ML18151A372

Evaluation of Potential Severe Accidents During LOW Power and Shutdown Operations at Surry, Unit 1.Analysis of Core Damage Frequency from Seismic Events During Mid-Loop Operations.Main Report

ML18151A372
Person / Time
Site:	Surry
Issue date:	08/31/1994
From:	Budnitz R, Davis P, Ravindra M, Tong W EQE, INC., FUTURE RESOURCES ASSOCIATES, INC., PRD CONSULTING
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
CON-FIN-L-1922 NUREG-CR-6144, NUREG-CR-6144-V05, NUREG-CR-6144-V5, NUDOCS 9409230293
Download: ML18151A372 (106)

Text

NUREG/CR-6144 Vol. 5 Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry, Unit 1 Analysis of Core Damage Frequency from

~eismic Events During Mid-Loop Operations Prepared by R. J. Budnitz/FRA P. R. Davis/PRD M. K. Ravindra, W. H. Tong/EQE Future Resources Associates, Inc.

PRD Consulting EQE International, Inc.

Prepared for

• Nuclear Regulatory Commission 9409230293 940831 O P n~ ADOCK 0500028 p U1' ** PDR

,. *f AVAILABILITY NOTICE Availability of Reference Materials Cited in NRG Publications Most documents cited In NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, Washington, DC 20555-0001

2. The Superintendent of Documents, U.S. Government Printing Office, Mail Stop SSOP. Washington, DC 20402-9328

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not In-tended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC bulletins, circulars, information notices, In-spection and investigation notices: licensee event reports: vendor reports and correspondence: Commission papers: and applicant and licensee documents and correspondence.

The following documents In the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRG-sponsored conference proceedings. international agreement reports, grant publications. and NRC booklets and brochures. Also available are regulatory guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG-series reports and tech-nical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items. such as books, journal articles, and transactions. Federal Register notices, Federal and State legislation. and congressional reports can usually be obtained from these libraries.

Documents such as theses. dissertations. foreign reports and translations, and non-NRC conference pro-ceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free. to the extent of supply, upon written request to the Office of Administration, Distribution and Mail Services Section, U.S. Nuclear Regulatory Commission, Washington.

DC 20555-0001.

Copies of industry codes and standards used in* a substantive manner In the NRC regulatory process are main-tained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, for use by the public. Codes and stan-dards are usually copyrighted and may be purchased from the originating organization or, If they are American National Standards. from the American National Standards Institute, 1430 Broadway, New York, NY 10018.

DISCLAIMER NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.

NUREG/CR-6144 Vol. 5 Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry, Unit 1 Analysis of Core Damage Frequency from

~eismic Events During Mid-Loop Operations anuscript Completed: June 1994 Date Published: August 1994 Prepared by R. J. Budnitz, Future Resources Associates, Inc.

P. R. Davis, PRD Consulting M. K. Ravindra, W. H. Tong, EQE International, Inc.

Future Resources Associates, Inc.

2039 Shattuck Avenue, Suite 402 Berkeley, CA 94704 PRD Consulting P.O. Box 2046 Sheridan, 'WY 82801 EQE International, Inc.

18101 Von Karman Avenue, Suite 400 Irvine, CA 92715 Prepared for Division of Safety Issue Resolution Office of Nuclear Regulatory Research Nuclear Regulatory Commission hington, DC 20555-0001 C FIN L1922

ABSTRACT Traditionally, probabilistic risk assessments (PRAs) of severe accidents at nuclear power plants have explored accidents initiated during full-power operation. However, in 1989 the U.S.

Nuclear Regulatory Commission (NRC) initiated an extensive program to examine carefully the potential risks during low-power and shutdown operations. The program included two parallel projects, one at Brookhaven National Laboratory studying a pressurized water reactor (Surry Unit 1) and the other at Sandia National Laboratories studying a boiling water reactor (Grand Gulf). Both the Brookhaven and Sandia projects have examined only accidents initiated by internal plant faults --- so-called "internal initiators". This project, which has explored the likelihood of seismic-initiated core damage accidents during refueling shutdown conditions, is complementary to the internal-initiator analyses at Brookhaven and Sandia. This report covers the seismic analysis at Surry Unit 1, while a companion report documents the Grand Gulf seismic analysis.

All of the many systems modeling assumptions, component non-seismic failure rates, and human error rates that were used in the internal-initiator study at Surry have been adopted here, so that the results of the two studies can be as comparable as possible. Both the Brookhaven study and this study examine only two shutdown plant operating states (POSs) during refueling outages at Surry, called POS 6 and POS 10, which represent mid-loop operation before and after refueling, respectively. This analysis has been limited to work analogous to a level-I seismic PRA, in which estimates have been developed for the core-damage frequency from seismic events during POSs 6 and 10. The methodology is almost identical to that used for full-power seismic PRAs, as wideiy practiced in the nuclear industry.

The results of the analysis are that the core-damage frequency for earthquake-initiated accidents during refueling outages in POS 6 and POS 10 is found to be low in absolute terms, less than 10-6 /year. The core-damage frequencies are also low relative to the frequencies during POS 6 and POS 10 for internal initiators, as analyzed in the companion study by Brookhaven.

• Vol.5 iii NUREG/CR-6144

TABLE OF CONTENTS ABSTRACT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii EXECUTIVE

SUMMARY

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi ACKNOWLEDGMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x111

1. INTRODUCTION ................................................... . 1-1 1.1 Objective of the Report ................................. . 1-1 1.2 Importance of the Issue .................................. . 1-1 1.3 Scope ................................................. . 1-2 1.4 Assumptions ............................................ . 1-2 1.5 Organization of the Report .............................. . 1-4

2. SEISMIC RISK ANALYSIS METHODOLOGY .......................... . 2-1 2.1 Seismic Hazard Analysis ................................. . 2-1 2.2 Seismic Fragility Evaluation ............................. . 2-2 2.3 Analysis of Plant Systems and Accident Sequences .......... . 2-2 2.4 Evaluation of Core Damage Frequency..................... . 2-3

3. SEISMIC HAZARD AN AL YSIS ....................................... . 3-1 3.1 EPRI and LLNL Seismic Hazard Studies ................... . 3-1

4. SYSTEMS ANALYSIS FOR SURRY.................................... . 4-1 4.1 Identification of Accident Sequences ...................... . 4-1 4.1.1 Introduction...................................... . 4-1 4.1.2 Assumptions ..................................... . 4-1 4.1.3 BNL Event Tree for POS 6 ......................... . 4-1 4.1.4 Seismic Shutdown Event Tree for POS 6.............. . 4-3 4.1.5 BNL Event Tree for POS 10 ........................ . 4-4 4.1.6 Seismic Shutdown Event Tree for POS 10 ............ . 4-5 4.2 Selection of Components ................................. . 4-6 4.3 Operator Reliability..................................... . 4-7 4.3.1 Human Error as a Function of Acceleration Level. .... . 4-7 4.3.2 Initial Human Error............................... . 4-7 4.3.3 Subsequent Human Errors .......................... . 4-8 4.4 Consideration of Outage Duration ........................ . 4-8 4.4.1 Introduction ...................................... . 4-8 4.4.2 Plant Outages..................................... . 4-8 4.4.3 Refueling Outage Duration for Surry Unit 1. ......... . 4-8

.Vol.5 V NUREG/CR-6144

f (*

(

5. SEISMIC FRAGILITY EVALUATION FOR SURRY .. .' ................. .

5.1 5.2 Introduction ........................................... .

Seismic Walkdown of Surry .............................. .

5.2.1 General ......................................... .

5.2.2 Walkdown Procedures ............................ .

5-1 5-1 5-1 5-1 5-2 5.2.3 Walkdown Documentation ......................... . 5-6 5.2.4 Walkdown Findings............................... . 5-6 5.3 Seismic Fragility Evaluation .. *........................... . 5-9 5.3.1 Seismic Fragility Methodology ..................... . 5-9 5.3.2 Surry Seismic Fragilities .......................... . 5-17 5.3.3 Example of Equipment Fragility Evaluation ......... . 5-19

6. SEISMIC RISK QUANTIFICATION FOR SURRY ...................... . 6-1 6.1 Base Case .............................................. . 6-1 6.2 Sensitivity Studies ...................................... . 6-1 6.2.1 Impact of Seismic Hazard.......................... . 6-1 6.2.2 Uncertainty Analyses ............................. . 6-2 6.3 Comparison with CDF from Internal Initiators During Mid-loop Operations and with CDF at Full Power .... . 6-2

7. CONCLUSIONS AND RECO:MMENDATIONS .......................... . 7-1

8. REFERENCES ..................................................... . 8-1 NUREG/CR-6144 vi Vol. 5

LIST OF FIGURES 2-1 Seismic Hazard Curves For a Nuclear Power Plant Site ........... . 2-4 2-2 Family of Fragility Curves For a Component .................... . 2-5 2-3 Probability Distribution of Seismically-Induced Severe Core Damage Frequency ............................... . 2-6 3-1 EPRI Seismic Hazard Curves For Surry Site ..................... . 3-2 3-2 LLNL Seismic Hazard Curves For Surry Site .................... . 3-3 3-3 10,000-Year Return Period Ground Response Spectrum For Surry Site ......................................... . 3-4 4-1 Event Tree for POS 6 From BNL Study ......................... . 4-11 4-2 Seismic Event Tree for POS 6.................................. . 4-12 4-3 Event Tree for POS 10 From BNL Study ........................ . 4-13 4-4 Seismic Event Tree for POS 10 ................................ . 4-14 5.2-1 SEWS of 125V Batteries (3 pages) .............................. . 5-26 5.2-2 SEWS of LHSI Pumps (2 pages) ................................ . 5-29 5.2-3 Masonry Block Walls of 125V Battery Enclosure ................. . 5-31 5.2-4 Masonry Block Walls of 125V Battery Enclosure .................. . 5-31

• 5.2-5 5.2-6 5.2-7 5.2-8 5.2-9 5.2-10 110,000 Gallon Condensate Water Storage Tank Concrete Enclosure .

