittal, thelicensee's qualitative assessment ofcontainment performance appearstobereasonable intermsofthescopeofcomponents considered, andthelevelofdetailemployedinwalkdowns andanalyses.

However,thefragility analysisoftheiceEnergyResearch, Inc.A-&ERI/NRC95-501

"~

condenser appearstohavebeenperformed incorrectly.

Fragility analysesforotherimportant components relatedtoaccidentmitigative aspectsofcontainment performance (e.g.,containment spraysystem,RPSmiscellaneous panels,andperhapsdirectcontainment failure)needtobereviewedduringthesitevisit.29.Thequalitative discussion ofcontainment performance contained inthelicensee's submittal doesnotspecifically addressexpectedmagnitude andtimingofradioactive releasesassociated witheachplantdamagestate.Thesubmittal doesnotexplicitly identifywhichcomponents aredominantcontributors totheriskoflarge-early, large-late, andsmall-early releases.

30.Thelicensee's evaluation ofcontainment performance appearstoadequately addressthescopeofpossibledirectfailurestothecontainment structure andcontainment internals thatmaycompromise bothaccidentprevention andmitigation.

31.Licensee's treatment ofpossiblesequences leadingtosmallorlargecontainment bypassappearstobelimited.The'onlybypassscenarioconsidered isfailureoftheRPS,leadingtopossiblefailuretoisolatethecontainment.

(Note,thisscenarioismoreconcerned withcontainment isolation, ratherthanwithtruecontainment bypasssequences, e.g.,interfacing systemsLOCAsorunisolated steamgenerator tuberuptures.)

32.Thelicensee's evaluation ofcontainment performance appearstoadequately addressthescopeofpossibledirectcomponent failuresthatmaycompromise accidentmitigation.

Thelicensee's evaluation ofcontainment performance appearstoadequately addressthescopeofpossiblefailuresofsupportsystemsthatarerequiredforaccidentmitigation.

Thosecomponents ofsupportsystemsrequiredtoachieveaccidentmitigation, yetnotrequiredforaccidentprevention, needtobeidentified duringthesitevisit,toascertain iffragility analysesofsuchcomponents needtobereviewed.

34Thedescription ofrelaychatterevaluation intheD.C.CookseismicIPEEEsubmittal appearstosatisfytheprocedural guidelines inNUREG-1407.

Alistof"badactor"relaysfoundinsafetyrelatedequipment modeledintheSPRA,andyetnotfallingwithinthescopeofUSIAC6,shouldbeobtainedandevaluated duringthesitevisit.35.Licensee's treatment ofsoilliquefaction concernsappearstobegenerally reasonable, althoughadditional datawillneedtobereviewedduringthesitevisittoconfirmadequacyoftheanalysis.

TheIPEEEsubmittal statesthatthepotential forearthquake inducedlandsliding doesnotexistatD.C.Cook.Thisclaimshouldbeconfirmed inawalkdownofthegroundssurrounding theplantduringthesitevisit.36.Licensee's IPEEEsubmittal doesnotprovideaverydetailedconsideration ofthepotential forfloodingduetoapossibleearthquake-induced seicheonLakeMichigan.

37.Licensee's assessment ofseismic-fire interaction issuesappearstobegenerally valid.Thisaspectoftheanalysisshould,however,bediscussed atthesitevisit(inconjunction withthereviewoftheinternalfireIPEEE)toinsurethatanypotential concernsareidentified andresolved.

EnergyResearch, Inc.A-9ERI/NRC95-501 38.Duringthesitevisit,thelicenseeshouldprovideadescription ofcomponents andsequences thatdominatetheriskofnotachieving accidentmitigation, particularly forcomponents requiredtomitigateaccidents thatcouldleadtolargerelease(earlyorlate)orsmall-early release.39.D.C.CookisaWestinghouse planthavingamovablein-corefluxmappingsystem.TheIPEEEsubmittal description ofthelicensee's evaluation andtreatment ofpotential seismicinteractions involving themovableinurefluxmappingsystemappearstofullysatisfytheconcernsofGI-131.However,designdetailsofstrapsandrestraints intendedtobracethefluxmappingcartshouldbeexaminedduringthesitevisit,anddetailsoftheHCLPFcalculation forthefluxmappingcartshouldbereviewedandevaluated.

Licensee's submittal saysthatexternaleventfindingsrelatedtoUSIA-45("ShutdownDecayHeatRemovalRequirements"

)werecombinedwithfindingsfromtheinternalanalysis(Section3.4.3oftheIPE).Thetreatment ofUSIAP5relativetoseismiceventsneedstobegivenattention duringthesitevisit,andSection3.4.3oftheIPEneedstobereviewedforseismic-related findings.

41.Ameaningful qualitative discussion ofthepotential impactsofuncertainty ontheseismicIPEEEfindingshasnotbeenincludedinthelicensee's submittal.

Thesubmittal's treatment ofissuesrelatedtouncertainty isasignificant weaknessofthestudy.42Sensitivity studiesconducted byAEPSCdonotadequately resolvesignificant concernsrelatedtotheseismicIPEEEprocedures andfindings, particularly indemonstrating therobustness ofrankingofthedominantriskcontributors.

Inmanyinstances, licenseeresponses toNRCquestions areinadequate, andfurtheranalysiswouldbeneededtosatisfactorily resolvetheissuesraisedinthosequestions.

43.Duringthesitevisit,IPEdatapertaining toaspectsoftheseismicIPEEEwillneedtobereviewedandevaluated.

Particular areastoconsiderincludetheuseofinternaleventssystemmodelingtodevelopaseismicplantmodel,consistency ofassessment ofnon-seismic failuresandhumanactions,treatment ofUSIA-45,andotheraspectsrelatedtoseismicissues.D.C.CookisaUSIAMplant.TheseismicIPEEEsubmittal makesreference toGIPprocedures implemented insomeaspectsofseismicwalkdowns andinrelaychatterevaluation.

OtheraspectsofUSIAP6resolution shouldbereviewedinthelicensee's USIA-46submittal.

Noparticular concernsrelatedtocoordination ofUSIAMandseismicIPEEEevaluations wereapparentintheseismicIPEEEsubmittal.

accidentpohcyEnergyResearch, Inc.ERI/NRC95-501A-10Licensee's seismicIPEEEsubmittal doesnotfullysatisfyIPEEEobjectives andpertaining NUREG-1407 guidelines.

Thedeficiency inthesubmittal isnotintheoverallapproach, butratherinanumberofspecificimportant evaluation details.Thesedetailspertainmostlytomethodsandresultsofthefragility evaluations, andtheirimpactsondominantriskcontributors.

Inaddition, thesubmittal's description concerning disposition ofidentified seismicconcernsanddominantriskcontributors isclearlyinadequate andnon-responsive totheassociated IPEEEobjective.

ItisjudgedthatamoderateeffortonthepartofthelicenseewillberequiredtorevisetheseismicIPEEEprocedures andsubmittal tofullysatisfytheguidanceofNUREG-1407 andresolvesevere-concerns.

46.Licensee's generaloverallIPEEEprocessindeveloping findingsregarding potential plantimprovements identified inseismicwa!kdowns andregarding dominantriskcontributors evaluated throughriskanalysisiswellexecuted.

