4. HIGH WINDS, FLOODS, AND OTHER EXTERNAL EVENTS 

4.1 Introduction 

This section summarizes the key results from 70 IPEEE submittals with regard to high winds, floods, and 

other (IFO) external events, including transportation and nearby facility accidents, and plant-unique hazards. 

External flooding events were evaluated in the IPEEE program, while internal flooding was addressed in the 

IPE program. Table 4.1 gives a list of the HFO-related external event topics discussed in NUREG-1407. 

Table 4.1: Potential natural and man-induced events to be considered for HIFO 

external events (from NUREG-1407)

Aircraft impact 

Industrial or military facility accident (offsite toxic or combustible/explosive gas/chemicals) 

Pipeline accident (onsite toxic or combustible/explosive gas) 

Release of chemicals from onsite storage 

Turbine-generated missiles

Avalanche 

Coastal erosion 

Drought 

Dust storms 

External flooding (e.g., high tide, lake, or 

river water level) 

Extreme winds and tornadoes 

Fog 

Forest fire 

Frost 

Hail 

Hurricane 

Ice (blockage of intakes, etc.) 

Intense precipitation

Internal flooding 

Landslide 

Lightning 

Low lake or river water level 

Meteorite

Sandstorm 

Seiche (oscillatory waves) 

Severe temperature transients (hot or cold) 

Snow 

Storm surge 

Volcanic activity (including volcanic ash) 

Waves

4-1
4.1.1 Objectives 

The objectives of this chapter are to discuss the HFO review findings reported in the licensees' submittals, 

and to identify insights gleaned from the staff s reviews of the submittals. 

4.1.2 Organization 

This chapter specifically addresses the HFO areas of the IPEEE, and is organized in the following seven 

major subsections. 

Section 4.1 provides an introduction including the objectives and organization of this chapter. This 

section also gives background information including some historical perspectives for HFO events, 

guidance for conducting the HFO reviews, and an overview of the results. 

Section 4.2 discusses the perspectives gleaned from the IPEEE evaluations of high winds, including tornadoes, tornado missiles, and hurricanes. Potential vulnerabilities associated with severe high wind conditions are discussed, including plant improvements that licensees have considered or 

implemented to reduce the plant risk associated with these events. 

Section 4.3 discusses the perspectives gleaned from the IPEEE evaluations of external floods, including intense rainfall resulting in site flooding and roof ponding; flooding from nearby bodies 

of water, including wave runup from rivers, lakes, and the ocean; potential flooding from postulated dam failures; and flooding as the result of snow melt. Potential vulnerabilities resulting from 

external floods are discussed with plant improvements that licensees have considered or implemented 

to reduce the plant risk associated with such flooding. 

Section 4.4 discusses perspectives gleaned from the IPEEE evaluations of accidents related to 

transportation or nearby industrial facilities. Potential vulnerabilities from such accidents are 

discussed with plant improvements that licensees have considered or implemented to reduce the plant 

risk associated with these types of events. 

Section 4.5 discusses other types of external events that can occur. This category includes events 

such as onsite hazardous material spills; hydrogen line breaks; effects from low-temperature conditions, such as icing and blockage of cooling water intake lines; blockage of drains and intakes 

from debris; other weather conditions, such as wind-blown sand and dust; and any other plant-unique 

hazard events. 

Section 4.6 discusses some general observations regarding HFO events. Topics included in this 

section are containment performance, unresolved safety issues (USIs) and generic safety issues 

(GSIs), human actions, HFO-related information gained from plant walkdowns, a summary of related 

plant improvements, general perspectives, and some perspectives regarding the impact of the HFO 

event analyses on plant safety. 

Section 4.7 provides a summary and conclusions gleaned from the HFO reviews. 

4-2

I II
4.1.3 Background

This section provides background information including a historical perspective for the HFO external events 

and a discussion of the guidance used in conducting reviews of these events. 

4.1.3.1 Historical Perspectives on High Winds, Floods, and Other External Events 

The primary regulatory basis governing the HFO-related design aspects of nuclear power reactors is 

contained in Appendix A to 10 CFR Part 50, "General Design Criteria for Nuclear Power Plants." General 

Design Criterion (GDC) 2 defines design bases requirements for protection against natural phenomena. 

GDC 2 identifies the following performance criterion: 

Structures, systems, and components important to safety shall be designed to withstand the 

effects of natural phenomena, such as earthquakes, tornadoes, hurricanes, floods, tsunami, 

and seiches without loss of capability to perform their safety functions. The design bases 

for these structures, systems, and components shall reflect (1) appropriate consideration of 

the most severe of the natural phenomena that have been historically reported for the site and 

surrounding area, (2) appropriate combinations of the effects of normal and accident 

conditions with the effects of the natural phenomena, and (3) the importance of the safety 

functions to be performed. 

In 1975, the NRC published the Standard Review Plan (SRP), which provides standardized review criteria 

to assist the staff in evaluating safety analysis reports submitted by license applicants. Since its first 

publication, the SRP has undergone several revisions (the latest being 1981) to incorporate new developments 

in design and analysis technology. The SRP sections that address plant safety issues relevant to the IPEEE 

lIFO events include SRP Section 2.2.1, "Site Location and Description," and Section 2.2.2, "Identification 

of Potential Hazards in Site Vicinity." The review criteria in these SRP sections include the locations of 

transportation routes (water, rail, car) in the vicinity of the plant; pipelines that may contain hazardous 

materials; and fixed manufacturing, processing, and storage facilities. The review of these areas focuses on 

the potential for a release of hazardous material that could cause a fire, an explosion, or a threat to the 

habitability of the plant's control room. These two sections and other SRP sections that are relevant to the 

IPEEE HFO events are listed in Table 4.2. 

There are also a number of regulatory guides that address the technical issues related to the IPEEE HFO 

events, as follows: 

* Regulatory Guide 1.59, "Design Basis Floods for Nuclear Power Plants," 

0 Regulatory Guide 1.76, "Design Basis Tornado for Nuclear Power Plants," 

0 Regulatory Guide 1.102, "Flood Protection for Nuclear Power Plants," 

0 Regulatory Guide 1.115, "Protection from Low-Trajectory Turbine Missiles," and 

0 Regulatory Guide 1.117, "Tornado Classification."

4-3
Table 4.2: Standard review plan sections relevant to UFO events

2.2.3 Evaluation of Potential Accidents

2.3.1 Regional Climatology 

2.3.2 Local Meteorology 

2.4.1 Hydrologic Description 

2.4.2 Floods 

2.4.3 Probable Maximum Flood (PMF) on Streams and Rivers 

2.4.4 Potential Dam Failures 

2.4.5 Probable Maximum Surge and Seiche Flooding 

2.4.6 Probable Maximum Tsunami Flooding 

2.4.7 Ice Effects 

2.4.10 Flooding Protection Requirements 

2.4.11 Cooling Water Supply* 

3.3.1 Wind Loading 

3.3.2 Tornado Loadings 

3.4.1 Flood Protection 

3.4.2 Analysis Procedures 

3.5.1.4 Missiles Generated by Nature Phenomena 

3.5.1.5 Site Proximity Missiles (Except Aircraft) 

3.5.1.6 Aircraft Hazards 

3.5.2 Structures, Systems, and Components to Be Protected 

from Externally Generated Missiles

* SRP Section 2.4.11 refers to potential interference with the ultimate heat 

sink, such as ice blockage, debris, droughts, etc.

The acceptance criteria for each HFO area given in the SRP are specifically tied to the corresponding GDCs 

for that topic and the regulatory guides that address that area. Hence, there is a close connection between the 

review of HFO events and the other related NRC regulatory guidance. 

There are two other NRC programs that are directly related to the IPEEE HFO events. These programs are 

the Generic Safety Issues (GSIs) Program and the Systematic Evaluation Program (SEP). GSI- 103, "Design for Probable Maximum Precipitation" (PMP), involved an evaluation of a plant's capability to withstand 

4-4
severe rainfall using updated site-dependent PMP values developed by the National Oceanic and Atmospheric 

Administration. GSI- 172, "Multiple System Responses Program (MSRP)," addressed a number of generic 

plant safety concerns. One of the MSRP issues that directly relate to HFO events is the effects of flooding 

and/or moisture intrusion on non safety-related and safety-related equipment. An aspect of the HFO reviews 

was to determine if the GSIs discussed above could be verified on a plant-specific basis as part of the IPEEE 

program. 

The SEP was initiated in the mid-i 970s. This program recognized that many safety criteria, including those 

associated with HFO events, had evolved since the initial licensing of the earliest nuclear power plants. The 

purpose of the SEP was to develop a systematic and documented basis for the safety of the older plants by 

comparing them to the current licensing criteria. 

Among the many technical issues that were included as a part of the SEP were six issues related to the UIFO 

events. These issues were (1) dam integrity and site flooding, (2) site hydrology and ability to withstand 

floods, (3) industrial hazards, (4) tornado missiles, (5) severe weather effects on structures, and (6) design 

codes, criteria, and load combinations. The IPEEE-related SEP issues are described in more detail in Section 

5.4.7 of this report. 

The following section of this report provides guidance for conducting IPEEE HFO reviews. As discussed 

in NUREG-1407, one of the approaches that a licensee could use in analyzing of the HFO events was to 

determine if the plant conforms to the guidance in the NRC's 1975 Standard Review Plan coupled with a 

plant walkdown. This approach was widely used by licensees in performing their evaluations of the HFO 

events. 

4.1.3.2 Guidance for Conducting IPEEE HFO Analyses 

Guidance for conducting HFO analyses for the IPEEEs is provided in Section 5 of NUREG-1407, 

"Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for 

Severe Accident Vulnerabilities" (NUREG-1407). In particular, NUREG-1407 recommends a progressive 

screening approach to identify potential HFO-related vulnerabilities at U.S. nuclear power plants. This 

progressive screening approach, summarized below, represents a series of steps or analyses in increasing 

level of detail and effort. 

Review the plant-specific hazard data and licensing basis and determine if any significant changes 

that could impact the IPEEE have occurred since the issuance of the operating license. 

Determine whether the plant conforms to the guidance in the NRC's 1975 Standard Review Plan 

(SRP) (NUREG-0800), and perform a plant walkdown. 

If the plant does not conform to the 1975 SRP guidance, one or more of the following optional steps 

may be taken: 

- Determine if the hazard frequency of the original design is acceptably low, by demonstrating 

that the hazard frequency is less than 1E-5 per year. 

- If the event cannot be screened out on the basis of hazard frequency, perform a bounding 

analysis. Such an analysis should be performed using conservative parameters, and is

4-5
intended to show that the hazard would not result in a bounding CDF contribution above the 

screening criterion of 1 E-6 per reactor-year (ry). 

Perform a PRA. 

High winds, floods, transportation, and nearby facility accidents are to be explicitly addressed in each 

licensee's IPEEE submittal, while "other" additional external events are to be addressed if they are 

applicable to a specific site. 

An analysis of containment performance for HFO events is not needed unless the licensee predicts 

or identifies plant-unique accident sequences that are different from those determined by the internal 

events IPE. 

As an alternative to the above options, a licensee may request that the staff review any other 

systematic examination method to determine its acceptability for IPEEE purposes. 

These various options are graphically shown in Figure 4.1, which is taken from NUREG-1407. 

4.1.4 Overview of Results 

A summary of the HFO-related IPEEE results for the 70 plants reviewed is given in Table 4.1 of Volume 2 

of this report. This table includes the method used by each licensee to evaluate HFO events, the estimated 

CDF, if reported, and HFO-related improvements that licensees have implemented or planned. As indicated 

in this table, all licensees have addressed a range of HFO events at their plants. 

In the majority of the HFO event analyses, licensees have screened out these events on the basis of qualitative 

assessments, consistent with one of the accepted approaches given in NUREG-1407. A qualitative 

assessment typically involved demonstrating conformance with the 1975 SRP criteria (or for several plants the criteria in the updated 1981 SRP) coupled with a plant walkdown. The purpose of the walkdown is to 

identify any changes in the plant configuration from the original design basis that may impact the IPEEE 

evaluation and also to identify any specific plant areas that may not necessarily have been part of the design basis but could significantly impact the IPEEE evaluation (e.g., a roof design that could potentially be 

overloaded during heavy rainstorms because the drains are susceptible to being blocked with debris). There 

are three forms of quantitative analyses that licensees have used in the HFO-related IPEEEs, each involving 

a different level of detail and resulting in a different type and amount of information. These three evaluation 

methods (analysis of hazard frequency, bounding analysis of estimated CDF contributors, and PRA) are 

described in Section 4.1.3.2 and Figure 4.1. As in other applications, licensees that performed PRAs for 

HFO-related studies have used varying degrees of conservatism, some with best-estimate parameters and 

others with more conservative values. 

Table 4.3 shows the relative distribution of the evaluation methods used by the licensees in performing their 

HFO reviews. This table summarizes the methods chosen by the licensees for analyzing the topical event 

categories of: high winds in general, tornadoes, tornado-generated missiles, floods, other external events in 

general, chemical releases, hydrogen explosions, and aircraft crashes. Table 4.3 also indicates that most of 

the HFO-related IPEEE studies (approximately 80%) were performed using the qualitative screening method, 

4-6

I I
(1) Review plant-specific hazard data and licensing bases 

(FSAR)

V 

(2) Identify significant changes, if any, since issuance 

of the operating license

(3) Does plant/facilities design meet 1975 SRP criteria? 

(Includes screening and plant walkdown)

YES

(4) Is the hazard frequency acceptability low?

I NO

(5) Perform bounding PRA analyses YES 

(bounding response/consequences)

I NO

(6) Perform PRA (best estimate response/consequences)

(7) Documentation (identified reportable items & proposed 

improvements)

Figure 4.1 Recommended IPEEE approach for high winds, floods, and other 

external events

4-7

< NO

OR 1ý

OR -

OR
as allowed in NUREG-1407. The PRA applications, including both full and partial bounding PRAs, 

accounted for roughly 15% and, lastly, the initiating event hazard frequency method was used least frequently 

(less than 5%). 

None of the 70 IPEEE submittals identified any HFO-related vulnerabilities; however, 34 submittals reported 

that they had either made, or were considering, a total of 64 HFO-related plant improvements; 36 submittals 

reported that they had not identified any needed improvements. Tables provided in this chapter show the 

number of improvements for each event category, and the number of plants making improvements for each 

category of events. 

Section 4.6 summarizes the general observations and insights pertaining to the HFO IPEEE submittals. 

Table 4.3: Licensees' methods of analysis for HFO external events 

(by topic)

High winds (general) 55 13 2

4-8

I II

Tornadoes 51 17 2 

Tornado-generated missiles 56 12 2 

Floods [ 58 12 f 0 

Other events (general) 60 7 3 

Chemical releases 57 10 3 

Hydrogen explosions 59 8 3 

Aircraft crashes 58 8 4 

Notes: 

1. As allowed by NUREG-1407, this approach involves confirming that 

the plant is in conformance with the 1975 SRP criteria coupled with a 

walkdown to confirm that changes have not occurred at the plant that 

would impact on the IPEEE or that there are important plant-unique 

situations that should be considered. 

2. Some of the applications of PRA used best-estimate input parameters, 

and others used some bounding parameters to simplify the analysis. 

3. In this approach, an event is screened out if the calculation of the 

initiating frequency (e.g., the likelihood of a damaging tornado event) 

has an estimated frequency below some screening value (a typical 

value used is 1 E-5 events/year).
4.2 High Winds

4.2.1 Introduction 

The external events category of high winds comprises tornadoes, hurricanes, and straight winds. 

4.2.2 High Winds Quantitative Results 

Among the 17 plant submittals that reported a CDF from high winds, the results have ranged from less than 

2E-7/ry to 6E-5/ry. 

Typically, the dominant CDF sequence associated with high winds involved a loss of offsite power (LOOP) 

in combination with random failure of emergency ac power. Other random failures that licensees reported 

as being significant contributors to CDF for high wind events include the loss of service water, auxiliary 

feedwater, feed-and-bleed cooling, and high-pressure injection. In addition, one plant postulated that wind

generated missiles could fail the diesel generators, service water system condensate storage tank, or 

ventilation system, thereby leading to core damage. Another plant identified the diesel fuel oil transfer pumps 

and lines as being exposed to tornado-induced missiles. 

The review process revealed that some licensees had employed optimistic assumptions in their analysis of 

high winds. In response to related RAIs, the licensees either revised their analyses or provided information 

to show that their assumptions were appropriate. For example, in one submittal, the licensee's treatment of 

direct winds initially screened out wind speeds from 108 to 125 miles per hour. However, upon subsequent 

analysis, the licensee found that such wind speeds could lead to station blackout, and increased the plant's 

CDF contribution from 2E-6/ry to 8E-6/ry. 

4.2.3 High Winds Qualitative Results 

As seen in Table 4.3, qualitative analysis involving the demonstration of conformance with the 1975 SRP 

was used much more frequently than either PRA (full and bounding assessment) or hazard frequency 

screening for high winds (i.e., 55 cases versus 13 and 2 cases, respectively). 

4.2.4 Plant Improvements for High Winds 

The plant improvements that the licensees reported to increase protection against the effects of high winds 

included 7 procedural improvements and 10 plant hardware improvements. Table 4.5 of this volume lists 

the individual improvements for high winds which are also identified in the plant-specific summaries in 

Table 4.1 of Volume 2. 

4.2.5 General Insights for High Winds 

As would be expected, the incidence of a specific type of high wind that is of significant magnitude to cause 

power plant damage is very region-specific in the United States. Hurricanes are the dominant potentially 

damaging high wind source in the coastal areas, while tornadoes dominate inland, particularly in the Midwest 

and South. One of the more damaging ways in which high wind effects contribute to plant CDF is through 

impact of wind-generated missiles, particularly tornado-generated missiles. Seventeen plant improvements

4-9
related to high winds were cited by the licensees as a result of their IPEEEs. This accounted for 

approximately 27% of all of the HFO-related improvements. See Table 4.4 for a summary of the relative 

distribution of the HFO-related improvements. 

Table 4.4: Total number of plant improvements for high winds, floods, 

and other external events* 

High winds 17 27% 

External flooding 32 50% 

Transportation or nearby facility accidents 5 8% 

Other external events including plant- 10 15% 

unique hazards

Total_1 64 100%

* This table gives the total number of improvements cited in the submittals for 

all 70 IPEEE plants. These improvements include both procedural and 

hardware improvements. Some of the improvements cited by the licensees in 

their submittals were still under consideration at the time the licensees sent their 

IPEEEs to the NRC. Therefore, the number of actual improvements that have 

been implemented is not known, but is likely to be somewhat less than 64. A 

small number (less than five) of the improvements had been implemented before 

the IPEEE, but were IPEEE-related. 

4-10
Table 4.5: Plant improvements to protect against high winds

Special plant procedures 

Arrangement for the timely delivery of additional diesel generator fuel oil during storms 

Emergency procedures to inspect diesel generator fuel oil transfer pumps and to isolate oil leakage and 

provide for makeup after a high wind event 

Special training sessions for plant personnel, including training in the use of redundant instrumentation 

locations 

Additional sheltering plans for plant personnel 

Revised emergency procedures based on lessons learned from Hurricane Andrew 

Emergency procedures to prevent ventilation failures during hurricanes 

Tornado protection of the diesel generator exhaust system 

Protection for the diesel generator room air supply 

Addition of an air-cooled diesel generator (added before the IPEEE) 

Addition of a tornado missile shield in the door of a technical support center 

Addition of a tornado missile shield for an opening of an auxiliary building 

Protection of cooling ducts and dampers in the control and diesel generator rooms during high wind 

conditions 

Modifications to strengthen the diesel generator exhaust stacks 

Improved mechanical hold downs for hydrogen tanks 

Modifications to exterior doors to withstand pressure differentials during high winds 

Strengthening of exhaust stacks of nearby fossil plant to prevent collateral damage from high winds

4-11
4.3 External Floods

4.3.1 Introduction 

Sources of external floods are intense rainfall (including hurricanes); dam failures; wind-driven waves from 

lakes, rivers, or the ocean; abnormally high water levels from the same; and melting snow. Potential damage 

modes are site flooding resulting in water ingress into areas housing vulnerable safety-related equipment and 

water ponding on roofs that could potentially fail from the increased roof loading. 

4.3.2 External Floods Quantitative Results 

Of the licensees' submittals, 12 reported CDF contributions for external flooding ranging from about 2E-8/ry 

to about 7E-6/ry. Typically, floods induced by dam breaks, hurricanes, or intense precipitation have been 

treated as leading to a LOOP, which the licensees usually assumed to be irrecoverable, and additional random 

failures could then lead to core damage. Other submittals listed additional flood-related damage, including 

the loss of function of the intake structure; failures of diesel fuel oil transfer pumps; and potential failures of 

safety-related equipment in the diesel generator, auxiliary, and turbine buildings. 

4.3.3 External Floods Qualitative Results 

Just as for high winds, licensees used the qualitative screening approach more often than PRA or hazard 

frequency screening (58 cases versus 12 and 0 cases, respectively). In few instances where flood hazards 

were screened out, the IPEEE review process revealed that a relatively small increase in the critical flood 

level (perhaps just a few inches) could result in a significant change in the predicted annual rate of flood 

occurrence, such that these events could no longer be screened out, and additional analysis would then be 

needed to assess the consequences. On the other hand, many of the flooding assessments were conservative 

in that the licensees assumed that the effects from a number of possible conditions were cumulative (e.g., 

assuming a concurrent combination of peak wind-driven wave heights and peak high-water levels). Given 

the substantial uncertainties involved in developing Site-specific flood hazard curves, a consideration of 

possible combinations of multiple effects causing a range of flood levels would have enhanced the robustness 

of some of the licensee's analyses and lent greater confidence to their findings. 

Where applicable, most submittals considered and screened out potential failures of upstream dams that could 

lead to flooding at the plant site. 

A few licensees proposed flood-related countermeasures that may be optimistic. For example, one licensee 

took credit for sandbagging up to a level of 9 feet. In several other submittals, flood barriers made of various 

construction materials, such as logs or concrete beams, were credited with being effective for preventing 

flooding, but the submittals did not discuss whether the licensees performed confirmatory testing to verify 

the effectiveness of certain of these mitigating actions. 

4- 12

I II
4.3.4 Plant Improvements for External Floods

Plant improvements that were cited to provide further protection against flooding included 15 procedural 

improvements and 17 plant hardware improvements. Table 4.6 of this volume lists the individual flood

related improvements, which are also identified in the plant-specific summaries in Table 4.1 of Volume 2. 

4.3.5 General Insights About External Floods 

As for high winds, the effects of flooding are seen to be very region-specific and are more common in certain 

areas of the United States than in others. Plant sites In coastal locations are most susceptible to hurricane

induced flooding, as well as high precipitation levels. Certain rivers and lakes are more prone to have 

combinations of high winds and associated waves combined with high water levels, and other areas in the 

Northern and Western United States are subject to heavy snows with subsequent melting and flooding. As 

indicated, this category of the IFO-related events accounted for more of the cited plant improvements 

(approximately 50%) than any other HFO-related area.

4-13
Table 4.6: Plant improvements to protect against external floods

Improved emergency procedures for flooding conditions 

Increased maintenance of drainage structures 

Improved plant flood mitigation procedures 

Increased inspection of roof drains 

Procedures and inspections associated with the expeditious installation of special flood doors when needed 

Special procedures for removal of snow and ice 

Surveillance of a drain flapper valve for drainage from a control building 

Evaluation of closure times for flood gates to aid in emergency planning 

Revised procedures based on lessons learned regarding flooding from Hurricane Andrew 

Procedures regarding water drainage from the turbine building during heavy rainfall 

Procedures to prevent water flow from the turbine building into the main control room 

Improved procedures to protect against local river flooding 

Improved emergency operating procedures in the event of a dam failure 

Scuppers in parapet walls to promote drainage and reduce roof ponding loads during heavy rainfall 

Provisions for portable pumps 

Upgrading flood-resistant doors 

Provision for sandbags 

Sealing of conduits 

Addition of weather stripping to doors in buildings housing safety-related equipment 

Addition of screens on equipment hub drains in a 480V switchgear room to preclude foreign material intrusion 

Flood protection of a service water pump motor 

Alteration of local site topography to reduce potential site flooding 

Addition of a seiche (oscillatory wave action) protection barrier to protect the fuel oil transfer pumps for the diesel generators 

from flooding 

Improved penetration seals to protect against potential flooding between service and auxiliary buildings 

Modifications to the service water pump house roof to allow existing scuppers to drain excess rainwater more effectively 

Refurbishment of existing flood walls and stop logs 

Raised elevation of diesel generator fuel oil transfer pumps to protect against hurricane surge 

Sealing of underground conduits to the switchgear rooms against water intrusion 

Sealing penetrations in the diesel fuel oil transfer pump house to protect transfer pumps 

Addition of a pump in the cooling tower area to remove excess water during heavy rainfall 

4-14

I II
4.4 Accidents Involving Transportation or Nearby Facilities

4.4.1 Introduction 

Examples of events in this category include accidents involving hazardous chemical spills; fires or explosions 

from railway shipping or truck transport in the area of the plant (typically within a 5-mile distance); 

hazardous chemical spills, fires, or explosions from commercial facilities in the vicinity of the plant (e.g., 

chemical processing or storage plants, hydrogen storage tanks, etc.); and aircraft crashes. 

4.4.2 Results of Analyses 

Although only a few submittals document PRA results or CDF bounding assessments for these specific types 

of accidents (e.g., aircraft crashes), none of the submittals identified a CDF from accidents involving 

transportation or nearby facilities above the NUREG- 1407 screening criterion of 1 E-6/ry. 

The large majority of the licensees performed qualitative as opposed to PRA or hazard frequency screening 

for their IPEEE transportation analyses. As observed for the treatment of the other HFO events, most 

submittals did not report walkdown procedures, walkdown team composition, or detailed walkdown findings. 

Many of the submittals primarily relied on existing analyses and documents as the basis for screening out 

transportation and nearby facility accidents. 

4.4.3 Plant Improvements for Transportation or Nearby Facility Accidents 

Plant improvements that were cited to protect against these types of events included just three procedural 

improvements and two plant hardware improvements. As indicated in Table 4.4, this category accounted for 

the fewest number of HFO-related plant improvements (8%). Table 4.7 of this volume lists the individual 

improvements related to transportation and nearby facility accidents, which are also identified in the plant

specific summaries in Table 4.1 of Volume 2. 

Table 4.7: Plant improvements to protect against transportation and nearby facility accidents 

Addition of plant guidelines to exclude flights over the plant by company pilots 

Addition of restrictions to exclude all flights over the plant 

Coordination with the U.S. Coast Guard to prevent further shipping of explosive materials on a nearby 

shipping channel 

Hadaeimproements 

Addition of a backup cooling water intake structure for added protection against barge accidents 

(added before the IPEEE) 

Addition of concrete barriers placed around a propane tank near the diesel generator rooms to protect 

against possible vehicle impact and subsequent explosions and fires

4-15
4.4.4 General Insights for Transportation or Nearby Facility Accidents

Transportation and nearby facility accidents do not vary regionally as much as weather-related external 

events, such as high winds and flooding. All areas of the United States where plants are located may have 

nearby roadways, rail traffic, water traffic, air traffic, and industrial facilities. While these types of events 

were not found to account for a significant risk contribution in any of the IPEEE submittals, and the relative 

number of plant improvements was much smaller than for the other HFO-related topics, these classes of 

accidents have rather unique aspects. That is, the plant-specific situation could change rather quickly. Fore 

example, a company could begin to transport hazardous materials by a route (by water, rail, or roadway) sufficiently close to the plant to pose a hazard, or a nearby industrial facility could establish a new storage facility for hazardous materials on its property but close enough to the plant to pose a potential risk. These 

changes could conceivably be made without the knowledge of the plant safety personnel, and those making the changes may not be particularly sensitive to the potential impact on the plant's safety. Although these 

types of accidents have not been found to represent a significant risk in the IPEEEs, this emphasizes the need 

for communication between licensees and nearby facilities to ensure the use of up-to-date information. 

4.5 Other External Events Including Plant-Unique Hazards 

4.5.1 Introduction 

Besides high winds, floods, and transportation and nearby facility accidents, a wide variety of less likely other 

external events could possibly affect the plant risk, and these required consideration in the IPEEE evaluations. 

Table 4.1 gives a list of other types of events. Although most of these other events could easily be screened 

out, a few were found to have an impact on a site-specific basis as discussed below. 

