ML17329A492
| ML17329A492 | |
| Person / Time | |
|---|---|
| Site: | Cook  |
| Issue date: | 04/30/1992 |
| From: | INDIANA MICHIGAN POWER CO. (FORMERLY INDIANA & MICHIG |
| To: | |
| Shared Package | |
| ML17329A488 | List: |
| References | |
| NUDOCS 9205050338 | |
| Download: ML17329A492 (139) | |
Text
DONALD C. COOK NUCLEAR PL'ANT UNITS 1 AND 2 INDIVIDUALPLANT EXAMINATION OF EXTERNALEVENTS
SUMMARY
REPORT APRIL, 1992 Submitted By
$ gp%fh C$
AMERICANELECTRIC POWER SERVICE CORPORATION 9205050//8 9/0/0i-.-- -~
- DOCK 050003i5 P
~aj, t
I
~
'Ii I I
~ f Kt PI I J
'lII p
I~ yt ~
~ 'I
~
I ~ig I
m A
I' jC',I'IJ
INDIVIDUALPLANT X3DMINATION
SUMMARY
REPORT TABLEOF CONTIPFIS TOPIC
~PA E
1.0 EXECUTIVEFRIARY 2,0 1.1 Background and Objectives 1.2 Plant Familiarization 1.3 Overall Methodology 1.4 Summary of M@or Findings EXAMINATIONDESCRIPI'ION 2.1 Introduction 2.2 Conformance with Generic Letter and Supporting Material 2.3 General Methodology 2.4 Information Assembly 1-1 1-2 1-2 1-2 2-1 2-1 2-1 2-2 2-3 3.0 SEISMIC ANALYSIS 3-1 3.0.1 hlethodology Selection 3-1 3.1 Seismic 3.1.1 3.1.2 3.1.3 3.1.4 3.1.5 3.1.6 PRA Hazard Analysis Review of Plant Information and Walkdowns Analysis of Plant Systems and Structure Response Evaluation of Component Fragilities and Failure Modes Analysis of Plant Systems and Sequences Analysis of Containment Performance 3-1 3A 34 3-6 3-10 3-11 3-20 4.0 3.2 USI A-45, GI-131, and Other Seismic Safety Issues 3.2.1 GI-131 Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants 3.2.2 USI A-17 System Interactions in Nuclear Power Plants 3.2.3 USI A45 Shutdown Decay Heat Removal Requirements 3.2.4 Eastern U.S. Seismicity (The Charleston Earthquake) 3.2.5 Soil Liquefaction 3.2.6 Uniform Hazard Spectra Evaluation 3.2,7 Seismically Induced Flooding 3.2.8 Relay Chatter 3,3 References INTERNALFIRE ANALYSIS 4.0.1 Methodology Selection 4.0.2 Major Assumptions 4.1 Fire Hazard Analysis 4.2 Review of Plant Information and Walkdowns 3-21 3-21 3-21 3-21 3-'21 3-23 3-23 3-24 3-24 4-1 4-1'-1 4-2
TABLEOF CON'TENTS (Cont'd.)
TOPI 4,3 4.4 4.5 4,6 4.7 4.8 4.9 4.10 4.11 Fire Growth and Propagation Evaluation of Component Fragilities and Fire Modes Fire Detection and Suppression Analysis of Plant Systems, Sequences, and Plant Response Analysis of Containment Performance Treatment of Fire Risk Scoping Study Issues USI A-45 and Other Safety Issues Conclusions References PAGE 4-2 4-2 4-3 4-3 4Q 4.4 4-5 4-6 4-6 5.0 HIGH WINDS, FLOODS, AND OTHERS 5.0.1 USI AA5 Issue 5-1 5-1 5,1 5.2 5,3 5.4 Severe Winds and Tornadoes External Floods Transportation and Nearby Facility Accidents Others 5-5 5-13 5-19 5-29 I
6.0 LICENSEE PARTICIPATION AND INTERNALREVIEW TEAM 6-1 6.1 6.2 6.3 6.4 IPEEE Program Organization Composition of Independent Review Team Areas of Review, Major Comments, and Resolution of Comments Living IPEEE Program 6-1 6-2 6-2 6-2 7.0 8.0 PLANT IMPROVEMENTS AND UNIQUE SAFETY FEATURES SUiiMARYAND CONCLUSIONS 7-1 8-1
LIST OF TABLES TABLE 2.4-1 3.1.1-1 Cook Nuclear Plant IPEEE Information Sources Seismic Acceleration Level Probabilities
~PA E
2-5, 3-26 3.1.3-1 3.1.3-2 3.1,4-1 3.1;4-2 Scope of Seismic Fragility Assessment
- Buildings, Structures and Cranes Scope of Seismic Fragility Assessment
- Systems/Equipment Component and Structure Fragilities and HCLPFs Failure Probability for Modeled Components and Structures In Each Seismic Interval 3-27 3-28 3-30 3-36
'.1.5-1 3.1.5-2 3.1.5-3 3.1.54 3.1.5-5 3.1.5-6 3.1.5-7 3.1.5-8 3.1.5-9 3.1.5-10 3.1,5-11 3.1.5-12 Seismically Induced Initiating Event Frequencies Description of Seismic Event Tree Nodes Summary of Seismic PRA Results Dominant Contributors to Core Damage for the "Normal Power" Cases Dominant Contributors to Core Damage for the "LOSP" Cases Dominant Cutsets to Seismic Core Damage Frequency List of Containment Bypass Sequences Greater Than 1E-8 Sequences Meeting More Than 1 Screening Criteria Seismic Core Damage Frequency By Plant Damage State Seismically Induced Initiating Event Frequencies
- LLNL Summary of Seismic PRA Results (LLNL)
Sensitivity Analysis Results 342 3-43 3M 3-45 3-46 347 3-49 3-50 3-51 3-52 3-53 3-54 5.1-1 5.1-2 F-Scale Classification of Tornadoes Based on Appearance of Damage Fqjita-Pearson (FPP) Classifications 5-11 5-12 5,2-1 PMP and 100 Year Recurrence Rainfall Depths for Storms with Durations from 0,5 to 24 Hours 5-18 5.3A-1 Aircraft Accident Acceptance Criteria Calculations and Comparisons 5-23 5.4A-1 5.4A-2 Cook Chemical Source Quantities and Locations Peak Control Room Concentrations 5-32 5-33 6.2-1 Independent Review Team Representation 6-3
LISI'FFIGURES
~ FIGl~E
/
Constant Percentile Seismic Hazard Curves Using AllExperts Comparison of Median Seismic Hazard Curves PAGE 3-55 3-56 Comparison of Plant Design Ground Spectrum and 10,000 Year Median Uniform Hazard Spectrum for the Donald C. Cook Nuclear Plant 3-57
'.1.5-1 3.1.5-2 3.1.5-3 3.1.5-4 3.1.5-5 3.1.5-6 3.1.5-7 3.1.5-8 Event Tree for Determining Seismic Initiating Event Frequencies Small LOCA Seismic Event Tree Medium LOCA Seismic Event Tree Large LOCA Seismic Event Tree Steamline/Feedline Break Seismic Event Tree Loss of Essential Service Water Seismic Event Tree Loss of Offsite Power Seismic Event Tree Transient Without Steam Conversion Seismic Event Tree 3-58 3-59 3-60 3-61 3-62 3-63 345 3-66 Cook Nuclear Plant IPEEE Project Organization
1.0 EXECUTIVESUlVHNARY In November 1988, the U.S. Nuclear Regulatory Commission (NRC) staff issued Generic Letter 88-20, "Individual Plant Examination for Severe Accident Vulnerabilities - 10CFR50.54(t)," which established a
formal request for utilities to perform an Individual Plant Examination (IPE). In addition to the performance of the IPE, this letter requested utilities to identify potential improvements to address the important contributors to plant risk and implement improvements that they believed were appropriate for their plant.
In June 1991, the NRC issued Supplement 4 to Generic Letter 88-20, "Individual Plant Examination of External Events (IPEEE) forSevere Accident Vulnerabilities-10CFR50.54(f)," accompanied by NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," which provided guidance for the information to be reported back to the NRC.
This report provides the requested information for the Donald C. Cook Nuclear Plant, Units 1 and 2, regarding external events (excluding internal flooding). The internal flooding analysis is included in the "Donald C. Cook Nuclear Plant, Units 1 and 2, Individual Plant Examination for Internal Events."
1.1 Background and Objectives In its Severe Accident Policy Statement (50FR43621,)
issued in 1985, the NRC concluded that operating nuclear plants pose no undue risk to the public health and safety and that there is no present basis for immediate action on any regulatory requirements for these plants.
However, the Commission recognized,.
based on NRC and industry experience with plant-specific probabilistic risk assessments (PRAs), that systematic examinations are beneficial in identifying plant-specific vulnerabilities to severe accidents that could be fixed with lowwost improvements.
As a result, the Commission issued Generic Letter 88-20 in 1988, requesting that each licensee conduct an individual plant examination (IPE) for internally initiated events, including internal flooding.
Many PRAs indicate that, in some instances, the risk from external events could contribute significantly to core damage. In December 1987, an External Events Steering Group (EESG) was established by the NRC to make recommendations regarding the scope, methods and coordination nf the individual plant examination of external events (IPEEE). Ultimately, Supplement 4 to Generic Letter 88-20 was issued regarding external events.
The objectives of the IPEEE, as outlined in NUREG-1407, were:
1.
To develop an appreciation of severe accident behavior.
2.
To understand the most likely severe accident sequences that could occur with the Donald C. Cook Nuclear Plant under full power operating conditions.
3.
To gain a qualitative understanding of the overall likelihood ofcore damage and fission product releases.
4.
Ifnecessary, to reduce the overall likelihood of core damage and fission product releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents.
AEPSC has completed and documented an IPEEE for the Cook Nuclear Plant that has completely met these objectives.
This report, containing a summary of the methods, results, and conclusions, fullycomplies with the NRC request for information contained in Generic Letter 88-20, Supplement 4 and NUREG-1407.
In addition, the IPEEE was conducted according to the applicable sections of 10CFR50, Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants."
AEPSC has retained all supporting analyses, descriptions and files pertaining to the IPEEE.
These are available at AEPSC offices for NRC review as necessary.
1-1
1D Hant Familiarization The AEPSC IPEEE program for the Cook Nuclear Plant involved an extensive plant familiarization effort because the undertaking of a full-scope realistic IPEEE required careful analysis of the as-built, as-operated plant. To the extent possible, information gained during the internal events IPE for Cook Nuclear Plant was used for the IPEEE.
Nevertheless, additional walkdowns of the plant were performed and documented for seismic, fire and other external events.
As with the internal events analysis, differences were identiTied between Units 1 and 2, however, only Unit 1 was modeled for the base analysis.
19 Overall Methodology In performing the IPEEE, standard systems analysis and external event assessment practices as outlined in NUREG-1407 were used. Seismic, internal fires and other external events (e.g. high winds, floods, etc.) were analyzed in the IPEEE using the following methodologies:
Seismic: The seismic IPEEE was a Level I effort with a qualitative containment performance analysis. A seismic PRA (SPRA) approach using guidance described in NUREG/CRM40, "Procedures for the External Event Core Damage Frequency Analysis for NUREG-1150" and NUREG/CRA550, Vol. 3, Rev. 1, Part 3,
" Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External Events" was selected for Cook Nuclear Plant.
Both plant specifi seismic hazard curves and hazard curves developed by the Lawrence Livermore National Laboratory (LLNL)were used in the analysis. The seismic accident event trees and plant system models were taken from the internal events IPE and modified as necessary for seismic events.
Internal Fires: The internal fires analysis of the IPEEE was performed using a Level I PRA. This analysis is a new fire PRA and was done following the guidance identiTied in NUREG-1407.
The deficiencies of past firePRAs identified in NUREG/CR-5088 "FireRisk Scoping Study" were addressed in the Cook Nuclear Plant Fire PRA. The fire analysis utilized the internal events Level IIPRA to identify any additional containment
'performance issues unique to fire scenarios.
Other External Events: The other external events analysis of the IPEEE used a screening approach that meets the intent of that described in NUREG-1407.
1.4 Summary of Major Findings This section summarizes the major findings of the Cook Nuclear Plant IPEEE. First, the results of the core damage frequency quantification for each initiator are presented, Second, the dominant contributors leading to core damage for signiTicant initiating events are described.
Detailed discussion of these events can be found in their respective chapters of this report.
Seismic In general, no significant seismic concerns were discovered during the seismic IPEEE, Overall, the following conclusions were reached:
T
- 1. Core damage frequency based upon the Cook Nuclear Plant site specific seismic hazard curve is 1.83E-05, whereas core damage frequency based upon the LLNLseismic hazard curve is 3.07E-04.
This is due to the larger seismic frequencies of exceedance associated with the LLNLhazard curves.
and
- 2. Rankings of the dominant contributors to seismic core damage frequency remain the same regardless of ivhich seismic hazard curve is used to determine the component fragilities.
1-2
The initiating"events which dominate the analysis are:
~
~
~
~
1.
Steamline/Feedline Break 3.
Loss of Service Water System The dominant contributors to seismic core damage are:
1.
Loss of Electric Power Systems a.
600 VAC Transformers b.
Diesel Generator Fuel Oil Day Tank 2, Auxiliary Building seismic failure These contributors become significant after the Cook Nuclear Plant 0.2g design basis earthquake criteria is exceeded.
Seismic Containment Performance Summary:
\\
According to the fragility data, seismic failure of the containment building may occur due to the following causes:
failure of the containment rebar or failure due to soil pressures.
Of these two failure mechanisms, the soil pressure dominates.
Seismic containment damage for all the seismic intervals evaluated in the SPRA is calculated to be 2.02E-07/yr which contributes approximately 1% to the total seismic core damage frequency.
However, this value represents seismic containment failure and not a containment failure probability after containment is challenged following an accident.
A seismic Level II'containment performance is not required for the IPEEE (GL'8-20 Supplement 4), but containment performance was assessed by reviewing the seismic core damage sequences and, based on the progression of these sequences, making comparisons to the Level IIinternal events containment performance analysis. As an example, some of the results of seismic assessment include the following:
l.
A certain number of the most damaging seismic sequences involved a loss of decay heat removal (Emergency Core Cooling System (ECCS) or auxiliary feedwater to the steam generators) in conjunction with a failure of the containment spray system. Based upon the internal events IPE Level IIresults, core damage, in general, is expected to occur in the range of2-to4 hours after accident initiationifdecay heat removal is lost. Containment spray failure greatly reduces the availability ofwater cooling on the failed core in the containment reactor cavity after vessel failure. With less water in the cavity, containment pressurize at a much slower rate due to less steaming from the failed core and containment failure occurs much later in the accident. Again, this is a comparison to Level IIaccident progression.
2.
Other seismic quantification sequences failed due to ice condenser failure, which was speciTically modeled.
The ice condenser was not modeled within the internal events analysis due to its high availability, thus no analogies can be drawn.
However, with Cook Nuclear Plant being an ice condenser containment plant, chances of containment failure following an accident significantly increase after losing the ice condenser and containment failure could occur sooner in accident progression. Aftercontainment failure',
any water inside containment may boil off, thereby preventing ECCS from removing decay heat via recirculation mode, which would lead to core damage. Although the seismic failure of the ice condenser contributed to the total seismic core damage frequency, it was a much lower contributor than those items identified above.
1-3
3.
For the SPRA, containment bypass was assumed if the Reactor Protection System/Engineered Safety Features Actuation System (RPS/ESFAS) fails (e.g., signals fail to isolate the containment).
The SFRA does not differentiate between signals for containment isolation and signals for ESFAS actuation, thus, the quantiiflied results were conservative.
Even with this conservatism, RPS failure contribution to the total seismic core damage frequency was less than 1%.
As part of the seismic containment walkdowns, containment mechanical penetrations and the containment isolation valves were analyzed for the ability to withstand seismic events. The penetrations and isolation valves from both inside and outside of containment were analyzed. Based upon these plant walkdowns, no significant seismic hazards were found to exist and it was determined that these components possess a high capability to withstand seismic events. Additionally, the hydrogen igniters were found to be very rugged seismically and were screened out of the evaluation process (electrical power to the igniters was evaluated).
The internal fire core damage frequency for Cook Nuclear Plant is 1.65E-07/year and is dominated by a fire in the Engineered Safety System and Motor Control Center Room causing a Loss of a Single Train of 250 V DC Power.
This room houses 4KV/600V transformers, 600 V AC buses, and several motor control centers.
The dominant contributors to core melt are failures of electric power buses and motor control centers that are destroyed by the fire.
The contribution to core damage frequency is low relative to other risks and, therefore, not a significant concern.
No additional containment failure modes unique to internal fires were identiiiie. The Level IIanalysis from the internal events analysis, therefore, applies to the Cook Nuclear Plant Fire PRA.
ther External Ev nt.
This analysis examined all credible external events other that seismic events, internal floods, or internal fires.
Specifically examined in the other external events analysis were external flooding, aircraft accidents, severe winds, ship impact accidents, off-site and on-site hazardous materials accidents, turbine missiles, and external fires. No vulnerabilities were identified that required detailed quantification of any accident events. It was, therefore, concluded that the effects from any of the other external events described here are not a significant concern at Cook Nuclear Plant.
2.0 EXAMINATIONDESCRIPI'ION 2.1 Introductioa The Cook Nuclear Plant IPEEE has been performed to identify and resolve plant specific severe accident issues stemming from external events, C
AEPSC has conducted the IPEEE in full compliance with the requirements of the NRC Generic Letter 88-20, Supplement 4. AEPSC's approach to the IPEEE has been to perform realistic evaluations of Cook Nuclear Plant's capabilities to respond to external events.
The Cook Nuclear Plant External Events program consisted of the following 8 major tasks:
1.
2.
3.
4.
5.
6.
7.
8.
Project Management Data Collection and Analysis Initiating Event Analysis Event Tree Analysis Systems Analysis Systems Interaction Fault Tree and Accident Sequence Quantification/Engineering Evaluation Training and Technology Transfer The Cook Nuclear Plant IPEEE Containment Performance Analysis was conducted on a qualitative basis using analogies to the internal events Level II analysis as appropriate.
The models developed in the IPEEE were drawn from the internal events analysis and modified as necessary for external events. These models represent the as-built, aswperated Cook Nuclear Hant. Efforts were taken to ensure that formal procedures for which the operators were trained to use have been credited.
2.2 Conformance with Generic Letter and Supporting Material Generic Letter 88-20, Supplement 4 requested each utility to perform an Individual Plant Examination of External Events for the purpose of:
(1) developing an appreciation of severe accident behavior, (2) understanding the most likely severe accident sequences that could occur at its plant, (3) gaining a more quantitative understanding of the overall probabilities of core damage and fission product releases, and ifnecessary, (4) reducing the overall probabilities of core damage and fission product releases.
General requirements provided in the Generic Letter for fulfillingthe stated purpose were:
(1)
The utilitystaff should be used to the maximum extent possible in the performance of the IPEEE to insure that they:
understand the plant procedures, design, operation, maintenance and surveillance, understand the quantification/evaluation of the expected sequence frequencies, determine the leading contributors to core damage and unusually poor containment performance, 2-1
~
identify proposed plant improvements for prevention and mitigation,
~
examine each of the proposed improvements, and identify which proposed improvements will be implemented and their schedule.
(2)
The method of examination should be as described (for each of the external events)in the Generic Letter using the guidance of NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities".
(3)
The utility should resolve Unresolved Safety Issue (USI) A45, "Shutdown Decay Heat Removal Requirements,"
as impacted by external events in the IPEEE.
(4)
The utilityshould carefully examine the results of the IPEEE to determine ifthere are worthwhile prevention or mitigation measures that could be taken to reduce the frequency of core damage or improve containment performance.
(5)
The utilityshould report the results of the IPEEE to the NRC consistent with the criteria provided in the Generic Letter and subsequent guidance provided in NUREG-1407.
(6)
The utilityshould document the examination in a traceable manner and retain it for the duration of the license unless superseded.
In response to the Generic Letter, AEPSC issued a letter on October 24, 1989 stating its intent to perform a fullscope Level m PRA considering both internal and external events for the Cook Nuclear Plant in order to identify, evaluate, and resolve severe accident issues germane to the plant. The external events (IPEEE) analysis was of a Level I scope with a qualitative containment performance analysis.
The IPEEE also accounted for the requirements set forth in Supplement 4 to the Generic Letter, which was issued after
- October, 1989.
AEPSC has invested substantial personnel time in addition to financial resources for the efforts ofcontractors (Individual Plant Evaluation Partnership, EQE Engineering and Stevenson & Associates) in the performance of an IPEEE that meets or exceeds the NRC directives listed in Generic Letter 88-20, Supplement 4.
A permanently assigned core staff, knowledgeable in the design and operation of the Cook Nuclear Plant, has been involved in or tracked all aspects of the IPEEE. Other AEPSC personnel have been intensively involved in various aspects of the evaluation as needed, In addition, a substantial training effort was undertaken to insure that AEPSC personnel who had a need for understanding of the evaluation or parts thereof developed an appreciation for the risk significance of the results and the plant response and an understanding of the bases of the IPEEE.
2.3 General Methodology The Cook Nuclear Plant IPEEE program, as previously identified, consisted of 8 major tasks.
The IPEEE was conducted using standard systems analysis practices such as those mentioned in NUREG-1407.
A comprehensive task breakdown was developed for the Cook Nuclear Plant PRA in order to organize the work to be accomplished.
An overview of each of the tasks is provided below. More specific information regarding each of the analyzed external events is found within the applicable sections of this report.
IPEEE Tasks Project Management
- Development and monitoring of detailed project planning and scheduling provided necessary technical direction of project analyses and proper review of results, 2-2
2.
Data Collection and Analysis - Plant-specific information was collected through plant walkdowns, review of AEPSC calculations and review of the history of external events at Cook Nuclear Plant.
This data was analyzed and formatted for input into the IPEEE.
3.
Initiating Events Analysis - The selection of accident initiating events for the Cook Nuclear Plant IPEEE considered both actual plant data and results of previous PRAs and published NUREGs.
4, Event Tree Analysis - Plant-speciTic event tree models were drawn from the internal events analysis and modified as necessary for external events.
This task entailed reviewing accident progression as modeled within the internal events event trees and modifying these event trees based upon equipment and operator availability following initiation of the external event.
5, Systems Analyses - Similar to the event trees, the internal events system fault trees were modified as necessary to reflect plant system availability following initiation of the external event.
6.
Systems Interaction - Possible system interactions due to external events were identified by conducting detailed system walkdowns and a control room evaluation.
7.
Fault Tree and Accident Sequence Quantification/Engineering Evaluation - The Cook Nuclear Plant external events fault trees and event tree accident sequences were integrated and quantified to obtain accident sequence
- cutsets, frequencies for all accident sequences resulting in core damage, and to identify dominant accident sequences among all event tree results.
The Westinghouse WLINECode System was used to perform the accident sequence quantification.
The seismic IPEEE also used'the WALT Code System, which is a subset of WLINK.'he internal fire analysis also employed the COMPBRN IIIe Code System to back up engineering evaluations. The other external events analysis employed a screening type approach with engineering judgement as described in Supplement 4 to the Generic Letter.
8.
Training and Technology Transfer - Training was conducted by contractor employees for utility personnel to provide the in-house ability to understand, evaluate, modify, and update the IPEEE to reflect proposed or actual changes in the plant design, operation or to account for future industry updates impacting external event analyses.
2.4 Information Assembly A tremendous amount of information was needed to perform the detailed Cook Nuclear Plant IPEEE study.
The project team reviewed and assembled information from plant specific sources, similar plant studies, and generic sources, Plant walkdowns were key to the data collection effort. Walkdowns were specifically used to search for plant external event vulnerabilities and to group data into specific areas.
This data was ultimately used to determine important initiating events, quantify their frequency and determine component and system failure rates or provide information for various screening analyses.
The Cook Nuclear Plant IPE team modelled the Cook Nuclear Plant as-built condition as it existed on August 1, 1989. No major changes to plant operation or design have been identified since August 1, 1989, that would be expected to significantly affect the PRA results.
All information used in the project is available at the AEPSC ofFices in Columbus, Ohio.'opies of some information are also housed at the Westinghouse office in Monroeville, PA.
Detailed IPEEE project notebooks were developed for seismic events, internal fires and other external events (external floods, winds, etc.,). Information sources identified in Table 2.4-1 were used to develop the IPEEE models.
Both plant specific and generic sources identified were used to define component availabilities, initiating events and initiating event frequency, important accident sequences and potentially important modeling features.
Subsequent sections of this report provide a more detailed discussion of the use of the information collected.
2-3
Plant walkdowns were conducted by IPEP team members and contracted personnel who were responsible for the evaluation ofspecific external events, AEPSC IPEEE analysts accompanied the walkdown team members so as to I) observe first hand any identified plant.vulnerabilities and 2) take part in the IPEEE from start-to-finish.
Walkdowns were conducted for the systems and plant environment of most concern to the PRA. These arem are contained primarily in the AuxiliaryBuilding and the Containment; hovvever, several other buildings or areas were examined because important systems and components are located therein. The areas or buildings in which walkdowns were made are:
~
Containment
~
AuxiliaryBuilding
~
Turbine Building
~
Service Water Screen House
~
Control Room
~
Outside Grounds Including Switchyards General arrangement drawings of these areas are contained in the UFSAR.
The individual external event walkdowns are described in more detail in subsequent sections of this report.
Table 2.4-1 Cook Nuclear Plant IPEEE Information Sources SOURCES Plant SPPecifie Donald C. Cook Nuclear Plant Updated Final Safety Analysis Report, American Electric Power Service Corporation, July 19S9.
Donald C. Cook Nuclear Plant Units 1 and 2 Technical Specifications, Donald C. Cook Nuclear Plant, American Electric Power Service Corporation, Amendment 127 Unit 1, Amendment 113 Unit 2.
Donald C. Cook Nuclear Plant Units 1 and 2 System Descriptions, American Electric Power Service Corporation.
Plant System Flow Diagrams.
Plant'rrangement Drawings.
Plant Electrical One-Line Diagrams and Elementary Diagrams.
Emergency Operating Procedures.
Normal Operating Procedures.
I Maintenance Procedures System Surveillance Test Procedures Test Procedures Donald C. Cook Nuclear Plant Facility Data Base.
AEPSC Calculations, Probabilistic Seismic Hazard Analysis - Donald C. Cook Nuclear Power Plant - Bridgman, Michigan", Paul C. Rizzo Associates, Inc., April 1991 Seismic Fragility Assessment, Donald C. Cook Nuclear Plant, Westinghouse Electric Corporation, February 1992 Effects of Ground Spectral Shape on Plant Response, Donald C. Cook Nuclear Plant, Paul C. Rizzo Associates, Inc., November 1991 General Electric Power Generation Report to Indiana & Michigan Electric (AEP), dated December 3, 1990.
American Electric Power System Fire Report, Donald C. Cook, May 10, 1986.
2-5
Table 2 4-1 (Cont'd)
Cook Nuclear Plant IPEEE Information Sources SOURCE@
Generic S urces Regulatory Guides Code of Federal Regulations NUREG-0965, "NRC Inventory of Dams,", 1983.
NUREG-1068, "Review Insights on the Probabilistic Risk Assessment for the Limerick Generating Station,"
August 1984.
NUREG-1335, "Individual Plant Examination:
Submittal Guidance,", Final Report, August 1989.
NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination ofExternal Events (IPEEE) for Severe Accident Vulnerabilities", 1991 NUREG/CR-2300, "PRA Procedures Guide," January 1983.
NUREG/CR-2462, "Capacity of Nuclear Power Plant Structures to Resist Blast Loadings," 1983.
NUREG/CR-2650, "Allowable Shipment Frequencies for the Transport of Toxic Gases Near Nuclear Power Plants," 1982.
NUREG/CR-3058, "A Methodology for Tornado Hazard Probability Assessment,"
1983.
NUREG/CR-3428, "Application of the SSMRP Methodology to the Seismic Risk at the Zion Nuclear Power Plant", 1983 NUREG/CR-3660, "Probability of Pipe Failure in the Reactor Coolant Loops of Westinghouse PWR Plants",
1985 NUREG/CRM50, "Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External Events", 1990.
NUREG/CRM58, "Shutdown Decay Heat Removal Analysis for Westinghouse 2-Loop Pressurized Water Reactor Case Study," Sandia National Laboratories, 1986.
NUREG/CR-4840, "Procedures for the External Event Core Damage Frequency Analysis for NUREG-1150", 1990 NUREG/CR-5042, "Evaluation ofExternal Hazards to Nuclear Power Plants in the United States,", December 1987.
EPRI NP-768, "Tornado Missile Risk Analysis," 1978.
EPRI NP-2005, "Tornado Missile Simulation and Design Methodology," 1981.
24
Table 2.4-1 (Cont'd)
Cook Nuclear Plant IPEEE Information Sources S~VR ES EPRI NP4726, "Seismic Hazard Methodology for the Central and Eastern United States", 1988.
EPRI NP-6041, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin", 1988.
Generic Implementation Procedure for Seismic Verification of Nuclear Plant Equipment, 1991 (SQUG document)
Ben Chic Yen, "Flood Hazards for Nuclear Power Plants," Nuclear Engineering Design (Netherlands), 1988.
D. M. Hershfield, "Rainfall Frequency Atlas of the United States for Durations from 30 Minutes to 24 Hours and Return Periods from 1 to 100 years," United States National Weather Bureau, Technical Paper No. 40, May 1961.
L. C. Schreiner and J. T. Riedel, "Probable Maximum Precipitation Estimates, United States East of the 105th Meridian," United States National Weather Service, Hydrometeorological Report No. 51, June 1978.
E. M. Hansen, et al., "Application of Probable Maximum Precipitation Estimates - United States East of the 105th Meridian," United States National Weather Service, NOAAHydrometeorological Report No. 52, August
- 1982, "FAAStatistical Handbook of Aviation, Calendar Year 1982," U.S. Department of Transportation, Federal Aviation Administration, Office of Management Systems, Information Analysis Branch, Washington, D. C.,
December 31, 1982.
"1989 Michigan Aircraft Traffic Counter Program," Michigan Department of Transportation, June 1990.
"AircraftOperations in Michigan 1990," Michigan Department of Transportation, February 1991.
A. E. Harvey, et. al., "Statistical Trends in Railroad Hazardous Materials Transportation Safety 1978 to 1986," American Association of Railroads, Publication R-640, 1987.
2-7
3.0 SEISMIC ANALYSIS 3.0.1 Methodology Seiectioa The seismic portion of the Cook Nuclear Plant IPEEE was completed using a seismic PRA (SPRA) approach as described in Section 3.1 of NUREG-1407 (Reference 1). No previous version of an SFRA existed for Cook Nuclear Plant, thus this was a new PRA study.
3.1 Seismic PRA A Seismic PRA (SPRA) was performed to identifyseismic vulnerabilities which could jeopardize core integrity at the Cook Nuclear Plant. The elements of the SPRA include analyses of (1) field information generated by plant walkdowns (2) the seismic hazard at the site, (3) the fragilityof the plant structures and components, using walkdown data inputs, with respect to the seismic ground acceleration, (4) the response of the plant and its systems to the seismic loss of structures and/or components, and (5) the consequences of these elements.
The Cook Nuclear Plant SPRA was performed in such a way as to employ much of the work done in the internal events analysis of the Cook Nuclear Plant Individual Plant Evaluation (IPE). That is, the event trees and fault trees developed for the internal events analysis were modified or enhanced to include the plant or systems response to a particular seismic event.
Hence, only cursory descriptions with enough detail to describe the required modifications and/or enhancements are provided for the seismic event and fault trees.
Complete descriptions of the plant event trees and system fault trees can be found in the Level I internal events submittal package.
The methodology employed in the Cook Nuclear Plant SPRA for the most part parallels that described in i~G/CR-4840 (Reference 2) and NUREG/CRA550 (Volume 3, Part 3)(Reference 3). The main elements in the SPRA methodology include analyses which produce the following:site seismic hazard curves, fragility estimates for plant structures and components, compilation of seismically induced initiating events and their respective frequencies, seismic event trees, seismic fault trees, and seismic accident sequ'ence quantification, The methodology used for the SPRA analysis is summarized below.
- l. Plant IValkdowns Seismic plant walkdowre were conducted by a seismic assessment team using approved procedures.
The purpose of,these walkdowns were identify possible seismic vulnerabilities and to determine which components and structures that either generic (public domain) or plant specific data could be applied to in the fragility assessments.
2.
Seismic Hazard Analysis A site-specific seismic hazard analysis was prepared for the Cook Nuclear Plant site by Paul C. Rizzo Associates (Reference 4).
The seismic hazard analysis has as its goal the prediction of the frequency of various peak ground accelerations at the site considering historic information.
The product of the seismic hazard analysis was a set of weighted seismic hazard curves, each having a probability of representing the true hazard curve for the site.
The seismic hazard curves are based on a log-normal distribution (see Section 3.1.1, Hazard Selection).
The integration of the seismic hazard curve analysis into the overall SPRA is accomplished by translating the results of the seismic hazard curves into a finite set of earthquakes of various magnitudes (six discrete intervals were chosen),
each with an associated frequency distribution.
Each finite set of earthquakes is approximated by its median ground acceleration A 3-1
According to seismic studies, Cook Nuclear Plant is located in an area of low seismic activity. For this reason, Cook Nuclear Plant was designed For a 0.1 g Operating Basis Earthquake (OBE) and a 0.2 g Design Basis Earthquake.