Itssuggested treatment ofseismicconcerns, however,isweakandlargelyunresponsive tosevere-accident policyconcerns.

Inparticular, akeyobjective ofGenericLetter88-20,Supplement 4,istoidentifyandimplement low-cost, effective safetyenhancements.

ItisjudgedthattheseismicIPEEEsubmittal doesindeedidentifyanumberofareaswheresignificant safetyenhancement wouldbeachievedatlowcost,yetthesubmittal suggeststhattheseitemswillnotbeimplemented.

Examplesinclude:fixingmissing/broken anchorages, strengthening thesupportbracingofaCO,tanktoreduceseismically inducedfirehazard,repairing fireextinguisher mountings, insuringpropermountingoffluorescent

lighting, andimplementation ofothersimplemodifications.

Licensee's seismicIPEEEsubmittal needstogivegreaterattention toimplementation ofpotential safetyenhancements, andprovidejustification ininstances whereitsevaluation doesnotsupportimplementation ofapotential safetyenhancement.

47.TheseismicIPEEEsubmittal doesnotspecifically identifycontainment-performance concernsandpotential opportunities forimplementing cost-effective safetyenhancements relatedtoaccidentmitigation.

Giventhescopeofitemsinvolved, itseemsreasonable toquestionthisresult.Additional reviewandevaluation duringthesitevisitmayhelpdevelopabetterbasisforsupporting orrefutingthisresult.48.Asdescribed intheseismicIPEEEsubmittal, considerable efforthasbeenexpendedbythelicenseeininvolving itsstaffintheIPEEEprocess.Inaddition, thelicenseeintendstomaintainitsIPEEEasalivingstudy.Thisdegreeofparticipation isaclearstrongpointofthelicensee's overallI&BEEeffort.EnergyResearch, Inc.A-11ERI/NRC95-501

A.2~~Thefollowing istheD.C.CookIPEEEsiteauditexitreportforseismic.PlantD.C.CookSeismicIPEEESiteAuditExitReportByDrs.R.T.SewellandM.V.FrankTheseismicauditwasundertaken withtheobjective ofdetermining whetherornotthelicensee's submittal meetstheintentofsevere-accident policyandmeetstheIPEEEguidanceprovidedinNUREG-1407.

TheseismicauditoftheD.C.CookIPEEEfocusedoncollection ofinformation, anditsevaluation, withrespecttothefollowing items:SeismicWalkdowns SeismicSystemsEvaluation SeismicFragility Assessment Disposition ofWalkdownFindings/Recommendations 3.1PlantWalkdowns Theauditrevealedtheplantwalkdowns tobewellexecutedanddocumented.

Thereappearstohavebeengoodcommunication, generally insuringthatallitemsidentified inthewalkdowns weretreatedintheseismicfragility assessment and/ortrackedforsubsequent disposition.

3.2PlantModelingandAnalysisThesystemseventtree/fault treemethodology followedstandardpractice.

However,bothinadvertent modelingerrorsandsimplifying assumptions haveledtoamodelthatdoesnothavesufficient resolution toprovidearobustdetermination ofspecificriskcontributors.

Theassumptions alsohavetheeffectofproviding averyconservative estimateofcoredamagefrequency.

Indeed,theassessment leadsareviewertoconcludethattheplanthasessentially noseismicmargintoresistearthquakes moreseverethantheDBE.Thefragility analysisintroduces excessive conservatisms, whichisamajorfactorintheevaluation oflow-to-no seismicmargin.Thisisanartificial result;whereastheIPEEEsubmittal suggests(roughly) plant-level medianandHCLPFcapacities, respectively, ofabout0.3gand0.2g,itis'xpected thattheplanthasasignificantly greaterseismiccapabili:y.

DespitetheIPEEEresult,however,alowseismiccoredamageriskisstillsuggested forCook.EnergyResearch, Inc.A-12ERI/NRC95-501

Themajorproblemwiththefragility analysisisthatitdoesnotproperlyrepresent realistic

insights, particularly thelistandrankingofdominantriskcontributors forD.C.Cook.Otherproblemsinplantmodelingandanalysisinclude:Assumptions suggesting that4160V,600V,and250Velectricpowersystemseachfailentirelyifanycomponent inthefragility listofpertinent components fails.CCWsystemwasnotcorrectly modeled,andtherefore, erroneously wasnotpartofthedominantcontributor list.Assessedauxiliary buildingandscreenhouse conditional failureprobabilities weretoohigh,andmaskedindividual component failureprobabilities.

~Assessedelectrical powersystemfailureprobabilities mayalsobetoohigh,possiblymaskingtheriskcontribution comingfrommechanical components.

Afinalpointisthatacondition withaweakpedestalsupportonaCCWheatexchanger appearstobeoverlooked intheIPEEEsubmittal, althoughthiscondition maycontrolthefailureprobability oftheCCWsystemandmaybealikelysignificant riskcontributor.