4.5.2 Other External Events Quantitative and Qualitative Results 

As seen in Table 4.3, only a few (seven) licensees reported quantitative CDF estimates for this category of 

external events. One submittal (Haddam Neck) reported a CDF contribution of 8E-6/ry from lightning and 

7E-6/ry from snow and ice. Lightning was assumed to cause a LOOP, with a number of other random 

failures being required to result in core damage. In the ice and snow analysis, the licensee found that the 

screen house, service building, and primary auxiliary building did not have roof load capacities much more 

than the snow load for a 100-year return interval. However, critical equipment failures attributable to roof 

collapse, combined with a number of other random failures, were required to lead to core damage. 

NUREG- 1407 did not require an explicit evaluation of liFO events other than high winds, external flooding, and accidents involving transportation or nearby facilities. Consequently, some submittals did not report an 

analysis of "other" HFO events. For those that did, most screened these events using qualitative screening techniques (e.g., showing conformance with the 1975 SRP criteria). For these other events, the number of 

qualitative screening applications compared with PRA and hazard frequency screening was 60, 7, and 3, respectively. In submittals that reported risk results for some "other" HFO event, most were found to have 

CDF contributions less than the NUREG- 1407 screening criterion of 1 E-6/ry. 

Two submittals reported the existence of a plant-unique hazard related to failure of downstream dams and 

related loss of a cooling source. In one case, the hazard was screened out since it is covered as a design basis 

accident. In the other case, the hazard is also a design basis event, but the licensee estimated an initiating 

4-16

I II
event frequency and performed a bounding CDF analysis on the basis of the applicable conditional core 

damage probability (CCDP) in order to screen out the hazard. 

4.5.3 Plant Improvements for Other External Events 

The improvements for this category included six procedural and four plant hardware improvements. As 

indicated in Table 4.4, the 10 improvements in the "other" category accounted for approximately 15% of all 

of the HFO-related improvements. Table 4.8 of this volume lists the individual improvements for this 

category, which are also identified in the plant-specific summaries in Table 4.1 of Volume 2. 

Table 4.8: Plant improvements to protect against other external events 

Special report regarding onsite hazards ftom potentially dangerous materials 

Notice regarding the onsite storage and transportation of hazardous materials 

Evaluation of control room habitability regarding plans for storing hazardous materials onsite 

Increasing the distance from a recently enlarged hydrogen storage system to the nearest safety-related 

equipment 

Guidance to prevent the buildup of hydrogen gas in letdown storage tank rooms 

Procedures to prevent stacking of containers in close proximity to safety-related equipment 

Modifications to prevent ice formation on service water pumps serving the diesel generators 

Addition of screens on drains to prevent foreign material intrusion into safety-related equipment spaces 

Modifications to ventilation system exhausts systems to protect against potential combustible gas 

explosions 

Modifications to a plant intake structure to prevent blockage from detritus (debris) 

4.5.4 General Insights About Other External Events 

While most plants did not report a significant hazard contribution attributable to these types of events, and 

most completely screened out this I-FO category, there was one notable exception. Lightning and hazards 

associated with snow and ice were reported to have a relatively high CDF contribution at Haddam Neck (i.e., 

greater than the NUREG- 1407 screening criterion of 1E-6/ry). While the CDF contributions for these events 

were estimated to be above the screening criterion at Haddam Neck, they still represent a small fraction of 

the overall plant CDF and are not large enough to be considered vulnerabilities. As indicated, this category 

of potential plant hazards is often unique to the plant and, in some cases, is regional in that the hazards are 

weather related.

4-17
4.6 General Observations and Insights about HFO External Events 

4.6.1 Containment Performance Perspectives 

None of the 70 IPEEE submittals identified any plant-unique accident sequences associated with containment 

performance that are different from those determined by the internal events IPE. Consistent with the 

guidance in Section 5.2 of NUREG- 1407, no additional containment performance is needed for HFO events. 

4.6.2 Unresolved Safety Issues and Generic Safety Issues 

Unresolved safety issues (USIs) and generic safety issues (GSIs) are discussed in depth in Chapter 5 of this 

report. Those issues pertaining particularly to the HFO part of the IPEEE review are discussed briefly below. 

All submittals provided some discussion concerning GSI-103, "Probable Maximum Precipitation." For this 

issue, some of the licensees stated that they had taken measures to protect roofs of safety-related buildings 

from the effects of roof ponding predicted as a result of intense local precipitation (e.g., the addition of 

scuppers to aid in draining the water). As noted in Table 5.2 and Section 5.4 of this report, three plants have 

not completely verified GSI- 103. 

The HFO IPEEE submittals did not explicitly discuss other GSIs or USIs. Nonetheless, certain information 

provided in the submittals is considered relevant for addressing issues associated with GSI-156, "Systematic Evaluation Program (SEP)," and GSI-172, "Multiple System Responses Program (MSRP)," as discussed 

below. 

4.6.2.1 GSI-156, Systematic Evaluation Program 

This generic issue has five sub-issues related to HFO events that are discussed below. 

Dam Integrity and Site Flooding. When applicable to the plant, HFO IPEEE submittals generally 

discussed the potential for, and effects of, site flooding as a result of independent or combined 

failures of upstream and downstream dams. Two submittals also considered the potential for loss 

of cooling water caused by failure of an onsite dam. 

Site Hydrology and Ability to Withstand Floods. HFO IPEEE submittals generally provided 

discussions that are directly relevant to this issue in their assessments of floods. 

Industrial Hazards. HFO IPEEE submittals generally provided discussions that are directly relevant 

to this issue in their assessment of accidents involving transportation and nearby industrial facilities. 

Tornado Missiles. HFO IPEEE submittals generally provided discussions that are directly relevant 

to this issue in their assessment of high winds and tornadoes. 

Severe Weather Effects on Structures. In general, HFO IPEEEs screened out the effects of direct 

winds and flooding on plant structures. Nonetheless, where applicable, the submittals generally 

provided relevant information concerning the effects of wind-induced missiles on those structures. 

4-18

I II
4.6.2.2 GSI-172, Multiple System Responses Program

With regard to GSI- 172, the only HFO-related issue regarding GSI- 172 is the effects of flooding and/or 

moisture intrusion on non safety-related and safety-related equipment. With respect to safety-related 

equipment, HFO IPEEE submittals generally provided discussions that are directly relevant to this issue in 

their assessment of floods. However, the submittals generally did not discuss flooding or moisture intrusion 

effects on non-safety-related equipment. This omission is not important from an IPEEE perspective since 

these effects do not contribute significantly to the plants' external event CDFs. 

4.6.3 Human Actions 

Where applicable, the HFO submittals documented operator recovery actions to mitigate the effects of UFO

induced plant transients. In those instances, the important operator recovery actions included recovery of 

offsite power or diesel generators given a tornado- or high-wind-induced LOOP, and use of sandbagging or 

installation of stop logs to mitigate an external flood. In some cases, the licensees' assessments of recovery 

actions may have been somewhat optimistic. The submittals did not discuss whether licensees performed 

confirmatory testing to verify the effectiveness of certain of these mitigating actions. However, as indicated 

in Section 4.3.3, flooding analyses tended to include conservative assumptions and, in addition, flooding 

levels do not generally change rapidly for topological configurations around plants. Plant operators should 

have time to initiate emergency actions (e.g., including plant shutdown) if conditions require such actions. 

4.6.4 Walkdown Perspectives 

Most of the HFO submittals provided some general description regarding walkdown findings. One licensee 

reported that they believed that the updated FSAR data constituted a more reliable information source than 

a plant walkdown. Most of the submittals reviewed did not provide specific detailed information regarding 

either walkdown findings or walkdown team composition. Licensees employed walkdowns to confirm that 

no significant changes have occurred since the plant operating license was issued. Specifically, walkdown 

findings noted in regard to flooding events included the identification of two conduits for flood entry into 

critical structures, the discovery that loads on the roof of a spent fuel cooling pool from roof ponding could 

potentially exceed the roof's design load, and identification of flood pathways (including non-water-tight 

doors). Walkdown findings pertaining to high winds consisted primarily identifying exposed components 

and nearby objects for wind-induced missiles. 

4.6.5 Summary of Plant Improvements 

Procedural enhancements related to HFO events have included provisions for sandbagging, closing or 

welding doors, hooking up pumps, providing new electrical circuits to reduce the risk from flooding, and 

provision for routine inspection and maintenance of drains. Two submittals reported that the licensees were 

considering the development of severe accident management guidance to reduce the risk of high winds. One 

submittal indicated development of guidance to ensure that a flood door can be installed in 8 hours, for the 

purpose of reducing flooding risk. 

Hardware improvements include (among others) refurbishing a flood wall, strengthening non-safety stacks 

to prevent collapse onto safety structures in high-wind events, installing weather stripping and other 

modifications to enhance flood protection at entry pathways, replacing drain screens, and providing 

4-19
equipment (such as portable water pumps) to enhance flood protection. At least one HFO submittal noted 

that hardware changes that had been implemented as a result of their IPE analyses (i.e., the addition of diesel 

generators) have also reduced the risk associated with HFO events. 

Overall, for most licensees, the HFO IPEEE program has resulted in a greater level of appreciation of the 

potential risk impact of high winds and tornadoes, external flooding, and other external initiators. 

4.6.6 General Perspectives 

As shown in Table 4.1 of Volume 2, the CDF estimates for high winds (including tornadoes) and external 

flooding have been found to range from 2E-8/ry to 6E-5/ry. Conservative bounding analysis estimates of 

CDF for high winds and external floods have been reported and, while the associated risks were not 

categorized as "vulnerabilities," they have resulted in a number of plant improvements (see Table 4.1 of 

Volume 2; Tables 4.4, 4.5, 4.6, 4.7, and 4.8 of this volume; and Sections 4.2.4, 4.3.4, 4.4.4, and 4.5.4 of this 

volume). All IPEEE submittals screened out accidents involving transportation and nearby facilities. 

Additional general review observations pertaining to HFO submittals include the following. 

Licensees' application of PRA techniques in HFO IPEEEs has varied considerably in scope, detail, and rigor. Simplified PRA approaches have generally been implemented, whereas to a lesser extent, detailed state-of-the-art PRA studies have been performed for some or all of the HFO initiators at 

a plant. 

Where the HFO IPEEE submittals have adopted the use of PRA methods or applicable PRA 

bounding analyses, licensees have commonly used the IPE conditional core damage probabilities (CCDPs) for events such as the loss of offsite power or loss of service water. However, the accident 

conditions associated with the IPEEE HFO events can be significantly different than the IPE 

conditions for these events. In certain cases, the accident sequences and associated CCDPs used to 

assess the HFO events may not have reflected the potential for the degradation of equipment performance as a result of conditions such as high winds or floods (particularly on exposed components). Consequently, in some of these cases, the resulting quantitative CDFs may have been 

underestimated, but not enough to mask a vulnerability. 

The HFO events are, by nature, somewhat different than the seismic and fire external events in the 

following respects. Certain HFO events can involve changes in the external environment that take 

place over time. An example of this is one case where a licensee reported that they discovered that 

explosive materials were being shipped on a nearby waterway. The licensee reported that when this 

was discovered, arrangements were made with the U.S. Coast Guard to prevent a recurrence. As 

discussed earlier, these types of events have not been found to be a significant risk contributor in the 

IPEEEs, but they emphasize the need for communication between licensees and other transportation and nearby facilities to ensure the use of up-to-date information. 

4.6.7 Impact of the IPEEE HFO External Events Program on Plant Safety 

Although no IPEEE submittal reported any HFO-related vulnerabilities, the HFO IPEEEs have resulted in 

numerous improvements in the form of procedural enhancements, severe accident management guidelines, 

4- 20

I I
and hardware improvements. Table 4.4 of this volume gives the number of improvements that licensees 

identified for the major IPEEE event categories; Tables 4.5,4.6,4.7, and 4.8 list the individual improvements 

by HFO topic; and Table 4.1 of Volume 2 lists the improvements on a plant-specific basis. 

Given that many licensees reported improvements associated with HFO events, the HFO IPEEE program has 

had a significant impact on improving plant safety. Of the 70 plant submittals, 34 cited a total of 64 

individual HFO-related improvements. Except for one case (Salem), the submittal did not provide 

information to quantify the reduction in CDF that resulted from these improvements. In the case of Salem, 

the licensee improved door seals to prevent flooding into a building that houses safety-related equipment. 

The IPEEE submittal reported that the CDF contribution was reduced from approximately 1 E-4/ry to 1 E-7/ry 

as a result of this improvement. Perhaps most important, it is clear from the documentation provided in the 

submittals that licensees' efforts to assess the potential hazards from HFO-related events have enhanced the 

knowledge of plant personnel regarding these types of events specifically for their plants. 

4.7 Summary and Conclusions 

For those cases where licensees performed PRAs or CDF bounding analyses, the estimated CDF results 

varied from plant to plant as demonstrated by the following information. 

0 For high winds and tornadoes, the plant-specific CDF results vary from less than 2E-7/ry to 

6E-5/ry. 

0 For external flood events, the plant-specific CDF results for 12 plants vary from about 2E-8/ry to 

about 7E-6/ry. 

* For transportation and nearby facility accidents, 8 plants reported that the plant-specific CDF results 

from PRA studies or bounding analyses are below the NUREG- 1407 screening criterion of 1 E-6/ry. 

* One submittal (Haddam Neck) reported bounding analysis CDF results of 8E-6/ry for lightning 

events and 7E-6/ry for snow and ice. 

* One submittal (South Texas) reported CDF results of 8E-6/ry for a chemical release from a nearby 

chemical facility. 

0 One submittal (Salem) reported a plant improvement that reduced the external events CDF by three 

orders of magnitude from approximately 1E-4/ry to approximately 1E-7/ry. The plant modification 

cited was the improvement of door penetration seals between the service and auxiliary buildings to 

protect against external flooding. 

Regarding HFO-related plant improvements, 34 of the 70 plant submittals cited a total of 64 individual 

improvements. Sixteen plants cited more than one HFO-related improvement with one plant (Turkey Point) 

indicating that they were considering as many as five improvements. These improvements are summarized 

in Tables 4.4 through 4.8 in this volume and on a plant-by-plant basis in Table 4.1 of Volume 2. Thirty-six 

plants reported no HFO-related improvements.

4-21
All HFO evaluations reviewed screened out accidents involving transportation and nearby facilities, as well 

as other plant-unique hazards when encountered. 

Of the 70 IPEEE submittals, most indicated that some type of walkdown was performed for HFO events 

during the IPEEE. However, one submittal stated that the licensee believed that a review of the updated 

FSAR data constituted a more reliable information source than a plant walkdown. The submittals usually 

did not provide detailed descriptions of the walkdown procedures and results. 

As discussed in Section 4.6.7, the licensees' evaluations of HFO events have not identified any vulnerabilities 

to these type of events. However, the extent of the documentation submitted by the licensees regarding their 

evaluations, and the list of HFO-related plant improvements, suggest that the IPEEEs have significantly 

contributed to the licensees' understanding of, and preparation for, potential HFO events. 

4 - 22

I I II
5. UNRESOLVED SAFETY ISSUES AND GENERIC SAFETY ISSUES 

5.1 Introduction 

This chapter discusses the unresolved safety issues (USIs) and generic safety issues (GSIs) that were 

addressed under the IPEEE program. Specifically, in accordance with Supplement 4 to Generic Letter (GL) 

88-20 and the associated guidance in NUREG- 1407, "Procedural and Submittal Guidance for the Individual 

Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," the NRC requested that 

licensees provide information to address the following issues: 

• USI A-45, "Shutdown Decay Heat Removal Requirements," 

0 GSI-103, "Design for Probable Maximum Precipitation," 

• GSI- 131, "Potential Seismic Interaction Involving Movable In-Core Flux Mapping System Used in 

Westinghouse Plants," 

• GSI-57, "Effects of Fire Protection System Actuation on Safety-Related Equipment," and 

• Sandia Fire Risk Scoping Study (FRSS) issues. 

In addition, the four other GSIs listed below have external event aspects, but were not specifically identified 

as issues to be verified under the IPEEE program and, therefore, were not explicitly discussed in 

Supplement 4 to GL 88-20 or NUREG-1407. After issuing the generic letter, the NRC evaluated the scope 

and the specific information requested in the generic letter and the associated IPEEE guidance. The NRC 

concluded that the plant-specific analyses requested in the IPEEE program could also be used, through a 

satisfactory IPEEE submittal review, to evaluate and verify the external event aspects of the following safety 

issues: 

• GSI-147, "Fire-Induced Alternate Shutdown/Control Room Panel Interactions," 

0 GSI-148, "Smoke Control and Manual Fire-Fighting Effectiveness," 

0 GSI- 156, "Systematic Evaluation Program (SEP)," and 

• GSI-172, "Multiple System Responses Program" (MSRP). 

It should be noted that there is some overlap among the issues discussed in this chapter and, although the 

majority of these issues are covered within the IPEEE scope, a number of issues (or sub-issues) have aspects 

related to internal events (which were covered in the IPE program), as well as aspects related to external 

events. Only external events aspects are covered in this chapter. Some of these issues relate to seismic 

events, fires, and HFO events and, therefore, are also discussed in Chapters 2, 3, and 4, respectively. Table 

5.1 summarizes this information for the issues (and sub-issues) that are covered within the IPEEE scope. 

As shown in Table 5.1, a number of these issues are very closely related. Some issues or sub-issues are 

identical in scope, but may have different or similar titles. For example, GSI-147, "Fire-Induced Alternate 

Shutdown/Control Room Panel Interactions" (discussed in Section 5.4.5), is identical to the FRSS issue with 

the same title' (discussed in Section 5.4.9.1.5). 

1 This issue, which NUREG/CR-5088 originally identified as one of the Sandia Fire Risk Scoping Study issues, was 

later designated as a generic issue and was tracked in the NRC's generic issue program (NUREG-0933).

5-1
Table 5.1: Generic safety issues addressed in the IPEEE program

Shutdown Decay Heat Removal Requirements S,F USI A-45 EX

Potential Seismic Interaction Involving the Movable In-Core S GSI-131 C 

Mapping System 

Effects of Fire Protection System Actuation on Safety-Related S,F GSI-57 X X P 

Equipment 

Fire-Induced Alternate Shutdown/Control Room Panel Interaction F GSI-147 X C 

Smoke Control and Manual Fire-Fighting Effectiveness F GSI-148 X P 

Seismic-fire Interactions F X X C 

Adequacy of Fire Barriers F X C 

Effects of Hydrogen Line Ruptures S,F X C 

Settlement of Foundations and Buried Equipment S X P 

Dam Integrity and Site Flooding S,HFO X C 

Seismic Design of Structures, Systems, and Components S X C 

Common Cause Failures Related to Human Errors S,F X EX 

Non-Safety-Related Control System/Safety-Related Protection S,F X EX 

System Dependencies 

Effects of Flooding and/or Moisture Intrusion on Non-Safety- F,HFO X EX 

Related and Safety-Related Equipment 

Seismically Induced Spatial and Functional Interaction S X C 

Seismically Induced Flooding S X C 

Seismically Induced Relay Chatter S X C 

Evaluation of Earthquake Magnitudes Greater than S X C 

Safe Shutdown Earthquake 

Design for Probable Maximum Precipitation HFO GSI-103 C 

Site Hydrology and Ability to Withstand Floods HFO X P 

Industrial Hazards HFO X C 

Tornado Missiles HFO X C 

Severe Weather Effects on Structures HFO X C 

Design Codes, Criteria, and Load Combinations S,HFO X C 

Shutdown Systems and Electrical Instrumentation and Control F X EX 

Features

iS=seismic, F=internal fires, HFO=high winds, floods, and other external events 

2C=issue covered by IPEEE; EX-only external event-related aspects of issue covered; P=partially covered (refer to 

specific section of the text for details)

5-2
The scope of most of these generic issues is covered in its entirety by the IPEEE program. These issues are 

noted in the remarks column of Table 5.1 by the letter "C" (i.e., the issue is covered by the IPEEE). As noted 

above, the scope of some issues includes aspects of both internal and external events. For example, USI A

45, "Shutdown Decay Heat Removal Requirements," includes potential plant vulnerabilities associated with 

internal event initiators as well as external event initiators. The IPEEE program covers only the external 

event-related aspects of this issue. (The internal event aspects were covered in the IPE program.) Issues such 

as this are noted by "EX" (i.e., only the external event-related aspects of the issue are covered) in the remarks 

column of Table 5.1. The other designator in the remarks column is "P" (i.e., is partially covered in the 

IPEEE program). The scope of these issues, as defined in NUREG-0933, includes some aspects that go 

beyond those that are covered by the IPEEE program. For example, GSI- 148, "Smoke Control and Manual 

Fire-Fighting Effectiveness" (discussed in Section 5.4.6), does not cover the effects of potentially damaging 

mechanisms, such as smoke, on equipment. Data on smoke-induced damage to equipment are sparse and, 

hence, it was not anticipated that the IPEEE analyses would assess this potentially damaging mechanism. 

Other parts of GSI- 148 are covered by the IPEEE program (see Section 5.4.6). Each of these issues and sub

issues is discussed in more detail in Section 5.4. 

As discussed in previous chapters, there were 70 IPEEE submittals; however, the staff prepared only 69 staff 

evaluation reports because one plant (Haddam Neck) was permanently shut down after providing its IPEEE 

submittal. Therefore, the discussions and tables in this chapter related to USIs and GSIs (which are addressed 

in the staff evaluation reports) address only 69 submittals. 

Sections 5.2 and 5.3 discuss the process used by licensees and the staff, respectively, in evaluating the USIs 

and GSIs. This is followed by Section 5.4, which describes each individual issue and sub-issue and presents 

an overview of their treatment in the IPEEE submittals. Section 5.5 presents a summary and the staff s 

conclusions. 

5.2 Overview of Licensees' Assessment Processes 

This section describes the processes that the licensees used to arrive at their conclusions regarding the 

verification of the USIs and GSIs that they were asked to address within the context of the IPEEE program. 

In general, the licensees' processes included performing seismic, fire, and HFO walkdowns, which involved 

USI/GSI aspects related to the individual plant. In the case of seismic walkdowns, the licensees used a 

seismic review team (SRT) to review documentation of the walkdowns that were conducted and, in some 

cases, performed additional verification walkdowns. 

The licensees also used probabilistic risk assessment (PRA) techniques to examine the dominant accident 

sequences and their associated initiating events. When these examinations revealed no vulnerability or no 

particular plant feature with a potentially significant risk contribution, the licensees concluded that the 

external event aspects of the considered USIs and GSIs were verified. Usually, the licensees also subjected 

their assessments and conclusions to an independent peer review before submitting the IPEEE study to the 

NRC.

5-3
5.3 USI/GSI Staff Review Evaluation Process

This section discusses the process that the staff used to assess the acceptability of the licensees' conclusions 

regarding the USIs and GSIs in the IPEEE submittals. The staff's judgement regarding for USI and GSI 

verification was based on the following criteria. 

The licensee's IPEEE is complete with regard to USI and GSI coverage. 

The licensee's assessment demonstrated an in-depth knowledge of the external event aspects and 

plant characteristics that are relevant to the issues discussed. 

The licensee's assessment results are reasonable given the design, location, features, and operating 

history of the plant. 

An issue is thus considered verified if the submittal did not identify any potential vulnerabilities associated 

with its related concerns, or the licensee implemented plant-specific improvements to eliminate or reduce the 

significance of the identified potential vulnerabilities at the plant. For example, during plant walkdowns, 

some licensees identified improvements to strengthen equipment anchorages to reduce seismically induced 

spatial interactions (one of the MSRP sub-issues discussed in Section 5.4.8.2.7). In a few cases, licensees 

identified improvements related to a generic issue that were planned, but had not been implemented at the 

time of the IPEEE submittal. Confirmation that "planned" improvements have been made with regard to a 

generic issue is recommended. 

The staff assessed the acceptability of the licensees' conclusions on the basis of information in the IPEEE 

submittals, which was sometimes supplemented by the licensees' responses to the staff's requests for 

additional information (RAIs) seeking clarification or supplemental assessments of certain aspects of the 

submittal. 

Furthermore, the staff established an IPEEE Senior Review Board (SRB), which held meetings on a regular 

basis. The SRB comprised NRC staff and consultants with specialized expertise in the various aspects of 

external events and PRA. In these meetings, the SRB members provided their perspectives on the IPEEE 

review findings, and recommended actions on the basis of their technical specialities. In this manner, the 

SRB provided additional assurance that each review met the IPEEE program objectives. 

The IPEEE reviews showed that most of the submittals contain information that addresses most of the GSIs. 

However, if a submittal did not discuss the issue or sub-issues, and the reviewers determined whether the 

missing information could cause the licensee to overlook a potential vulnerability at their plant. On the basis 

of the SRB members' expertjudgement and information on similar issues from other IPEEE submittals, RAIs 

were sent to licensees if a potential vulnerability could have been missed or if information in response to the 

RAI would be likely to uncover a significant problem with the IPEEE results. However if a licensee's 

submittal did not address an issue or sub-issue, but did not miss a potential vulnerability, the NRC's staff 

evaluation report (SER) identified the omission as a "weakness" in the submittal. In such cases, the 

submittals still meet the intent of Supplement 4 to Generic Letter 88-20, but the GSI may not be "verified" 

for that plant. 

5-4

I I
Table 5.2 shows the status of each of the IPEEE-related USI and GSI issues for all of the plants. A "yes" 

indicates that the particular issue was verified for that plant. A "no" indicates that the staff did not have 

sufficient information from either the submittal or the responsea to RAIs to determine whether the issue was 

adequately addressed. An "N/A" means that the issue was not applicable to the given plant. For example, 

GSI- 131, "Potential Seismic Interactions Involving the Movable In-Core Flux Mapping System Used in 

Westinghouse Plants," only applies to Westinghouse plants. Several issues (e.g., GSI- 156, GSI- 172, and the 

FRSS issues) comprise a number of sub-issues. Issues in Table 5.2 that are shown to be "partially" verified 

indicate that one or more of the sub-issues may not be verified, but the remaining sub-issues are verified. 

Table 5.2: IPEEE USI/GSI verification

Arkansas I & 2 Yes Yes Yes N/A Yes Yes Yes Yes Yes

Beaver Valley 1 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Beaver Valley 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Braidwood I & 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Browns Ferry 2 & 3 Yes Yes Yes N/A Partial Yes Partial Yes Partial 

Brunswick 1 & 2 Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Byron 1 & 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Callaway Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Calvert Cliffs 1 & 2 Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Catawba 1 & 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Clinton Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Columbia Generating' Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Comanche Peak 1 & 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Cooper Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Crystal River 3 Yes Yes Yes N/A Yes Yes Yes N/A Partial 

D.C. Cook 1 & 2 Yes Yes Yes Yes Yes Yes Yes Yes Yes 

Davis Besse Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Diablo Canyon 1 & 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Dresden 2 & 3 Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Duane Arnold Yes Yes Yes N/A Partial Yes Partial Yes Yes 

Farley 1 Yes Yes Yes Yes Yes Yes Yes N/A Partial

Formerly known as Washington Nuclear Project No. 2 (WNP-2). 

5-5
Table 5.2: IPEEE USIIGSI verification (Continued)

Plant name USI A-45 JGSI-57 GSI-103 GS1-131 PRSS GSI-147 J 05-148 G51- 156 GS1-172 

Fermi 2 Yes Yes Yes N/A Partial Yes Partial N/A Yes 

Fitzpatrick Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Fort Calhoun Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Ginna Yes Yes Yes Yes Yes Yes Yes Yes Yes 

Grand Gulf Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Hatch 1 & 2 Yes Yes Yes N/A Partial Partial Partial Yes Partial 

Hope Creek Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Indian Point 2 Yes Yes Yes Yes Partial Yes Partial Yes Yes 

Indian Point 3 Yes Yes Yes Yes Partial Yes Partial Yes Yes 

Kewaunee Yes Yes Yes Yes Partial Yes No Yes Partial 

LaSalle' Yes No Partial N/A Partial Yes No N/A Partial 

Limerick 1 & 2 Yes Yes Yes N/A Yes Yes Partial N/A Partial 

Millstone 2 Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Millstone 3 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Monticello Yes Yes Yes N/A Yes Yes Yes Yes Yes 

McGuire I & 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Nine Mile Point I Yes Yes Yes N/A Partial Yes Partial Yes Yes 

Nine Mile Point 2 Yes Yes Yes N/A Yes Yes Yes N/A Yes 

North Anna 1 & 2 Yes Yes Yes Yes Yes Partial Partial N/A Partial 

Oconee 1, 2, & 3 Yes Yes Yes N/A Partial Yes Partial J Yes Yes 

Oyster Creek Yes Yes Yes N/A Partial Yes Partial Yes Yes 

Palisades Yes Yes Yes N/A Yes Partial Yes Yes Yes 

Palo Verde 1, 2, & 3 Yes Yes Yes [ N/A Yes Yes Yes N/A Yes

2 The licensee relied exclusively upon previously published NRC PRA reports (NUREG/CR

4832, "Analysis of the LaSalle Unit 2 Nuclear Power Plant: Risk Methods Integration and Evaluation 

Program (RMIEP)," and NUREG/CR-5305, "Integrated Risk Assessment for the LaSalle Unit 2 Nuclear 

Power Plant: Phenomenology and Risk Uncertainty Evaluation Program (PRUEP)") and provided no 

additional information related to generic issues. This is evidenced by the lack of verification for any 

issue outside of those that could be deduced from the RMIEP study.

