NUREG-1407, SER Concluding That Licensee IPEEE Process Capable of Identifying Most Likely Severe Accidents & Severe Accident Vulnerabilities & That IPEEE Has Met Intent of GL 88-20, Suppl 4 & Resolution of Specific GSIs
| ML20212L349 | |
| Person / Time | |
|---|---|
| Site: |  |
| Issue date: | 09/29/1999 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML20212L336 | List: |
| References | |
| REF-GTECI-***, REF-GTECI-045, REF-GTECI-057, REF-GTECI-103, REF-GTECI-131, REF-GTECI-147, REF-GTECI-148, REF-GTECI-NI, RTR-NUREG-1407, TASK-***, TASK-103, TASK-131, TASK-147, TASK-148, TASK-A-45, TASK-OR GL-88-20, NUDOCS 9910080023 | |
| Download: ML20212L349 (11) | |
Text
. - _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ - - - _ _ _ _ _ _ _
STAFF EVALUATION REPORT OF INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS (IPEEE) SUBMITTAL
. ON SAN ONOFRE NUCLEAR GENERATING STATION (SONGS) UNITS 2 AND 3
- l. INTRODUCTION On June 28,1991, the NRC issued Generic Letter 88 20, Supplement 4 (with NUREG 1407, Procedural and Submitta Guidance) requesting alllicensees to perform individual plant examinations of extemal events (IPEEE) to identify plant specific vulnerabilities to severe accidents and to report the results to the Commission together with any licensee-datermined improvements and corrective actions. In a letter dated December 15,1995, the licensee, Southern Califomia Edison Company, submitted its response to NRC.
The staff contracted with Energy Research, Inc. (ERI) to conduct a " Step 1" review (a review for completeness and reasonableness) of the licensee's IPEEE submittal and its associated documentation and sent a request for additional information (RAl) to the licensee on Octooer 16,1997. The licensee responded in part to the RAl on December 15,1997, and submitted the remainder of its response on March 16,1998. Based on the results of the review, the staff concluded that the aspects of seismic; fires; and high winds, floods, transportation and other external events were adequately addressed. The review findings are summarized in the evaluation section below. Details of the contractor's findings are in the technical evaluation report (TER) attached to this staff evaluation report.
In accordance with Supplement 4 to GL 88 20, the licensee has provided information on the Fire Risk Scoping Study (FRSS) issues, generic safety issue (GSI)-57, " Effects of Fire Protection System Actuation on Safety Related Equipment," GSI-103, " Design for Probable Maximum Precipitation (PMP)," and Unresolved Safety issue (USI) A-45, " Shutdown Decay Heat Removal Requirements." This information was explicitly requested in Supplement 4 to GL 88 20 and its associated guidance in NUREG-1407. In addition, the licensee has addressed the " Seismic Capability of Large Safety-Related Above Ground Tanks" aspects of USl A-40," Seismic Design Criteria," and the seismic aspects of USl A 17, " Systems interactions in Nuclear Power Plants." The licensee notes that GSI 131, " Potential Seismic Interaction involving the Movable in core Flux Mapping System Used in Westinghouse Plants,"
is not applicable to SONGS Units 2 and 3 because these units are Combustion Engineering plants.
II. EVALUATION SONGS Units 2 and 3 are pressurized water reactors (PWRs) with Combustion Engineering nuclear steam supply systems. The plant is located on the Pacific coast of southern Califomia in San Diego County, approximately 62 miles southeast of Los Angeles and 51 miles northwest of San Diego. Unit 2 began commercial operation in August 1983, and Unit 3 began commercial operation in April 1984.
I 9910090023 990929 ENCLOSURE fR ADOCK 05000361 PDR
& -^
m Core Damano Freauency Estimates Seismic San Onofre is a western U.S. plant, and NUREG-1407 specifies a seismic PRA as part of the IPEEE seismic analysis. The licensee performed a new Level-1 seismic probabilistic risk assessment (SPRA), with a qualitative and quantitative (Level-2) seismic containment analysis.
