ML20209F270
| ML20209F270 | |
| Person / Time | |
|---|---|
| Site: | Three Mile Island  |
| Issue date: | 07/09/1999 |
| From: | Lachance J, Pepping R, Ross R BROOKHAVEN NATIONAL LABORATORY, SANDIA NATIONAL LABORATORIES, SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY |
| To: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| Shared Package | |
| ML20209F261 | List: |
| References | |
| CON-FIN-W-6733 GL-88-20, NUDOCS 9907150283 | |
| Download: ML20209F270 (29) | |
Text
~ -
~- .
Review of the Submittalin Response to U.S. NRC Generic Letter 88-20, Supplement 4:
" Individual Plant Examination-External Events" Fire Submittal Screening Review Technical Evaluation Report: Three Mile Island, Unit 1 Revision 2: September 9,1998 Prepared by:
Steven B. Ross Battelle Albuquerque, New Mexico 87106 Richard E. Pepping Accident and Consequence Analysis Department Sandia National Laboratories j
Albuquerque, New Mexico 87185-0748 '
Jeffrey L. LaChance Science Applications International Corporation Albuquerque, New Mexico 87106 Prepared for:
Probabilistic Risk Assessment Branch Division of Systems Technology Office of Nuclear Regulatory Research U. S. Nuclear Regulatory Commission Washington, D.C. 20555 USNRCJCN W6733 9907150283 990709 1 DR ADOCK 0500 2 9
1.0 INTRODUCTION
This Technical Evaluation Repon (TER) presents the results of the Step 0 review of the fim assessment reported in the Three Mile Island 1 " Individual Plant Examination of External Events (IPEEE)" [1], requests for additional information (RAI) based on questions raised during the initial review [2], and the licensee responses to those questions [3].
1.1 Plant Description Three Mile Island 1 (TMI-1) is a Babcock and Wilcox designed pressurized-water reactor that was granted a commercial license in 1974. It has a licensed core design output of 2544 MWt with a corresponding net electrical rating of 821 MW,.
Electric power to the engineered safeguards equipment is provided either from offsite or from Class IE-design emergency diesel generators that are located in a separate diesel generator building. A station blackout (SBO) diesel is used r.: TMI-l to provide a backup source of power in case of a station blackout and is located in a separate, hardened concrete building.
Engineered safeguards power is distributed from two separate safeguards buses, each of which can be supplied from offsite, a class IE diesel generator, or the SBO diesel generator. The class IE switchgear distribution originates in the control building where the 4160V buses and the station batteries are located. Other class IE motor control centers are located in the fuel handling, auxiliary, and intake buildings.
Decay heat from the reactor is normally removed through the steam generators using main feedwater and condensate to maintain steam generator level, with main turbine bypass providing a closed loop for condensate retum. Following a loss of main feedwater, emergency feedwater can be used to maintain steam generator level, using either motor driven or turbine driven pumps.
Following a loss of main and emergency feedwater, decay heat can be removed directly from the reactor coolant system (RCS) by use of high pressure injection (HPI) pumps with power operated relief valve (PORV) or pressurizer safety valve operation to maintain a feed and bleed cooling condition.
Coolant injection is provided by the high pressure injection system (makeup and purification) and the low pressure injection system (decay heat removal). The high pressure system is made up of two trains with three pumps. For the low pressure injection system injection is provided by two trains with two pumps. -
It should be noted that numerous plant design modifications have been made at TMI-l in response to the requirements of 10 CFR 50, Appendix R. The majority of these modifications were cable routing changes or additional protection of safe shutdown equipment cables. Four types of additional protection were normally used: radiant energy heat shields; fire rated Rockbestos Firezone R cables; cr.ble tray fire barriers; and conduit fire barrier wraps. When 2
ri L. .
, cable protection was not feasible for certain pumps, motor operated valves, or solenoid valves that must be prevented from spuriously operating, control scheme modifications were made.
Also, the remote shutdown panel and operator action requirements were added to tha fire mitigation procedure. No other unique plant features impacting safety were noted n the submittal.
1.2 Review Objectives The performance of an IPEEE was requested of all commercial U.S. nuclear power plants by the U.S. Nuclear Regulatory Commission (USNRC) in Supplement 4 of Generic Letter 88 20. [4]
Additional guidance on the intent and scope of the IPEEE process was provided in NUREG-1407.-[5] The objective of this Step 0 screening review is to help the USNRC determine if the i Three Mile Island submittal has met the intent of the generic letter and also to determine the
! extent to which the fire assessment addresses certain other specific issues and ongoing programs.
1.3 Scope and Limitations i
The Step 0 review was limited to the material presented in the Three Mile Island IPEEE submittal and responses to requests for additional information (RAI). RAIs were submitted to the licensee based on an initial review of the submittal alone. The scope of the review was limited to verifying that the critical elements of an acceptable fire analysis have been presented.
An in-depth evaluation of the various inputs, assumptions, and calculations was not performed.
The review was performed according to the guidance presented in Reference 6. The results of the review against the guidance in the reference document are presented in Section 2.0.
Conclusions and a recommendation as to the adequacy of the Three Mile Island IPEEE submittal with regard to the fire assessment and its use in supporting the resolution of other issues are presented in Section 3.0.
l l
l L
1 3
L
2.0 FIRE ASSESSMENT EVALUATION l
l The following subsections provide the results of the review of the Three Mile Island-l fire assessment. The review compares the fire assessment against the requirements for performing the IPEEE and its use in addressing otherissues. Both areas of weakness and strengths of the fire assessment are highlighted.