3.3Personnel Interviews

~~~Personnel werehighlycooperative inassisting withtheaudit.Interviews wereconducted withAEPSCpersonnel, Westinghouse personnel, andEQEpersonnel, plusplantoperators.

Theywereallveryhelpfulandwillingtohelp.3.4Disposition ofIPEEEFindingsPlantauditwalkdownlookedatplantconditions relativetorecommended fixesfromtheIPEEEseismic-walkdowns.

Inmanyinstances, therecommended fixeshadnotbeenimplemented (onlytwofixeswereverified).

AEPSC'sprocessfordisposition oftherecommended fixeswasreviewed; however,thebasesforrejecting recommended fixeswerenotclearbecauseindependent calculations thatweremadewereunavailable.

4I4.1Evaluation ofStrengths andWeaknesses Themajorstrengths ofthestudyincludethefollowing:

1.Licenseeexpendedsignificant effortwithrespecttothedepthandbreadthofthestudy.2.Theoverallmethodology forconducting theIPEEEappearsfullyadequate, andrepresents soundpractice, asfarasIPEEEisconcerned.

3.EnergyResearch, Inc.A-13Aparticular strengthofthestudywasawell-executed plantwalkdown.

EM/NRC95-501 J'

QaThesignificant weaknesses ofthestudyinclude:Fragility methodisinaccurate, calculations areover-conservative, andtheoverallanalysisisflawedsuchthatthedominantriskcontributors mayhavenotbeenidentified.

2.Systemsanalysismadesignificant simplifying assumptions andomissions, maskingdominantriskcontributors.

Theneteffectof(1)and(2)isthatthecalculated resultofplantcapacityartificially suggeststhatthereexistsnoseismicmargin(i.e.,capacityinexcessoftheDBE)atD.C.Cook.4TheintentofGenericLetter88-20isnotmetbecausetheIPEEEhasnotrevealedthedominantriskcontributors, thusleadingtoerroneous appreciation ofsevere-accident

behavior, including understandings andinsightsrelatedtoexpectedplantresponseinanearthquake.

Concerning thefragility calculations/analyses, removingsimplifiications andcorrecting omissions willaltercalculated riskcontributors andcoredamagefrequency.

5.Theinteraction plansbetweenUSIAMandtheIPEEEwerereviewed.

ThelicenseehasagreedtoinsurethatUSIA-46findingsarepassedtoIPEEEforevaluation ofpotential impacts.IPEEEfindingshavealreadybeenpassedtoUSIA-46.(Note:Itisnotclearthatthispassingofinformation willnecessarily insurethatimpactsofUSIA-46findingsonIPEEEfragility assessments willbeincorporated.)

EnergyResearch, Inc.A-14EJU/NRC95-501

cVAPPENDIXB:~~B.1SUMMARYOFFIREREVIEWFINDINGSThefireanalysispartoftheD.C.CookIPEEEwasreviewedusingthequestions andtopicsprovidedinSection4oftheIPEEEReviewGuidanceDocument[12].Thenotesobtainedinperformance ofthatreviewareprovidedbelow.Reviewthesummaryreport,assembled documentation andreports,toascertain thatsufhcient information isprovidedforthereviewertoformanunderstanding ofthesalientfeaturesofthepowerplant,andtheinformanon citedinthesummaryreportisproperlysupported.

Thefollowing documents wereavailable forreviewpriortothesiteaudit:DonaldC.CookNuclearPowerUnits1and2,Independent PlantEvaluation, ExternalEvents,SummaryReport,AmericanElectricPowerServiceCorporation, April1992.Attachment totheletterdatedJuly22,1993fromE.E.Fitzpatrick, VicePresident ofIndianaMichiganPower,toT.E.MurleyofU.S.NuclearRegulatory Commission, Reference NumberAEP:NRC:1082G.

"SafeShutdownCapability Assessment, ProposeModifications andEvaluations

-10CFR50,AppendixR,SectionIII.G,"DonaldC.CookNuclearPlantUnits1and2,'ndiana

&MichiganElectricCompany,AmericanElectricPowerServiceCorporation, Revision1,December1986.Muchinformation iscitedintheSummaryReport[1],butveryfewitemshadbeensubstantiated byreference documents orsupporting information.

Onpage1-1oftheSummaryReport,thelicenseestates"AEPSChasretainedallsupporting

analyses, descriptions andfilespertaining totheIPEEE."Itwouldhavebeenhelpfulinplanningthesitevisitifalistofthesesupporting descriptions andfileswereprovidedintheIPEEEsubmittal.

Thefollowing information weremadeavailable duringthesiteaudit:~"FireRiskAnalysis,"

D.C.CookPRAVolume11,April1992,Rev.0.~MemofromJ.M.McNanietoDC-N-6280<,

COMPBRNinput/outputs attachedtothememo,February28,1992.FHAdrawingsinD.C.CookFireHazardAnalysis, January31,1992,Rev.6.Calculation sheetsandothersupporting documents forfirefrequency evaluation foreachfirezone.(Thesewerepartofthefireriskanalysisdocument.)

COMPBRNinputsandoutputs(memobyJ.M.McNanie).

ERI/NRC95-501V,Adescription ofthefire-induced initiating eventanalysis(e.g.,reactortrip,transients andLOCAs)(included inthefireriskanalysisreport).EnergyResearch, Inc.B-1

'4~I' Samplecableroutinginformation (whichwasreviewedduringsitevisit).Information onthemodelusedforfire-induced coredamage(i.e.,theIPE/PRAcoredamagemodel).Basedonthecommentsgenerated bythisreviewteamonRevision0ofthefireriskanalysis(Reference 10),thelicenseerevisedtheanalysisandthensubmitted thefollowing documents:

LetterfromE.E.Fitzpatrick ofAEPtoU.S.NuclearRegulatory Commission, February15,1995.Attachment 1totheabovereferenced letter,"Response toNRCAuditConcernsandRequestforAdditional Information."

"DonaldC.CookNuclearPlantUnits1and2,FireAnalysisNotebook,"

Revision1,February1995.Theinformation providedintheabovereferenced documents wasusedtogeneratethefollowing comments.

Notetheoverallmethodology thathasbeenemployed(i.e.,whetherthemethodology isFIVE,PRAoracombinanon ofthetwo).Level1PRAmethodology isemployedtoconductthefireIPEEEanalysis.

Thelicenseeclaimsthatthiswasdoneaccording toNUREG-1407.

Itisalsoclaimedthat"thefireanalysisfortheIPEEEutilizedtheinternaleventsLevel2PRAtoidentifycontainment performance issues."Ithasbeenassumedthatafireatanyzonewouldleadtoatleastareactortrip.A'nexhaustive analysisoftheinitiating eventshasbeenpresented inthefireriskanalysisreportthathasconcluded thatLOCA'otherthanRCPsealfailurefromlossofCCW)andlossofoffsitepowerarenotpossibletooccurasaresultofafireatD.C.Cook.TheD.C.CookIPEEEusedacommonPRAbasedapproachinwhichascreening assessment.

eliminates allbutarelatively fewfireareas.Adetailedeventtreeandfaulttreeanalysis, withthesemodelscomingfromtheIPE,isusedtoassesscoremeltfrequency Romlocalor'globalfireswithintheareasthatsurvivethescreening.

Severalfireareassurvivedthescreeningprocess.

DetailedPRAmethodswereused, whichpostulated completeunavailability ofallcomponents inanarea,determined theinitiating event(s)causedbytheunavailability, modifiedthefaulttreesofeachoftherelevantIPEeventtrees,andquantified acoredamagefrequency.

2.Reviewtheequipment andassociated cablesselectedforfiredamageassessment.

Reviewershouldascertain that:addresEnergyResearch, Inc.B-2ERI/NRC95-501Thelistcoincides completely withtheequipment usedinthemodel.&emodelcanbeeithertheIPEfaulttreesandeventtreesorthesafeshutdownlist(e.g.,thoseusedintheAppendixRsubmittal).