100,000 Gallon Emergency Condensate Makeup Tank ............. .

Refueling Water Storage Tank ................................. .

Trapeze Supported Cable Trays ................................ .

Floor Supported Cable Trays .................................. .

LHSI Pump Upper Lateral Support ............................. .

5-32 5-32 5-33 5-33 5-34 5-35 5.2-11 Lower CCW Heat Exchangers .................................. . 5-36 5.2-12 Upper CCW Heat Exchangers .................................. . 5-36 5.2-13 Anchorage Details at Concrete Pier of Lower CCW Heat Exchanger .. 5-37 5.2-14 Vital Bus Distribution Panel in the Control Room ................ . 5-37 5.2-15 Typical Battery Rack of 125V Batteries.......................... . 5-38 5.2-16 Live Tank Design Circuit Breakers in the Switchyard ............. . 5-38 5.2-17 Dead Tank Design Circuit Breakers in the Switchyard............. . 5-39 5.2-18 Friction Clip at the Base of Steel Frame Supporting Circuit Breakers........................................ . 5-39 5.3-1 Median, 5% Non-Exceedance, and 95% Non-Exceedance Fragility Curves For a Component. ............................... . 5-40 6-1 Surry Boolean Expressions for the Two Plant Operating States ...... . 6-4

• Vol. 5 vii NUREG/CR-6144

(

LIST OF TABLES 4-1 4-2 5.3-1 Human Error Rates and Uncertainty Bounds for POS 6 and 10 ..... .

Duration of Surry-I in Plant Operating States 6 and 10............ .

Surry Low Power PRA Components Seismic Fragilities (3 pages) .... .

4-10 4-10 5-23 6-1 POS Frequency Estimates For Surry Plant ...................... . 6-5 6-2 Sensitivity of POS 6 Frequency to Seismic Site Hazard ............ . 6-5 6-3 Impact of Human Error Rates on POS Annual Frequencies ........ . 6-6 6-4 Impact of Bus Stub Human Error Rate on POS Annual Frequencies .. 6-6 6-5 Surry: Comparison of CDF for Shutdown vs. Full-Power Conditions and for Seismic Initiators vs. Internal Initiators ............ . 6-7 NUREG/CR-6144 viii Vol. 5

• EXECUTIVE

SUMMARY

Traditionally, probabilistic risk assessments (PRAs) of severe accidents at nuclear power plants have explored accidents initiated during full-power operation. However, in 1989 the U.S.

Nuclear Regulatory Commission (NRC) initiated an extensive program to examine carefully the potential risks during low-power and shutdown operations. The program included two parallel projects, one at Brookhaven National Laboratory studying a pressurized water reactor (Surry Unit 1) and the other at Sandia National Laboratories studying a boiling water reactor (Grand Gulf). Both the Brookhaven and Sandia projects have examined only accidents initiated by postulated internal plant faults --- so-called "internal initiators".

This project, which has explored the likelihood of seismic-initiated core damage accidents during refueling shutdown conditions, is complementary to the internal-initiator analyses at Brookhaven and Sandia. This report covers the seismic analysis at Surry Unit 1, while a companion report documents the Grand Gulf seismic analysis. The project reported here is the second phase of a two-phase effort, the initial phase of which was scoping in character, having been performed primarily to establish if the issue was judged to be important enough to justify the more extensive and more quantitative evaluation reported here.

All of the many systems modeling assumptions, component non-seismic failure rates, and human error rates that were used in the internal-initiator study at Surry have been adopted here, so that the results of the two studies can be as comparable as possible. This study, which is based on key inputs from the Brookhaven study, examines only two shutdown plant operating states (P0Ss) during refueling outages at Surry, called POS 6 and POS 10, which represent mid-loop operation during refueling. POS 6 is mid-loop operation before refueling while POS 10 represents mid-loop operation after refueling.

This analysis has been limited to work analogous to a level-I seismic PRA, in which estimates have been developed for the core-damage frequency from seismic events during P0Ss 6 and 10.

The methodology is almost identical to that used for full-power seismic PRAs, as widely practiced in the nuclear industry. However, seismic-induced relay chatter is beyond the scope of this analysis. Seismic hazard curves from both the Electric Power Research Institute (EPRI) and the Lawrence Livermore National Laboratory (LLNL) have been used. Assessments of the likelihood of various post-core-damage plant-damage states (level-2 PRA) and of significant radioactive releases (level-3 PRA) are beyond the scope or' this evaluation.

The results of the analysis are that the mean core-damage frequency for earthquake-initiated accidents during refueling outages in POS 6 and POS 10 is found to be low in absolute terms, less than 10-6/year. This is true using both the EPRI and the LLNL seismic hazard curves. The reasons for this are (i) Surry's seismic capacity in responding to earthquakes during shutdown is excellent, well above its design basis and similar to its ability to respond to earthquakes during full-power conditions; (ii) the Surry site enjoys one of the least seismically active locations in the United States; (iii) the Surry plant is only in POS 6 and POS 10 (combined) for an average (mean) of 6.6% of the time. The core-damage frequencies are also low relative to the frequencies during POS 6 and POS 10 for internal initiators, as analyzed in the companion study by Brookhaven.

• Vol. 5 ix NUREG /CR-6144

FOREWORD (NUREG/CR-6143 and 6144)

Low Power and Shutdown Probabilistic Risk Assessment Program Traditionally, probabilistic risk assessments (PRA) of severe accidents in nuclear power plants have considered initiating events potentially occurring only during full power operation. Some previous screening analyses that were performed for other modes of operation suggested that risks during those modes were small relative to full power operation. However, more recent studies and operational experience have implied that accidents during low power and shutdown could be significant contributors to risk.

During 1989, the Nuclear Regulatory Commission (NRC) initiated an extensive program to carefully examine the potential risks during low power and shutdown operations. The program includes two parallel projects performed by Brookhaven National Laboratory (BNL) and Sandia National Laboratories (SNL), with the seismic analysis performed by Future Resources Associates. Two plants, Surry (pressurized water reactor) and Grand Gulf (boiling water reactor), were selected as the plants to be studied.

The objectives of the program are to assess the risks of severe accidents due to internal events, internal fires, internal floods, and seismic events initiated during plant operational states other than full power operation and to compare the estimated core damage frequencies, important accident sequences and other qualitative and quantitative results with those accidents initiated during full power operation as assessed in NUREG-1150. The scope of the program includes that of a level-3 PRA.

• • The results of the program are documented in two reports, NUREG/CR-6143 and 6144. The reports are organized as follows:

For Grand Gulf:

NUREG/CR-6143 - Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Grand Gulf, Unit I Volume 1: Summary of Results Volume 2: Analysis of Core Damage Frequency from Internal Events for Plant Operational State 5 During a Refueling Outage Part 1: Main Report Part I A: Sections I - 9 Part 1B: Section 10 Part IC: Sections 11 - 14 Part 2: Internal Events Appendices A to H Part 3: Internal Events Appendices I and J Part 4: Internal Events Appendices K to M Volume 3: Analysis of Core Damage Frequency from Internal Fire Events for Plant Operational State 5 During a Refueling Outage Volume 4: Analysis of Core Damage Frequency from Internal Flooding Events for Plant Operational State 5 During a Refueling Outage Volume 5: Analysis of Core Damage Frequency from Seismic Events for Plant Operational State 5 During a Refueling Outage Volume 6: Evaluation of Severe Accident Risks for Plant Operational State 5 During a Refueling Outage Part 1: Main Report Part 2: Supporting MELCOR Calculations Vol. 5 xi NUREG /CR-6144

l For Surry:

NUREG/CR-6144 -

FOREWORD (continued)

Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry Unit-I Volume I: Summary of Results Volume 2: Analysis of Core Damage Frequency from Internal Events During Mid-loop Operations Part I: Main Report Part IA: Chapters I - 6 Part I B: Chapters 7 - 12 Part 2: Internal Events Appendices A to D Part 3: Internal Events Appendix E Part 3A: Sections E.l - E.8 Part 3B: Sections E.9 - E.16 Part 4: Internal Events Appendices F to H Part 5: Internal Events Appendix I Volume 3: Analysis of Core Damage Frequency from Internal Fires During Mid-loop Operations Part 1: Main Report Part 2: Appendices Volume 4: Analysis of Core Damage Frequency from Internal Floods During Mid-loop Operations Volume 5: Analysis of Core Damage Frequency from Seismic Events During Mid-

• loop Operations Volume 6: Evaluation of Severe Accident Risks During Mid-loop Operations Part 1: Main Report Part 2: Appendices NUREG/CR-6144 xii Vol. 5

• ACKNOWLEDGMENTS This project has been supported by the U.S. Nuclear Regulatory Commission under contract NRC-04-92-058, "PRA Analysis of LWR Low-Power and Shutdown Accidents Initiated by Earthquakes", as a Phase II project under the NRC's Small Business Innovation Research Program. Richard C. Robinson Jr. of NRC's Office of Nuclear Regulatory Research provided technical liaison with the project team.