To be conservative, seismic analysis began at an OBE level of 0.1 g's.
The seismic hazard curve was broken down into six discrete seismic intervals from 0.10 g - 1.50 g.
The seismic acceleration intervals chosen for the Cook SPRA were:
Seismic Interval 1
2 3
4 5
6 0.10 - 0.25 g 0.26 - 0.50 g 0,51 - 0.75 g 0.76 - 1.00 g 1.01 - 1.25 g 1.26 - 1.50 g Median: 0.175g
- 0.380g
- 0.630g
- 0.880g
- 1.130g
- 1,380g The frequency of occurrence of an earthquake which produces a ground acceleration within a s ecific seismic interval can be calculated from the seismic hazard curves by subtracting the frequency of exceedance of the upper limit from the frequency of exceedance of the lower limit for the ground acceleration interval of interest.
The site seismic hazard curve and frequency of exceedance is presented in Section 3.1.1 of this report.
- 3. Fragility Analysis The fragility analysis establishes approximate estimates of fragility parameters for use in the SPRA analysis using simplified conservative approaches.
Conservative estimates of the seismic capacities were established using either plant specific fragility assessments or public domain generic fragility data.
The fragility parameters used in the SPRA consist of estimates of median acceleration capacities, A~, and standard deviations, P, based on a log-normal distribution for buildings, structures, and equipment.
A~ is defined as that ground acceleration associated with a 50% probability of failure with 50% confidence.
P is defined as the variation in A~ due to randomness and modeling uncertainties.
The general expression used to calculate points on the log-normal fragility curve is:
a =a e(>>)
EQ.
1 where:
A
= Ground Acceleration Level of Interest, Am
=Median Ground Acceleration Level,
=Variable Representing the b'f Standard Deviations from In(Am) to In(A), and
=Combined Standard Deviation Due to Randomness and Modeling Uncertainty.
P is calculated by the following equation:
EQ.2 where:
3-2
P,
= Standard Deviation Due to Randomness, and P= Standard Deviation Due to Uncertainty.
Ifeither P, or P is not given, it was assigned a value of zero (0).
The fragilities and failure probabilities are described in more detail in Sections 3.1.3 and 3.1.4.
- 4. Seismically Induced Initiating Events The methodology used to identify and calculate seismic initiating event frequencies consists of the following four basic steps.
Step 1:
Choose which buildings, structures and equipment should be used to determine the plant status following the seismic event.
Step 2:
Given the failure of each of the items listed in step 1, the plant status following a given earthquake is defined.
Failures with similar results are grouped together.
Step 3:
The frequency of occurrence for each seismic interval and the probability of failure for each failure group described in step 2 at each seismic interval was determined from the seismic hazard analysis and the fragility analysis, respectively.
Step 4:
An event tree was developed and quantified which contains, as its nodes, the seismic interval of interest and the failure groups identified in step 2. The sequence frequencies are determined by the seismic interval frequency and the corresponding fragilities calculated in step 3.
The inputs to the event tree (developed in step 4) include the six frequencies from the hazard analysis and the respective failure group probabilities as event tree top nodes.
The output of the event tree is a listing of the seismically induced initiating event frequencies (IEQ for the accidents analyzed in the SPRA. The initiating events are presented in Section 3.1.5 of this report.
5.
Seismic Event Tree Analysis In general, the event trees developed for the IPE internal events analyses are used as the basis for the seismic event trees.
This is so the final core damage frequencies due to seismic and random events can be compared on a common basis.
It is sometimes suggested that global failure events (usually structural failures) which directly fail one or more safety systems be added to the seismic event tree.
However, to prevent having to significantly alter the internal events event trees, these global events are used to define the initiating events or are added in the fault trees as additional failures which could disable systems in close proximity.
The seismic event trees are presented in Section 3.1,5.
6.
Seismic Fault Tree Analysis The seismic fault trees were defined by the seismic event tree top events and those support systems which the top events require for successful system operation.
The first step in creating the seismic fault trees was to identify which components would be adversely affected by a seismic event.
The components expected to experience seismic failures were identified during the plant walkdowns.
These components include system pumps, tanks, valves, and electrical equipment.
The components were then used to construct seismic fault trees for each system. These seismic fault trees were combined with the internal events fault trees (non-seismic) using fault tree linking methodology. These combined (seismic and non-seismic) fault trees were linked into the seismic event trees. This approach accounted for seismic and non-seismic (random) failures.
3-3
3.1.1 Kizard Analysis As defined ivithinReference 1 (Section 3.1.1.2, Hazard Selection), the NRC staff prefers that hazard curves developed by both Lawrence Livermore National Laboratory (LLNL) and the Electric Power Research Institute (EPRI) be evaluated within an IPEEE (plants east of the Rocky iMountains).
At the beginning of this IPEEE, the only seismic hazard curves existing for Cook Nuclear Plant were those developed by LLNL.Thus, in an effort to present results from analysis of two hazard curves, Paul C. Rizzo Associates was contracted to develop a set of seismic hazard curves for Cook Nuclear Plant (Reference 4).
Similar to the approach taken by both LLNLand EPRI, Rizzo Associates incorporated expert opinions in their analysis, opinions which were taken from LLNLand EPRI as well as using their own. In agreement with the EPRI approach (Reference 5), a common data base ofseismic events was used as input and that data base was applied uniformly through a "statistical consensus" approach.
The seismic hazard analysis estimated the probability, within a given time frame, that different levels of earthquake induced vibratory ground motion will be exceeded at Cook Nuclear Plant.
The basic input required for the analysis was the seismotectonic model, which defined the sources ofearthquake activity. The probability that earthquakes of different energy levels originated from these sources was estimated.
An attentuation function was defined to estimate the ground motion that would be experienced at Cook Nuclear, Plant by the occurrence of an earthquake withina given source.
The results, presented as annual probabilities of exceedance for different levels of ground motion, were calculated by integration over all possible combinations of earthquake levels postulated to be feasible.
The hazard curves are based on a log-normal distribution.
The hazard curves developed for Cook Nuclear Plant are shown in Figure 3.1.1-1. The SPRA used the mean curve.
Figure 3.1.1-2 shows how the Rizzo Associates median hazard curves compare to the LLNLmedian hazard curve.
As noted, the LLNLfrequencies of exceedance are higher than those developed for Cook Nuclear Plant. Table 3.1.1-1 shows how the Rizzo Associates hazard curve was broken down into six intervals for the SPRA.
3.12 Review of Hant Infoanation and Walkdowns Regardless of the seismic IPEEE approach described in Reference 1 (seismic margins or SPRA), plant walkdowns are emphasized as significant activities to find as-designed, as-built and as-operated seismic weaknesses in plants.
Plant walkdowns conducted at Cook Nuclear Plant Units 1 and 2 looked at components and structures within both containment buildings, the Auxiliary and Turbine Buildings, the Screen House and the grounds immediately surrounding the plant site.
The purpose of the walkdowns was to not only find seismic vulnerabilities, but also to determine whether generic (public domain) fragilitydata could be applied towards components and structures of interest.
The others would require a plant specific analysis.
Plant information was gathered in a series of walkdowns due to the varying availability schedules for gaining access inside the containment structures.
Even though the data collection phase of the SPRA has been completed, a
confirmatory walkdown concerning containment mechanical penetrations inside of the Unit 1 containment will be conducted during the Unit 1 refueling outage scheduled forsummer 1992. Based upon the results ofsimilar IPEEE walkdowns conducted inside of the Unit 2 containment, no problems are expected to come from this confirmatory walkdown.
Since the internal events analysis provided the basis for the SPRA, components modeled within the accident event trees and plant system fault trees generally made up the bulk of items that were reviewed during the walkdowns.
The following were also reviewed;
- Containment Buildings, Auxiliary and Turbine Buildings, and the Screen House.
Any visible structural defects and potential building-to-building interactions were reviewed.
- Instrumentation that impacted IPE modeled components.
- Containment isolation valves and containment mechanical penetrations.
This was done both inside and outside of the containment buildings, Prior to conducting the walkdowns, procedures were developed applicable to the entire plant and all walkdown team members were trained in these procedures (Reference 8). EPRI document NP-6041, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin", (Reference
- 9) provided guidelines for these procedures.
The walkdown teams were comprised ofpersonnel from EQE Engineering, Westinghouse Electric Corporation and AEPSC.
AEPSC systems personnel also observed the walkdown efforts.
These same personnel were involved in the SPRA quantification analysis.
3.1,2.1 Walkdown Results Since multiple walkdowns were performed, summaries ofthe walkdown findings were broken down into inside and outside of containment categories.
Allitems noted in the findings have either been incorporated into the component fragility analysis, administratively addressed, fixed at Cook Nuclear Plant or placed into action item tracking status awaiting disposition.
Findings regarding seismic-fire interactions are found in the Internal Fire Analysis portion of this submittal.
3.1,2.1.1 Inside Containment Walkdown Findings:
In general, it was determined that generic fragility curves could be applied to most components.
The walkdown screening criteria in the walkdown procedures, and used in making these judgements, are based on the deterministic screening rules contained in Reference 9. If the component met the EPRI screening criteria for a review level earthquake (RLE) of 0.3g or less, the high-confidence-of-low-probability-of-failure (HCLP$) was considered to be greater than 0.3g and generic fragility curves were considered adequate.
Components meeting the EPRI screening criteria for a RLE of 0,5g were screened out completely and fragility curves were not required.
Very few components met the 0.5g criteria and most required either a generic or a plant specific fragility curve.
Components which could be screened out, pending confirmation that there were no adverse systems interactions, were manual and check valves, electrical conduit and small junction boxes.
The primary coolant system of Westinghouse reactors has been studied extensively using probabilistic fracture mechanics for the primary piping and plant specific fragility analysis for the primary coolant system component supports.
Thus, there was no emphasis on these items in the walkdown. The probabilistic fracture mechanics results are included in NUREG/CR-3660, "Probability ofPipe Failure in the Reactor Coolant Loops of Westinghouse PWR Plants", (Reference 10) and show that piping failure is not a governing failure mode for a large loss of coolant accident.
Thus, the direct seismic induced fracture of the primary system may be screened out of consideration.
Fragility descriptions for the primary system supports are also contained in Reference 10, as are probabilities ofseismic induced failure derived using the calculated fragilities and generic hazard curves. Fragility curves from Reference 10 for Cook Nuclear Plant primary coolant system equipment supports should be used in the study to represent the seismic capacity of the reactor coolant system.
3.1.2.1.2 Outside Containment Walkdown Findings:
Itwas determined that generic fragilitycurves were applicable to most components, The walkdown screening criteria contained in the walkdown procedures, and used in making these judgements, were based on the deterministic screening rules contained in the GIP (Reference 11), EPRI NP-6041 (Reference
- 9) and the walkdown procedures (Reference 8).
The same 0.3g and 0.5g RLE criteria described for the inside of containment walkdowns were applicable for outside ofcontainment. Again, very few components met the 0.5g criteria and most required either a generic or a plant specific fragility curve.
Components which could be screened out, pending confirmation that there were no adverse systems interactions, were manual and check valves, electrical conduit and small junction boxes.
3-5
Some general observations made during the outside of containment walkdowns were of special importance to the IPEEE effort. Topics ofgeneral concern include block walls, fire extinguisher mountings, fire protection pilot lines, and fluorscent light fixtures.
Block Walls Block walls have been shown to be interaction sources in past earthquakes.
A block wall program at Cook Nuclear Plant was carried out to assure satisfactory performance of block walls under DBE (design basis earthquake) conditions.
Consequences of these potential block wall interactions were found to be variable and had to be assessed in the systems modeling, which goes beyond DBE.
Fire Extin uisher M untin Fire extinguishers around the plant are typically mounted to the wall by a single hook. In some cases, the hooks were starting to pull out from the wall. Fire extinguishers should be mounted in packs with straps to hold the extinguisher in place.
The concern was that the extinguisher could fall during an earthquake and possibly become a missile.
Fire Pr tection Pilot Lin Several pilot lines for the water fire protection systems are located in near proximity to other components such as pipe supports, HVACducting, platforms and other piping. It was determined during the walkdowns that flexibilityof the pilot lines may allow them to swing into adjacent obstacles and break the glass fuses in a few locations.
Breakage would activate deluge valves and charge the sprinkler lines with water. This, in itself, does not result in spray or flooding, but a simultaneous broken sprinkler head would lead to spray, wluch could affect safety related equipment.
Fluorescent Li ht. in ontr 1 Room Fluorescent lighting above the main control boards in the Control Rooms are potential interaction sources with electrical components in the back of the control panels.
The fluorescent bulbs were found not to always be confined within their mounting brackets.
It was felt that screens or a positively latched diffusing shields should be placed over the tubes to prevent them from dislodging during an earthquake and becoming missiles.
Note: During the walkdowns, floor anchorages for a few of the motor control centers were questioned since bolting or welds in certain spots on individual motor control centers were found missing/broken. Following the component fragility analysis and SPRA quantification, motor control centers were not dominant contributors.
3.1B Analysis of Hant Systems and Structure Response Seismic fragility parameters are needed for use in the PRA analysis.
The fragility parameters consist of estimates of median seismic acceleration capacities and standard deviations based on log-normal statistical distributions.
These fragility parameters are obtained from seismic fragility analyses.
The purpose of a fragility analysis is to define the maximum limit of structural integrity, or functional capability, with the associated uncertainty for all plant components and structures that could have an effect on safe shutdown of the plant following an external event. Fragility as defined herein for a seismic event is the free field ground acceleration level required for failure of a given component to perform its safety related function.
Failure could occur due to loss of a pressure boundary, signiTicant inelastic deformation, inability to operate, partial collapse, or a combination of failure modes. Reference 7, Seismic Fragility Assessment, documents fragility calculations for Cook Nuclear Plant.
Conservative estimates of the seismic capacities were established using plant specific fragilityassessments and public domain generic fragility data.
Plant specific calculations were reviewed and simplified calculations performed as necessary to establish fragility data for the buildings, structures, and crane identiiflied in Table
3.1.3-1.
Plant specific information and generic data available from published NUREGs were used to define the fragilityparameters associated with the equipment identified in Table 3.1.3;2. The applicability of using generic data was verified during the plant walkdown activities, as indicated previously.
The plant speciTic information used in this evaluation is listed below:
e Design stress reports associated with buildings, structures, and cranes; o
Site soil reports;
~
Layouts showing location of the identified systems and components; e
Plant safety analysis reports or similar documents;
~
Plant equipment qualification test or analysis reports; e
Criteria and specification documents for identified buildings, structures,
- cranes, and equipment; e
Structural analysis calculations;
~
Structure and building drawings.
The plant specific assessment procedure used to determine the minimum seismic ground acceleration capacity associated with the buildings, structures, and crane is described below:
(i)
For each identified building, structure, or crane, the critical structural components required to assure survivability during a seismic event was identified.
The failure modes and the criteria defining failure were established for these critical components.
The seismic loads were combined with the normal operating loads as applicable.
The seismic event is not postulated to occur in conjunction with tornado loads. The stresses in critical elements due to normal operating loads and seismic excitation were determined from existing calculations, or from new calculations performed as necessary, Seismic fragility levels were defined in terms of free field ground acceleration levels using appropriate amplification factors, obtained from the plant design spectra for the given response frequency.
Margin factors were defined based on criteria and areas of reserve strength.
These factors were used in conjunction with the stresses calculated in step (ii) to define seismic fragility.
Statistical relationships (i.e. standard deviations) associated with the log-normal distribution were used.
In order to develop fragility data and make assessments of the reserve strength, formulations based on probability were employed.
Conservative estimates of the fragility data were developed using the seismic stress state associated with the Design Basis Earthquake (DBE) for Cook Nuclear Plant, along with the design margin factors associated with the analysis or test qualification.
The fragility data were developed using methodologies consistent with standard NUREG practices such as given in: NUREG/CRC334; NUREG/CR-5270; NUREG/CR-4659; and NUREG/CR-4482. Also determined were the seismic capacities defined by a five percent failure probability.
These seismic capacities were referred to as the capacity having a High Confidence ofLow Probability ofFailure (HCLPT). This value reflects a 95 percent confidence (probability) of not exceeding a five percent probability of failure.
There are many sources of conservatism and variability in the estimation of seismic ground acceleration, capacity.
Those that were considered in this program are:
stress interaction, criteria factors of safety, nraterial strength, damping, inelastic response, analysis method, test procedure, redundancy, and seismic input. They are discussed in more detail below:
3-7
Stress Interaction This factor reflects the margin between the actual stress state and the code mandated allowable stress.
Criteria This margin factor represents the factor of safety that is inherent in the code associated with the component stress state.
Material Strength This factor accounts for the difference between code mandated minimum material values used for design and actual material properties.
Damping A factor that reflects the fact that higher damping exists in a structure or equipment than used in the actual qualiTication analyses.
Inelastic Response Additional reserve strength exists due to energy absorption and ductility. This factor accounts for this added margin.
~
Analysis Conservatism sometimes exist in the seismic qualification through the analyses used.
~
Testing This factor reflects conservatism existing in the qualification tests.
Redundancy Conservatism resulting from redundancy in a structure that yields a higher load capacity due to load redistribution was not considered in the qualification analyses.
Seismic Input In some of the analyses performed, conservative seismic accelerations are used fo'r equipment qualification that results in additional margin in the design.
As part of this program, AEPSC, EQE, and Westinghouse performed field walkdowns of equipment located in the Containment Building and AuxiliaryBuilding, Walkdowns are discussed in Section 3.1.2.
One of the goals of the containment walkdown was to confirm the assumptions made and to verify equipment anchorage adequacy.
During the AuxiliaryBuilding walkdown, structures and equipment were identified that could be screened out, or where generic qualiTication data was applicable, or where plant specifi evaluations were necessary.
As a result of the walkdowns, a number of open items regarding equipment/structural capacity were generated that were addressed and reflected in the fragility data as appropriate.
To simplify the evaluation, equipment of similar types were grouped, such as large motor operated valves, small motor operated valves, switchgear, tanks, and motor control centers.
Since the various members of a subclass may be mounted at different locations in the plant, lower bound fragility data were developed for each subgroup.
Further, in this evaluation, the interaction of masonry walls with nearby safety related equipment was taken into account and reflected in the fragility data.
3-8
The HCLPF values for each piece of equipment were determined using the median spectral acceleration capacity and standard deviation values.
The median capacities were calculated taking into account the location in the plant and the dynamic characteristics of the equipme'nt.
The procedure employed to define the median ground acceleration capacity level is given below:
~
For the piece ofequipment being evaluated, using generic or plant specific documentation, first define the equipment fundamental frequency (f) and then calculate the median floor spectral acceleration capacity level (Sq(f)) using the qualification seismic capacity and associated design margin factors.
Determine the site mounting location for the equipment, and the applicable design required spectral acceleration (Sqr(I)) along with the associated zero period acceleration (ZPA,) defined by the applicable site design fioor response spectrum.
~
Using the information obtained above, determine the floor median zero period acceleration, ZPA, capacity for the equipment:
ZPA= ZPA, x (Sq(f)/Sqr(f)),
~
Scale the median floor ZPA value calculated above using the ratio of design response spectrum zero period acceleration value associated with the mounting location (ZPA,) and the ground (ZPAs) to define an equivalent median ground acceleration capacity level (Am) for the equipment or structure:
Am = ZPA x (ZPA</ZPA,).
In Reference 1, Section 3.1.1.2, it is stated:
"Most seismic PRA's use peak ground acceleration as the hazard parameter. Ifthis is done, spectral shapes that are consistent with current estimates of ground motion should be used.
In the Central and Eastern United States, current spectral estimates can be found in the LLNLand EPRI hazard studies.
Since similar spectral shapes are obtained from LLNLand EPRI hazard studies, separate analyses using both spectral shapes are not needed.
Median spectral shapes of 10,000 year return period provided in NUREG/CR-5250 along with variability estimates are recommended for use in the analyses...."
In Figure 3.1.3-1 is shown a comparison of the plant design ground spectrum and the 10,000 year LLNL (Lawrence Livermore National Laboratory) median Uniform Hazard Spectrum (UHS) associated with the Cook Nuclear Plant site.
The spectra are normalized (or anchored) to the plant DBE level of 0.2g and are associated with 5% damping.
It is noted that initially, fragility data n'ere developed based on the Cook Nuclear Plant UFSAR Ground Design Response Spectra (GDRS). This fragility data was adjusted to correspond to the UHS spectral shape recognizing the range of frequency response associated with the equipment, structures, and buildings for Cook NuclearPlant.
Theonly fragilitydatathatchangewerethemedianandHCLPFgroundseismiclevels.
These seismic levels were modified directly by applying linear factors that were defined by ratioing the response spectrum values (Cook Nuclear Plant GDRS and UHS) associated with the appropriate fioor spectra at the response frequency. The GDRS is found within the Cook Nuclear Plant UFSAR (Reference 6). It is noted that comparison (GDRS vs. UHS) response spectra were developed as part of this program.
It was found that since the building frequencies associated with the dominant dynamic response are below 5 Hz for Cook Nuclear Plant Units 1 and 2, the fragility data associated with the UHS spectra have larger values (i.e. larger seismic capacity) than the corresponding data calculated using the Cook Nuclear Plant seismic design spectra due to the filtering of the building structures.
This is apparent from Figure 3.1.3-1 were it is seen that the Cook Nuclear Plant GDRS envelopes the UHS spectrum in the frequency response region below 5 Hz. Further, it was found that equipment mounted on the ground have dominant response frequencies in the range where the GDRS envelopes the UHS spectrum.
3-9
In the evaluation performed, it was found that nearly all of the equipment and structures had HCLPF values
~
equal to or greater than 0.3g. The exceptions are listed below showing both the HCLPF value based on the GDRS, and that obtained using the UHS ground spectral shape:
~
Support of Motor Control Center in the Emergency Diesel Generator Room and in the hall of the AuxiliaryBuilding at the 578 Elevation level:
HCLPF Value = 0.22g (Plant FSAR)
~
Component Cooling Water Pump piping supports:
HCLPF Value = 0,24g (Plant FSAR)
~
Wall around Emergency Diesel Generator Fuel Oil Day Tank:
HCLPF Value = 0.25g (Plant FSAR)
~
Isolators of Control Room HVAC Chillers (non-safety) at the 650'evel of the Auxiliary Building:
HCLPF Value = 0,21g (Plant FSAR)
HCLPF Value = 0.25g (UHS) o Switchyard Ceramic Insulators:
HCLPF Value = 0.09g (Plant FSAR)
It is important to note that the above items are all support related with the exception of the ceramic insulators.
Further, it is noted that ceramic insulators normally fail in a seismic event and loss of off-site'ower occurs.
3.1.4 Evaluation of Component Fragilities and Failure Modes The purpose of a fragility analysis is to define the maximum limitof structural integrity, functional capability, or operability with the associated uncertainty for all plant components and structures that could have an effect on safe shutdown of the plant following an external event.
Fragility as defined herein for a seismic event is the free field ground acceleration level required for failure of a given component to perform its safety function.
The fragility parameters for use in the SPRA (seismic PRA) analysis are established from existing plant specific calculations, public domain published data, and/or simplified conservative approaches that provide approximate estimates of the plant specific fragility capacity Reference 7). The fragility parameters consist of estimates of medium seismic acceleration capacities and standard deviations based on log-normal statistical distributions.
In order to develop fragility data and make assessments of the reserve strength, formulations based on probability are used.
Conservative estimates of the fragility data are developed using the seismic stress state associated with the Design Basis Earthquake (DBE) for Cook Nuclear Plant, along with the analysis/test and design margin factors, Fragility data are defined by standard deviations (P) and median capacities (A~) associated with the log-normal distribution. This distribution is employed to be consistent 3-10
with standard NUREG practices (e.gvp NUREG/CRA334, 5270, 4659, 4482).
Also determined are the seismic capacities defined by a five percent failure probability. These seismic capacities are referred to as the capacity having a High Confidence of Low Probability of Failure (HCLPQ. This value reflects a 95 percent confidence (probability) of not exceeding a five percent probability of failure.
The seismic fragility assessment results for the buildings, structures, and equipment are presented in Table 3.1.4-1.
Using the methodology and equations from Section 3.1, component failure probabilities associated with the fragilities were calculated.
Since Am is given (median seismic component capacities), and P is calculated (from equation 2), and six values of A were already chosen (median values from the hazard analysis),
equation 1. is solved for y as follows:
y = ln['A/A~]/P The value of y represents the number of standard deviations from In(A~) to ln(A). Thus, the probability of occurrence (e.g., the probability of failure at a given seismic interval) is a function of the number of standard deviations from the median in a log-normal statistical distribution. The component failure probabilities are estimated by finding the value of y in the "Areas'Under a Normal Curve" table in a statistics book or computer program.
As discussed in Section 3.1, the seismic analysis was broken down into six (6) seismic intervals.
Thus, each modeled component was evaluated at six different seismic intervals in the SPRA.
Table 3.1.4-2 shows the seismic failure probabilities for each component at each of the six seismic intervals.
3.1.5 Analysis of Plant Systems and Sequences The following topics are discussed in this section:
seismic initiating events, seismic event trees," seismic fault trees, accident sequence quantification results and sensitivity analysis.
3.1.5.1 Initiating Events In order to calculate the seismic initiating event frequencies, the seismic initiators had to be defined.
The list of structures and components used in the Cook Nuclear Plant SPRA,to determine the seismically induced initiating events include:
~gtructur
- Containment building, screen house, reactor pressure vessel supports, steam generator supports, pressurizer supports, RCP supports, reactor coolant system piping, and secondary side piping and supports.
~om )~nant. - Reactor pressure vessel, steam generators, pressurizer, reactor coolant pumps, control rod drive mechanisms, and avitchyard ceramic insulators.
Again, these items were used for determining seismic initiating events, The remaining items found in Tables 3.1.4-1 and 3.1 4-2 provided seismic event tree/fault tree failure inputs in the quantification
- process, Once the structures and components were defined, the plant physical status was defined for each failure group. It was deemed impractical to analyze every possible accident scenario following an earthquake; therefore, conservative yet credible assumptions were used to produce those initiating events which could be considered "worst case" events.
Thus, a total of nine failure groups were defined, Each failure group is briefly described below.
- 1. CONTAINMENT OR STEAM GENERATOR FAILURE 3-11
Containment structural failure is a function of either the containinent rebar or soil pressure fragilities. Failure is assumed to be structural collapse of the containment building. Damage to the RCS and the core cooling systems due to the containment collapse is hypothesized.
Steam generator integrity is assumed to be a function of the fragility of the SG and its supports.
All SGs are assumed to fail in such a way as to sever both RCS and secondary side piping (outside of containment).
Thus, either of these failures is assumed to cause direct seismically induced core damage with containment breech.
- 2. REACTOR VESSEL OR RCS PIPING FAILURE This failure is a function of the fragility of the reactor pressure vessel (RPV), the RPV supports, and the RCS piping. RPV or RPV support failure is assumed to lead to a vessel position which could not guarantee core cooling. RCS piping failure is assumed to be double guillotine breaks in all loops at a point which would preclude emergency core cooling. In either case, since the core cooling function would not be guaranteed, this failure is conservatively assumed to lead to direct core damage; no direct damage to the containment is assumed.
- 3. RCS COMPONENT FAILURE This failure is a function of the pressurizer, the pressurizer supports, and the reactor coolant pump supports.
The failure of any of these components is assumed to lead to a large LOCA event.
Neither emergency core cooling nor ice condenser functions would be compromised as a direct result of these failures.
- 4. MEDIUMPRIMARYPIPE BREAK This category includes all pipes of sufficient size to produce a medium LOCA event, which for the Cook Nuclear Plant IPE is defined as a 2 to 6 inch equivalent diameter pipe break. The probabilities are estimates based on calculations for appropriately sized piping calculated in the SSMRP Zion Analysis. The Zion analysis classified a medium break to occur when piping is between 3 and 6 inches in diameter.
Zion, like Cook Nuclear Plant, is a 4 loop Westinghouse PWR. Thus, the Zion medium pipe break calculations are deemed acceptable for use in the Cook analysis. These same probabilities were also employed in NUREGP550 (Reference 3) for Surry plant.
- 5. SMALLPRDIARY PIPE BREAK This category includes all pipes of sufficient size to produce a small LOCA event, which for the Cook Nuclear Plant IPE is defined as a 2 inch equivalent diameter pipe break.
The probabilities are estimates based on calculations for appropriately sized piping calculated in the SSMRP Zion Analysis.
The Zion analysis ciassiTied a small break to be in piping less than 3 inches diameter.
These same probabilities were also employed in NUREG-4550 (Reference 3) for Surry plant.
In addition, the reactor coolant pumps (RCPs) are assumed to fail in such a way as to damage the seals on all four pumps.
The resultant leakage is assumed to be equivalent to that required for small LOCA classification.
- 6. SCREEN HOUSE FAILURE The screen house is postulated to fail in such a way as to disable the circulating water pumps as well as the essential service water pumps.
These failures are considered unrecoverable.
In this scenario, the main condenser would lose its ability to remove heat from the turbine exhaust.
In addition, a loss of ESW would eventually lead to a loss of the component cooling water (CCW) systems'eat removal ability. Thus this failure would result in the loss of the power conversion 3-12
Furthermore, since CCW is required to cool the charging pumps, the RCPs willeventually lose seal cooling water and seal LOCA is imminent.
- 7. SECONDARY SIDE PIPE BREAK The integrity of the secondary side piping is function of the fragilityof the secondary side piping and its supports.
Failure is assumed to lead to a steamline or feedline break. It is assumed that only one steam generator will be affected,
- 8. OFF-SITE POWER FAILURE Off-site power availability is a function of the avitchyard ceramic insulators.
Failure of these insulators is assumed to lead to a complete, unrecoverable loss of off-site power.
- 9. CONTROL ROD INSERTION FAILURE The ability to insert the control rods is a function of the control rod drive mechanism fragility as well as the fragilities of the reactor core upper internals, and the lower internals i.e., core barrel and thermal shield. Allof these seismically induced failures are postulated to fail in such a way as to either disable the control rod drive mechanism, or physically prevent rod insertion.
The final step in the initiating event frequency (IEF) calculations was to construct an event tree which contains as its nodes the seismic interval of interest (six intervals were defined in Section 3.1 under Seismic Hazard Analysis) and the above failure groups.
The event tree is presented in Figure 3.1.5-1.
The event tree was then quantified using the seismic interval frequency and the failure group failure probabilities (based on the applicable fragility values defined earlier).
The results represent the seismically induced IEFs.
Note the IEFs were calculated for all six seismic intervals.
The seismic IEFs are presented in Table 3.1.5-1.
3.1.5,2 Seismic Event Trees Once the seismic initiators were defined, the seismic event trees were created.
The event tres developed for the IPE internal events analysis were used as the basis for the seismic event trees.
In most cases, the IPE event trees were altered to include the ICE event (ice condenser failure) and to remove the top events which rely on the PORVs (pressurizer and steam generator) for depressurization.
The PORVs rely on the instrument air system for operation, a system which is non-seismic class I and is assumed to fail in an earthquake.
The IPE event tree top events which were removed due to this automatic failure to depressurize include:
OA6 and OLI in the medium LOCA tree; PBF and OA6 in the small LOCA tree; PBF in the steamline break, loss of offsite power, and transient trees; and MF1 in the loss of ESW tree (note MFI failure probability is 1.0 since main feedwater is not seismic class 'I and is also assumed to fail in an earthquake).
The seismic event trees are presented as Figures 3.1.5-2 through 3.1.5-8.
By reviewing Table 3.1.5-1, the analyst determined whether or not offsite power is available simply by looking at the coding in the Initiating Events category, Ifa "P" is shown as part of the category, then offsite power is not available. Ifno "P" is shown, then offsite power is assumed to be available following a seismic event.
Note those events with an "R" listed in the Initiating Event column of Table 3.1.5-1, need only assume that the IEF is the core damage frequency since these are the events where the control rods fail to insert.
Thus, the following initiating events were quantified for the "normal" power cases (offsite power is
~
~
~
available during the accident) and the "loss of offsite power (LOSP)" cases:
3-13
SLO MLO LLO SLB ESW TRS LSP N rmal a.
X X
X X
X X
X X
X X
X X
3.1.5.3 Seismic Fault Trees Once the seismic event trees were developed, the seismic fault trees were created.
The seismic fault trees are defined by the seismic event tree top events and those support systems which the top events require for successful system operation. Table 3.1.5-2 lists the top events and support systems which required a fault tree.
Note that some event tree top events do not require a seismic fault tree (e.g, RCP, CNU) since the event does not model any components that could fail seismically.
The first step in creating the seismic fault trees was to identify which components would be adversely affected by a seismic event.
The components expected to experience seismic failures were identified during the seismic walkdown and are discussed in Section 3.1A. The list of components include system pumps, tanks, valves, and electrical equipment.
The components described in Section 3.1.4 were then used to construct seismic fault trees for each system.
The seismic fault trees were then quantiTied and linked to the corresponding IPE fault trees (e.g., seismic fault tree SHP2 was linked to IPE fault tree HP2).
By combining these trees together, both seismic and non-seismic failures were considered in the event tree accident sequence quantification.
Thus, the IPE fault tree component random mechanical failures, human errors, and test and maintenance unavailabilities are all considered in the SPRA.
The seismic fault trees were constructed based on the following assumptions:
In order to remove some of the complexity involved with the seismic quantification, it was assumed that analogous components in dose proximity, simultaneously fail with a probability equal to that for one component.