2.1 Compliance with USNRC IPEEE Guidelines ;
The USNRC guidelines for performance of the IPEEE fire analysis derive from two major documents. The first is NUREG-1407, [5] and the second is Supplement 4 to USNRC Generic Letter 88-20. [4] In the current screening assessments, the adequacy of the utility treatment in comparison to these guidelines has been made as outlined in " Guidance for the Performance of Screening Review of Submittals in Response to U. S. NRC Generic Letter 88-20, Supplement 4:
Individual Piant Examinations - Extemal Events," Revision 3, March 21,1997. [6] The following sections d.scuss the utility document in the context of the specific review objectives set fonh in this Screening Review Guidance Document and assess the extent to which the utility submittal has achieved the stated objectives.
2.1.1 Methodology Documentation The analysis ofinternal fire hazards at TMI-l for the IPEEE was performed through a progressive screening analysis, based on the plant model 0veloped for the Internal Events Individual Plant Examination (IPE). Guidance for this analysis was taken from the EPRI FIVE methodology [7), although significant deviations were employed as compared to that methodology. The analysis was performed in the following stepwise fashion:
- 1. Identify critical areas of vulnerability: Identify various fire hazards in the plant and associated fire areas.
- 2. Identification of componer.ts imponant to safety: The Level 1 PRA developed for TMI-l was used to determine the components that impact risk.
- 3. Locate components imponant to safety: Suppon cables required for component operation, as well as those that could result in a " hot shon" condition were located.
Location data were taken from a number of sources including the Fire Hazards Analysis Report, plant data bases, and plant walkdowns.
- 4. Review of fire area for growth and propagation: Included in this step was an evaluation of fire barrier effectiveness using FIVE fire companment interaction analysis (FCIA) guidance.
4
- 5. Evaluation of component fragilities and failure modes: In general, the most conservative t
- failure modes were chosen for all components.
- 6. Review areas for fire detection and suppression capabilities.
- 7. Identify impacts on top events: Within a given fire area the impacts of fire-related failures ofindividual components on the various top level events of the Level 1 PRA model were reviewed.
- 8. Calculate the screening core damage frequency: This step involved the failing or degrading of the individual top events within the Level 1 PRA model and then quantifying the model. A fire severity factor was also used in this step. The output from this step combined with the fire frequencies provides a screening CDF estimate to be compared with the numerical screening criterion of IE-06/ year.
- 9. Perform detailed analysis if remaining fire areas using FIVE fire and damage modeling techniques.
A separate review was conducted to confinn that containment bypass scenarios due to the failure of penetrations were adequately addressed.
The TMI-l IPEEE includes directly or by reference, the current plant data used in the examination that includes the 1987 TMI-I PRA, Final Updated Safety Analysis Report (FSAR),
Operation Plant Manual, Abnormal Transient Procedure, Piping and Instrumentation Diagrams and Electrical Diagrams, TMI Fire Hazard Analysis Report, and the Transient Assessment Repons. Additionally, plant walkdowns were conducted to ensure the IPEEE represents the as-built configuration.
Some key aspects of the analysis including important assumptions that were utilized in the fire assessment are addressed below, Only the FCIA criteria for screening compartment boundaries were employed from the qualitative screening steps of FIVE.
Severity factors were employed in quantitative screening to reduce the need for detailed fire modeling.
Automatic fire suppression was not credited in the analysis, except in the Relay Room.
Manual fire suppression was generally not credited explicitly in either the screening assessment or final PRA evaluations. However, the licensee notes that manual suppression was imnlicitiv included through the use of severity factors.
In conclusion, the TMI-l IPEEE submittal contains a good description of the methodology used in the fire assessment.
2.1.2 Plant Walkdown 5
I l
The Three Mile Island plant walkdowns confirmed the infoimation contained in the Appendix R documentation, primarily the Fire Hazards Analysis Report. Walkdowns were performed at several stages of the analysis including a separate detailed review of the areas that were not screened to confirm the validity of the analysis and that no additional fire hazards or concerns were present. For the analysis of one of the control room panels, the panel was physically opened to confirm the layout ofindividual circuits and fire barriers within the panel. Additional walkdowns, including a seismic / fire walkdown, were performed to complete the response to the Fire Risk Scoping Study issues. Throughout the fire evaluation effort, on-site personnel were utilized to confirm plant data and component locations within the plant. This included a continual interaction with the on-site fire protection engineer as well as personnel experienced in
- plant operation.
Cable routing information was generated from the plant data base and then spot checked. The interactive plant laserdisc video was used for the high radiation areas to confirm component and fire hazard location.
Many detailed plant walkdowns were conducted in support of the analysis. However, a detailed description of the walkdown team was not provided.
2.1.3 Fire Area Screening !
Critical fire areas were defined as either, e those areas that contain any component modeled in the Level 1 PRA, I e any suppott circuitry for these components.
1 No consideration of plant trip initiators was given in screening, which is a deviation from the FIVE method. Three areas in the Auxiliary Building areas and two areas in the Control Building were eliminated buy these criteria.
The next level of qualitative evaluation, the FCIA based on the FIVE guidance, addresses fire propagation between adjacent fire areas. _In accordance with the FIVE guidance, fire compartments are defined in the submittal as spaces within a fire area bounded by non-l 1
combustible barriers where heat and products of combustion will be substantially contained.