The project could not have been effectively accomplished without the insights gained from the much larger shutdown-risk projects that have recently been completed under NRC support at Brookhaven National Laboratory (for Surry) and at Sandia National Laboratories (for Grand Gulf). We wish to thank all the many participants in those projects for their excellent work, and in particular Tsong-Lun Chu of Brookhaven and Donnie W. Whitehead of Sandia.

Finally, we wish to thank the staff members at Virginia Electric Power Company's Surry power station for their cooperation, both during our walkdowns of the plant and afterward in furnishing technical information.

ie Vol. 5 xiii NUREG /CR-6144

1. INTRODUCTION 1.1 Objective of the Report This project has explored the likelihood of seismic-initiated core damage accidents during refueling outage conditions at the Surry (Unit 1) and Grand Gulf nuclear power plants. This report documents the Surry analysis, while a companion report documents the Grand Gulf analysis (Ref. FRA/Grand Gulf, 1994). The project reported here is the second phase of a two-phase effort, the initial phase of which (Ref. FRA, 1991) was scoping in character, having been performed primarily to establish if the issue was judged to be important enough to justify the more extensive and more quantitative evaluation reported here. Throughout this report, we will refer to the earlier study as the "Phase-I study" and, where necessary for clarity, this study as the "Phase-II study".

The Phase-I results were preliminary in character, and served principally both to establish that the issue is important enough to merit further study, and to assure the study team that it is fully feasible to adapt the seismic-PRA methodology for full-power seismic PRA to this problem. The findings on both points were favorable enough to justify continuing with this Phase-II project.

1.2 Importance of the Issue The issue of whether the risk of a large core-damage accident is significant when nuclear power plants are in shutdown conditions has received increasing attention in recent years. It is beyond our scope here to summarize the several recent studies of this issue: suffice it to state that the problem has been judged important enough that the U.S. Nuclear Regulatory Commission (NRC) has supported a major shutdown-risk research program for the past three years. The program has examined shutdown risk by performing in-depth probabilistic risk assessments (PRAs) at two U.S. nuclear power plants, Surry Unit I and Grand Gulf, and has resulted in significant insights into various safety-issues that may arise during shutdown conditions. The Surry study was carried out at Brookhaven National Laboratory, and the Grand Gulf study at Sandia National Laboratories, both under contract to NRC and both using subcontractors to supplement the in-house expertise at the two laboratories.

The results of this effort have recently been published (Ref. BNL, 1994; Sandia, 1994), and the findings are important: the overall core-damage frequency for postulated accidents during the shutdown conditions that were examined is comparable to the core-damage frequency during full power operation.

However, the NRC shutdown-risk projects at Brookhaven and Sandia did not examine risks during shutdown that might arise from earthquake-initiated accidents: they both concentrated on so-called "internal initiators" such as transients, loss-of-coolant accidents, and loss of off site power. They also both examined scenarios that might arise from internal fires and internal flooding. In the project being reported here for Surry Unit 1, and in the companion project for Grand Gulf, the earthquake-initiator issue has been examined. Both of these projects are fully coordinated with these two larger studies of internal initiators.

Vol. 5 I - I NUREG /CR-6144

1.3 Scope The scope of this effort was limited to an examination of two nuclear power plants: Surry Unit l, a Westinghouse 3-loop PWR with a subatmospheric containment, and Grand Gulf, a General Electric BWR/6 with a Mark-III containment. Surry-I, owned by Virginia Electric Power Company, is located on a two-unit site in the tidewater region of southeastern Virginia, and has a nearly identical companion unit. Grand Gulf, owned by Entergy Corporation, is located on the Mississippi River in east-central Mississippi, and is alone on its site. There were two principal reasons for selecting these two plants:

o As mentioned above, both the Surry-I and the Grand Gulf nuclear stations have been the subject of probabilistic shutdown risk studies (excluding seismic-initiated events) recently completed for the U.S. Nuclear Regulatory Commission. The Surry study was accomplished by Brookhaven National Laboratory (Ref. BNL, 1994), and the Grand Gulf study by Sandia National Laboratories (Ref. Sandia, 1994). Appropriate models, data, and results from these studies were available for direct use in this seismic shutdown risk study. This information proved to be invaluable in completing this analysis.

o Both Surry (Ref. Breeding et al., 1990) and Grand Gulf (Ref. Brown et al., 1990) have also been the subjects of an extensive risk assessment for full-power conditions sponsored by the Nuclear Regulatory Commission and performed by Sandia National Laboratories, as part of the very large NUREG-1150 PRA study (Ref. NRC/1150, 1990).

For Surry (but not for Grand Gulf), this NUREG-1150 analysis included an investiga-tion of seismic-initiated accidents during full power conditions (Ref. Bohn et al., 1990),

in which a limited amount of plant-specific seismic fragility information was developed for Surry's components and structures. This information was utilized in part where appropriate.

The NUREG-1150 full-power PRA study covered five plants. Seismic-initiated accidents at full power were analyzed for only two of them, the other (besides Surry) being Peach Bottom Unit 2, a BWR. Parts of the Peach Bottom external-events report (Ref. Lambright et al., 1990) also served as an important source of information for the Phase-I scoping project (Ref. FRA, 1991) that preceded this full-scope project.

While Surry and Grand Gulf were the only plants specifically examined in this study, some seismic-hazard data were examined for other LWR sites in the U.S., and insights relative to the applicability of the Surry results to other plants were developed and are included in this report.

This analysis has been limited to work analogous to a level-I seismic PRA.

We have developed an estimate for the core-damage frequency from seismic events during certain shutdown operating states. Assessments of the likelihood of various post-core-damage plant-damage states (level-2 PRA) and of significant radioactive releases (level-3 PRA) are beyond the scope of this evaluation.

1.4 Assumptions The following key assumptions have made for this study of Surry Unit 1:

a. As mentioned, the recent shutdown risk study for Surry Unit 1 (Ref. BNL, 1994) is the principal basis for the systems-analysis parts of our work here: indeed, we could not have NUREG/CR-6144 1-2 Vol. 5

accomplished this work at all without using the other very extensive analysis as our point of departure. The Brookhaven analysis contains numerous assumptions that are necessary to bound the scope and to simplify the detailed work, and we have adopted all of these assumptions without exception. Most importantly, we have adopted directly the loss-of-offsite-power (LOOP) event trees, including the definitions of the top events and underlying thermal-hydraulic and other assumptions that support these event trees, namely those corresponding to mid-loop operation.

b. Only refueling outages have been considered in this seismic analysis. Indeed, only certain specific operating states occurring within the standard refueling outages at Surry have been considered. Outages for other reasons frequently occur at nuclear power plants, and they are of two broad types: controlled shutdowns and uncontrolled (rapid) shutdowns. Although these outages for other reasons can produce the same plant operating states but with configurations unique to the reason for the shutdown, resources in this analysis did not permit examining outage configurations other than those for refueling. In any event, refueling outages con-tribute a majority of the shutdown time.

c. We assume that the only seismic events of concern are those that cause loss-of-off site-power (LOOP) transients. Seismic events of lower acceleration than those causing LOOP are expected to have a negligible probability of causing severe plant accidents for two reasons: (i) Critical plant equipment, including the residual heat removal (RHR) system, can withstand signifi-cantly higher accelerations than that which is sufficient to cause LOOP (Ref. Bohn et al., 1990; Lambright et al., 1990). Thus, loss of core-cooling capability will have a very low probability for seismic events too small to cause a LOOP. (ii) With offsite power available, sources of water sufficient to cool the core from alternative pumping sources will generally be available even if the RHR system fails.

d. We also assume that seismic-initiated LOOP is non-recoverable in the time frame of interest in this study (from about one to several hours). This is a reasonable and only slightly conserva-tive assumption, because the LOOP initiator is most likely to arise from the seismic-caused failure of the ceramic insulators in the plant substation (Ref. Bohn et al., 1990; Lambright et al., 1990). Replacement of these insulators would likely require several hours at a minimum, and probably much longer. Additionally, other damage caused by the earthquake, for example to off site transmission systems and offsite switch yards, would likely hamper efforts to. recover off site power.

e. The Brookhaven analysis of internal initiators (Ref. BNL, 1994) used a time-window approach to differentiate different parts of the Plant Operating States that they studied, so as to account better for decay-heat differences within the POSs. Our seismic analysis has not used this time-window approach, because the distinctions that it embodies are not important for our analysis.

f. The engineering methodology to develop probabilistic seismic fragility curves is described below (Chapter 2). The methodology uses a successive-screening approach, in which structures and equipment that are judged to be very strong under earthquake loading are screened out first, so that the number of items for which actual numerical fragilities must be developed is limited. Also, for a few items the study team was unable to obtain enough information, either because access to some parts of the plants was limited or because engineering information in the appropriate form was not available. For these items, generic fragilities have been used.

g. We have assumed that the seismic failures of identical equipment in similar locations are fully correlated. This means, for example, that when a postulated earthquake causes one diesel generator to fail, we have assumed that the other diesel generator(s) will also fail. This simplifying assumption is probably conservative in many cases, but perhaps not overly so for Vol. 5 I -3 NUREG /CR-6144

truly identical equipment. Sensitivity studies performed in several past seismic PRAs have shown that the bottom-line results are sensitive to this assumption at a level of about a factor of plus-or-minus two.

h. Equipment failure from seismic-induced relay chatter is outside the scope of this analysis.