For example, ifone pump in a two pump system were to seismically fail, its redundant partner would simultaneously fail without a decrease in the failure probability. This assumption, which is analogous to using common cause P factor of 1, conservatively removes train redundancy while simplifying the seismic fault trees.
2.
In an attempt to accurately model operator action, it was assumed that an operator would be physically unable to perform any immediate action after a seismic event.
The control rooms, speciTically the fiuorescent lighting above the main control boards, were evaluated during the seismic walkdowns for their potential to withstand a seismic event.
It was assumed that the operator willregain full efficiency five to ten minutes after the seismic event.
Thus, ifan operator action is required within the first ten minutes following a seismically induced accident, it is assigned a failure probability of 1.0.
3.
Systems which are not classified as Seismic Class I are conservatively assumed to have failed at any seismic activity level. That is, the failure probability is 1.0.
The most visible result of this assumption is the automatic loss of the control air system, which in turn removes all PORV's and the possibility for bleed and feed and the use of the steam generators for cooldown via the steam generator PORVs.
Like the control air system, 3-14
the non~ential service water, feedwater an'd condensate systems are also not Seismic Class I. Because of this assumption it was convenient to remove top events which rely on control air, NESW, and feedwater and condensate from the seismic event trees.
Note that the essential service water and AFW systems rely on control air; however, the AFW air-operated valves fail to a predetermined position upon a loss of control air to permit continued operation.
The ESW system needs control air for auto baclavashing of the ESW strainers; hovvever, this failure is not a major contributor to ESW unavailability and the system is seismically addressed in the seismic quantification.
Thus, failure of the control air system does not directly fail the ESW and AFW systems.
Based on assumptions 2 and 3, it was assumed that when the condensate storage tank (CST) fails (P=1.0 since non-seismic class I), the operators have up to 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to switch the auxiliary feedwater supply source to the essential service water system.
- Thus, the human reliability values for switchover from the CST are not changed from those used in the IPE internal events analysis.
Failure of the auxiliary building destroys everything within the building confines, The electrical wires that run through the auxiliary building wall willalso be sheared.
It has been assumed that the auxiliary building failure will also take out the 4KV/600V AC rooms and the emergency diesel generator rooms.
Likewise, failure of the turbine building destroys all the components and systems located within the building. This includes the auxiliary feedwater system.
Failure of offsite power is assumed to have a duration of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
Thus the diesel generators have a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
In order for proper operation of a nuclear power plant, there are numerous signals and controls which must operate to keep the operators informed of the plant status and if necessary enable the operator to start a safety system.
These controls and signals have been organized together under one event and are referred to as the miscellaneous control panels.
This event also represents SI signal generation.
It has been assumed that the auxiliary building failure will also take out the 4KV/600V AC rooms and the emergency diesel generator rooms. These rooms are smaller areas attached to the auxiliary building. The turbine building, though adjacent to the auxiliary building, is much larger and is assumed to not be taken down by auxiliary building failure.
Seismic failure of the RCS safety valves was not modeled in the SPRA since these valves are normally dosed and it is expected that they fail dosed due to seismic activity. Since they fail closed, no initiator (i.e., small or medium LOCA) occurs.
In order to simplify the seismic fault tree models, some of the basic events were selected to represent more than one failure mode.
For example, the following failure mode probabilities were summed to generate the total failure probability of the auxiliary building: soil pressure, foundation mat, steel structure, and the concrete structure.
Other basic event vvhich represent more than one failure mode are listed below.
S-AUX-BLDG-FA S-TRB-PED-FA S-PF-AFW-FA, Sum all the values for the AuxiliaryBuilding Sum all the values for the Turbine Pedestal Sum all the values for the TD pump with the values for the AFW fans.
3-15
S-MISC;PAN-FA S-PM-CCW-FA S-OT-120 VAC-FA S-V-HPI-FA S-IC-ICE-BASB-FA Sum the values for Level and Pressure Transmitters with the values for the following RPS items: MCC, Misc. Panels, Cable Trays, RPS/Aux Rack/STC, and Main Control Board Sum the values for the CCW pump (piping support) with the values for the CCW pump (water)
Sum the values for the CRID inverter with the values for the CRID transformer Sum the values for the HPSI Isolation Valves with'the values for the (ECCS) Misc. Isolation Valves.
Sum all the values for the Ice Condenser 3.1.5.4 Quantification and Results The seismic event tree models were quantified for each seismic interval using the initiating event frequency and the fault trees which include seismic and non-seismic failures.
The results of the event tree accident sequence quantification were combined with the initiating event frequencies for those events which were not speciYically quantified (e.g., paths leading to direct core damage).
Table 3.1.5-3 presents the results of the seismic PRA analysis, The results are presented based on each seismic interval and as a total seismic core damage frequency.
As shown in Table 3.1.5-3, the seismic core damage frequency is estimated to be L83E45/yr. The LOSP cases at seismic interval 2 dominate the core damage frequency.
To further define which components, equipment, and buildings are dominating the results, Tables 3.1.5-4 and 3.1.5-5 offer a summary listing of the importance analysis results for the "no'rmal power" cases and the LOSP cases respectively.
The LOSP cases represent a LOSP occurring simultaneously with the accident events.
As can be seen from these tables, the dominant contributors to seismic core damage are:
1.
Loss of Electric Power Systems a.
600 VAC Transformers b.
Diesel Generator Fuel Oil Day Tank 2.
AuxiliaryBuilding To a lesser degree, the following are also shown as contributors:
1.
2.
3.
4.
5.
Reactor Protection System Failures (Misc. Panels)
Turbine-Driven AF Pump (random failures)
Turbine Building Pedestal 250 VDC System 4160 VAC Switchgear From the above information, the only non-seismic failure is the turbine driven AFW pump mechanical failure (failure to start and run). Allother failures are a result of the seismic event.
Table 3.1.54 provides a detailed listing of the top 35 cutsets which contribute over 90% of the total seismic core damage frequency.
Approximately 80% of the core damage frequency (CD@ comes from three initiating events.
The top contributor is loss of offsite power (LSP) at 40% followed by steamline/feedline break (SLB) at 22% and the special initiator loss of essential service water (SWS) at 19%.
As can be seen from Table 3.1.5-6, the initiating events which dominate the analysis are:
3-16
2.
3.
Loss of Offsite Power Steamline/Feedline Break Loss of Service Water System The remaining discussion in this section is based upon the screening criteria set forth in NUREG-1407 (which refers to the criteria in NUREG-1335).
Each of the criterion is described below.
Screenin Criterion 1 This criterion requires that "any systemic sequence that contributes 1E-7 or more per reactor year to core damage" be identified. The first 35 sequences shown in Table 3.1.5-6 fall into this criteria.
Note that sequence 36 (not shown on table) contributes less than 1E-7 per reactor year to the core damage.
Screenin Criterion 2 This criterion requires that "all systemic sequences within the upper 95 percent of the total core damage frequency" be identified. The 35 sequences listed in Table 3.1.5-6 fall into this criteria.
creenin Criterion 3 This criterion requires that "all systemic sequences within the upper 95% of the total containment failure probability" be identified.
According to the fragility data, seismic failure of the containment building may occur due to the following causes:
failure of the containment rebar or failure due to soil pressures.
Of these hvo failure mechanisms, the soil pressure dominates.
Failure of the containment structure was designated as category "core damage and containment damage" in Table 3.1.5-1.
From Table 3.1.5-3, "Summary of Seismic PRA Results," the sum of the "containment damage" events for all the seismic intervals is calculated to be 2.02E-07/yr which contributes approximately 1% to the total seismic core damage frequency.
However, this value represents seismic containment failure and not a containment failure probability after containment is challenged following an accident.
A seismic Level II containment performance is not required for the IPEEE (GL 88-20 Supplement 4 - Reference 12), but containment performance was assessed by reviewing the seismic core damage sequences and, based on the progression of these sequences, making comparisons to the Level II internal events containment performance analysis. As an example, some of the results of seismic assessment include the following:
The dominant contributors listed in Table 3,1,5-6 were examined to determine the type of potential containment failure which exists.
The event tree sequences which are associated with these events include:
LSP SWS SLB SLO LLO Sequence 10 Sequences 95, 112, & 113 Sequences 28 A 29 Sequences 40 A 41 Sequences 22 S 32.
The LSP-10, SWS-95, SWS-112, SLB-28, SLO40 and LLO-22 sequences all involved a loss of decay heat removal (Emergency Core Cooling System (ECCS) or auxiliary feedwater to the steam generators) in conjunction with a failure of the containment spray system. Based upon the internal events Level II results, core damage, in general, is expected to occur in the range of 2-to-3-17
4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after accident initiation ifdecay heat removal is lost.
As for containment performance, containment spray failure greatly reduces the availability of water cooling on the failed core in the containment reactor cavity after vessel failure.
XVith less water in the cavity, containment pressurizcs at a much slower rate due to less steaming from the failed core and containment failure occurs much later in the accident. Again, this is a comparison to Level lIaccident progression.
The SOS-113, SLB-29, SLO-41 and LLO-32 sequences failed due to ice condenser failure, which was speciTically modeled.
The ice condenser was not modeled within the internal events analysis due to its high availability, thus no analogies can be drawn.
However, with Cook Nuclear Plant being an ice condenser containment plant, chances of containment failure following an accident significantly increase after losing the ice condenser and containment failure could occur sooner in an accident.
After containment failure, any water inside containment may boil off, thereby preventing ECCS from removing decay heat via recirculation mode, which would lead to core damage. Although the seismic failure of the ice condenser to the total seismic core damage frequency, it was a much lower contributor than those items identified above.
creenin riterinn 4 This criterion requires that "systemic sequences that contribute to a containment bypass frequency in excess of 1E-8 per reactor year" be identified.
For the seismic PRA, containment bypass is assumed ifthe Reactor Protection System/Engineered Safety Features Actuation System (RPS/ESFAS) fails (e,g., signals fail to isolate the containment).
The seismic PRA does not differentiate between signals for containment isolation and signals for ESFAS actuation, thus, the results reported here are conservative.
Note that, even ifthe RPS failure represents component actuation, it could be anticipated that containment cooling systems such as the containment spray system would fail to start, thus eventually leading to a containment bypass failure event.
The RPS/ESFAS is represented in the seismic PRA by a basic event referred to as "Miscellaneous Panels."
As presented in Tables 3.1.54 and 3.1.5-5, failure of the miscellaneous panels (RPS/ESFAS) is not a dominant contributor.
For the "normal power" cases, RPS contributes approximately 76% to the core damage frequency for seismic interval 1 and 15% for seismic interval 3. Although it appears that RPS is a dominant contributor for seismic interval 1, its contribution to the total seismic CDF is less than 1%. For the LOSP cases, RPS is only a factor for seismic interval 3, where RPS contributes approximately 12% to the core damage frequency.
A list of all the potential containment bypass sequences with a frequency in excess of 1E-8/yr is presented in Table 3.1.5-7.
The accident sequences (cutsets) as shown in Table 3.1,5-8 meet more than one screening criteria, Sequences 1 through 35 meet 3 of the 4 criteria.
Sequences 14 and 34 meet all four of the criteria.
The plant damage states for the top 35 sequences were examined.
The seismic core damage frequency per plant damage state is presented in Table 3.1.5-9.
As seen in this table, the dominant damage state is category THIF, which represents that a transient event has occurred and the hydrogen igniters and containment air recirculation fans failed to operate during the 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the accident.
3-18
3.155 Sensitivity Analysis Com arison to the LLNLHazard urves for Initiatin Events:
Following the guidance of Reference 1, Section 3.1, a hazard curve comparison was performed that compared the LLNLhazard spectra to the Cook Nuclear Plant hazard spectra.
Since Electric Power Research Institute (EPRI) hazard curves do not exist for Cook Nuclear Plant, Paul C. Rizzo Associates conducted a probabilistic seismic hazard analysis for Cook Nuclear Plant (Reference 4) that took the place of the EPRI hazard curves.
Separately, in a comparison of the ground response spectral shapes (LLNL'based Uniform Hazard Spectra (UHS) to the Cook Nuclear Plant ground design response spectra (GDRS), it was found that the spectral shape of the GDRS enveloped that of the UHS for the seismic frequency range of most concern at Cook Nuclear Plant (see Reference 13). Therefore, the individual component fragilities associated with the IPEEE that predict component or structural failure for various seismic levels were based upon the Cook Nuclear Plant GDRS. This leads to lower seismic capacities for the modeled components in this seismic PRA. Components with lower capa'cities have a higher probability of failure for a given seismic level. This is further explained in Section 32.6, Uniform Hazard Spectra Evaluation.
Note that Section 32.6 addresses component fragilities based upon UHS compared to those based upon GDRS.
Since the spectral shapes are similar (UHS to GDRS), a complete separate analysis using both hazard curves was not necessary (Section 3,1.12 of Reference 1).
However, another seismic core damage frequency was obtained using initiating event frequencies based on the LLNLhazard curves and the conservative component fragilities derived from the GDRS. Initiating event frequencies derived from the median LLNL hazard curve are shown in Table 3.1+-10.
Methods similar to those used for calculating the original seismic core damage frequency were used.
The core damage frequency based upon the LLNLhazard curves is 3.07E-04 (see Table 3.15-11).
This is 17 times larger than the L83E-05 core damage frequency shown above (based on Cook Nuclear Plant hazard spectra).
This is an expected result since the LLNL frequencies of exceedance for all seismic levels are much higher than those associated with Cook Nuclear Plant seismic hazard curve.
Overall, the following conclusions were reached; 1, Core damage frequency based upon LLNLhazard curve initiating event frequencies gives a much larger value (17 times greater) than the Cook Nuclear Plant site specific seismic hazard curve generated in Reference
- 4. This is due to the larger seismic frequencies of exceedance associated with the LLNLhazard curves.
and
- 2. Rankings of the dominant contributors to seismic core damage frequency remain the same regardless of which seismic hazard curve the component fragilities are based on.
Even though the LLNLcurves were evaluated only to 1.0g (Cook Nuclear Plant hazard spectra went to ling), the stated conclusions are still valid since seismic interval two (026g to 0$0g) failures dominate both core damage frequencies.
Contributions to core damage frequency above 1.0g are very small.
Anal si f Dominant ontri ut rs'eismic interval 2 failures (026g to 050g) were the dominant contributors to core damage frequency (CDF)
(See Table 3.1$ -3). Within interval 2, failure of the AuxiliaryBuilding, 600VAC transformers and the Emergency Diesel Generator Fuel Oil Day Tanks were the most significant items.
The sensitivity analysis presented here concentrates only on seismic interval 2.
3-19
The significance of altering the dominant contributors was evaluated by setting the seismic failure probability of each contributor to zero and individually requantifp4ng.
This gave a measure of the net reduction in risk that would occur ifthat component would never fail due to seismic shaking.
As can be seen in Table 3.1$ -12, no seismic failure of the AuxiliaryBuilding has the greatest effect on reduction to seismic core damage frequency.
This result makes sense since Auxiliary Building failure was the leading dominant contributor.
However, it is important to realize that the underlying assumption behind Auxiliary Building failure was that everything within the building confines was destroyed, including electrical wiring shearing, as the structure collapsed.
Even though this was a conservative assumption, it sufficed for this project barring a more indepth analysis on AuxiliaryBuilding Failure. In actuality, auxiliary Building failure probably would not destroy all components inside.
EDG Fuel Oil Day Tank and 600 VAC Transformer failure were governed by failures of adjacent walls.
Reducing seismic failures for these components may involve fixes that would probably reinforce these walls to beyond design basis criteria.
Uncertainty in the seismic fragilities calculations was addressed by using beta factors that represented uncertainty (Au). This uncertainty in component or structure capacity is attributed to engineering judgment or professional opinion.
These values are shown in Table 3.1 4-1.
However, CDF sensitivity requantifications were not performed using fragilities with zero Au factors since the Gu factors for the dominant contributors were zero initially. In the development of the component fragilities, rather than insert uncertainty (which could vary greatly) into these fragilitycalculations, it was decided to leave any uncertainty contributions out of these calculations, except in certain cases (see Table 3.1.4-1).
Even though uncertainty estimates could vary greatly, uncertainty judgement would have been applied consistently to the (Au) factors, had values been assigned.
Thus, it is expected that even though the seismic core damage frequency could change, rankings of the dominant contributors would remain the same lf (Au) values were applied.
Factors associated with randomness (Ar) were included in the fragilitycalculations.
An example of randomness is the variation in material properties that exists due to manufacturing or construction methods.
3.1.6 Analysis of Containment Performance This information is covered in Section 3.15 in the discussion on Screening Criterion 3 and 4. Also, during the plant walkdowns, containment mechanical penetrations and the containment isolation valves were analyzed for the ability to withstand seismic events. The penetrations and isolation valves from both inside and outside of containment were examined. Based upon these plant walkdowns, no significant seismic hazards were found to exist and it was determined that these components possess a high capability to withstand seismic events. The isolation valves receive actuation signals from the Engineered Safety Features Actuation System (ESFAS). Contributions to seismic core damage frequency from ESFAS were found to be less than 1/o (Section 3.15). Additionally, the hydrogen igniters were found to be very rugged seismically and were screened out of the evalu'ation process (electrical power to the igniters was evaluated).
3-20
32 USI AM, GI-131, and Other Seismic Safety Issues 323.
GI-131 Potential Seismic Interaction Involving the Movable In&ore Flux Mapping System Used in Westinghouse Plants As part of the Containment Walkdown, the fiux mapping cart and seal table were examined for potential seismic interaction, This was done following the recommendations made in Reference 1,to coordinate the IPEEE with ongoing programs.
GI-131 was noted as one of these programs.
Reference 1, Section 6, page 19 states:
"GI-131, 'Potential Seismic Interaction Involving the Movable In-Core Flux Mapping System Used in Westinghouse Plants,'as identified because portions of the in-core iiux mapping system that have not been seismically analyzed are located directly above the seal table.
Failure of this equipment during a seismic event could cause multiple failures at the seal table and could produce an equivalent small-break LOCA."
NRC IE Information Notice 85-45 noted the NRC's concern that the movable flux mapping cart used in Westinghouse plants could come loose during a design basis seismic event and fall on the seal table, which is a safety related pressure boundary, and cause a small LOCA. The NRC requested the utilities to review the structural adequacy of the cart mounting details, In response to the information notice, the seismic structural adequacy of the upper cart supports were reviewed by AEPSC considering the occurrence of a 02g design basis earthquake.
As a result of this evaluation, the hold down straps attached to the top of the cart were redesigned and these design changes were made in the field: In addition, AEPSC installed a lower lateral restraint to the flux mapping cart at an elevation just above the seal table.
Based on the flux mapping cart design details and results of the mlkdown, a HCLPF seismic capacity of 032g was calculated for this component.
The upper supports are the critical elements.
322 USI A-17 System Interactions in Nuclear Power Plants
.This issue was addressed as part of the IPEEE plant walkdowns and as part of the IPE program at Cook Nuclear Plant. USI A-17 related items discovered during the plant walkdowns (seismic, fire and internal flooding walkdowns) have been incorporated into the seismic, fire or internal iiooding analysis as necessary, addressed administratively, fixed at Cook Nuclear Plant or placed into an action item tracking status.
323 USI A45 Shutdown Decay Heat Removal Requirements The USI AAS external events findings were combined with the findings from the internal events analysis.
These are listed in Section 3.43 of the internal events IPE submittal.
32.4 Eastern US. Seismicity (TIie Charleston Earthquake)
As noted in Generic Letter 88-20, Supplement 4 (Reference 12), using the seismic hazard curves developed by LLNLand EPRI within a SPRA resolves the Eastern U.S. Seismicity issue, Since EPRI hazard curves do not exist for Cook Nuclear Plant, another set of hazard curves was developed by Paul C. Rizzo Associates for Cook Nuclear Plant. This is further explained within the Hazard Analysis section of this submittal, Therefore, the Rizzo hazard curves as well as the LLNLhazard curves were incorporated within the SPRA, thus resolving the Charleston Earthquake issue for Cook Nuclear Plant.
325 Soil Liquefaction Reference 1 has required that the soil liquefaction potential be examined as part of the IPEEE program.
The impact on plant operation is to be assessed from the point of view of both potential for and consequences of liquefaction.
Reference 6 (UFSAR), Section 5.0, states that "relative densities of the sands were found to be in the range of values which are not susceptible to liquefaction." Since this statement is 3-21
not sufficient to meet the IPEEE requirements, additional evaluation was required to assess liquefaction potential.
As suggested in the IPEEE Guidelines, the assessment of soil liquefaction potential at the Cook Nuclear Plant site was performed using the analysis approach identified in the EPRI report NP4041 (Reference 9).
The liquefaction potential at the Cook Nuclear Plant site was evaluated, concentrating on the Containments at both Units 1 and 2 as well as the common AuxiliaryBuilding, The description of the exploratory borings given in Reference 6 (UFSAR), Appendix I, indicates a brown uniform sand (medium loose to medium dense fine sand) from the ground surface (608 elevation - UFSAR) to approximately the 590 elevation level, The building structures are founded on very dense, slightly cemented fine to medium brown sand with coarse sand and pebbles, or founded on hard to very stiff gray silty clay.
The exploratory boring data for borings No. 114, 115, 116, 117, 118, and 119 were used in the assessment.
It was found that there is no potential for liquefaction based on the Standard Penetration Test (SPT) data
" obtained for borings 117 and 118. The borings that had adjusted blow counts, (Nt)@> below 30 were evaluated in more detail. The zone of potential liquefaction was established for these critical borings (boring No. 114, 115, 116, and 119).
Boring 115 indicated the greatest potential for liquefaction. This boring is directly below the Unit No. 1 Containment, It is noted that the subsurface material had been removed during plant construction and the reactor cavity foundation is resting on the underlying stiff clay layer.
This clay layer will not liquefy based on the assessment methodology given in EPRI report NP4041 (Reference 9) for clayey soils. The clay layer at the Cook Nuclear Plant site has a water content less of than 90Vo of the liquid limit, and is therefore outside of the NP-6041 characteristics for clayey soils vulnerable to seismic liquefaction.
Boring numbers 114 and 116 have a single layer where potential liquefaction is indicated for ground seismic levels in excess of 035g, Boring 119 has two layers near the clay boundary where the potential for liquefaction is indicated for seismic ground accelerations greater than 0'. The layers of soil within these borings that have characteristics indicating the potential for liquefaction are local in nature not extending across the full soil layer under the building structures in question.
Further, they are at depths greater than 30 feet, and it is expected that the overlying consolidated sands will redistribute the loads due to the building structures.
Additionally, it is noted in Reference 9 that there is evidence from recent studies that some residual strength is retained by sandy soils subjected to liquefaction. For the layers identified as having potential liquefiable characteristics, the post-liquefaction residual strength could be much greater than 1000 psf. This wilt contribute significantly to the capability of the soil layers to transmit loads to the underlying clays.
Based on the evaluation performed, there is no potential for soil liquefaction at the Cook Nuclear Plant site that would effect the structural integrity of the Containment Buildings and the Auxiliary Building.
This finding is consistent with the soil studies previously performed and reported in Reference 6 (UFSAR).
It Is noted on page G-25, Section XIIof Reference 6 (UFSAR - Appendix G, Amendment 5):
"In our judgement all subsoil strata underlying this plant possess exceptionally high stability under earthquake loadings. It is entirely inconceivable that the sand stratum could liquefy even in earthquakes substantially exceeding 02g acceleration."
Further, on page G-26, of Reference 6
(UFSAR - Appendix G, Amendment 5) it is stated:
"Earthquakes will not produce any objectionable effects on the subsoil strata.
In fact the dense sand and the highly overconsolidated clay are exceptionally stable materials under any earthquake loadings."
In conclusion, the site soll configuration at Cook Nuclear Plant, developed from the existing subsurface borehole data, was investigated to assess the potential for soil liquefaction given a seismic event.
The liquefaction potential of sand was determined using Seed's approach as recommended in EPRI Report NP-3-22
6041 (Reference 9). The liquefaction potential of the day was assessed by comparison of soil characteristics associated with clays that are vulnerable to liquefaction defined in Reference 9, to the properties of the clay at the Cook Nuclear Plant site. It is concluded from the assessment that the dense beach sands and clay deposits at the Cook Nuclear Plant site are not susceptible to liquefaction causing loss of load carrying capacity during a seismic event, There is no potential of failure of the Containment Buildings or the Auxiliary Buildings due to soil liquefaction.
Therefore, the consequences of soil liquefaction due to seismic excitation are not signiiflicant and willnot affect the performance of the plant structures.
3.2.6 Uniform Hazard Spedra Evaluation In addition to using the Cook Nudear Plant Ground Design Response Spectra, fragility data associated with the uniform hazard spectra (UHS) was developed for Cook Nuclear Plant.
The UHS is based on the LLNL10,000 year return period median spectral shape.
Comparing this data with the plant specific site design spectra fragility data employed in the Seismic PRA analysis indicates that:
o The standard deviations (P, and P) are the same behveen the bvo fragility data analyses, and o
The median ground seismic level (A~) associated with the UHS is greater than the plant specific levels.
As A~ increases, the associated equipment and building seismic failure probabilities decrease.
This is due to the fact that the A~ value represents a 50% probability that the plant can withstand an earthquake of the A~ magnitude.
Therefore, the UHS data indicates that the components will be able to withstand a larger earthquake than the plant specific data shows.
Based on a review of the UHS fragility data, the seismic failure probabilities decrease at approximately the same rate for all equipment analyzed in the seismic PRA. As reported in Section 3.1.5, the dominant contributors to seismic core damage include: 600 VAC transformers, EDG fuel oil day tank, ice condenser, and auxiliary building. The UHS fragility data for these components and building show that for seismic interval 2 the probability of failure decreases, but for seismic interval 3 it remains the s'arne for these four components/building.
Although the failure rates decrease, the UHS data does not indicate that any of these dominant contributors would drop significantly such that they are no longer dominant contributors.
Additionally, the UHS fragility data indicates that a component or building which does not appear as a dominant contributor in the SPRA will also not appear ifthe core dainage frequency was requantiiflied using the UHS fragility data.
These findings are due to the fact that no one equipment or structure A~ increased or decreased significantly compared to all the other components analyzed.
In addition, by using the UHS fragility data, the seismic core damage frequency would decrease since the failure probabilities decrease.
3.2.7 Seisimcally Induced Flooding Flooding due to tank and pipe rupture was examined as part of the internal flooding analysis.
AEPSC flooding calculations were performed in response to IE Notices 8341 and 8749.
They addressed worst case flooding scenarios which could occur as a result of a seismic event, and concluded that safety equipment in the auxiliary building was not vulnerable to flooding events since all safety equipment is mounted on concrete pads and elevated a minimum of two feet.
However, turbine hall flooding could Jeopardize operability of components which are credited in the Level I PRA, namely the non-essential service water pumps which are located on the sub-basement level of the turbine hall. This is addressed as part of the internal flooding analysis.
Flooding due to the rupture of non-seismic fire protection piping was also reviewed. Cook Nuclear Plant has a dry pipe preaction fire sprinkler system within the AuxiliaryBuilding (in addition to Halon systems), where a majority of the safety related equipment is found. This system has pilot lines which contain glass fuses. Melting of a glass fuses bleeds off compressed air within the pilot line and activates 3-23
deluge valves, which charge sprinkler lines with water. Walkdown findings revealed several pilot lines located in near proximity to other components such as pipe supports, HVAC ducting and platforms.
Flexibilityof the pilot lines willallow them to swing into adjacent obstacles and break the glass fuses in a few locations in the plant, which would charge associated sprinkler lines with water. This in itself is not a problem unless a sprinkler head also breaks, thus spraying down equipment. During the seismic plant walkdowns, sprinkler head interactions were not found to be a concern. Thus, seismically induced flooding from fire protection systems is not a concern at Cook Nuclear Plant.
Overall, seismically induced flooding does not pose a hazard at the Cook Nuclear Plant.
3.2.8 Relay Chatter For the IPEEE, the relay chatter issue involved interfacing with the USI A-46 program "Verification of Seismic Adequacy of Equipment in Operating Plants" at Cook Nuclear Plant.
Using the guidance in Reference 1 regarding SPRA methodology'enhancements, USI AM "bad actor" relays identified as part of that program were also found within systems modeled for the SPRA. Plans have been developed to replace these relays at Cook Nuclear Plant winch affect operability of safety related equipment. Even though a more complete comparison of the chatter-prone relays affecting SPRA systems with those in the USI A-46 scope is still in progress, relay chatter is not considered to be a problem at Cook Nuclear Plant since a vast majority of the USI AMsystems are also modeled within the SFRA.
3B References NUREG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities", June 1991 2.
NUREG/CRM40, "Procedures for the External Event Core Damage Frequency Analysis for NUREG-1150", November 1990 3.
NUREG/CR4550, Vol. 3, Rev. 1, Part 3, "Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External Events", December 1990 4,
Probabilistic Seismic Hazard Analysis - Donald C. Cook Nuclear Power Plant - Bridgman, Michigan", Paul C. Rizzo Associates, Inc., April 1991 5.
- EPRI NP4726, Vol. 12, "Seismic Hazard Methodology for the Central and Eastern United States", 1988 6.
Updated Final Safety Analysis Report, Donald C. Cook Nuclear Plant, American Electric Power Service Corporation, 1990 7.
Seismic Fragility Assessment, Donald C. Cook Nuclear Plant, Westinghouse Electric Corporation, February 1992 8.
9.
Field Walkdown Procedures for Seismic Probabilistic Risk Assessment of Nuclear Power Plants In Response to USNRC Generic Letter 88-20, EQE Engineering, Document Number 52077.01-P-001, March 1991 EPRI NP-6041, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin",
October 1988 10.
NUREG/CR-3660, "Probability of Pipe Failure in the Reactor Coolant loops of Westinghouse PWR Plants", Vol. 3, February 1985 3-24
11.
Generic Implementation Procedure (GIP) for Seismic Verification of Nuclear Hant Equipment, June 1991 (SQUG document) 12.
USNRC Generic Letter 88-20 Supplement 4, "Individual Hant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities -10CFR50.54 (f), June 1991 13.
Effects of Ground Spectral Shape on Hant Response, Donald C. Cook Nuclear Hant, Paul C.
Rizzo Associates, Inc., November 1991 14.
NUREG/CR-3428, "Application of the SSMRP Methodology to the Seismic Risk at the Zion Nuclear Power Plant", November 1983 3-25
TABLE3.1.1-1 SEISMIC ACCELERATION LEVEL PROBABILITIES (COOK SITE)
(Event Tree iiode: SIX I
I I
I I
I I
I Seismic lnterva 1 "X" I
1 I
Acceleration Range *
( 0.10 - 0.25 I
Hedian Accel.
(A
) '
0.175 I
0.880 I
I 2
3 4
5 6
I 0.26 - 0.50 0.51 - 0.75 0.76 - 1.00 1.01 - 1.25 1.26 - 1.50 I
I 0.380 0.630 1.130
~
1
~ 380 I
I I
I
--I I
I 7.85E-OS 1.85E-OS 1.33E-06 2.08E-07 5.56E-OB l.g3E-OB Frequency of Exceedance I
- 2.09E-OS
- 1.47E-OG
- 2.23E-07
- 5.82E-OB
- 2.0IE-OB
- 8.12E-09 I
I-I I
I AA I
Frequency of Occurrence 5.76E-OS 1.70E-OS 1.1IE-06 1.49E-07 3.55E..OB 1.12E-OB I
All accelerations units are g's.