Suchpassiveequipment aspipesandcheckvalvesmaynotbesedinthereview.

J Thisissueismentioned inSections3.1.1,4.1(assumption 2)and4.3,whichstatethatIPEandsafeshutdownequipment andcables(i.e.,AppendixRequipment) areincludedinthefirezonescreening process.Thesafeshutdown(perAppendixRdefinition) equipment andcableswereused.Furthermore, thelistofequipment usedforfireimpactmodelingincludedmotorcontrolcenters(MCCs)andvalvecontrolcenters(VCCs)whicharetypically notexplicitly modeledinPRAs.Thelistincludeselectrical cabinetsandbusesoftheelectricpowerdistribunon systemmodeledintheIPEorinternaleventsPRA,andassociated controlcircuitcabinets.

Persitevisitobservations, itcanbeconcluded thatelectrical cabinetshavebeenmodeled.Thelistincludesequipment andcablesthatareassociated withcontainment performance.

Theeffectoffireoncontainment performance isanalyzedqualitatively (Section4-9ofReference 11)usinganalogies totheinternaleventsLevel2PRA.3.Reviewtheinitiaring eventsandfireimpactmodel.Ascertain thatallpossibleiniriating events(e.g.,reactortrip,transients andLOCAs)havebeenidenrified, andthoseidentified canindeedbecausedbyafire.Anexhaustive analysisofthepossibility ofoccurrence oftheinitiating eventsfromafirehasbeenconducted.

Toestablish thefrequencies oftheinitiating eventsforsomeofthefirezones,eventtreetypeofmodelshavebeenusedinReference 11toaccountforpartialfailurefromafireevent(Figures1through10ofReference 11).Therearesomecalculational discrepancies intheseeventtreesthathavenotbeenexplained inthetext.Forexample,inFigure1thefrequencies ofthebottomtwosequences shouldbe1.1E-07and1.1E-09,whereas1E-08and1E-10areshownonthefigure.Similarerrorisnotedinalmostallofthefigures.Morespecifically, ascertain thattheReactorCoolantSystemandPowerConversion Systemboundaries havebeenanalyzedforthepossibility oflossofintegrity fromafire.Reference 11doesnotaddressthepossibility ofafireaffecting highandlowpressureinterface failurefromafireevent.Thatis,theoccurrence ofaLOCAfrominadvertent openingofisolation valveshasnotbeenconsidered inthisIPEEE.However,onpage4oftheLicenseeResponsetoNRCQuestions

[2]thisissuehasbeenraised,anditisconcluded that"withinareasonable probability" suchaneventisnotpossible.

Generally, sucheventsareveryunlikelytooccur.Thepossibility oftransients isproperlyaccounted for.Reactortripisassumedforallfirezones/areas, andthetransient eventtreewiththePowerConversion Systemavailable isusedtomodelthefireimpact.Thediscussions regarding lossofESWinthefireriskanalysisreportdonotaddresstheopenpassagebetweenthetwoESWpumps,andthelackofbarriersbetweenthetwotrainsofESWMCCs.EnergyResearch, Inc.B-3ERI/NRC95-501 lgt Lossof250VDCpowerisexplicitly addressed.

Oneofthesignificant scenarios islaterfoundtoincludethisinitiating event.Thepossibiliries ofReactorCoolantPumpsealfailureandtransient-induced LOCAsareanalyzed.

Thepossibility ofRCPsealfailureisaddressed inReference 11,aspartofCCWfailureoccurrence.

Thefireimpactmodel(i.e.,theinternaleventscoredamageandcontainment failuremodelmodrfredfor+reanalysis) isreasonable.

TheIPEmodelisusedforcor'edamageassessment.

Useofsuchamodelisproperandreasonable.

Theinitiating eventfrequencies, andassociated systemunavailabilities, havebeenmodifiedtoreflectfireinducedfailures.

Reviewtheftrezonelarea definitions.

SelectasamplePomthefirezones(e.g.,thecontrolroom,cablespreading areas,pumprooms,andcablevaults)andstudythembasedonthelicensee's FireHazardAnalysis, AppendixRandwalk-down notestoseewhetherproperartenrion ispaidtoidenrifying theboundaries ofthepirezonelarea andpotennalpropagarion pathsamongthezonesandareas.Firezone/area definitions arebasedonthefirehazardanalysisdoneaspartoftheD.C.CookAppendixRsubmittal.

Itisnotclearifthelicenseehasconsidered mechanisms otherthanfireaffecting abarrier.Forexample,insomespecialcasesthedoortotheaffectedareamaybeopenedbythefirebrigadetogainaccesstothefire.Insuchacasethebarrierwouldbebreached, andadditional firezonesmaybeexposedtoafire.Duringthesitevisittheareasvisitedincludedthecontrolroom,thecablevault,4kVswitchgear rooms,firezones45,46A,44S,44N,60,29A,29B,29E,29F,17D,17E,17F,17G,and17A,andLSIlocations intheauxiliary building.

Forseveralfirezones,theboundaries w'erecomparedwiththosepresented intheFHAfirezonedrawings.

Nodeficiencies wereidentified.

Thefollowing addirional quesrions mayalsobeconsidered bythereviewer:

Isthefirezonelarea selection identical tothatusedintheAppendixRsubmittal?

Ifnot,whatarethedifferences, andhasrhelicenseeselectedtheftrezoneslareas reasonably?

ThelicenseehasusedtheAppendixRinformation andFireHazardAnalysis(FHA)forselecting firezones/areas, andhasusedthosereportsandawalkthroughforcombustible loading,cablepathways, andassociated component connections foreachfirezone/area (assumption 10,inSection4.1ofReference 11).Areacrivefireprorecrion featuresusedforftrezonejareadejinirion?

Ifyes,hasthe.failureprobabiliry oftheftreprorecrion featurebeenconsidered duringfirezonescreening?

Activefireproduction systemshavebeenusedfordefiningtheboundaries ofseveralfirezones.Thefollowing areashavesuchcharacteristics:

EnergyResearch, Inc.BPERI/NRC95-501 Betweenfirezones45and46A(41and42AforUnit1)thereisaroll-updoorthatisnormallykeptopen.Firezone29Aand29Bareconnected withanopendoorway.Firezone17Ahasfiredampersthatopenintotheturbinebuilding(fiirezone60).Inallcases,theisolation devicescloseautomatically uponfiredetection.

However,thefireriskanalysisdoesnotaddressthepossibility offailurefortheseisolation devices(assumption.9 inSection4.1ofReference 11).Hastheentireplantbeenmappedbyfirezonesandareas?Ifnot,istheredocumentarion tosupportthereasonsforexcluding theseareas?Allareasoftheplantthatcontainequipment orcablesthatareassociated withsafeshutdownorthePRAeventtreemodels,havebeenmappedproperlyintofirezones.5.Reviewequipment andcablelocarions.

Selectasampleoffirezones(atleastthreediferentzones)andascertain thatthelistofequipment andcablesareproperlyusedandtabulated, andthustherearenoinconsistencies.

Panicular attention shouldbepaidtotheequipment andcableswhichareincorporated intotheplantIPEmodel.Duringthesitevisit,thefireauditteamreviewed"SafeShutDownSystemAnalysis" VolumesI,IIandIH.Theseprovideseveralcrosstabulations ofcomponents, associated cables,fireareasandfirezones.6.Reviewthefirescreening methodology andconsiderthefollowing questions:

Isthemethodology reasonable andconservarive, anddoesitcoverallpossiblecondirions thatmayariseinafiresituation?