5-6
Table 5.2: WPEEE USJ/GST verification (Continued)

Plant name USI A-45 GSI-57 GSI-103 GSI-131 FRSS GSI-147 GS-148 _GSI-156 GSI-172 

Peach Bottom 2 & 3 Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Perry Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Pilgrim Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Point Beach 1 & 2 Yes Yes Yes Yes Yes Yes Yes Yes Yes 

Prairie Island 1 & 2 Yes Yes Yes Yes Yes Yes Yes Yes Yes 

Quad Cities I & 2 Yes Yes Partial N/A Yes Yes Partial Yes Yes 

River Bend Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Robinson 2 Yes Yes Yes Yes Yes Yes Yes Yes Yes 

Salem 1 & 2 Yes Yes Yes Yes Yes Yes Yes N/A Yes 

San Onofre 2 & 3 Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Seabrook Yes Yes Yes Yes Partial No No N/A Partial 

Sequoyah I & 2 Yes Yes Partial Yes Yes Yes Yes N/A Yes 

Shearon Harris Yes Yes Yes Yes Partial Yes Partial N/A Yes 

South Texas I & 2 Yes Yes N.A. 3 Yes Yes Yes Yes N/A Yes 

St. Lucie 1 & 2 Yes Partial Yes N/A Partial Yes Partial N/A Partial 

Summer Yes Yes Yes Yes Yes Yes Yes N/A Yes 

Surry 1 & 2 Yes Yes Yes Yes Yes Yes Yes Yes Yes 

Susquehanna 1 & 2 Yes Yes Yes N/A Yes Yes Yes N/A Yes 

Three Mile Island I Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Turkey Point 3 & 4 Yes Partial Yes Yes Partial Yes No Yes Partial 

Vermont Yankee Yes Yes Yes N/A Yes Yes Yes Yes Yes 

Vogtle 1 & 2 Yes Yes Yes Yes Partial Yes Partial N/A Partial 

Waterford 3 Yes Yes Yes N/A Yes Yes Partial N/A Partial 

Watts Bar I Yes Yes Yes Yes Yes Yes Yes N/A Partial 

Wolf Creek Yes Yes Yes Yes Yes Yes Yes N/A Yes 

3 A new PMP evaluation was not required for South Texas because the impact of the new PMP criteria had previously 

been evaluated as part of the operating license process in 1989, in accordance with GL 89-22, "Potential for Increased 

Roof Loads and Plant Area Flood Runoff Depth at Licensed Nuclear Power Plants Due to Recent Change in Probable 

Maximum Precipitation Criteria Developed by the National Weather Service."

5-7
(The plant-specific tables in Volume 2 ofthis report provide additional information showing which sub-issues 

are or are not verified for each plant.) For those issues that have not been completely verified, the NRC staff 

will determine if any additional actions or assessments are needed to verify these GSIs. This follow-up will 

be done separately from the IPEEE program. 

The following sections discuss the unverified USIs and GSIs or portions thereof for each plant listed above. 

5.4 IPEEE-Related USIs and GSIs 

This section discusses the USIs and GSIs that are addressed in the IPEEE submittals. Each specific issue 

includes the following: 

* a description of the issue, 

• a discussion of findings and plant modifications that impact this particular issue, and 

* additional observations regarding the issue. 

5.4.1 USI A-45, "Shutdown Decay Heat Removal (DHR) Requirements" 

5.4.1.1 Issue Description 

The objective of USI A-45 is to determine whether the decay heat removal function at operating plants is 

adequate and whether cost-beneficial improvement(s) could be identified. The internal event aspects of USI 

A-45 were subsumed in the IPE (Generic Letter 88-20); therefore, the external event aspects, including fire

related issues and seismic adequacy of the decay heat removal systems, are included in the IPEEE. Thus, 

the purpose of the IPEEE related to USI A-45 is to identify any significant and unique seismic and fire 

vulnerabilities in the decay heat removal function. 

5.4.1.2 Findings and Related Plant Modifications 

Most licensees explicitly addressed USI A-45 in their IPEEE submittals. Those submittals that did not 

explicitly mention this issue implicitly addressed USI A-45 by providing adequate information on the 

potential loss of decay heat removal capability through the evaluation of seismic and fire events, which would 

ensure adequate decay heat removal under these conditions. 

The seismic evaluation of all plants included decay heat removal equipment. Plants that performed a seismic 

PRA provided a quantitative evaluation of the contribution of potential loss of decay heat removal to the 

estimated CDF. 

The plants that performed seismic margin analyses (SMA) included the equipment that would be used for 

decay heat removal on their IPEEE safe shutdown equipment list (SSEL). The licensees then performed a 

fragility analysis of all of the equipment on the SSEL. For licensees that performed an SMA, this analysis 

resulted in identification of each component's high confidence of low probability of failure (HCLPF) value. 

Usually, the licensees would state that most or all of the components' HCLPF values were greater than the 

review-level earthquake (RLE) value (usually 0.3 g except for six plants that had 0.5 g - see Section 2.1.3.2) 

and would only identify those components that had HCLPF values close to or below the RLE. Those 

licensees that had HCLPF values below the RLE usually either performed a more detailed evaluation that 

5-8

I II
resulted in removing the components from the SSEL, the revised HCLPF value being higher than the RLE, 

or citing some plant change that would result in a higher HCLPF value. In some cases, the licensees 

determined that there was no cost-beneficial modification that would significantly improve the HCLPF value. 

All plants had HCLPF values for the equipment on the SSEL in excess of the safe shutdown earthquake 

(SSE). 

NUREG- 1407 identified 10 plants as "reduced-scope" plants. These plants are located in areas where the 

seismic challenge is deemed to be significantly reduced, such that the design basis earthquake is an adequate 

representation of the perceived seismic challenge. For these plants, the RLE was the same as the SSE. 

Therefore, for reduced-scope plants, demonstrating that the equipment on the SSEL would remain functional 

at the SSE level and there were no vulnerabilities was sufficient for addressing USI A-45. 

Some licensees addressed potential loss of decay heat removal capability in the event of a fire through a fire 

PRA, a few of which included Level 2. Some plants used the decay heat removal model from their IPE to 

model postulated fire events as part of their IPEEE. Other plants developed alternative success paths. 

Typically, these drew on previous work, such as the fire hazard analyses conducted in accordance with 

Appendix A to 10 CFR Part 50, or compliance with Appendix R to 10 CFR Part 50. 

5.4.1.3 Observations 

Whether a licensee used an SPRA or an SMA for the seismic IPEEE, the capability of decay heat removal 

functions is directly included by definition. Thus, any findings encountered in the IPEEE with respect to 

seismic capability of DHR functions also apply to USI A-45. In other words, for seismic events, USI A-45 

perspectives are a subset of the IPEEE perspectives. Consequently, the IPEEE submittals generally reiterated 

those seismic IPEEE findings pertaining to DHR capability as the basis for the verification of USI A-45. 

The NRC concludes that all plants have adequately addressed USI A-45. All plants have identified at least 

one method of removing decay heat for postulated fire events. While not all plants have an identified margin 

in excess of the needs for safe shutdown during an SSE (e.g., the reduced-scope plants) the NRC has 

determined that the IPEEEs have performed an adequate assessment to identify potential vulnerabilities in 

the decay heat removal systems consistent with the guidance in NUREG- 1407, and no vulnerabilities were 

found. 

5.4.2 GSI-57, "Effects of Fire Protection System Actuation on Safety-Related Equipment" 

5.4.2.1 Issue Description 

GSI-57 addresses the potential that the activation of fire suppression systems, either as part of actual fire

fighting or spuriously, might result in damage to plant systems and components. The analytical results 

obtained for prioritization of this issue by the NRC identified the following dominant risk contributors as: 

* seismically induced fire plus seismically induced suppression diversion, and 

* seismically induced actuation of the fire protection system (FPS). 

The NRC anticipated that licensees would conduct seismic and fire walkdowns, as described in Section 7.0 

of EPRI's Fire-Induced Vulnerability Evaluation (FIVE) methodology. These walkdowns were expected to 

assess whether (1) an actuated FPS would spray safety-related equipment, and (2) some protective measures,

5-9
if needed, could be implemented to prevent the safety-related equipment from being sprayed by fire 

suppressants. 

Other potential damage mechanisms, such as smoke and fire suppressant damage (either from fixed systems 

or manual actions), have not been considered. In general, this is an area where the database on equipment 

vulnerability is rather sparse. Similarly, analytical methods and tools (such as computer codes) have not 

generally been evaluated in the context of fire risk assessment. Hence, it is not anticipated that the IPEEE 

analysis would provide a detailed assessment of smoke- and suppressant-induced damage. 

5.4.2.2 Findings and Related Plant Modifications 

Some licensees noted that their fire protection system was designed in accordance with the guidelines of 

Category II/I in safety-related structures and areas (Regulatory Guide 1.29, "Seismic Design Criteria," 

Revision 3, September 1978, Regulatory Position C.2). This guideline states that wherever a Category II 

component (e.g., the non-safety-related fire protection system) is installed above a Category I component (i.e., safety-related), no failure mode of the Category II system or component is to adversely impact the 

Category I system or component. This includes seismic events. Thus, seismically induced failure of the fire 

protection system could fail the piping, but the failed piping would not adversely impact the performance of 

the safety-related structures, systems, or components. This includes the potential falling of the failed pipe 

and the potential release of water from the failed pipe. 

Many licensees noted that some, or all, of their water-based fire protection systems required two diverse 

actions for initiation (pre-action type). One action would be for a smoke detector to open a supply valve in 

the fire protection system, while the second action is heat from the fire to melt the fusible link in the sprinkler head. For this type of system, the licensees concluded that inadvertent activation of the fire protection system 

by a seismic event or associated dust was not a problem. 

Most licensees performed walkdowns as part of the verification of this generic issue. Typically, these 

walkdowns reviewed the spatial relationship between the fire protection system and safety-related 

components. This was particularly applicable to those licensees that had deluge fire protection systems. The 

safety-related components were reviewed to ensure that postulated failure of the fire protection system under 

seismic conditions would not adversely affect safety-related equipment from a falling component or from the 

water released from the fire protection system. The walkdowns also identified the presence of seals in the 

top of safety-related cabinets to prevent water intrusion and of area drains to remove excess water to prevent flooding. Most floor drainage systems were sized for flooding induced by pipe breaks. Generally, fire 

protection systems have lower flow rates and would be less likely to flood a compartment. However, some 

licensees have identified potential drain plugging issues and have revised or developed procedures to 

periodically inspect the drainage system to reduce the probability of plugging. 

The impact of CO2 or Halon protective system actuation was also reviewed as it relates to potential effects 

on personnel (e.g., control room operators) and equipment (e.g., operation of the diesel generators) in the 

area. Usually potential problems from these systems were dismissed as having an insignificant impact on 

plant safety or were beyond the scope of this generic issue. Data on the effects of smoke and fire 

suppressants on equipment are limited, and such effects were considered to be beyond the scope of the IPEEE 

program. 

5-10

I II
A few licensees discussed the potential effects of corrosion, buildup of soot, or other combustion products 

on equipment operability. Those that discussed this aspect stated that potential damage would occur over a 

much longer period of time than required to establish cold shutdown. Corrective maintenance would resolve 

any long-term problem that might be caused by these mechanisms. The majority of the submittals did not 

discuss the impact of combustion products on equipment operability or stated that there was insufficient 

information to address the issue. 

A number of licensees stated that operators in their plants receive training on the use of the abnormal 

operating procedures for fire situations. Some of the licensees stated that training included live fire or live 

smoke conditions. Frequently, the licensees stated that timing records are kept for the fire brigade training 

exercises. Some licensees used this information to demonstrate that the manual fire-fighting times used in 

the IPEEE are conservative. 

The licensees concluded that the impact of seismically induced activation of fire suppression systems, 

suppressant diversion, and adverse effects on safety-related components was negligibly small. 

5.4.2.3 Observations 

The information provided in the submittals is usually qualitative and provides little detail. Table 5.1 of 

Volume 2 of this report lists the plants and whether they addressed the two items in the generic issue. All 

but four of the plants have provided adequate information to verify this generic issue. One plant (LaSalle) 

provided no information, and three provided only partial information. Review of the submittals indicates that 

the licensees generally have an appreciation for the potential impacts of fire systems on safety-related 

components and systems. 

5.4.3 GSI-103, "Design for Probable Maximum Precipitation" 

5.4.3.1 Issue Description 

The latest probable maximum precipitation (PMP) criteria published by the National Weather Service (NWS) 

of the National Oceanic and Atmospheric Administration (NOAA) may identify higher rainfall intensities 

over shorter time intervals and smaller areas than have previously been considered. This could result in 

higher site flooding levels and greater roof ponding loads than have been used in previous design bases. The 

IPEEE program includes an assessment of the effects of applying these new PMP criteria to each plant in 

terms of potential severe accident vulnerabilities associated with onsite flooding and roof ponding. To 

provide the revised PMP estimates, licensees typically used the information in the NOAA 

Hydrometeorological Report (HMR) 51, "Probable Maximum Precipitation Estimate, United States East of 

105 th Meridian," HMR 52, "Application of Probable Maximum Precipitation Estimates - United States East 

of the 105' Meridian," and HMR 53, "Seasonal Variation of 10-Square-Mile Probable Maximum 

Precipitation Estimates, United States East of the 105th Meridian." 

5.4.3.2 Findings and Related Plant Modifications 

Typically, licensees determinee the revised PMP rate and evaluated the ability of the roofs to withstand the 

new accumulation of water. Table 5.2 of Volume 2 of this report shows the PMP information provided in 

the submittals. Usually, the roofs can withstand the additional loads because the excess rainfall overflows 

the roof parapets. In some cases, licenses installed scuppers in the parapets to accommodate additional

5-11
precipitation. In many situations, licensees credited roof drains for water removal. Such licensees frequently 

identified a new or existing procedure to periodically inspect the roof drainage system for potential blockage. 

In the unusual case that a structure was found to be unable to withstand the new loadings, the licensee 

evaluated the impact of roof failure and water intrusion into the building. No plant vulnerabilities related to 

this issue were identified in the IPEEE submittals. 

Another PMP-related consideration involves its effect on nearby rivers and streams, and the resulting 

potential for failures of dams and levies. The submittals provided different levels of detail. Some submittals 

provided a short qualitative narrative. Other submittals provided significant detail. The latter showed that 

the licensee considered the entire drainage area into a river (or other body of water), and evaluated the impact 

of this increased water flow on site water levels and on dams and levies. Frequently, licensees consulted with 

other organizations (e.g., the U.S. Army Corps of Engineers). In some cases, licensees identified static water 

levels. However, in most cases where detailed information was provided, the licensees also considered wave 

runup and wind effects to determine the maximum water level at the site. The licensees then compared this 

water level to the flood protection elevation provided to safety-related structures, systems, and components. 

Table 5.2 of Volume 2 of this report shows the external flooding elevations and flood-protected elevations 

provided in the submittals. When licensees identified the potential for flooding of a structure, the licensee 

reviewed the potential effects of the flooding and either determined that the potential flooding would not 

adversely affect the plant, or made plant changes including installation of seals, procedures for timely plant 

shutdown, or procedures to prevent flooding (e.g., installation of sand bags around doorways). Table 5.3 of 

Volume 2 of this report lists the improvements identified in the submittal for each plant. In one case, the 

service water systems and a train of the fire protection system could be lost. In this case, the licensee 

identified actions that could be taken in a timely manner to prevent the total loss of service water. 

The last PMP consideration relates to local intense PMP. This issue addresses the potential that site drainage 

might not adequately remove very intense local precipitation at the site. The licensee usually addressed this 

by reviewing site elevations and drainage capabilities. Either the resulting water level at the safety-related 

structures was bounded by the flood water elevation (most frequent finding) or the licensee evaluated the 

potential in-leakage. The licensee found that (1) this potential in-leakage would result in insignificant water 

accumulation; (2) it would result in significant water accumulation, but the water level would remain below 

the elevation of safety-related components; or (3) the potentially affected components would perform their 

intended function in a submerged condition (least frequent finding). Thus, all licensees concluded that local 

intense PMP was not a problem. 

Most licensees included a confirmatory plant outdoor walkdown to identify building doors and penetrations 

that might be vulnerable to moisture intrusion. These walkdowns also involved examining of the roof drain 

systems and plant site drainage. Occasionally, these walkdowns identified weaknesses, and the licensee made 

some plant change. For example, recognizing the need for the roof drainage system to perform its intended 

function, one licensee instituted a surveillance procedure to periodically inspect the drains for obstructions. 

5.4.3.3 Observations 

All but three plants verified all aspects of GSI-103. As shown in Table 5.3, these three plants verified some, 

but not all, parts of this issue. Two plants neglected to address the issues of roof ponding and external 

flooding from the revised PMP-induced flooding, and one plant did not address site drainage. 

5- 12

I II
Table 5.3: Unverified areas related to GSI-103

Not Verified Verified Not Verified Illinois River

Quad Cities 1 & 2 Not Verified Verified Not Verified PMP 

Sequoyah 1 & 2 Verified Not Verified Verified Verified 

* Source of external flooding that was not verified (i.e., from dam or pond failures) or river 

flooding as the result of the revised PMP

One plant (Salem) installed new penetration seals between the service and auxiliary buildings. These new 

penetration seals significantly reduced the core damage frequency from external floods from approximately 

1E-4/ry to 1E-7/ry. 

For a few plants, the revised PMP is less than the design basis PMP; nonetheless, the overall conclusion is 

that the original design and construction of the plants included sufficient margin to allow variations of up to 

two to three times the original design basis PMP without adversely impacting safe operation of the plant. 

5.4.4 GSI-131, "Potential Seismic Interaction Involving the Movable In-Core Flux Mapping 

System Used in Westinghouse Plants" 

5.4.4.1 Issue Description 

This issued was identified because portions of the in-core flux mapping (ICFM) system in Westinghouse 

plants are located directly above the seal table, and may not have been seismically analyzed. Failure of this 

equipment during a seismic event could potentially result in multiple failures at the seal table and could 

produce a small-break LOCA (SBLOCA) as a result of instrument tube failure(s). The potential interaction 

between the seal table and non-seismic Category I systems associated with the movable ICFM system can 

be identified during the seismic IPEEE walkdown. This issue may be dealt with in the following ways: 

• demonstrate that the issue is not applicable to the site, or 

* demonstrate that the restraints provide adequate capacity to withstand seismic forces, or 

* document and implement administrative controls that preclude unrestrained mobile cart motion. 

5.4.4.2 Findings and Related Plant Improvements 

Licensees performed walkdowns to verify that previous modifications to their ICFM system were adequate, 

or to identify potential interactions between the seal table and the ICFM. 

Table 2.13 of Volume 2 of this report summarizes the characteristics of the ICFM system for Westinghouse 

plants. It identifies previous upgrades for each plant and summarizes IPEEE findings and related plant 

improvements. The improvements ranged from procedures to restrain a chain from falling to installation of 

angle irons welded to the seal table to bolt the transfer table in place when not in use.

5- 13

LaSalle
5.4.4.3 Observations

GSI-131 applies only to Westinghouse plants that have a movable ICFM system (see Table 2.13 of Volume 

2). For 39 of the 69 plants, GSI-131 is not relevant. For 3 of the 30 Westinghouse plants (Kewaunee, Point 

Beach 1 and 2), the issue is only partially relevant due to an immobile configuration of the flux mapping cart. 

Of the 30 plants affected by this generic issue, 19 (-63%) had already verified the issue and completed the 

modifications that were needed to ensure the that Category II ICFM equipment would not adversely impact the Category I seal table. This was verified by walkdowns and reviewed by a seismic review team. Six 

plants did not identify any evaluation of this issue before the IPEEE. As part of the IPEEE review, these six 

plants determined that the as-found condition of the ICFM and seal table was adequate. Many of the plants made some modification to their procedures to provide increased assurance that the ICFM would be left in 

the appropriate configuration when it is not in use. Table 2.13 of Volume 2 of this report lists this 

information by individual plant. 

In some cases, the licensees undertook a walkdown to verify the installation of a previous improvement as 

part of the seismic IPEEE. Some plants implemented hardware improvements related to GSI- 131 by either 

replacing the flux mapping system cart hold down bolts or installing stiffener and anchor assemblies for the 

mapping carts. A few submittals (at least 13 of 30) indicated that the licensees evaluated the capability of 

the ICFM system for RLE loads. In one case (Kewaunee), the licensee implemented an administrative 

procedure to help eliminate the potential for an interaction hazard involving an overhead chain hoist. In 

another submittal (North Anna), the existing configuration of the moveable flux mapping system was found 

to be adequate, provided that operators reinstalled bolts connecting the cart frame to its supporting beams 

whenever the cart was moved into position above the seal table. Overall, all 30 plants for which this issue is 

applicable verified this generic issue. 

5.4.5 GSI-147, "Fire-Induced Alternate Shutdown and Control Room Panel Interactions" 

5.4.5.1 Issue Description 

The issue of control systems interactions is primarily associated with the potential that a fire in the plant (e.g., in the main control room (MCR)) might lead to potential control system vulnerabilities. Given a fire in the 

plant, the likely control systems interactions are between the control room, the remote shutdown panel, and 

shutdown systems. The guidance for performing such an assessment is provided in NUREG/CR-5088, "Fire 

Risk Scoping Study." The following specific areas should be addressed in the IPEEE fire analysis. 

Electrical independence of the remote shutdown control systems. The primary concern for control 

systems interactions occurs at plants that do not provide independent, remote shutdown control 

systems. The licensees' processes to (a) verify electrical independence and (b) evaluate the level of 

indication and control of remote shutdown control and monitoring circuits should be reviewed. 

Loss of control equipment orpower before transfer. The licensees' processes for evaluating the loss 

of control power for certain control circuits as a result of hot shorts or blown fuses before 

transferring control to remote shutdown locations should be assessed. 

Spurious actuation ofcomponents leading to component damage, a loss-of-coolant accident (LOCA), 

or an interfacing systems LOCA. The licensees' processes for evaluating the spurious actuation of 

one or more safety-related or safe shutdown-related components as a result of fire-induced cable 

5- 14

I I
faults, hot shorts, or component failures leading to component damage, LOCA, or interfacing system 

LOCAs before taking control from the remote shutdown panel should be assessed. This should also 

include assessment of the spurious starting and running of pumps, as well as the spurious 

repositioning of valves. 

Total loss of system function. The licensees' processes for evaluating total loss of system function 

as the result of fire-induced redundant component failure or electrical distribution system (power 

source) failure should be assessed. 

5.4.5.2 Findings and Related Plant Modifications 

All but four4 of the licensees provided adequate information in their IPEEE submittals to verify GSI-147. 

Table 5.4 of Volume 2 of this report identifies the unique features at specific plants and the areas where 

adequate information was not provided to verify appropriate implementation of GSI- 147. 

Many plants relied, in part, on compliance with the requirements of Appendix R to 10 CFR Part 50, or the 

counterpart guidelines in NUREG-0800, "Standard Review Plan," Section 9.5.1, "Fire Protection Program," 

and related Branch Technical Positions. As part of the IPEEE review related to fire events and as part of the 

Sandia Fire Risk Scoping Study, the licensee verified that the plants have the ability to transfer adequate 

control from the control room to alternate locations to achieve plant safe shutdown conditions (i.e., the 

alternate location is electrically independent of the control room). The IPEEE submittals indicated that 

control of any errant equipment would be regained once control was transferred from the control room to the 

alternate shutdown locations. The licensees stated that no unrecoverable effects from errant equipment would 

be sustained until control was regained. Once the transfer is accomplished from the control room, the area 

with the fire is independent from the systems that would be used to control the plant, thereby precluding the 

total loss of system function for those systems. The Appendix R reviews considered spurious actuation of 

components, one at a time. As part of the fire IPEEE review, some licensees considered multiple hot shorts, 

including, in one case (Cooper), the concurrent, independent, spontaneous, and spurious hot short powering 

of each of the six automatic depressurization system valves. Spurious actuation reviews generally included 

power cables and signal (or instrumentation) cables. Generally, the potential loss of power to equipment was 

addressed by feeding the alternate shutdown equipment through a separate, independent breaker or fuse. This 

alternate feed line was engaged as the control was transferred from the control room. 

4 The four plants that did not provide sufficient information to verify GSI- 147 are Hatch, North 

Anna, Palisades, and Seabrook. The first three plants provided adequate information for three of the four 

aspects of this issue described in Section 5.4.5.2. The fourth plant, Seabrook, only mentioned in the 

submittal that control systems interactions were treated in the fire area screening and detailed plant 

response evaluation. However, the submittal did not address any of the four specific areas. Although the 

staff could not conclude that this issue was verified for Seabrook, the licensee did perform a quality fire 

analysis and analyzed control room fire scenarios in detail. Overall, the staff felt that the licensee's 

IPEEE process was capable of identifying the most likely severe accidents and severe accident 

vulnerabilities and, therefore, the Seabrook IPEEE met the intent of the IPEEE program. However, the 

staff's SER noted a weakness in the IPEEE in that GSI- 147 was not considered verified for that plant.

5-15
Only one plant (Surry) identified any plant modifications specifically related to this issue. In this case, Surry modified some circuits to ensure that the diesel generators and the alternate shutdown panel could be isolated 

from the control room and to reduce the likelihood of spurious power operated relief valve actuations. 

5.4.5.3 Observations 

The information in the IPEEE submittals provided a wide range of information on this topic. Some submittals 

provided sparse information (e.g., "generally immune to the effects of control system interactions" and using the FIVE guidance), while other submittals provided very specific information (e.g., being necessary to 

perform one or more actions at 14 alternate shutdown panels). The plants' capabilities also varied from 

having a black-start combustion turbine generator set with dedicated components to plants that use one electrical division of the normal plant equipment with power and control isolation from the control room. 

Most plants with safe shutdown facilities5 also require or preferentially desire some operator action(s) or 

equipment operation outside of the safe shutdown facility in the event of control room abandonment. The 

effectiveness of the previous work associated with Appendix R (and its counterpart in the Standard Review Plan) is evidenced by only one plant finding the need to make a plant modification related to its alternate 

shutdown capability. Overall, the staff found that 94% of all plants provided adequate information to verify 

this generic issue. 

It should be noted that the IPEEE program was not intended to enhance or go beyond the current state-of-the

art. This includes potential electric circuit interactions as the result of postulated fires. For the most part, licensees satisfactorily performed the review of their plants in accordance with the guidance in the generic issue and the state of circuit interaction knowledge at the time of the IPEEE submittals. Recently, the NRC 

and industry initiated further investigations to determine the likelihood of the different potential fire-induced 

cable failure modes (circuit interactions). This ongoing investigation is aimed at providing an improved basis 

for the treatment of circuit interactions and indicates that there is a potential for additional cable interactions that may need to be considered that are beyond those evaluated as part of this generic issue and the IPEEE 

program. However, this investigation is not complete at this time. Therefore, with the possible exception of the four plants mentioned above, the staff considers GSI- 147 to be verified, while recognizing that, at some 

future date, some related further consideration may be necessary. 

5.4.6 GSI 148, "Smoke Control and Manual Fire-Fighting Effectiveness" 

5.4.6.1 Issue Description 

Smoke control and manual fire-fighting effectiveness are associated with the concern that a potential exists for the buildup of smoke to hamper the efforts of the fire brigade to extinguish fires in a timely manner before 

damage can occur to plant systems and components important to safety. (It should be recognized that the 

brigade response time is not equal to the extinguishment time.) Any risk-significant fire will generate significant amounts of smoke. Smoke can impact plant risk in several ways. 

5 A safe shutdown facility is an independent, dedicated method of providing safe shutdown. Typically, safe shutdown facilities include an independent, dedicated, black-start power source, pump(s), 

water supply, and instrumentation and controls that are located outside of the normal plant facility buildings. Generally, only piping, isolation valves, and level instrumentation are located within normal 

plant facility buildings and are used by the safe shutdown facility. 

5- 16 

I I II
Smoke can reduce manual fire-fighting effectiveness (e.g., by causing access problems to the 

affected fire zone or by causing difficulties in actually locating the fire within the zone), cause 

misdirected suppression efforts, and subsequently damage equipment that is not directly involved 

in the fire. 

Smoke can damage or degrade electronic equipment thereby resulting in functional loss or spurious 

response. However, very little experimental data is available with regard to equipment response in 

smoke environments and the methodology for including smoke in PRAs has not been adequately 

developed. Hence, the IPEEE analysis was not expected to provide an assessment of the effect of 

smoke on equipment. 