The result of this part of the analysis was stated by the licensee, " Based on the review of fire boundary conditions and features that are based on the boundary evaluation criteria used within the TMI-l Fire Hazards Analysis Report [8), and the guidance provided in the EPRI FIVE documentation [7], existing evaluations of fire boundary effectiveness arejudged to be adequate l for the screening of fire propagation between areas at TMI-1. Each of the fire barriers features l for each area were confirmed through plant documentation or physical walkdown of the area."
Consequently, no' multi-compartment scenarios were found to be contributors to the fire CDF.
The next level of screening involved five tasks.
6 s
l l. The impacts ofintemal fires on plant model top events were identified. Fire damage
. appears in the plant model through systems that are failed or degraded. Degraded systems are expressed through modified split fractions.
- 2. A conservative estimate of the conditional core damage probability (CCDP) for each fire area was made. If the resulting CCDP was less than 1.0E-06, the fire area was screened from further consideration.
- 3. The CCDPs for the remaining areas were combined with the fire frequency for the respective areas to generate an " upper bound" core damage frequency. An area with CDF less then IE-06/ year was screened.
- 4. The unscreened areas required further analysis. This task consisted of a detailed review of area geometry and the use of a detailed analysis worksheets and guidance provided in the EPRI FIVE methodology.
- 5. Numerical results for unscreened areas were presented.
The first three tasks are similar in intent to the quantitative screening steps of FIVE. They were described in the submitta' for each fire companment. A nu"1ber of scenarios, or " cases," were defined for each compartment. The fire frequency was partitioned among these scenarios to generate companment CCOP. (The submittal actually uses the term " conditional core damage frequency".)
The partitioning of frequency among these scenarios introduced numerical factors that preserve the overall compartment frequency. The analysis cited EPRI data [10) to make plausible these numerical factors as indicators of the relative fire severity for each scenario. The most frequent values were 10% and 1%, which were based on a count of the number of damaged targets in recorded fires. The severity factor was then used to represent the relatively smaller frequency of more severe fires. The CCDPs for the individual scenarios postulated for a fire compartment were evaluated, with the severity factors included, and summed to form the screening CCDP for the companment. Multiplied by the compartment fire frequency, the result is the screening CDF, which can be compared to the numerical criterion of IE-6/yr. In the manner these severity factors were used, all of the fire frequency has an associated CCDP. This treatment is somewhat different from the treatment of severity factors as simple frequency reduction factors.
The FIVE "all systems failed" screening method was first applied and many compartments were screened. However, assuming only this screening method, too many unscreened companments resulted, and too many compartments required detailed modeling. This was due to the importance of the three systems on the plant fire response, instrument air, main feedwater, and emergency feedwater, and the fact that components of these systems are present in many fire compartments. The screening method described above resulted in eight fire areas remaining after Task 3. These are tabulated below.
l l
7 l
l l
The severity factors used most frequently were 10% and 1%, as noted above. The 1% value was typically used to represent the fires that were most severe ("all engulfing" fires) in terms of the number of systems damaged. The 10% value was frequently applied, and applied repeatedly if multiple target failures were being addressed, or if an additional barrier failure was required, e.g.,
if three separated targets were required to be failed, the factor would be 0.001. The 10% factor was applied to the failure of Thermo-Lag barriers in locations where Thermo-Lag was used for the protection of one of a pair of redundant trains. Compartments with a combustible loading greater than 80,000 Btu /ft' were given n severity factor of 50% for the severe scenarios, rather than 10%. After apportioning frequency to these more severe scenarios, the balance of the frequency was assigned to less severe scenarios. It should be noted that in the least severe scenario considered, all active equipment in a compartment was assumed failed. The severity factors described here were applied only to the systems with associated cabling and piping traversing the compartment.
The use of the fire severity factor in screening is a significant deviation from the FIVE methodology.~ The submittal notes that conservative assumptions that ha 'e not been relaxed thus far include the neglect of fire suppression. However, severity factors derived from the EPRI database generally give implicit credit for fire suppression. Nevertheless, the areas remaining after screening are those typical of fire studies.
Areas Surviving Screening Fire Area Description AB-FZ-7 NS and DC Pump Area CB-FA-2d East Inverter Room CB-FA-2e West Inverter Room CB-FA-2f East Battery Room CB-FA-3a 1D Switchgear Room CB-FA-3b IE Switchgear Room CB-FA-3d Relay Room CB-FA-4b Control Room 2.1.4 Fire Occurrence Frequency The total fire frequency for each fire area is obtained by summing the location specific fire frequency and the frequency associated with any plant-wide components located in the fire area.
The location specific fire frequencies were generated by using the generic fire frequencies developed in the EPRI Fire Event Data Base (FEDB) as described in EPRI repon NSAC-178L 8
[10]. The generic fire frequencies were modified by applying plant specific information to account for numbers of specific areas or components. For example, the generic fire frequency for battery rooms was divided by the number of battery rooms at TMI-1 to obtain the individual l battery room fire frequency.
l Fire frequencies for a number of plant wide components were also determined. These components include fire protection panels, non-1Ejunction boxes, non-lE cable, transfonners,
- battery chargers, air compressors, hydrogen tanks, cable fires from welding, and transient sources. All of the plant wide components were mapped to specific fire areas to deternune an j overall fire frequency for each plant area.
l l
. The total fire frequencies for 5"! fire areas are developed in tabulations in the submittal and the )
results summarized in Table 4.i-9. The tables show that both qualified and unqualified cables I are present. A review by the licensee of fires that have historically occurred at TMI-1 indicated I that use of plant-specific data would not be more conservative than the EPRI data. The fire i frequencies used for the TMI-l analysis are in general agreement with those reported ! y Sandia 1
- [9] and EPRI [10]. l 2.1.5 Fire Propagation and Suppression Analysis The first step in the propagation analysis involved screening with the fire severity factors. These were used to express the observation that data cuggest that most fires are extinguished before propagating from the ignition source or developing to a size sufficient for extensive damage.