Ascreening methodology hasbeenusedforidentifying therisksignificant firezones.Themethodology includesseveraltiersofscreening.

Intheinitialtier,thefirezonesthatdonotcontainanysafeshutdownequipment orcablesareeliminated fromfurtheranalysis.

Aspartoftheinitialstep,thecontainment firezonesarealsoeliminated withoutfurtheranalysis, basedontheargumentthatotherfirePRAshavenotshownanyrisksignificant containment firescenarios.

Thisconclusion ismostlikelytobecorrect.However,thereisaslightpossibility thatthelayoutofCook'containment isdifferent fromtheaveragePWR,andmayincludeauniquepotential concern.Aftertheinitialscreening basedonzoneswithnosafeshutdownequipment, asecondscreening wasconducted byassumingthatafiremadealltheequipment intheaffectedroomunavailable.

Zoneswerescreenedoutifthecalculated coredamagefrequency waslessthan10'/yr.ThePRAeventtreeandfaulttreeswereusedforthisscreening.

ThePRAeventt'reeistheLevel1treeforatransient withthePowerConversion Systemavailable.

Isthemethodforassigning fireoccurrence frequency foreachroomconservative?

EnergyResearch, Inc.B-5ERI/NRC95-501

Thefirefrequency foreachfirezoneisconservative.

Athoroughanalysisoffireinitiation frequency hasbeenconducted bypartitioning fireoccurrence dataamongthosefirezoneswheresimilarfirescouldoccur.Forareaswhereafireeventcouldnotbeassigned, afrequency of1.0E-03peryearhasbeenassigned.

Isitassumedthatinthefirsttierofscreening, allequipment andcablesfailintheworstpossiblemanner?Inthescreening stagesitisassumedthattheequipment andcablesfailimmediately.

Noinformation isprovidedastowhetherthereareequipment thatmayfailinmorethanonemode,andwhethertheanalystshaveidentified theworstfailuremode,andassumedthatmodeforscreening purposes.

Iscoredamagefrequency usedasthescreening measure?Ifnot,idenrifythemethodusedforscreening anddetermine ifitisreasonable.

Thefirstscreening isbasedonpresenceofsafeshutdownequipment (thisineffectdealswithcoredamage,butdoesnotexplicitly verifythepossibility ofoccurrence ofcoredamage).Inthesecondtierofscreening, coredamagefrequency isusedforscreening.

Isthethreshold coredamagefrequency forscreening sugctently smalltoavoiddiscarding firescenarios thatwhenaddedtogethermaysignificantly increasethecoredamagefrequency?

Thethreshold fire-induced coredamagefrequency issetat10'eryear.Table12ofReference 11liststheCDFforallfirezonesthatsurvivedthefirstscreening test.FromthislistitisseenthatmanyoftheCDFaresufficiently small,suchthattheircumulative effectontotalfireCDFisminimal.Aretheequipment andcablesthatcontribute tothecontainment failuremodeincludedinthescreening process?Ifnot,aretheseequipment andcablestreatedproperly?

Section4.7oftheSummaryReportandSection4.9ofReference 11addresscontainment performance.

Containment relatedequipment (e.g.,containment isolation valvesorcontainment coolingfans)werenotincludedinthefireimpactmodel.7.Reviewthefireoccurrence frequencies.

Reviewtheoverallmethodology forestimaring thefirefrequency foreachzone.Thefollowing questions maybeconsidered:

Istheoverallmodelforfirefrequency basedongenericcategories offireareas?Ifnot,doesthemodelproperlyurilizetheoverallindustryexperience?

TheIPEEEhasusedtheapproachofmanyexistingPRAs,wherethefirefrequency isestimated forgenericcategories offireareas(building types).Theplantspecificfireareafrequencies aredeveloped byrationing thefirefrequency amongdifferent firezonesofabuilding, according tothefirehistoryofthespecificareausingindustry-wide fireoccurrence data.Thus,forareaswhereafirehasoccurredintheindustry, afractionofthefireincidence dataisassignedaccording tothecharacteristics nfthearea.Forareaswherenofireincidence historyexists,afirefrequency of0.001peryearhasbeenused.EnergyResearch, Inc.B-6ERI/NRC95-501 I

InapplyingtheSandiafirefrequency databasetotheD.C.Cookanalysis, thefireincidents fromthefivegenericcategories giveninthedatabasewereallocated tothesixD.C.Cookgeneralzones.Inonecas=,thisallocation canbenonconservative.

InSection4.4.1ofReference 11,itisstatedthatallreactorbuildingexperience fromtheSandiadatabasewasallocated totheD.C.Cookcontainment.

Itisnotclearhowreactorbuildingfiresareinterpreted.

Reactorbuildingfireexperience islargelyfromBWRs.BWRreactorbuildings haveequipment thatisfoundinPWRauxiliary buildings.

Thus,acertainfractionofreactorbuildingfireexperience shouldhavebeenallocated totheD.C.Cookauxiliary building.

Subsequently, intheD.C.Cookanalysis, allcontainment locations werescreenedoutonessentially thesamebasisasintheFIVEmethodology.

This,ineffect,removesrelevantfiredatafromtheanalysis.

Isthegenericfireoccurrence dataPomacredibleandacceptedsource(e.g.,NUREGICR-4586 orTable1.2oftheFIVEreport)?TheD.C.CookIPEEEusedacrediblesourceofgenericfirefrequency data,i.e.,theSandiafiredatabaseasrepresented inNUREG/CR-4586 andtheassociated FIREDATAcomputerprogram.HaveshutdownPresbeenincludedinthepoweroperation fireoccurrence database?IntheLicenseeResponsetotheNRCQuestions

[2]and,inSection4.4.1ofReference 11,itismentioned thattheSandiafiredatahasbeenscreenedforhotandcoldshutdownfiresthatcouldoccurduringpoweroperation.

Haveplant-speci Jtcfireoccurrence databeenusedforevaluating thefirefrequencies?

Noplant-specific firedatawasused.Itwasclaimedthatincluding theoneapplicable plant-specific firewouldnotchangeanyresults.Isthefirefrequency ofeachfirezonelarea obtainedfrompanitioning thefirefrequency ofacollection ofzonesandareas?Ifnot,isthetotalfirefrequency fortheplantconsistent withtheindustryexperience?

Thefirefrequency wasobtainedfrompartitioning thebuildingfirefrequency tospecificzones.Rationing byareahasafundamental pitfall.Itbegsthequestionofhowfinetheoriginalfiieareadatabasecanbedividedupintopieces.Ifsmallenoughareasareconsidered, itcanalwaysbeshownthattheproductofthearearatioandthefireareafrequency islessthanwhateverscreening criteria(e.g.,10'eryear)ischosen.Nosuchabuseofthemethodology hasbeennotedintheD.C.CookIPEEE.Furthermore, thelicenseehasassignedastandard1.0E-03/year frequency toallthoseareaswhereahistorical firecouldnotbeassignedto.Thispracticeshouldleadtoaconservative totalfrequency offirefora'givenbuildingorgeneralfirearea.Ifabuildingfirefrequency ispanirioned forobtaining thefirefrequency ofspecificzoneslareas, isit.donebasedonflammablelcombusrible materials loading,ignirionsourcesnndlortransient fuelloading?Theallocation ofthegeneralzonefirefrequencies tospecificareaswasbasedonhistorical fireeventsforthespecificarea.Thelicenseehasredonethispartoftheanalysissinceitsinitialsubmittal oftheIPEEE.EnergyResearch, Inc.B-7ERI/NRC95-501 8.Sumthecoredamagefrequencies conservarively assignedtothescreenedoutfirezonesandareas.Doesthissumrepresent as.'gnificant fractionofthetotalIPEcoredamagefrequency?