The IPEEE submittal reports the seismic core damage frequency to be 1.7E 5 per reactor year (RY).
E!m l
For fire, the licensee used a combination of the Elec'tric Power Research Institute's fire-induced vulnerability evaluation (FIVE) methodology and probabilistic risk assessment (PRA) methodology. The fire frequency and fire protection system data was that of FIVE. The licensee estimated the total fire CDF from the scenarios surviving screening to be 1.6E-5 per RY.
Hioh Winds. Floods. Transoortation. and Other (HFO) External Events High (non-tornado) winds were screened out on the basis that the plant design conformed to the 1975 Standard Review Plan (SRP), with respect to high winds. As far as tornadoes are concerned, the licensee judged that only F5 category tornadoes (on the Fujita scale) were capable of damaging safety-related equipment and structures. Since the licensee estimated the frequency of an F5 tornado striking the plant at 8E-8 per year, the core damage frequency from tornadoes is less than the NUREG-1407 screening criteria of 1E-6 per year. The licensee states that no Class I structures are vulnerable to tornado missiles.
As far as external flooding is concerned, the licensee found that the dominant flood hazard was due to probable maximum precipitation (PMP) associated with a thunderstorm. The plant was evaluated for the PMP, using new PMP data consistent with GSt-103, " Design for Probable Maximum Precipitation," and the licensee determined that no safety-related equipment would be affected.
Transportation and nearby facility accidents were screened out based on the hazard frequency, in a manner consistent with the guidance in NUREG-1407. For aircraft accidents, the analysis in the Updated Final Safety Analysis Report was updated, and the number of aircraft op-ations now estimated was less than half of the old estimate, so that the aircraft hazard meets t. a screening criteria of less than 1E-6 per year given in NUREG-1407. For more details, see the attached TER.
Dominant Contributors Seismic l
The top five seismic accident sequences contributed over 85% of the seismic CDF. These are:
l I
2 l I
1
(
e I Sequence 1: Seismically induced loss of offsite power (LOSP) and loss of emergency switchgear (39% of the seismic CDF), dominated by loss of the motor control centers.
e Sequence 2. Seismically induced LOSP with seismic failure of instrumentation and control (19% of the seismic CDF), dominated by failure of the auxiliary building.
Sequence S. Station blackout resulting from unrecoverable . sismically induced LOSP, in combination with random failures, but no additional seismic failures (15% of the seismic CDF). This sequence is dominated by random failures of diesel generators or their support systems.
e Sequence 4: Seismic LOSP, with no additional seismic failures, but random failures of the condensate makeup system and auxiliary fee.fwater (AFW) pumps (8% of the seismic CDF). This sequence is dominated by random loss of AFW.
e Sequence 5: Seismically induced LOSP and small loss-of-coolant accident (LOCA),
with loss of emergency switchgear (7% of the seismic CDF), dominated by seismic loss of motor control centers (MCCs).
Fire The main contributors to the fire CDF are given in the table below.
l Fire ignition Core Damage Area Systems / Equipment Frequency Frequency Affected by the Fire (per ry) (per ry)
Switchgear room Loss of offsite power, train A 2.53x103 3.4 x104 (2 AC 50 40) switchgear and main feedwater Switchgear room Loss of offsite power, train B 2.65x10'3 3.1 x104 (2 AC 50-35) switchgear and main feedwater Electrical Penetration Room Loss of offsite power 2.54x10 8 2.4x104 (2 PE 63 38)
Turbine Building Loss of main feedwater 4.50x104 2.3x104 (2-TB 148)
Electrical Penetration Room Loss of offsite power 2.54x10'* 2.3x104 (3-PE 63-38)
Electrical Penetration Room Loss of offsite power 2.54x10~8 1.5x104 (2-PE-45-3A)
Relay Room Loss of offsite power 7.95x10d 1.2x104 l (2 AC-9-17)
Diesel Generator Room Station black out 5.00x10d 1.2x104 I (2-DG 30-155) I Diesel Generator Room Station black out 6.00x10d 1.2x104 l (2-DG-30-158) l Switchgear Room Loss of offsite power 2.53x10-8 1.1 x104 (2- AC-85-71)
]
Note that the sum of the frequencies in the table is about 2E 5 per year, which exceeds the licensee's estimated total fire CDF of 1.6E 5 per year. This is noted on p. 4100 of the IPEEE submittal, and is due to slight differences in the methodology used in determining the dominant 3
sequences compared to the total fire core damage frequency, which was obtained by a cutset
' quantification approach.