The use of fire severity factors in screening is an implicit statement of credit for suppression success and limited propagation. The result was that many cases otherwise requiring detailed fire damage modeling were eliminated in the screening phase of the analysis. This is a significant deviation from the FIVE methodology. In the TMI study, eight compartments survived screening and required additional modeling.
The eight remaining compartments were analyzed as follows:
The presence and location of risk significant components in the area, including support cables, were determined.
- Potential fire sources and geometry relative to risk significant components were identified.
- - The fire impact on risk significant components was evaluated.
The damage analysis used the worksheets from the FIVE methodology. The submittal did not .
present modeling parameter assumptions. Some assumptions were noted in passing during discussions of scenarios:
A cable damage temperature of 700' F was noted, typical of qualified cable.
. An 810 Btu /s oil fire was noted.
9 l
i
- A battery bank fire of 174 Btu /s was noted. '
A heat loss fraction of 0.7, recommended by FIVE, was used.
l The automatic fire protection systems installed at TMI-1 were described in the submittal but generally not credited in the analysis. TMI appeared to take explicit credit for automatic fire i suppression, in addition to using a fire severity factor, only in the Relay Room. Elsewhere in the submittal, the licensee acknowledged that the severity factors used implicitly credit fire suppression. This apparent " double-count" of suppression credit was addressed through the RAI process, where the licensee stated that the severity factor (50%, corresponding to a high j combustible load) was in fact not used in the Relay Room. (It should be noted that the question s was phrased to address the 500 factor. An additional 10%-factor was assumed to describe the '
partitioning of fire scenarios in this area. The scenario is discussed below.)
Two other questions for the licensee came out of the discussion of the submittal at the October i
1997 meeting of the IPEEE fire Senior Review Board,
- An Halon explosive suppression system was identified in two fire zones in the air intake tunnel. Both were screened based on low combustible materials loads and the presence j of a deluge system. An RAI asked that the scenario for which the suppression system was installed be identified. The licensee identified a hypothetical aircraft impact as a scenario identified in it' sFSAR that the system was design to address.
In the fire analysis, conduit was credited with preverting damage to an enclosed cable in !
the East Battery Room. The basis for the assumption of this credit was not presented, and l the licensee was asked to re-analyze the scenario without crediting the conduit as a fire barrier. The licensee responded with a scenario that failed cable in the conduit. The l CCDP was low (7.6E-4) and comparable to other scenarios for the room. The licensee i concluded that the revised CDF from the compartment was about 7.3E-7/ year, which still j allowed the room to be screened. The new CDP was virtually unchanged from the original value.
2.1.6 Fire-induced Initiating Events and Fire Scenarios Throughout the internal fire hazard evaluation, components impacted by fires were
)
conservatively assumed to fail. Specifically, this assumption included the following failure modes: 1 Those required to send a component to an " active failure" position, for example, requiring a hot short. This form of failure was primarily used for valves and relays. ]
Air operated valve failure in the active failure position, although failure in the loss-of-air position is more likely.
Operator failure was assumed for operator actions performed in fire-affected areas. Recovery of .
. l plant systems or components damaged by fire was not modeled, except for use of the remote shutdown capability for fires in the relay room.~ (Such recovery was not included for fires in 10 l
l
)
control room cabinets.)
As described in Section 2.1.3, each of the eight compartments surviving screening have had a number of scenarios defined based on simplified a development of frequencies and damage.
Following screening, these compartments have had FIVE-based damage modeling to refine the 4 damage description in terms of specific targets affecting top events in the plant transient shutdown sequence. The plant model was then requantified to assess the CCDP due to the fire.
]
Frequency estimates were then improved in four compartments to reflect the actual ignition l
sources, rather than compartment totals. In the remaining fopr, severity arguments were retained l l
to panition frequencies among scenarios. No specik! initiators appear to have been considered, J e.g., LOSP or LOCA.
Relav Room treatment: The relay room treatment in the submittal prompted an RAI that was discussed above. Its treatment was typical of the detailed analyses and, from the description in the text, seems to include a relatively high CCDP scenario. The Relay Room was treated j through three scenarios:
A fire suppressed by the automatic CO2 system,
. A CO2suppression system failure with recovery of plant control from the remote i shutdown panel, A CO 2suppression system failure without recovery of plant control from the remote shutdown panel, and resulting in core damage.
The last scenario occurs at a conditional frequency determined by the CO 2 system failure,4%
according to FIVE, and a 10% partition (severity) assumed by the study. The submittal states that, in this scenario, ".. the operator is unable to recover plant control from the alternate shutdown panel before the onset of core damage." This seems to imply a CCDP of 0.004, whereas the submittal gives 3.42E-5, about two orders of magnitude smaller. This seems to require some other, not-described control and isolation capability from the plant-side of the relay room. The submittal notes that several systems are procedurally required to be isolated from the relay and. control rooms in order to shut down from outside the control room. However, there is no discussion in the submittal of when, in this loss-of-control scenario, these steps would be taken, where they are relative to the relay room, or what the steps in the shutdown procedure are.