Smoke can hamper an operator's ability to safely shutdown the plant by causing evacuation of 

control centers and subsequent reliance on alternate shutdown capability. 

Smoke can initiate automatic fire protection systems in areas away from the fire, thereby potentially 

damaging safety-related systems or components. This aspect is separately addressed in GSI-57, 

"Effects of Fire Protection System Actuation on Safety-Related Equipment" (see Section 5.4.2). 

5.4.6.2 Findings and Related Plant Modifications 

Of the IPEEE submittals, only 19 credited manual fire-fighting actions. In addition, 25 submittals identified 

manual fire-fighting for only select areas (e.g., the control room) or select accident scenarios. Normally, not 

crediting manual fire-fighting is a conservative approach to the assessment of fire growth and direct fire 

damage timing issues because this assumes that all equipment within a fire zone is destroyed. Usually, those 

submittals that credited manual fire-fighting also considered the following: 

* delays in manual actuation of suppression systems (e.g., while verifying the existence of a fire), 

* delays in locating the fire, once the fire brigade has arrived, 

* time required to extinguish or substantially control a fire, once fire-fighting has begun, and 

* fire brigade training. 

Two of the submittals that credited manual fire-fighting actions did not discuss fire brigade training, fire

fighting equipment, or timing. 

Although not taking credit for manual fire-fighting actions in the licensee's analysis is conservative from a 

PRA standpoint, submittals that did not credit manual fire-fighting actions may not have considered the 

following potential effects of manual suppression: 

potential damaging effects of misdirected fire suppressants (e.g., to adjacent safety-related 

equipment), and 

barriers breeched by fire-fighting personnel (e.g., leading to the spread of smoke, fire, or both to 

adjacent fire areas). 

Not considering the potential effects of misdirected suppression was deemed to be a shortcoming in the 

IPEEE submittals that took some credit for manual fire-fighting. Not considering the potential adverse effects 

of breaching fire barriers was also deemed to be a weakness. However, even in cases for which the licensees 

took no credit in the IPEEEs for manual fire-fighting the submittals provides information related to fire

5- 17
brigade training, drills, record keeping, and timing, consistent with the guidance in EPRI's FIVE 

methodology. In some cases, the information was very detailed. Several submittals identified that training 

exercises were carried out under live fire or live smoke conditions. In one case (Grand Gulf), the licensee 

simulated the actual plant configuration for the fire exercise with live fire and changed the configuration for 

each drill. Another submittal (Salem) identified that there is a dedicated fire department for the plant. 

Some licensees discussed the potential for the effects of fire to adversely affect equipment that is not directly 

involved with the fire. This includes potential effects (corrosion or buildup of soot and/or other combustion 

products) that occur over a much longer period of time than that required to establish cold shutdown. In such 

cases, the submittal identified that corrective maintenance would resolve any induced equipment problem. 

The remaining submittals did not discuss the impact of combustion products on equipment operability. Some 

submittals (e.g., Browns Ferry and Farley) limited their discussion of mitigating the effects of smoke to the 

use of self-contained breathing apparatus and portable ventilation equipment. Two submittals (Grand Gulf 

and Waterford 3) specifically identified that fire brigade members were educated on the toxic and corrosive 

characteristics of combustion products. It should be noted, however, that there is little information about this 

topic in the currently available literature. 

The IPEEE submittals did not identify any plant modifications or procedural changes associated with this 

generic issue. Table 5.5 of Volume 2 of this report provides plant-specific information found in the SERs 

and TERs related to this generic safety issue. 

5.4.6.3 Observations 

Manual fire-fighting activities were credited in 19 submittals, were credited for only select fire areas or fire 

scenarios in 25 submittals, and were explicitly not credited in 13 submittals. This generic issue was verified 

for 49 plants (71%), partially verified for 17 plants (25%), and not verified for 3 plants (4%). 

5.4.7 GSI-156, "Systematic Evaluation Program" 

5.4.7.1 Issue Description 

The Systematic Evaluation Program (SEP) was developed to review plants that were licensed before the 1975 

edition of the Standard Review Plan (SRP) was issued (i.e., were licensed without explicitly addressing the 

information in the 1975 SRP). Of the 70 submittals, 31 are for plants that are in the SEP program. (The 

remaining 29 submittals are for plants that are not in the SEP program.) Nine SEP issues were reviewed as 

part of the IPEEE program. Each of these issues is discussed in the following sections. 

5.4.7.1.1 Site Hydrology and Ability to Withstand Floods 

The objective of this issue is to identify the site hydrologic characteristics to ensure the capability of safety

related structures to withstand flooding, to ensure adequate cooling water supply, and in-service inspection 

of water-control structures. This issue involves assessing the following: 

* hydrologic conditions - to ensure that plant design reflects appropriate hydrologic conditions, 

* flooding potential and protection - to ensure that the plant is adequately protected against floods, and 

* ultimate heat sink -to ensure an appropriate supply of cooling water during normal and emergency 

shutdown conditions. 

5-18

I I
Issues related to in-service inspection of water-control structures constitue compliance issues that are not part 

of the IPEEE program. 

5.4.7.1.2 Industrial Hazards 

The objective of this issue is to ensure that the integrity of safety-related structures, systems, and components 

would not be jeopardized as a result of accident hazards from nearby facilities. Such hazards include shock 

waves from nearby explosions, releases of hazardous gases, or chemicals that result in fires or explosions, 

aircraft impacts, and missiles resulting from nearby explosions. 

5.4.7.1.3 Tornado Missiles 

The objective of this issue is to ensure that plants that were constructed before 1972 (SEP plants) are 

adequately protected against tornadoes. Safety-related structures, systems, and components need to be able 

to withstand the impact of an appropriate spectrum of postulated tornado-generated missiles. 

5.4.7.1.4 Severe Weather Effects on Structures 

The objective of this issue is to ensure that safety-related structures, systems, and components are designed 

to function under all severe weather conditions to which they may be exposed. Meteorological phenomena 

to be considered include straight wind loads, tornadoes, snow and ice loads, and other phenomena that are 

deemed to be significant for a particular site. 

5.4.7.1.5 Design Codes, Criteria, and Load Combinations 

The objective of this issue is to ensure that structures that are important to safety should be designed, 

fabricated, erected, and tested to quality standards that are commensurate with their safety function. All 

structures that are classified as Seismic Category I are required to withstand the appropriate design conditions 

without impairment of structural integrity or reduction in the performance of the required safety functions. 

Due to the evolutionary nature of design codes and standards, operating plants may have been designed to 

codes and criteria that differ from those that are currently used in evaluating new plants. Therefore, the 

review is to ensure that Category I structures will withstand the appropriate design conditions (i.e., against 

seismic events, high winds, and floods) without impairment of structural integrity or reduction in the 

performance of required safety functions. 

5.4.7.1.6 Dam Integrity and Site Flooding 

The objective of this issue is to ensure the ability of a dam to prevent site flooding and ensure a cooling water 

supply. The safety functions normally include remaining stable under all conditions of reservoir operation, 

controlling seepage to prevent excessive uplifting water pressures or erosion of soil materials, and providing 

sufficient freeboard and outlet capacity to prevent overtopping. Therefore, the review is to ensure that 

adequate safety margins are available under all loading conditions, and uncontrolled releases of retained 

water are prevented.

5- 19
The seismic portion of the IPEEE address the concern regarding site flooding resulting from seismic failure 

of an upstream dam and loss of the ultimate heat sink caused by the seismically induced failure of a 

downstream dam. 

5.4.7.1.7 Settlement of Foundations and Buried Equipment 

The objective of this SEP issue is to ensure that safety-related structures, systems, and components are 

adequately protected against excessive settlement. The scope of this issue includes reviewing subsurface 

materials and foundations in order to assess the potential static and seismically induced settlement of all 

safety-related structures and buried equipment. Excessive settlement or collapse of foundations could result 

in failures of structures, interconnecting piping, or control systems, such that the capability to safely shut 

down the plant or mitigate the consequences of an accident could be compromised. This issue, which 

primarily applies to soil sites, involves two specific concerns, namely the (1) potential impact of static 

settlements of foundations and buried equipment where the soil might not have been properly prepared, and 

(2) potential seismically induced settlement and soil liquefaction following a postulated seismic event. The 

potential impact of static settlements of foundations and buried equipment is not believed to pose any 

significant safety concern and is not included in the IPEEE program. 

5.4.7.1.8 Seismic Design of the Structures, Systems, and Components 

The objective of this SEP issue is to review and evaluate the original seismic design of safety-related 

structures, systems, and components, to ensure the capability of the plant to withstand the effects of a safe 

shutdown earthquake (SSE). 

5.4.7.1.9 Shutdown Systems and Electrical Instrumentation and Control Features 

With regard to shutdown systems, this issue addresses the capacity of plants to ensure reliable shutdown 

using safety-grade equipment. The electrical instrumentation and control issue addresses the functional 

capabilities of electrical instrumentation and control features of systems that are required for safe shutdown, 

including support systems. These systems should be designed, fabricated, installed, and tested to quality 

standards and remain functional following external events. 

In the IPEEE, licensees were requested to address USI A-45, "Shutdown Decay Heat Removal (DHR) 

Requirements" (refer to Section 5.4.1 of this report), and to identify potential vulnerabilities associated with 

DHR systems following the occurrence of external events. The verification of USI A-45 addresses this SEP 

issue. 

5.4.7.2 Findings and Related Plant Improvements 

As shown in Table 5.6 of Volume 2 of this report, all of the SEP plants have provided sufficient information 

in their IPEEE submittals to verify all ofthe GSI-1 56 issues. The IPEEE submittals did not explicitly identify 

any plant modifications or improvements related to this generic safety issue. However, some plants made 

modifications related to HFO external events (e.g., for protection from tornado-generated missiles and floods) 

that overlap some of the SEP areas. 

By virtue of the licensees having an acceptable IPEEE with regard to external flooding, the site-specific sub

issues related to site hydrology and ability to withstand floods, severe weather effects on structures (water 

5 - 20

I II
related), and dam integrity and site flooding have been satisfactorily verified. By virtue of the licensees 

having an acceptable IPEEE with regard to seismic events, the sub-issues related to design codes, criteria, 

and load combinations; settlement of foundations and buried equipment; and seismic design of structures, 

systems, and components have been satisfactorily verified. By virtue of the licensee having an acceptable 

IPEEE with regard to HFO events, the site-specific sub-issues related to industrial hazards, tornado-generated 

missiles, and severe weather effects on structures (wind related) have been satisfactorily verified. By virtue 

of the licensee having an acceptable IPEEE with regard to USI A-45, "Shutdown Decay Heat Removal 

Requirements," the sub-issue related to shutdown systems and electrical instrumentation and control 

functions has been satisfactorily verified. 

5.4.7.3 Observations 

Even though the SEP issues were not explicitly identified in Generic Letter 88-20 orNUREG- 1407, the NRC 

has determined that licensees for all of the 31 SEP plants performed an adequate assessment to identify 

vulnerabilities related to the 9 SEP issues discussed above, and these issues are considered verified. 

5.4.8 GSI-172, "Multiple System Response Program" 

5.4.8.1 Issue Description 

GSI-172, "Multiple System Response Program" (MSRP), addresses concerns raised by the Advisory 

Committee on Reactor Safeguards (ACRS) regarding safety issues that might exist and might not be 

addressed by the NRC's existing generic safety issues. Each of the 11 MSRP issues reviewed as part of the 

IPEEE program are discussed in the following sections. 

5.4.8.1.1 Effects of Fire Suppression System Actuation onNon-Safety-Related and Safety-Related Equipment 

Fire suppression system actuation can have an adverse effect on safety-related components either through 

direct contact with suppression agents or through indirect interaction with non-safety-related components. 

This issue is addressed by the verification of GSI-57, which is discussed in Section 5.4.2 of this report. 

5.4.8.1.2 Seismically Induced Fire Suppression System Actuation 

Seismic events can potentially cause multiple fire suppression system actuations which, in turn, may cause 

failures of redundant trains of safety-related systems. Analyses currently required by fire protection 

regulations generally only examine inadvertent actuations of fire suppression systems as a single, independent 

event, whereas a seismic event could cause multiple actuations of fire suppression systems in various areas 

of the plant. This issue is addressed by the verification of GSI-57, which is discussed in Section 5.4.2 of this 

report. 

5.4.8.1.3 Seismically Induced Fires 

Seismically induced fires have the potential to cause multiple failures of safety-related systems. The 

occurrence of a seismic event could create fires in multiple locations, thereby simultaneously degrading fire 

suppression capability and, therefore, preventing mitigation of fire damage to multiple safety-related systems. 

This issue is addressed by the verification of the Fire Risk Scoping Study (FRSS) issue entitled "Seismic-Fire 

Interactions," discussed in Section 5.4.9.1.1 of this report.

5 -21
5.4.8.1.4 Effects of Hydrogen Line Ruptures

Nuclear power plans use hydrogen in electrical generators to reduce windage losses and as a heat transfer 

agent. Hydrogen is also used as a cover gas in some tanks (e.g., volume control tanks). Leaks or breaks in 

hydrogen supply piping could result in the accumulation of a combustible mixture of air and hydrogen in vital 

areas, resulting in a fire and/or explosion that could damage vital safety-related systems in the plants. 

5.4.8.1.5 Non-Safety-Related Control System/Safety-Related Protection System Dependencies 

Multiple failures in non-safety-related control systems may adversely impact safety-related protection 

systems as a result of potential unrecognized dependencies between control and protection systems. The 

concern is that plant-specific implementation of the regulations regarding separation and independence of 

control and protection systems may be inadequate. The licensees' IPE process should provide a framework 

for systematic evaluation of interdependencies between safety-related and non-safety-related systems and 

identify potential sources ofvulnerabilities. The dependencies between safety-related and non-safety-related 

systems resulting from external events (i.e., concerns related to spatial/functional interactions) are addressed 

in GSI- 147 (Section 5.4.5), the fire risk scoping study (Section 5.4.9.1.5), and the MSRP issue on seismically 

induced spatial and functional interactions (Section 5.4.8.1.7 of this report). 

5.4.8.1.6 Effects of Flooding and/or Moisture Intrusion on Non-Safety-Related and Safety-Related Equipment 

Flooding and water intrusion events can affect safety-related equipment either directly or indirectly through flooding or moisture intrusion of multiple trains of non-safety-related equipment. This type of event can 

result from external flooding events, tank and pipe ruptures, actuation of fire suppression systems, or 

backflow through part of the plant drainage system. The IPE process addressed the concerns of moisture 

intrusion and internal flooding (i.e., tank and pipe ruptures or backflow through part of the plant drainage system). The IPEEE program addressed the external flooding-related aspects of this issue (discussed in 

Section 4.3 of this report) and the potential effects of actuation of the fire suppression system on safety

related equipment (see Section 5.4.2). 

5.4.8.1.7 Seismically Induced Spatial/Functional Interactions 

Seismic events have the potential to cause multiple failures of safety-related systems through spatial and 

functional interactions. Some particular sources of concern include ruptures in small piping that may disable 

essential plant shutdown systems; direct impact of non-seismically qualified structures, systems, and 

components that may cause small piping failures; seismic functional interactions of control and safety-related protection systems via multiple non-safety-related control system failures; and indirect impacts, such as dust 

generation, that disable essential plant shutdown systems. 

5.4.8.1.8 Seismically Induced Flooding 

Seismically induced flooding events can potentially cause multiple failures of safety-related systems. The 

rupture of small piping could provide flood sources that could potentially affect multiple safety-related 

components simultaneously. Similarly, non-seismically qualified tanks are a potential flood source of 

concern. 

5 - 22

I I
5.4.8.1.9 Seismically Induced Relay Chatter

Essential relays must operate during and after an earthquake, and must meet one of the following conditions: 

* remain functional (i.e., without occurrence of contact chattering), 

* be seismically qualified, or 

* be chatter acceptable. 

It is possible that contact chatter of relays not required to operate during seismic events may produce some 

unanalyzed faulting mode that may affect the operability of equipment required to mitigate the event. These 

would be defined as "low-ruggedness" or "bad actor" relays. 

5.4.8.1.10 IPEEE-Related Aspects of Common Cause Failures Related to Human Errors 

Common cause failures resulting from human errors include operator acts of commission or omission that 

could be initiating events or could affect redundant safety-related trains needed to mitigate the events. Other 

human errors that could initiate common cause failures include manufacturing errors in components that 

affect redundant trains, and installation, maintenance, or testing errors that are repeated on redundant trains. 

In the IPEEE, licensees were requested to address only the human errors involving operator recovery actions 

following the occurrence of external events. 

5.4.8.1.11 Evaluation of Earthquake Magnitudes Greater Than Safe Shutdown Earthquake 

This issue was identified to address concerns that adequate margin may not have been included in the design 

of some safety-related equipment. As part of the IPEEE, all licensees were expected to identify potential 

seismic vulnerabilities or assess the seismic capacities of their plants by performing either a seismic PRA or 

a seismic margins assessment (SMA). The licensees' evaluation for potential vulnerabilities (or unusually 

low plant seismic capacity) to seismic events addresses this issue. 

5.4.8.2 Findings and Related Plant Improvements 

Of the 69 submittals, 56 provided sufficient information to adequately verify all 11 MSRP sub-issues. The 

remaining 13 IPEEE submittals did not provide adequate information to verify one or more of these MSRP 

issues. Of those 13 submittals, 5 contained information to only partially verify one or more of these issues. 

Table 5.4 identifies which portion(s) remain(s) unverified for these five plants. Figure 5.1 shows the 

distribution of unverified or partially unverified sub-issues by plant. As this figure shows, most plants (56) 

have verified all of the GSI- 172 issues. This figure also shows that only one plant (LaSalle) did not provide 

adequate information to verify 7 of the 11 issues, and one plant (St. Lucie) had 5 issues that remain 

unverified. Figure 5.2 shows the distribution of unverified or partially unverified sub-issues by sub-issue. 

As this figure shows, the most frequent unverified issue deals with human error-induced common cause 

failures related to external event initiators (approximately 10% of the plants). The next two most frequent 

unverified issues relate to evaluation of seismically induced flooding and potential hydrogen line ruptures 

(each approximately 7% of the plants). 

None of the submittals explicitly identified that any plant modifications or improvements were directly related 

to the MSRP issues. However, improvements made in conjunction with other external events (e.g., flooding) 

would also produce a benefit relative to the MSRP issues.

5 - 23
Table 5.4: Partially verified GSI-172 sub-issues by plant

Seismically induced fires for SSEL 

electrical cabinets

Hydrogen tank ruptures 

Safety/non-safety system interactions

Seismically induced fires for non-SSEL 

electrical cabinets

Hydrogen line ruptures -t

Hot shorts

Effects of moisture intrusion on LaS alle Effects of flooding on equipment equipment 

Flooding from all external sources Seismically induced internal flooding 

Limerick 1 & 2 Common cause human factors related to Common cause human factors related to 

fire events seismic events 

Common cause human factors related to Common cause human factors related to 

fire events seismic events 

Seismically induced fires from Seismically induced fires from electrical 

Seabrook equipment interactions cabinet interactions 

Hydrogen tank ruptures Hydrogen line ruptures

60 --

F-1

r1 F1

0 1 2 3 4 5 6 7 8 

Number of Unverified MSRP Sub-Issues by Plant

[1

9 10 11

Figure 5.1 Number of unverified GSI-172 issues by plant 

5 - 24

I II

Hatch 1 & 2

50

P 40 

~4-4 o 30

920 z 

10

0- Foi ýL.. Foi - Fil Fol Fol no
10

8

"6

4

S2 - 2

0

Seismic Activation Hydrogen Ruptures Flood & Moisture Seismic Flooding Common Cause 

Effects of Activation Seismic Fires System Dependencies Spatial Interactions Relay Chatter Beyond SSE 

MSRP Sub-Issues 

Figure 5.2 Number of unverified GSI-172 issues by issue 

5.4.8.2.1 Effects of Fire Suppression System Actuation on Non-Safety-Related and Safety-Related Equipment 

All of the IPEEE submittals reported that the licensee had qualitatively examined issues related to inadvertent 

fire suppression system actuation. To varying degrees, such examinations included the potential for, and 

effects of, inadvertent fire suppression systems actuation. 

In most of the submittals, licensees included considerations related to inadvertent fire suppression system 

actuation within the scope of their overall seismic walkdown. The most consistent strong points of these 

evaluations appear to be the treatment of inadvertent fire suppression systems actuation and the identification 

of concerns regarding potential interaction with safety equipment. However, the level of effort, scope, and 

detail varied significantly among the IPEEE submittals. Two submittals (LaSalle and St. Lucie) did not 

include any evaluation. In most other cases, licensees limited their evaluations exclusively to assessing direct 

impacts on safe shutdown equipment or safety-related equipment. 

Many of the submittals did not consider the potential effects of inadvertent fire suppression system actuation 

on non-safety-related equipment. Most considered non-safety-related equipment to be unnecessary for safe 

shutdown, or stated that the equipment and floor drains would be adequate to prevent unacceptable internal 

flooding. See Section 5.4.2 on GSI-57, "Effects of Fire Protection System Actuation on Safety-Related 

Equipment," for additional discussion related to this issue.

5-25
5.4.8.2.2 Seismically Induced Fire Suppression System Actuation

All of the IPEEE submittals reported that the licensees qualitatively examined issues related to seismically 

induced fire suppression system actuation. To varying degrees, such examinations included the potential and 

effects of seismically initiated actuation and degradation of fire suppression systems. 

In most of the submittals, licensees included considerations related to seismically induced fire suppression 

system actuation within the scope of their overall seismic walkdown. The most consistent strong point of 

these evaluations appears to be the treatment of inadvertent actuation of the fire suppression system. However, the level of effort, scope, and detail directed toward addressing issues related to seismically induced fire suppression system actuation varied significantly among the IPEEE submittals. Three submittals 

(North Anna, St. Lucie, and Turkey Point) did not include any evaluation. In most other cases, licensees 

limited their evaluations exclusively to assessing direct impacts on safe shutdown equipment. 

Many of the submittals did not include a consideration of the potential for seismically induced loss of fire 

suppression systems. In the remaining cases, some licensees sought to include all relevant plant areas and 

equipment in their evaluations. Such relevant items include, for instance, fire suppression system 

components and non-safety-related piping and tanks, which may not be part of the seismic plant model or 

safe-shutdown equipment list, but may nonetheless be important or may have indirect effects on safety

related equipment. 

In a number of the IPEEE submittals, the evaluation of seismically induced fire suppression system actuation 

resulted in plant improvements. Some of the relevant improvements included strengthening component 

anchorages, replacing vulnerable (e.g., mercury) relays and switches, and implementing procedures to 

properly secure transient fire-protection equipment. 

For additional information, refer to the discussion on GSI-57, "Effects of Fire Protection System Actuation 

on Safety-Related Equipment," in Section 5.4.2. 

5.4.8.2.3 Seismically Induced Fires 

All of the IPEEE submittals reported that the licensees qualitatively examined seismically induced fire 

interaction issues as part of the treatment of Sandia fire risk scoping study issues. A few licensees performed 

a PRA study for seismically induced fire-initiating events; albeit the level of detail varied from a simplistic 

probabilistic analysis to inclusion in their plant's seismic or fire PRA. 

In most of the submittals, licensees included seismically induced fire considerations within the scope of their 

overall seismic walkdown. The level of effort, scope, and detail directed toward addressing seismically 

induced fire issues varied significantly among the IPEEE submittals. One licensee (LaSalle) did not discuss 

seismically induced fire evaluations in their IPEEE submittal. In most other cases, licensees limited their 

seismically induced fire evaluations exclusively to assessing direct impacts on safe shutdown equipment. 

Some licensees sought to include all relevant plant areas and equipment in their evaluations of the potential 

and effects of seismically induced fire events. Such relevant items include, for example, non-safety-related 

piping and tanks containing flammable materials, which may not be part of the seismic plant model or safe 

shutdown equipment list, but may have indirect effects on safety-related equipment. 

5 - 26

I II
In some of the IPEEE submittals, the evaluations of the seismically induced fire interaction resulted in plant 

improvements. An example of the relevant improvements is the installation of restraints for gas cylinders. 

5.4.8.2.4 Effects of Hydrogen Line Ruptures 

All but 5 of the 69 submittals provided sufficient information to verify this MSRP issue. Of these five 

submittals, two (Hatch and Seabrook) addressed the potential effects of hydrogen tank ruptures, but did not 

discuss the potential for hydrogen line ruptures. The other three submittals did not specifically discuss the 

potential failure of hydrogen lines or tanks. The other licensees considered the potential effects of ruptures 

of hydrogen lines and tanks. These licensees found that the potential rupture of either hydrogen lines or tanks 

did not significantly contribute to the core damage frequency and, thus, this aspect was considered verified. 

Licensees typically addressed this issue by performing plant walkdowns following EPRI's FIVE 

methodology. FIVE calls for licensees to "identify any flammable liquid or gas storage vessel or piping 

(e.g., hydrogen) and whether these vessels are subject to leakage under seismic conditions." 

5.4.8.2.5 Non-Safety-Related Control System/Safety-Related Protection System Dependencies 

The dependencies between non-safety-related control systems and safety-related protection systems resulting 

from external events are related to GSI-147, "Fire-Induced Alternate Shutdown/Control Room Panel 

Interactions," and the MSRP issue on seismically induced spatial and functional interactions. Generally, 

licensees took the position that since safe shutdown could be achieved either from the main control room or 

the alternate shutdown panel(s) using only safety-related equipment, any failure or failures of non-safety

related equipment would not inhibit achieving safe shutdown conditions. All but four submittals provided 

sufficient information to verify this issue. Licensees provided different levels of detail. Of the four 

submittals that did not provide adequate information to verify this issue, three did not provide any discussion 

related to this issue, and one did not address the hot short aspect of this issue. See Sections 5.4.5 and 

5.4.8.2.7 for additional discussion related to this issue. 

5.4.8.2.6 Effects ofFlooding and/or Moisture Intrusion on Non-Safety-Related and Safety-Related Equipment 

Frequently, the discussion of this issue in the IPEEE submittals related to the ability to adequately protect 

safety-related equipment from external flooding. External flooding is covered by the licensees' HFO 

analyses (see Section 4.3). A satisfactory HFO evaluation verifies the flooding aspect of this issue. 

The other aspect of this issue relates to moisture intrusion into equipment. All but three submittals provided 

adequate information for the staff to conclude that this aspect of this issue was verified. Generally, this 

information related to the licensees having adequately addressed the potential effects of seismically induced 

failure or actuation of the fire protection system and the potential effects of misdirected spray from manual 

fire-fighting activities, since these are the two main sources of water for potential moisture intrusion into 

equipment. See Section 5.4.2 for additional discussion. 

5.4.8.2.7 Seismically Induced Spatial-Functional Interactions 

All but two of the IPEEE submittals provided sufficient information on the licensees' examinations related 

to seismic spatial-functional interaction issues. In most of the submittals, licensees considered seismic 

spatial-functional interaction within the scope of their overall seismic walkdown (see Chapter 2). However, 

the level of effort, scope, and detail directed toward addressing seismic spatial-functional interaction issues

5 - 27
varied significantly among the IPEEE submittals. In most cases, licensees limited their evaluations of seismic 

spatial-functional interactions exclusively to assessing the direct impacts on safe shutdown equipment. 

In some of the IPEEE submittals, the evaluations of seismic spatial-functional evaluations resulted in plant 

improvements. Some of the relevant improvements included strengthening component anchorages, anchoring 

cabinets together, and implementing procedures to properly secure transient fire-protection equipment. In 

one instance, the licensee evaluated the potential for seismically induced toxic chemical release as part of its 

seismic interactions walkdown. As a result, the licensee identified a plant-specific improvement related to 

strengthening the anchorage of an ammonia storage tank. 

5.4.8.2.8 Seismically Induced Flooding 

Some licensees undertook quantitative assessments of components' seismic capacities related to seismically 

induced flooding interactions. A few licensees performed a PRA study for seismically induced flooding 

events, albeit the level of detail varied from simplistic probabilistic analysis to inclusion in their plant's 

seismic PRA. 

In most of the submittals, licensees included seismically induced flooding considerations within the scope 

of their overall seismic walkdown. However, the level of effort, scope, and detail directed toward addressing 

seismically induced flooding issues varied significantly among the IPEEE submittals. All but six of the 

licensees provided adequate information to verify this issue. Of the remaining six submittals, five did not 

provide any discussion of evaluations related to seismically induced flooding in their IPEEE submittal, and 

one licensee did not provide adequate information to completely verify this issue. In most other cases, 

licensees limited their seismically induced flooding evaluations exclusively to assessing direct impacts on 

safe shutdown equipment. 