'" Frequencies are calculated on a per year basis 3-26
TABLE3.13-1 SCOPE OF SEISMIC FRAGILITYASSESSMENT BUILDINGS, STRUCTURES AND CRANES Circulating Water/Service Water Screen House Structure Auxiliary Building Structure including Control Room and Switchgear Building Turbine Room Foundation Containment Structure Containment Polar Crane lce Condenser Structure 3-27
TABLE3.1.3-2 SCOPE OF SEISMIC FRAGILITYASSESSMENT - SYSTEMS/EQUIPMENT Auxiliary Feedwater System
- bfotor-driven pumps
- Turbine-driven pumps
- Piping and Supports
- Valves
- Condensate Storage Tank Component Cooling Water System
- Water Pump
- Main and AuxiliaryHeat Exchangers
- Surge Tank
- Piping and Supports
- Valves Containment Spray System
- Spray Additive Tank
- Containment Spray Pumps (including nearby wall)
- Valves
- Piping and Supports
- Heat Exchangers Essential Service Water
- Piping and Supports
- Valves
- Vertical Turbine Pumps Feedwater System (Portion thereof)
- Feedwater Regulating Valves
- Feedwater Isolation Valves
- Piping and Supports Main Steam Supply System
- Main Steam Isolation Valve (MSIV)
- Motor Operated Isolation Valve
- Safety Valves
- Piping and Supports 3-28
TABLE3.1.3-2 (Continued)
SCOPE OF SEISMIC FRAGILITYASSESSMENT - SYSTEMS/EQUIPMENT
~
- Reactor Vessel
- Reactor Internals
- CRDM's with Rod Position Indicator
- Reactor Coolant Pumps
- Pressurizer
- Reactor Coolant Loop Piping
- Primary Component Supports
- Pressurizer Safety Valves
- Power-Operated Relief Valves
- Heat Exchangers
~
- Residual Heat Removal Pump (including nearby wall)
- RHR Heat Exchanger
- Valves
- Piping and Supports
- Accumulator Tanks
- Centrifugal Charging Pumps
- Safety Injection Pumps
- Refueling Water Storage Tank
- Boron Injection Tank (including nearby wall)
- Boric Acid Transfer Pump e
- Electrical Components and Cabinets e
Emergency Diesel System
- Diesel Generator
- Fuel Oil Day Tank (including nearby wall)
- Diesel Oil Pump
- Electrical Distribution
- Valves
- Piping and Supports Offsite Power - Switchyard
- Ceramic Insulators Other containment systems
- Hydrogen igniters
- Containment air recirculation fans 3-29
TABLE3.1.4-1 COMPONENT AND STRUCTURE FRAGILITIESAND HCLPFs om onent/ tructure Screen House
- Reinforced Concrete Walls
- Piers
- Base Slabs
- Crane Rumvay Girders
- Columns/Budding Failure
- Columns/Shear Failure Standard Deviations Qr Bu B
0.16 0.00 0.16 0.16 0.00 0.16 0.16 0.00 0.16 0.30 0.00 0.30 0.10 0.00 0.10 0,31 0.00 0.31 0.62 0.48 Cook 1.05 O.S1 Cook 0.44 0.34 Cook 1.33 0.81 Cook 1.40 1.19 0.72 0.43 Cook Cook Ground Seismic Level Aru
~HLPF Source AuxiliaryBuilding
- Soil Pressure
- Foundation Mat
- Steel Structure 0.30 0.00 0.30 0.09 0.00 0.09 0.13 0.00 0.13 1.36 0.83 0.41 0.35 0.38 0.30 Cook Cook Cook
- Concrete Structure 0.14 0.00 0.14 0.38 0,30 Cook Turbine Pedestal
- Columns - Bent I, XII
- Columns - Bent II, XI
- Columns - Bent III,IV IX, and X
- Columns - Bent V, VIII 0.12 0.00 0.12 0.12 0.00 0.12 0.12 0.00 0.12 0.12 0.00 0.12 0.51 0,42 0.66 0.54 0.64 0,53 0.82 0.67 Cook Cook Cook Cook
- Columns - Bent VI, VII Containment
- Containment Rebar
- Soil Pressure 0.12 0.00 0.12 0.31 0.00 0.31 0.31 0,00 0.31 0.50 0.40 1.53 0.92 0.99 0.59 Cook Cook Cook 3-30
TABLE3.1.4-1 (Cont.)
Br Bu B
Am HCLPF Source Polar Crane
- Girder/Trunnion Weld Ice Condenser 0.15 0.00 0.15 0.39 0.30 Cook
- Top Deck Structure
- Ice Baskets
- Lower Support Structure
- Lattice Frame, Cradles and Columns 0.11 0.00 0.11 0.20 0.00 0.20 0.11 0.00 0.11 0.39 0.00 0.39 0.52 0.43 0.66 0.47 0.51 0.42 0.91 0.48 Cook Cook Cook Cook
- Embedments on Crane Wall
- Phasing Link RCS Primary Components
- Reactor Vessel
- Lower Internals (Thermal Shield and Core Barrel)
- Upper Internals
- Control Rod Drive Mechanisms with RPI
- Reactor Coolant Pump
- Pressurizer and Supports Reactor Coolant Loop Piping Primary Component Supports
- Reactor Vessel
- Ste~ Generators
- Reactor Coolant Pumps 0.32 0.00 0.32 0.39 0.00 0.39 0.13 0,00 0.13 0,27 0.00 0,27 0.14 0.00 0.14 0.32 0.00 0.32 0.32 0.00 0.32 0.27 0.00 0.27 0.14 0.28 0.31 0.14 0,00 0.14 0,18 0.00 0.18 0.27 0.00 0.27 0.32 0.00 0.32 1.21 0.71 0.87 0,46 2.10 1.70 1.17 0.75 0.65 0.52 2.30 1.36 1.62 0.96 2.84 1.82 0.84 0.42 2.67 2.12 3,10 2,30 1.72 1.10 1.97 1.16 Cook Cook Cook Cook Cook Cook Cook Cook Generic Cook Cook Cook Cook 3-31
TABLE3.1.4-1 (Cont.)
om onentl tructure Pressurizer Br Bu Am
~HLPP Source
- Safety Valves 0.20 0.35 0.40 2.37 0.96 Generic
- PORVs Regenerative Heat Exchanger Excess Letdown Heat Exchanger Level & Pressure Transmitters 0.26 0.60 0.65 0.10 0.00 0.10 0.10 0.00 0.10 0.10 0.00 0.10 1.29 0.31.
0.75 0.63 0,73 0.61 0.75 0.63 Generic Cook Cook Cook AuxiliaryPiping Systems (Secondary Side)
- Piping
- Supports ECCS Pumps
- Centrifugal Charging
- Safety InIjection
- Boric Acid ECCS Tanks 0.23 0.00 0.23 0.23 0.00 0.23 0.05 0.00 0.05 0.10 0.00 0.10 0.10 0.00 0.10 0.10 0.00 0.10 2.00 1.37 0.44 0.30 0.49 0.46 0.94 0.79 0.94 0.79 0.94 0.79 Cook Cook Cook Cook Cook Cook"
- Refueling Water Storage
- Boron Injection RHR Heat Exchangers ECCS Valves 0.10 0.00 0.10 0.19 0.45 0.49 0.25 0.45 0.51 0.10 0.00 0,10 0 44 0.37 0.90 0.32 1.42 0.45 0.53 0.44 Cook Generic Generic Cook
- Miscellaneous Isolation
- HPSI Isolation 0,20 0.35 0 40 0.26 0.60 0.65 0.10 0.00 0.10 3.79 1.53 2.36 0.57 2.25,1.90 Generic Generic Cook 3-32
TABLE3.1,4-1 (Cont.)
Br Bu B
Am H~LPF
$ource Emergency Diesel Generators
- Diesel Oil Pump
- Fuel Oil Day Tank
- Diesel Generator
- Transformer
- Battery Rack
- Motor Control Center
- Charger AB, CD, N
- Control Panel
- AC Distribution Panel
- Miscellaneous Valves
- Batteries
- Cable Trays Containment Spray
- Pumps
- Spray Additive Tank
- Heat Exchangers
- Spray Additive Tank Vlvs
- System Valves Containment Recirc Fans 0.25 0.27 0,37 0.05 0.00 0.05 0.25 0.31 0AO 0.10 0.00 0.10 0.05 0.00 0.05 0.10 0.00 0.10 0.21 0.21 0.30 0.17 0.00 0.17 0.31 0.49 0.58 0.48 0.74 0.88 0.48 0.74 0.88 I
0.26 0.60 0.65 0.21 0,21 0.30 0.34 0.19 0.39 0.05 0.00 0.05 0.20 0.35 0.40 0.10 0.00 0.10 0.26 0.60 0.65 0.26 0.60 0.65 0.27 0.31 0.41 2.00 0.85 0.27 0.25 0.91 0,36 0.66 0.55 0.38 0.36 0.66 0.55 0.71 0.36 0.29 0.22 1.52 0.41 5.90 0.79 5.11 0.68 2.15 0.52 0.71 0.36 1.98 0.83 0.49 0.46 1.46 0.59 0.40 0.34 2,48 0.60 2.36 0.57 0.91 0.35 Generic Cook Generic Cook Cook Cook Generic Cook Generic Generic Generic Generic Generic Generic Cook Generic Cook Generic Generic Generic 3-33
TABLE3.1.4-1 (Cont.)
Com onent/ tructure AuxiliaryFeedwater
- Motor Driven Pump
- Turbine Driven Pump
- Pump Isolation Valves
- SG Isolation Valves
- Fans (Room Cooling)
Reactor Protection System Bu B
0.21 0.27 0.34 0,21 0.27 0,34 0.31 0.34 0.46 0.26 0.60 0.65 0.27 0.31 OA1 Aro
~HLPF Source 2.28 1.03 2.28 1.03 Generic Generic 3.90 1.34 Generic 4.37 1,06 Generic 1.09 0.42, Generic
- MCC
- Crid Inverter
- Miscellaneous Panels
- Cable Trays
- Crid Transformer
- RPS/Aux Rack/STC
- Main Control Board Component Cooling Water
- Pumps (Piping Supports)
- Pumps (Water)
- Heat Exchanger
- Surge Tank
- Valves Essential Service Water Sys
- ESW Pumps
- ESW Valves
- ESW Strainers 0A8 0.74 0.88 0.26 0.35 0A4 OAS 0.66 0.82 0,34 0.19 0,39 0.28 0.30 0.41 0.05 0.00 0.05 0.48 0.74 0.88 0.00 0.00 0.00 0.21 0.27 0.34 0.10 0,00 0.10 0.20 0.35 0.40 0.26 0.60 0.65 0.10 0.00 0.10 0.26 0.60 0.65 0.22 0.32 0.39 3.32 0.44 7.61 2.78 3.40 0.52 1.98 0.83 2,22 0.85 0.47 OA4 5.11 0.68 0.24 0.24 2.28 1.03 0,54 0.45 1.30 0.52 2.15 0,52 0.46 0.39 2.15 0.52 2.01 0.82 Generic Generic Generic Generic Generic Cook Generic Cook Generic Cook Generic Generic Cook Generic Generic 3-34
TABLE3.1.4-1 (Cont.)
om onent/ tructure Main Steam System Am HCLPF source
- MSIVs
- PORVs
- MSIV Isol. Valves
- Safety Valves
- Steam Generator Dump Main Feedivater System
- Isolation Valves
- Control Valves Switchyard
- Ceramic Insulators 0.10 0.00 0.10 0.10 0.00 0.10
'.10 0.00 0.10 0,20 0.35 0.40 0.10 0.00 0.10 0.26 0.60 0.65 0.31 0.34 0.46 0.25 0.25 0.35 1.88 1.58 1.75 1.48 3.50 2.95 3.96 1.60 1.29 1.09 2.10 0.51 3.31 1.13 0.20 0.09 Cook Cook Cook Generic Cook Generic Generic Generic 3-35
TABLE3.1.4-2 FAILURE PROBABILITYFOR MODELED COMPONENTS AND STRUCTURES IN EACH SEISiAIIC INTERVAL Failure Probability for Each Seismic Interval avith 50% Confidence Screen House
- Reinforced Concrete Walls 1,33E-15 1.11E-03 5.40E-01 9.86E-01 1.00E+00 1.00E+ 00
- Piers 0.00E+00 1.06E-10 7.05E-04 1.35E-01 6.77E-01 9.56E-01
- Base Slabs 4.15E-09 1.80E-01 9.88E-01 1.00E+00 1.00K+00 1.00E+00
- Crane Runway Girders
- Columns/Buckling
- Columns/Shear AuxiliaryBuilding
- Soil Pressure
- Foundation Mat
- Steel Structure
- Concrete Structure Turbine Pedestal 6.88E-12 1.48E-05
. 6.37E-03, 8.43E-02 2.93E-01 0,00E+00 0,00E+00 7.02E-16 1.72E-06 1.61E-02 2.52E-06 1.96E-02 3.33E-01 7.41E-01 9.27E-01 4.11E-12 1.07E-05 5.16E-03 7.34E-02 2,68E-01 0.00E+00 1.99E-01 1.00E+00 1.00E+00 1.00E+00 1.23E-09 5.00E-01 1.00E+00 1.00E+00 1.00E+00 1.53E-08 5.00E-01 1.00E+00 1.00E+00 1.00E+00 5 49E-01 4,43E-01 9.82E-01 5.19E-01 1.00E+ 00 1.00E+00 1.00E+00
- Columns - Bent I, XII
- Columns - Bent II, XI 2 44E-19 7.10E-03 9.61E-01 1.00E+00 1.00E+00 1.00E+00 0.00E+00 2.11E-06 3.49E-01 9.92E-01 1.00E+00 1.00E+00
- Columns - Bent III,IV IX, and X 0.00E+00 6,99E-06 4 48E-01 9.96E-01 1.00E+00 1.00E+00
- Columns - Bent V, VIII
- Columns - Bent VI, VII 0.00E+00 7.30E-11 1.40E-02 7.22E-01 9.96E-01 1.00E+ 00 1.08E-18 1.11E-02 9.73E-01 1.00K+00 1.00E+00 1.00E+00 3-36
TABLE3.1.4-2 (Cont.)
Failure Probability for Each Seismic Interval with 50% Confidence Containment
- Containment Rebar
- Soil Pressure 1,33E-J2 3,51E-06 2.10E-03 3.72E-02 1.64E-01 1.14E-08 1.01E-03 7.24E-02 3.52E-01 6.65E-01 3.70E-01 8.58E-01 Polar Crane
- Structure Ice Condenser
- Top Deck
- Ice Baskets 4.59E-08 4.31E-01 9.99E-01 1.00E+ 00 I.OOE+00 1.00E+ 00 1.60E-11 2.89E-03 4.08E-01 9.25E-01 9.96E-01 1.00E+00 O.OOE+00 2.18E-03 9.60E-OI 1.00E+00 1.00E+00 1.00E+00
- Lower Support Structure O.OOE+00 3.74E-03 9.73E-01 1.00E+00 1.00E+00 1.00E+00
- Lattice Fraine, Wall Panels and Columns 1.18E-05 1.26E-02 1.73E-01 4.66E-01 7.11E-01 8.57E-01
- Phasing Link RCS Primary Components 1.96E-05 1.68E-02 2.04E-01 5.12E-01 7.49E-OI
- Embedments on Crane Wall 7.59E-10 1.48E-04 2.07E-02 1.60E-OI 4.15E-01 6.59E-01 8.82E-01
- Reactor Vessel
- Lower Internals (Core Barrel & Thermal Shield)
- Upper Internals
- Control Rod Drive Mechanisms O.OOE+00 O.OOE+00 O.OOE+00 1,11E-11 9.35E-07 6.20E-04 9.83E-13 1.56E-05 1.09E-02 1 46E-01 4 49E-01 7.30E-01 O.OOE+00 6.30E-05 4.12E41 9.85E-01 1.00E+00 1.00E+00 4.15E-16 9.19E-09 2.60E-05 1.34E-03 1.32E-02 5.52E-02
- Reactor Coolant Pump
- Pressurizer and Supports 1.77E-12 2.93E-06 1.58E-03 2.83E-02 1.30E-OI O.OOE+00 4.68E-14 1.22E-08 7.14E-06 3.21E-04 2.71E-07 5.64E-03 1,79E-OI 5.59E-01 8.28E-OI 3.08E-OI 3.76E-03 9 44E-01 3-37
TABLE3.1.4-2 (Cont.)
Failure Probability for Each Seismic Interval with 50% Confidence Reactor Coolant Loop Piping O.OOE+00 O.OOE+00 O.OOE+00 1.11E-15 4.08E-IO 6
1.21E-06 Primary Component Supports
- Reactor Vessel
- Reactor Coolant Pumps Pressurizer
- Safety Valves
- PORVs O.00K+ 00 O.OOE+00 4.34E-19 1.32E-12 1.03E-08 1,29E-17 1.12E-08 9.97E-05 6.53E-03 5.99E-02 1.93E-14 1.36E-07 1.84E-04 5.89E-03 4.12E-02 5.09E-11 2,80E-06 5.07E-04 6.99E-03 3.31E-02 1.13E-03 3.08E-02 1.37E-01 2.79E-01 4.20E-01 3.46E-06 2.07E-01 1,33E-01 8.99E-02 5.41E-01 Regenerative Heat Exchanger O.OOE+00 5.27E-12 Excess Letdown Heat Exchanger O.OOE+00 3.32E-11 4.06E-02 9.45E-01 7.03E-02 9,69E-01 LevelI Pressure Transmitters O,OOE+00 5.27E-12 4.06E-02 9.45E-01 1.00E+ 00 1.00E+00 1.00E+ 00 1.00E+00 1.00E+00 1.00E+00 AuxiliaryPiping Systems (Secondary Side)
- Piping
- Supports ECCS Pumps
- Centrifugal Charging
- Safety Injection
- Boric Acid ECCS Tanks
- Refueling Water Storage
- Accumulators O.OOE+ 00 2.59E-13 2.55E-07 1.79E-04 6.53E43 5.33E-02 3,05E-05 2.62E-01 9.41E-01 9.99E-01 1.00E+00 1.00E+00 O,OOE+00 1.84E-07 1.00K+00 1.00E+00 1.00E+00 1.00E+00 O.OOE+00 5.42E-20 3.15E-05 2.55E-01 9.67E-01 O.OOE+00 5.42E-20 3.15E-05 2.55E-01 9.67E-01 O.OOE+00 5.42E-20 3.15E-05 2.55E-01 9.67E-01 1.00E+00 1.00E+ 00 1.00E+00 2.71E-20 7.13E-02 1.00E+00 1.00E+00 1.00E+00 1.00E+00 4.00E-04 3.88E-02 2.33E-01 4.82E-01 6.79E-01 8.09E-01
- Boron Injection 2.38E-05 5.22E-03 5.72E-02 1.76E-01 3.29E-01 4.78E-01 3-38
TABLE3.1.4-2 (Cont.)
om onent/ tructure Failure Probability for Each Seismic Interval with 50% Confidence RHR Heat Exchangers ECCS Valves 0.00E+00 4.39E44 9.58E-OI I.OOE+00 I.OOE+00 I.OOE+00
- Check Valves 1.18E-14
'.80E-09 4.27E-06 1.46E-04 1.34E-03
- Miscellaneous Isolation 3.47E-05 2.61E-03 2.17E-02 6.57E42 1,30E-OI
'a
- HPSI Isolation O.OOE+00 O.OOE+00 O.OOE+00 O,OOE+00 2.85E-12 Emergency Diesel Generators
" 6.10E-03 2.06E-OI 5.08E-07
- Diesel Oil Pump
- Fuel Oil Day Tank
- Diesel Generator
- Transformer
- Battery Rack
- Motor Control Center
- Charger AB, CD, N
- Control Panel
- AC Distribution Panel
- Miscellaneous Valves
- Batteries
- Cable Trays 1.79E-II 3.19E-06 8.47E-04 1.28E-02 6.04E-02 1,57E-OI 1.74E-05 1.42E-02 1.78E-OI
~
4.67E-OI 7.07E-OI 8.52E-OI O.OOE+00 1.69E-08 3.21E-OI 9.98E-OI I.OOE+00 I.OOE+00 O,OOE+00 5.00E-OI I.OOE+00 I.00K+00 I.OOE+00 I.00K+00 O,OOE+00 1.69E-08 3.21E-OI 9.98E-OI I.OOE+00 I.OOE+00 1.21E-06 1.77E-02 3 44E-01 7.65E-OI 9.41E-OI I 48E-03 9.44E-OI 1.00E+00 I.OOE+00 I.OOE+00 9.65E-OS 8.40E-03 6,44E-02 1.73E-OI 3.05E-OI 3.33E-05 9.38E-04 5.60E-03 1.55E-02 3.05E-02 6.53E45 1.61E-03 8.82E-03 2.31E-02 4.36F=02 6.25E-OS 4.02E-03 3.03E-02 8.60E-02 1.63E-OI 1.21E-06 1.77E-02 3.44E-OI 7.65E-O'I 9.41E-OI 2.35E-IO 1.13E-05 1.64E-03 1.87E-02 7.49E-02 9.87E-OI I.OOE+00 4.34E-OI 4,98E-02 6,89E-02 2.49E-OI 9.87E-OI 1.77E-OI 2.11E-18 I.OOE+00 1.00E+00 I.OOE+00 I.OOE+00 I.OOE+00 3-39
TABLE3.1.4-2 (Cont.)
Com onent/Structure Failure Probability for Each Seismic Interval with 50% Confidence Containment Spray
- Pumps
- Spray Additive Tank
- Heat Exchangers O.OOE+00 1,84E-07 1.00E+00 1.00E+00 1,00E+00 1,00E+00 7.10E-08 4.20E-04 1.85E-02 1.05E-01 2.63E-01 4.44E-01 6.88E-17 3.04E-01 1.00E+00 1.00E+00 1.00E+00 1.00E+00
- Spray Additive Tank Vlvs 2.51E-OS 2.06E-03 1,81E-02 5.66E-02 1.15E-01 1,85E-01
- System Valves Containment Recirc Fans Auxiliary Feedwa ter
- Motor Driven Pump
- Turbine Driven Pump
- Pump Isolation Valves
- SG Isolation Valves
- Fans (Room Cooling)
- MCC
- Crid Inverter
- Miscellaneous Panels
- Cable Trays
- Crid Transformer
- RPS/Aux Rack/STC
- Main Control Board 3.47E-05 2.61E-03 2.17E-02 6,57E-02 1,30E-01 2.06E-01 3.03E-05 1.68E-02 1.86E-01 4.68E-01 7.01E-01 8.44E-01 3.07E-14 8.11E-08 8.49E-05 2.69E-03 2.01E-02 3.07E-14 8.11E-08 8.49E-OS 2.69E-03 2.01E-02 7.59E-12 2.09E-07 3.71E-05 6.07E-04 3.55E-03 4.31E-07 9.39E-05 1.53E-03 7.13E-03 1.93E-02 4.31E-06 5.18E-03 9.12E-02 3,01E-OI 5,35E-01 7.11E-02 7.11E-02
- 1. 12E-02 3.90E-02
- 7. 17E-01 4.24E-04 7.00E-03 2.98E-02 6.61E-02 1.11E-01 2.52E-18 3.121':12 5.51E-09 3.75E-07 6.09E-06 1,39E-04 3.62E-03 1.94E-02 4.88E-02 8,85E-02 2.35E-10 1.13E-05 1.64E-03 1.87E-02 7.49E-02 2.99E-10 8.49E-06 1.07E-03 1.21E-02 4.99E-02 1.60E-01 4.50E-05 1.35E-01 1.77E-01 1,23E-01 O.OOE+00 1.06E-05 1.00E+00 1.00E+00
.1.00E+00 1.00E+00 6.53E-05 1.6IE43 8.82E-03 2,31E-02 4,36E-02
. 6.89E-02 3-40
TABLE3.1.4-2 (Cont.)
Failure Probability for Each Seismic Interval with 50% Confidence Com onent/Structure 1
2 3
4 Component Cooling Water
- Pumps (Piping Support)
O.OOE+00 1.00E+00 1.00E+00 1,00E+00 1.00E+00 1.00E+00
- Pumps (Water)
- Heat Exchanger
- Surge Tank
- Valves Essential Service Water Sys
- ESW Pumps
- ESW Valves 3.07E-14 8.11E-08 8.49E-05 2.69E-03 2.01E-02 7.11E-02 O.OOE+00 2.21E-04 9.38E-01 3.27E-07 1.14E-03 3.62E-02 1.00E+00 1.00E+00 1.00E+00 1.67E-Ol 3.64E-01 5.59E-01 2.49E-01 6.25E-05 4.02E-03 3.03E-02 8,60E-02 1.63E-01 6.25E-05 4.02E-03 3.03E-02 8,60E-02 1.63E-01 2.49E-01 0.00E+00 2.80E42 9.99E-OI 1.00E+00 1.00E+00 1.00E+00
- ESW Strainers Main Steam System
- MSIVs
- PORVs
- MSIV Isol. Valves
- Safety Valves 1.63E-10 8.96E-06 1.41E-03 1.67E-02 6.90E-02 1.66E-01 O.OOE+00 O.OOE+00 O.OOE+00 1.59E-14 1.79E-07 O.OOE+00 O.OOE+00 O.OOE+00 3.11E-12 6.10E-06 9.95E-04 8,77E-03 5.06E-15 3.04E-09 2.56E-06 9.53E-05 9.33E-04 4.46E-03 O.OOE+00 O.OOE+00 O.OOE+00 O.OOE+00 O,OOE+00 O.00K+ 00
- Ste~ Generator Blowdown O.OOE+ 00 0.00E+ 00 3.84E-13 6.55E-05 9.27E-02 Main Feedwater System 7.50E-OI
- Isolation Valves
- Control Valves Switchyard 7.23E-05 4.47E-03 3.28E-02 9.17E-02 1.72E-OI 8.32E-I1 1.27E-06 1.56E-04 1.99E-03 9.75E-03 2.60E-01 2,86E-02
- Ceramic Insulators 3.53E-OI 9.65E-OI 9.99E-01 1.00E+00 1.00E+00 1.00E+00 341
TRS TABLE3.1.5-1 SEISMICALLYINDUCED INITIATINGEVENT FREQUENCIES Seismic Interval 3
4 3.73E-05 3.36E-07 LSP-R SLB
-P
-R SWS
-P
-R SLO
-P
-R MLO
-P
-R LLO
-P 2.03E-OS 2.00E-17 1.14E-09 6.20E-10 0
9.39E-11 5.12E-ll 0
1.49E-08 8.13E-09 0
3.73E-11 2.03E-11 0
1.01E-11 5.51E-12 9.25E-06 7.27E-10 1.19E-07 3.29E-06 2.58E-10 1.14E-07 3.15E-06 2A8E-10 2.06E-08 5.69E-07 4.47E-11 1.18E-09 3.26E-08 2.56E-12 3.35E-09 9.24E-08 6.52E-10 3.76E-07 2.76E-07 1.65E-10 9.51E-08 6.97E-08 2.53E-11 1 46E-08 1.07E-08 1.85E-IO 1.85E-07 0
0 1.72E-08 0
0 1.92E-08 0
0 2.74E-09 0
5.08E-08 0
0 2.89E-11 0
0 3.84E-10 0
0 1.03E-10 0
3.42E-09 Direct Core Damage Direct Core Damage A Cntm Damage 1.12E-18 3.73E-15 6.57E-13 1.72E-08 8,28E-08 5.90E-08 3.16E-08 1.12E-08 Notes:
TRS - Transient without power conversion system available LSP - Loss of Offsite Power SLB - Steamline/Feedline Break SWS - Loss of Essential Service Water System SLO - Small LOCA MLO - Medium LOCA LLO - Large LOCA P - Initiating event occurs concurrent with loss of offsite power R - Initiating event occurs concurrent with loss of offsite power and rods do not insert.
3-42
TABLE3.1.5-2 DESCRIPTION OF SEISMIC EVENT TREE NODES EVENT TREE NODES ACC MS1 ICE LPI LPR HP2, HP3 HPR AF1, AF4, AFS CSI CSR CF HI RCP EH1, EH8 EN1, EN2 RRI DESCRIPTIONS Accumulators Main Steam Ice Condenser Low Pressure (RHR) Injection Low Pressure (RHR) Recirculation High Pressure Injection High Pressure Recirculation AuxiliaryFeedwater Containment Spray Injection Containment Spray Recirculation Containment Fans Hydrogen Igniters Reactor Coolant Pumps Tripped Probability Recover ESW with X Hours CNU Restore Reactor Coolant System Inventory SUPPORT SYSTEMS:
T11A/B/C/D/AZ/BZ/CZ/DZ 11A/B/C/D/AZ/BZ/CZ/DZ 120AFW, ELSC, CRID1/2/3/4 DCA, DCB, DCN 1AB, 1CD ESWW, ESWE, ESWWL, ESWEL CCWW, CCWE, CCWWL, CCWEL MISC-PAN 4160 V AC Electrical System 600 V AC Electrical System 120 V AC Electrical System 250 V DC Electrical System Emergency Diesel Generators Essential Service Water Component Cooling Water Miscellaneous Control Panels (ESFAS signals and controls) 3-43
TABLE3.1.5-3
SUMMARY
OF SEISMIC PRA RESULTS Seismic Interval 3
4 6
Normal Power Cases LOSP Cases 2.57E-08 5.93E-07 1.03E-09 0
2.17E-08 1'.63E-05 6.71E-07 5.08E-08 3.42E-09 0
Control Rods Fail to Insert Direct Core Damage Direct Core 8c Containment Damage 2.00E-17 1.28E-09 3.56E-07 3.91E-08 5.16E-10 0
h 1.12E-18 3,73E-15 0
6.57E-13 1.72E-08 8.28E-08 5.90E-08 3.16E-08 1.12E-08 Total 4.74E-08 1.69E-05 1.11E-06 1.49E-07 3.55E-08 1.12E-08 Total Seismic Core Damage Frequency = 1.83E-05
TABLE3.1.54 DOMINANTCONTRIBUTORS TO CORE DAMAGEFOR THE "NORMALPOWER" CASES Seismic Interval Dominant Contrihuto Dominant I.E.
Misc. Panels (RPS)
Battery Chargers 250 VDC Panels 76%
14%
10%
TRS 99.9%
AuxiliaryBuilding 600 VAC Transformers 63%
31%
TRS 56%
SLB 20%
SWS 19%
Auxiliary Building Ice Condenser Misc. Panels (RPS) 600 VAC Transformers RWST Turbine Bldg Pedestal 4160 VAC Swgr 600 VAC Swgr 19%
18%
15%
15%
13%
10%
6%
5%
SWS 70%
SLO 16%
LL0 14%
345
TABLE3.1,5-5 DOAGNANT CONTRIBUTORS TO CORE DAMAGEFOR THE "LOSP" CASES j
i mic Interval Dominant ontri uto Turbine Driven AF Pump (non-seismic failure) 600 VAC breakers (common cause)
EDGs (common cause)
Battery Chargers DG - Fails to Run (non-seismic failure) 250 VDC Panels 84%
62%
17%
9%
9%
6%
D minant I.E.
LSP 99.8%
AuxiliaryBuilding 600 VAC Transformers DG Fuel Oil Day Tank~
DG Fuel Oil Day Tank, Auxiliary Building Ice Condenser Misc. Panels (RPS)
Turbine Bldg Pedestal 600 VAC Transformers Diesel Generators 600 VAC Ssvgr AuxiliaryBuilding DG Fuel Oil Day Tank Accumulators Ice Condenser 4160 VAC Savgr Diesel Generators Accumulators AuxiliaryBuilding DG Fuel Oil Day Tank Diesel Generators Ice Condenser 4160 VAC Swgr 52%
26%
19%
36%
18%
17%
12%
12%
12%
6%
5%
25%
25%
22%
18%
17%
12%
29%
24%
24%
17%
15%
14%
LSP 50%
SLB 27%
SWS 17%
SWS 68%
LL0 19%
SL0 12%
LLO 100%
LLO 100%
TABLE3.1.5-6 DOMINANTCUTSETS TO SEISMIC CORE DAMAGEFREQUENCY Cutset 2.
3.
4, 5.
6.
7.
8.
9.
10.
12.
13.
14.
15.
Core Damage
~Fre cene Intervnl 9,25E-06 2
4.63E-06 2
3,26E-06 2
3.26E-06 2
3.06E-06 2
1.63E-06 2
1.53E-06 2
1,02E-06 2
5.63E-07 2
5,63E-07 2
3.76E-07 3
3.65E-07 3
3.65E-07 3
3.65E-07 3
3.65E-07 3
Seismic Event LSP LSP SLB SWS SLB LSP SLO SLO SWS SWS SWS SWS SWS Initiating Failed Com onents/Huildin Auxiliary Building Fails Seismically 600 VAC Transformers Fail Seismically DG Fuel Oil Day Tank Fails Seismically Auxiliary Building Fails Seismically AuxiliaryBuilding Fails Seismically 600 VAC Transformers Fail Seismically 600 VAC Transformers Fail Seismically Turbine Driven AF Pump Fails (random failure) and DG Fuel Oil Day Tank Fails Seismically DG Fuel Oil Day Tank Fails Seismically il Auxiliary Building Fails Seismically Ice Condenser Fails Seismically Auxiliary Building Fails Seismically 600 VAC Transformers Fail Seismically Misc. Panel (RPS) and DG Fuel Oil Day Tank Fail Seismically Turbine Bldg. Pedestal and DG Fuel Oil Day Tank Fail Seismically 16.
3.36E-07 2
SWS Turbine Driven AF Pump (random failure) and DG Fuel Oil Day Tank Fails Seismically 17.
18.
3.36E-07 2
2,82E-07 2
TRS SLO Auxiliary Building Fails Seismically (NP) 600 VAC Transformers Fail Seismically 19.
2.76E-07 3
1.85E-07 3
SWS LLO "R" Case - Control Rods Fail to Insert Ice Condenser Fails Seismically 347
TABLE3.1.5-6 (Cont.)
21.
1.79E-07 3
24.
1.68E-07 2
22.
1.79E-07 3
23.
1.68E-07 2
LLO LLO LSP TRS Auxiliary Building Fails Seismically DG Fuel Oil Day Tank Fails Seismically Turbine Building Pedestal and DG Fuel Oil Day Tank Fail Seismically 600 VAC Transformers Fail Seismically (NP) 25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
1.64E47 2
1.64E-07 2
1.26E-07 3
1.26E-07 3
1.26E-07 2
1.21E-07 2
1.18E-07 2
1.17E-07 3
1.17E-07 3
1.14E-07 2
LSP LSP SWS SWS SLB SWS SLB SWS LSP 250 VDC Battery Racks Fail Seismically 250 VDC Batteries Fail Seismically 250 VDC Batteries and DG Fuel Oil Day Tank Fail Seismically 250 VDC Battery Racks and DG Fuel Oil Day Tank Fail Seismically Ice Condenser Fails Seismically Ice Condenser Fails Seismically AuxiliaryBuilding Fails Seismically (N.P.)
600 VAC Switchgear Fail Seismically 4160 VAC Sivitchgear Fail Seismically Miscellaneous Panels (RPS) and DG Fuel Oil Day Tank Fail Seismically 35.