tiEQ Because of the nature of the screening approach used, which followed the guidance in
' NUREG 1407, the licensee did not determine dominant core damage accident sequences for I HFO events.
Assessment of Licensee's Determination of Dominant Contributors
' For seismic and fire events, the licensee appears to have identified the significant initiating events and dominant accident sequences.' Because of the nature of the screening approach used for HFO events, dominant accident sequences were not developed. The attached TER -
notes, in Section 3.3, that the HFO screening methodology appeared to be followed correctly.
Containment Performance Seismic No containment failure modes unique to the seismic initiator were found, and, therefore, the licensee used the containment performance analysis of their Individual Plant Examination (IPE)
- for internal events. The licensee found (see p. 3-108 of the IPEEE) that, given a seismically-induced core damage accident:
e 53% of the time there was no failure of containment, e 32% of the time there was a leak type containment failure,-
e 13% of the time there was containment rupture, e 2% of the time there were steam generator tube rupture type bypasses of containment, e Interfacing system LOCAs (not steam generator tube rupture) were of negligible likelihood.
What is called "no failure of containment" may include late basemat melt through from core-concrete interactions, but does not include overpressurization of containment. The 45% of the time that the leak or containment rupture failure mode occurs may be subdivided into a 2%
of the time where containment failure occurs at or about the time of vessel failure, and 43% of the time that containment failure occurs more than 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after vessel failure. (That is, given a leak or rupture type containment failure mode, the conditional robability of early containment
- failure at or about the time of vessel failure is 2/45, and the conditional probability of late containment failure is 43/45.)
4 L
fut
. The licensee's analysis of containment performance for the fire initiator concluded that there are no new containment failure modes unique to fire compared to internal events. The conditional probability of a given containment failure mode, given that core damage was initiated by a fire, is approximately the same as the conditional probability of the same
- containment failure mode, given that core damage was initiated by an internal event. This can be seen from Table 4.51 of the IPEEE. For more details, see Section 2.2.11 of the attached
.TER.
Sf.Q Because of the nature of the screening analysis performed by the licensee for HFO events, containment performance was not evaluated for HFO events. NUREG 1407 does not require a containment performance analysis for HFO events.
Assessment of Licensee's Containment Performance Analysis The licensee's containment performance analyses for seismic and fire events appears to have considered the important severe accident phenomena and are consistent with the intent of Supplement 4 to Generic Letter 88 20.
fatneric Safety issues As a part of the IPEEE, a set of generic and unresolved safety issues (USl A 45, GSI 131, GSI-103, GSI 57, and the Sandia Fire Risk Scoping Study (FRSS) issues) were identified in Supplement 4 to GL 88 20 and its associated guidance in NUREG-1407 as needing to be addressed in the IPEEE. The staff's evaluation of these issues is provided below.
- 1. USl A-45, " Shutdown Decay Heat Removal Requirements" The licensee performed a seismic PRA and a fire PRA. These are capable of finding vulnerabilities which involve loss of decay heat removal capability. No such vulnerabilities were found. The screening analysis done by the licensee for HFO events is capable of finding vulnerabilities associated with loss of decay heat removal capability. Since the staff judges that the process used by the licensee is capable of finding decay heat removal vulnerabilities, and no vulnerabilities were found, the staff considers that the external events aspects of USl A-45 are resolved for SONGS Units 2 and 3.