Control Room treatment: The control room consoles were considered as both ignition sources and damage targets. There are 34 consoles. Of these, only two were considered "significant,"
nine were considered " minor," and the balance were simply "other." The control room fire frequency was partitioned uniformly among the 25 "significant" and "other" consoles. There was no discussion of cabinet construction in terms of barriers credited with preventing fire propagation. There was no discussion of fire detection, although the submittal noted that the room is continuously occupied and that any fire would be detected early by sight or smell. No control room evacuation scenarios were evaluated, which the submittal notes as a conservatism j
since some failures could be recovered from the remote shutdown panel. ;
I 11 I
i'
- 1
. -. 1 I
i The "significant" consoles were designated as CC and CR. Scenarios were developed separately l
for each. Frequency partitioning among the scenarios required several assumptions, the bases for which were not provided. The "other" panels were assumed to have risk contributions bounded by the loss of offsite power CCDP. Their collective contribution to the fire risk was estimated as about 3E-7/ year.
Loss of Console CC is associated primarily with the loss of balance of plant functions: main steam supply valves, atmospheric dump valves, component cooling water, containment spray ;
fans, emergency feedwater (EFW), and RCS control and inventory. Two less frequent scenarios !
involved loss of EFW (10%) tad EFW loss combined with a hot-short induced stuck PORV l (2%).
Loss of Console CR is associated with loss of cooling water and both trains of essential AC power, including diesel generators. Six scenarios were developed, differing in the systems lost l Od occurring with greater or lesser relative frequency. One scenario results in core damage directly, but occurs with a relative frequency of 0.001, the least frequent of the six scenarios.
It is clear that implicit credit has he:n given for fire suppress. ion and/or propagation limiting ;
features of the cabinet design since many scenarios have been defined with differing frequencies '
and consequences. This' credit and its basis were not described in the submittal. There were no 3
scenarios dealing with failure of the entire console, as would be the case for the unrestricted 1 propagation of a fire inside a console, or propagation between consoles.
An appendix to the submittal lists the dominant sequences contributing to the TMI fire risk and their frequencies. This section of the study is reasonably well done in terms of considering effects of fires on specific systems, damage to which contributes to fire risk.
2.1.7 Quantification and Uncertainty Analysis The resulting core damage frequencies for the zones that survived screening are tabulated below.
No uncertainty analysis was performed.
2.1.8 Sensitivity and Importance Ranking No sensitivity or importance ranking was performed.
12 l
L 1-Fire Areas Description Final CDF Comments CB-FA-2d East Invener Room 4.94E-06 CB-FA-2e West Inverter Room 5 IE-06 CB-FA-3a ID Switchgear Room - 3.94E-06 i CB-FA-3b IE Switchgear Room 4.96E-06 8.39E-07 Fire in console CC CB-FA-4b Control Room 3.17E-07 Fire in any other panel l
1.96E-06 Fire in panel CR l TOTAL 2.28E-05 Total for unscreened
! fire areas L 2.2 SpecialIssues As a part of the IPEEE fire submittal, the utilities were asked to address a number of fire-related issues identified in the Fire Risk Scoping Study (FRSS) and USNRC Generic Safety Issues (GSI). Specific review guidance on these issues is taken from Reference 4.
I 2.2.1 Decay. Heat Removal (USI A-45)
'As discussed in Generic A,etter 88-20 [4] and NUREG 1407 [5), USI A-45 associated with the adequacy of decay heat removal at nuclear power plants is subsumed into the IPE submittals. A submittal meeting the intent of Generic Letter 88-20, Supplement 4 is assumed to -satisfy the l requirements of USI A-45. Specifically, the fire assessment presented in the IPEEE submittal should address the adequacy of long-term decay heat removal in the event of fires. }
The systems used for decay heat removal at TMI are discussed in detail in the Level 1 PRA.
. Essentially, the deczy heat removal function is performed either directly through the reactor coolant system by the decay heat removal system itself or through the steam generators through use of main feedwater and condensate or emergency feedwater pumps, Also, feed and bleed crxiling is a redundant method for removing decay heat from the reactor coolant system under L high pressure conditions by using high pressure injection pumps and PORV or pressurizer safety
! valve operation.
The licensee states that the fire hazard effects on the decay heat removal system is not a significant concern due to design criteria, particularly the train separation requirements.' The separation includes the various support functions such as Class IE AC power. The emergency feedwiter system is normally maintained in a standby status and is only relied upon to maintain decay heat removal through the steam generators following a loss of makeup from the main 13
s feedwater system. The system :onsists of two motor driven pumps located in one fire area and a l turbine driven pump located in a separate fire area.
l The licensee states that, "pue to the redundancy between and within the various methods for decay heat removal at the TMI-1 plant and based on the discussions generated during the review of each of the individual fire areas examined in this report, the decay heat removal function is judged to be reliable with regard to the hazard resulting from plant fhes."
2.$.2 Effects of Fire Protection Sygem Actuation on Safety-related Equipment (FRSS, CSI57)
This issue is associated with the concem that traditional fire PRA methods have generally L
considered only direct thermal damage effects. Other potential damage mechanisms have not been addressed, such as smoke and the potential that the activation of fire suppression systems, L either as pad of actual fire fighting or spuriously, might result in damage to plant systems and components. In general, this is an area where the database on equipment vulnerability is rather -
sparse. The analytical results obtained for resolution of the issue, subsumed by GSI-57, identified the d:minant risk contributors as:(1) Seismic-induced fire plus seismic-induced suppressant
- diversion and (2) Seismic-induced actuation of the fire protection system (FPS). The NRC anticipated that the licensee would conduct seismic / fire walkdowns to assess (1) whether an actuated FPS would spray safety-related equipment, and (2) whether some protective measures to
[ prevent the same could be instituted. The results could be documented in the IPEEE submittal.
l The impact of spurious or inadvenent fire suppression activation on safe shutdown was analyzed by Three Mile Island 1. The hubmittal indicated that NRC IN 83-41 was reviewed extensively by the onsite fire protection engineer. Spray shields have been instilled to protect against the effects ofinadvenent suppression system actuation and discharge on important plant equipment.