1.11E-07 2
SWS Auxiliary Building Fails Seismically (NP) 1.83E-05
= Total Seismic CDF
TABLE3.1.5-7 LIST OF CONTAP@IENT BYPASS SEQUENCES GREATER THAN 1E-8 Core Damage Seismic
~Ere cene lntervel Event Initiating Failed Com onents/Buildin s
3.65E-07 3
SWS Misc. Panel (RPS) and DG Fuel Oil Day Tank Fail Seismically 1.14E-07 2
6.50E-08 3
3.76E-08 2
1.95E-08 1
1.11E-08 3
LSP SWS SWS TRS SWS Misc. Panels and DG Fuel Oil Day Tank Fail Seismically Misc. Panels and Diesel Generators Fail Seismically Misc. Panel (RPS) and DG Fuel Oil Day Tank Fail Seismically Misc. Panels Fail Seismically (N.P.)
Misc. Panels and Support'ystem Valves for the DGs Fail Seismically 349
SEQUENCE NUMBER TABLE3.1.5-8 SEQUENCES MEETING MORE THAN 1 SCREENING CRITERIA SCREENING CRITERIA 1
2 3
4 1
2 3
4 5
6 7
8 9
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
Y Y
3-50
TABLE3.1.5-9 SEISMIC CORE DAMAGEFREQUENCY BY PLANT DAMAGESTATE Dama e State THIF THX Seismic Interval 2
3 1.27E-05 3.36E-07 1.26E-07 SHIF SHWIF SX 3.22E-06 3.76E-07 5.69E-07 1.21E-07 3.76E-07 ALWIF AX 1.S5E-07 1.85E-07 Note: THIF =
THX =
SI-IIF =
SHWIF =
SX =
ALWIF=
igniters fail AX =
Transient, hydrogen igniters and containment air recirculation fail Transient, RCS at high pressure, containment dry, containment spray injection k air recirculation fail, hydrogen igniters fail Transient, Ice Condenser fails Small LOCA, hydrogen igniters and containment air recirculation fail Small LOCA, RCS at high pressure, containment spray injection 8c air recirculation fail, hydrogen igniters fail Small LOCA, Ice Condenser fails Large LOCA, containment spray injection 4 air recirculation fail, hydrogen Large LOCA, Ice Condenser fails
- 1. Seismic interval 2 is 0,26g to 0.50g. Interval 3 is 0.5lg to 0.75g.
3-51
TABLE3.1.5-10 SEISMICALLYINDUCED INITIATINGEVENT FREQUENCIES - LLNL Initiatin Event Seismic Interval 2
TRS 1.58E-03 5.06E-06 0
LSP-R 8.65E-04 8.50E-16 1.39E-04 0
1.09E-08 0
SLB
-P
-R 4,83E-08 2.64E-08 2,59E-20 1.79E-06 4.95E-05 3,89E-09 SWS
-P
-R 3.99E-09 2.18E-09 0
1.72E-06 2.35E-08 4.75E-OS 1.35E-05 3.73E-09 9.93E-06 0
0 9.62E-07 SLO
-P
-R MLO
-P'R LLO
-P Direct Core Damage 6.34E-07 3.46E-07 3.40E-19 1.59E49 8.65E-10 0
4.30E-10 2.34E-10'.11E-07 8.57E-06 6.74E-10
'1.78E-08 4.91E-07 3.86E-11 5.05E-08 1.36E-06 5.95E-09 3.43E46 2.51E-06 9.11E-10 5.25E-07 3.85E-07 6,66E-09 6.66E-06 0
0 1.08E-06 0
0 1,54E-07 0
2.85E-06 6.25E-17 Direct Core Damage A Cntm Damage 2.79E-11 2.59E-07 2.98E-06 4.96E-06 Notes:
TRS - Transient without power conversion system available LSP - Loss of Offsite Power SLB - Steamline/Feedline Break SWS - Loss of Essential Service Water System SLO - Small LOCA MLO - Medium LOCA LLO - Large LOCA P - Initiating event occurs concurrent with loss of offsite power R - Initiating event occurs concurrent with loss of offsite power and rods do not insert.
3-52
TABLE3.1.5-11 QSIMARY OF SEISMIC PRA RESULTS LLNL Seismic Interval Normal Power Cases 1.09E-06 8.92E-06 3.70E-08 0
LOSP Cases Control Rods Fail to Insert
("R") Cases Direct Core Damage ("Cl")
Direct Core A Containment Damage ("ClC2")
9.28E-07 2 46E-04 2 41E-05 2.85E-06 8.50E-16 1.92E-08 1.28E-05 2.20E-06 6.25E-17 2,79E-11 2.59E-07 2,98E-06 4.96E-06 Total 2.02E-06 2,55E-04 3.99E45
.1.00E-05 Total Seismic Core Damage Frequency = 3.07E44 3-53
TABLE3.1,5-12 SENSITIVITYANALYSISRESULTS Offsite Power Available Case:
om onent
~%chan e
Auxiliary Building 600 VAC Transformer 63%
31%
Loss Offsite Power Case:
Cnnmnn en t Auxiliary Building 600 VAC Transformer EDG Fuel Oil Day Tank han e
52%
26%
19%
Note:
Comparison only for seismic interval (0.26g - 0.50g) since this was the dominant interval in the SPRA. The EDG Fuel Oil Day Tank was not dominant in Offsite Power Available Case.
3-54
10 0"
-3 CD CD LrJ 10 Ci LJO 10 X
LJ D
10 Z
10 10 200 400 600 I
800 1000 PGA (cm/sec
)
15th PERCENTILE MEDIAN MEAN 85th PERCENTILE NOTE PGA's PRESENTEO IN THE TABLE REPRFSENT THE MEAN OF THE PGA RANGES USED IN THE PRA CALCULATIONS.
PGA (9's) 0.175 0.380 0.630 0.880 1.130 15 50 MEAN 85 1.84E-5 3.97E-5 1.24E-6 3.29E-6 7.18E-8 2.36E-7 7.49E-9 1.20E-9 2.78E-8 5.19E-9 5.45E-S 9.93E-5 4.71E-6 8.I18E-6 5.06E-7 9.21E-7 1 05E 7
1 69E 7
3.29E-8 4.31E-8 ANNUAL EXCEEDANCE PROBABILITIES FOR MEAN,15th,50th AND 85th PERCENTILES PlGURE 3
CONSTANT PERCENTILE SEISMIC HAZARD CURVES USING ALL EXPERTS SEISMIC HAZARD ANALYSIS OONAI 0 C. COOK NUCLEAR PLANT PREPARED FOR WESTINGHOUSE ELECTRIC CORP.
PITTSBURGH, PENNSYLVANIA Paul C whizzo A,ssociates, Enc.
COHSULIPN ~ 5 3-55
10 10 10 lD0
-S LJ C3 10 bl 4J X
-7 10 10 10 200 400 600 800 000 PGA (crn/sec~ )
LKGFi40:
LLNL MEDIAN HAZARD
~ RIZZO MEDIAN HAZARD WITH ALL EXPERTS MEDIAN HAZARD WITH RIZZO S" ISMIC SOURCE MODEL FIGURZ 3. l. 1-2 COMPARISON OF MEDIAN SEISMIC HAZARD CURVES SEISMIC HAZARD ANALYSIS DONALD C.
COOK NUCLGR PLANT PREPARED FOR WESTINGHOUSE ELECTRIC CORP.
PITTS8URGH, PENNSYLVANIA Paul C Biz"o Associates, Lac.
coNsut TUNIS
0.1
~Q 4
F'RKOUEHCY (Hz) 10
&lid 'OOK SSK:
CAOUNO OKSICN RESPONSE SPECTRUM LLNL UHS:
LAVQQICE UVERMORK NATlONAI LABORATORY lOOOQ YEAR VEQIAN UHS FIGURE 3.12 Comparison of Hant Design Ground Spectrum and 10,000 Year Median Uniform Hazard Spectrum for the Donald C. Cook Nuclear Plant Site 3-57
szx csr SS?
OS?
ACD Tttrttttrtttftrtr ttttT7ttf
~'tftttrTT trtrtTTTT 7'ettttTTT TTTTTTTTr 3
PR 7 ~ttttttrtttTtttt trtettttt t
7'TTTtt' 'tt terat'eeettrft'e ~Ttt tteeeeree 7 7 'rt 7 7f7 T't7 7 '7 Tt7 ttettrttttttrrt'tr 7'tfrf'7'7't' 77 7ftfTTT
~rtt' TTT' 7
H
'e ~t 7 '7 '7 7 Tt tTrtt7ttt '77rT77 T7 7t7Ttfttet'rtt'et f 7tt7 et tee tT '7 7 7 7 7tt 7TtTt 7 7 T 'etetettref IO 5 11 SP 12 SPR
'ffftftfft 7' ttrttttf'ttrfttr ett tete t f7 rett tttttttt f tftttttttt 13 M
7r7 '7 '7 7 7tt f777 7 et tf err terre ffrtftttt t '7ttt 7tt Ttt7 Tt7 TT tttttet'7 T'tf7ft 7 7t 7 t'7'et tt tet'tet'7 tet'et ftt'ettrrttrttttTttt'7' ~
7'ttttt'7 et t ter fr tt'77ftfTt7'tet t'et fter Tt 7 et tet tf '7tf't'7'tttf t 7tttTtrt fr tetttff7777 tt'rrt'7ttet'f'rtf77'tttf'ttr'tttertttttttrf~'7'etttttttfl@tff77trefft l4 HP IS MPR IE L IV LP IS C1 19 CIC2 SIX CSF RVP Rcr HPB SPB SHF SSP OSP ROD
~ HAM SEISMIC ViTZRVAL TXT CONTAIN~ OR S/G PAZLURE RX VESSEL OR RCS PLPZNG PAI"URE RCS COHPONENT PAZIURE MEDIUMP~~
PIPE BREAK SHALL PRDGQtZ PIPE BREAK SCREm HOUSE FAILURE SECONDARY SZDE PIPE BREAK Orr-S~~~
POWER PAZLURE CCNTROL ROD INSER ICN FAILURE CA ZGORY DESCRIP ON I
TRANS~ E/O ?CS AVAIL~LE P
Loss or orr-SITE poNER PR P + EO RCOS RISERS r
rmoLam/s~~~
Bauer ip r+p FPR F+PR E
S~
HOUSE FAZLURE EP E+P HPR E+ PR 5
PR M
HEDZUM LOCA MP M+ P HPR M+ PR L
LARGE LOCA LP L+P CI DIRECT CORE DAMAGE CIC2 DIRECT CORE AND CONTAD~P~ DAMAGE FlGURE 3.1.5 Event Tree for Deteradning Seismic Initiating Event Frapmcies 3-58
2/n/'92
!CITES 28 rILEHANE FCR ET fILE IS SLQIEE SHALL LCCA E~P' Vr'2S ~ ~"
SLQ ICE HP2 AF'4 CSI CSR Cr FVENT SLQ ICE HP2 AF4 CSI HPR CSR Hl Cr EVENT NAME SMALL LOCA INITIATING EVENT ICE CONDENSER ECCS (HIGH PRESSURE)
INJECTION AUXII IARY F'EEDVATER 2 S/G CQNTAINMENT SPRAY INJECTION HIGH PRESSURE COLD LEG RECIRCULATION CONTAINMENT SPRAY RECIRCULATION HYDROGEN IGNITERS CONTAINMENT RECIRCULATION F'ANS CATEGORY SUCCESS SHC SHCI SHCIF
~ SHR SHRI SHRIF SH SHI SHIF SHV SHVI SHVIF'X I SUCC SS 2
SHC 3
SHCI 4
SHCIF 5
SHR 6
SHRI 7 SHRir 8
SHC 9
SHCI 10 SHCIF'1 SH 12 SHI 13 SHir 14 SHR 15 Sr'.RI 16 SHRlr 17 SHC 18 SHCI 19 SHCIP 20 SHR 21 SHRI 22 SHRIF 23 SHC 24 SHCI 25 SHCIF 25 SH 27 SHI 28 SHIP 29 SH 30 SHI 31 SHIF'2 SHR 33 SHRI 34 SHRIF 35 SHC 36 SHCI 37 SHCIF 38 SHV 39 SHVI 40 SHVIF'1 SX DESCRIPTION NO CORE MELT OR CONTAINMENT OVERPRESSURE RCS AT HIGH PRESSUR<
CSR FaILS RCS AT HIGH PRESSURE.
HI FAIL RCS AT HIGH PRESSURE, HI F'AIL. CF F'AIL RCS AT HIGH PRESSURE, CSR SUCCESS RCS AT HIGH PRESSURE, Hl FAIL RCS AT HIGH PRESSURE.
Hl PAIL, CFAIL RCS AT HIGH PRESSURE RCS AT HIGH PRESSURE.
HI fAlL RCS AT HIGH PRESSURE.
HI FAIL CF'AlL RCS AT HIGH PRESSURE, RVST NQT EMPil D
RCS AT HIGH PRESSURE.
HI FAIL RCS AT HIGH PRESSURE.
Hl FAIL, Cr PAIL SX FIGURE 3.1.5-Z - Small LOCA Seismic Event Tne 3-59
2/II/9e !2'<048 Fr~r r(R CT flLE 1S ~1Cr WQ(I>I LCCA KTPLv VERSICN IN MLQ ICE ACC HP2 CSI CSR HI Cr EVENT HLO ICE ACC HP2 CS[
HPR CSR Hl CF EVENT NAME MEDIUM LOCA ICE CONDENSER ACCUHULATORS ECCS HIGH PRESSURE INJECTION
'CONTAINMENT SPRAY INJECTION HIGH PRESSURE COLD LEG RECIRCULATION CQNTAINHENT SPRAY RECIRCULATION HYDROGEN IGNITERS CONTAINMENT RECIRCULATION FANS CATEGORY SUCCESS SHC SHCI SHCIF SHR SHRI SHRIF SH SHI SHIF'HV SHVI
"'HVIF SX I SUCCESS 2
SHC 3 SHCI 4
SHCir" 5
SHR 5 SHRI 7 SHRIr" 8
SHC 9 SHCI 10 SHC tr SH 12 SHI 13 SHIr 14 SHR 15 SHRI 15 SHRIF 17 SHC 18 SHCI 19 SHCIF 20 SHV 21 SHut 22 SHVtF 23 SHR 24 SHRI 25 SHRIF 25 SHC 27 SHCI 28 SHCir 29 SHV 30 SHVI 31 SHVlr 32 SX DESCRIPTION NQ CORE HELT QR CQNTAINHENT OVERPRESSURE RCS AT HIGH PRESSURE.
CSR F'AILS RCS AT HIGH PRESSURE.
Hl FAIL RCS AT HIGH PRESSURE.
Hl FAlL. CF FAILS RCS AT HIGH PRESSURE, CSR SUCCESS RCS AT HIGH PRESSURE.
HI FAIL RCS AT HIGH,PRESSURE, Hl FAIL, CF F'AILS RCS AT HIGH PRESSURE RCS AT HIGH PRESSURE.
HI F'AIL RCS AT HIGH PRESSURE.
Hl F AIL, CF FAILS RCS AT HIGH PRESSURE.
RVST NOT EMPTIED RCS AT HIGH PRCSSURE.
HI F'AIL RCS AT HIGH PRESSURE, HI FAIL,CF F'AILS SX FIGURE 3.1.5 Medium LOCA Seismic Event Tree 3-60
~
~
8/I5/9I 09i45<40 FILENAME FCR ET FILE IS SL3ICE STENCH LINE/FEEBINE 3REAK ETPLT VERSICN SLB ICE HP3 MS1 AFS CSI CSR Cr EVENT SLB ICE HP3 MS1 AFS CSI CSR HI CF'VENT NAME STEAM LINE BREAK INITIATING EVENT ICE CONDENSER ECCS (CHARGING PUMP)
INJECTION/BORATION SECONDARY SIDE ISOLATION AUXILIARYFEEDMATER ACTUATION M/SLB CONTAINMENT SPRAY INJECTION CONTAINMENT SPRAY RECIRCULATION HYDROGEN IGNITERS CONTAINMENT RECIRCULATION FANS SUCCES 2
THR 3 THRI 4 THRIF 5
THC 6 THCI 7
THC Ir 8
THV 9 THAI 10 THVIF 11 TY 12 T
13 THk.r 14 THC 15 THCI 16 THCIF 17 TH 18 19 THIF 20 THR 2)
I HR I 22 THRIr 23 THC 24 THCI 25 THC Ir 26 TH 27 THI 28 THIF 29 THX HGURE 3.1$ Steamline/Feediine Break Seismic Even! Tree 3-62
lOJCQ/91
~4474$
FLswpc plà cT F'inc fs cxvlcz ass CF'SV SPEC?AL VllvlJvtR CTPLv VER"'~
SVS ICE RCP AF'I EH1 RCII EHB CNU RRI CSI HPR CSR Hl CF 1 SUCCESS 2
SHR 3
SHRI 4
SHRIP 5
SHC 6
SHCI 7 SHCIr 8
SUCCESS 9
SH 10 SHI 11 SHIF'2 SHR 13 SHRI 14 SHRIF 15 SHC 16 SHCI 17 SHCIF'8 SAV 19 SHVI 20 SHVIFI SUCCESS 22 SHR 23 SHRI 24 SHR Ir 25 SHC 25 SHCI 27 SHCIP 28 SUCCESS 29 SH 30 SHI 31 SHIF'2 SHR 33 SHRI 34 SHRIP 35 SHC 36 SHCI 37 SHCIr 38 SHV 39 SHVI 40 SHVIF 41 SHR 42 SHRI 43 SHRIr 44 SHC 45 SHCI 46 SHCIF 47 SHV 48 SHVI 49 SHVIF'0 SHC 51 SHCIF'2 SHV 53 SHVIF'IGURE 3.1.54 - Loss of Essential Service Water Seismic Event Tree 3-63
54 SUCC=SS 55 SHR p
6 SHRt 57 SHRfr~
58 SHC 59 SHCI 60 SHCIF 61 SUCCc.ss 62 SH 63 SHI 64 SHIF 65 SHR 66 SHRI 67 SHRIF 68 SHC 69 SHCI 70 SHCIr 71 SHV 72 SHVI 73 SHVIF 74 SHR 75 SHRI 76 SHRI" 77 SHC 78 SHCI 79 SHClr 80 SHV 81 SHVI 82 SHVIr 83 SHC 84 SHCIr 85 SHV 86 SHVIF'~
87 SHR 88 SHRI 89 SHRIF 90 SHC 91 SHCI 92 SHCIF 93 SH 94 SHI 95 SHIF'6 SHR 97 SHR fr 98 SHC 99 SHCIF 100 SHR 101 SHRI 102 SHRIF'03 SHC 104 SHCI 105 SHCIF'06 SHV 107 SHVI 108 SHVIF'09 SHC 110 SHCIF'll SHV 112 SHVIF'13 SX FIGURE 3.1.54 (Continued) 3-64
sits/'tt 09 itch <'t rtt.sNiw rott t:r rtt.c ts t.st tcc t.spi t.css cr cf rslTp. povctt Eii"l.i VCRslCN AF I CSI HI CF EVENT t SP AF I CSI CSR HI CF EVENT NAME LOSS OF OFFSITE POttER AUXILIARYFEEDM*TER SYSTEM CONTAINMENT SPRAY INJECTION CONTAINMENT SPRAY RECIRCULATION HYDROGEN IGNITORS CONTAINMENT RECIRCULATION FANS I
SUCCE.'
THR 3 THR[
4 TER I.
5 THC 6 THCI 7 THCI 8
TH 9 THI 10 THIF HGURZ 3.1.5 Loss of Offsite Power Seltsmic Event Tree 3-65
Z/II/9Z 184035 fILE~IE rCR ET FILE IS TRSIEE TR4NSIEHT VITMCUT STEAll CQNVERSiCII SYS~i ETRLT VERSICLE I.O TRS AFI CSI CSR Hl EVENT TRS AF'I CSI CSR Hl Cr EVENT NAME TRANSIENT VITHQUT STEAM CQNVERSIQN SYSTE AUXILIARY FEEDVATER ACTUATION CONTAINHENT SPRAY INJECTIQN CONTAINMENT SPRAY RECIRCULATION HYDROGEN IGNITFRS CONTAINMENT RECIRCULATION F ANS CATEGORY SUCCESS THR THRI THRIF THC THCI THCIF THV THVI
~
THVIF' SUCCESS 2
THR 3
THRI 4
THRIr 5
THC e
THCI 7 THClr 8 THV 9 THVI 10 THVIF'ESCRIPTION NQ CORE DAHAGE TRANSlc.NT, Hl PRES, CSR SUCCESS TRANS, Hl PRES, CSR SUC Hl FAILS TRANS, Hl PRES, CSR SUC, HI/CF FAIL TRANSIENT, Hl PRES, CSR FA!LS TRANSIENT. Hl PRES.
CSR.HI FAIL TRANSIENT, Hl PRES, CSR,HI.CF FAIL TRANSIENT, HIGH PRESSUR~
CT DRY TRANSIENT. HIGH PRESSURE.
CT DRY, Hl~
TRANS. HIGH PRES, CT DRY, HI r CF FAIL FIGURE 3.1.54 - Transient Without Steam Conversion Seismic Event Tree 3-66
4.0 INTERNALFIRE ANALYSIS 4.0.1 Methodology Selection In response to Generic Letter 88-20 Supplement 4 (Reference 1), a new fire PRA was performed to identify fire vulnerabilities which could jeopardize core integrity at the Cook Nuclear Plant.
The methodology used for the internal fire analysis meets the intent of NUREG-1407 (Reference 2) and is summarized below:
1.
Only zones containing systems required for mitigation of initiating events that could jeopardize core integrity were retained for further analysis.
2.
Initiating event frequencies were calculated by examining the historical frequency of fires occurring in domestic light water reactors, and further partitioning this number by ratioing combustible loading for that zone with respect to the combustible loading for the building in question.
3 ~
Progressive screening was employed using conservative assumptions and a screening value of 1E-7/yr for fire-induced sequences leading to core damage.
Total fire-induced destruction in a zone was first postulated, and if the resultant core damage frequency exceeded 1E-7/yr, that zone was retained for further analysis.
Those zones with core damage frequencies below lE-7/yr were screened from further analysis.
4, Those zones that were retained for further analysis were more realistically modeled for fire-induced damage.
Engineering judgement and the COMPBRN IIIe code were used to determine the area of influence over which a fire could inflict damage, and the timing of damage.
Determination of damage was used to partition initiating event frequencies and subsequently compute fire-induced core damage frequency.
Westinghouse fault tree linking codes WLINKand SCE were used to determine fire-induced core damage.
5.
Issues identified in NUREG/CR-5088, "Fire Risk Scoping Study" by Sandia National Laboratories were addressed as they applied to Cook Nuclear Plant.
4.0.2 Major Assumptions The following majo'r assumptions were made during this analysis:
l.
The work done to support compliance with 10CFR50 Appendix R requirements was utilized as much as possible.
A sample of Appendix R cables were re-traced on plant drawings to ensure accuracy, and the routings were found to be acceptable.
Fire area and zone delineations created for Appendix R analyses were found to be pertinent to this analysis, 2.
Fire suppression systems were assumed to be sized to effectively mitigate a maximum sized fire.
3.
Unit 1 was assumed to be representative of Unit 2. This assumption was validated during plant fire walkdowns when dual unit interactions and any properties unique to Unit 2 were examined.
4.
It was conservatively assumed that a fire in any zone would cause a reactor trip.
4.1 Fire Hazard Analysis Much of the work completed in support of compliance with 10CFR50 Appendix R requirements was used in this fire analysis.
This included cable routings, combustible loadings, location mapping of all safe shutdown components, fire barrier ratings, fire detection and suppression capabilities, and safe shutdown capability.
41
4.2 Review of Ptant Information and Walkdowns The Appendix R documentation and plant layout drawings were reviewed.
Initiating event frequencies were calculated for all zones, This calculation was based on the historical frequency of fires in nuclear power plants.
The initiating event frequencies were then partitioned and made plant specific by dividing the combustible loading of the fire zone in question by the combustible loading of the building or area of the building to which that zone belonged.
A review of all initiating events was conducted.
It was found that all credible events were derived from or actually were modelled as a transient with power conversion systems available (TRA). The response required for successful mitigation of this event was already modeled in the internal events analysis.
Those zones without safe shutdown equipment or without equipment which was modeled in the transient event were screened from further analysis.
Remaining zones were subjected to a progressive screening.
A maximum fire was postulated which destroyed everything in the zone.
Core damage frequency was then calculated for each zone.
The transient event quantification was employed in this screening process. If the modeled fire caused the core damage frequency to exceed 1E-7/yr, then that zone was retained for further analysis.
All but 38 fire zones were eliminated from further analysis using this screening criteria.
Two walkdowns were conducted (November 13 and 14, 1990 and March 18-21, 1991) as part of the fire analysis.
These walkdowns utilized both AEPSC and westinghouse personnel and were performed to confirm assumptions, to verify information used to screen zones from further analysis, and to assess dual-unit interactions.
These walkdowns were completely documented through the use of walkdown checklists and comprise individual notebooks in the Cook Nuclear Plant PRA.
Containment was inspected for fire hazards.
Due to the low combustible loading and the large volume inside containment, all zones
, inside containment were screened from further analysis.
Thirty-two zones outside containment (in addition to the 38 zones which were retained for further analysis) were selected for inspection to confirm information used in the screening process and were thoroughly inspected.
Zones with high combustible loading were also inspected for fire propagation likelihood.
4.3 Fire Growth and Propagation During the initial screening, a maximum fire which destroyed everything in the zone was postulated.
Subsequent screening efforts modeled fire suppression which would limit fire growth. Total zone destruction was still postulated.
The COMPBRN IIIe code was used in the latter stages of the analysis to confirm engineering judgement and to model fire growth and potential propagation.
Propagation potential was assessed by drawing review, Appendix R documentation review, and walkdown
- findings, Assumptions used in this assessment were confirmed during the walkdown.
Subsequent walkdowns were conducted to obtain exact measurements for COibIPBRN IIIe modeling of fire zones requiring further analysis.
It was found through engineering judgement and confirmation with the COMPBRN IIIe code that propagation was not feasible beyond the Appendix R zone divisions.
Fire growth was modeled with the COMPBRN me code to determine the extent and timing of fire damage.
4.4 Evaluation of Component hgilities and Failure Modes In this analysis, fire was conservatively assumed to always induce instantaneous, unrecoverable failure of equipment.
No credit was taken for partially failed equipment or for equipment that functioned for a short period and then became disabled by the fire. All equipment failed at the time the fire is initiated.
4.5 Ere Detection and Suppression For those zones containing safe shutdown equipment or cabling, a second screening was performed in which fire detection and suppression were credited.
Failure of fire detection was not addressed in this screening process due to its low failure rate.
Manual and automatic fire suppression systems were credited as follows (Reference 3): Manual fire suppression failure was conservatively estimated to occur with a failure probability of 0.5; automatic suppression system failure was estimated to be 0.04 for water sprinkler and COz systems and 0.06 for Halon flooding systems.
Thirty<ight zones were subjected to this screening and their respective core melt frequency contributions calculated using the failure rates listed above.
Of these 38 fire zones, 12 zones were retained for further analysis due to their high core melt frequency contributions.
For each of these 12 zones, a detailed calculation of the initiating event frequencies was performed.
Previously calculated fire initiation frequencies for each zone were furthe'r assessed using the frequencies of automatic and manual fire detection, and automatic and manual fire suppression.
Automatic detection capabilities in each zone were l'ound in Appendix R documentation and were verified during the walkdowns.
The failure probabilities of automatic fire detection devices were taken from a non-nuclear data source.
5Ianual fire detection was assumed only for those zones which were occupied.
Fire suppression capabilities were then assessed.
Automatic fire suppression failure probabilities were taken from Reference 3.
Manual fire suppression failure probabilities were taken from NUREG/CRM58 (Reference 4) and were based on time to damage.
Each of these factors was incorporated into a zone-specific initiating event frequency calculation.
4.6 Analysis of Hant Systems, Sequences and Hant Response For each of the twelve zones requiring further analysis, the components in the zone and the cables running through the zone were determined.
Total destruction of these components and cables was postulated to determine the applicable event.
As discussed in Section 4.2, a fire in any of the twelve remaining zones would result in a transient event enveloped by the internal events analysis transient with steam conversion systems available model.
For two of these twelve zones, the control room and the control room cable vault, the probability of a core damage due to a fire is highly dependent upon the availability of auxiliary feedwater.
While not modeled in the internal events transient event tree, Unit 2 auxiliary feedwater may be called upon ifUnit 1 auxiliary feedwater fails. This is procedurally directed in the Cook Nuclear Plant emergency operating procedures, In a fire scenario such as modeled here, the core damage frequency is dominated by the initiating event frequency and the unavailability of Unit 2 auxiliary feedwater.
Multiplying these two values yielded frequencies falling between 1.00E49/year and 4.00E49/year.
When these values were further quantified to include the unavailability of Unit 1 auxiliary feedwater, the values became even smaller.
Thus, it was determined that no further analysis was necessary.
For an additional five of the twelve zones requiring further analysis, total fire-induced damage was postulated.
All cables and components in each zone were assumed to fail. These fire-induced failures were considered in conjunction with random failures modeled in the internal events model.
The fire frequency for each of these five zones was used to quantify the transient with steam conversion systems available event tree from the internal events analysis.
The highest resultant core damage frequency associated with these zones was 4.5E-10/year.
Due to the extremely low frequencies calculated, no further analysis was performed concerning these five zones.
The last five remaining zones were analyzed in more detail.
The extent and timing of fire damage in each of these zones was assessed using engineering judgement and then confirmed with the COMPBRN IIIe fire simulation code.
Additional plant walkdowns were performed to provide detailed measurements required for accurate modeling using CO) fPBRN IIIe.
For two of these zones, the AB Battery Room and the North Auxiliary Building (elevation 609 feet), it was determined that fire-induced core damage was not a credible event.
In the AB Battery Room, the
COMPBRN runs calculated no fire damage using a simulation involving a transient combustible fire equivalent to the size of a medium trash can located in various parts of the room.
In the North Auxiliary Building, the few cables which were found to be vulnerable to damage by a postulated fire were either not modeled in the internal events transient event tree or were judged to be of little importance.
The final three zones, the Engineered Safety System and Motor Control Center Room, the Switchgear Room Cable Vault, and the Auxiliary Cable Vault, were analyzed in detail including COMPBRN analysis and fault tree linking quantification.
The COMPBRN runs supported the previous engineering judgement used and indicated potential damage to portions of the zones due to a fire. For the zones where damage was indicated, the initiating event frequencies were partitioned by an area ratio; area of fire damage to the total area of the zone.
A core damage frequency calculation was then done for each vulnerable portion of the zone using the loss of a single train of 250 V DC power event tree from the internal events analysis, (Each of the fires analyzed for these three zones resulted in a loss of a single train of 250 V DC power, a special version of the transient with steam conversion systems available.)
These core damage frequencies were summed to obtain the core damage frequency contribution for that zone.
The core damage frequencies for each zone ivere calculated to be:
Zone Core Damn e Fre uencv 41 55 56 1.55E-7/yr 1.97E-9/yr 3.89E-9/yr The total fire-induced core damage frequency was found by summing the fire-induced core damage contributions from significant areas in the plant and was calculated to be:
TOTAL FIRE-INDUCED CORE DAibIAGE FREQUENCY (CDF)
CDF<t + CDF55 + CDF56
= (1.55E-7/yr) + (1.97E-9/yr) + (3.S9E-9/yr)
= 1.61E-7/yr 4.7 Analysis of Containmcnt Performance Plant responses arising from a fire are identical to those initiated by other internal events.
These responses are fully addressed in the internal events analysis.
Containment performance is also identical to that modeled in the Level II analysis.
No additional containment performance analysis resulted from the fire analysis.
4A Treatment of Fire Risk Scoping Study Issues (Reference 5) 4$.I Dependencies Between Control Room and Remote Shutdown Panel Circuitry Both the control room and the remote shutdown panel are tapped from the same cable spreading room, making electrical Interactions between the two possible.
This issue was raised earlier by the NRC, and AEPSC responded in AEP:NRC:0692BT stating that the Local Shutdown Indication (LSI) panels fulfillthe function of safe shutdown monitoring. LSI indications are electrically and physically isolated from the control room, Indications from loops 1 & 4 are physically isolated from indications from loops 2 & 3, so that there is no one fire which could eliminate all control room indication or all LSI indication.
482 Use of PlantSpeciTic Data Generic building fire initiation frequencies were made plant-specific by ratioing combustible loading of the zone in question to the combustible loading of the building,
In order to take credit for the Cook Nuclear Plant fire brigade in the Fire PRA, the response time (time from alarm actuation to arrival at the site of the fire) of the fire brigade was addressed.
The response time was determined based upon the following considerations:
(1) response to the NUREG/CR-5088 questionnaire by Cook Nuclear Plant fire brigade personnel, (2) fire brigade training and qualification requirements, (3) information specifically obtained from the Fire Protection Coordinator, (4) information taken from the fire, drill summaries, and (5) data from actual fires that have occurred at Cook Nuclear Plant.
Based upon all of these considerations, it was determined that the reasonable response time for the fire brigade to a fire is ten minutes.
4.89 Suppression Agent Induced Damage The fire brigade is specifically trained in techniques to avoid damage to safety-related equipment.
They are trained to avoid "pushing" the fire or flame plume into areas containing safety related equipment.
Due to the use of an E-type nozzle, the fire brigade is instructed to keep the spray of the nozzle 15 feet away from any energized electrical equipment.
IVhen experienciiig a "fullblownfire" (i.e., a room completely filled with flames), instead of using the method of "surround and drown" or "flood and find out," the fire brigade is trained to use short controlled bursts to knock the fire down, thus allowing the ability to observe the fire and locate its base with a minimal amount of water damage.