Isthecore~damagefrequency properlyusdforfireoutlieridentification?

Asaresultoftheinterviews duringthesitevisitandareviewoftheinitialfireriskanalysisreport,itwasconcluded thatfirecoredamagefrequency wasunderestimated significantly.

Thecurrentfireriskanalysis(i.e.,Reference 11)isbasedonmorereasonable assumptions andanalysisthantheinitialstudy,andtherefore theresultsareconsidered credibleforidentifying meaningful plantimprovements.

ThesumoffirescenarioCDFsgiveninTable12ofReference 11,thatarescreenedout,is3.0E-06peryear.TMsisaboutthesameasthetotalCDFbasedonthefinallistofsignificant firescenarios.

Itcanbearguedthatifthescreenedoutscenarios wereanalyzedfurther,thetotalscreenedoutCDFmayendupbeingsignificantly smallerthanthatgivenabove.Hasthecontrolroombeenscreenedout?Reviewthemethodtoascertain thatproperconsiderarion hasbeengiventocontrolcircuitfailuresandoperatoracrionsduringanaccidentsequence.

Havethepossibilities ofequipment failureandinadvertent operanonbeenconsidered?

Hastheprocedure forcontrolroomfiresuppression beenconsidered?

Havetheprocedures forretrearing fromthecontrolroombeenanalyzed?

Theinitialfireriskan'alysis screenedoutthecontrolroombytakingcreditfortheotherunit's(Unit2)Auxiliary Feedwater System(AFWS).Therevisedfireriskanalysis(Reference 11)followstheexampleoftheSeabrookPRA,wherethreefiredamagescenarios arepostulated.

TheanalysisforD.C.Cook(Section4.8.17ofReference 11)doesnotindicatewhethertheanalystshavereviewedthecontrolpanellayoutofthecontrolroomtoascertain thatnoothercomponent/equipment groupings arepossible.

Fromthestatements madeinthatsection,itisconcluded thatthecontrolpanellayoutofD.C.Cook(i.e.,locationofdifferent controlswitches, indicators, controllers andotherdevices)isverysimilartothatoftheSeabrookcontrolroom.Fromthediscussions providedinSection4.8.17,itcanbeinferredthattheanalystshaveindeedlookedintothelayoutofthecontrolpanel,anddetermined suchfactorsastheconditional frequency ofdamageatacertainpoint,givenafireeventinthecontrolroom.Theanalystshaveusedprobability valuesforcontrolroomevacuation andhumanerror.10.Havecablespreading areasbeenscreenedout?Reviewthemethodtoascertain thatproperconsiderarion hasbeengiventocontrolcircuitfailuresandoperatoracnonsduringanaccidentsequence.

Havethepossibiliries ofequipment failureandinadvertent operarion beenconsidered?

Hasthedamageassociated withfiresuppression activities beenconsidered?

Hasthesitereview,thewalk-down, andtheanalysisconsidered redundant trainco-location?

Similartothecontrolroom,theinitialstudyhadwrittentheseroomsoffasriskinsignificant.

ThereareseveralareasatD.C.Cookthathavethecharacteristics ofatypicalcablespreading room.Theseareashavebeenanalyzedexplicitly intherevisedfireriskanalysisreport(Reference 11).Theequipment failureandeventsequenceanalysisistakentobesimilartothatofthecontrolroom.However,thefrequency offireoccurrence istakentobe1.3E-05peryear.Thisfrequency isquitelowerthanthatEnergyResearch, Inc.B-8ERI/NRC95-501 usedforotherareasoftheplantforwhichhistorical firedatadonotexist.Forthoseareas,theanalystshaveused1.0E-03peryear.Theanalystshavenotmadeananalysisofthelayoutofthecablesinthecablevaults,andhaveassumedthatthearearatiosusedforcontrolroomfirescenarios areapplicable tothisarea.Thebasisofthisargumentisweak.Itisquitepossiblethatthesameratiomaybeapplicable.

Itisnotclearwhethertherecouldbeotherareaswithinthevaultswhereseveraloppositetraincablescometogetherinonesmallarea.Il.Whatassumptions havebeenmadewithregardtothefailureoregecriveness offirebarriers?

Intheinitialstudy,aCOMPBRNanalysisismentioned forcheckingtheeffectiveness ofthebarriers.

However,thefollowing issueshavenotbeenaddressed inthatanalysis, andtheyareapplicable totherevisedanalysisaswell:Possibility ofbarrierfailureduetofirefightingactivities (e.g.,dooropenedtoaccessanotherroom).Possibility offirewrappingfailurefromopenboltends(observed inarea6N).Possibility offiredamperorfiredoorfailuretocloseautomatically.

12.HasthefailureoftheAuxiliary ShutdownPanel(oritsequivalent) beenconsidered intermsofsmokeingressfromthefire,theoperator's pathtoapproachthepanel,theprocedure thatinitiates thetransfer, andthepossibility ofconfusion betweentw0operators (i.e.,operators workingsimultaneously fromtwodiferentlocations, e.g.,thecontrolroom,thecontrolcircuitisolation cabinetandtheauxiliary panel)?Theequivalent oftheAuxiliary ShutdownPanelatD.C.CookisreferredtoastheLocalShutdownIndicator (LSI)panels.Itisacollection of6localpanelsintheauxiliary buildingthatcontainvariouskeycontrolandinstrumentation functions.

TheLSIhasbeenconsidered, butnotmodeledexplicitly.

ThecontrolroomandcablevaultanalysesintherevisedfireriskanalysisreportcomputesCDFswithoutmodelingusageofLSI.Thissimplifies theanalysisanddoesnotdiminishtheresults.13.Havethefirefightingpractices beenreviewedaspartoftheIPEEEtoascertain thatinnocaseswouldthepirefightingeffortjeopardize thesepararion betweenredundant trains?Willftghringthefireorgemngtothefirecausefirebarrierstobeopenedorbreached?

Therevisedfireriskanalysis(Reference 11)doesnotexplicitly modeltheeffectsoffiredetection andsuppression systemsontheCDF.Inthecaseofsomeofthefirescenarios (e.g.,controlroomandcablevault),theeffectsoffireprotection systemsisincludedimplicitly.

Thelicensee, however,initsIPEEEsubmittal hasdiscussed anassumption that10minutesisarepresentative manualsuppression timeforalllocations, andhasassignedaprobability of0.5forfailuretosuppressafiremanually.

Thismayberealistic forsomezones,conservative forsomeothers,andnon-conservative fortherest.Thenetaffectontheriskassessment ishardtoestimatewithoutproperconsideration astothefireset-upofeachzonewithrespecttothefirebrigade's

training, location, typeofmanualfirefightingequipment, etc.TheFIVEmethodology recommends, however,zonespecificmanualsuppression timesbasedonfiredrilldata.IfEnergyResearch, Inc.B-9ERI/NRC95-501

~~,I asingleaveragesuppression timeisusedforalllocations, asensitivity studyshouldbeperformed ontheeffectofrealistic variations onthistime.Thelicenseehasconducted anextensive analysisoftheadverseeffectsoffiresuppression activities onsafeshutdowncomponents.

14.Selectatleasttwofibrezonesiareas thathavebeenanalyzedindetailandconductathoroughreviewoftheanalysis.