Some licensees sought to include all relevant plant areas and equipment in their evaluations of the potential 

for and effects of seismically induced flooding events. Such relevant items include, for example, non-safety

related piping and tanks that may not be part of the seismic plant model or safe-shutdown equipment list, but 

may nonetheless be important or may have indirect effects on safety equipment. 

In some of the IPEEE submittals, the evaluations of seismically induced flood interaction resulted in plant 

improvements. Some of the relevant improvements include adding seals to waterproof electrical cabinets and 

implementing enhanced drain inspection procedures. Evaluations of external flooding (see Chapter 4) also 

addressed this sub-issue. 

5.4.8.2.9 Seismically Induced Relay Chatter 

All of the submittals provided adequate information to verify this issue. In a few plants, low-ruggedness 

relays have been encountered in the circuits involving only IPEEE success paths (i.e., IPEEE equipment that 

was not redundant to USI A-46). Of the 27 licensees that performed a seismic PRA (SPRA) as part of their 

IPEEE, 14 included relays in the PRA models. Others performed separate evaluations to determine the 

ruggedness of relays. When relays are explicitly modeled in the PRA, the effect of low-ruggedness relay 

chatter on accident sequences is clearly identified and quantified. Most of SPRAs did not credit recovery 

actions in their logic model. 

5 -28

I II
When licensees encountered low-ruggedness relays, they often existed only in alarm circuitry, were assessed 

as having negligible consequences, orthe licensees assumed that operator actions would provide for effective 

reset. In only limited instances, licensees actually proposed replacing relays specifically on the basis of the 

analysis for the IPEEE. For additional information, see Section 2.3.1.4. 

5.4.8.2.10 IPEEE-Related Aspects of Common Cause Failures Related to Human Errors 

All of the 69 IPEEE submittals (which excludes Haddam Neck) provided some treatment or discussion of 

non-seismic failures and human actions. Of the 69 submittals, 61 provided adequate information to verify 

this issue, 2 provided adequate information to partially verify this issue, and 6 did not provide adequate 

information to verify this issue. 

For seismic PRAs, operator actions were introduced in seismic event-tree and fault-tree models, which 

generally reflect the logic used in the plant's internal events PRA. However, the seismic impacts on operator 

error rates were modeled in a highly variable fashion. In some instances, licensees developed simplified 

operator error fragilities. In other instances, licensees applied judgemental scaling factors (in relation to the 

importance of the human action) on internal event error rates, or other means to account for seismically 

related performance shaping factors. 

With regard to the treatment of human actions in IPEEEs that used a seismic margin assessment (SMA), the 

staff s reviews found that the submittals typically provided only limited discussion of the impact of seismic 

events on operator error rates. Generally, the SMA IPEEE submittals took the approach of relying on those 

success paths that are most familiar to plant operators and that use the most reliable equipment. In one SMA, 

the licensee applied quantitative screening criteria with respect to random failure rates and human error rates. 

Licensees have generally reported the timing and locations of required human actions, and have commented 

qualitatively on their reliability. 

The approaches varied for quantification of the post-accident human actions retained from the IPEs. A few 

licensees used the existing IPE HEPs without making any adjustments to reflect the potential impact of fire 

conditions. These submittals did not address the potential that at least one operator may not be available as 

the result of fire brigade responsibilities, the fire may result in spurious signals and alarms that would provide 

confusing information to the operator, or the fire and the presence of even small amounts of smoke might 

have negative psychological effects on some operators and other plant staff who are needed to respond to the 

event. Regardless of their approach, few submittals considered these factors in determining HEPs. 

Some licensees simply applied a performance shaping factor (PSF) of, for example 5 or 10, as a multiplier 

on all the existing IPE HEPs to reflect potential influences (e.g., increased stress) that a fire might create for 

the operators. Some licensees examined each human action and used expert judgement to decide whether 

a multiplier (or a simple increase in the value) should be applied to reflect fire conditions. Others assigned 

"conservative" screening values (generally around 0.1, but ranging to 1.0 for events that might be directly 

influenced by the fire) with the idea of doing a more detailed evaluation, if needed. Finally, some licensees 

re-evaluated all of the existing HEPs and re-quantified them to more precisely model the potential effects of 

the fire on human performance. 

The licensees' submittals considerated human action failure events. In many cases, licensees identified the 

human actions that were most important to CDF (or CDF reduction), and considered the potential impact of 

fire effects on those reliability estimates. For more discussion, see Section 3.4.8.

5 - 29
5.4.8.2.11 Evaluation of Earthquake Magnitudes Greater than Safe Shutdown Earthquake 

This issue is verified by licensees providing an acceptable seismic IPEEE. The specific seismic review-level 

earthquake varies, depending on the plants' location and the IPEEE review level identified in NUREG- 1407 

(see Chapter 2 for details of the seismic submittals). All submittals provided adequate information to verify 

this issue. 

5.4.8.3 Observations 

Even though these MSRP issues were not explicitly identified in either Generic Letter 88-20 or NUREG

1407, a large majority of the licensees (approximately 80%) provided sufficient information in their IPEEE 

submittals to verify all 11 MSRP sub-issues. Only one plant (LaSalle) had seven unverified MSRP issues. 

Table 5.7 of Volume 2 of this report identifies the verification of each FRSS issue by plant. 

5.4.9 Sandia Fire Risk Scoping Study Issues 

5.4.9.1 Issue Description 

Section 4.2 of NUREG-1407 includes the following statement: 

The use of an existing fire PRA for the internal fires IPEEE is acceptable, provided the PRA 

reflects the current as-built and as-operated status of the plant and the licensee addresses the 

deficiencies of past PRAs that are identified in the Fire Risk Scoping Study (NUREG/CR

5088). 

EPRI's FIVE methodology, which the NRC staff concluded was acceptable for use in the fire IPEEE, 

provides guidance for licensees to use in addressing the Sandia FRSS issues. The following sections discuss 

each of the five FRSS issues that were to be addressed as part of the IPEEE. As noted below, several of these 

FRSS issues are closely related, or identical, to other generic issues discussed in this chapter. 

5.4.9.1.1 Seismic-Fire Interactions 

The issue of seismic-fire interactions primarily involves three concerns. First is the potential that seismic 

events might result in fires internal to the plant. Such threats might be realized as a result of inadequately 

secured liquid fuel or oil tanks, breakage of fuel lines, or rocking of unanchored electrical panels (either 

safety- or non-safety-grade). The second concern is the potential that seismic events might render fixed fire 

suppression systems inoperable. This could include detection systems, fixed suppression systems, and fixed 

manual fire-fighting support elements, such as the plant's fire protection system's water distribution system. 

The third concern is that a seismic event might spuriously activate fixed fire detection and suppression 

systems. The spurious operation of detectors might both complicate operator response to the seismic event 

or cause the actuation of automatic fire suppression systems. Actuation of a suppression system may lead 

to flooding problems, habitability concerns (in the case ofCO2 systems), diversion of suppressants to non-fire 

areas (rendering them unavailable in the event of a fire elsewhere in the plant), the potential for over-dumping 

of gaseous suppressants (resulting in over pressurization of a compartment), and spraying of important plant 

components. 

5 -30

I 11
5.4.9.1.2 Adequacy of Fire Barriers

The common reliance on fire barriers to separate redundant components needed to achieve safe shutdown 

has elevated the risk sensitivity of fire barrier performance. Degraded fire barrier penetration seals and 

unsealed penetrations in some barriers can contribute to this source of fire risk. Barrier reliability and inter

compartment fire effects relate to the potential that fires in one area might impact other adjacent or connected 

areas through the spread of heat and smoke. In general, a licensee's fire IPEEE analysis should address this 

concern by considering the following factors: 

manual fire-fighting activities might allow the spread of smoke and heat through the opening of 

access doors, and 

failure of active fire barrier elements, such as normally open doors, water curtains, and ventilation 

dampers, would compromise barrier integrity. 

5.4.9.1.3 Smoke Control and Manual Fire-Fighting Effectiveness 

Sensitivity studies have shown that prolonged fire-fighting times can lead to a noticeable increase in fire risk. 

Smoke, identified as one of the major contributors to prolonged response times, can also cause misdirected 

suppression efforts and hamper the operator's ability to safely shut down the plant. This issue evolved as 

GSI-148, which is discussed in Section 5.4.6 of this report. 

5.4.9.1.4 Equipment Survival in a Fire-Induced Environment 

The FRSS investigated the potential susceptibility of equipment damage to indirect or secondary fire 

involvement through the environment created by fires, fire suppression, and the spurious operation of fire 

suppression systems. The FRSS found that past spurious actuation of suppression systems had a range of 

effects, including induced plant scrams. Several events were identified in which significant degradation of 

plant operability resulted. This issue is assessed as part of GSI-57, "Effects of Fire Protection System 

Actuation on Safety Related Equipment," which is discussed in Section 5.4.2 of this report. 

5.4.9.1.5 Fire-Induced Alternate Shutdown/Control Room Panel Interactions 

Control system interactions involving a combination of fire-induced failures and spurious actuation, and high

probability random equipment failures, were identified as potential contributions to fire risk. Sensitivity 

studies were performed which indicated that these interactions could have a significant impact on the fire core 

damage frequency. This issue was later classified as GSI-147, which is discussed in Section 5.4.5 of this 

report. 

5.4.9.2 Findings and Related Plant Modifications 

Of the 69 submittals, 16 did not provide adequate information to verify one or more of the sub-issues in the 

FRSS. Twenty-seven licensees used the FIVE methodology in addressing the FRSS issues. Figure 5.3 shows 

the distribution of unverified or partially unverified FRSS issues by issue, while Figure 5.4 shows the 

distribution of unverified or partially unverified issues by plant. Figure 5.3 shows that the most common 

unverified FRSS issue (14 plants) is related to smoke control and manual fire-fighting effectiveness. This 

is not surprising, for as with GSI- 148, if a licensee did not take credit for manual fire-fighting actions in their

5-31
IPEEE fire analysis, there might not be sufficient information to verify this FRSS issue. For additional 

discussion directly related to this issue, see Section 5.4.6.

16 

N 14 

i12 

10 

8 

S2

Ir

-F

F21

Seismic/Fire Interactions Fire Barriers Smoke Effects Equipment Survival 

Fire Risk Scoping Study Issues

AS/CR Interactions

Figure 5.3 Number of unverified FRSS issues by issue

60

50

40

o 30 

920-

10-

0 1 2 3 4 

Number of Unverified Fire Risk Scoping Study Issues

5

Figure 5.4 Number of unverified FRSS issues by plant 

Figure 5.4 shows that two licensees each had four unverified FRSS issues. Table 5.8 of Volume 2 of this 

report shows that one of these two plants (LaSalle) did not provide information to explicitly address these 

four issues, and the other plant (Hatch) provided information to partially verify each of the four issues. 

Except for these two licensees, almost all of the FRSS issues (excluding smoke effects) were verified for 

most of the plants. 

5 - 32

I II

U

21 L. MMIM Fol

!i

O0 1
Table 5.8 of Volume 2 of this report identifies the verification of each FRSS issue by plant. This table also 

provides comments on plant-unique or interesting characteristics related to these issues and why these issues 

were partially or not fully verified. 

Only one plant (Surry) explicitly identified any plant modifications that directly related to the FRSS issues. 

In this case, the licensee modified some electric circuits to ensure that the diesel generators and the alternate 

shutdown panel could be isolated from the control room and to reduce the likelihood of spurious power 

operated relief valve actuations. Although other plants did not explicitly identify plant enhancements related 

to the FRSS issues, plant modifications identified for other issues could also be an improvement for one or 

more of the FRSS issues (e.g., securing bottle gas tanks related to seismic-fire interactions). 

5.4.9.2.1 Seismic-Fire Interactions 

All but 3 of the 69 submittals provided adequate information to verify this FRSS issue. Licensees frequently 

assessed the potential seismic-fire interactions as part of their seismic and fire walkdowns. The potential for 

seismic events to initiate a fire related to the potential for an earthquake to result in a rupture of combustible 

gas lines, cylinders, or tanks. The most frequent plant enhancement related to this issue was to ensure that 

the existing procedures for securing the cylinders were followed. Combustible fluids are generally not stored 

or used near safety-related equipment. Generally, the tanks are outside, and the primary use of hydrogen is 

in the turbine building for generator cooling. Acetylene is stored in areas with no safety-related equipment. 

The licensees also considered the potential for seismically induced failure of the fire protection system. This 

included evaluating potential failures that could adversely affect safety-related structures, systems, or 

components. Generally, the licensees identified the fire protection system piping to be designed to the 

seismic Category II/I criteria, or identified similar standards if they did not explicitly refer to the I1/I criteria. 

The 11/I criteria states that any seismic Category II (i.e., non-seismic Category I) structure, system, or 

component that is installed over a seismic Category I structure, system, or component will not fail in such 

a manner as to adversely affect the seismic Category I structure, system, or component; however, the seismic 

Category II structure, system, or component may no longer be functional. Some licensees identified that 

although the fire protection system was not designed as seismic Category I, a review of the system indicated 

that it would likely remain functional after an earthquake (e.g., some hangers might fail, but the piping would 

remain essentially intact). 

Licensees generally used one of three methods to address the potential for seismic activity to actuate the fire 

protection system. First, most water systems are of the dry pipe design (i.e., a valve needs to open to flood 

the spray lines, and the fusible link in the sprinkler heat needs to melt before water is discharged from the 

system). Having both of these events occur solely as a result of a seismic event was deemed to be unlikely. 

A second type is the wet pipe fire protection system design. This design is similar to the dry pipe design 

except that water is maintained at the sprinkler head. In this case, the fusible link prevents discharge. This 

fusible link is not susceptible to failure from dust that might be stirred up as a result of a seismic event. 

Finally, there are gas suppression systems that use Halon or CO2 as the fire suppressant. Inadvertent 

activation of these systems would not aversely affect the equipment in an area that was not already damaged 

by a fire (e.g., in the cable spreading or switchgear rooms). These gas suppressant systems are for limited 

areas and are independent of the water suppressant systems used elsewhere in the plant. 

5 -33
5.4.9.2.2 Adequacy of Fire Barriers

All but 3 of the 69 submittals provided adequate information to verify this FRSS issue. Licensees typically 

addressed barrier integrity in their submittals by discussing the plant's inspection, surveillance, and 

maintenance program that was used to verify the integrity of penetration seals (including door and hatch 

seals) and doors. The percentage of the seals that were inspected, as well as the interval of inspection, varied 

considerably from plant to plant. The inspections ranged from a small percentage of the accessible seals per 

calendar quarter to a larger percentage every 18 months (refueling outage). Licensees also cited inspection 

procedures ensure that fire doors remain closed. Welding activities could necessitate having doors open or 

partially open for hoses or cables to pass through, thereby breaching a fire barrier. Therefore, fire watches 

were commonly identified as the means to prevent welding activities from starting fires and to quickly 

suppress fires that might occur. 

Given the licensees' programs for barrier integrity, the submittals typically assumed that the fire barriers 

would perform their intended function, as designed. A few licensees considered the potential consequences 

if a fire were to breach a fire barrier and adversely affect equipment in the adjacent fire area. Licensees 

usually addressed these consequences by considering the fire barrier to be ineffective with some small 

probability. Generally, the licensees found that, in these cases, the multi-zone fire scenarios were not a 

significant contributor to the plant's fire CDF. 

Those licensees that took credit for or provided information related to manual fire-fighting activities usually 

included some discussion of the effects of smoke. Generally, the submittals indicated that the large volume 

of the adjacent fire area would dilute any smoke and heat that entered through a door opened for manual fire

fighting purposes. The licensees concluded that the results of such a fire barrier breach would not inhibit fire

fighting activities. 

5.4.9.2.3 Smoke Control and Manual Fire-Fighting Effectiveness 

Of the 69 submittals, 14 did not provide sufficient information to verify this FRSS issue. Most submittals 

included some discussion of the fire brigade training. Some train under live smoke conditions, while one 

licensee (Grand Gulf) also simulates the actual plant configuration and changes the configuration for each 

fire drill. Since this FRSS issue is the same as GSI-148, "Smoke Control and Manual Fire-Fighting 

Effectiveness," see Section 5.4.6 of this report for more discussion concerning this issue. 

5.4.9.2.4 Equipment Survival in a Fire-Induced Environment 

All but 4 of the 69 submittals provided adequate information to verify this FRSS issue. Many licensees 

identified that some, or all, of their water-based fire protection systems to require two diverse actions for 

initiation (pre-action type). One action would be for a smoke detector to open a supply valve in the fire 

protection system, while the second action is the fire's heat to melt the fusible link in the sprinkler head. For 

this type of system, the licensees concluded that inadvertent activation of the fire protection system by a 

seismic event or dust was not a problem. 

Licensees also reviewed the impact of CO2 or Halon protective system actuation as it relates to the potential 

effects on personnel (e.g., control room operators) and equipment (e.g., operation of the diesel generators) 

in the area. Licensees usually dismissed potential problems from these systems as insignificant to safety or 

5 - 34

I II
beyond the scope of this generic issue. Data on the effects of smoke and fire suppressants on equipment is 

limited and beyond the scope of the IPEEE program. 

Some licensees discussed the potential for the effects of fire to adversely affect equipment that is not directly 

involved with the fire. This includes potential effects of corrosion, buildup of soot, or other combustion 

products. Those that did discuss this aspect stated that potential damage would occur over a much longer 

period than required to establish cold shutdown. Corrective maintenance would resolve any long-term 

problem that might be caused by these mechanisms. The remaining submittals did not discuss the impact of 

combustion products on equipment operability. 

5.4.9.2.5 Fire-Induced Alternate Shutdown/Control Room Panel Interactions 

All but 2 of the 69 submittals provided adequate information to verify this FRSS issue. Generally, the 

submittals identified that the plants have the ability to transfer adequate control from the control room to 

alternate locations to achieve plant safe shutdown conditions (i.e., the alternate location is electrically 

independent of the control room); control would be regained after being transferred from the control room 

to the alternate shutdown locations; the review considered spurious actuation of components; and the 

potential loss of power to equipment was addressed by feeding the alternate shutdown equipment through 

a separate, independent breaker or fuse. Since this FRSS issue is the same as GSI-147, "Fire-Induced 

Alternate Shutdown/Control Room Panel Interactions," see Section 5.4.5 of this report for more discussion 

concerning this issue. 

5.5 Summary and Conclusions 

This chapter discusses a total of 31 IPEEE-related unresolved safety issues and generic safety issues, 

including USI A-45, GSI-57, GSI- 103, GSI- 131, GSI- 147, GSI- 148, GSI- 156 (9 SEP issues), GSI- 172 (11 

MSRP issues), and five FRSS issues. Nine of these issues were explicitly discussed in Supplement 4 to 

Generic Letter 88-20 and NUREG-1407 (USI A-45, GSI-57, GSI-103, GSI-131, and the five FRSS issues). 

The other 22 issues were not explicitly discussed in the Generic Letter 88-20 or NUREG-1407. However, 

the NRC believes that the plant-specific analyses that were requested in the scope of the IPEEE program 

could also be used, through a satisfactory IPEEE submittal review, to evaluate and verify the external event 

aspects of these generic issues. Section 5.4 of this report discusses each of these issues, the related findings, 

and plant modifications. Detailed plant-specific tables concerning these USIs and GSIs are provided in 

Section 5 of Volume 2 of this report. 

One of the major achievements of the IPEEE program was the verification of a large majority of these generic 

issues. As shown in Table 5.2, most of the plants verified a large majority of these issues. Figure 5.5 

graphically illustrates these results. Of the 69 submittals, 44 provided sufficient information to verify all 31 

USIs and GSIs. The remaining 25 submittals had one or more generic issue(s) unverified or only partially 

verified6 . USI A-45, GSI-131, and GSI-156 (9 SEP issues) were fully verified for all plants. Of the other 

6 If a licensee's submittal did not address a generic issue, but did not overlook a potential 

vulnerability, the NRC's Staff Evaluation Report for that plant identified te omission as a weakness in the 

submittal. In such cases, the submittal still meets the intent of the IPEEE program, but the GSI may not 

be "verified" for that plant. For those issues that have not been completely verified, the NRC staff will 

determine if any additional actions or assessments are needed to verify these GSIs. This follow-up will

5 -35
.7','

+ ++.I. + + + + + 41Urov +ssues and Geei Saet 

Veo-fed IsuesI* Unverfied ssue 

+ + - -0 +'. - 50-- +1'1 B-0 - + 4 

+O- +'4- +-++ 

Figure 5.5 Number of unverified or partially verified generic issues by plant 

generic issues, GSI-57, GSI-103, and GSI-147 were verified for approximately 95% of the plants. GSI-172 

and the FRSS issues were verified for almost 80% of the plants.7 Even the issue that was most commonly 

unverified, GSI-148, was still verified for 70% of the plants. Not surprisingly, those issues that were 

explicitly identified in Supplement 4 to Generic Letter 8 8-20 or NUREG- 1407 had a higher percentage of 

verification than those that were not explicitly identified. Nevertheless, even those issues that were not 

identified were verified for most of the plants. One submittal (LaSalle) did not provide any information to 

verify generic issues. Those sub-issues that could be verified relied on information that could be deduced 

from an old PRA. 

With regard to GSI- 148, a number of licensees did not take credit for manual fire-fighting actions in their 

IPEEE fire analyses. Although this assumption is conservative from a PRA standpoint (i.e., could lead to a 

higher estimated fire CDF), the submittals for these cases did not consider the potential damaging effects of 

misdirected suppression on adjacent safety-related equipment. Therefore, this generic issue was not 

considered verified for those plants. One of the FRSS issues, "Smoke Control and Manual Fire-Fighting 

Effectiveness," is essentially the same as GSI-148. As shown in Figure 5.3, the most commonly unverified 

FRSS issue by far was the issue of smoke effects. Therefore, if a submittal did not provide adequate 

information to verify GSI- 148, that submittal also lacked adequate information to verify one of the FRSS 

issues. This contributed to the FRSS issues being only partially verified for a number of plants. 

be done separately from the IPEEE program. 

7 GSI-172 (MSRP) and the FRSS issues actually comprised 11 and 5 separate issues, 

respectively. All plants verified at least some of these MSRP and FRSS issues. If one or more individual 

MSRP or FRSS issue(s) were not verified for a plant, Table 5.2 identifies the issue as "partially verified" 

for that plant. Figure 5.5 graphically reflects the same information as Table 5.2. 

5 - 36

I II
6. REFERENCES

ANSI/IEEE, "IEEE Standard for Type Test of Class lE Electrical Cables, Field Splices, and Connections 

for Nuclear Power Generating Station," ANSI/IEEE Std. 383-1974. 

EPRI, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," NP-6041, 

October 1988. 

EPRI, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin," NP-6041-SL, Revision 

1, August 1991. 

EPRI, "Probabilistic Seismic Hazard Evaluation at Nuclear Plant Sites in the Central and Eastern United 

States: Resolution of the Charleston Earthquake Issue," EPRI NP-6395-D, April 1989. 

EPRI, "COMPBRN IIIE: An Interactive Computer Code for Fire Risk Analysis," EPRI NP-7282, 

May 1991. 

EPRI, "Fire-Induced Vulnerability Evaluation (FIVE)," TR- 100370, April 1992. 

EPRI, "Fire Events Database for U.S. Nuclear Power Plants," NSAC-178L, January 1993. 

EPRI, "Methodology for Developing Seismic Fragilities," TR-103959, June 1994. 

EPRI, "Fire PRA Implementation Guide," TR-105928, December 1995. 

EPRI, "Guidance for Development of Response to Generic Request for Additional Information on Fire 

Individual Plant Examination of External Events (IPEEE)," EPRI Project No. 689, Final Report, 

May 1999 (provided to the U.S. NRC under cover from D.J. Modeen, May 24, 1999). 

Kazarians, M., N.O. Siu, and G. Apostolakis, "Risk Analysis for Nuclear Power Plants: Methodological 

Developments and Applications," Risk Analysis, Vol. 5, No. 1, March 1985. 

Kazarians, M., S.P. Nowlen, and F. Wyant, "Risk Insights Gained from Fire Incidents," Draft Report, 

U.S. NRC, September 2000 (available through the U.S. NRC Public Document Room). 

Klamerus, L.J., "A Preliminary Report on Fire Protection Research Program (July 6, 1977)," 

SAND77-1424, SNL, October 1977. 

Lysmer, J., et al., "FLUSH - A Computer Program for Approximate 3-D Analysis of Soil Structure 

Interaction Problems," EERC 75-30, Earthquake Engineering Research Center, UCB, 

November 1975. 

Lysmer, J., et al., "SAS SI - A System for Analysis of Soil Structure Interaction," UCB/GT 181-0, 

Geotechnical Engineering, UCB, April 1981. 

NFPA, "Performance-Based Standard for Fire Protection for Light Water Reactor Electric Generating 

Plants," NFPA-805, (draft issued for public proposals), November 11, 1998. 

NEI, "Severe Accident Issue Closure Guidelines," Revision 1, NEI 91-04, December 1994. 

NUMARC, "Severe Accident Issue Closure Guidelines," NUMARC 91-04, January 1991. 

San Onofre Nuclear Generation Station Unit 1, "Report on Cable Failures - 1968," 

Southern California Edison Co., May 1968. 

SQUG, "Generic Implementation Procedure for Seismic Verification of Nuclear Power Plant 

Equipment," Revision 2 (Corrected), February 14, 1992. 

U.S. NRC,"Potential for Loss of Remote Shutdown Capability During a Control Room Fire," Information 

Notice 92-18, February 28, 1992. 

U.S. NRC, "Policy Statement on Severe Accidents Regarding Future Designs and Existing Plants," 

Federal Register, Vol. 50, p. 32138, August. 8, 1985. 

U.S. NRC, "Nuclear Plant Fire Protection Functional Responsibilities, Administrative Controls, and 

Quality Assurance," Generic Letter 77-02, 1977. 

U.S. NRC, "Fire Protection Rule (45 FR 76602, November 19, 1980)," Generic Letter 81-12, February 

20, 1981, and Clarification Letter, March 1982.

6-1
U.S. NRC, "NRC Positions on Certain Requirements of Appendix R to 10 CFR, Part 50," 

Generic Letter 83-33, October 19, 1983. 

U.S. NRC, "Fire Protection Policy Steering Committee Report," Generic Letter 85-01, January 9, 1985. 

U.S. NRC, "Implementation of Fire Protection Requirements," Generic Letter 86-10, April 24, 1986. 

U.S. NRC, "Fire Endurance Test Acceptance Criteria for Fire Barrier Systems Used To Separate Redundant Safe Shutdown Trains Within the Same Fire Area," Generic Letter 86-10, 

Supplement 1, March 25, 1994. 

U.S. NRC, "Removal of Fire Protection Requirements from Technical Specifications," Generic Letter 88

12, August 2, 1988. 

U.S. NRC, "Individual Plant Examination for Severe Accident Vulnerabilities, 10 CFR 50.54(f)," 

Generic Letter 88-20, November 23, 1988. 

U.S. NRC, "Initiation of the Individual Plant Examination for Severe Accident Vulnerabilities, 

10 CFR 50.54(f)," Generic Letter 88-20, Supplement 1, August 29, 1989. 

U.S. NRC, "Individual Plant Examination of External Events (IPEEE) for Severe Accident 

Vulnerabilities, 10 CFR 50.54(f)," Generic Letter 88-20, Supplement 4, June 28, 1991. 

U.S. NRC, "Individual Plant Examination of External Events (IPEEE) for Severe Accident 

Vulnerabilities," Generic Letter 88-20, Supplement 5, September 8, 1995. 

U.S. NRC, "Seismic Design Criteria," Regulatory Guide 1.29, Revision 3, September 1978. 

U.S. NRC, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants - LWR Edition," NUREG-0800, June 1987. 

U.S. NRC, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events 

(IPEEE) for Severe Accident Vulnerabilities," NUREG- 1407, June 1991. 

U.S. NRC, "Individual Plant Examination Program: Perspectives on Reactor Safety and Plant 

Performance," NUREG- 1560, December 1997. 

U.S. NRC, "Research Needs in Fire Risk Assessment," Proceedings of 25 'h U.S. Nuclear Regulatory Commission Water Reactor Safety Information Meeting, Bethesda, Maryland, NUREG/CP-0 162, 

Vol. 2, pages 93-116, N. Siu, J.T. Chen, and E. Chelliah, October 20-22, 1997. 

U.S. NRC,"Development of Criteria for Seismic Review of Selected Nuclear Power Plants," 

NUREG/CR-0098, BNL, May 1978. 

U.S. NRC, "Nuclear Power Plant Fire Protection-Fire Hazards Analysis (Subsystems Study Task 4)," 

NUREG/CR-0654, SNL, September 1979. 