4.8.4 Hre Barrier Integrity WVith respect to the issue of fire barrier integrity at Cook Nuclear Plant, an examination of the existing administrative controls was made. It was learned that the fire seal program at Cook Nuclear Plant is administered by the plant Quality Control (QC) Section.
All penetr'ations are numbered when they are created and a master log is maintained along with maps showing the approximate location of the penetration associated with the barrier.
Various plant procedures provide guidance on the required actions to be taken when a new seal is created or an existing seal is violated.
In addition, Technical Specification 3.7.10 requires that 10% of each type of penetration seal be inspected every 18 months and after every repair to verify operability.
Seals are installed using formal plant procedures using a safety related specification as guidance.
Certiiflied QC inspectors are required by this procedure to conduct inspections at predetermined points during the installation or repair of a seal.
Minor repairs can be made by Indiana Michigan workers in the field. Major repairs are made by the on site insulation contractor.
Based on the above review, it was concluded that adequate controls exist to maintain fire barrier integrity.
4.8.5 Seismic-Hre Interactions As a result of detailed walkdowns performed in support of the fire analysis, it was determined following on-site discussions with EQE that the 17-ton CO> tank was potentially vulnerable to a seismic event.
A seismic event could move the tank, severing pipe connections and expelling all CO>. Ifthe seismic event also induced a fire, fire suppression in those zones with automatic CO2 suppression could be limited to manual suppression.
Further seismic analysis, which included a review of the tank's support structure design drawings, concluded that this tank willsurvive a design basis earthquake.
Problems will not arise unless a much larger earthquake occurs.
Thus, it was concluded that this tank does not pose a significant seismic/fire interaction concern.
4.9 USI A~ and Other Safety Issues The USI AA5 external events findings were combined with the findings from the internal events analysis.
These are listed in Section 3,4.3 of the internal events IPE submittal.
4.10 Conclusions Fire-induced core damage frequencies at the Cook Nuclear Plant were analyzed, and the total fire-induced core damage frequency was found to be 1.61E-07/year.
One potential seismic-fire vulnerability was found during the seismic walkdowns.
This involved a concern that a seismic event could move the 17-ton COz tank, severing pipe connections and expelling all CO>.
This would leave a significant number of zones without automatic fire suppression.
Upon further review of the tank's support structure design drawings and subsequent seismic analysis, it was concluded that this tank willsurvive a design basis earthquake.
Problems willnot arise unless a much larger earthquake occurs.
Thus, it was concluded that this tank does not pose a significant seismic/fire interaction concern.,
4.11 Referams USNRC Generic Letter 88-20 Supplement 4, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities -10CFR50.54 (I) i~KEEG-1407, "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities", June 1991 3.
NUREG/CRM40, "Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150", Sandia National Laboratories, November 1990.
4.
NUREG/CRM58, "Shutdown Decay Heat Removal Analysis for Westinghouse 2-Loop Pressurized Water Reactor Case Study,", Sandia National Laboratories, December 1986.
5.
NUREG/CR-5088, "Fire Risk Scoping Study",
5.0 HIGH WINDS, FLOODS, AND OTHI."RS "Other External Events" are extrinsic events other than seismic, internal fire, or internal flooding events that may be an initiator of an accident sequence leading to core damage.
Such phenomena are potentially important because they may affect multiple components.
An accident involving a number of different component failures may be nearly incredible in the absence of some external influence, but may be possible or even likely by the occurrence of a tornado, for instance.
Included in this category are external flooding, severe wind, aircraft, hazardous materials transportation, other transportation, on-site hazardous materials, external fires, and turbine missile event analyses.
Any other site-specific event which the analyst feels may contribute to core damage should at least be screened to see iffurther analysis is required.
Some external events can be sub-categorized.
For example, severe wind analysis can be broken down into tornado, strong winds, and hurricane analyses.
A screening process may be employed to remove improbable or inappropriate sub-categories.
The screening process can be qualitative (i.e., removal of hurricane events for inland sites,) or quantitative (i.evg removal of tornado events due to extremely low frequency of tornadoes in the area.)
In any event, any engineering evaluation of events which results in their removal is fully documented.
Initial creenin:
A set of screening criteria was used to identify those external hazards which could be screened from further consideration based on very general considerations.
These screening criteria based on those in NUREG-1407 and NUREG/CR-2300, the PRA Procedures Guide, are listed below:
An external event is to be excluded from further consideration if:
~rit ri n i The event is of equal or lesser damage potential thon the events for which the pinnt has been designed.
This requires an evaluation of plant design bases in order to estimate the resistance of plant structures and systems to a particular external event.
Criterion 2 The event has a significantly lower mean frequency of occurrence than other events with similar uncertainties and could not result in worse consequences than those events.
Criterion 3 The event can not occur close enough to the plant to affect it. This is also a function of the magnitude of the event.
Criterion 4 The event is included in the definition of another event.
Qrinteri n 5 The event is stow in developing and there is suBicient time to eiiminnte the source of the threat or to provide an adequate response.
The use of these criteria minimized the possibility of omitting any significant risk contributors while at the same time reducing the amount of detailed bounding analysis required.
The following is a summary of the screening analysis which used as a reference the Donald C. Cook UFSAR.
5.0.1 USI A45 Issue The USI A45 external events findings were combined with the findings from the internal events analysis, These are listed in Section 3A.3 of the internal events IPE submittal.
5-1
Event Aircraft Impact Avalanche Biological Events Screening Criterion Remarks A bounding analysis is performed for this event.
Topography is such that no avalanche is possible.
The only biological event which may effect the Cook Nuclear Plant is Zebra mussel blockage of the circulating water system intakes.
This event is not further considered because effects of mussel buildup are continuously monitored, and the plant would have sufficient warning ifconditions warranted plant shutdown.
Additionally, a mussel control program is in place to minimize the zebra mussel population at Cook Nuclear Plant.
Coastal Erosion Drought External Fire External Flooding Extreme Winds/Tornados Fog Frost Hail Hazardous Materials The long-time periods required to produce sufficient coastal erosion to endanger the plant would provide sufficien time for plant shutdown, and, therefore, no further analysis was performed.
The depth of the intake cribs at the Cook site (about 10 feet below the record low lake level) predudes further analysis.
Additionally, drought conditions would be gradual in developing and would afford Cook Nuclear Plant ample time to undergo safe shutdown.
A bounding analysis is performed for this event.
A bounding analysis is performed for this event.
A bounding analysis is performed for this event.
Fog can increase the frequency of occurrence of accidents, Fog is implicitlyinduded in aircraft and other transportation accident frequency data.
Aircraft and transportation accidents are analyzed in this study.
Snow and ice govern,,
Tornado and turbine missiles govern.
A bounding analysis is performed for both off-site and on-site events, High Lake Level High Summer Temperature Included under external flooding.
The main problem would probably be loss of heat
. sink which is addressed in ESW system notebook.
Also, lake water temperature is continuously monitored, thereby affording the plant sufficient time to shutdown ifconditions approach technical specification limits, 5-2
Ice Cover Industrial or MilitaryFacility Accidents Included under high winds.
Ice or snow loading is considered in the plant design.
Included under hazardous materials.
Internal Fire Internal Flooding Landslide Lightning Low Lake Level Low Winter Temperature Meteorite Pipeline Accident Intense Precipitation Release of Chemicals in On-site Storage River Diversion RWST/CST Rupture A detailed plant specific analysis is performed elsewhere.
A detailed plant specific analysis is performed elsewhere.
Topography is such that a landslide is not
- possible, Included in loss of off-site power initiating event frequency and external fire analysis, Included under drought.
The likelihood of the lake freezing solid to the depth of the intake cribs is insignificantly small.
Also, there would be ample warning time for the plant to shutdown with respect to freezing of the heat sink. A procedure is used to increase the forebay temperature when signs of localized freezing are observed, Extremely low frequency as per K. A. Soloman, et. al., "Estimate of the Hazards to a Nuclear Reactor from the Random Impact of Meteorites,"
UCLA-ENG-7426, March 1974.
Included under hazardous materials.
Included under external flooding.
A bounding analysis is performed for this event.
Included under external flooding; also heat sink is Lake Michigan.
The likelihood of such a random failure is extremely low. Seismically/tornado missile induced failure of these tanks is analyzed elsewhere, Sandstorm Seiche Seismic Activity Snow This is not relevant for this region.
Included under external flooding.
A detailed site and plant specific analysis is performed elsewhere.
Ice or snow loading is considered in the plant design.
5-3
Soil Shrink-Swell Consoli-dation Site-suitability evaluation and site development for the plant are designed to preclude the effects of this hazard.
Storm Surge Transportation Accidents Included under external flooding, Included under aircraft impact, ship, and.
hazardous materials.
Tsunami Toxic Gas Turbine Generated Missile Volcanic Activity Waves This is not relevant for this region.
Included under hazardous materials.
A bounding analysis is performed for this event.
This is not relevant for this region.
Included under external flooding.
5.1 Severe Winds and Tornadoes This section examines potential severe wind events which might initiate an accident sequence leading to core damage.
Potential severe wind sources include: strong winds, tornadoes, and hurricanes.
5.1.1 Severe Winds Source Screening Hurricane wind speeds tend to diminish as they pass over large land masses.
Due to the geographic location of the Donald C, Cook Nuclear Plant (Reference 5.1-1), the probability of core damage as a direct result of wind from a hurricane is negligible.
5.1.2 Screening Summary The only severe wind sources that could potentially impact the Cook Nuclear Plant site are strong winds and tornadoes.
5.19 Methodology and Analysis Severe winds can affect safety related (or critical) structures at the plant site in at least hvo ways. Ifthe wind forces exceed the load capacity of a building or other external facility, the incident walls or framing might collapse or the structure might overturn. Ifstrong enough, the winds may be capable of lifting objects and hurling them against some of these structures. Ifa wind-induced missile breached a building wall, critical components or other equipment inside the building may N'damaged or disabled.
The first step in a severe winds analysis is to determine the frequency of the wind speeds associated with the various wind sources for the area in question, Next, the allowable wind loading of each pertinent plant structure is coupled with the wind speed frequency data to determine the expected failure frequency of the structure and ultimately the core damage frequency.
This analysis should also include the possibility of the generation of any wind-induced missiles and their effect on the plant.
Care should be taken to examine other possible wind-induced events such as the knocking down of power lines (causing a loss of offsite power), which can be initiated at much lower wind speeds.
5.19.1 Strong Winds Strong winds are the most common meteorological hazard to the Cook Nuclear Plant.
The re ion is frequented by relatively strong, gusty winds, usually accompanying the passage of squall lines or thunderstorms.
The maximum wind associated with these phenomena is 90 mph on a 100 year recurrence interval (i.e., annual frequency of occurrence = 10
) (Reference 5.1-1).
The Cook Nuclear Plant building structures are capable of withstanding the effects of 90 mph winds.
Class I building structures (including the auxiliary, containment, and circulating water pump screen house buildings, the turbine building foundation, the refueling water storage tank, and the steam generator stop valves and pipe enclosures outside the containment building) were designed to ensure safe plant shutdown at much higher wind speeds (see section 5.1.3.2 TORNADOES for more detail on higher wind force loadings).
Therefore, direct damage to the core from the 90 mph winds is not considered to be credible.
IVhilestructural damage is not postulated to occur within the range of credible wind events, it is possible that a loss of offsite power could be induced by winds considerably below the building structures design basis level. The Cook Nuclear Plant offsite power transmission lines are designed for a loading of 25 psf (Reference 5.1-2), corresponding to approximately 99 mph winds. This wind speed is estimated to occur at a frequency of less than 10 z/year (i.e., less than the recurrence interval of 90 mph winds).
- However, even ifit is conservatively assumed that these lines fail immediately beyond the design level, an independent failure of onsite diesel generator power would be required to cause a loss of vital power buses.
5-5
The frequency of occurrence of this wind induced loss of offsite power is much lower than the random event modeled in the internal plant analysis, (the loss of offsite power frequency for the Cook Nuclear Plant is 8E-2) (Reference 5.1-3). In addition, ample warning time is normally available prior to experiencing abnormal weather conditions (i.e. squall lines, thunderstorms, etc.), and plant procedures are established to ensure a proper state of preparedness for these conditions (e.gactuation of the Emergency Diesel Generators)
(Reference 5.1-4).
Therefore, it is judged that the probability of a strong wind which actually leads to core damage is sufficiently low such that it does not significantly contribute to overall plant risk and is conservatively bounded by the loss of offsite power analysis.
5.16.2 Tornadoes The basic methodology (Reference 5,1-5) used for tornado hazard probability studies is to develop a hazard probability model which yields the annual frequency for any point within a defined geographic region experiencing a tornado with a wind speed greater than or equal to specified values.
Four basic steps are involved in the development of the tornado hazard probability model:
(1) Determination of an area-intensity relationship in a "global" region surrounding the site, (2) Determination of an occurrence-intensity relationship in a "local" region'surrounding the site, (3) Calculation of the probability of a point in the local region experiencing wind speeds in some wind speed interval, and (4) Determination of the probability of wind speeds in the local region exceeding the interval values.
A plot of the results of Step 4 is the tornado hazard probability model. To accomplish the above four steps, tornado data is required for the region.
The data, obtained from the National Weather Service's - National Severe Storms Forecast Center, contains data on tornadoes within 125 nautical miles of Bridgman, Michigan [42', 86']. The tornado data, called a TORPLOT, contains a chronological listing of tornadoes in the region from 1950-1988.
The TORPLOT data includes information regarding each tornado's date and time of occurrence, location, intensity, and sim. Tornado intensity and size are classified by the Fujita and Pearson
- Scales, respectively, Until 1971 there was no method available for systematically rating the intensity of tornadoes.
In 1971, a rating scale whereby tornado intensity could be judged on the basis of appearance of damage was introduced by Fujita. The Fujita Scale (F-Scale) separates tornadoes into six intensity classifications ranging from FO (least intense) to F5 (most intense).
Table 5.1-1 contains a listing of the FNcale classification of tornadoes based on appearance of damage.
The Pearson path length, P<, and path width, Pw, scales indicate the length and mean width, respectively, of the tornado damage path for damage done by winds greater than or equal to 40 mph. Like the F-Scale, each Pearson Scale has six categories (0 - 5), with short, narrow paths having lower Pearson Scale numbers than long, wide paths, Each tornado can be categorized by it's FPP number.
For example, a 4,2,3 tornado has an intensity of F4, a path length of P<2, and a path width of Pw3, Table 5.1-2 defines the FPP classifications.
The tornado data is used to develop empirical relationships between tornado damage path area and intensity, step (1), and between tornado occurrence and intensity, step (2). These two functions are then used to derive a relationship between probability and wind speed (minimum wind speed of each F-Scale rating) by accounting for gradations of damage across the width and along the length of the damage path, step (3). Finally, a summation of all the probabilities of wind speed greater than the minimum wind 5-6
speed of each F-Scale rating gives the total probability of exceedence of each F-Scale minimum wind speed, step (4). Graphical or regression analyses can be used to determine wind speed exceedence probabilities of other wind speeds ifso desired.
To minimize random encounter errors, estimates of the number of unreported tornadoes in the area are included in the data set.
Ninety-five percent confidence limits are estimated for the expected values of the area-intensity and, occurrence-intensity empirical relationships derived from linear regression analyses'(Reference 5.1+. It should be noted that the calculated confidence limits account for uncertainty in the linear regression analysis performed to obtain the area-intensity and occurrence-intensity relationships.
They do not account for random encounter errors, misclassification errors, or errors in the wind speeds associated with the F-Scale classifications.
The confidence limits should be used to gauge the quality of the expected value.
For design or evaluation of structures, the expected value, rather than the upper bound value, should be (and is) used (Reference
- 5. 1-5).
Once the probability of the plant encountering a tornado with winds in excess of a specified speed is known, core damage frequency estimates are made (Section 5.1.3.2.4).
There are two sources for tornado-induced core damage: the force of the wind itself and wind-induced missiles.
5.1.39 Tornado-Induced Core Damage Frequency To determine the core damage frequency as a result of plant damage from a tornado, plant damage frequencies must first be determined, Here, plant damage refers to damage to the plant, from tornado wind pressures or tornado-induced missiles, which either directly damages the core, prevents or lessens the ability of the plant to safely shut down when required, or induces a transient leading to a reactor trip with a significant frequency relative to the random event causing the same transient.
Tornad Wind Dama e
Tornado wind damage is damage caused from the pressure forces of the tornado either damaging the plant directly or causing a transient leading to a reactor trip. To be conservative, it is assumed that a structure fails and causes core damage as soon as the tornado wind speed reaches the structure's design limit. The structures to be considered should include those structures which contain the reactor and/or components and equipment necessary for safe shutdown of the plant.
These include the following Class I structures: the containment and auxiliary buildings, the circulating water pump screen house, the refueling water storage tank (RWST), and the steam generator stop valves and pipe enclosures outside the containment building.
Class I structures are defined in the Cook Nuclear Plant Updated FSAR (Reference 5.1-1) as:
"Those structures and components including instruments and controls whose failure might cause or increase the severity of a losswf-coolant accident or'result in an uncontrolled release of excessive amounts of radioactivity.
Also, those structures and components vital to safe shutdown and isolation of the reactor."
As per Section 2.8,3 of Reference 5.1-1, "the plant can safely shut down despite the effects of a tornado with a forward progression of 60 mph containing 300 mph winds coincident with an atmospheric pressure drop of 3.0 psi applied within 3 seconds."
Per Reference 5.1-1, the following Class I buildingslstructureslcomponents were designed to withstand the tornado conditions as listed below.
5-7
Containment Buildings:
~
300 mph tangential wind velocity
~
60 mph forward progression
~
3 psi coinciderit pr'essure drop (for a complete analysis, see Reference 5.1-1, section 5.2)
Remaining Class I structures listed above (except RWST):
, ~
250 mph tangential wind velocity
~
50 mph forward progression
~
3/4 psi coincident pressure drop (will not experience stresses in excess of allowable as outlined in the 1963 American Institute of Steel Construction Specifications)
~
300 mph tangential wind velocity
~
60 mph fonvard progression
~
3/4 psi coincident pressure drop (will remain within yield and no permanent deformation will occur - this limit is appropriate for the analysis of severe wind accidents for the PRA)
Refueling Water Storage Tank (Reference 5.1-1):
~
100 mph forward progression
~
3/4 psi coincident pressure drop
~
maximum tangential wind velocity for the RWST is unavailable NOTE:
The primary water and condensate storage tanks are functionally Class IIstructures located near Class I structures, namely, the refueling water storage tank (RWST) and the containment.
Analysis of the primary water storage tank (Reference 5.1-1) indicates that its'ailure (collapse) willnot cause structural damage to the RWST.
Also, although not required to be a Class I structure, the condensate storage tank was designed as such to insure the structural integrity of the RWST.
(All three tanks are in excess of 20 feet from the containment.
Also since the containment is more structurally sound than the RWST, it can be inferred that failure of the primary water storage tank will not cause a failure of the containment vessel.)
The tornado hazard probability model does not distinguish between the tangential and forward wind speeds of a tornado.
The scale ratings, and hence wind speed ratings, are based on appearance of damage, therefore a tornado with a tangential velocity of 300 mph and a forward progression of 50 mph is rated the same as a stationary tornado with a 350 mph tangential velocity. Hence, the wind speeds in the hazard probability model are the sum of the tangential wind speed and the tornado's forward progression.
From the tornado hazard probability model, the probability of a 360 mph tornado wind speed or the probability of structure failure (i.e., 300 mph tangential wind speed and 60 mph forward progression) is 8.5E-08 per year. This probability corresponds to a 11.8 million year recurrerice interval.
The probability of 90 mph winds from a tornado (from the tornado hazard probability equation) is 2.0E-04.
Since the normal strong ~ind 90 mph frequency ic about hwo order@ af finitude higher (see Section 5-8
5.1.3.1 of this chapter) than the 90 mph tornado mnds, normal winds, and not tornadoes dominate the lower speed wind damage frequency.
It is therefore concluded that core damage as a result of direct tornado wind pressure forces is of a sufficiently low probability as to not warrant further or explicit modeling.
Note that the assumption made at the beginning of this section, that a structure fails and causes core damage as soon as the wind speed reaches the structure's design limit, is conservative and does'not include the conditional probabilities of forced reactor trip due to structural failure, or safety system failure (multiple train) which would be expected to considerably temper the core damage frequency.
Tornado-Induced Missil Tornado-induced missiles can cause damage to plant structures in a variety of ways, Structure barrier response to missile impingement can be broken down into five response categories.
The response categories:
penetration, threshold scabbing, scabbing, barrier perforation, and complete missile perforation are described in Reference 5.1-7.
The Cook Nuclear Plant is designed (Reference 5.1-1) so that missiles from both external and internal so Ufces:
- 1. will not cause or increase the severity of a loss of coolant accident (LOCA),
- 2. will not damage engineered safety features such that the minimum required safety functions are jeopardized,
- 3. will not cause a leak in the Seismic Class I portion of a steam or feedwater pipe,
- 4. will not prevent safe shutdown and isolation of the reactor, and 5
will not damage fuel stored in the Spent Fuel Pit.
The protection of safety related equipment from tornado induced missiles has been accomplished at the Cook Nuclear Plant by one or more of the following methods (Reference 5.1-1):
1.
enclosing equipment in missile protected compartments, 2.
erecting barriers to stop potential missiles either at the source or at the location of the equipment to be protected, 3.
providing sufficient separation of redundant systems so that a potential missile cannot impair both systems, restraining potential missiles, 5.
designing the structure or component to withstand a missile without loss of function, and 6.
locating equipment beyond the range of the potential missiles.
The design credible tornado induced missiles, from sources considered capable of generating potential missiles, are defined as follows (Reference 5.1-1):
a.
bolted wood decking, 12 ft x 12 ft x 4 in, weighing 450 lbs traveling at 200 mph;
- b. corrugated sheet siding, 4 ft x 4 ft, weighing 100 lbs traveling at 225 mph;
'5-9
Using the most conservative estimates for the Cook plant the total probability of missiles of types a,b,c, and d striking a vulnerable critical area of the plant are:
MISSILE SPEED (mph)
PROBABILITY (year t) 200 225 50 133 2.43E-10 2 42E-10 3.86E-09 3.54E-10 5.1.4 Results, Recommendations and Conclusions Due to the low frequency of strong wind, tornado, and tornado. induced missile events and the high level of protection afforded the Cook Nuclear Plant to these events, it is concluded that the contribution to plant risk from severe wind events is insignificant.
The severe wind protective measures and design features instituted in the Cook Nuclear Plant are consistent with a highly safe plant design with very low risk contribution. Therefore, no design changes related to severe winds protection are currently recommended.
5.1$
References 5.1-1 "Donald C. Cook Updated Final Safety Analysis Report," Donald C. Cook Nuclear Plant, American Electric Power Service Corporation, August 24, 1989.
5.1-2 Letter from J, B. Kingseed, American Electric Power Service Corporation, to Steve 51aher, Westinghouse dated April 4, 1991.
5.1-3 Initiating Event Notebook, Donald C. Cook Nuclear Plant, American Electric Power Service Corporation, Revision 0, 1992.
5.14 PMP 2080 EPP.111, "Natural Emergency Guidelines," Donald C. Cook Nuclear Plant, American Electric Power Service Corporation, Revision 0, January 21, 1988.
5.1-5 J.R. i>IcDonald, "A Methodology for Tornado Hazard Probability Assessment,"
NUREG/CR-3058, Prepared for U.S. Nuclear Regulatory Commission, Washington, D.C., October, 1983.
5.1-6 L.L. Lapin, "Probability and Statistics for Modern Engineering," 1983.
5.1-7 Electric Power Research Institute, "Tornado Missile Simulation and Design iWIethodology, Volume 2: Model Verification and Data Base Updates," EPRI NP-2005 Volume 2, Project 616-2, August 1981.
5-10
TABLE5.1-1 SCALE CLASSIFICATIONOF TORNADOES BASED ON APPEARANCE OF DAMAGE Fujita (1971)
(Reference 5.1-5)
(FO)
LIGHT DAMAGE 40-72 mph This speed range corresponds to Beaufort 9 through 11.
Some damage to chimneys or TV antennae occurs; branches broken off trees; shallow-rooted trees pushed over; old trees with hollow insides break or fall; sign boards are damaged, (F1)
MODERATE DAMAGE 73-112 mph 73 mph is the beginning of hurricane wind speed or Beaufort 12.
Surfaces of roofs peeled off; windows broken; trailer houses are pushed or overturned; trees on soft ground are uprooted; some trees snapped; moving autos pushed ofY road.
(F2)
CONSIDERABLE DAMAGE 113-157 mph Roofs tom ofY of frame houses leaving strong upright walls standing; weak structures or outbuildings are demolished; trailer houses are demolished; railroad boxcars are pushed over; large trees snapped or uprooted; light-object missiles generated; cars blown off highway; block structures and walls badly damaged.
(F3)
SEVERE DAMAGE 158-206 mph Roofs and some walls tom offwellwonstructed frame houses; some rural buildings completely demolished or flattened; trains overturned; steel frame hangar-warehouse type structures tom; cars lifted off the ground and may roll some distance; most trees in a forest uprooted, snapped or leveled; block structures often leveled.
(F4)
DEVASTATINGDAMAGE 207-260 mph
%Veil-constructed frame houses leveled, leaving piles of debris; structures with weak foundations lifted, tom, and blown offsome distance; trees debarked by small flying debris; sandy soil eroded and gravel flies in high winds; cars thrown some distance or rolled considerable distance, finally to disintegrate; large missiles generated.
(F5)
INCREDIBLE DAMAGE 261-318 mph Strong frame houses lifted clear off foundation and carried considerable distance to disintegrate; steel-reinforced concrete structures badly damaged; automobile-sized missiles fly distances of 100 yards or more; trees debarked completely; incredible phenomena can occur.
5-11
FUJITA SCALE TABLE5.1-2 FUJITA-PKARSON (FPP) CLASSIFICATIONS (Refereoce 5.1-5)
Maximum Wind Speed Fl F4 F5 Range, mph Median, mph 40-72 56.0 73-112 92.5 113-157 135.0 158-206 182.0 207-260 233.5 261-318 289.5 PEARSON PATH LENGTH SCALE Pl Path Length P4 PS Range, mi Median, mi 0.3-0.9 0.6 1.0-3.2 2.05 3.2-9.9 6.55 10.0-31.5 20.75 31.6-99 65.3 100-316 208 PE ARSON PATH YVIDTH SCALE PO Pl Path Width P5 Range, yds Median, yds 6-17 18-55 11.5, 36.5 56-175 115.5 176-556 557-1759 17604963 366 1158 3361.5 5-12
5.2 External Floods This section examines potential external flooding events which might initiate an accident sequence leading to core damage.
The potential flooding events considered indude:
dam failures, lake flooding, river flooding, and intense precipitation.
5.2.1 Extenul Hooding Source Screening There are no on-or off-site dams associated with, or in the proximity of the Doriald C. Cook Nuclear Plant (Reference 5.2-1.)
Also, local topography precludes any flooding from the landward side of the site (Reference 5.2-2.)
For these reasons, dam failure and flooding from inland lakes and streams are not applicable to the Cook Nuclear Plant site.
5.2.2 Screening Sununary The only sources of external flooding that could potentially impact the Cook Nuclear Plant site are Lake Michigan and intense precipitation.
5.2.3 Methodology and Analysis External flooding methodology involves the determination of the maximum possible flooding levels, and the effect these flooding levels have on the plant, Ifthe plant elevation precludes any flooding from these maximum flooding levels, the analysis is complete; if the elevation is insufficient to preclude flooding, further analysis is required.
5.29.1 Hooding From Lake Michigan Provisions were made in the plant design to protect safety-related plant structures and equipment from flooding, waves, storms, and other phenomena generated in the lake.
According to U.S. Geological Survey figures, from the Cook Nudear Plant Updated FSAR (Reference 5.2-2), the low water datum of Lake Michigan is 578.4 feet above'mean sea level (MSL). The lowest recorded level of the lake was 576.9 feet above hISL during the 1964-65 winter; the highest recorded level was 583.5 feet above MSL during the summer of 1886.
The current lake level at the Cook Nuclear Plant is 578.3 feet above MSL. The elevation of the plant embankment adjoining Lake AIichigan is 594 feet above MSL. The plant is protected to 595 feet above MSL (including a 0.5 foot freeboard), more than 11 feet higher than the highest recorded lake level (Reference 5.2-2).
The plant elevation is greater than or equal to 595 feet above.'.MSL for all buildings, and exterior vessels at the site.
Even though some safety related equipment is placed at elevations below the 595 foot level, and some are at elevations below that of the lake level, it is the elevation of the penetrations of the building containing the equipment rather than the elevation of the equipment itself that limits the flooding hazard.
Although the Cook Nuclear Plant is well above the normal lake levels, external flooding from abnormal lake levels is possible.
Seiches and wind waves are phenomena capable of producing large temporary deviations in lake water levels,
~Seieh Seiches are oscillations in the level of lakes and similar bodies of water caused by the passage of squall lines across the body of water.
In Lake Michigan, these squalls have their fronts oriented NE to SW and are accompanied by an abrupt increase in barometric pressure and local high winds.
There have been a number of seiches recorded in the Great Lakes, the great majority of which were of only a few inches amplitude and, therefore, of no consequence.
A few, however, have caused considerable flooding damage, and even loss of life. The most severe of the large seiches occurred on June 26, 1954 and caused water 5-13
level increases of up to 10 feet at North Avenue in Chicago, Illinois. The greatest le'vel increase recorded on the lake's eastern shore was 6 feet at Michigan City, Indiana (Reference 5,2-2).
Seiches do not have the rapidity or damaging power of a wind-wave of equal height.
Instead, the rise of water is continuous over several minutes, and damage is primarily due to flooding.
Within the bounds of seiche-causing conditions, the most severe initiating meteorological condition may be assumed to be a squall line traveling the entire lake from a direction west of northwest with a progress velocity sufficient to match the natural oscillation mode of the lake's southern sub-basin and producing a-seiche front so shaped as to trap against the shore at the plant site.
The maximum recorded amplitude of an open lake seiche produced under such conditions was 4.2 feet observed at the Wilson Avenue Crib in Chicago on July 6, 1954.
A previous seiche on June 26, 1954, which resulted in a rise of 3.2 feet at Wilson Avenue Crib, caused the rise estimated at less than 6 feet in the Michigan City Yacht basin, a point approximately 25 miles south of the plant site in an area where seiche effects are considered more severe than those farther to the north. Taking these values in proportion, one can postulate the maximum seiche producing a water level increase of as much as 8 feet in the Michigan City yacht basin (Reference 5.2-2),
The infrequency of seiches of significant size on Lake Michigan restricts to some degree the volume of recorded data from which future seiche characteristics may be predicted.
The great quantity of information available concerning other large bodies of water, including measurements and observations of actual seiches, the characteristics of the shoreline at the plant site, historical meteorological conditions, computations based upon mathematical models, etc., confirm that no water level increase of as much as 8 feet should ever be experienced at the plant site (Reference 5.2-2).
However, as an added measure of conservatism, the plant safety components are protected against a water level increase of 11 feet.
Wind Waves Wind generated waves are limited in their dimensions by wind velocity, fetch (open water distances available to the wind), and by the length of time the wind has blown. The greatest fetch for the plant site over Lake Michigan is 265 statute miles (223 nautical miles) to the north.
The maximum deep water wave to be expected as incident to the plant is approximately 23 feet, and would require a sustained north wind of about 26 knots for over 19 hours2.199074e-4 days <br />0.00528 hours <br />3.141534e-5 weeks <br />7.2295e-6 months <br /> (Reference 5.2-2).
The runup of such a wave on the site shore, discounting the effects of the off-shore sandbars has been calculated as 3,7 feet (Reference 5.2-2).
This figure is overly conservative, however, since a large wave approaching the beach would be tripped by each of the sand bars.
incid nce of Maximum Wave and Maximum eich The maximum wind wave can occur only in a fully developed sea, for which there is a definite requirement for a long wind duration.
The seiche, on the other hand, accompanies a squall-line storm that moves across the lake at a speed similar to one of the lake's natural oscillation modes.
Seiches occur at the beginning of a storm while the maximum wind wave would not manifest itself until many hours later.
Therefore, it is an impossibility for the conditions leading to a maximum seiche to coincide with the conditions necessary to produce the maximum wind wave.
5.2.3.2 Flooding From Intense Precipitation Precipitation flooding analysis consists of first determining the maximum amount of precipitation an area can receive followed by an analysis of water removal for the area (i.e., runoff analysis).
5-14
The rainwater concerning plant safety usually comes from local, convective type heavy rainstorms which are characterized by high rain intensity over a relatively short duration, normally less than an hour (Reference 5.2-3).
Probable Maximum Preci itation Rainfall frequency analysis is best performed using area-specific data from rain gauges or ifno rain gauge data are available results from nearby gauged sites can be meteorologically transferred to the area in question.
One such frequency analysis performed on recorded point rainfall data at gauged stations and generalized to ungauged stations is the U.S. National Weather Services Technical Paper No. 40 (Reference 5,2-4).
However, because of the potential seriousness of external flooding induced nuclear plant failure, the use of probable maximum precipitation (PMP) is usually recommended for plant design.
The PbIP is defined as "the theoretically greatest depth of precipitation for a given duration that is physically possible over a particular drainage area at a certain time of year" (Reference 5.2-5).