The submittal stated that equipment damage by fire suppressants was not explicitly modeled, but
!was included in the damaged equipment reported in the EPRI fire events database. These data l
were used to support the values of the fire severity factors used in the analysis.
2.2.3 Fire-induced Alternate Shutdown / Control Room PanelInteractions (FRSS, GSI 147)
The issue of control systems interactions is associated primarily with the potential that a fire in l ' the plant, i.e., main control room (MCR), might lead to potential control systems vulnerabilities.
l Given a fire in the plant, the likely sources of control systems interactions are between the l control ro0m, remote shutdown panel,and shutdown systems. Specific areas that should be L addressed in the IPEEE fire analysis include 1) Electrical independence of the remote shutdown
. control systems; 2) Loss of control equipment or power before transfer; 3) Spurious actuation of
~
components leading to component damage, LOCA, or interfacing LOCA; and 4) Total loss cf g system function. It is anticipated that the licensee's submittal will describe its remote shutdown capability including the nature and location of the shutdown station (s) and the types of control 14 L
m
I l
1 actions that can be taken from the remote panel (s). '
At Three Mile Island 1, 'het Remote Shutdown (PSD) System provides monitoring and control I stations to perform a safe shutdown of the plant from outside the control room in the event of circuit destruction caused by fire in the control room or cable spreading room (relay room). The following functions can be performed with the RSD system:
- t. Communications circuits for the gray page and M&I systems can be isolated from the control and relay room circuits to permit communications in all other areas of the plant;
- - Power to the vital protected buses can be established or verified; Reactivity Monitoring is available to ensure a continued shutdown condition; RCS heat removal control is available using the steam generators or the decay heat removal system; i
- RCS pressure and inventory control are available; i
- Control of component cooling is available to support the above functions.
Emergency lighting is provided and maintained in all areas needed for operation of safe shutdown equipment and in access and egress routes to the equipment controls. Also, the failure of plant components before shifting to the remote shutdown system was considered in the generation of plant procedures.
The TMI-1 submittal mentioned a scenario involving the loss of control of eqcinment before transfer. However, there was little discussion of the scenario and,in Section 2.1.6 of this review, it was noted that the discussion of Relay Room fires appears incomplete in this regard. Hot short failures were assumed when valve control cable passed through a fire area. Only one relay room scenario noted a stuck-PORV LOCA, but did not describe the scenario in detail. .
2.2.4 Smoke Control and Manual Fire Fighting Effectiveness (FRSS, GSI-148)
Smoke control and manual fire fighting effectiveness is associated with the concern that nuclear power plant ventilation systems are known to be poorly configured for smoke removal in the event of a fire, and hence, a significant potential exists for the buildup of smoke to hamper the efforts of the manual fire brigade to suppress fires promptly and effectively. Sensitivity studies nave shown that prolonged fire fighting times can lead to a noticeable increase in fire risk.
Smoke, identified as a major contributor to prolonged response times, can also cause misdirected suppression efforts and hamper the operator's ability to shut down the plant safely.
The TMI-l submittal edicates that fire brigade members are required to complete an initial training program that includes the proper use of ventilation and emergency breathing equipment.
! Also, the following portable ventilaticn equipment is located in the fire brigade equipment room with additional equipment in the Unit 1/ Unit 2 hallway and a van:
L
- 4 - 16 inch electric smoke ejectors
- 2 - 20 inch electric smoke ejectors 15 1
Flexible duct for ventilation equipment with -
- l 2 - 16 inch square adapters 3 - 20 inch square adapters 13 - 16 inch x 20 feet round duct 10- 20 inch x 20 feet round duct
)
Manual fire fighting at TMI-I centers on the following six areas:
Fire reporting, including the uw and availability of portable fire extinguishers and plant procedures for reporting fires, including plant communication.
- Fire brigade makeup and equipment.
- Fire brigade training in the classroon.
Fire brigade practice in hands-on stmetural fire training and in the use of equipment.
- Fire brigade drills.
l
- - Fire brigade training records. ;
Manual fire fighting was not credited explicitly in the study, Hence, no discussion was provided on issues such as the time to locate a fire once the fire brigade has arrived at the scene or the time to extinguish or take control of a fire once the fire has been located.
The submittal notes that many of the effects of smoke on equipment, such as corrosion or degradation due to soot or other products occur over a much bnger period of time than required .
to achieve cold shutdown. These impacts would be addressed during the ensuing forced outage l after the fire event. SCBAs were noted as available to personnel that needed to perform actions in or pass through areas with fire or smoke present.