While relay chatter can be important (Ref. Budnitz, Lambert, and Hill, 1987), it is a complicated issue, and the resources to study it were not available within this project. In any event, relay chatter is being studied at every U.S. nuclear plant as part of the current IPEEE program (Ref. Chen et al., 1991), and it is expected that almost all of the relays that are espe-cially sensitive to relay chatter will be identified and, if appropriate, modified in the course of the IPEEE studies.

i. As discussed below (see Chapter 3), we will use both the LLNL and EPRI seismic hazard analyses.

1.5 Organization of the Report The report is organized into three parts. First, we discuss the methodology used (Chapter 2 ---

risk-assessment methodology and Chapter 3 --- seismic hazard analysis inputs). Next, we discuss th~ analysis and results (Chapters 4, 5, and 6); and then we summarize in Chapter 7 the principal findings of the analysis.

NUREG/CR-6144 1-4 Vol. 5

2. SEISMIC RISK ANALYSIS METHODOLOGY The objectives of a full-scope seismic PRA of a nuclear power plant are to estimate the frequencies of occurrence of severe core damage, serious radiological releases, and consequenc-es in terms of early fatalities, long term adverse health effects and property damage, and to identify significant contributors to plant risks. In this study, only a level-I seismic PRA has been performed, leading only to estimates of the frequency of occurrence of severe core damage.

The key elements of a level-I seismic PRA are:

I. Seismic hazard analysis - estimation of the frequency of various levels of seismic ground motion (acceleration) occurring at the site.

2. Seismic fragility evaluation - estimation of the conditional probabilities of structural or equipment failure for given levels of ground acceleration.

3. Systems/accident sequence analysis- modeling of the various combinations of structural and equipment failures that could initiate and propagate a seismic core damage accident sequence.

4. Evaluation of core damage frequency - assembly of the results of the seismic hazard, fragility, and systems analyses to estimate the frequencies of core damage for various accident sequences and for the plant as a whole.

In the following subsections, the methods used in each of the above stages of a level-I seismic PRA are outlined.

2.1 Seismic Hazard Analysis Seismic hazard is usually expressed in terms of the frequency distribution of the peak value of a ground-motion parameter (e.g., peak ground acceleration) during a specified time interval.

Somewhat different approaches to implementing the basic methodology are documented in (Bernreuter et al, 1989) and (EPRI, 1989). The different steps of this analysis are as follows:

I. Identification of the sources of earthquakes, such as faults and seismotectonic provinces.

2. Evaluation of the earthquake history of the region to assess the frequencies of occurrence of earthquakes of different magnitudes or epicentral intensities.

3. Development of attenuation relationships to estimate the intensity of earthquake-induced ground motion (e.g., peak ground acceleration) at the site.

4. Integration of the above information to estimate the frequency of exceedance for selected ground motion parameters.

The hazard estimate depends on uncertain estimates of attenuation, upperbound magnitudes, and the geometry and seismic activity of the postulated sources. Such uncertainties are included in the hazard analysis by assigning probabilities or weights to alternative hypotheses Vol. 5 2- 1 NUREG/CR-6144

about these parameters. A probability distribution for the frequency of occurrence is thereby developed. The annual frequencies for exceeding specified values of the ground motion parameter are displayed as a family of curves with different weights (Figure 2-1).

A Bayesian estimate of the frequency of exceedance at any peak ground acceleration is obtained as the weighted sum of the frequencies of exceedance at this acceleration given by the different hazard curves; the weighting factor is the probability assigned to each hazard curve.

2.2 Seismic Fragility Evaluation The methodology for evaluating seismic fragilities of structures and equipment is documented in (Ref. Ravindra and Kennedy, 1983) and (Ref. Kennedy and Ravindra, 1984). Seismic fragility of a structure or equipment item is defined as the conditional probability of its failure at a given value of the seismic input or response parameter (e.g., ground acceleration, stress, moment, or spectral acceleration). Seismic fragilities are needed in a PRA to estimate the conditional probabilities of occurrence of initiating events (e.g., loss of off site power, large LOCA, small LOCA, RPV rupture) and the conditional failure probabilities of different mitigating systems (e.g., safety injection system, residual heat .removal system, containment spray system).

The objective of fragility evaluation is to estimate the ground acceleration capacity of a given component. This capacity is defined as the peak ground motion acceleration value at which the seismic response of a given component located at a specified point in the structure exceeds the component's resistance capacity, resulting in its failure. The ground acceleration capacity of the component is estimated using information on plant design bases, responses calculated at the design analysis stage, as-built dimensions, and material properties. Because there are many variables in the estimation of this ground acceleration capacity, component fragility is described by a family of fragility curves; a probability or weighting value is assigned to each curve to reflect the uncertainty in the fragility estimation (Figure 2-2).

2.3 Analysis of Plant Systems and Accident Sequences Frequencies of severe core damage and radioactive release to the environment are calculated by combining plant logic with component fragilities and seismic hazard estimates. Event and fault trees are constructed to identify the accident sequences that may lead to severe core damage and radioactive release.

The plant systems and sequence analyses used in seismic PRAs are based on the PRA Procedures Guide (Ref. NRC, 1983) and can generally be summarized for a level-I PRA as follows:

1. The analyst constructs event and fault trees reflecting (a) failures of key system components or structures that could initiate an accident sequence and (b) failures of key system components or structures that would be called on to stop the accident sequence.

2. The fragility of each such component (initiators and mitigators) is estimated.

3. Fault trees and event trees are used to develop Boolean expressions for severe core damage that lead to each distinct accident sequence.

As an example, the Boolean expression for severe core damage in the Zion Probabilistic Safety Study (Ref. Zion, 1981) is:

NUREG/CR-6144 2-2 Vol. 5

Boolean= 4 + 8 + 10 + 14 + 17 + 21 + (12 + 22 + 26)

• 9 (Eq. 2-1)

The numbers represent components for which seismic fragilities have been developed, as described earlier. The symbols "+"and"*" indicate "OR" and "AND" operations, respectively.

Plant level fragility curves are obtained by aggregating the fragilities of individual components according to Equation 2-1, using either Monte Carlo simulation or numerical integration. The plant level fragility means the conditional probability of severe core damage for a given peak ground acceleration at the site. The uncertainty in plant level fragility is displayed by developing a family of fragility curves; the weight (probability) assigned to each curve is derived from the fragility curves of components appearing in the specific accident sequence.

2.4 Evaluation of Core Damage Frequency Plant level fragilities are convolved with the seismic hazard curves to obtain a set of doublets for the accident frequency,

{ < Pij , f ij > } (Eq. 2-2) where f ij is the seismically-induced accident frequency and Pij is the discrete probability of this frequency, (Eq. 2-3)

• (Eq. 2-4)

Here, Hj represents the jth hazard curve, fi the ith accident fragility curve; qi is the proba-bility associated with the ith fragility curve and Pj is the probability associated with the lh hazard curve.

The above equations state that the convolution between the seismic hazard and plant level fragility is carried out by selecting hazard curve j and fragility curve i; the probability assigned to the accident frequency resulting from the convolution is the product of the probab~lities Pi and qj assigned to these two curves. The convolution operation given by Equation 2-4 consists of multiplying the occurrence frequency of an earthquake peak ground acceleration between a and a+ da (obtained as the derivative of Hj with respect to a) with the conditional probability of the accident fragility curve, and integrating such products over the entire range of peak ground accelerations zero to infinity. In this manner, a probabilistic distribution on the frequency of a given accident sequence can be obtained.

Severe core damage occurs if any one of the accident sequences occurs. By probabilistically combining the various sequences, the plant level fragility curves for severe core damage are obtained. Integration of the famiiy of fragility curves over the family of seismic hazard curves yields the probability distribution function of the occurrence frequency of severe core damage (Figure 2-3).