The derivation of the PMP estimate only produces the theoretical maximum precipitation produced by the combination of reasonably conceivable worst hydrometeorological conditions occurring concurrently; there is no frequency of occurrence implied. Therefore, the PMP is useful only as a guide in plant flood prevention design.
Since there is no frequency implied by the PMP, the plant must be designed to withstand the possible flooding effects from the PMP event.
PibfP estimates for a 10 mi'- area about the Cook Nuclear Plant for durations from 1/2 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are given in Table 5.2-1 (References 5,2-5, and 5.2+.
For comparison, Table 5.2-1 also contains the 100 year recurrence interval extreme rainfall estimates calculated by the U.S. National Weather Bureau (Reference 5.2A), and the PMP to 100 year recurrence extreme rainfall depth ratios.
Although the PMP estimates are all at least five (5) times as great as the respective 100 year recurrence depth for the same storm duration, the NRC Standard Review Plan, NUREG-0800 Section 2.4.2 (Reference 5.2-7), requires that plant designs satisfy the PMP flooding criteria, Resul f Runoff Analv is The Standard Handbook for ivil En ineers (Reference 5.2-8) describes a method to determine the volume of water from a rainstorm that must be removed (i.e., water that does not evapotranspire or seep into the ground).
The peak discharge runoff, Q, is defined in the "Rational Foimula" as:
r Q = CIA; where Q = peak discharge [=] ft /s C = runoff coefficient (% of rain that appears as direct runoff)
I = rainfall intensity [=] in/hr A = drainage area [=] acres The runoff coefficient, C, defined in Reference 5.2-8 for average grade (2-7%) sandy soil varies from 0.10 to 0.15.
To be conservative, C will be assigned a value of 0.15.
From Table 5.2-1, the greatest hourly rainfall intensity occurs during the first hour of the storm, i.e.,
14.3 inches.
Since the Rational Formula is defined for an hourly rainfall intensity, the more intense half-hour storm (10.9 in/half-hour) is not used.
5-15
As previously stated the PMP estimates are based on a 10 miz area or 6400 acres (Note: Larger areas tend to produce lower PMP values).
However, realizing that water depth and not water volume is the issue here, we will define the runoff depth rate, H, as:
Q/g CIA/P CJ [
] in/gr I
Using the above values for "C" and "I," 0.15 and 14.3 inches/hour, the runoff depth, or height of standing water left by the PMP storm that did not evapotranspire or seep into the sandy soil is 2,2 inihr.
For storms greater than one hour the following runoff depth rates are expected:
Duration of Storm
~hr 2
3 6
12 24 Runoff Depth Rate
~in/br 1.4 1.1 0.6 0.4 0.2 The Cook Nuclear Plant freeboard protects the plant from rainfall induced external floods up to 6 inches.
General runoff is toward the west to Lake Michigan.
However, due to the immense size of Lake Michigan and its normal water level (approximately 11.5 feet below the plant elevation) no flooding of Lake Michigan from a combination of rain collection and runoff should ever endanger the Cook Nuclear Plant.
5.2.4 Results, Recommendations and Conclusions In view of the low frequencies and maximum flood levels caused by seiches, wind waves, as well as the plant elevation, the topographical layout of the site, and the elevation of plant penetrations, it is concluded that the contribution to plant risk from external flooding is insigniTicant relative to other initiating events, An analysis was also performed to evaluate flooding based on probable maximum precipitation (PMP) criteria.
Please note that PMP criteria does not have a frequency associated with it. It was concluded that Cook Nuclear Plant is not endangered by the flooding based on the PMP criteria.
The external flooding protective measures and design features instituted at the Cook Nuclear Plant site are consistent with a highly safe plant design with very low risk contribution.
Therefore, no design changes related to external flooding prevention are currently recommended.
t 5-16
5.2.5 Refeamas 5.2-1 G. E. Lear and O. O. Thompson, "NRC Inventory of Dams," NUREG4965, U.S. Nuclear Regulatory Commission, Washington, D.C., 1983.
5.2-2 "Donald C. Cook Updated Final Safety Analysis Report," Donald C. Cook Nuclear Plant, American Electric Power Service Company, Chapters 1 and 2, August 24, 1989.
5.2-3 Ben Chic Yen, "Flood Hazards for Nuclear Power Plants," Nuclear Engineering Design (Netherlands), Volume 110 No. 2, pp: 213-19, December 1988.
5.24 D. M. Hershfield, "Rainfall Frequency Atlas of the United States for Durations from 30 hfinutes to 24 Hours and Return Periods from 1 to 100 years," United States National Weather Bureau, Technical Paper No. 40, May 1961.
5.2-5 L. C. Schreiner and J. T. Riedel, "Probable Maximum Precipitation Estimates, United States East of the 105th Meridian," United States National Weather Service, Hydrometeorological Report No. 51, June 1978.
5.2-6 5.2-7 E. M. Hansen, et al., "Application of Probable Maximum Precipitation Estimates - United States East of the 105th Meridian," United States National Weather Service, NOAA Hydrometeorological Report No. 52, August 1982.
"NRC Standard Review Plan," NUREG-0800, Section 2.4.2, Revision 3, 1990.
5.2-8 F. S. Merritt, ed. "Standard Handbook for Civil Engineers," Third Edition, Sections 21-53 to 21-57, McGraw-Hill, 1983.
5-17
TABLE52-1 PMP AND 100 YEAR RECURRENCE IMNFALLDEPTHS FOR SI'ORMS WITHDURATIONS FROM 0.5 TO 24 HOURS Durabon thours]
0.5 1.0 2.0 3,0 6.0 12.0 24.0
- PMP Estmrate
[inches]
10.9 14.3 18.7 21.0 25.5 29.0 31.3
- 100 Year Recurrerxe Depth
[ux3xs]
2.1 2.7 3.2 3,4 4,0 4.8 5.5
- PMPto 100 Year Depth Rabo 5.2 5,3 5.8 6.2 6.4 6.0 5.7
- PMP estimates based on 10 square mile drainage area.
PMP estimates for:
0.5 and 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> durations from Reference 5.24 6, 12 and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> durations from Reference 5.2-5 2 and 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> durations from logarithmic regression of 0.5, 1, 6, 12 and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> durations.
- From Reference 5.2A..
- This column underscores the conservatism of PlrfP criteria.
5-18
5D Transportation and Nearby FacTiity Accidents The analysis for transportation and nearby facility accidents will be divided in the following categories:
A. Aircraft Accidents B. Ship Impact Accidents C. Off-site Hazardous Materials Accidents The analysis for the above categories was performed and is summarized as follows.
5.3A Aircraft Accidents This section examines aircraft accident events which might initiate an accident sequence leading to core damage.
All private, commercial, and military aircraft and flight paths will be examined.
5.3A.1 Aircraft Accidents Source Screening The effect of an aircraft of sufficient weight, traveling at sufficient speed, crashing at a nuclear power plant site may result in physical damage and disruption to the plant to the extent that damage to the reactor, core damage, and release of radioactive material from the reactor core may result.
Only physical damage to the plant is considered because there is insufficient hazardous material carried by the aircraft, except for onboard fuel, to affect the plant sufficiently to ultimately cause damage to the reactor core (Reference 5.3A-1). The fuel aboard the aircraft is considered to be covered by physical damage to plant.
No sabotage or deliberate "kamikaze" crashes are considered.
The U.S. NRC has issued the following in their Standard Review Plan (Reference 5,3A-2) as their acceptance criteria for the siting of nuclear power plants near airports and/or airways.
The probability of an aircraft accident resulting in radiological consequences greater than 10 CFR Part 100 (Reference 5.3A-
- 3) exposure guidelines is considered to be less than 10 7 per year ifthe distances from the plant meet all of the requirements listed below:
(a)
The plant-to-airport distance D is between 5 and 10 statute miles, and the projected annual number of operations is less than 500 Dz, or the plant-to-airport distance D is greater than 10 statute miles, and the projected annual number of operations is less than 1000 Dz.
(b)
The plant is at least 5 statute miles from the edge of military training routes, including low-level training routes, except for those associated with a usage greater than 1000 flights per year, or where activities (such as practice bombing) may create an unusual stress situation, (c)
The plant is at least 2 statute miles beyond the nearest edge of a federal airway, holding pattern, or approach pattern.
Ifthe above proximity criteria are not met, or ifsufficiently hazardous military activities are identified (see item b above), a detailed review of aircraft hazards must be performed.
The FAA, in compiling airport use statistics, defines an aircraft operation as the airborne movement of aircraft in controlled or noncontrolled airport terminal areas and about given enroute fixes or at other points where counts can be,made.
There are two types of operations - local and itinerant.
Local operations are performed by aircraft which:
(1) operating in the local traffic pattern or within sight of the airport, (2) are known to be departing for, or arriving from, flight in local practice areas within a 20 mile radius of the airport, and (3) execute simulated instrument approaches or low passes at the airport.
Itinerant operations are all aircraft operations other than local operations (Reference 5.3AM).
5-19
Although the FAA defines local aircraft operations as those within a 20 mile radius around an airport, a 30 mile radius about the Cook Nuclear Plant will be used to provide an extra 10 mile cushion.
This extra ten miles will in fact, more than double the area checked (i,e., 30 /20
= 2.25).
Table 5.3A-1 contains the names, distances and approximate number of operations per year of all airports within a 30 mile radius surrounding the Cook Nuclear Plant.
Using the criteria set in (a) above, the probability of radiological consequences greater than 10 CFR Part 100 exposure guidelines from aircraft operations associated with those airports listed in Table 5.3A-1 is considered less than 10 7 per year, The nearest military training route, VR 1640, is approximately 50 miles from the Cook Nuclear Plant (Reference 5.3A-5). Therefore, criterion (b) concerning military training routes is satisfied, and again probability of exceedence of the radiological exposure guidelines set in 10 CFR Part 100 is considered less than 10 7.
The low altitude structure (i.e., flight path) V 526 passes well within 2 statute miles of the Cook Nuclear Plant..Therefore criterion (c) is not met, and further analysis of low altitude flight path V526 is warranted.
The distances to the Cook Nuclear Plant of local airports precludes danger from aircraft in approach or holding patterns over the airports.
The nearest high altitude flight path is J584.
J584 is at least 5 miles from the Cook Nuclear Plant at its closest approach.
Therefore, all high altitude flight paths meet the requirements of criterion (c), above, and do not require further analysis.
5.3A.2 Scnxming Smnmary Using the screening criteria found in the NRC Standard Review Plan (Reference 5.3A-2) it is determined that the only source of aircraft accidents that could potentially impact the Cook Nuclear Plant are in-flight accidents of aircraft using the low altitude flight path V 526.
5.3A.3 Methodology The basic methodology used to determine the plant damage probability from in-flight crashes begins by first determining the probability of an in-flight crash into the "effective plant area" for all types of aircraft using the flight path in question.
The total plant damage probability from in-flight crashes is the sum of all the individual plant damage probabilities for all types of aircraft.
A plant damage probability less than 10 7 precludes further analysis; otherwise, a more detailed plant specific analysis is required.
5.3A9.1 In-Bight Aircraft Accidents For Federal airways or aviation corridors that pass through the vicinity of a site, the probability per year of an aircraft crashing into the plant, Ppz, is given by the following equation (Reference 5.3A-2):
P>z = C x N x AAV, where C
=
in-flight crash rate per mile for aircraft using airway N
=
number of flights per year along the airway 5-20
A
=
effective area of plant in square miles, and W =
width of airway (plus bvice the distance from the airway edge to the site when the site is outside the airway) in miles As per Reference 5.3AX, the FAA is not required to keep information regarding the above parameters C,
N and W.
From Reference 5.3A-7, A is approximated to be 0.0136 sq, mi, A generic value for C from Reference 5.3A-2 in 4 x 10'rashes/mile for commercial aircraft.
Assuming a value of 1 mile for W and setting P>< = 1.0E-07, N is equal to 18382 flights per year on V526. Tins is slightly greater than 50 flights/day or 2/hour.
V526 is the low altitude flight path to Michiana Regional Airport. Table 5.3A-l shows the yearly activity at Michiana is 114562 takeoffs and landings per year (1988).
Assuming 1990 statistics have risen to 150,000/yr and that all 10 flight paths into Michiana are equally used (this is probably conservative based on the assumption that most traffi is on V6-10 to O'Hare International Airport in Chicago, Illinois), then the number of flights on V526/yr is about 15,000 (Note:
<18382).
Therefore setting N = 15,000, P+ =
8.16E-OS/yr which is less than 10 7 and thus precludes further analysis.
(Please note that the conservative assumptions in the above analysis had to be made because Michiana Regional Airport does not keep statistics on the frequency of flights for each flight path.)
5,3A.4 Resul ts, Recommendations and Conclusions Due to the distance-number of operations relationship between the Cook Nuclear Plant and. local airports (within a 30 mile radius); the distance between the Cook Nuclear Plant and military training routes; and the low probability of aircraft crashing into the plant, it is concluded that the contribution to plant risk is insignificant relative to other initiating events.
Until either flight patterns change or local air tratYic increases, no design changes related to aircraft accident induced plant damage is recommended.
5-21
52A.5 References 5.3A-1 C. Y. Kimura and R. J. Budnitz, "Evaluation of External Hazards to Nuclear Power Plants in the United States," NUREGiCR-5042, U. S. Nuclear Regulatory Commission, Washington, D. C., December 1987.
5.3A-2 5.3A-3 5.3AP "NRC Standard Review Plan," NUREG4800, Section 3.5.1.6, Revision 2, July 1981.
10 CFR Part 100, "Reactor Siting Criteria,"
"FAAStatistical Handbook of Aviation, Calendar Year 1982," U.S. Department of Transportation, Federal Aviation Administration, Office of Management Systems, Information Analysis Branch, Washington, D. C., December 31, 1982.
5.3A-5 Petty Officer Airhart - Naval AirStation Glenview, Glenview, IL, telephone conversation with G. P. Rozga - Westinghouse, February 9, 1990.
5.3A-6 Letter to G. P. Rozga - Westinghouse, from Teddy W. Burcham, Manager, Air Traffic Division, U.S. Department of Transportation, Federal Aviation Administration, Great Lakes Region, dated February 23, 1990.
5.3A-7 Plant Arrangement Basement Plan EL 591'0" & 587'0" Units 1 and 2, Dwg, 412-5167-10, American Electric Power Service Corporation, Donald C, Cook Nuclear Plant.
5.3A-8 "1989 Michigan Aircraft Traffic Counter Program," Michigan Department of Transportation, June 1990.
5.3A-9 "Aircraft Operations in Michigan 1990," Michigan Department of Transportation, February 1991.
5-22
TABLE5.3A-1 AIRCRAFI'CCIDENTACCEPTANCE CRITERIA CALCULATIONSAND COMPARISONS facility Andrews University Ross Twin Cities Tyler Mem.
Michigan City Michiana Regional Cass Company Mem.
La Porte Distance to Cook Nuclear Plant D (statute miles) 10.75 15.00 19.50 20.75 21.50
, 23.50 27.50
>>No. of Operations per Year N 26,000 38,727 18,600 10,950 114,562 13,400 5,512
- Number-Distance Criteria C 115,563 225,000 380,250 430,563 462,250 552,250 756,250
>>**Acceptance Criterion Met?
(Yes or No)
>>>> Number-Distance Criteria is calculated by:
>>'>> Acceptance criteria met if: N < C.
C = 500>> D"2 for D ( 10 statue miles, and C =1000>> D"2 for D ) 10 statute miles.
5-23
528 Ship Impact Accidents This section examines potential ship/barge accidents which might initiate an accident sequence leading to core damage.
Potential sources include commercial ships/barges and large recreational boats.
59B.1 Ship Impact Accident Source Screening Due to the physical location of the Cook Nuclear Plant buildings and structures, the only danger to the plant is from run-aground ships/barges collapsing the circulation water intake cribs and ultimately causing flow obstruction of all three circulating water system intake lines (Reference 5.38-1).
In the unlikely event of a loss of all three intake pipes, both units would be shut down.
- However, essential service water system flow can be maintained to remove heat from the component cooling water system and other essential service water system loads by opening sluice gates (WMO-17, Unit 1 and/or WM0-27, Unit 2) between the discharge chambers and the forebay.
This allows ivater from the discharge chambers to enter the forebay to supply the essential service water pumps (Reference 5.38-2).
5.38.2 Scanning Summary Since the plant decay heat load can be removed by the essential service water system even ifa shipping accident causes a loss of the circulating water system, the only credible shipping accident affecting the Cook Nuclear Plant does not cause further plant damage leading to core damage or radiological release.
Therefore, an in depth analysis is not required.
5.3B.3 Methodology and Analysis N/A 5.38.4 Results, Recommendations and Conclusions No plant damage leading to core damage or radiological release is expected as a result of a shipping accident.
Current plant design precludes further plant damage if the circulating water system's intal'es are obstructed; therefore, no design changes related to shipping accidents are currently recommended.
5.38.5 References 5.38-1 Plant Arrangement Sections L-L and M-MUnits 1 and 2, Donald C. Cook Nuclear Plant, American Electric Power, Drawing No. 12-5164, Revision 5, May 2, 1986.
5.38-2 Circulating Water System Description, Donald C. Cook Nuclear Plant, American Electric Power Service Company, System Description No. SD-DCC-HP119, Revision 6, June 8, 1989.
5-24
53C OIr4ite Hazardous Materials Accidents This section examines potential accidents involving the off-site storage or transportation of hazardous materials which might initiate an accident sequence leading to core damage.
The site and its vicinity are reviewed for location and separation distance from industrial, military, and transportation facilities and routes.
Such facilities and routes include air, ground, and water traffic, pipelines, and fixed manufacturing, processing, and storage facilities.
As per Reference 5.3C-1, all off-site hazardous materials sources stored or transported within a 5 mile exclusion radius of the Cook Nuclear Plant will be examined.
Potential danger from both toxic gas plumes, and/or explosion overpressure will be considered.
5.3C.1 Off-Site Hazardous Materials Source Screening The Cook Nuclear Plant receives no hazardous materials via pipeline, air, ship or barge (Reference 5,3C-2). Furthermore,'there are no military installations, missile sites, or industrial facilities located beyond the Cook Nuclear Plant Site boundaries at which an accident might cause interaction with the plant so as to affect public health and safety (Reference 5.3C-3).
Therefore, the only potential source of damage from off-site hazardous materials accidents comes from ground. transportation accidents via road or rail.
An internal calculation performed by American Electric Power Service Corporation (Enclosure 8 of Reference 5.3CA) concludes that the probability of compromising control room habitability via toxic chemical spill from a railway car is less than 1.0E-06 for each chemical meeting the shipment frequency requirements of Reference 5.3C-5.
The sum of all,the probabilities for all chemicals analyzed is 3,10E46.
Reference 5.3CA assumes that chemical spills from railway accidents were bounding over truck accidents.
Reference 5.3CA states that, in general, rail transport is more hazardous than truck transport with respect to the transportation of hazardous materials near nuclear power plants.
Even though Interstate 94, and other smaller roads, are about 2000 feet closer to the Cook Nuclear Plant than the nearest railroad, the volume of chemicals in a single truck shipment is so small in comparison to a railway tank car that the raihvay spill willbound any truck spill.
Reference 5.3C-1 states that "the expected rate of occurrence of potential exposures in excess of the 10 CFR Part 100 guidelines of approximately 10~ per year is acceptable if, when combined with reasonable qualitative arguments,:he realistic probability can shown to be lower."
The above value, 3.10E-06, is considered to be a conservative estimate for the following reasons:
Any releases were considered to be large enough to produce toxic concentrations at a point about 1.25 miles away.
2.
The weight of chemicals relewed was considered to be the entire weight of the car itself and its contents.
3.
Train accident frequencies have shown a downward trend from 1978 to 1986 (Reference 5.3C-7).
4, No credit is taken for air filtration by and/or isolation of the control room ventilation system.
Hence, the Cook Nuclear Plant meets or exceeds the accident probability criteria set in Reference 5.3C-1 with respect to toxic gas spills.
In the event that the accident results in an explosioa, Reference 5,3C4 describes a screening methodology based on the type and quantity of the material as well as the distance from the plant.
5-25
Reference 5.3C-9 enhances the analysis from Reference 5.3C4, In Reference 5.3C-9 both the natural periods and the inelastic response of structures is explicitly considered.
The effects of seismic requirements and quantity of reinforcing steel upon the blast capacity are also considered.
The results of the analyses performed in Reference 5.3C-9 are equations relating the minimum standoff distance from the accident sight with respect to the hazardous material's equivalent TNT yield and static wall capacity of the structures.
The minimum standoff distance R (feet), is predicted by:
R = f (W x p )'+; where, TNT equivalent yield (lbs) for solid explosives, static wall capacity (psi), and factor related to the permissible ductility p as given by:
1.0 87 3.0 54 5.0 51 Reference 5.3C-9 recommends that p be set to 3.0, therefore fz equals 54.
P, for the Cook Nuclear Plant is 3.0 psi, this corresponds to the minimum static lateral load design capacity of walls within tornado Zone I (Reference 5.3C-10).
Setting the distance to the constant R = 5280 feet (1.0 mile), which is a conservative estimate for the perpendicular distance from the Cook Nuclear Plant to the railroad, the maximum TNT equivalent is found to be 8.413 million pounds or about 4207 tons.
The TNT equivalent for fuel-air mixtures is calculated from Reference 5.3C-9 by the equation W = 2 W>', where, W~ = weight of the hydrocarbon fuel (lbs).
Using the above equation, the maximum amount of hydrocarbon fuel at the standoff distance of 5280 feet is about 1275 tons.
Due to insufficient data on hazardous chemical transportation via roadway, the assumption that an analysis on railway transportation will bound a roadway analysis used in Reference 5.3CA will again be used.
A list of the hazardous materials susceptible to explosions is given in Reference 5.3CA. The chemicals are segregated by type, e,g flammable liquids, combustible solids, etc.
From examination of this list of chemicals, it appears that the largest car size is 135 tons.
Hence, no single railway car or tanker accident, whether it involves solid, liquid or gaseous chemicals, poses risk to the Cook Nuclear Plant from explosion overpressure.
In fact, the number of cars or tankers whose contents fully explode would have to be approximately 31 for solid fuels or 9 for liquid or gaseous fuels.
Any combination of the chemical types would therefore involve between 9 and 31 cars and/or tankers.
This estimation is conservative for the following reasons:
The weight of chemicals exploding was considered to be the entire weight of the car itself and its contents.
2, A conservative distance to the plant (1 mile) was used.
5-26
3.
No consideration was made for the terrain, i.e., between the Cook Nuclear Plant and the railroad there exists numerous forest covered dunes which would be expected to temper the effects of the blast.
53C2 Screening Saaunary With respect to toxic chemical release and/or explosion overpressure from either local industrial accidents and/or hazardous materials transportation accidents, the design and location of the Cook Nuclear Plant preclude plant damage leading to core damage and/or radiological release in excess of that allowed by 10 CFR Part 100.
Therefore, further analysis is not required.
52CD Methodology and Analysis N/A 5.3C.4 Results, Recommendations and Conclusions The frequency of plant damage leading to core damage and/or radiological release in excess of that allowed by 10 CFR Part 100 as a result of any off-site hazardous materials accident is conservatively estimated to be less than 1E-7.
Therefore, no design changes related to off-site hazardous materials transportation are currently recommended.
5-27
53'eferences 53C-1 "NRC Standard Review Plan," NUREG-0800, Sections 22.1 - 223, Revision 2, July 1981.
53C-2 Letter from J. B. Kingseed, American Electric Power Service Corporation, to Steve Maher, Westinghouse, dated April 4, 1991.
53C-3 "Donald C. Cook Updated Final Safety Analysis Report," Donald C. Cook Nuclear Plant, American Electric Power Service Corporation, Chapter 2, August 24, 1989.
53C-4 Letter from J, B. Kingseed, American Electric Power Service Corporation, to Steve Maher, Westinghouse, dated May 29, 1990.
53C-5 Regulatory Guide 1.78, "Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release,"
U.S.
Atomic Energy Commission, Directorate of Regulatory Standards, June 1974.
53C-6 D. E. Bennett and D. C. Heath, "Allowable Shipment Frequencies for the Transport of Toxic Gases Near Nuclear Power Plants," NUREG/CR-2650, also SAND82-0774 R-4, October 1982.
53C-7 A. E. Harvey, et. al., "Statistical Trends in Railroad Hazardous Materials Transportation Safety 1978 to 1986," American Association of Railroads, Publication R-640, 1987.
53C-8 Regulatory Guide 1.91, "Evaluations of Explosions Postulated to Occur On Transportation Routes Near Nuclear Power Plants," U.S. Nuclear Regulatory Commission, Office of Standards Development, Revision 1, February 1987.
53C-9 R. P. Kennedy, et. al., "Capacity of Nuclear Power Plant Structures to Resist Blast Loadings," NUREG/CR-2462, also SAND83-1250 R4, RP, September 1983.
53C-10 Regulatory Guide 1.76, "Design Basis Tornado for Nuclear Power Plants," U.S.
Atomic Energy Commission, Directorate of Regulatory Standards, April 1974.
5-28
5.4 OTHERS This section is divided into the following categories:
A. On-Site Hazardous Materials Accidents B. Turbine Missiles C. External Fires The analyses for the above categories are summarized in the following subsections, 5.4A OaSite Hazardous Materials Accidents This section examines potential accidents involving the on-site storage of hazardous materials which might initiate an accident sequence leading to core damage, All hazardous materials stored within the site boundaries were examined.
Potential dangers from both toxic gas plumes, and/or explosion overpressure were considered.
5.4A.1 On-Site Kuardous Materials Source Screening The chemicals stored on-site at the Cook plant (Reference 5,4A-1) and their respective human toxicity limits (Reference 5.4A-2) are listed below.
hemical Toxicit
~m/m/
Ammonia (Ammonium Hydroxide) 29% solution 70.0 Chlorine (gas)
Hydrazine (35% solution)
Sulfuric Acid 45,0 1.3 2.0 Table 5,4A-1 lists the subject materials and their respective locations (References 5.4A-1, 5.4A-3, and 5.4A-4). Analyses were performed to calculate the maximum control room concentrations given an accident involving these materials (References 5.4A-5 and 5.4A-6). The analyses considered the consequences of a rupture of the single largest container and the largest container of the most concentrated solution of these chemicals in their respective locations, their dispersion and subsequent build-up in the control room ventilation system. (The analysis for the hydrazine case simply assumed two 55 gallon drums of hydrazine spilled in the Auxiliary Chemical Feed Gallery since this case bounded all others.)
The amounts of each chemical analyzed for spill and the respective distance from the control room intake (Reference 5.4AM) are also listed in Table 5.4A-1. The results in terms of Peak Control Room Concentration (P~) of the spilled chemicals are given in Table 5.4A-2. Although a hydrazine spill would result in control room concentrations exceeding the toxic limit (Reference 5.4A+, none of the chemicals present any hazard to plant safety.
(This toxic limitfor hydrazine is based on long term exposure that may increase one's risk of cancer.
Exceeding this limitwillnot incapacitate the control room personnel, nor force a reactor shutdown.)
The time required to reach the toxicity limits (t<) and the Peak Control Room Concentration (tz) once the initial puff has reached the control room intake are indicated in Table 5.4A-2.
Since the main concern associated with such a chemical spill is with the control room personnel being able to perform their function, the ability of the control room HVAC to protect them from such conditions plays an important role in minimizing the effects of a spill. Normally the control room HVAC system 5-29
draws outside air through filters and past chillers/heaters to provide fresh air for the control room personnel.
In the event of a chemical spill, the control room HVAC system can be placed in the recirculation mode to minimize the amount of outside air entering the control room.
The control room is designed such that isolation damper HV-ACRDA-1 can be manually dosed from the VS panel, Damper HV-ACRDAAdoses simultaneously with HV-ACRDA-1, thus isolating the control room. In the event of a nearby toxic gas release, these dampers are closed while the Control Room HVAC system continues to operate, thus limiting the quantity of outdoor air entering the control room.
The control mvitch for damper HV-ACRDA-3on the local panel is normally maintained in the "dosed" position which means that the damper is in a preset partially-open position.
In the event of a toxic gas release, the control room control mvitch shall be moved from the "ISOLATE" position to the "LOCAL"position which will close the damper.
The pressurizer/cleanup filter unit is not operated (Reference 5.4A-7).
Once the control room is isolated, there is additional time available to clean the spill. Procedure 12 THP 6020 LAB.133 "Actions Taken for Hydrazine Spill or Leak" (Reference 5.4A-S) describes the cleanup procedures for a hydrazine spill or leak.
Should the operators fail to isolate the control room, the control room is equipped with MSA air packs, each of which has a capacity of approximately 30 minutes (Reference 5.4A-3). Multiple air tanks are stored immediately outside the control room. Ifadditional time is needed by the wearer of the air pack, an exhausted tank can be quickly replaced provided that the additional tanks have not been used by individuals working outside the control room. (It is likely that any spilled material that would make the control room uninhabitable would make the rest of the plant uninhabitable also. It is expected that personnel from the rest of the plant would make use of any available air packs and the additional tanks.) (Reference 5.4A-10) 5 4A.2 Results, Conclusions, and Recommendations This analysis indicates that the hazardous materials stored within the site boundaries of Cook Nuclear Plant present no threat to plant safety.
While a hydrazine spill might result in a control room concentration that exceeds the human toxicity limit, the control room operators would not be incapacitated by the calculated concentrations, and would not be forced to trip the reactor.
The preliminary results of this analysis were used to make modifications to the Seismic Procedures (Reference 5.4A-9) such that, in the event of an earthquake that might result in a hydrazine tank falling over and rupturing, the control room operators are now instructed to place the Control Room HVAC system into isolation mode before any other action is taken.
This protects the operators from any possible hazardous chemical spill while they are following the remaining steps of the procedure, and until such time that they can determine if a hazardous chemical spill has occurred.
5-30
5AA3 References 5.4A-1 Letter from J.P, Carlson to J. Russell Sharpe, January 3, 1991.
5.4A-2 "Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External Events",
NUREG/CR4550, Vol3, Rev. 1, Part 3.
5.4A-3 5.4AM Telec'on between John Carlson (Cook Plant) and T. D. Taulbee, May 29, 1991.
'Plot Plan, Donald C, Cook, American Electric Power, Drawing No. 12-5160-10.
5.4A-5 AEP:NS&L Calculation CA-91-02, "Calculation of Control Room Habitability from an Onsite Release of a Hazardous Material,"
5 4A.6 AEP:NS&L Calculation CA-91-04, "Calculation of Control Room Habitability from an Onsite Release of a Hazardous Materiah" 5.4A-7 Control Room Ventilation System Description, SD-DCC-HV110 Rev. 8, September 7,
1990.
5.4A-8 D. C. Cook Procedure 12-THP-6020.LAB.133, "Actions taken for a Hydrazine Leak or Spill."
5 4A-9 D. C. Cook Procedure 12-THP-4023.001.012, Revision 2, "Earthquake."
5.4A-10 Tclecon between I.D. Fleebvood (Cook Plant) and J.R. Sharpe, December 13, 1991,
/
5-31
Table 5.4A-1 Cook Chemical Source Quantities and Locations Chemical Quantity Assumed
/piloted Distance from
~lntak
~L>~ti n Chlorine (gas) 55 gal ~
(150 lbs.)
Ammonia (Ammonium 177 gal.
Hydroxide) 29%
solution 1100 A.
525 A.
Unit 1 & 2 Auxiliary Chemical Feed Gallery elevation 580'utside NE of Control Room Intake Warehouse h'3 elevation 608'utside, SSE of Intake, Chlorine House elevation 608'ydrazine (35%
solution) 22.58 gal.
110 gal. (2X55) 66,67 gal.
55 gal.
66.67 gal.
55 gal.
55 gal.
178 A.
187 A.
1100 ft.
Unit 1 A 2 Auxiliary Chemical Feed Gallery elevation 580'nit 1 Condensate Chemical Feed Gallery elevation 587'nit 2 Condensate Chemical Feed Gallery elevation 587'utside, NE of Control Room Intake, Warehouse P3 elevation 608'ulfuric Acid 10,000 gal.
257 ft.
Storage Tank (west of plant Turbine Building) 5-32
Table 5.4A-2 Peak Control Room Concentrations Hazardous Material
~AL cation Amount Spilled
- goal, P3 tt
~m/ma Qa Ammonia Aux. Chemical Feed Gallery Warehouse b'3 177.42 55.0 35 133 4eee0 0.2868 193 2892 Chlorine
~ Chlorine House Hydrazum Aux, Chemical Feed Gallery Sulfuric Acid Storage Tank 150 lb.
110.0 (2X55) 10,000 2.222 1,48 1.126 3374 2325 15425 86300 Ps - Peak Control Room Concentration t> - Time Toxicity Limitis exceeded t2 - Time of Peak Control Room Concentration 5-33
5.4B Turbine Missiles This section examines potential Turbine Missiles that might initiate an accident sequence leading to core damage.
The two potential sources are the Unit 1 General Electric turbine and the Unit 2 Brown-Boveri turbine (Reference 5.4B-1).
5.4B.1 Turbine Missile Accident Screening The probability of serious damage from turbine missiles to a specific system in the plant is calculated as (Reference 5.48-2):
where Pp = Pt Pp Ps P> =
probability of turbine failure leading to missile generation P>
probability of missiles striking a barrier which encloses the safety system given that the missile(s) have been generated P> =
probability of unacceptable damage to the system given that one or more missiles strike the barrier Pl in the past generally has had a conservative value of 10+, which has been based on the historical fa~ilure rate (Reference 5.48-2).