Hasthefirezone/area beensubdivided iruosmallerareas?Isthesubdivision basedonequipment andcabledistriburion inthefirezoneiarea?

Inthecaseofcontrolroomfireanalysis, theareahasbeensubdivided intosmallerareas,whereCCWandESWsystemscanbeaffected.

InthecaseofFireZone6N,theareaiseffectively dividedintosmallerareas.Theanalystshavefocused-onlyononeareawhereCCWfailureispossible.

Nootherareasofthisfirezonearefoundtoberisksignificant.

However,theanalystshaveelectednottousearearatiostoadjustthefrequency offireinitiation forCCWdamage.15.Hasfirepropagation analysisbeenperformed?

Forpirepropagarion analysis(e.g.,usingCOMPBRN,FSM,or.othermethodology) reviewthefollowing:

IfCOMPBRNis used,whichversionoftheprogramhasbeenemployed?

COMPBRNIIIehasbeenusedforfirepropagation analysis.

Intheinitialfireriskanalysis, andintherevisedversion,severalreferences aremadeastotheuseofthiscodeforverifying thepropagation characteristics ofafireinacompartment.

Isthemodelrepresentative ofthecondirions ofthefirezonelarea?

Duringthesitevisit,samplecasesofCOMPBRNmodelswereexamined, andthefirepropagation analysiswasfoundtobeproperlydone.Istheselecrion ofpilotfirereasonable?

Fromtheinformation providedinthesubmittal andinitialfireriskassessment, ithasbeenconcluded thatthelicenseeusedthesamepilotfireforallfirepropagation cases,andbasedonthatselection, theywereabletoconcludethatforseverallocations propagation wasnotpossible.

Thepilotfiredescribed onpage9oftheLicenseeResponsetoNRCQuestions

[2]is1mmdeep.Theburningdurationofsuchafuelisrathersmall,andtherefore, therewouldbeinsufficient timetoheatuptargetcablesandequipment tothedamageorignitionpoint.Assumingapilotfirewithasmallerburningsurfacebutlargerdepththanthatdescribed onpage9mayleadtoadifferent conclusion.

Ingeneral,itisnotgoodpracticetouseonlyonepilotfiresize.Asapractical matter,avarietyofpilotfiresizesareplausible, eachwithitsownprobability ofoccurrence.

Thus,acorrectmethodology wouldbetoperformthecalculations probabilistically overarangeofpilotfiresizes.ItisquitepossiblethattheEnergyResearch, Inc.B-10ERI/NRC95-501F minimumpilotfiresizethatwouldleadtopropagation isunrealistically large.Thisshouldbeexpre'ssed probabilistically, orincludedinthesensitivity analysis.

Arethephysicalcharacteristics (i.e.,materials ofconstrucrion, meltingpoint,chemicalcomposirion, combusrion heat,etc.)anddamagethresholds forcablesandotherftresusceptible itemsreasonable?

Hasthelicenseeprovidedthebasisforselecring cablematerialcharacterisrics?

Theseissueswerenotaudited.Howaretheresultsusedintheanalysis?

Isthenmetodamageacriricalsetofequipment andcablestheobjecnveoftheanalysis?

Thetimetodamagehasbeenthemainobjective oftheanalysis.

HaveseveralpilotPresbeenusedtoestablish theminimum-pilotsizeneededtoinflictdamagetothecriticalsetofequipment andcables?Onlyinonecaseseveralpilotfireswereused.Generally, onlyonepilotfirehasbeenused.Thiswasfurtherdiscussed above.Aretheresultsofthedetailedjireanalysisreasonable?

Although, thefollowing commentsmaynotbevalidfortherevisedfireriskanalysis, severalstatements inthesubmitted documents needtobereviewedhere.Onpage10.oftheLicenseeResponsetoNRCQuestions, regarding Zone41,itismentioned thatcabletraysarenotvulnerable tofire-induced damage.Thisiscontrarytogeneralopinionoffiresusceptibility.

Furthermore, onpage11,itisindicated thatitisassumedthatcablesinclosedcabletraysandconduitsarenotsusceptible tofire.Thisassumption needstobesubstantiated, sincethecablesmayfailwithoutburning.Onpage22,itisindicated thatnoquantification wasperformed forthecableenclosure beneaththemezzanine area(Zone41-3).However,certaincablefiresthatarenotmodeledproperlyinthisIPEEEmayoccurandpropagate insidethevault.Onpage23,forZone44N,threecornersofthezoneareaddressed, butthesouthwest cornerisnotmentioned inthediscussions.

Therevisedfireriskanalysis(Reference ll)hasnotbeenauditedindetail.However,basedontheinformation providedinthatdocument, itisinferredthattheabovecommentsmaynolongerbevalid.16.Howhaveflresuppression considerations beenincludedinthemodel.Therevisedfireriskanalysis(Reference 11)doesnotprovideexplicitmodelsfortheeffectiveness ofthefiresuppressions systems.Whatarethesalientfeaturesofthemodel?ERI/NRC95-501Themodelsreviewedaspartofthesubmittals priortotherevisedriskanalysishadnumerousimportant deficiencies whichwerementioned tothelicenseeduringthesitevisit.Reviewofthosemodelsatthispointisdeemedtobe'immaterial.

\EnergyResearch, Inc.B-11 J

Isthetimingfordetecting andsuppressing apirequantified explicitly?

Inthesubmittals, otherthantherevisedriskanalysis, onerepresentative timeisusedforallcases.Thisisfurtherdiscussed intheresponsetothepreviousquestion.

Istheavailability ofthesuppression systemincludedinthemodel?Inthesubmittals, otherthantherevisedriskanalysis, theunavailability ofthesuppression systemshavebeenincludedintheanalysis.

Areplantspecificdataandfeaturesusedforesrimaring theavailability ofthesuppression system?Inthesubmittals, otherthantherevisedriskanalysis, genericunavailability valueshavebeenusedforthesuppression system.'owever,formanualfirefighting, plantspecificinformation hasinfluenced theestimation ofthetimetosuppressthefire.Hasthepossibility ofeq'uipment failurefromflresuppression activities beenconsidered andmodeled.'detailedaccountofthemethodology foranalyzing thedamagingeffectsoffiresuppression activities hasbeenprovidedonpages12through14oftheLicenseeResponsetoNRCQuestions

[2].Therevisedfireriskanalysisdiscusses thisissueinashortparagraph inSection5.3.17.Havetheresultsofthewalkdownbeenappropriately factoredintotherestoftheanalysis?

Hasthewalk-down verifietheassumprions madeaboutfireprotection

features, flrebarriers, keyignitionsources,andtheheightoftargetsabovethepilotpire?TheSummaryReportindicates thatatleasttwowalk-downs wereconducted, andspecialchecklists wereemployedforthispurpose.Inthesecondwalk-down, themeasurements neededforCOMPBRNanalysisweretaken.IntheLicenseeResponsetoNRCQuestions (page6),itisindicated thatonlyUnit1hasbeenreviewedindetail.AUnit2walk-down hasbeenconducted toverifythesimilarities betweenthetwounits.Therevisedfireriskanalysisreferstoadditional walkthroughs conducted aftertheauditteam'ssitevisit.Inthesewalkthroughs, risksignificant areashavebeenreviewedindetail.18.HavetheIPEorPRAeventtreesandfaulttreesbeenmodifietomodelflire scenarios?

Havethepropereventtreelfault treemodelsbeenemployedforthespeciflcflre scenarios thatareanalyzedindetail?Hasthecorrectiniriating eventbeenselected?

Haveprobabiliries ofequipment damagebeenalteredtoreflectflrecondirions?