U.S. NRC, "Revised Livermore Seismic Hazard Estimates of 69 Nuclear Plant Sites East of the Rocky 

Mountains," NUREG/CR- 1488, LLNL, April 1994. 

U.S. NRC, "Fire Risk Analysis for Nuclear Power Plants," NUREG/CR-2258, UCSB, Los Angeles, 

Calif., September 1981. 

U.S. NRC/ANS/IEEE, "PRA Procedures Guide," NUREG/CR-2300, January 1983. 

U.S. NRC,"Probabilistic Safety Analysis Procedures Guide," NUREG/CR-2815, Bari, R.A., et. al., 

August 1985. 

U.S. NRC,"An Approach to the Quantification of Seismic Margins in Nuclear Power Plants," 

NUREG/CR-4334, August 1985. 

U.S. NRC,"An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Control 

Cabinets, Part I - Cabinet Effects Tests," NUREG/CR-4527, Volume 1, SAND86-0336, SNL, 

April 1987. 

U.S. NRC, "An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Cabinets, 

Part II - Room Effects Tests," NUREG/CR-4527, Volume 2, SAND86-0336, SNL, 

October 1988. 

6-2

I II
U.S. NRC, "Users Guide for a Personal-Computer-Based Nuclear Power Plant Fire Data Base," 

NUREG/CR-4586, SAND86-0300, SNL, August 1986. 

U.S. NRC, "Accident Sequence Evaluation Program - Human Reliability Analysis Procedure," 

NUREG/CR-4771, SAND 86-1996, SNL, February 1987. 

U.S. NRC, "Analysis of the LaSalle Unit 2 Nuclear Power Plant: Risk Methods Integration and 

Evaluation Program (RMIEP)," NUREG/CR-4832, Vols. 1-10, SNL, March 1993. 

U.S. NRC, "Procedures for the External Event Core Damage Frequency Analyses for NUREG- 1150," 

NUREG/CR-4840, SAND88-3102, SNL, November 1990. 

U.S. NRC, "Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including 

Previously Unaddressed Issues," NUREG/CR-5088, SAND88-0177, SNL, January 1989. 

U.S. NRC, "Seismic Hazard Characterization of 69 Nuclear Power Plant Sites East of the Rocky 

Mountains," NUREG/CR-5250, LLNL, January 1989. 

U.S. NRC, "Individual Plant Examination of External Events: Guidance and Procedures," draft 

NUREG/CR-5259, March 1989. 

U.S. NRC, "Integrated Risk Assessment for the LaSalle Unit 2 Nuclear Power Plant: Phenomenology 

and Risk Uncertainty Evaluation Program (PRUEP)," NUREG/CR-5305, Vols. 1-3, SNL, 1992. 

U.S. NRC,"A Summary of the U.S. NRC Fire Protection Research Program at Sandia National 

Laboratories: 1975-1987," NUREG/CR-5384, SNL, December 1989. 

U.S. NRC, Letter, from A.C. Thadani, NRCiNRR/DST, to W.H. Rasin, NUMARC, Subject: "NRC's 

Staff Evaluation Report on Revised NUMARC/EPRI Fire Vulnerability Evaluation (FIVE) 

Methodology," August 21, 1991. 

U.S. NRC, "Assessment of the Impact of Appendix R Fire Protection Exemptions on Fire Risk," 

SECY- 99- 182, July 9, 1999. 

U.S. NRC, "Fire Protection for Operating Nuclear Power Plants," Draft Regulatory Guide DG- 1097, 

Revision 1, June 2000. 

Wong, H., and Luco, J., "Soil Structure Interaction: A Linear Continuum Mechanics Approach 

(CLASSI)," Report CE, Department of Civil Engineering, USC, Los Angeles, Calif., 1980.

6-3
GLOSSARY

Active fire barrier - a fire barrier element that must be physically repositioned from its normal 

configuration to an alternative configuration in order to provide its protective function. Examples include 

ventilation system fire dampers and normally open fire doors. 

Anomaly - an observed plant condition that deviates from a normal configuration or otherwise apparently 

fails to satisfy expected criteria. 

Anticipated transient without scram (ATWS) - a perturbation in the state of some system or component 

at full reactor power that initiates a deviation from the full-power, steady-state operating conditions that has 

been previously considered and analyzed which would normally result in a reactor scram. However, in this 

case, the reactor does not scram, either automatically or manually. 

Appendix R fire area - an area, as defined in the analysis pursuant to Appendix R to Title 10, Part 50, of 

the Code of Federal Regulations (10 CFR Part 50), "Fire Protection Program for Nuclear Power Facilities 

Operating Prior to January 1, 1979," that is sufficiently bounded by fire barriers such that it will withstand 

the fire hazards within the fire area and, as necessary, will protect important equipment within a fire area from 

a fire outside the area. A fire area must be made up of rated fire barriers with openings in the barriers 

provided with fire doors, fire dampers, and fire penetration seal assemblies having a fire resistance rating at 

least equivalent to the barrier in which it is installed. 

Appendix R fire zones - subdivisions of a fire area, as specified in Appendix R to 10 CFR Part 50. 

Appendix R requirements - fire protection requirements specified in Appendix R to 10 CFR Part 50. (It 

should be noted that while some Appendix R requirements apply to all plants operating before January 1, 

1979, plants licensed after January 1, 1979, are not subject to Appendix R requirements. Instead, these plants 

must meet the fire protection condition(s) of their licenses, which are based upon the guidelines of NUREG

0800, "Standard Review Plan for the Review of Safety Analysis Reports of Nuclear Power Reactors - LWR 

Edition," June 1987, specifically Branch Technical Position CMEB 9.5-1, which mirrors Appendix R with 

additional information.) 

"Bad actor" relay - a low-ruggedness relay, as defined in guidance and procedures pertaining to USI A-46 

and the Seismic Quantification Utilities Group (SQUG). 

Barrier failure - the breach of a fire barrier, by a fire or other cause, which could permit propagation of 

a fire or its combustion products across the barrier. 

Bounding analysis - an analysis that intentionally makes use of methods and assumptions (e.g., those 

pertaining to parameters describing a hazard, a resulting initiating event, and a plant's resistance to the 

initiator) designed to result in an upper-bound or demonstrably conservative estimate of risk. 

Charleston Earthquake Issue- an issue initiated by a 1982 U.S. Geological Survey letter that pointed out 

the possibility that large, damaging earthquakes have some likelihood of occurring at locations where such 

events may not previously have been considered in developing past licensing decisions. (As a result of work 

carried out by the NRC and EPRI to resolve this issue, eight plants at five Eastern U.S. sites were identified

Glossary - 1
as having a sufficient likelihood of being affected by large, damaging earthquakes beyond the licensing bases, 

such that further assessment was deemed to be warranted.) 

Common cause failure (also referred to as "common mode failure") - a single event, action (e.g., improper maintenance activity), or condition (e.g., stress corrosion cracking) that adversely affects two or 

more similar or identical components at the same time. (Since this report deals with external events, the 

common cause failure can also be an external event that affects multiple (similar or dissimilar) components 

in the same area.) 

COMPBRN - a computer code described in EPRI NP-7282, "COMPBRN IIIE: An Interactive Computer 

Code for Fire Risk Analyses," May 1991. 

Component - an item of plant equipment (e.g., a pump, valve, pipe, etc.) or a structural feature (e.g., a 

building, masonry wall, stack, etc.) that is designed to perform a particular function. (For purposes of system modeling, a component is the lowest level of detail used in representing a piece of plant hardware and 

defining its associated failure as a basic event.) 

Conditional core damage probability (CCDP) - a probability of reaching core damage given an event 

(initiator), in combination with a specific (degraded or normal) plant condition. (For example, the initiator 

might be a wind-induced loss of offsite power, and an associated degraded plant condition might be crimping of an exposed diesel generator exhaust stack resulting from a wind-induced missile. In this case, the CCDP 

would be determined by evaluating the plant model for a loss of offsite power initiator where either an 

increased failure probability or guaranteed failure of at least one diesel generator is assumed.) 

Conservative deterministic failure margin (CDFM) - an estimate of the high-confidence of low

probability of failure (HCLPF) capacity of a component, determined in accordance with the procedure 

recommended in EPRI NP-6041. 

Containment failure modes - a mutually exclusive set of descriptive states used to categorize the 

characteristics of containment failure. (For example, such descriptive states might consist of "early isolation 

failure," "late isolation failure," "early containment bypass failure," "early over-pressure failure," etc.) 

Containment performance - the ability of a nuclear plant containment to fulfill its intended function in 

the event of challenges presented by a severe accident. (Such ability can be assessed through qualitative and/or quantitative evaluation. A quantitative measure of containment performance would be the conditional 

probability of containment failure given core damage.) 

Control systems interaction - the potential of fire to adversely affect the ability of plant operators to 

achieve safe shutdown from either the control room or the remote shutdown panel as a result of fire-induced 

circuit failures. (For example, a fire may damage common circuits or cables in a way interferes with the 

ability to achieve safe shutdown conditions. Control systems interaction is identified as Generic Safety Issue 

(GSI) 147.) 

Core damage - a state of clad oxidation and fuel damage caused by a prolonged uncovering and heating of the reactor core, as a result of an imbalance in heat generation and heat removal. 

Glossary - 2

1 11
Core damage frequency (CDF) - the frequency, per reactor-year, of the occurrence of severe accidents 

that lead to core damage. 

Cross-zone analysis - the analysis of a potential fire scenario involving fire propagation between adjacent 

fire zones. 

Cut set- any combination of a set of events (e.g., occurrence of an initiating event and component failures) 

that, if they occur, would result in an undesirable condition (e.g., onset of core damage or containment 

failure). 

Dependency- requirement external to a structure, system, or component (SSC), and upon which the S SC's 

function depends. 

Design basis event - any of the events specified in a nuclear power plant's licensing basis that are used 

to establish acceptable performance for safety-related functions. (Such events include anticipated transients, 

design basis accidents, external events, and natural phenomena.) 

Dominant contributor - an accident class that has a major impact on the total core damage frequency, or 

a containment failure mechanism that has a maj6r impact on the total radionuclide release frequency. 

Eastern U.S. seismicity issue - formerly the Charleston Earthquake Issue. (See "Charleston Earthquake 

Issue.") 

EPRI seismic margin assessment (SMA) methodology - a methodology, described in EPRI NP-604 1, 

for seismic assessment of a plant and determination of component and plant HCLPF capacities, which uses 

success paths as the approach for systems modeling. 

Event tree - a quantifiable logical network that begins with an accident initiator or condition; progresses 

through a series of branches that represent possible system performances, human actions, or 

phenomenological behaviors; and ultimately leads to either a safe, stable state or an undesirable one, such 

as core damage or containment failure. 

External event - an accident initiator that originates outside a nuclear power plant's internal systems, and 

in combination with safety system failures and/or operator errors, may induce core damage accident 

sequences. (Examples of external events include earthquakes, tornadoes, external floods, and fires.) 

External flood - a flood initiated outside the plant that can affect the operability of internal plant systems. 

Fault tree - a graphical representation that shows the logical relationships among possible basic failure 

events, and provides a concise and orderly description of the various combinations of such events that may 

occur within a system and could result in some predefined, undesirable event for that system. 

Feed-and-bleed - a method to provide core cooling in a pressurized water reactor (PWR) (without the use 

of feedwater or steam generators) by providing (feeding) primary coolant makeup to the core, while removing 

decay hear by opening the pressurizer power-operated relief valves (PORVs) or safety valves to remove 

(bleed) primary fluid having elevated temperature.

Glossary - 3
Fire area - a physical area bounded on all sides by rated fire barriers. (See also "Appendix R fire area.") 

Fire barrier- elements of construction (walls, floors, and their supports), which may incorporate beams, 

joists, columns, penetration seals or closures, fire doors, and fire dampers that are rated by approving laboratories (usually in terms of hours of resistance to fire), and are used to prevent the propagation of fire. 

Fire compartment - in fire analysis, an enclosure or space bounded by non-combustible barriers, where 

heat and products of combustion generated from a fire will be substantially confined within the enclosure. 

Fire compartment interaction analysis (FCIA)- a procedural step in the EPRI fire-induced vulnerability 

evaluation (FIVE) methodology, in which qualitative consideration is given to the potential for interacting 

fire spread between compartments and the consequences of such fire spread on plant shutdown. 

Fire damage modeling - modeling of all pertinent and necessary fire damage sequences (including fire 

scenarios and fire-induced sequences). 

Fire-induced vulnerability evaluation (FIVE) - a quantitative screening technique sponsored by the EPRI 

under the guidance of the Severe Accident Working Group of the Nuclear Management and Resources 

Council (NUMARC) and the industry's experts, for the purpose of addressing the fire portion of licensees' 

IPEEE studies. 

Fire PRA methodology - the set of procedures, based on probabilistic risk analysis, for estimating the core 

damage frequency attributable to fire events. 

Fire zones - subdivisions of a fire area. (See also "Appendix R fire zones.") 

Focused-scope - a term used in NUREG- 1407 to designate a somewhat narrowed set of aspects, relative 

to the broader full-scope aspects, to be included in the seismic IPEEE assessment for a specified group of 

nuclear power plants. The plants in this category are to perform a detailed walkdown of the safe shutdown 

equipment list (SSEL), an evaluation of low-ruggedness relays, a screening assessment of structures and 

SSEL items for a 0.3g peak ground acceleration (PGA) review-level earthquake (RLE), calculation and 

reporting of HCLPF capacities for the weaker elements, and determination and reporting of the plant's 

HCLPF capacity. 

Fragility - the conditional probability that a component, system, or plant will fail, given the occurrence of 

a specified value of a load parameter (e.g., in the case of seismic fragility, the load parameter is typically a 

measure of ground acceleration). A component fragility curve, which is equivalent to the probability 

distribution function of the component's capacity, is used in a PRA to determine the component's failure 

probabilities under various load levels. 

Free field - a location at which the ground motion from a seismic event can be recorded without 

experiencing a measurable influence of ground-motion effects caused by the dynamic response of constructed 

features. 

Free-field peak ground acceleration (PGA) - peak acceleration of the ground motion experienced in a 

seismic event for free-field conditions. 

Glossary - 4

I it
Full-scope - a term used in NUREG- 1407 to designate the broader set of aspects, relative to the focused

scope aspects, to be included in the seismic IPEEE assessment of a specified group of plants. The plants in 

this category are to perform a seismic IPEEE that goes beyond the focused-scope assessment, particularly 

in regard to the breadth of relay chatter evaluation, the effort expended in investigating potential soil failures, 

and the list of components for which HCLPF calculations are performed. 

Functional interaction -the potential effects of one component or system upon another as a result of their 

functional interdependencies. 

Generic implementation procedure (GIP) -the screening guidance given in the "Generic Implementation 

Procedure for Seismic Verification of Nuclear Power Plant Equipment," which was developed under the 

sponsorship of the Seismic Qualification Utility Group (SQUG). 

Generic issue (GI) - A concern that may affect the design, construction, or operation of all, several, or a 

class of nuclear power plants, which either does not affect safe operation of the plant or the safety 

significance of the issue has not yet been determined. 

Generic Letter 88-20 - a letter issued by the NRC to all licensees on November 23, 1988, which requested 

that U.S. nuclear power reactor licensees submit an individual plant examination (IPE) for severe accident 

vulnerabilities for each licensed nuclear power plant. 

Generic Letter 88-20, Supplement 4 - a letter issued by the NRC to all licensees on June 28, 1991, which 

requested that U.S. nuclear power reactor licensees submit an individual plant examination of external events 

(IPEEE) for severe accident vulnerabilities to external events for each licensed nuclear power plant. 

Generic Letter 88-20, Supplement 5 - a letter issued by the NRC to all licensees on September 8, 1995, 

which notified all U.S. nuclear power reactor licensees about modifications to the seismic reviews that are 

to be performed as part of the IPEEE program for focused-scope and full-scope plants. 

Generic safety issue (GSI)- according to NUREG-0933, "A Prioritization of Generic Safety Issues," a GSI 

is a safety concern that may affect the design, construction, or operation of all, several, or a class of nuclear 

power plants, and may have the potential for safety improvements and promulgation of new or revised 

requirements or guidance. 

Ground motion - the strength of shaking experienced at a specified location within the ground or on the 

ground surface, which is usually described for engineering purposes by either a time history of ground 

acceleration or a response spectrum that conveys the strength of response accelerations of simple harmonic 

oscillators versus their vibration periods or frequencies. 

Hazard - a potential source of risk (e.g., combustible materials, high-pressure piping, chemical solutions, 

storms, earthquake sources, landslides, meteors, etc.). 

Hazard curve - A curve conveying the annual rate of occurrence of a hazardous event versus the value of 

a parameter that characterizes the severity of the hazard. (Hazard curves are most often used to quantify the 

threat of various earthquake ground motions, extreme wind speeds, and extreme flood levels.)

Glossary - 5
High-confidence of low-probability of failure (HCLPF) capacity- an earthquake acceleration level for 

which a given component, system, or plant is evaluated as having a 95% confidence that the chance of its 

failure is 5%. 

High wind, flood, and other (HFO) external events - the external events examined in an IPEEE, 

excluding seismic and fire events. HFO events include high winds and tornadoes, external floods, 

transportation and near facility accidents, and other unscreened or plant-unique hazards. 

Hot short - an electric cable failure mode, resulting from a fire, which involves making an electrical 

connection between a conductor with power and a conductor that does not currently have power, without a 

simultaneous short-to-ground or open-circuit condition. Such a fault might, for example, simulate the closing of a control switch, cause errors in an instrument reading, or result in the application of power to an 

unpowered circuit. 

Human error probability (HEP) - (See "Human error rate.") 

Human error rate - a measure of the likelihood that an operator will fail to initiate the correct, required, 

or specified action or response needed to allow the continuous or correct functioning of an item of equipment. 

(Human error rate and human error probability are used interchangeably.) 

In-core flux mapping (ICFM) system - a system used in a PWR to measure the strength and distribution 

of neutron flux in the reactor core. 

Individual plant examination (IPE) - an evaluation to identify any plant-specific vulnerabilities to severe 

accidents initiated by internal events, including internal flooding, during full-power operation. (Generic 

Letter 88-20 requested that each licensee of a United States nuclear power plant perform such an evaluation 

for its plant(s).) 

Individual plant examination of external events (IPEEE) - an evaluation to identify any plant-specific 

vulnerabilities to severe accidents initiated by external events during full-power operation. (Generic Letter 

88-20, Supplement 4, requested that each licensee of a United States nuclear power plant perform such an 

evaluation for its plant(s).) 

Interfacing system loss-of-coolant accident (ISLOCA) - an accident in which reactor coolant is released 

at high pressure into a low-pressure system, resulting in a loss of reactor coolant that cannot be isolated. 

Internal events- accident initiators (including internal flooding) that originate within a nuclear power plant 

and, in combination with safety system failures and/or operator errors, may induce core damage accident 

sequences. 

Internal fire - a fire initiated anywhere within the plant boundaries, including areas within plant structures 

and buildings, as well as contiguous outdoor areas such as the electrical switchyard and transformer areas. 

Internal flood - a flood initiated within the plant that can affect the operability of internal plant systems. 

Level 1 analysis - an identification and quantification of the sequences of events leading to the onset of core 

damage. 

Glossary- 6

I It
Level 2 analysis - an evaluation of containment response to severe accident challenges, including 

quantification of the mechanisms, quantities, and likelihoods of radioactive material releases from the 

containment given core damage accident sequences. 

Loss-of-coolant accident (LOCA) - an accident caused by a break in the reactor coolant system pressure 

boundary. 

Low-ruggedness relay - a relay or relay-type device (switch/contact) that has the potential to change state, 

or to oscillate between states (i.e., chatter), under a relatively low-intensity seismic event. 

Minimal cut set--a necessary and sufficient combination of events (e.g., occurrence of an initiating event 

and component failures) that would result in some undesirable condition (e.g., onset of core damage or 

containment failure). (See also "Cut set.") 

Mission time - the time period that a system or component is required to be operable in order to carry out 

its intended mission. (For example, a containment spray mission time of 24 hours implies that containment 

sprays are required to be operable for 24 hours following their demand, in order to prevent containment 

failure from occurring within that time period.) 

Modified focused-scope - a focused-scope seismic evaluation that makes use of the relaxations and other 

provisions described in GL 88-20, Supplement 5. 

Modified full-scope - a full-scope seismic evaluation that makes use of the relaxations and other provisions 

described in GL 88-20, Supplement 5. 

Multiple system responses program (MSRP) - the program described in NUREG/CR-5420, "Multiple 

System Responses Program - Identification of Concerns Related to a Number of Specific Regulatory 

Issues." 

National Fire Protection Association (NFPA) codes and standards - consensus codes and standards 

intended to minimize the possibility and adverse consequences of fires. 

NEI 91-04, "Severe Accident Closure Guidelines" - guidelines proposed by the Nuclear Management 

and Resources Council (NUMARC) (now, the Nuclear Energy Institute (NEI)) that are intended to identify 

vulnerabilities that may lead to a severe accident, and that have been proposed as a basis for resolving severe 

accident issues. 

NRC seismic margin assessment (SMA) methodology - a methodology for seismic assessment of a plant 

and determination of component and plant HCLPF capacities, which uses event tree and fault tree modeling 

instead of the success path approach that has been adopted in the EPRI SMA methodology. 

NUREG-1407 - a report issued by the NRC in June 1991, entitled "Procedural and Submittal Guidance for 

the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities." This 

report provides guidance for performing and reporting the results of the IPEEE analyses. 

Outlier - a component that cannot be screened out because a condition that violates one or more key criteria 

of standard screening tables is encountered in a seismic walkdown or documentation review.

Glossary - 7
Passive component - a component, or part of a component, that performs its intended function without any 

moving parts or changes in state. (Examples of passive components include tanks, piping runs, valve bodies, 

and ductwork.) 

Passive fire barrier - a fire barrier that provides its protective function while in its normal orientation, 

without any need to be repositioned. (Examples of passive fire barriers include walls and normally closed 

fire doors.) 

Peak ground acceleration (PGA) - for purposes of IPEEEs, the PGA is the same as the "free-field peak 

ground acceleration." 

Performance shaping factor (PSF) - an influence on the performance of an operator. (PSFs are a key 

underlying aspect of the concept that human error rates for a set of specified actions can be derived by 

investigating how a small set of influences affect the likelihood of success or failure of the operator(s). PSFs 

include such items as training, experience, availability and quality of a procedure, stress, interdependence 

among operators, environment, and timing.) 

Plant - a general term used to refer to a nuclear power facility, including one having a single reactor unit 

or multiple units. 

Plant-level capacity - the quantification of a plant's ability to resist the effects of a given hazard. (Plant

level seismic capacity is typically conveyed by a fragility curve or an HCLPF value. In the EPRI SMA 

methodology, the plant-level seismic capacity can be conveniently approximated as the lowest HCLPF 

capacity among those components (including structures) that are relied upon to achieve safe shutdown 

conditions in the most rugged success path. In the NRC SMA methodology, the plant-level seismic capacity 

can also be approximated if the Boolean expression for core damage and the HCLPF capacities for 

components included in this expression are known.) 

Plant logic model - a mathematical representation that simulates the behavior of a plant in response to an 

initiating event. The mathematical representation is used to (a) delineate sequences of events that could result 

in a state of core damage or a state of safe shutdown, and (b) to quantify the frequencies of such 

event/accident sequences. A plant logic model typically involves the development of event trees and 

associated fault trees that describe the combinations of basic events leading to the event-tree top events. 

Probabilistic risk assessment (PRA) - an analytical process that quantifies the likelihood of possible 

adverse consequences. For a nuclear power plant, this process focuses on evaluating the design, operation, 

and maintenance of a plant in regard to potential severe accidents and adverse effects on the health and safety 

of the public. The risk evaluation process involves three sequential parts or "levels" (Level-I addresses 

potential accident sequences leading to core damage; Level-2 addresses potential releases of radiological 

materials outside of the containment in the event of core damage; and Level-3 addresses potential adverse 

health, safety, and environmental consequences resulting from transport of the radiological elements in the 

event of radiological releases.) 

Probable maximum precipitation (PMP) - the probable maximum rainfall, as stated in Generic Letter 

89-22. (The PMP pertains to phenomena associated with spatially and temporally localized intense 

precipitation. Such phenomena are usually distinct from phenomena associated with the probable maximum 

Glossary - 8

I I II
flood (PMF), which generally results from a longer-term collection of rainfall distributed within a drainage 

basin and subsequent transport of water (i.e., flood routing) to the site location of interest.) 

Qualified cable - a cable that is certified to meet all of the requirements of the IEEE standard No. 3 83 

(including both the flame spread and the LOCA exposure test protocols). 

Random failure - an independent, unrelated failure of which an occurrence can be represented by a 

probability distribution. (In IPEEEs, this term typically refers to failure events that are not caused by, or 

related to, the external event being analyzed.) 

Rated fire barrier - a fire barrier with a fire endurance rating established in accordance with the test 

procedures of NFPA 251, "Standard Methods of Fire Test of Building Construction and Materials." 

Reactor coolant pump (RCP) seal LOCA - a loss-of-coolant accident resulting from a failure of a reactor 

coolant pump seal. 

Reactor-year- 365 full days (8,760 hours) of operation of a single reactor unit at full or partial power. (A 

reactor-year does not include the shutdown and restart intervals or the downtime of the reactor.) 

Recovery action - an operator action intended to restore equipment that has failed or been rendered 

unavailable (e.g., as a result of testing and maintenance) back to an operable status. 

Reduced-scope-- a term used in NUREG- 1407 to designate a limited implementation of the seismic margin 

method, which emphasizes a seismic walkdown and evaluation of outliers with respect to the design basis 

level, and which is to serve as the seismic IPEEE assessment approach for a specified group of nuclear power 

plants. (NUREG- 1407 assigned plants to this category on the basis that they are located in areas that have 

a low seismic hazard.) The plants in this category do not need to perform HCLPF calculations, an assessment 

of soil failures, or a relay evaluation (beyond the requirements of USI A-46, if applicable). 

Relay chatter - the oscillation of relay contacts between open and closed positions during a seismic event. 

Remote shutdown panel (RSP) - the capability to achieve safe shutdown from outside the control room. 

While the term "remote shutdown panel" is commonly used both in this report and elsewhere, the term is 

inaccurate if not somewhat misleading. Plants are required to have a capability to achieve a safe, cold 

shutdown from outside the control room. In many cases, this is accomplished at one location, thus explaining 

the common usage of remote shutdown "panel." However, there is no actual requirement for any new or 

special panel to be used in the event of a fire in the control room. Thus, any mention in this report of RSP 

should be understood to be a general reference to the capability of achieving safe shutdown from outside the 

control room, rather than the existence of a specific panel (or panels). 

Request for additional information (RAI) - an inquiry sent to a licensee from the NRC for the purpose 

of obtaining additional information that clarifies the IPEEE submittal. 

Review-level earthquake (RLE) - the specific earthquake level recommended in NUREG- 1407 for which 

a seismic evaluation is conducted. This earthquake level governs the criteria that are applied in screening 

components. In addition, for seismic margin assessments, this earthquake level defines the spectral 

acceleration values (based on the spectral shape defined by NUREG/CR-0098) from which the seismic

Glossary - 9
demands are derived for use in calculating HCLPF capacities of components. (For seismic PRAs, NUREG

1407 indicates use of the site-specific 10,000-year median uniform hazard spectral shape for developing 

seismic demands.) 

Roof ponding - the accumulation of rain water on the roof of a structure. The term "roof ponding" also 

pertains to the specific phenomenon in which roof ponding loads lead to sagging (vertical deformations 

associated with flexure) of the roof that, in turn, leads to additional collection/ponding of water and 

correspondingly increased loads, potentially resulting in roof instability or failure. 

Safe shutdown earthquake (SSE) - the design basis earthquake defined for a nuclear power plant, in 

accordance with Appendix A to 10 CFR Part 100. 

Safe shutdown earthquake (SSE) spectrum - the ground response spectrum associated with a safe 

shutdown earthquake. 

Safe shutdown equipment list (SSEL) - the list of components required for safe shutdown in the event 

of a specific initiator. 

Safe shutdown model - a mathematical representation of the behavior of plant systems, components, and 

actions that are needed to bring a plant to safe shutdown. 

Safety-related structures, systems, and components -those structures, systems, and components that are 

relied upon to remain functional during and following design basis events to ensure the integrity of the reactor 

coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown 

condition, or the capability to prevent or mitigate the consequences of accidents that could results in potential 

offsite exposure comparable to the guidelines in 10 CFR 50.34(a)(1) or 10 CFR 100.11. 

Scaling factor-- a number used to adjust (multiply) the seismic demands determined from some previously 

performed (e.g., design or reevaluation) building response analysis, in order to estimate the demands 

associated with a seismic margin earthquake (SME). 