- 2. GSI 131, " Potential Seismic Interaction involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants" -
SONGS Units 2 and 3 are Combustion Engineering plants, and therefore, this issue is not applicable to them, l
5
- 3. GSI-103, " Design for Probable Maximum Precipitation" As noted in Sections 2.3.2.1 and 2.3.2.4 of the attached TER, the licensee considered the new PMP data from the National Oceanic and Atmospheric Administration consistent with GSI 103. The licensee found that no safety-related equipment would be affected by the PMP. For more details, see the TER sections already noted.
On the basis that the licensee's procedure for identifying severe accident sequences associated with the PMP is satisfactory, and on the basis that no vulnerabilities were found, the staff considers that GSI-103 is resolved for SONGS Units 2 and 3.
- 4. GSI-57, " Effects of Fire Protection System Actuation on Safety-Related Equipment" Inadvertent actuation of fire suppression equipment could be initiated as a result of a seismic event, or by other events, such as, for example, a maintenance error.
NUREG-1472, which presents the regulatory analysis for GSI 57, concludes that the dominant risk contributor associated with inadvertent fire protection system actuation is seismic actuation of the fire protection system. For SONGS, seismic inadvertent actuation is discussed in Sections 3.3.4 and 3.8.6 of the IPEEE. Analyses of non-seismic inadvertent actuation of fire suppression equipment was addressed earlier by the licensee in response to NRC information Notice 83-41, and the analysis performed is referenced in the IPEEE. As noted on page 4 3 of the IPEEE submittal, the checklists included in the FIVE methodology were used to address the Fire Risk Scoping Study issues.
The staff finds that the licensee's GSI 57 evaluation is consistent with the guidance provided in EPRl's Fire induced Vulnerability Evaluation (FIVE), which was accepted by !
the NRC staff, and therefore, the staff considers this issue resolved for SONGS Units 2 !
and 3.
- 5. Fire Risk Scoping Study (FRSS) issues As noted in Section 2.2.12 of the attached TER, all of the fire risk scoping studies have ,
been addressed. Although not mentioned in the TER, the licensee has also considered I potential misdirected fire suppression activities, as the licensee notes on p.4-115 of the IPEEE submittal. (This is also part of GSI-148, discussed below). The only information the licensee gave is that these misdirected fire suppression activities were considered.
The staff finds that the licensee's evaluation of the FRSS issues is consistent with the guidance provided in FIVE, which was accepted by the NRC staff, and therefore, the staff considers these issues resolved for SONGS Units 2 and 3.
In addition to those safety issues discussed above that were explicitly requested in Supplement 4 to GL 88-20, four generic safety issues were not specifically identified as issues to be resolved under the IPEEE program; thus, they were not explicitly discussed in Supplement 4 to GL 88-20 or NUREG-1407. However, subsequent to the issuance of the 6
e generic letter, the NRC evaluated the scope and the specific information requested in the generic letter and the associated IPEEE guidance, and concluded that the plant specific analyses being requested in the IPEEE program could also be used, through a satisfactory IPEEE submittal review, to resolve te external event aspects of these four safety issues. The i following discussions summarize the staff's evaluation of these safety issues at SONGS Units 2 and 3. {
l
- 1. GSI-147, " Fire-Induced Alternate Shutdown / Control Room Panel Interactions" This issue includes the following:
Electricalindependence of remote shutdown control circuits j
t Loss of control power before transfer from the main control room to the alternate shutdown panel Totalloss of system function Spurious actuation of components The licensee addressed this generic safety issue in its March 16,1998, response to an RAl. The staff judges that the process used by the licensee to evaluate this issue is capable of finding vulnerabilities associated with the issue. Since no vulnerabilities were found, the staff considers this issue resolved for SONGS Units 2 and 3. !