• Vol. 5 2-3 NUREG/CR-6144

10-2

~

~

,...,,,,_ ./

Curve 1 Curve 2

~~~

!::: ~~ ~ .......... // .--- Curve 3

.,,.--- Curve 4

c cu ~ ~

r.... //// ....-- Curves 1 o-3 ._,,,,

- Curve 6

.0 ...... ...... ~ ~

0 ......

Curve 7 a... "- "' /

"__,,_ Curves

... ' ~:x/,1 / .,.........- Curve 9 Cl) 0 C

10-4

' ~

"' ~ ~

~ / Curve10 Cl)

""C -.........."" ..... .

~

Cl) .....

Cl) 0 ~

w X

10-5 """~~ ~ \..

cu C

' ~ ' \.

C

" . ' "'\." ' "'"

<( \.

\1 ~ \' ~ "'

10-6 10 100

\.

'1000 Acceleration (Cm/Sec 2 )

2HD 533nb/SRA-F191 Figure 2-1 : Seismic Hazard Curves For A Nuclear Power Plant Site NUREG/CR-6144 2-4 Vol. 5

Q)

I....

J

~ 0.8 0.6

..0 ctS

..0 0

I....

0... 0.4 ctS C

0

""O 0.2 C

0

()

0 0.4 0.8 1.2 1.6 2.0 Peak Ground Acceleration, g 2HD 533nb/SRA-F194 Figure 2-2: Family of Fragility Curves tor a Component Vol. 5 2-5 NUREG /CR-6144 L ..

I '

Internal events ---

~

"cij C:

a,

"'C

-~:.c Other external ,

ca events '--.

.c a..

...C events 1x10*1* 1 X 10-6 1 X 10"5 1 X ,0*3 Core.damage frequency (per year)

Figure 2-3: Probability Distribution of Seismically-Induced Severe Core Damage Frequency NUREG/CR-6144 2-6 Vol. 5

• 3. SEISMIC HAZARD ANALYSIS 3.1 EPRI and LLNL Seismic Hazard Studies Seismic hazard curves are needed to estimate the core-damage frequencies of different plant operating states. Typically, a site-specific seismic hazard analysis is performed to obtain the hazard curves. For the Surry site, two such studies have already been conducted and the results are available in a usable form.

Figure 3-1 is the set of seismic hazard curves for the Surry site developed by the Electric Power Research Institute (Ref. EPRI, 1989). Shown are the mean, median, 5th-percentile and 95th-percentile curves. Each curve is the annual probability of exceedance plotted against the peak ground acceleration. Similar curves developed by the Lawrence Livermore National Laboratory (Ref. Bernreuter, et al. 1989) are shown in Figure 3-2. These two sets of hazard curves are used in the seismic risk quantification reported in Chapter 6.

For fragility evaluation, a site-specific ground motion response spectrum is needed. In NUREG-1407 (Ref. Chen et al., 1991), it is recommended that either of the spectral shapes developed in the above EPRI and LLNL studies could be used. The median spectral shape corresponding to a 10,000-year return period along with variability estimates given in the LLNL study (Bernreuter et al., 1989) is suggested for this purpose (Figure 3-3).

Two important considerations arise in the use of these seismic hazard curves. These curves provide estimates of probability of exceedance per year. However, the plant outages only extend for a fraction of the year. This must be taken into account in the estimation of frequencies of different plant operating states during shutdown (See Section 4.4 below).

Secondly, the objective of this study is to assess the contribution of the seismic-induced risks in refueling outages and to compare it to the risks from other events during the same refueling outages. It would be interesting to know how the seismic-induced shutdown risk varies from nuclear plant site to site. Towards this end, we have performed sensitivity studies by "moving" the Surry power station to different sites elsewhere in the eastern United States (with different seismic hazard curves) and estimating the impact. This is discussed in Section 6.2.

Vol. 5 3- 1 NUREG /CR-6144

J '

SURRY

- -- - --

• 85th fractile r..:J - - median

~ 10- 2 \ - -- - - 15th fractile

< \

0 r..:J

~**

\

- - - mean r..:J * ~*.

~ 10- 3 '. {.

r..:J '. ~ ' **

\ '\ '.

'\ *,

'\*.'

'\ .. '

'\ *.

'\' ..

10- 7 ._.....__.__.__.__.__,_.___.__.___.___.~....__._,,_........__.__.___.._~.__..__,__~

0. 200. 400. 600. 800. 1000.

ACCELERATION (cm/sec 2 )

Figure 3-1: EPRI Seismic Hazard Curves for Surry Site NUREG /CR-6144 3-2 Vol. 5

• E.U.S SEISMIC HAZARD CHARACTERIZATION LOWER MAGNITUDE OF INTEGRATION IS 5.0 PERCENTILES= 15., 50. AND 85.

-1 HAZARD CURVES USING ALL EXPERTS 10

-2 10 0:

<(

w 0:

w -.3 a.. 10 w

u z

~

L&J L&J -4 u 10 X

L&J 0

t- -5

...J 10 Ill'

<(

II) 0 0:

a..

-6 10

-7 10

~N I() CX) 0, 0

+

L&J ACCELERATION CM/SEC**2 Figure 3-2: LLNL Seismic Hazard Curves for Surry Site Vol. 5 3-3 NUREG/CR-6144

SURRY 10- 4 spectra

(.)

Q)

Cl) 10 2

"'su

~ 85

-u E-4 0

10 1

~ 50

~

> 15

~*

~

E-4 10° u

~

~

r.n 10-\0-2 10- 1 10° 10 1 PERIOD (sec)

Figure 3-3: 10,000 year Return Period Ground Response Spectrum for Surry Site NUREG /CR-6144 3-4 Vol. 5

4. SYSTEMS ANALYSIS FOR SURRY 4.1 Identification of Accident Sequences 4.1.1 Introduction This section develops the accident sequences which are to be quantified in order to provide an estimate of core damage frequency.

4.1.2 Assumptions Several assumptions were made at the outset of the study to simplify the analysis and provide meaningful results. These assumptions are as follows:

4.1.2.1 Loss of offsite power: It was determined that the only seismic events which are of concern in this study are those which cause loss of offsite power (LOOP). Seismic events of lower ground-motion than those causing LOOP are expected to have a negligible probability of causing severe plant accidents for two reasons. First, critical plant equipment, including the residual heat removal (RHR) system, is designed for significantly higher seismic acceleration than that which is sufficient to cause LOOP. Indeed, as shown in Chapter 5 following, the seismic capacity of the offsite power system is significantly lower than the systems and components necessary to maintain core cooling. Thus, loss of core cooling capability for seismic events less than those causing a LOOP initiating event will have a negligible probability.

Second, with off site power available, sources of water sufficient to cool the core from alternate pumping sources would be available even if the RHR system fails. Thus, only LOOP-initiated accidents are considered in this study.

4.1.2.2 LOOP recovery: It has been assumed that seismic-initiated LOOP is non-recoverable in the time frame of interest in this study (from about one to many hours). While this is a slightly conservative assumption, it is considered reasonable because the LOOP initiator is most likely to be failure of the ceramic insulators in the plant substation (see Chapter 5).

Replacement of these insulators would very likely require more than a few hours. Further-more, other damage caused by the earthquake would likely hamper efforts to repair the switchyard. Offsite damage to other parts of the electrical power grid that supplies power to the plant would also be expected, which would likely delay efforts to restore offsite power.

Thus, recovery of off site power is not considered likely after an earthquake large enough to cause LOOP, and has been ignored.

4.1.3 BNL Event Tree for POS 6 In order to develop accident sequences for the study, seismic shutdown event trees were developed based on applicable event trees from the BNL study. These event trees identify the functions and systems which are important in evaluating the progression of accidents during shutdown conditions following the occurrence of a seismic event. As indicated previously, two plant operating states (POSs) are of interest in this study, POS 6 and POS 10. This section considers the POS 6 event tree from the BNL study.

Vol. 5 4-1 NUREG/CR-6144 L_

l The development of the event trees appropriate for this study involved extracting and

• modifying the appropriate event trees from the BNL study on shutdown risks (Ref. BNL, 1994),

and identifying core damage accident sequences appropriate to a seismic initiated loss of offsite power event. It was determined in the BNL study that plant operating states 6 and 10 during refueling shutdown were the most significant plant states in terms of core damage accident vulnerability. These states involve so-called mid-loop operation wherein the water inventory in the primary system is reduced, which means that less water is available for core cooling if RHR is lost. Further details are provided in the BNL study (Ref. BNL, 1994).

The appropriate event trees from the BNL study are those which examine the accident sequences from LOOP for POSs 6 and 10. The BNL event tree for POS 6 is shown, modified somewhat for clarity, as Figure 4-1. The event headings are defined as follows:

4.1.3.1 Power to RHR: This event, following LOOP, is manual connection of the RHR pumps to the stub bus which is powered by the emergency AC power system. The operator must take manual action to connect the RHR pumps to the stub bus. This is an assumption made in the BNL study (Ref. BNL, 1994), and was confirmed during a site visit on October 27 and 28, 1993.

4.1.3.2 RCS Vent: This is not technically an event during the accident, but is a preexisting plant condition that is important for subsequent evaluation. According to the BNL study, this vent condition involves removal of three pressurizer safety relief valves for maintenance. A probability of 0.1 was estimated by BNL for this condition based on information from the plant, and this value.has been adopted for this seismic analysis. (Actually, BNL used a time-window approach in their analysis for internal initiators, but in this seismic analysis the additional refinement of the time-window approach is not necessary.)

4.1.3.3 RCVR PWR: This event is the probability that offsite power would be recovered in time to influence the probability of subsequent events. As noted previously in this section, this event is not considered in the seismic-initiated LOOP case.

4.1.3.4 F & B Secondary: This function signifies the feed-and-bleed cooling operation using the steam generators. This activity maintains core cooling by natural circulation of the primary system water through the steam generators. The feed is accomplished normally by auxiliary f eedwater, but other water sources may also be available. The bleed operation is through the steam generator relief valves. This cooling mechanism is assumed to be unavailable if the primary system is vented because natural circulation would not occur. This is consistent with the BNL study.