Screening analysis - a quantitative or qualitative evaluation used to narrow the list of items that require 

more detailed assessment. (In a seismic assessment, a screening analysis based on a walkdown and/or 

documentation review, supplemented by anchorage calculations, is typically performed in order to identify 

components that require further treatment (e.g., HCLPF or fragility calculations). In a fire assessment, a 

screening analysis is performed to eliminate fire areas and/or zones that have a negligible CDF contribution. 

In an HFO assessment, an initial overall screening analysis is performed to exclude hazard categories that 

have negligible CDF contributions.) 

Seismic capacity - the highest seismic demand level (e.g., peak ground acceleration) that a structure, 

system, or component can withstand and still continue to perform its intended function. 

Seismic Category 1 structure- a structure designed to withstand a safe shutdown earthquake (also simply 

referred to as a Category 1 structure). 

Seismic demand - the influences (e.g., stresses and strains, or accelerations/forces and deformations) 

experienced within (or by) a structure and/or imposed on equipment, as a result of an applied earthquake 

Glossary - 10

1 11
loading/input. (Seismic demands on equipment are typically characterized by means of in-structure response 

spectra, or for ground-mounted equipment, the input ground response spectrum. Seismic demands on 

structures can also be characterized by the input ground response spectrum, although the forces or 

deformations that are experienced at a particular critical location in the structure (e.g., shear forces on a roof 

diaphragm) usually provide a more meaningful and precise description of the seismic demand.) 

Seismic-fire interaction evaluation - an assessment of seismically induced fires, including the inadvertent 

actuation of fire protection systems. 

Seismic-flood interaction evaluation - an assessment of the effects of a seismic event on the potential 

occurrence of a flood and plant response to flooding. 

Seismic hazard - any feature capable of causing ground motion, and any phenomenon related to, or caused 

by, ground shaking (e.g., ground movement, liquefaction, landsliding, seiche), which has the potential to 

produce adverse effects. 

Seismic margin - the ability of a plant, system, component, or structure to safely withstand seismic 

demands or input ground-motion levels beyond those imposed by the design basis earthquake. 

Seismic margin assessment (SMA) - a methodology for assessing the seismic capacities and seismic 

margin of a nuclear power plant. (As described in NUREG-1407, two NRC and EPRI have independently 

developed two alternative approaches for performing SMA.) 

Seismic margin earthquake (SME) - the specific earthquake ground motion spectrum used as input for 

a seismic margin assessment. 

Seismic margin methodology (SMM) - (See "Seismic margin assessment (SMA).") 

Seismic PRA (SPRA) methodology - an analytical process used to estimate a plant's frequency of core 

damage as the result of seismic events. (See also "Probabilistic risk assessment (PRA) methodology.") 

Seismic Qualification Utilities Group (SQUG) - a group of nuclear power plant owners who have worked 

together to pool their experience data on component behavior in past earthquakes, and have sponsored the 

development of the "Generic Implementation Procedure for Seismic Verification of Nuclear Power Plant 

Equipment." (See also "Generic implementation procedure (GIP).") 

Senior review board (SRB) - a panel of independent experts, consisting ofNRC staff and consultants from 

national laboratories, that performed peer reviews of each IPEEE review in order to ensure the consistency 

and completeness of the review process. 

Sensitivity analysis - an assessment in which one or more input parameters are varied in order to observe 

their effects on results. 

Settlement - downward movement of the ground surface (or of a building or other facility that is founded 

on, or within, the ground) as the result of the compaction or consolidation of the underlying soil. 

Severe accident - an accident that goes beyond the design basis of the plant and results in core damage.

Glossary - 11
Severe accident management-the implementation of strategies and guidance developed for incorporation 

into a plant's emergency response procedures to arrest the progression of an accident sequence, or to prevent 

or reduce the release of radioactivity into the environment. 

Soil liquefaction - a phenomenon in which submerged ground materials (particularly, loose cohesionless 

soils, and some types of sensitive clays) develop high pore pressures under repeated load cycles (that cause 

rearrangement of soil structure and diminished resistance between soil grains), with a resulting significant 

loss of shear strength and development of large shear strains. 

Soil-structure interaction (SSI) - the dependent relationship between ground motion and building 

response, where ground motion affects a building's vibratory behavior, and the building's vibratory response 

(in turn) alters the characteristics of the ground motion. Soil-structure interaction can have an important 

influence on the demands experienced by a structure and the equipment housed in or near that structure, 

particularly for the case of a massive structure having a large foundation. (See also "Free field" and "Ground 

motion.") 

Spatial interaction - a potential adverse influence between plant components as a result of their spatial 

proximity. (Examples of spatial interactions include pounding of adjacent cabinets, water or chemicals 

spraying on equipment as a result of activation or breach of overhead fire-suppression lines, and overhead 

fluorescent light tubes falling and shattering inside open cabinets/panels, among many others.) 

Spectral shape - the shape (i.e., plotted pattern that does not change with uniform scaling) of a response 

spectrum associated with a given ground motion. (See also "Ground motion.") 

Spurious actuation - an undesirable actuation of a component or system as a result of an uncontrolled or 

unintended signal. 

Standard Review Plan (SRP) - review guidance for nuclear power plant license applications, as issued 

by the NRC in NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear 

Power Plants," June 1975. 

Station blackout (SBO) - the complete loss of alternating current (ac) electric power to the essential and 

nonessential switchgear buses in a nuclear power plant (i.e., loss of the offsite electric power system 

concurrent with a turbine trip and unavailability of the onsite emergency ac power system). 

Steam generator tube rupture (SGTR) - a PWR severe accident sequence initiated by the breach of at 

least one steam generator tube. 

Step 1 review - a review of a licensee's IPEEE submittal and associated documentation by the NRC and 

NRC contractor(s). If needed, the Step 1 review may include one or more RAIs. 

Step 2 review - a review of the Tier 2 IPEEE documentation retained for audit (as specified in Section 8.2 

of NUREG- 1407) and maintained by the licensee at its plant or company offices. If needed, the Step 2 

review may include a walkdown to confirm specific features of the plant's configuration or screening basis, 

as encountered in the licensee's IPEEE submittal or Tier 2 documentation. 

Glossary- 12

I 11
Submittal-only review-- a review of an IPEEE on the basis of the information in the IPEEE submittal and 

additional information obtained from the licensee's responses to RAIs. 

Success path - a specific combination of safety-system trains that accomplish the four principal functions 

of reactivity control, reactor pressure control, reactor coolant inventory control, and decay heat removal, and 

that together are capable of bringing a plant to a stable condition (either hot or cold shutdown) and 

maintaining that condition for at least 72 hours. 

Success path equipment list (SPEL) - the list of components needed to achieve chosen success paths. 

Supplemental technical evaluation report - a report prepared by NRC staff or NRC contractors that 

describes additional technical review findings resulting from consideration of a licensee's responses to a final 

round of RAIs. 

Surrogate element-- a representative element used in an SPRA to account for the effects of the components 

that are screened out during the walkdown and screening phase of the SPRA. The failure of a single 

surrogate element represents the failures of several screened components. 

Systematic Evaluation Program (SEP) - an NRC program for examining plants that were licensed before 

the agency issued the 1975 SRP guidance on regulatory issues. 

Technical evaluation report (TER) - a report that describes the technical findings of the review of a 

licensee's IPEEE submittal and associated documentation. 

Tier 2 documentation- information retained for audit by a licensee, as specified in Section 8.2 ofNUREG

1407. In general, Tier 2 documentation consists of information and materials that the licensee used in 

preparing its IPEEE but did not include in its submittal to the NRC (for example, notebooks and detailed 

calculations), and that by the licensee keeps at the plant site or the corporate office. 

Tornado-generated missile - an object that is lofted and transported by a tornado. 

Transient - a perturbation in the state of some system or component at full reactor power that initiates a 

deviation from the full-power, steady-state operating conditions. Transients that are of interest consist of 

those where the plant systems cannot respond to the deviation in time to restore the plant to its full-power, 

steady-state conditions before one or more monitored parameters deviates outside of the acceptable operating 

bounds. Such parameters that exceed operating bounds will trigger events that lead to a reactor scram, which 

would then call upon operation of the safety-related core heat removal systems. 

Transient combustibles - Combustible materials that can easily be moved or stored either temporarily or 

on a long-term basis. Transient combustibles are typically associated with maintenance, plant modifications, 

poor housekeeping, or the temporary accumulation of waste materials or storage within the plant. 

Transportation and nearby facility accidents - potentially adverse events that are associated with 

manmade hazards that may occur sufficiently close to the plant to cause an initiating event. Transportation 

accidents involve moving vehicles (i.e., planes, ships, barges, trucks, and railroad cars) that pass near the 

plant and may potentially cause an explosion that results in significant over pressure loads and missiles; 

impact with plant structures or components; or a release of hazardous material and formation of a traveling

Glossary- 13
vapor cloud with the potential for ignition, explosion, or toxic conditions. Nearby facility accidents involve 

incidents at industrial facilities located within a local proximity to the plant, with possible release of 

hazardous materials, rupture of a pipeline carrying a hazardous gas or liquid under pressure, and other 

undesirable events. 

Uncertainty analysis-- an evaluation process to quantify the epistemic variability in a PRA estimate which 

derives from incomplete knowledge in formulating PRA models and incomplete knowledge of input 

variables. 

Uniform hazard spectrum (UHS) - a response spectrum for which there is a constant annual frequency of exceedance of spectral values across all vibration periods. A uniform hazard spectrum is constructed as 

a plot of independently predicted spectral values - each having a given hazard (i.e., annual exceedance 

frequency or return period), a given confidence level (e.g., 50th percentile for a median spectrum), and a 

given damping value (typically 5%)-- versus the vibration frequencies (or vibration periods) associated with 

the spectral values. 

Unit - a single nuclear power reactor with its associated structures, systems, and components. (Nuclear 

power plant sites may have one or more units. At sites having multiple units, some support systems may be 

shared between units.) 

Unresolved safety issue (USI) - according to NUREG-0933, "A Prioritization of Generic Safety Issues," 

a USI is a matter affecting a number of nuclear power plants that poses important questions concerning the 

adequacy of existing safety requirements for which a final verification has not yet been developed and which 

involves conditions that are not likely to be acceptable over the lifetime of the affected plants. 

USI A-17 - Unresolved Safety Issue (USI) A-17, "Systems Interaction in Nuclear Power Plants." 

USI A-45 - Unresolved Safety Issue (USI) A-45, "Shutdown Decay Heat Removal Requirements." 

USI A-46 - Unresolved Safety Issue (USI) A-46, "Verification of Seismic Adequacy of Equipment in 

Operating Plants," which is intended to assess the seismic ruggedness of safety-related equipment to 

withstand a safe shutdown earthquake in those plants with construction permit applications docketed before 

about 1972. 

Walkdown - an inspection of local areas within and around a nuclear power plant during which systems, 

components, structures, hazard sources, etc., are physically located and examined, in order to collect relevant 

plant information; verify plant configuration; evaluate the potential significance of hazards and adverse 

configurations; verify the location of important equipment; assess the adequacy of installation/construction, 

condition, and operating status of equipment; ascertain any environmental effects or system interaction effects 

on equipment, which could occur during accident conditions. (It should be recognized that the seismic 

walkdown, fire walkdown, and HFO walkdown each have distinct objectives and procedures, although the 

walkdown treatment of interactions among these events (e.g., seismic-fire interactions or seismic-flood 

interactions) usually involves a joint set of objectives and procedures.) 

Glossary - 14

I II
APPENDIX A - GUIDANCE ON IPEEE-RELATED REQUESTS FOR 

ADDITIONAL INFORMATION 

The staff developed and used the following guidelines to determine when to send requests for additional 

information (RAIs) to licensees in order for the staff to complete its IPEEE reviews. 

0 It is not possible to conclude that the licensee met the intent of the IPEEE generic letter in one or 

more particular area(s). 

* The response to the RAI is necessary to complete the final assessment of the submittal. 

a The methodology and/or data used in the submittal is unacceptable, which could result in incorrect 

ranking or screening, masking, underestimating, or incorrect evaluation. See Table A. 1 below. 

0 Information in response to the RAI would be likely to uncover a significant problem with the results, 

such as incorrect ranking or screening, masking, underestimating, or incorrect evaluation. See Table 

A.1 below. 

0 A plant has a significant assumption or result that is different from other plants in the same group 

(and the basis or justification is not provided), which could result in incorrect ranking or screening, 

masking, underestimating, or incorrect evaluation. See Table A. 1 below. 

Table A.1: Guidance for issuing RAls

A-I

incorrect ranking or screening; or significant risk contributor 

masking significant plant vulnerability 

important fire areas 

significant fire scenarios 

underestimating plant fire or seismic CDF 

incorrect evaluation core damage frequency 

containment response 

high-confidence of low-probability of 

failure (seismic)
In general, the staff did not send RAIs under the following circumstances.

* There could be a potential weakness, but the response to the RAI would not add to the review or 

would not provide any significant additional insights. 

0 Information provided in response to the RAI would not contribute to the review or would not impact 

the assessment of the submittal conclusions or vulnerabilities. 

0 The response to the RAI would not alter the scenario rankings. 

0 Issuing an RAI to many licensees does not constitute sufficient reason to issue it to another licensee. 

0 Documentation is weak but, in general, the results are "typical" of what would be expected. 

In issuing RAIs, the staff considered the following guidelines. 

The question(s) should be specific. Ask focused questions aimed at a particular issue. For example, 

do not ask open-ended questions, such as "provide more information about your treatment of human 

error probabilities (HEPs)." Instead, ask questions, such as "identify the scenarios screened from 

further analysis based on quantification of HEPs, and discuss how the effects of postulated fires were 

considered in determining HEPs." 

Ask the question(s) in a way that is clear to the licensee and requests specific information. Avoid 

asking questions that can be answered "yes" or "no" without providing additional necessary 

information. 

The RAI should not ask for additional analyses or sensitivity studies, unless such analyses were 

called for in the IPEEE submittal guidance (i.e., NUREG-1407) and one or more of the guidelines 

on the previous page apply. Instead, if an assumption or parameter in the submittal appears to be 

optimistic, provide background related to the issue being addressed, and ask the licensee to either 

provide a basis for using the parameter in question or repeat the analysis using a value that can be 

justified. 

Each question should be reviewed by someone other than the author to ensure that it is clear and not 

subject to alternative interpretations. The reviewer should check each question against the guidelines 

listed above. 

A-2

I II
APPENDIX B - GENERIC RAIs RELATED TO THE FIRE PRA 

IMPLEMENTATION GUIDE 

B.1 Background 

In preparing their IPEEE, a number of licensees have applied the Fire PRA Implementation Guide (FPRAIG 

or simply "the Guide"), which the EPRI published in December 1995 [EPRI, 1995]. The FPRAIG provides 

both general and specific guidelines for performing a fire PRA. The NRC sponsored a review of the FPRAIG 

from the perspective of the IPEEE program needs [Lambright, 1997]. This review found that (1) the overall 

fire PRA approach suggested by the FPRAIG is consistent with the current fire PRA state-of-the-art, (2) some 

of the detailed discussions on fire PRA methods and issues "are an improvement over what can be found in 

the open literature," and (3) the Guide also provides useful, practical tips, notations, and cautionary 

statements. However, the review also found that the Guide contains a number of shortcomings "that could 

potentially lead to either optimistic results or masking of information needed for identifying potential 

vulnerabilities." The review recommended a set of 15 generic RAI questions that the staff could ask of 

licensees that employ the FPRAIG.' Subsequent IPEEE reviews identified one additional shortcoming that 

led the staff to add a 16th generic RAI to the list. 

Following the FPRAIG review, the NRC and EPRI jointly agreed to an approach for resolving the generic 

RAIs in a manner that is suitable for the IPEEE program. Consistent with the IPEEE intent, the objective of 

the resolution approach was not to define nor advance the state-of-the-art but, rather, to ensure that IPEEEs 

that relied on methods documented in the Guide were capable of identifying plant fire vulnerabilities. This 

approach led to specific suggestions concerning how licensees should respond to each of the 16 generic RAIs. 

The following discussions address these generic RAIs, the concerns raised, and the resolution strategies that 

EPRI ultimately recommended to licensees. Note that the discussion of how the resolution of these issues 

might have impacted the results or insights of an IPEEE fire analysis is deferred to the body of this report. 

B.2 Human Error Probabilities for the Fire Screening Analysis 

A licensee's PRA typically credits a variety of human actions, which typically relate to manual actions that 

are used to recover or bypass a failed system, or to remotely operate a system or component. The internal 

event models typically include credit for human recovery actions and include an associated human error 

probability (HEP) for each credited action. These same internal event models are commonly adapted for use 

in a fire analysis. However, during a fire, some of the recovery actions credited in the internal event analysis 

might not be possible or might be associated with higher HEP values. 

For example, recovery actions that require passage through, or entry into, an area that is impacted by a 

postulated fire (e.g., the area where the fire occurs or an adjacent area that might be impacted by smoke and 

heat from a fire) would not typically be credited in the analysis of that fire scenario. Similarly, if the normal 

path to the location of a credited recovery action is blocked, but an alternate path to the location is available, 

a higher HEP might be assigned. 

The review also identified a number of concerns that were not reflected in the generic RAIs, 

either because their verification was deemed not to be essential to the IPEEE process, or because they 

were deemed not to affect a large number of studies.

B-I
In the original guidance provided in the FPRAIG, direct use of the internal event models was allowed for a 

number of situations. This inherently included credit for all modeled human recovery actions using the 

internal events HEP values. This neglected the potential impact of fire on the credited operator actions. The 

primary concern of IPEEE reviewers was that crediting such human actions without review during the fire 

area/zone screening analysis might lead to premature screening of potentially important fire areas/zones. 

The generic RAI asked licensees to explain how fire effects were treated in assessing the reliability of 

credited human actions and to assess the impact on fire area screening if such actions were not credited. The 

revised EPRI guidance ultimately recommended that licensees (1) re-examine the human recovery actions 

credited in the fire analysis to ensure that the actions were possible given the fires being postulated, and 

(2) assess any potential fire effects on the reliability of the credited actions. One specific issue in fire PRA 

involves the treatment of operator actions taken within the main control room. For the purposes of the IPEEE 

process, EPRI recommended that such actions could be assumed to be unaffected by fires outside the main 

control room. 

B.3 Heat Loss Factors and Simplified Hot Gas Layer Modeling 

The FIVE method implemented a simplified approach to enclosure fire response modeling, which was also 

adopted under the FPRAIG. That is, rather than exercising a fire model for each fire scenario, engineering correlations (in the form of tabular worksheets) were adopted to estimate fire plume, ceiling jet, and hot gas layer exposure conditions for a given fire in a given fire zone. 

One important aspect of enclosure fire modeling is heat transfer to the enclosure surfaces. Testing has shown 

that enclosure surfaces absorb a significant amount of heat during a fire, and this moderates the resulting air 

temperatures within the enclosure. Most enclosure fire models address this behavior through direct modeling of surface heat transfer. The correlations used are generally both complex and time-dependent. One of the 

significant simplifications invoked in the FIVE/FPRAIG correlations is that heat losses to enclosure surfaces 

are addressed through a heat loss factor (HLF). The HLF was defined as the fraction of the heat generated by the fire that is assumed to be lost to the enclosure surfaces. Heat lost to the surfaces is not available to heat 

the air within the room. Under the FIVE/FPRAIG approach, the HLF is assumed to be constant for a given 

fire scenario, and its value is selected by the analyst. 

FIVE recommended using an HLF of 0.7; that is, 70% of the fire's heat is lost to the enclosure surfaces. In 

the NRC reviews of FIVE,2 this value appeared to yield reasonable estimates of hot gas layer response. The 

FPRAIG endorsed the use of these same engineering correlations, but recommended that HLF values ranging from 0.85 to 0.94 were more appropriate. These values were derived from "An Experimental Study of Upper Hot Layer Stratification in Full-Scale Multi-room Fire Scenarios" [Cooper, 1982]. 

The NRC recommendation for using substantially higher HLF values as a point of potential concern because 

the HLF directly impacts the assumed plume, hot gas layer, and ceiling jet temperatures obtained from the 

correlations. For example, with an HLF of 0.94, just 6% of the total fire heat release is assumed to be 

available to heat the air in the enclosure. In contrast, with an HLF of 0.7, 30% of the total fire heat release 

is available to heat the air. As a result, raising the HLF from 0.7 to 0.94 meant that only one-fifth as much 

2 The NRC reviewed the FIVE methodology during its development in the late 1980s, and a part 

of that review involved comparing of the FIVE hot layer correlations to experimental data. 

B-2

I II
heat would go into the hot gas layer and, in turn, the predicted hot gas layer temperature increases would be 

reduced by 80%. The temperature increases in the plume and ceiling jet, but to a lesser degree and in a less 

predictable manner. This is because the general hot layer temperature increase is only one of the factors in 

estimating the plume and ceiling jet temperature increases. 

In support of efforts to resolve this concern, a series of validation calculations were performed. These 

calculations were aimed at assessing the impact of changes in the HLF value on estimated hot gas layer 

temperature, and comparing the correlation's predictions with large-scale fire experiments [Nowlen, 1987]. 

The results were obtained through a comparison between the maximum hot gas layer temperature predicted 

by the engineering correlation using three HLF values (0.7, 0.85, and 0.94) to the maximum temperatures 

measured during full-scale tests over a range of room elevations.' 

In all cases, an HLF of 0.94 led to significant underestimation of the measured hot gas layer temperature. 

Using an HLF value of 0.85 also underestimated the hot gas layer temperature for most cases. In only one 

case did an HLF value of 0.85 yield a predicted temperature increase that fell within the range of the 

measured data. Use of the FIVE-recommended value of 0.7, however, led to results that compared quite 

favorably with the test data. In most cases, using an HLF of 0.7 yielded a temperature that modestly bounded 

the measured data. In four cases, the predicted temperature increase did not fully bound the measured data 

but, in all such cases, the prediction did fall within the range of the experimental data. 

As a second exercise, the actual heat loss factors experienced during two fire test programs were estimated 

[Nowlen, 1987 and Cline, 1983]. The HLFs in the tests nominally ranged from 0.5 to 0.7. Some limited 

cases had HLF as low as 0.3. While these results contain considerable uncertainty, they do illustrate a 

nominal consistency with the correlation results, as described above. 

The revised EPRI guidance directs licensees to two possible approaches for responding to the generic RAI. 

In general, the guidance recommends returning to the original FIVE HLF value of 0.7. The major exception 

is for cases where the fire source is assumed to be located at or above 40% of the room height. One factor 

in the hot gas layer correlation is the assumed hot gas layer volume. FIVE recommends that if the fire source 

is modeled as being elevated above the floor, such as a fire on top of a panel or transformer, only the room 

volume above the fire source elevation should be assumed to be involved in the hot gas layer. In effect, 

reducing the room volume tends to offset an increase in the HLF. 

B.4 Modeling of Cable Tray Fire Growth 

The growth of fire in a stack of cable trays is a common fire PRA scenario. Past practice has generally relied 

on predictive fire models such as COMPBRN [Ho, 1991] for this analysis. The FPRAIG introduced an 

approach to modeling the growth of cable tray fires by extrapolating fire test data. In particular, the approach 

relied on the fire spread behavior noted in a 1976 NRC-sponsored fire test [Klamerus, 1977] as documented 

by Nowlen [Nowlen, 1989]. Nowlen's description included the approximate time the fire was observed to 

spread from tray to tray during the test. The FPRAIG recommended using these reported fire spread times 

as a general model of cable tray fire propagation. 

3 The correlation can also be exercised in a pseudo-transient format that predicts the temperature 

increase over time. These results are not illustrated, but follow the same overall pattern of behavior.

B-3
A concern with this approach was that it effectively assumes that all cable tray fires will follow the behavior 

observed in a single test. Of particular concern was the fact that the test in question was designed to simulate 

a self-ignited cable fire. Hence, no external fire source was present during the period of tray-to-tray fire 

spread. Application of this limited test result to other fire scenarios appeared to be inappropriate and 

potentially optimistic, especially for fire scenarios that involved exposure to an external fire source. 

Furthermore, in applying the FPRAIG guidance, a number of IPEEE analysts assumed that the FPRAIG 

model also predicted fire damage times. That is, licensees assumed that fire spread was the indicator for 

thermal damage when, in fact, cables can be damaged before they are ignited. 

A review of other cable fire tests [Newman, 1983 and Sumitra, 1982] revealed that cable tray fires could 

spread substantially faster than was observed in the cited 1976 test, particularly under conditions involving 

exposure to an external fire. However, EPRI demonstrated that the combination of the tray-to-tray spread 

model and the FPRAIG-recommended fire heat release rate model for each tray did yield reasonable 

estimates of the total fire heat release rate for a range of fires, including those cited in the generic RAI. 

Hence, the resolution of this issue involved something of a compromise. 

For the purposes of the IPEEE process, use of the fire spread model recommended in the FPRAIG was found 

to be acceptable, provided that the fire scenario did not involve substantial exposure to an external fire. 

Furthermore, the model was only to be used to predict fire heat release rates. An independent assessment 

of cable damage was also required. 

B.5 Main Control Room Abandonment 

In a fire PRA, it is common to assume that a severe, unsuppressed fire in the main control room (MCR) will 

lead operators to abandon the MCR and rely on remote shutdown. The FPRAIG recommended using a 

conditional probability of abandonment given an MCR fire of 3.4E-3. This value was derived by interpreting 

data from a small number of actual control room fires and from NRC-sponsored electrical panel fire tests 

[Chavez, 1987 and 1988]. The interpretation was that operators would have at least 15 minutes after 

detecting a fire to suppress the fire before a forced abandonment would be required. A further assumption 

was that, because the MCR is continuously manned by well trained staff, fire detection would occur with little 

or no significant time delay. In particular, it was assumed that operators would smell a fire with an equal 

level of reliability and as quickly as would fire detectors that had been optimally placed within the fire source 

panels during the cited fire tests. 

The NRC review of the FPRAIG revealed that the recommended approach did not adequately consider 

MCR-specific design features. The approach was considered optimistic for some MCRs, including those that 

do not have in-panel smoke detection available. It was also considered potentially optimistic for MCR 

configurations that use electrical panels as ventilation system return air plenums. In such cases, smoke from 

a panel fire would likely be drawn quickly into the ventilation exhaust. There, dilution of the small quantities 

of smoke associated with the incipient fires observed at the time of detection in the fire tests would mean that 

ventilation duct smoke detectors would likely not actuate. Under such conditions, the prompt detection times 

indicated by the test would likely be optimistic when detection in practice relies on operators smelling the 

smoke from the incipient fire. 

An additional complication of this particular generic RAI was the fact that some IPEEE analyses also applied "severity factors" to adjust the MCR fire frequency, typically to reflect prompt detection and suppression of 

B-4

I II
MCR fires. Because the conditional probability of 3.4E-3 directly credited fire detection and suppression, 

application of an additional fire severity factor was found, in effect, to represent "double counting" the same 

mitigating behaviors. Using this approach, a number of IPEEEs screened MCR abandonment scenarios as 

being risk insignificant, and did not assess the plant's remote shutdown capabilities in the event of a 

challenging MCR fire. Given the insights gained from past PRAs, and the results of other IPEEEs, the 

screening of MCRs on such a basis was considered to be potentially optimistic and inappropriate. 

The accurate treatment of serious MCR fires and subsequent MCR abandonment is a difficult challenge for 

fire PRA and, in many regards, is beyond the current state-of-the-art for fire PRA. The IPEEE process was 

specifically not intended to advance the state-of-the-art. Hence, for the purposes of the IPEEE process, the 

NRC agreed that licensees could apply the conditional abandonment probability of 3.4E-3 as a nominal 

estimate of the non-suppression/abandonment probability, but should not apply any severity factors. That 

is, the likelihood of MCR abandonment was to be taken to be the MCR fire frequency (typically assumed to 

be 1.9E-2) times the conditional abandonment probability (3.4E-3). The NRC, therefore, directed licensees 

not to screen MCR abandonment scenarios and to provide an assessment of remote shutdown capability and 

reliability. 

B.6 Recovery of Fixed Fire Suppression Systems 

Fixed fire suppression systems are widely used to enhance fire safety in United States nuclear power plants. 

These systems are also important factors in a fire risk analysis. In fire PRA, it is common to find that fixed 

fire suppression systems offer a substantial risk benefit. Depending on the timing of system actuation versus 

critical damage, fire scenarios may be of potential risk importance only if a fire suppression system is 

assumed to fail on demand (for example, as a result of failures in supporting equipment). Licensees 

commonly apply generic failure rates to assess the likelihood of such failures. 