- 2. GSI-148, " Smoke Control and Manual Fire-Fighting Effectiveness" 1
As already noted above under the discussion of the FRSS issues, the issue of 1 misdirected fire suppression activities, which is part of GSI-148, was considered by the licensee. In addition, the SONGS 2/3 fire protection program was assessed against the a' tributes of an adequate fire protection program discussed in FIVE (see page 4-115 of l the IPEEE.). FIVE has been accepted by the staff. On the basis of the information presented by the licensee, and on the basis that FIVE has been accepted by the staff, the staff considers GSI 148 resolved for SONGS Units 2 and 3.
- 3. GSI-156, " Systematic Evaluation Program (SEP)"
The SEP issues are a set of issues associated with plants that were licensed prior to the time the 1975 Standard Review Plan was issued. GSI-156 does not apply to SONGS Units 2 and 3. -
- 4. GSI 172, " Multiple System Responses Program (MSRP)"
- Effects of fire protection system actuation on safety related equipment 7
This is issue GSl 57, and is discussed under that heading. See also the attached TER, Section 2.4.4.
- Seismically induced fire suppression system actuation This is an FRSS issue, and, as already noted, is discussed as such in Section 3.3.4 of the IPEEE submittal, e Seismically induced fires This is a FRSS issue. Seismically induced fires were addressed in the seismic capability walkdowns performed as part of the seismic IPEEE (see Section 3.3.4 of the
. IPEEE submittal).
e Effects of hydrogen line rupture Page 4-8 of the IPEEE submittal notes that the walkdown identified and verified potential fixed and transient fire sources. This would include hydrogen lines. The iPEEE submittal, in the section on unique safety features, notes that "there are very few hydrogen or waste gas lines routed in areas with safety-related equipment," and that these lines are very strong.
e The IPEEE related aspects of common cause failures associated with human errors The TER notes, in Section 2.2.7 (e), that it can be inferred that the human error probabilities used in fire analysis were revised from those in the IPE to take into account the special conditions of the fire scenarios. Human error probabilities (HEPs)in fire 3
scenarios were discussed in the March 16,1998, licensee's response to an RAI (see l
- p. 26 of the response). The licensee notes there that the potentialimpacts of fires -
(including losses of indication, impacts on communication, availability of lighting, and 1 impacts of smoke / heat) were considered in the evaluation of the HEPs. Human errors were included in the seismi:: PRA models, and the HEPs were modified to account for seismic stress on the operators (see Sections 3.6.4 and 3.6.7 of the IPEEE submittal).
The licensee's March 16,1998, response to an RAI discusses the seismic HEPs further (see page 1 of the response). As for HFO events, the screening analysis procedure used did not require the assessment of human error probabilities.
o Non-safety related control system / safety related system dependencies As far as the IPEEE is concerned, this issue reduces to that of seismically induced spatial and functional interactions, a MSRP issue already discussed above, and GSI-147, on fire-induced alternate shutdown and control' room panel interactions, which has also already been discussed.
8
e Effects of flooding and/or moisture intrusion on non safety related and safety-related equipment Flooding from external floods is discussed in the HFO portion of the IPEEE (see Section 5.5); a screening analysis was used. Flooding from the actuations of fire protection systems is a GSI 57 issue, and is discussed under that heading. Seismically induced
-_ flooding, including inadvertent actuation of fire protection systems, is discussed in Section 3.3.4 of the IPEEE submittal.
e Seismically induced spatial and functional interactions As noted in Section 2.4.4 of the attached TER, the SONGS IPEEE has included (in Section 3.3) a seismic walkdown which addressed this issue.
e- Seismically induced flooding Seismically induced flooding was addressed in the seismic capability walkdowns performed as part of the seismic IPEEE, and is discussed in Section 3.3.4 of the IPEEE submittal.
- Seismically-induced relay chatter As noted in Section 2.4.4 of the attached TER, the licensee performed a relay chatter evaluation as part of the IPEEE. [See Sections 3.2.1 (relay chatter evaluatioq methodology),3.3.3 (relay walkdown), and 3.6.3.3 (relay and process switch chatter analysis) of the IPEEE submittal.]
e Evaluation of earthquakes greater than the safe shutdown earthquake (S SE)
The seismic analysis in the IPEEE was a PRA, which automatically incl;de the effects of earthquakes greater than the SSE.