2.2.5 Seismic / Fire Interactions (FRSS, MSRP)
Tne issue of Seismic / Fire Interactions primarily involves three concems. First is the potential that seismic events might result in fires internal to the plant. Such threats might be realized from l inadequately secured liquid fuel or oil tanks, through breakage of fuel lines, or through the rocking of unanchored electrical panels (either safety or non-safety grade). The second concern is the potential that seismic events might render fixed fire suppression systems inoperable. This could include detection sys.tems, fixed suppression systems, and fixed manual fire fighting support elements such as the plant fire water distribution system. The third concern is that a seismic event might spuriously actuate fixed fire detection and suppression systems. The spurious operation of detectors might both complicate operator response to the seismic event and/or cause the actuation of automatic fire suppression systems. Actuation of a suppression system may lead to flooding problems, habitability concerns (for CO2 systems), the diversion of suppressants to non-fire areas rendering them unavailable in the event of a fire elsewhere, the potential over-dumping of gaseous suppressants resulting in an overpressure of a compartment, and spraying ofimportant plant components. It had been anticipated that a typical fire IPEEE 16
submittal would provide for some treatment of these issues through a focused seismic / fire interaction walkdown.
The seismic / fire issues investigated by the licensee are discussed below.
Seismicallv-Induced Fires As part of the seismic assessment walkdown, areas where flammable gas lines or bottles are located in the plant were identified and it was verified that the lines or bottles are normally left unpressurized or the equiptrent will not become a fire source during a seismic event.
Seismic Actuation of Fire Sunoression Sveteme Inadvertent fire protection system actuation concerns were reviewed and documented. NRC Information Notice 83-41 was reviewed extensively by the onsite Fire Protection Engineer. The
'concems identified in IN 83-41 were evaluated and found to be satisfactorily addressed by the programs in place to verify that water spray from the fire suppression systems would not create darnage resulting in a loss of all r afe shutdown paths.
Seismic Degradation of Fire Suppression Systems l During the seismic walkdown, fire protection systems were verified to be installed in accordance
- with good industrial practices and reviewed for seismic considerations such that suppression system piping and components will not fail and daciage safe shutdown path components, nor is it likely that leaking or cascading of the suppressr.r, will result.
2.2.6 Adequacy of Fire Barriers (FRSS)
The common reliance on fire barriers to separate redundant components needed to achieve a safe shutdown has elevated the risk sensitivity of fire barrier performance. Degraded fire barrier penetration seals and unsealed penetrations in some barriers can contribute to this source of fire risk, since fires in one area might impact other adjacent or connected area through the spread of heat and smoke. In general,it is expected that a utility analysis would provide for some treatment of this by considering that (1) manual fire fighting activities might allow for the spread of heat and smoke through the opening of access doors, and (2) that the failure of active fire barrier elements such as normally open doors, water curtains, and ventilation dampers might compromise barrier integrity.
The Three Mile Island 1 fire barrier qualification program centers on the following four areas of interest:
- Fire barrier surveillance program. l
- Inspection and maintenance of fire doors. I e
Installation, inspection, surveillance, and maintenance of penetration seal assemblies. !'
Inspection, testing and maintenance of fire dampers.
The fire door maintenance and inspection procedure is performed temiannually to verify that the 17
_- l
(
doors are operable. Surveillance procedures are in place to inspect the fire doors daily. Fire barrier penetration seals have been installed and maintained to address concerns such as those identified in NRC Information Notice No. 88-04. Fire damper installations address concerns such as those identified in NRC Information Notice No. 89-52, " Potential for Fire Damper Operational Problems," and NRC Information Notice No. 83-69, " Improperly Installed Fire Dampers at Nuclear Powerplants."
The use of fire barriers on cable trays and conduits to meet Appendix R requirements was indicated. Additionally, an additional factor of 0.1 was applied to the fire severity factor to account for the damaging of all equipment in a fire zone including a second protected train of l equipment. Based on the response to this issue in the submittal where Thermal Sciences l
Incorporated (TSI) barriers are mentioned it can be assuined that Thermo-Lag is in use. Beyond i the TSI barrier reference, no indication was given of what fire barriers have been installed and to what extent.
2.2.7 Effects of Hydrogen Line Ruptures (MSRP)
)
The use of flammable gases in the plant, including hydrogen, introduces the potential that a rupture of the gas flow lines might lead to the introduction of a serious fire hazard into plant safety areas. It had been anticipated that a typical fire IPEEE analysis would include the ,
consideration of such sources in the analysis. l Hydrogen lines were inspected during the seismic walkdown to ensure hydrogen lines are normally left unpressurized or will not become a fire source in a seismic event. No discussion of hydrogen lines was provided in the submittal.
2.2.8 Common Cause Failures Related to Human Errors (MSRP)
Common cause failures resulting from human errors include operator acts of omission or commission that could be initiating events or could affect redundant safety-related trains needed to mitigate other initiating events. It had been anticipated that a typical fire IPEEE analysis would include the consideration of suc2 failures in the submittal. '
This issue was not explicitly discussed. The submittal noted that operator recovery actions performed in fire environments were assumed to fail.
e 18 1
l .
i 2.2.9 Non-safety Related Control System / Safety Related Protection System Dependencies I
(MSRP)
Multiple failures in non-safety-related control systems may have an adverse impact on safg-related protection systems as a result of potential unrecognized dependencies between control and protection systems. The licensee's IPE process should provide a framework for systematic evaluation ofinterdependence between safety-related and non-safety related systems and identify potential sources of vulnerabilities. It had been anticipated'that the fire IFEEE analysis would
. include the consideration of such dependencies in the submittal.
This issue was not explicitly discussed. However, if dependencies are properly represented by the plant model, its use in the fire study may implicitly include these effects.