4.1.3.5 F & B Primary: In this case, core cooling is provided by feed-and-bleed of the primary.

Feed is by one of the high-pressure emergency core cooling injection systems, and bleed is ac-complished by venting out the pressurizer (which is already available for the RCS Vent case).

4.1.3.6 Gravity Feed: This event is a gravity-feed mode in which appropriate valves are opened to allow water from the refueling water storage tank (RWST) to flow through the low pressure injection system into the primary system. This cooling mode requires that the reactor coolant system be vented, as shown by the event tree logic.

4.1.3.7 Other Modes: This event represents the restoration of other modes of decay heat removal capability, for example, feed-and-bleed of the primary system, after gravity feed of R WST inventory has been initially established. Consideration of this event is necessary because the gravity feed mode is not sufficient to provide sufficient cooling beyond a few hours.

NUREG /CR-6144 4-2 Vol. 5

4.1.4 Seismic Shutdown Event Tree for POS 6 The BNL event tree for POS 6 for the loss of offsite power event was modified to provide a seismic shutdown event tree which was used in this study to estimate core damage frequency.

This modified tree is shown in Figure 4-2. The event tree contains functions (top row) corresponding to the BNL tree, with some modifications to be considered, and also contains equipment associated with each function in the second row. The equipment items identified are judged to be the most fragile component(s) that can cause failure of the associated function.

The judgment is based on the results of a previous seismic core damage assessment for Surry at full power conditions (Ref. Bohn et al., 1990) as well as a plant walkdown to examine in detail each system which supports the function. System drawings were also obtained and examined to determine the most fragile critical components for each system. Section 4.2 provides additional information regarding the process used for selecting equipment. Each heading of the event tree will be considered separately, as follows:

4.1.4.1 LOOP: This event is loss of offsite power. The most likely mechanism to cause LOOP is failure of the ceramic insulators in the switchyard. This failure mechanism was also identified as the most likely in the previous Surry seismic analysis (Ref. Bohn et al., 1990). If LOOP does not occur, it is assumed that core damage has a negligible probability, and subsequent events are not considered (see previous discussion in Section 4.1.2).

4.1.4.2 Stub Bus: This event involves the connection of the stub bus AC power to the RHR pumps. As noted previously, at the Surry plant this requires a manual action by the control room operator. It was determined that the limiting probability for failure of this event would be human error, or failure of the plant operator to connect the RHR pumps. As indicated in the tree, the top branch for this event is for the case where the human error does not occur (the stub bus is successfully connected to the RHR pumps), while the lower branch considers the case where the operator fails to make the connection. The human error modeling for this case is considered in Section 4.3. If the operator fails to connect the RHR pumps to the stub bus, then the RHR function (considered next) is unavailable, as shown on the tree.

4.1.4.3 RHR: This event is failure of the Residual Heat Removal function due to, seismic failure of RHR components. In this case, it was determined that three critical components had the potential to fail during a seismic event: the component cooling water heat exchanger (which provides cooling to the recirculating RHR system water), the RHR pumps, and the RHR heat exchanger. If the RHR system has not failed because of the seismic failure of any of the components considered, then core damage is avoided unless emergency power (to be considered later) fails, as shown by the tree.

If RHR fails by any of the three component failures, then alternative means of core cooling must be considered, as indicated on the tree.

4.1.4.4 No RCS Vent: This event is not affected by the seismic event, but is a pre-existing condition which is important for subsequent events. This condition is the removal of the three pressurizer relief valves as noted in Section 4.1.3.2 above. If the RCS vent condition does not exist (top branch under this heading) then secondary feed-and-bleed is considered as a sub-sequent core cooling mechanism. However, if the RCS is vented (bottom branch), then secondary feed-and-bleed is not considered because the primary system vent condition is assumed to interrupt the natural circulation cooling in the primary system as indicated in the BNL study.

Vol. 5 4-3 NUREG /CR-6144

4.1.4.5 Secondary F & B: The secondary feed-and-bleed event is the same as described in Section 4.1.3.4 above for the BNL event tree. The most fragile component supporting this function is the condensate storage tank. No other components were found which had the potential to be significant contributors to failure. However, because this cooling mode requires manual actions, human error is also considered as a failure mechanism. If Secondary F&B is successful (top branch), then core cooling is provided as long as emergency power is available to power the auxiliary f eedwater pumps, as indicated in the tree. If Secondary F&B is not successful, then primary feed-and-bleed must be considered as shown.

4.1.4.6 Primary F & B: This function, primary feed-and-bleed, is the injection of water into the primary system and venting from the pressurizer as discussed for the BNL event tree in Section 4.1.3.5 above. For this function, the refueling water storage tank (RWST) was found to be the dominant seismic failure mode. However, as with Secondary F&B, this activity requires human action to be successful. Accordingly, human error is also considered. If primary feed-and-bleed is successful, core cooling is maintained as long as emergency power is available (as indicated on the tree). If primary feed-and-bleed fails, then all sequences lead to core damage as shown.

4.1.4.7 Emergency AC Power: This event represents the emergency on-site power function.

It is provided by the emergency diesel generators. Three failure modes are considered for this event: fuel oil day tank failure, con:trol panel failure, and the motor control centers which distribute the electrical power to various items of equipment. If the AC power function fails, then core damage occurs, as indicated by the tree.

Note that the gravity-feed mode considered in the BNL event tree as discussed in Section 4.1.3.6 is not considered on the seismic shutdown tree for POS 6. This is because the gravity-feed mode requires the RWST as a source of water. If the RWST is available, then the primary feed-and-bleed function is available and would be the preferred method of decay heat removal.

Also, as noted in Section 4.1.3.6, success of the gravity-feed mode requires subsequent restoration of some other means of decay heat removal after a few hours. For the seismic event, this is not considered probable because the restoration of equipment failed by a seismic event would likely not be feasible in a short time frame.

The POS 6 Event Tree provides a total of 41 core damage sequences as shown on Figure 4-2.

4.1.5 BNL Event Tree for POS 10 Figure 4-3 illustrates the BNL event tree for a loss of offsite power event when the plant is in POS 10. This figure is taken from BNL's study (Ref. BNL, 1994) and has been modified slightly for clarity. The following events or functions are covered by the tree:

4.1.5.1 LOOP: This is the loss of offsite power initiating event.

4.1.5.2 Power to RHR: This event covers the possibility of loss of electrical power to the RHR pumps. If power is not lost, the core remains cooled by the RHR system.

4.1.5.3 RCS Vent: This is a pre-existing condition which can occur and influence subsequent events. As explained in Section 4.1.3.2, this event covers the case wherein the pressurizer relief valves have been removed, providing a flow path out of the primary system. If vent occurs, then gravity is an option for cooling because the low pressure gravity flow is able to flow through the primary system and out the vent.

NUREG /CR-6144 4-4 Vol.5.

4.1.5.4 Recover PWR: This event considers the probability that offsite power is recovered in time to provide power to injection pumps for feed-and-bleed cooling of the primary system.

If this power is not recovered, then the feed-and-bleed function must consider the availability of emergency power.

4.1.5.5 F & B Primary: This event covers the feed-and-bleed mode of cooling the core in the primary system. Emergency core cooling injection pumps are used, and venting is provided by the pressurizer relief valves. They must be manually opened if the RCS Vent function is not a pre-existing condition.

4.1.5.6 Gravity Feed: This cooling mode involves gravity flow from the refueling water storage tank (R WST) through the low pressure injection system. As shown on the tree, it is only considered if the primary system has been previously vented by removal of the relief valves because a large primary system opening is necessary to provide sufficient gravity flow.

4.1.6 Seismic Shutdown Event Tree for POS 10 An event tree was developed for POS 10 based on the BNL LOOP event tree, in a manner similar to the development of the seismic shutdown event tree for POS 6. This tree is illustrated in Figure 4-4. The tree provides both a function (top row) and the equipment failures which were found to be important to support each function. As with the POS 6 event tree, the equipment was identified based on fragility and other information from a previous Surry seismic analysis at full power (Ref. Bohn et al., 1990), and a plant walkdown to examine the systems which perform each function. Each event in the tree is discussed in the sub-sec-tions which follow .