Based on the overall results of the IPEEE submittal review, the staff considers that the licensee's process is capable of identifying potential vulnerabilities associated with GSI 172.
Since no potential vulnerability associated with these issues was identified in the IPEEE submittal, the staff considers the IPEEE-related aspects of these issues resolved for SONGS Units 2 and 3.
The licensee pointed out in its submittal that USl A-46, " Verification of Seismic Adequacy of Equipment in Operating Plants" is not applicable to San Onofre Units 2 and 3. The licensee also addressed two other generic safety issues: USl A-40, " Seismic Design Criteria" and the 4 seismic aspects of USl A-17 " System Interactions in Nuclear Power Plants." The licensee )
states that the only aspect of USl A-40 which is applicable to SONGS Units 2 and 3 is the !
seismic capability of large safety-related tanks. The IPEEE submittal shows that the large ;
safety related tanks at SONGS Units 2 and 3 have high seismic capacity. The licensee !
addressed the seismic aspects of USl A-17 in its seismic PRA. The seismic walkdowns specifically looked for seismic systems interactions.
l O
l
o i
Unique Plant Features, Potential Vulnerabilities, and Improvements Unique safety features are described in Section 7.2 of the IPEEE. Some of these safety features are:
SEISMIC e SONGS Units 2 and 3 are designed for a very high design basis earthquake (0.67g peak ground acceleration) e Potential spatial and seismic category ll/l issues were addressed during the design of SONGS Units 2 and 3.
e Portions of the fire suppression system are designed to seismic category 1.
- The risk from piping failure of hazardous materialis very low since there are very few hydrogen or waste gas lines routed in areas with safety-related equipment. In addition these lines are very strong and rugged.
INTERNAL FIRES e Shared systems between units (including service water and component cooling water) provide extra redundancy during fire events.
No severe accident vulnerabilities related to external events were found by the IPEEE.
However, the licensee did make the following seismic improvements as a result of the IPEEE.
These were: improving the reliability of cross-connecting emergency diesel generators between the two units; strengthening the supports of an ammonia tank to eliminate a spill hazard; removing a floor grating surrounding AFW valve actuators to eliminate an interaction hazard; removing a concrete plug surrounding the Unit 2 diesel generator fuel oil transfer piping to improve the seismic capacity of the pipe; and fastening adjacent electrical cabinets / panels together to prevent interactions and relay chatter. No improvements were made as a result of the fire IPEEE or the HFO analysis. -
lit. . CONCLUSIONS On the basis of the overall review findings, the staff concludes that: (1) the licensee's IPEEE is complete with regard to the information requested by Supplement 4 to Generic Letter 88 20 (and associated guidance in NUREG-1407), and (2) the IPEEE results are reasonable given the SONGS Units 2 and 3 design, operation, and history. Therefore, the staff concludes that the licensee's IPEEE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities, and therefore, that the SONGS Units 2 and 3 IPEEE has met the intent L of Supplement 4 to Generic Letter 88-20 and the resolution of specific generic safety issues discussed in this SER.
It should be noted that the staff focused its review primarily on the licensee's ability to examine SONGS Units 2 and 3 for severe accident vulnerabilities. Although certain aspects of the 10
IPEEE were explored in more detail than others, the review was not intended to validate the accuracy of the licensee's detailed findings (or quantification estimates) that underlie or stemmed from the examination. Therefore, this SER does not constitute NRC approval or endorsement of any IPEEE material for purposes other that those associated with mee.ing the intent of Supplement 4 to GL 88-20 and the resolution of specific generic safety issues discussed in this SER.
(
l l
1 i
)
1 i
11 i
o l
Attachment 1 SAN ONOFRE UNITS 2 AND 3 INDIVIDUAL PLANT EXAMINATION OF EXTERNAL EVENTS (IPEEE)
TECHNICAL EVALUATION REPORT ,
4