2.2.10 Effects of Flooding and/or Moisture Intrusien on Non Safety- and Safety-Related Equipment (MSRP)
Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intmsion of multiple trains of non-safety-related equipment. This type of event can result from external flooding events, tank and pipe ruptures, actuations of the fire suppression system, or backflow through part of the plant drainage system.
It had been anticipated that the fire IPEEE analysis would include the consideration of such events in the submittal.
This issue was not explicitly discussed. Sections 2.2.2 and 2.2.5 briefly address parts of this issue.
2.2.11 Shutdown Systems and ElectricalInstrumentation and Control Features (SEP)
The issue of shutdown systems addresses the capacity of plants to ensure reliable shutdown using safety-grade equipment. The issue of electricalinstrumentation and control addresses the functional capabilities of electrical instrumentation and control features of systems required for a safe shutdown, including support systems. These systems should be designed, fabricated, installed, and tested to quality standards and remain functional following external events. It had been anticipated that the fire IPEEE analysis would include the consideration of this issue in the submittal.
This issue was not explicitly discussed.
2.3 Containment Performance Issues Unique to Fire Scenarios The Three Mile Island I submittal stated that no new containment failure modes were identified by the analysis ofinternal fires.
19 1
l i
The approach taken to determine fire impacts on containment isolation and safeguards was to list all fire areas that had a fire sequence frequency greater then 1.0E-08 events / year. The impacts of fires were assumed based on the component and cable locations for the equipment for containment isolation and safeguards. If the equipment were located in the fire area, it was assumed failed by the fire with no recovery action except for manual actions to operate valves.
The fire events that were not screened initially were quantified using the TMI-l level 1 IPE plant model. The model was exercised to confirm that these fires do not cause plant damage state results that are siguificantly different those identified in the Level 1 PRA analysis of internal events. No individual containment isolation failures were identified with a frequency greater than 1.0E-08/ year. As a result, no containment failure modes have been found due to fire that significantly differ from those fcund in the TMI-l IPE internal events evaluation.
2.4 Plant Vulnerabilities and Improvements No definition of plant vulnerability was provided in the submittal. No improvements to mitigate the hazards caused by fires resulted from the TMI-1 IPEEE fire study, since the analysis results showed no significant core damage sequences caused by in-plant fires.
9 a
20
I L
I i
3.0 CONCLUSION
S AND RECOMMENDATIONS The TMI-l fire assessment was performed using a combined FIVE/PRA approach. The TMI-1 IPEEE submittal adequately documents the methods and the results of the fire assessment. The l
l assessment also addresses the FRSS issues and USI A-45. Some areas of strengths and '
weaknesses were identified in the analysis. The strengths include:
PRA was used to perform the f' mal quantification to obtain the fire-induced CDF.
Comprehensive walkdowns were performed at many stages of the analysis including a seismic / fire interaction walkdown.
The approach presented in the submittal to determine containment failure modes due to fire provided a significant amount of detail. l e
Spurious operation of equipment due to hot shorts was considered in the study.
1 Weaknesses in the submittal were addressed through '.he RAI process. Licensee responses were noted in the text of this review.
The fire severity factor was applied in the cable spreading room where explicit credit was also taken for automatic fire suppression.
Conduit was credited with preventing fire damage to the enclosed cable. I e A conspicuous fire suppression system was described in an area with a low combustible -
I materials load, few ignition sources, and a normal fire suppression system.
The licensee response to each question asked was deemed adequate to resolve the issue.
In summary, the information presented in the TMI-1 IPEEE fire submittal and the responses to follow-up questions, appear to address adequately the issues needed in the IPEEE fire assessment. The reviewers find that a sufficient level of documentation and appropriate bases for analysis have been established to recommend that the subject !icensee submittal has substantially met the intent of the IPEEE process.
21
l
4.0 REFERENCES
- 1. "Three Mile Island 1 Nuclear Station Individual Plant Examination for Extemal Events,"
GPU Nuclear Corporation, December 1994.
- 2. Letter from
- 3. Letter from James W. Langenbach to U. S. Nuclear Regulstory Commission, Three Mile Island Nuclear Station, Unit 1 (TMI-1), Operating License No. DPR-50, Docket No. 50-289, Individual Plant Examination for External Events- Remonse to Request for Additional Information,14 April 1998.
(
- 4. USNRC, " Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR ;
$50.54(f)," Generic Letter 88-20, November 23,1988. '
- 5. USNRC, " Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," NUREG-1407, May 1991.
- 6. S. Nowlen, M. Bohn, J. Chen, Guidance for the Performance of Screenine Reviews of Submittals in Response to U.S. NRC Generic Letter 88-20. Supolement 4: Individual Plant Examination - External Events," Rev. 3,21 Mar 1997.
- 7. EPRI TR-100370, Fire-Induced Vulnerability Evalu ation (FIVEL Professional Loss Control, Inc., April 1992.
- 8. GPU Nuclear, (TMI-1 Fire Hazards Analysis Repon), Document No. 990-1745, Revision 14, May 20,1992.
- 9. Bohn, M.P. and Lambright, J.A., Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150, NURGEG/CR-4840, November 1990.
- 10. Electric Power Research Institute, " Fire Events Database for US Nuclear Power Plants, EPRI Database, Revision 1," NSAC-178L,1993.
22 1
1 l
4
~ ..
Appendix C Technical Evaluation Report on the Review of the Three Mile Island Nuclear Station, Unit 1, Individual Plant Examination for External Events (IPEEE) Submittal on High Winds, Floods, and Other External Events (HFO), Dated May 1999 l
l l
i Attachment 3 L