The FPRAIG included an approach for crediting recovery of a failed fire suppression system. Many types 

of fire suppression system failures are recoverable. For example, a system inadvertently left in manual 

actuation mode may be recovered (or actuated) by a simple flip of a switch (provided that no damage to the 

system has occurred). If fire-fighting personnel arrive on the scene of the fire and find that a fixed 

suppression system has not actuated, they will likely attempt to recover and/or manually actuate that system. 

It was noted that the FPRAIG approach did not address some potential dependencies. In particular, attempts 

by fire fighters to recover a fixed suppression system would likely delay initiation of other manual fire

fighting actions. If the recovery attempts are not successful, the fire, which would have continued to grow, 

may present a greater challenge to subsequent manual fire suppression. 

EPRI, therefore, provided revised guidance directing licensees to re-examine scenarios that credited both 

recovery of a failed fixed system and manual fire-fighting. Specifically, licensees were asked to consider 

the impact of the recovery attempts on the timing of subsequent fire-fighting efforts and the potential for 

additional fire growth while recovery was attempted. In particular, attention was directed to rooms that are 

protected by CO2 or Halon systems. In such cases, fire fighters might be especially hesitant to enter the area 

knowing that an attempt was being made to actuate the fire suppression system.

B-5
B.7 Control Systems Interactions

The fire-induced failure of an electrical cable will lead to some type of circuit fault. How a cable failure will 

be manifested in the circuit depends on the purpose of the cable in the circuit (i.e., power, instrument or 

control), the circuit design, and the assumed mode of cable failure. For example, conductor-to-conductor 

"hot shorts" might lead to spurious component actuations, whereas a short to ground on the same conductors 

might lead to a loss of system power and/or control. These behaviors, and other related issues, are broadly 

referred to as control system interaction (CSI) issues. 

The CSI issues are also interrelated with the question of fire in the MCR as well as MCR abandonment 

scenarios. Depending on a plant's safe shutdown strategy, MCR abandonment may be initiated as a result 

of fires in the MCR itself and/or fires in other critical plant areas (the cable spreading room being a common 

example). It is important that remote shutdown functions be independent of fire damage and the circuit faults 

that might occur in such areas. 

The treatment of fire-induced CSI is a point of both regulatory and PRA interest. In 1989, the Fire Risk 

Scoping Study (FRSS) [Lambright, 1989] concluded that the then current fire PRA methods did not fully treat 

the CSI issues. The CSI issues are arguably one of the most difficult challenges currently facing fire PRA. 

The potential circuit interactions of interest to fire PRA are complex and difficult to analyze [LaChance, 

2000]. The methods of analysis available at the outset of the IPEEE process were both limited and subject 

to debate. 

The FPRAIG provided some guidance for resolving the CSI issues. However, the guidance did not consider 

all potentially important aspects of the CSI issues. Hence, the NRC developed a generic CSI-related RAI and 

discussed with EPRI. The generic RAI requested that licensees provide additional discussion and analysis of four specific areas of potential importance to fire PRA. In general, the NRC did not expect licensees to 

advance the state-of-the-art in their IPEEE analyses. Ultimately it was agreed that licensees' ability to fully 

address the CSI issues in their IPEEEs was clearly impacted by limitations in the state-of-the-art. 

Furthermore, a range of related regulatory activities are underway to address CSI concerns. Hence, for the 

purposes of the IPEEE process, licensees were asked to address one specific aspect of CSI, namely, the 

independence and reliability of remote shutdown. Licensees were directed to provide an assessment of their 

remote shutdown capability to ensure that it was independent of fire-induced failures in the areas where fires 

might force an MCR abandonment, and to assess the capability and reliability of the plant's remote shutdown 

features. 

B.8 Other Fire Risk Scoping Study Issues 

In addition to the CSI issues discussed above, the NRC requested that licensees address three issues raised 

in the FRSS, namely, seismic-fire interactions, smoke control and manual fire-fighting, and the adverse 

impact of fire suppression systems. In its letter accepting the use of FIVE in the IPEEE process, the NRC 

noted shortcomings in the guidance for verifying the FRSS issues [U.S. NRC, 1991]. The FPRAIG largely 

adopted the same guidance regarding these issues as in the FIVE methodology, without addressing the 

shortcomings identified by the NRC. Hence, the NRC developed three additional generic RAIs, one relating 

to each of these three issues. 

B-6

1 11
In its response, EPRI provided additional guidance to licensees relating to the three issues. For example, in 

the area of seismic-fire interactions, EPRI's revised guidance recommended that licensees consider the 

seismic ruggedness of installed fire suppression systems, the potential for spurious actuation of fire 

suppression systems, the possible impact of an unsuppressed fire following an earthquake, personnel response 

to spurious fire alarms that might mask a real alarm, and the impact of spurious suppression system actuations 

on operator actions required to respond to an earthquake. Licensees were also directed to describe the 

walkdown approach used to address each issue and document the results obtained in those walkdowns. 

B.9 Screening of Fire-Induced Special Initiators 

As defined in the FPRAIG, a "special initiator" trips the plant and causes loss of a mitigating safety system. 

Examples include loss of service water and loss of component cooling water. For some plants, an 

unrecovered special initiator can lead directly to core damage. Hence, special initiators are potentially 

significant risk contributors if, as in a fire, there is a potential for common mode failure in multiple mitigating 

safety systems. 

One step in the FPRAIG stated that licensees should "consider the need to locate equipment and cables for 

those special initiators whose (non-recoverable) frequency is greater than 1E-4/yr." This implied that if the 

initiation frequency was less than 1E-4/yr, the special initiator scenarios could be screened. A concern with 

this implied screening criterion is that it might lead to premature screening of potentially important fire risk 

scenarios. In the worst case, a fire scenario leading directly to core damage (i.e., without additional 

independent equipment failures) with an initiating frequency of 1 E-4/yr would clearly represent a dominant 

fire risk scenario, if not a fire vulnerability. Following discussion of the concerns, EPRI provided revised 

guidance that deleted this particular step in the analysis. Licensees were directed to re-examine any fire 

scenarios that might have been screened using the original guidance. 

B.10 Screening of Enclosed Ignition Sources 

The FPRAIG process for screening ignition sources was founded on an assessment of the potential that each 

ignition source might lead to propagation of fire to other combustibles. One aspect of this screening was to 

"eliminate from further consideration situations where ignition sources are fully enclosed, making them 

unable to ignite other combustibles." The IPEEE reviewers found that licensees were broadly applying this 

criterion to screen a range of ignition sources. 

Therefore, a concern was raised that this approach might prematurely screen some ignition sources. In 

particular, some ignition sources have the potential to breach their enclosures. The generic RAI cited 

transformers and electrical panels as example cases. An electrical panel fire, for example, may generate 

sufficient heat to warp the panel's doors, thereby allowing fire to escape despite the lack of other openings. 

Fire experience also includes cases where an energetic electrical fault allowed fires to breach an electrical 

enclosure. 

Following discussion of the issue, EPRI provided revised guidance directing licensees to re-examine a 

number of fire ignition sources to determine if they were prematurely screened. These sources included 

transformers of greater than 480V, switchgear, any electrical panel of 480V or greater fed by a high-energy 

source (such as a diesel generator or transformer) and motor control centers of 480V or greater. With certain 

specific case-by-case exceptions, licensees were to re-evaluate these sources as "open ignition sources."

B-7
B.11 Electrical Control Panel Heat Release Rates

Fire scenarios involving a fire in an electrical panel that threatened overhead cables were quite common in 

the IPEEE fire analyses. In assessing fire propagation and/or fire damage associated with such fires, the 

assumed heat release rate (HRR) of the initial panel fire source can be critical. The FPRAIG recommended 

that most panel fires could be modeled using an HRR of 65 BTU/s (69 kW). This recommendation was 

primarily based on interpretation of NRC-sponsored electrical control panel fire tests [Chavez, 1987 and 

1988]. 

IPEEE reviewers found that the recommended panel fire HRR may be optimistic for a number of electrical 

panels because the cited HRR values did not bound the referenced tests, the referenced tests did not address 

fires involving electrical distribution panels, and the results of other panel fire tests [Mangs, 1994 and 1996] 

were not considered. The overall concern was that if panel fires were assumed never to exceed 65 BTU/s 

(69 kW), a fire risk study might prematurely screen some electrical panel fire scenarios. 

In response, EPRI provided revised guidance for licensees to use in assessing the fire potential for electrical 

panels. First, the guidelines established for when it was appropriate to assume an HRR of 65 BTU/s (69 kW). These guidelines reflected the actual test conditions under which panel fire sizes were indeed so limited, 

namely, panels containing only qualified cables (per IEEE-383 flame spread testing) and panels where the 

fuel load was concentrated in individual cable bundles such that fire spread beyond a single cable bundle 

could be dismissed. Second, for all other panels, licensees were directed to reconsider the risk contribution 

should the IRR be increased to 190 BTU/s (200 kW). The higher HRR value was largely based on the 

results of the panel fire tests in Finland [Mangs, 1994 and 1996]. 

B.12 Screening of Fire Sources Based on Non-Combustible Shields 

One criterion that the FRAIG cited for screening fire sources was the presence of a non-combustible shield 

between the source and key targets. IPEEE reviewers found that this criterion would be overly optimistic for some cases, particularly those cases involving high hazard combustibles (such-as large oil sources), where 

flames might impinge on the shield and where hot gases in the plume or hot layer might move around the 

shield to expose the targets. As a result, licensees might prematurely screen some fire scenarios. 

EPRI agreed with these observations, and provided additional guidance for licensees to use in the treatment 

of non-combustible shields. Specifically, licensees were directed to reconsider any fixed fire sources that 

were previously screened using the original guidance. In addition, licensees were directed to reconsider fire 

scenarios that involved potential plume, ceiling jet, and hot layer exposures that would not be impacted by such shields. The revised guidance also notes that it may be appropriate to limit the fire's "damage zone" 

associated with radiant heat transfer on the basis of the intervention of such shields between the fire and 

target. However, licensees were directed to take such credit only "if the shield is designed and maintained 

to protect against the source-target combination being considered." 

B.13 Screening of Transient Combustibles 

As a general rule, the FPRAIG recommended screening ignition sources if an analysis shows that the source 

poses no potential for either propagation to secondary fuels or damage to PRA targets. Furthermore, one 

passage in the FPRAIG stated that "if all fixed ignition sources in a zone screen, the zone probably will 

B-8

I II
screen." IPEEE reviewers noted that some licensees were interpreting this passage as allowing for direct 

screening of transient ignition sources if all of the fixed ignition sources screened. When applied in this 

manner, this passage might lead to premature screening of fire zones. 

In discussions with EPRI, it became clear that the intent of the FPRAIG authors was not to establish a 

transient fire screening criterion, and that some licensees were misinterpreting the guidance. The actual intent 

of the passage was to convey the likely outcome of the transient fire analysis, not to allow for screening of 

transients. That is, in many situations, transient fire sources do not represent significant fire threats. This 

is typically attributable to geometry considerations (for example, cables being located too far above the floor 

for a transient fire source to threaten). Hence, if the fixed sources screen, one might expect the transient 

sources to screen as well. However, there are cases where this observation does not apply. In particular, the 

assessment of target vulnerability based on fixed sources alone would be incomplete for areas where there 

are no significant fixed fire sources, or where the fixed fire sources are not located near the critical targets. 

In these cases, transient fire sources, which may occur anywhere in the room, might still represent significant 

fire risk contributors. EPRI, therefore, developed revised guidance to clarify that a specific analysis of 

transient fire sources is still needed even when the fixed fire sources have screened or are absent. EPRI also 

directed licensees to re-examine any fire zones that were screened without considering transient fire sources. 

B.14 Fire Suppression Criteria 

One additional aspect of the FPRAIG treatment of fire suppression led to another generic RAI. Specifically, 

the FPRAIG provided probabilistic curves for the likelihood of fire suppression versus time for a number of 

specific fire types (e.g., transients, welding fires, cable fires, panel fires, etc.). In one passage, the FPRAIG 

stated that fire suppression efforts could be considered successful if the source fire or any subsequently 

ignited targets were suppressed. The approach estimated the likelihood of successful suppression before 

damage as the product of two suppression terms, namely, the likelihood that the fire ignition source was 

suppressed before damage, and the likelihood that any subsequently ignited materials were suppressed before 

damage. For example, in a scenario involving a panel fire that spreads to overhead cable trays, an analyst 

might assess the likelihood for fire suppression within a given time as the product of the likelihood that the 

panel fire is suppressed times the likelihood that a cable fire is suppressed within that time. In effect, the two 

suppression probabilities are treated as fully independent when, in fact, the two are highly dependent because 

there is really only one consolidated fire and fire fighters will attack the overall fire, rather than attacking two 

separate fires. 

EPRI provided revised guidance clarify that there is one consolidated fire that requires suppression. The 

revised guidance states that if the fire does not spread beyond the fire ignition source, the likelihood of 

suppression is based on suppression of the fire source. However, if the fire does spread, for example to cable 

trays, the likelihood of suppressing the larger (cable) fire should be used. 

B.15 Cable Ignition Temperatures 

One aspect of fire growth modeling, as commonly applied in fire PRA, requires the analyst to establish 

temperature criteria for the ignition of combustible materials. The criteria for piloted ignition of cables (i.e., 

ignition of cables in the presence of a pilot flame) is a particularly common question encountered in nuclear 

power plant fire scenarios.

B-9
In 1991, an NRC-sponsored cable damage test program revealed that cable electrical failures and arcing often 

led to self-sustaining fires in the exposed cables [Nowlen, 1991] This lead to a conclusion that the piloted ignition temperature (the electrical sparks representing the pilot source) for the tested cables was at or below 

the damage threshold for those cables. 

The results of the NRC-sponsored tests were cited in the FIVE methodoloy, which recommended that, for 

cables, the damage temperature and piloted ignition temperature should be assumed to be the same. The most 

commonly applied value was 700'F (370'C) given the damage thresholds for IEEE-383 qualified cables. 

The FPRAIG recommended that 932°F (500'C) be used as the threshold for both piloted and spontaneous (i.e., in the absence of a pilot flame) ignition of cables. The higher value derives from earlier EPRI data 

extrapolation results [Tewarson, 1979]. However, it has since been shown that those extrapolations do not 

reflect the actual threshold behavior [Nowlen, 1989]. 

The NRC, therefore, developed a generic RAI to address this change in the assumptions related to piloted cable ignition criteria. Specifically, the RAI stated that using the higher piloted ignition temperature could 

lead to premature screening of fire growth scenarios. In response, EPRI issued revised guidance 

recommending that licensees return to the original FIVE guidance. 

B.16 References 

Chavez, J.M., "An Experimental Investigation of Internally Ignited Fires in Nuclear Power Plant Control 

Cabinets, Part I -Cabinet Effects Tests," SAND86-0336, NUREG/CR-4527, Volume 1, U.S. NRC, 

April 1987. 

Chavez, J.M. and S.P. Nowlen, "An Experimental Investigation of Internally Ignited Fires in Nuclear Power 

Plant Cabinets, Part II - Room Effects Tests," SAND86-0336, NUREG/CR-4527, Volume 2, 

U.S. NRC, October 1988. 

Cline, D.D., W.A. von Riesemann, and J.M. Chavez, "Investigation of Twenty-Foot Separation Distance as 

a Fire Protection Method as Specified in 10 CFR 50, Appendix R," NUREG/CR-3192, U.S. NRC, 

October 1983. 

Cooper, L.Y., et. al., "An Experimental Study of Upper Hot Layer Stratification in Full-Scale Multiroom Fire 

Scenarios," Journal of Heat Transfer, Volume 104, pp. 741-749, November 1982. 

EPRI, "Fire-Induced Vulnerability Evaluation (FIVE)," TR-100370, April 1992. 

EPRI, "Fire PRA Implementation Guide," TR-105928, December 1995. 

EPRI, "COMPBRN IIIE: An Interactive Computer Code for Fire Risk Analysis," EPRI NP-7282, May 199 1. 

Klamerus, L.J., "A Preliminary Report on Fire Protection Research Program (July 6,1977)," SAND77-1424, 

SNL, October 1977. 

LaChance, J., S.P. Nowlen, F. Wyant and V. Dandini, "Circuit Analysis - Failure Mode and Likelihood 

Analysis," letter report to the U.S. NRC, SNL, May 8,2000 (available through the U.S. NRC Public 

Document Room under memorandum from T.L. King, RES/DRAA, to G.M. Holahan, NRR/DSSA, 

and M.E. Mayfield, RES/DET, dated June 13, 2000, RES File Code RES-2C-1). Lambright, J., S.P. Nowlen, V.F. Nicolette, and M.P. Bohn, "Fire Risk Scoping Study: Investigation of 

Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," SAND88-0177, 

NUREG/CR-5088, U.S. NRC, January 1989. 

Lambright, J., and M. Kazarians, "Review of the EPRI Fire PRA Implementation Guide," a letter report to 

the U.S. NRC, Energy Research Inc., ERINRC 97-50 1, August 1997. 

B- 10
Mangs, J., and 0. Keski-Rahkonen, "Full Scale Fire Experiments on Electrical Cabinets," VTT Technical 

Research Centre of Finland, Publ. 186, Espoo, Finland, 1994. 

Mangs, J., and 0. Keski-Rahkonen, "Full Scale Fire Experiments on Electrical Cabinets II," VTT Technical 

Research Centre of Finland, Publ. 269, Espoo, Finland, 1996. 

Newman, J.S., "Fire Tests in Ventilated Rooms - Detection of Cable Tray and Exposure Fires," 

EPRI NP-2751, February 1983. 

Nowlen, S.P., "Enclosure Environment Characterization Testing for Base Line Validation of Computer Fire 

Simulation Codes," SAND86-1296, NUREG/CR-4681, U.S. NRC, March 1987. 

Nowlen, S.P., and V. Nicolette, "A Critical Look at Nuclear Qualified Electrical Cable Insulation Ignition 

and Damage Thresholds," SAND88-2161 C, published in Conference Proceedings of the Operability 

of Nuclear Systems in Normal and Adverse Environments, ANS/ENS, September 1989. 

Nowlen, S.P., "A Summary of the U.S. NRC Fire Protection Research Program at Sandia National 

Laboratories 1975-1987," NUREG/CR-5384, U.S. NRC, December 1989. 

Nowlen, S.P., "An Investigation of the Effects of Thermal Aging on the Fire Damageability of Electric 

Cables," NUREG/CR-5546, U.S. NRC, May 1991. 

Siu, N., and H. Woods, "The U.S. Nuclear Regulatory Commission's Fire Risk Research Program - An 

Overview," Proceedings from International Workshop on Fire Risk Assessment 

NEA/CSNI/R(99)26, 2000. 

Sumitra, P.S., "Categorization of Cable Flammability Intermediate-Scale Fire Tests of Cable Tray 

Installations," EPRI NP- 1881, August 1982. 

Tewarson, A., et. al., "Categorization of Cable Flammability Part 1: Laboratory Evaluation of Cable 

Flammability Parameters," EPRI, NP- 1200, October 1979. 

U.S. NRC,"Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," 

Generic Letter 88-20, Supplement 4, June 28, 1991. 

U.S. NRC, Letter from A.C. Thadani, NRC/NRR/DST, to W.H. Rasin, NUMARC, Subject: "NRC's Staff 

Evaluation Report on Revised NUMARC/EPRI Fire Vulnerability Evaluation (FIVE) Methodology," 

August 21, 1991 (see letter attachment, paragraph 4). 

B-11
APPENDIX C - PUBLIC COMMENTS AND NRC RESPONSES ON DRAFT 

NUREG-1742 

C.1 Introduction 

The NRC initially issued NUREG- 1742, "Perspectives Gained From the Individual Plant Examination of 

External Events (IPEEE) Program," Volumes 1 and 2, in April 2001 as a draft report for public comment, 

with the comment period ending on July 31, 2001. At that time, the NRC published notices in the Federal 

Register' announcing the availability of the report and requesting comments. The NRC also made the report 

available on the NRC's web site <http://www.nrc.gov/>. The NRC distributed the report to more than 500 

people and organizations. 

In response to the request for comments, the NRC staff received four letters. Table C. 1 lists the authors and 

organizations who submitted these comments. All comments received are available from the NRC's 

Agencywide Document Access and Management System (ADAMS) using the accession number listed in 

Table C. 1. 

Table C. 1: Submitted comments on draft NUREG- 1742

Nebraska Public Power 

District

John H. Swailes, 

V.P. of Nuclear Energy

7/06/01 011910159

2 Rochester Gas & Electric Dr. Raymond H.V. Gallucci 7/30/01 012130238 

Corporation 

3 BWR Owners Group J. M. Kenny, BWR Owners' 8/06/01 012190262 

Group Chairman 

4 Union Electric Company Dave Shafer, 8/06/01 012190272 

Superintendent, Licensing

In addition to these comments, as part of the IPEEE review process, the staff discussed the approach and 

results of draft NUREG- 1742 with the NRC's Advisory Committee on Reactor Safeguards on June 22 and 

July 12, 2001. 

The final version of NUREG-1742 addresses all of the comments that the NRC received. Specifically, the 

comments fell into three broad categories: 

'Federal Register, "NUREG- 1742, 'Perspectives Gained from the Individual Plant Examination 

of External Events (IPEEE) Program'; Draft for Comment," Vol. 66, No. 86, Page 22269, May 3, 2001.

C-1

1
(1) A number of comments were editorial in nature. Such comments are not reproduced in this 

appendix. However, the NRC corrected the text to reflect these comments where appropriate. 

(2) Some comments reflected a difference between the report's representation of a plant feature and the 

current plant condition. These comments are not reproduced in this appendix. However, the NRC 

reviewed the comments. The final report was revised to properly reflect the plant feature and the 

current plant condition. 

(3) Other comments related to the presentation of findings and perspectives, the potential uses of the 

findings, and the plant-to-plant comparisons that could be made. The next section of this appendix summarizes these comments and presents NRC staffs responses. 

C.2 Specific Comments and Responses 

This section summarizes the comments received, and presents the NRC staff s responses. 

(1) Comment: The report inappropriately compares core damage frequencies (CDFs) for internal 

fires, seismic external events, and HFO events with those for internal events. The comment raised 

the point that the nature of the process for determining the CDFs for the two analyses is significantly different. In the IPEEEs, a conservative screening analyses was performed to look for potential plant vulnerabilities. Even though some aspects of the IPEEE review used PRA techniques, it was still a 

screening analysis rather than a full-scope PRA. In many cases, conservative assumptions were used 

to bound the analysis and show that no vulnerabilities exist. In the IPEs, a less conservative, more 

realistic, assessment was performed. Thus, it is not appropriate to compare the IPEEE CDFs with 

the IPE CDFs. (Reference: see Table C. 1, #3) 

Response: It is true that most of the submittals indicated that the IPEEE results were generated using a more conservative approach than employed in the IPE. However, there were also instances 

where the staff observed that certain assumptions may have been overly optimistic (i.e., non

conservative). While recognizing the uncertainties with any CDF estimate, the staff believe that 

general comparisons between the IPEEE and IPE CDFs are reasonable. Therefore, NUREG- 1742 

does not provide plant-specific comparisons or evaluations, but provides general comparisons (e.g., by reactor type). The format for the figures, predominantly in Chapter 3, have been revised to make 

it clear that plant-specific comparisons are not intended. The "Scope, Limitations, and General 

Comments" and the "Uses of IPEEE Information" sections in the summary of this report have been 

revised to clarify the limitations when comparing quantitative CDF results. 

The typical fire assessment approach was to perform an initial qualitative screening. Areas that were qualitatively screened would be expected to be areas that would not lead directly to a fire initiation 

and would not cause the loss of safe shutdown function. To evaluate areas that did not screen, licensees typically applied a PRA approach with variable amounts of uncertainty, detail, and 

conservatism. Indeed, licensees used some of the IPE PRA information to evaluate the unscreened 

areas. Similarly in the seismic area, there were different levels of uncertainty and conservatism 

applied in evaluating seismic capacities. The amount of conservatism varied between analyses and 

was influenced by the analyst and the method chosen. The NRC staff did not evaluate the amount 

C-2

I I
of conservatism, and it is not clear what level of conservatism could be generically attributed to the 

IPEEE submittals. 

(2) Comment: The IPEEE was intended to be a vulnerability screening analysis, rather than a full

scope PRA and, as such, licensees used only the technical resolution needed to support that objective. 

NUREG-1742 identifies potential uses of the IPEEE information that would need a higher degree 

of precision than that presented in the IPEEE. Using the IPEEE (with low technical resolution) to 

resolve issues needing higher technical resolution could result in inaccurate conclusions. Therefore, 

using the IPEEE information requires careful consideration of the IPEEE objective and how it could 

affect the results. (Reference: see Table C. 1, #3) 

Response: We agree that those who use the IPEEE information need to carefully consider both 

the objective of the activity and the level of detail and completeness of the IPEEE information. We 

have revised the "Uses of IPEEE Information" in Section 1.4 of NUREG- 1742 to emphasize that 

care needs to be taken when IPEEE information is to be used. Anyone using this information needs 

to carefully consider the nature, quality, and completeness of the IPEEE analysis to ensure that the 

analysis is suitable, reasonable, and robust in the context of the desired application. 

(3) Comment: NUREG-1742 identifies substantial differences in the IPEEE results, without 

addressing the many differences between the plants' designs and sites. This could be misleading, 

and could lead to inappropriate conclusions. (Reference: see Table C. 1, #3) 

Response: We agree. We have enhanced the discussion of the scope of the IPEEEs and the 

limitations on using this information in the "Scope, Limitations, and General Comments" in Section 

1.3 of NUREG- 1742. 

C-3
NRC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER 

(2-89) (Assigned by NRC, Add Vol., Supp., Rev., NRCM 1102, and Addendum Numbers, if any.) 3201 3202 BIBLIOGRAPHIC DATA SHEET 

(See instructions on the reverse) 

2. TITLE AND SUBTITLE NUREG-1742, Vol. 1 

Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) 

Program 3. DATE REPORT PUBLISHED 

MONTH YEAR 

Final Report April 2002 

4. FIN OR GRANT NUMBER 

5. AUTHOR(S) 6. TYPE OF REPORT 

Technical 

7. PERIOD COVERED (Inclusive Dates) 

8. PERFORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address; if contractor, 

provide name and mailing address.) 

Division of Risk Analysis and Applications 

Office of Nuclear Regulatory Research 

U.S. Nuclear Regulatory Commission 

Washington, D.C. 20555

9. SPONSORING ORGANIZATION - NAME AND ADDRESS (IffNRC, typ 'Same as above," if contractor, provide NRC Division, Office or Region, U.S. Nuclear Regulatory Commission, 

and mailing address.) 

Same as above

10. SUPPLEMENTARY NOTES 

Alan M. Rubin, NRC Project Manager

11. ABSTRACT (200 words or less) 

The NRC requested by Generic Letter 88-20, Supplement 4, and NUREG-1407, that each licensee perform an IPEEE to 

identify and report all plant-specific vulnerabilities to severe accidents caused by external events. The external events 

considered included seismic events; internal fires; and high winds, floods, and other external initiating events including 

transportation or nearby facility accidents and plant-unique hazards. All currently operating U.S. nuclear power plants have 

completed their assessments. 

The objective of the NRC's IPEEE submittal reviews was to ascertain whether the licensees' IPEEE processes were capable of 

identifying severe accident vulnerabilities to such external events, and implementing cost-effective safety improvements to 

either eliminate or reduce the impact of those vulnerabilities. The reviews did not attempt to validate or verify the licensees' 

results. 

The purpose of this report is to document the perspectives gleaned from the technical reviews of the IPEEE submittals. These 

include a description of the overall IPEEE process and findings; conclusions regarding the dominant risk contributors for the 

major areas of evaluation; an overview of plant improvements; a description of the overall strengths and weaknesses in the 

licensees' implementation of the IPEEE evaluation methodologies; and an assessment of the overall effectiveness in meeting 

the IPEEE objectives.

12. KEY WORDSIDESCRIPTORS (List words or phrases that will assist researchers in locating the report.) 13. AVAILABILITY STATEMENT 

IPE, IPEEE, Probabilistic Risk Assessment, severe accident, seismic, fire, flood, tornado, earthquake, unlimited 

hurricane, Generic Letter 88-20, NUREG-1407, external events, Fire Induced Vulnerability Evaluation, 14. SECURITY CLASSIFICATION 

unresolved safety issue, generic safety issue, (This Page) 

unclassified 

(This Report) 

unclassified 

15. NUMBER OF PAGES 

16. PRICE

NRC FURM 3;•5 (2-8U)
UNITED STATES 

NUCLEAR REGULATORY COMMISSION 

WASHINGTON, DC 20555-0001 

OFFICIAL BUSINESS 

PENALTY FOR PRIVATE USE, $300
Federal Recycling Program