Whatisthebasisforthecondirional probability ofequipment damagefromaflre?TheSummaryReport[1]mentionsthatthePRAmodelhasbeenmodifiedtoaddresstheimpactoffireonequipment andcables.However,thelogicmodelwasnotmodified.

Truncated versionsofcoredamagesequences wereusedwithfirefrequencies appropriately usedforinitiating events,andsystemunavailabilities modifiedperaffectedcablesandequipment list.Thetruncated modelwassuspected toEnergyResearch, Inc:B-12ERI/NRC95-501 yieldoptimistic resultswhenfire-induced coredamageisconsidered.

Thiswasmentioned tothelicenseeduringthesitevisit.Fromtherevisedfireriskanalysisreport[11],itcanbeinferredthattheIPEmodelshavebeenusedforCDFestimation.

Theconditional failureprobabilities andinitiating eventfrequencies havebeenalteredtoreflecttheeffectsofagivenfire.19.Hasthecoredamagefrequency beenesrimated foreachfrrescenario?

Aspartofthescreening process,thecoredamagefrequency hasbeenestimated forallfirezonesandareasthatsurvivedthefirstroundofscreening.

20.Isthecoredamagefrequency obtainedinStep8alargefractionofthetotalfire-induced coredamagefrequency?

Asmentioned previously, thetotalCDFofscreenedoutfirezones(fromTable12ofReference 11)isfoundtobealmostthesameasthetotalCDFofrisksignificant firescenarios.

However,furtheranalysisofthesescenarios mayleadtoaconsiderably smallertotalscreenedoutCDF.21.Whatarethecriteriaforidentifying vulnerabilities?

Havethecriteriabeenemployedproperly?

Noneofthedocuments haveincludedadiscussion ofthecriterion forestablishing afirevulnerability.

22.Haveuncertainries beenaddressed inthefireanalysis?

Havetheuncertainnes influenced rhevulnerabi.i'ty assessment issues?Section5.7ofReference 11addresses theissueofuncertainties bysimplymentioning theparameters offireriskanalysisthatentailuncertainties.

Noneofthedocuments available tothereviewers containsanexplicitdiscussion oftheuncertainties intheanalysisandintheresults.Reference 11,however,doesincludeadiscussion inSection6.0onareasofconservatism.

Thelistincludessuchissuesasthelackofincluding theeffectsoffiredetection andsuppression systemsintheanalysis, andtheprotection affordedbyfireretardant insulations andshields.23.HavetheSandiaScopingStudyissues(NUREGICR 5088)beenaddressed explicitly (e.g.,Attachment 10.5totheFIVEReport)?Ifyes,haverheissuesbeenaddressed completely andproperly?

TheSandiaScopingStudyissueshavebeenaddressed explicitly inSection5oftherevisedfireriskanalysis.

Thesafeshutdownpanelisnotindependent ofthecontrolroom.However,LocalShutdownIndication (LSI)panelscanbeusedtorespondtoacontrolroomorcablevaultfire.Withrespecttoseismically inducedfires,theSummaryReportdoesnotaddresstheseinSection4.8.However,intheLicenseeResponsetoNRCQuestions (page8),itisstatedthatcabinetmovement, tankmovement, andpumpleakageisnotaproblemforthedesignbasisearthquake.

InSection5.8oftheEnergyResearch, Inc.B-13ERI/NRC95-501

revisedfireriskanalysis, theseismicandfireinteraction isdiscussed intermsofCO,tankfragility.

Itisconcluded thatfiresuppression maybehamperedbecauseofseismicactivity.

\24.HasthedecayheatremovalissueofUSIA-45beenaddressed?

Ifyes,hastheissuebeenaddressed completely andproperly?

USIA-45hasbeenaddressed bythelicenseeintheSummaryReport[1].Noinformation isprovidedexceptforareference totheIPEreport.EnergyResearch, Inc.B-14ERI/NRC95-501

gB.20Thefollowing istheD.C.CookIPEEEsiteauditexitreportforfires.D.C.CookIPEEESiteVisitGeneralConclusions onFireIssuesByDr.M.Kazarians 1.Licenseehasexpendedsignificant effortinconducting thefireanalysis.

2.Theoverallmethodology anddata,withtheexception ofsomecasesthathavebeenidentified, areproper.3.Licenseehasbeenexceptionally cooperative, helpful,andopenabouthowIPEEEwasconducted, wherethedatacamefrom,andinguidingthereviewteamthroughtheplant.01.Thereareseveralcalculations thatcannotbeexplained fromtheavailable information, andseemtobeinaccurate.

2.Thespecificassumption maderegarding firesuppression failure,theevaluation offirefrequencies, andthecorresponding initiating eventfrequencies, donotreflectthestate-of-the-art, andinsomecasesareoptimistic.

Firepropagation betweenfirezonesisnotadequately considered.

4.Iftheabove-mentioned weaknesses arerectified

properly, therankingofmajorcontributors tocoredamagewillcertainly change.Especially, therewillbemorefirezonesrequiring detailedquantification.

Licenseedoesnotprovideadefinition for"vulnerability".

1.Revisitthefirefrequency evaluation anduseapartitioning methodthatincludesignitionsources,personnel traffic,andotherzoneoccupancy characteristics.

2.Revisitallcoredamagecomputations toassurethattheconditional frequencies arecomputedaccurately.

EnergyResearch, Inc.B-15ERI/NRC95-501 Qi3.Postponeconsideration oftheuseofsuppression systemsfailureuntiltherelativelocationof,cablesandothercriticalequipment areidentified withineachzonetoassurethatasmallfirecannotdamagethecablesandequipm;nt ofinterest.

'.Analyzecontrolroomandcablevault(all3vaults)firesasspecialcauses,andincorporate intheanalysistheuseofLSI.Specialattention shouldbegiventosmokepropagation.

Reviewtheanalysisforthosefirezonesthathavenormallyopenfiredampersordoors,andproperlymodelthepossibility thatdamper/door failurecanleadtoamulti-zone firescenario.

Also,lookintofirebarrierfailurefromexposedboltspenetrating thebarrier.Includeplant-speciifiic dataondeficient barrierpenetration seals.Reviewthelocalfireprotection featurescarefully forthosezonesthatdetailedquantification willbedonetoassurethatspecialweaknesses (e.g.,distancebetweensprinkler headsandceiling)aretakenintoaccount.Reviewspecificsystemanalysestoassureapplicability tofireconditions (e.g.,Auxiliary Feedwater systemavailability).

UseentireIPEmodelonamuchlargersetofcutsetstoperformscreening calculations.

Correctlogicindetection/suppression eventtreeusedinscreening analysis.

1.Appreciation ofsevereaccidentSincealmostallfirezoneshavebeenscreenedout,thelicenseecouldnotgainanappreciation ofwhatsevereaccidents couldpossiblyoccur.Understand themostlikelysevereaccidents Sincetherearemanyerrorsandoptimistic assumptions inthecomputations forthecoredamagefrequency, itcannotbeascertained thatthelicenseehasgainedanunderstanding ofthemostlikelysevereaccidents.

3.Qualitative understanding oftheoveralllikelihood ofcoredamageSincemanyfirezonescouldbescreenedout,thelicenseehasgainedanoverallunderstanding oftheoveralllikelihood ofcoredamage.4Reducetheoveralllikelihood ofcoredamageSincetheoveralllikelihood wasfoundtobesmall,nochanges/recommendations havebeensuggested.

EnergyResearch, Inc.B-16ERI/NRC95-501

'<r%i~f