• 4.1.6.1 LOOP: This event is loss of off site power. As discussed in Section 4.1.4.1 preceding, the most likely mechanism to cause LOOP is failure of the ceramic insulators in the switchyard based on an examination of the offsite power system. This failure mechanism was also iden-tified as the most likely in a previous Surry seismic risk analysis (Ref. Bohn et al., 1990). If LOOP does not occur, it is assumed that core damage has a negligible probability, and subsequent events are not considered (see discussion in Sect. 4.1.2.1).

4.1.6.2 Stub Bus: This event involves the connection of the stub bus power to the RHR pumps.

As noted in Section 4.1.3.1, at the Surry plant this requires a manual action by the control room operator. It was determined that the limiting probability for failure of this event would be human error, or failure of the plant operator to connect the RHR pumps. As indicated in the tree, the top branch for this event is for the case where the human error does not occur (the stub bus is successfully connected to the RHR pumps), while the lower branch considers the case where the operator fails to make the connection. The human error modeling for this case is considered in Section 4.3. If the operator fails to connect the RHR pumps to the stub bus, then the RHR function (considered next) is unavailable, as shown on the tree.

4.1.6.3 RHR: This event is failure of the Residual Heat Removal function due to seismic failure of RHR components. As indicated in Section 4.1.4.3, it was determined that three critical components had the potential to fail during a seismic event: the component cooling water heat exchanger (which provides cooling to the recirculating RHR system water), the RHR pumps, and the RHR heat exchanger. If the RHR system has not failed by the seismic failure of any of the components considered, then core damage is avoided unless emergency power (to be considered later) fails, as shown by the tree. If RHR fails by any of the three component failures, then alternative means of core cooling must be considered as indicated on the tree .

• Vol. 5 4-5 NUREG/CR-6144

l 4.1.6.4 No RCS Vent: This event is not affected by the seismic event, but is a pre-existing

• condition that is important for subsequent events. This condition is the removal of the three pressurizer relief valves as noted in Section 4.1.4.4 above. If the RCS vent condition does not exist (lower branch under this heading) then gravity feed is considered as a subsequent core cooling mechanism because the large vent area will allow gravity flow through the primary system. However, if the RCS is not vented (bottom branch), then gravity feed is not considered because the primary system would not allow sufficient flow to provide cooling, according to the BNL an~lysis. This logic is shown on the event tree.

4.1.6.5 Primary F & B: This function, primary feed-and-bleed, is the injection of water into the primary system and venting from the pressurizer as discussed in Section 4.1.5.5. For this function, the refueling water storage tank (RWST) was found to be the dominant seismic failure mode. However, this activity requires human action to be successful. Accordingly, human error is considered. If primary feed-and-bleed is successful, core cooling is maintained as long as emergency power is available (as indicated on the tree). If primary feed-and-bleed fails due to seismic failure of the RWST, then all sequences lead to core damage as shown because the gravity-feed cooling event also requires the RWST. If, however, the failure mode of primary feed-and-bleed is a human error with the RWST intact, then gravity feed is considered, as shown on the tree.

Note that secondary feed-and-bleed is not considered on this tree because, according to the BNL study, all three primary coolant loops are isolated in POS 10 such that the steam generators are unavailable.

4.1.6.6 Emergency AC Power: This event represents the emergency on-site power function.

It is provided by the emergency diesel generators and associated electrical distribution equipment. Three failure modes are considered for this event: fuel oil day tank failure, control panel failure, and the failure of motor control centers that distribute the electrical power to various equipment items. If the AC power function fails, then core damage occurs for all cases except for the case when the RWST is intact and the RCS has been vented, as shown in the tree. In these cases, gravity feed remains as a cooling option.

4.1.6.7 Gravity Feed: This event involves manually opening a path between the RWST and the primary system through the low pressure injection system to allow gravity flow through the core and out the pressurizer relief valve openings. Accordingly, this cooling method is only considered if the R WST remains intact following the seismic event, and the primary system has been vented by removal of the pressurizer relief valves.

This cooling mode is considered viable for POS 10 because the decay heat generation rate is lower than for POS 6. According to the BNL study, in POS 10 gravity feed can provide sufficient core cooling acting alone, unlike the condition for POS 6.

The event tree in Figure 4-4 depicts a total of 27 core damage sequences. The quantification of these sequences, as well as those derived in Section 4.1.4 for POS 6, is described in Chapter 6.

4.2 Selection of Components The selection of components involved the following process. First, the functional event trees were derived based on the BNL event trees and associated discussion as given in Section 4.1.

From the functional event trees, systems available to perform each function were determined NUREG/CR-6144 4-6 Vol. 5

from the BNL study (Ref. BNL, 1994), a previous Surry seismic risk study (Ref. Bohn et al.,

1990), and other information obtained from the plant visit. For each system, components were identified based on system information from the same sources. An initial screening was performed to eliminate components which are known to have high seismic capacity from previous studies and confirmed by a walkdown at the Surry plant. Such components include most valves,'most piping, and other components which have been found to be rugged from past seismic evaluations. For those components remaining, a seismic screening capacity evaluation was performed based on information obtained during the plant walkdown, supplemented by system drawings. This evaluation resulted in the elimination of additional components which had high capacity. For the remaining components, a fragility assessment was performed to establish the probability of failure as a function of input acceleration. These components appear in the event trees for POSs 6 and 10 as discussed in Section 4.1. A detailed discussion of the seismic fragility evaluation, as well as a listing of all components examined, is given is Chapter 5.

4.3 Operator Reliability This section describes the operator reliability model that was used when quantifying the accident sequences. The event trees each contain three human errors. For the POS 6 tree (Figure 4-2), the errors are: failure to connect the stub bus to the RHR pumps, failure to initiate secondary feed-and-bleed, and failure to initiate primary feed-and-bleed. For the POS 10 event tree (Figure 4-4), the errors are: failure to connect the stub bus to the RHR pumps, failure to initiate secondary feed-and-bleed, and failure to initiate gravity feed. It is necessary to assign failure (and success) probabilities to these events in order to quantify the trees. The remaining parts of this Section provide the derivation of the human error model.

4.3.1 Human Error as a Function of Acceleration Level It was assumed at the outset that the human error probabilities would be independent of the magnitude of the seismic event. This was done because virtually no data could be found that could be used to relate human error probability to the magnitude of the seismic event. This assumption is considered valid because the dominant core damage contribution comes from a relatively narrow range of accelerations. Thus, the probability of human error would not be expected to vary significantly over this rather narrow range.

4.3.2 Initial Human Error The first human error to be considered is failure of the operator to connect the stub bus to the RHR pumps. This action occurs in both event trees considered in the study. This is a fairly simple task which can be accomplished locally from the Emergency Switchgear Room.

However, given the large seismic event which has occurred, coupled with a loss of offsite power, it is obvious this will be an extreme stress situation, with the operator likely to be preoccupied with personal concerns. According to the Brookhaven study (Ref. BNL, 1994), a minimum of 42 minutes is available before boil down of the coolant in the primary system. To establish a human error rate under these conditions, the work of Swain & Guttmann (Ref.

Swain & Guttmann, 1980) was used. According to Table 20-26 of this reference, a mean human error probability of 0.1 is estimated, given a high stress condition and 30 minutes to several hours to take action. Thus, it was assumed that 90% of the time, the operator would success-fully connect the RHR pumps to the stub bus, and would fail to do so 10% of the time. This value is considered highly uncertain, and is thus the subject of a sensitivity study as d*ocumented below in Section 6.2.

Vol. 5 4-7 NUREG/CR-6144

4.3.3 Subsequent Human Errors In both the POS 6 and POS 10 event trees (Figures 4-2 and 4-4), human actions need to be considered following the event described in the preceding section. There are two circumstances considered for these subsequent events: human error given that the initial error has been committed, and human error given that the initial error has not been committed. It is considered that if the initial error has been committed, subsequent errors will be more likely than if the initial error has not been committed. Thus, the following model is assumed, based on judgment and information in (Ref. Swain & Guttmann, 1980): If the initial error has not been committed, then all subsequent errors are given a mean probability of 0.01 to account for the expected improved performance after successful completion of the first action. For those actions needed after the first error has been made, it is assumed that the mean error probability remains at 0.1. This is based on the fact that the time available'will not increase appreciably, and that additional failures have occurred to equipment which will tend to maintain a high stress condition. Again, these values are considered highly uncertain, and have been subject to a sensitivity study as discussed below in Section 6.2.