According to NUREG-1068:
This logic places the regulatory emphasis on the strike probability. That is, having established an individual plant safety objective of about 10 7 per year, or less, for the probability of unacceptable damage to safety-related systems as a result of turbine missiles, this procedure requires that P> P~ be less than or equal to 10 (Reference 5.48-3).
NUREG-1068 also describes the current NRC position on calculating the probability of turbine missile damage.
Because of the uncertainties involved in calculating P~, the NRC staff concludes that P>
analyses are "ball park" or "order of magnitude" type calculations only.
Based on simple estimates for a variety of plant layouts, the NRC staff further concludes that the strike and damage probability product can be reasonably taken to fall in a characteristic narrow range that is dependent on the gross features of turbine-generator orientation because (1) for favorably oriented turbine generators, P>P~ tend to lie on the range 10 to 10, and (2) for unfavorably oriented turbine generators, P>P~ tend to lie in the range 10 to 10
. For these reasons (and because of weak data, controversial assumptions, and modeling difficulties), in the evaluation of P~, the NRC staff gives credit for the product of the strike and damage probabilities of 10 for an unfavorably oriented turbine, and does not encourage calculations of them.
In the opinion of the NRC staff, these values represent where P>P> lie, based on calculations done by the NRC staff and others.
It is the view of the NRC staff that the NRC safety objective with regard to turbine missiles is best expressed in terms of criterion applied to the missile generation frequency which requires the demonstrated value of turbine missile generation frequency (Pt) be less that 10 for initial startup and that corrective action be taken to return Pt to this value ifit should become greater than 10 s during operation (Reference 5.4B-3).
5-34
5.4B.2 Turbine Missile Screening Summary In December 1979, the NRC Office of Inspection and Enforcement issued Information Notice No. 79-37 that discussed the discovery of cracks in the keyway and bore sections of discs in Westinghouse low-pressure turbines (Reference 5.4BA). These turbines were manufactured using the method of shrunken discs.
The General Electric turbines were also manufactured using this same method.
5.4B.2.1 General Electric Turbine As a result of the Information Notice, regular ultrasonic tests have been and are continually being conducted on a regular schedule for the Unit 1 General Electric turbine (Reference 5,4B-5).
The objective of these inspections is to a) ensure that the probability of turbine missile failure resulting in the ejection of turbine disc fragments through the turbine casing is 10 s or less, b) determine the time interval for the next inspection based on crack propagation (Reference 5.48-6).
5.4B.2.2 Brown-Boveri Turbine The Brown-Boveri (Unit 2) turbine was manufactured using the method of welded discs (Reference 5.4B-1),
According to a BBC Brown, Boveri A Company, Ltd. paper, The welded rotor consists of separate small forgings welded. together to form an integral rotor. The welds are positioned at the circumference where the centrifugal stresses are
- smallest, For the welded rotor, the discussion of a failure due to stress corrosion cracking is purely hypothetical because there are no indications of stress corrosion cracks found to date.
Nevertheless, BBC performed a case study comparing the shrunken disk turbines to the welded rotor turbines (Reference 5,4B-7).
In this case study, it is assumed that in both turbine generators gne disk is affected by stress corrosion cracking and the corresponding disk fragment will perforate the casing.
This is very conservative since no stress corrosion cracks have been found to date.
According to this study, the welded rotor turbine out performed the shrunken disk turbine, and BBC cited the following remons:
(1)
The lower net stress, leading to a critical crack size which is eight times greater than that of the shrunken disk type.
(2)
The lower yield strength of the employed material leads to a calculated crack growth rate which is only one half that for the shrunken disk rotor material.
BBC introduced the following inspection intervals for unfavorably oriented turbines.
Welded Rotor Shrunken disks 22 years 1-5 years At present, the D, C. Cook Unit turbine has been in service for approximately 12 years, which is well below the recommended inspection interval for welded rotor turbines.
From a graph given by BBC, the failure probability P~ is estimated to be in the 10 range (Appendix 3.7).
5-35
Since no stress corrosion cracks have been found and the probability of turbine missile generation is order of magnitudes lower for the welded rotor turbines than the shrunken disk turbines, the Brown Boveri &
Company turbine (Unit 2) has been screened out of this analysis.
5.4BB Methodology and Analysis Presently the ultrasonic testing and analyses are performed by-General Electric for the Unit 1 Turbine.
During the Unit 1 outage in November 1990, an inspection was performed on the shrunk-on wheels of the Low Pressure Turbine rotor for the Unit 1 turbine.
The inspection included a surface visual examination, an ultrasonic examination of the tangential entry dovetails and the last stage bucket dovetail outside fingers, an ultrasonic examination of the dovetail pins, a magnetic particle inspection of the exterior wheel
- surfaces, and an ultrasonic examination of the wheelbores and keyways (Reference 5.4B-7).
From this inspection, it was determined that the annual probability of turbine failure resulting in the ejection of turbine disc fragments through the turbine casing was 1.6x10~ (Reference 5.4B-7).
Cook Nuclear Plant has an unfavorably oriented turbine arrangement (Reference 5.4B-8), therefore, for the calculation of P< a value of lx10 will be used for PzPs (Reference 5.4B-3).
This results in the overall probability of turbine, missiles causing unacceptable damage to safety related systems of 1.6x10 per year.
5.4B.4 Results, Recommendations and Conclusions In the early days of commercial nuclear power, it was believed that turbine missile probability was dominated by turbine overspeed events.
While it still holds true that turbine overspeed would certainly result in turbine missiles, the most dominant contributor to turbine missile hazard is now believed to lie with the normal wear and tear on the turbine.
Programs have thus been instituted to monitor the damage caused by continuous usage and to assess the effects of such usage.
Such a program currently exist within AEPSC for both Cook Nuclear Plant turbines.
The results of the Cook PRA Turbine Missile Analysis is based primarily on the results of these ongoing programs.
Additionally, after the turbine missile event at Salem Nuclear Plant in 1991, AEPSC performed an analysis comparing and contrasting the overspeed protection methods employed by Salem and Cook Nuclear Plants (Reference 5.4B-9). It was concluded that Cook Nuclear Plant was not susceptible to the same failure modes encountered by Salem Nuclear Plant, and that the turbine program currently in place at AEPSC is effective in maintaining a sufficiently low likelihood of turbine missile hazard.
Due to the low frequency of turbine-induced missile events, it is concluded that the contribution to plant risk from turbine missiles from either Unit 1 or 2 is negligible.
The Turbine Missile inspection procedures instituted in the Cook Nuclear Plant are consistent with current guidelines to insure and maintain a very low risk contribution.
5.4B.5 References 5.4B-1 "Donald C. Cook Updated Final Safety Analysis Report,"
Donald C. Cook Nuclear Plant, American Electric Power Service Corporation, Chapter 14.1.13 Turbine Generator Safety Analysis, July 1990.
5.4B-2 "Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External Events,"
'UREG/CR-4550, Vol. 3, Rev. 1, Part 3, November 1990.
5.4B-3 "Review Insights on the Probabilistic Risk Assessment for the Limerick Generating Station,"
NUREG-1068, August 1984.
5-36
5.4BQ Letter from A. Schwencer (NRC) to John Dolan (Indiana and Michigan Electric Company),
Docket No. 50-315, dated April 29, 1980.
5.4B-5 Donald C, Cook Procedure 1-SHP.5050.NDE.004, Revision 0.
5.4B-6 5.4B-7 Interview with J. D. Benes by T. D. Taulbee on May 2, 1991.
General Electric Power Generation Report to Indiana k Michigan Electric (AEP), dated December 3, 1990.
5.4B-8 Plant Arrangement Turbine Building Main Floor Elev. 633'-0" Units No. 1 and 2, Donald C. Cook, American Electric Power, Drawing No. 12-5169-10.
5.4B-9 AEP:NRC:9972, Non-Submittal Packet for NRC Information Notice 91-83, "Solenoid Operator Valve Failure Resulted in Turbine Overspeed", September 20, 1991 5.4C External Pres This section examines the potential that external fires might initiate an accident sequence leading to core damage.
The two potential results of an external fire are loss of offsite power and control room inhabitability.
5AC.1 Possible Sources of Extenml Hres ScreeIung The two possible sources of external fires are human induced and localized weather induced fires that have the potential of causing a forest fire, A review of the plant layout and aerial photographs of the plant site shows that a forest fire to the North, East, or South of the plant coincident with proper wind condi4ons (ie. allowing the fire to spread) has the potential cause a loss of offsite power event or cause the control room to become uninhabitable (References 5.4C-1 and 5.4C-2).
5.4C.1.1 Loss of Offsite Power From review of the plant layout and aerial photographs of the plant site, assuming a random inability to crosstie the opposite unit's power supply, a Unit 1 loss of offsite power would result from a forest fire destroying the 69 kV line and the 345 kV switchyard, and a Unit 2 loss of offsite power would result from the loss of the 69 kV line and the 765 kV switchyard (References 5.4C-I and 5.4C-2).
For a dual unit loss of offsite power initiating event, a fire would have to destroy the 69 kV line, the 345 kV avitchyard, and, the 765 kV switchyard.
The two switchyards are constructed such that there is a clearing of approximately 50 ft of gravel and stone around each avitchyard, therefore, no fallen trees could render equipment inoperable.
The only possible result could be hardware failures due to fire debris (cinders) or the intense heat associated with the fire. This type of event has been analyzed separately in the Initiating Events Notebook (Reference 5,4C-3).
5.4C.1.2 Control Room Habitability Smoke in the control'room would not render equipment inoperable and, therefore, would not cause an automatic reactor trip. Should a reactor trip occur coincident with a'major external fire, the control room is equipped with a filtration system which will remove a portion of the particulates from the air.
A major concern resulting from an external fire with regard to control room habitability is the existence of carbon monoxide (CO) and carbon dioxide (CO>).
Due to the unpredictability of the amounts of CO
'nd CO> released during a major fire, as well as the effects of intense heat on the local meteorological dispersion, emphasis in this analysis was be placed on the defensive measures available to the operator to prevent incapacitation.
5-37
Since the main concern associated i~ith such a fire is with the control room personnel being able to perform their function, the ability of the control room HVAC to protect them from'such conditions plays an important role in minimizing the effects of a forest fire. Normally the control room HVAC system draws outside air through filters and past chillers/heaters to provide fresh air for the control room personnel, In the event of such a forest fire, the control room HVAC system can be placed in the recirculation mode to minimize the amount of outside air entering the control room. The control room is designed such that isolation damper HV-ACRDA-1 can be manually dosed from the VS panel.
Damper HV-ACRDA-4closes simultaneously with HV-ACRDA-1, thus isolating the control room.
In the event of a nearby toxic gas release, these dampers are closed while the Control Room HVAC system continues to operate, thus limiting the quantity of outdoor air entering the control room. The control switch for damper HV-ACRDA-3 on the local panel is normally maintained in the "closed" position which means that the damper is in a preset partiallywpen position.
In the event of a toxic gas release, the control room control switch shall be moved from the "ISOLATE" position to the "LOCAL"position which will close the damper.
The pressurization/cleanup filter unit is not operated (Reference 5 4C-4).
According to Plant Procedure PAIP 2080 EPP.110 (Reference 5.4C-5), the Shift Supervisor/Site Emergency Coordinator directs control room operators to close or verify closed all of these dampers. Ifthe operators fail to isolate the control room and the high toxicity limits of CO and CO> (1100 mg/m and 1840 mg/m, respectively) (Reference 5.4C-6) are reached, the control room is equipped with MSA air packs, each of which has an air capacity of approximately 30 minutes (Reference 5.4C-7).
5.4C.2 Source Screening Since the Cook Plant site has been in operation there has been only one case of an external fire that could potentially cause a forest fire. The fire occurred when an old cabin on the plant property caught on tire and burned down (cause of the fire is unknown).
The fire was reported by security personnel.
YVhen the Fire Brigade arrived on the scene the fire was spreading, but the fire was contained and extinguished well before it became a threat to the plant (Reference 5.4C-8).
5.4C9 Methodology and Analysis No probabilities were calculated, 5.4C.4 Results, Conclusions, and Recommendations Two scenarios involving external fires were identified that could potentially have an impact on plant operation:
- 1) a forest fire causing a loss of offsite power by destroying the 345kV/765kV switchyards and the 69 kV offsite power line, and 2) smoke from a forest fire causing the control room to become uninhabitable.
These two external fire scenarios were screened out of this analysis due to low likelihood and small probabilities of adverse effects.
The loss of offsite power scenario has been analyzed in the Initiating Events Notebook (Reference 5.4C-3).
The control room habitability scenario is not considered a
problem because the resultant toxic gases will not cause an equipment failure or a reactor trip and because control room personnel would be notified almost immediately of a major fire by the security patrols. If the wind was blowing smoke towards the control room ventilation intakes and threatening the control room habitability, the control room HVAC would be placed in recirculation mode (isolation) (Reference 5.4C-9).
The minimal impacts of these two scenarios leads to the conclusion that no plant damage leading to core damage or radiological release can be expected as a result of an external fire.
Although Cook Nuclear Plant personnel have indicated that the control room would be placed in isolation mode, current plant procedures omit the possible results that major external fires might have on control room habitability should the fire not be extinguished in a timely manner, and the control room has not been isolated.
Therefore, it is recommended that current procedures be enhanced to instruct the operator to place the control room HVAC in the isolation mode in the event of an external fire whose smoke is blowing towards the plant.
5-38
5.4C.5 References
~
~
5.4C-1 5.4C-2 Plot Plan, Donald C. Cook, American Electric Power, Drawing No. 12-5160-10.
765/345 kV Location Plan, Donald C. Cook, American Electric Power, Drawing No. E-42373-1001.
5.4C-3 5.4C-4 Initiating Event Notebook, Donald C. Cook Nuclear Plant PRA, Revision 0.
System Description, Control Room Ventilation System, SD-DCC-HV110 Rev, 8, September 7, 1990.
5.4C-5 5.4C-6 Plant Procedure, PiWIP 2080.EPP.110 Rev 0, January 6, 1987.
'I
(
"Assumptions for evaluating the habitability of a nuclear power plant control room during a postulated hazardous'chemical release", Regulatory Guide 1.78, Table C-l, June 1974.
5,4C-7 5.4C-8 5.4C-9 Telecon between J. P. Carlson (Cook Plant) and T. D. Taulbee, May 29, 1991.
American Electric Power System Fire Report, Donald C. Cook, May 10, 1986.
Telecon between B. D. McLean and T. D. Taulbee, May 28, 1991.
5-39
k 1
0
6.0 LICENSEE PARTICIPATIONAND INTERNALREVIEWTEAM
'A IPEEE Program Oqpnizatlon AEPSC has committed substantial personnel and financial resources to its IPEEE program.
Due to the magnitude of the Cook Nuclear Plant IPEEE Program, AEPSC engaged the Individual Plant Evaluation Partnership (IPEP) and consultants (namely Westinghouse, Paul C. Rizzo Associates and EQE Engineering) to support and direct efforts on the IPEEE.
AEPSC created a Cook Nuclear Plant IPEEE Team (drawn from the internal events PRA team) which effectively utilized its personnel resources and provided AEPSC with complete control and involvement in the IPEEE analyses.
In the organization structure, IPEP personnel provided the overall task leadership while both the IPEP team and the AEPSC team jointlyperformed all the analyses.
Interactions between AEPSC personnel and the IPEP team were conducted on a continual basis and intensively at each step to resolve issues and incorporate plant specific knowledge.
In addition to the IPEEE personnel, other AEPSC engineering and support staff provided design and operational information at the direction of the program coordinator.
Figure 6.1-1 depicts the overall organizational structure for the AEPSC Cook Nuclear Plant IPEEE program.
As shown, AEPSC established an IPEEE Project Coordinator who was responsible for the overall performance of the IPE project and served as the primary point of contact for the Cook Nuclear Plant IPEEE. For the Cook Nuclear Plant IPEEE, an Independent Review Team (IRT) of AEPSC middle level management actively reviewed all results and insights. For the seismic analysis, the IRT appointed a
consultant, Stevenson & Associates, to review the component fragility analysis for accuracy.
The IRT was briefed on the seismic analysis and results.
The AEPSC team members were trained and involved in all aspects of the IPEEE project. This included taking part in the IPEEE plant walkdowns, becoming familiar with IPEP and consultant activities (i.e.
analyses performed by Westinghouse and consultants) and authoring/reviewing sections of the various IPEEE analyses.
k The IPEP organization (through Westinghouse) supported AEPSC in the Cook Nuclear Plant IPEEE project mth a core of experienced IPEEE personnel, led by a Technical Project Manager.
The technical project manager was responsible to the AEPSC Project Coordinator for directing and coordinating project activities and maintaining the project schedule and budget.
The project manager was the primary interface between the IPEP team and the AEPSC IPEEE Project Coordinator.
In summary form, the folloi>ing describes the task-by-task participation of the AEPSC IPEEE team engineers in the development of the Cook Nuclear Plant IPEEE:
Data Collection and Analysis - AEPSC engineers took part in the external events field walkdowns, which collected data, and authored, reviewed or became familiar with the efforts taken to analyze this data.
Initiating Event Analysis, Event Tree Analysis and Systems Analysis - AEPSC engineers reviewed the development of these analyses, which were performed by Westinghouse.
The external events event trees and system fault trees were modified as necessary for the IPEEE from the internal events event/system logic trees.
System Interactions - AEPSC engineers took part in the external events field walkdowns which, in addition to collecting data, looked for system interaction effects in IPEEE modeled components.
Fault Tree and Accident Sequence Quantification/Engineering Evaluation - AEPSC engineers reviewed or authored sections of the various IPEEE quantification/evaluation processes.
Training and Technology Transfer - Training was conducted by contractor employees for utilitypersonnel to provide the in-house ability to understand, evaluate, modify, and update the IPEEE to reflect proposed 6-1
ol actual changes ln the plant design, operation or to account for future Industry updates impacting external event analyses, 62 Composition of Independent Review Team Although the Cook Nuclear Plant IPEEE program was performed to satisfy the requirements of 10CFR50 Appendix B, an additional Independent Review Team (IRT) was organized to review the various IPEEE analyses.
This team generally consisted of middle level managers from applicable engineering and operations organizations as indicated ln Table 62-1. The IRT conducted formal meetings to review, comment on and approve all aspects of the IPEEE analyses.
As stated earlier, the IRT (for the seismic analysis) appointed Stevenson & Associates to review the component fragility analysis for accuracy';
63 Areas of Review, Major Comments, and Resolution of Comments All areas of the Cook Nuclear Plant IPEEE were subject to independent review through either the 10CFR50 Appendix B process, the IRT or through consultant support. AEPSC engineers were directly involved in a majority of th'e analysis or review tasks associated with the IPEEE. This approach assured AEPSC involvement in the IPEEE.
Although consultants did solely develop and review certain inputs to the IPEEE (such as the site specific seismic hazard curves developed by Paul C. Rizzo Associates), AEPSC engineers became familiar with these efforts and ensured that the IPEEE properly employed these inputs.
All comments w'ere either for'mally documented or addressed and resolved'through phone conversafions.
Any remaining resolution items were disposed through immediate changes to the IPEEE models ifthe effects were anticipated to be significant to the results.
One major comment was received.
It is summarized with its'esolution below.
Comment (from EQE, International)
"... the assignment of variability to the median value of the fragility description differs considerably from the industry standard.....
The net eA'ect is that the HCLPF value and calculated'risk'are optimistic."
r
~Re ice (provided by YVestinghouse, the analyst for this topic)
"It is noted that the approach taken to define the seismic fragility data was based on calculating lower bound median and high confidence of low probability of failure (HCLPF) values.
This resulted in using lower standard deviation values than normally given for fragility data and was so noted by one of the reviewers, An evaluation of this difference was undertaken and it was found that the results of the seismic PRA are conservative and the dominant contributors will not change due to larger variations (standard deviations)."
6.4 Living IPEEE Program The Cook Nuclear Plant IPEEE is designed to be periodically updated over the remaining lifetime of the plant by utilityrisk assessment and engineering personnel.
The living IPEEE program willappropriately address external event impacts on plant design and operations.
6-2
TABLE6.2-1 INDEPENDENT REVIEWTEAMREPRESENTATION De rtment r Divi ion.
Cook Nuclear Plant Operations p
Design Division Supervisor S
Manager, Structural A Analytical Design Nuclear Section Nuclear Engineering Division
-Electrical i Manager, Instrumentation A Control
-Mechanical Manager, Technical Support Nuclear Operations Division l
Group Manager, Safety, Licensing, 8c Ass~ment Quality Assurance Consulting Engineer Manager, QA Engineering Note:
The committee voted to have Steyenson & Associates review the seismic analyses as an independent expert in lieu of the committee's review.
6-3
AHVSC IPEEH PROJECT COORDINATOR II'EP IPEEE THCIINICAL PROJECT hlANAGER AEPSC IPEHE TEAM II'EP II'HEE TEAhl INTI IINAL Fll(I',
SEI'HMIC 01'IIEll EXTI;RNAI.
EVFN rS I"igI.I~e 0.1-1 Coolc Nuclenr I'lant.-lPL'L'E I'> ojec,t Orgariization--
7.0 PLANT IMPROMMENrS AND UNIQUE SAFEFY $ZATUMB While no moor plant changes have been deemed necessary based on the results of the Cook Nuclear Hant IPEEE, some potential procedural changes and minor equipment enhancements have resulted from this study. These are indicated below.
S~ei mie Plant walkdowns conducted at Cook Nudear Plant Units 1 and 2 looked at components and structures within both containment buildings, the Auxiliary and Turbine Buildings, the Screen House and the grounds immediately surrounding the plant site. All findings noted in the walkdowns have either been inco'rporated into the component fragility analysis, administratively addressed, fixed at Cook Nuclear Plant'or placed into action item tracking status awaiting disposition, No Cook Nuclear Plant specifi.safety features (beyond features standard to Westinghouse PWRs) were noted from the seismic IPEEE.
Cook'Nuclear Hant's investment in compliance with the 10CFR50 Appendix R requirements was found to be th'e most significant safety feature concerning fire vulnerabilities.
The modifications to the plant equipment and procedures due to these requirements have a major influence on.,the insignificant contribution of internal fire to overall core melt frequency.
Hi h Winds Floods and Othe 1
1 e
The risk associated with external events other than seismic and internal fires was found to be'insignificant due t6 thi. general design basis of Cook Nuclear Plant.
One change identified due to this analysis was in
'he area of on-site hazardous materials.
Hydrazine is stored on-site in various locations at Cook Nuclear Plant; Concerns regarding the effects of a spilled container of hydrazine on control room habitability'.',
arose during the course of the analysis.
Internal calculations proved that such a spill would not result in sufficient concentrations of hydrazine vapor in the control room to cause inhabitability. However, since the most likely incidence of an undetected spill of hydrazine would be due to a seismic event, the earthquake procedure was,modified as a precaution to instruct the operator to isolate the control room HVAC following an earthquake until it can be verified that no hydrazine spill has occurred.
Another recommended change, somewhat related to the one just discussed, involves developing a procedure to instruct the operator to isolate the control room ifsmoke from an external fire is affecting control room habitability. This is already an accepted practice at Cook Nuclear Hant, however, the activity is not presently proceduralized.
7-1
I N,
'I II
~
- II
- v
'H 5
8.0
SUMMARY
AND CONCLUSIONS AEPSC has performed a complete IPEEE induding all credible external events at Cook Nudear Plant.
This study was performed using a seismic and fire PRA with a fault tree linking methodology and a basic screening approach for other external events which meets the intent of NUREG-1407.
The Cook Nudear plant IPEEE documented the computer models and the results of the analysis which together meet the requirements of 10CFR50 Appendix B. While the Individual Plant Evaluation Partnership (IPEP) was contracted for the Cook Nuclear Hant IPEEE, AEPSC personnel were involved to a great degree in every aspect of this analysis through either detailed review of contract work or actual performance of the analysis.
The contract with IPEP indudes a complete transfer of technology upon their completion of services.
This technology transfer allows AEPSC to biannually update the Cook Nudear Plant PRA in-house with minimal additional contract work.
<mimi The seismic IPEEE was a Level I effort with a qualitative containment performance analysis. A seismic PRA (SPRA) approach using guidance described in NUREG/CR-4840, "Procedures for the External Event Core Damage Frequency Analysis for NUREG-1150" and NUREG/CR4550, Vol. 3, Rev. 1, Part 3, "
Analysis of Core Damage Frequency: Surry Power Station, Unit 1 External. Events" was selected for Cook Nuclear Plant.
Since EPRI seismic hazard curves do not exist for Cook Nudear Plant, site specific seismic hazard curves were developed for the SPRA in order to provide a second set of hazard curves for this analysis. In keeping with the requirements of %KEG-1407, both plant specific seismic hazard curves and hazard curves developed by the Lawrence Livermore National Laboratory (LL'NL)were used in the analysis. Plant walkdowns provided field information for a component fragility analysis, which the SPRA utilized.
In general, no signiticant seismic concerns were discovered during the seismic IPEEE.
Overall, the following conclusions were reached:
1.
Core damage frequency based upon the Cook Nuclear Hant site specific seismic hazard curve is 1.83E-05, whereas core damage frequency based upon the LLNLseismic hazard curve is 3.07E44.
This is due to the larger seismic frequencies of exceedance associated with the LLNLhazard curves.
and Z. Rankings of the dominant contributors to seismic core damage frequency remain the same regardless of which seismic hazard curve the component fragilities are based on.
The initiating events which dominate the analysis are:
1.
Steamline/Feedline Break 3.
Loss of Service Water System The dominant contributors to seismic core damage are:
1.
Loss of Electric Power Systems a.
600 VAC Transformers b.
Diesel Generator Fuel Oil Day Tank
- 2. Auxiliary Building seismic failure 8-1
These contributors become significant after the Cook Nuclear Plant 0.2g design basis earthquake criteria is exceeded.
Seismic Containment Performance Summary:
M According to,the fragility data, seismic failure of the containment building may occur due to the following causes; failure of the containment rebar or failure due to soil pressures.
Of these "two failure mechanisms, the soil pressure dominates.
Seismic containment damage for all the seismic intervals evaluated jn the SPRA is calculated to be 2.02E47/yr which contributes approximately 1% to the total seismic cor'e damage frequency.
However, this value represents seismic containment failure and not a containmenf failure probability after containment is challenged, following an accident.
A seismic Level II containment performance is not,required for the IPEEE (GL 8840 Supplement'4), but containment
'erformance was assessed by reviewing the seismic core dapnage sequences and, b'ased on the progr~>on of these sequences, making comparisons to the Level II internal events containment performance an'alysis, As an example, some of the results of seismic assessment include the following:
" 1*
l.
A certain number of the most damaging seismic sequences involved a loss of decay heat removal (Emergency Core Cooling System (ECCS) or auxiliary feedwater to the steam generators) in conjunction with a failure of the containment spray system.
Based upon the internal everits IPE Level II results, core damage, in general, is expected to occur in the range of 2-to-4 hours after accident initiation ifdecay heat removal is lost.
Containment spray failure greatly leduces the availppility of water cooling on the failed core in the containment reactor cavity after vessel failure. IVith less water in the cavity, cpntainment pressurizes at a much>lower rate due.to less steaming from the faileg core and containment failure occurs much later in the accident. Again, this is a comparison to
- Level 0 accident progression.
2.
='Other seismic quantification sequences failed due to ice condenser failure, wgch was specifically'odeled.
The ice condenser was not modeled within the internal e'vents analysis due to its high availability, thus no analogies can be drawn.
However, with Cook Nuclear Plant being an ice condenseI containment plant, chances of cpntainrpent failure following an accident significantly
'increase after losing the ice condenser and containment, failure could occur sooner in accident progression.
After containment failure, anywater inside containment may boil off, thereby preventing ECCS from removing decay heat via recirculation mode, wluch would lead'to core damage, Although the seismic failure of the ice condenser contributed to the total seismic core damage frequency, it was a much lower contributor than those items identified above.
3.
For the SPRA, containment bypass was assumed if the Reactor Prqtection System/Engineered Safety Features Actuation System (RPS/ESFAS) fails (e.gsignals fail to isolate the containment).
The SPRA does not differentiate between signals for containment isola<ion and signals for ESFQ(
- actuation, thus, the quantified results were conservative.
E'en with this conservatism,.RPS'ailure contribution to the total seismic core damage f'requency was=)ess than 1%.
As part of the seismic containment walkdowns, containment rnechqnical peqe~tions and the containment isolation valves were analyzed for the qpility to withstand seismic, events, The penetratlons an)isolation valves. from both, inside and outside of containment were analyzed.
BaSed upon these plant walkhownsno signifi'cant seismic, hazards were found to exist and it was determined that these components possess a high capability to withstand seismic events, Additionally, the hydrogen igniters were found to be very rugged seismically and were screened out of the evaluation process (electrical power to the igniters was evaluated).
P I
The soil I1quefaction potential at Cook Nuclear Hant was evaluated for the Containmerit Buildings at both Units 1 and 2 as we'll asthe common Auxiliary Building, Based on the evaluati9n performed, there is no potential for soil liquefaction at Cook Nuclear Plant that would affect the structural integrity of the Containment Buildings and the Auxiliary Building. This finding is consistent with the soil studies previously performed and reported in the Cook Nuclear Hant UFSAR.
8-2
The relay chatter issue involved interfacing with the USI A-46 proton "Verification of Seismic Adequacy of Equipment in Operating Hants" at Cook Nudear Hant.
USI A-46 "bad actors" relays identified as ~-
part of the AW program were also found within systems modeled for the SPRA.
Plans have been developed to replace AMrelays at Cook Nudear Plant which affect operability of 'safety rela>>ted
'quipment.
Even, though a more. complete search for chatter-prone relays affecti~.SPRA systems is still.
in progress relay chatter is not considered to be'a problem at Cook Nudear Plant'since a* v'ast majority of the USI A-46 systems are also modeled within the SPRA.
>>~
c k
Fire The internal, fire,core darrlage frequericy.'for'C(haik'Nudear Hant is'1.65E-07/year and is dominated by a fire,in,,the Engin'eered,Safety System" arid Motrir",Control Center Room causing"a "Loss of a Siiigle TMin'f 250 V DC Power.
This room houses 4KV/600V transformers, 600 V AC buses, a'nd seve'ral'motor control ceriters.
The dominant contributors to.'cor'e'melt are failures of electric powei buses and rnotorco'ntrol centers that are destroyed by'thh'fire, 'The contribution to core damage'requency is:considered to be low, andi therefore, not a significant c'oncern.
Po additional contaiiunent failure modes uriique to intern'al fires were identified. The Level II analysis from the in'ternal'events analysis','therefore,
'applies t'o the Cook iNudear Plaiit Fire PRA, I!
!!!! g 4!+ '>>
e
~
Hi' Wi'nd.
Fl
- d. 'and Othe
>> ~
This analysis'examined all credible exte'mal 'events other than seismic events and inter'nal fires. '
t'pecifically examined in thr.rother external ev'ents'-arialysis'were external flo6'din'g'," aircraft accidents,"
severe winds, ship impact accidents, off-site and on-site hazardous materials accidents, turbine missiles, and external fires.
No yulnerabilities were identified that required detailed quantification of any accident events.
It was, therefor'e, concluded that th3 effects from any of the other ext!eriial eventsidescribed here are not a significant corrcern at Cook Nu'clear Plant.'
>> ~
I t
~ +
1 The only changes identified due to this tr'nalyisis were in the area of controf'room "isolation due'to"on-"site hazardous materials,and external fires.
Hydrazine is stored on'-site in various locations at"Cook>>Nuclear
- Plant, Coricerns reg'ardirrg the effects of a spille'd container of hydr'azin'e 'oii'control room habitability arose during the course of the analysis.
>>Inter'nal 'calculations proved that such a spill would n'ot result in sufficient concenHtions of hydrazine vapor in the control room to cause inhabitability. However, since the most likely incidence of ari ikdete!cted spill of hydrazine worild'be due to a seismic event, the earthquake procedure was modified as a precaution to instruct the operator to isolate the control room HVAR following an earthquake until it cqn be verified that Jio hydrazine'spill has occurred.
l 0 4 g
~,'i The,seco'nd charig>>e involves the! 'devefdpment of a'proce'dure to instru'ct the 'operator "to'solate the'control roorh HVAR'ifSmok'e from an exterrial'fire is affecting control room.habitability'. This is currirntly'an accepted practice at Cook'Nuclear Plant,'however, 'it r's not currently proceddralized.
It is the" rritention of"AEPSC to use the'Cook IPEEE as a decision-making tool ln ma'y,aspects"of.">>...
engineerr'ng'support and plant operations.'ince the IPEEE is a highly teclirucal document 'ah>>d; i:, >>,
io'ridertainties do>>exist in the'analysis, the use and'interptetation of IPEEB results and c'ondusions'is--;
currently limited to thyrse individuals who'have been 'intimately involved ivitliits development.,This'i',"
'pproach'avoih th'e problems that might'arse fr'om misint&jretation of th'e:study; Also, AEPSC'y infernal commitment to regularly update the IPEEE ensures that the docum'ent will be a "living"document that always adequately reflects the current plant configuration and operating requirem'ents.'"'This"'livirnti"'RA>>'coricept'coupled with the review requirements of 10CFR50 Appendix B makes the Cook Hudea'r'lant IPEEBra v'aluable decision-making tool for most safety. r'elated questions.
(
S 8-3
f
~