In all cases, the human errors derived above are mean values. Uncertainty bounds have been estimated based on judgment and information contained in (Ref. Swain & Guttmann, 1980).

• The basic human error rates and the uncertainty bounds are provided in Table 4-1.

4.4. Consideration of Outage Duration 4.4.1 Introduction This section provides a discussion of the estimated duration, in hours, for the plant operating states of interest in this study. This time interval is important in estimating the annual core damage frequency from seismic events because the estimate must account for the fraction of the time during a given year that the plant is in an operating state of interest.

4.4.2 Plant Outages Only refueling outages were considered in this seismic analysis. Outages for other reasons frequently occur at nuclear power plants, and they are of two broad types: controlled shutdowns and uncontrolled (rapid) shutdowns. These outages, for reasons other than refueling, can produce the same plant operating states but with unique configurations based on the reason for the shutdown. However, this analysis did not examine outage configurations other than those for mid-loop operations during refueling. The reason for this limitation is because it was outside our scope, and because the companion study from which this analysis derived considerable input information (Ref. BNL, 1994) also considered mid-loop states during refueling. In any event, refueling outages contribute a majority of the shutdown time.

4.4.3 Refueling Outage Duration for Surry Unit 1 As part of the BNL shutdown risk study (Ref. BNL, 1994), an evaluation was completed to estimate the time that the Surry plant was in various plant operating states during shutdown.

In this study, we are interested only in Plant Operating States (POSs) 6 and 10, the mid-loop-operation POS states, because these are the POSs that Brookhaven studied in their internal-events analysis (Ref. BNL, 1994). They are also the most important shutdown states from the standpoint of vulnerability to loss of decay heat removal. POS 6 represents mid-loop operation before refueling, while POS 10 represents mid-loop operation after refueling.

NUREG/CR-6144 4-8 Vol.5.

• Brookhaven identified two different states for POS 6, which they called R6 and D6 (see Ref.

BNL, 1994), but for our purposes here this time-window distinction is not important.

Brookhaven also used a time-window approach to account better for decay-heat differences in the POS states, but again this distinction is not important here. Therefore, we will use the summed values for the times per year in refueling-related POS 6 and POS 10. These are found in Table 4-2. Note that the fractions of the time in POS 6 and POS 10 are 5.1% and 1.5%,

respectively.

Vol. 5 4-9 NUREG/CR-6144

('

TABLE 4-1 HUMAN ERROR RATES AND UNCERTAINTY BOUNDS FOR POS 6 AND 10 ACTIVITY ERROR RATES 5% upper bound Mean 95% lower bound A. Stub Bus Connection 0.5 0.1 0.02 to RHR Pumps B. All Subsequent Events 0.5 0.1 0.02 Given Failure of A C. All Subsequent Events 0.1 0.01 0.001 Given Success of A TABLE 4-2 DURATION OF SURRY-1 IN PLANT OPERATING STATES 6 AND 10 A VERA GE OUT AGE DURATION Fraction of Year Hours per Year POS 6 0.051 444 hr POSlO 0.015 131 hr NUREG/CR-6144 4 - 10 Vol. 5

• .---------------i PWRto RHR RCS Vent RCVR PWR F& B Secondary F& B Primary Gravity Feed Other Modes I

I I CD LOOP I CD I

I I CD I CD CD CD Figure 4-1: Event Tree for POS 6 from BNL Study (modified for clarity)

Vol. 5 4 - 11 NUREG/CR-6144

LOOP Stub Bus RHR NoRCSVnt Secondary F&B PrimaryF&B EmerPwr Cl Not HE CCW Hex I Pumps IRHR Hex SIR Valves CST I NotHE RWST I NotHE EOG OK OK C01 OK CO2 OK C03 C04 C05 OK C06 C07 cos OK cos C010 C011 OK C012 OK Seismic C013 C014 Event C015 SE OK C016 C017 C018 OK C019 C020 C021 OK C022 OK C023 C024 C025 OK C026 C027 C028 OK C029 C030 C031 OK C032 OK C033 C034 C035 OK C036 C037 C038 OK C039 C040 2HD SOI nb1SE-FLWC1 C041 Figure 4-2: Seismic Event Tree for POS 6 NUREG /CR-6144 4 - 12 Vol. 5

• PWR to RHR RCS Vent RCVR PWR F&B Primary Gravity Feed I

LOOP 0.1 I CD I

I CD CD 0.9 CD Figure 4-3: Event Tree for POS 10 from BNL Study (modified for clarity) 4 - 13 NUREG /CR-6144 Vol. 5

LOOP Stub Bus RHR No RCS Vnt Primary F & B Erner Pwr Gravity Fd Cl Not HE CCW Hex I Pumps IRHR Hex S/R Valves RWST I NotHE EOG RWST I Not HE*

OK OK CD1 I I OK I OK CD2 I

CD3 OK I CD4 I I CDS I CDS OK I OK I CD7 I I OK I CDS CD9 OK I CD10 I

CD 11 I CD12 Seismic OK Event - .I I

OK SE CD13 I I OK I

I I I CD 17 I CD18 OK I

OK I CD 19 I . I oi<

I CD20 CD21 OK I CD22 I

CD23 I

CD24 OK I

OK I CD25 I I OK I CD26 CD27 Figure 4-4: Seismic Event Tree for POS 10 NUREG/CR-6144 4 - 14 Vol. 5

5. SEISMIC FRAGILITY EVALUATION FOR SURRY 5.1 Introduction In this Chapter, the details concerning the seismic fragility evaluation for Surry be discussed.

Section 5.2 will discuss the seismic walkdown, and Section 5.3 will discuss the seismic fragility evaluation.

5.2. Seismic Walkdown of Surry 5.2.1 General The seismic walkdown of Surry Power Station Unit 1 was performed in October, 1992 and included the following personnel:

Michael Kacmarcik Virginia Power William Gallagher Virginia Power Thomas Hsu Virginia Power Robert Budnitz Future Resources Associates Peter Davis PRD Consulting MK. Ravindra EQE Wen H. Tong EQE.

The purposes of the seismic walkdown were to:

1. Pre-screen all equipment items that have sufficiently high seismic capacities.

2. Clearly define the failure modes of components which are not pre-screened. Review and gather detailed information and measurements on equipment and structures for performing seismic fragility evaluations.

3. Identify spatial system interaction (SI) concerns that are judged to be potentially serious problems (such as heavy, questionably secured space heaters or ceiling fixtures over critical batteries, etc.)

One of the primary objectives of the seismic walkdown was to screen all equipment items that are judged to have High Confidence of Low Probability of Failure (HCLPF) capacities higher than 0.3g peak ground acceleration (pga).

• Prior to the walkdown, an initial list of components was made available based on the components modeled in the internal event fault trees that were judged to be critical from a seismic standpoint. Using the plant layout drawings the e 4 uipment locations were identified.

The following provides a list and brief discussion of the structures and equipment identified Vol. 5 5- I NUREG /CR-6144

as target areas for seismic walkdown review.

Yard Equipment and Structures: Yard equipment and structures reviewed during the walkdown included:

o Auxiliary Building o Service Building o Safeguards Building o Emergency Generator Enclosure o Essential Service Water Pumphouse o Emergency Condensate Water Storage Tanks o Refueling Water Storage Tanks o Emergency Condensate Make-up Tanks o Underground Fuel Oil Tanks.

A cursory walkdown was performed on the turbine building since only the component cooling water heat exchangers are located in this building. The concrete internal structure and the containment building were not reviewed since both units were in operation. Seismic review of these structures was performed using primarily the as-built structural drawings.

Equipment: The Surry plant layout drawings were reviewed prior to the walkdown to locate mechanical and electrical equipment identified on the equipment list. Seismic Evaluation Walkdown Sheets (SEWS) were prepared for each component to record detailed information for fragility evaluation.

All of the major equipment components identified by the system analysts were reviewed during

• the walkdown in accordance with the procedures discussed in the section below. Generically reviewed components included piping, valves, ducting, cable trays, and instrument racks.

5.2.2 Walkdown Procedures 5.2.2.1 Structures: Information necessary for seismic evaluation of civil structures is normally obtained from design drawings rather than walkdowns. Drawings are reviewed to obtain a general understanding of construction and configuration of the structures and to identify any specific data to be obtained during the walkdown. The walkdown of structures is to determine the following:

o Verify that the structures are in general conformance with the design drawings o Identify any gross deficiencies that might result in reduced capacities o Confirm that structural separations indicated on the drawings are provided o Obtain structural details not available from the drawings.

5.2.2.2 Equipment: Components which were reasonably accessible and located in non-radio-active or moderately radioactive environments were reviewed. To assess components in high-radioactive environments, or within contaminated containment, smaller inspection teams and more hurried inspection were employed. For components which were not accessible, the equipment inspection relied on alternate means such as p~10tographic inspection and seismic reanalysis.

NUREG/CR-6144 5-2 Vol. 5

• In the event that the walkdown team had a reasonable basis for assuming that a group of components is similar and is similarly anchored, then only a single component of this group was inspected. The "similarity-basis" was developed during the walkdown. The one component of each type which was selected was thoroughly inspected. The other components were then reviewed during the walkdown to ensure similarity with the selected unit. Outliers, lack of similarity, anchorage which was different from that shown on drawings or prescribed in the criteria for that component, potential SI problems, situations that are at odds with the team members' past experience, and any other areas of concern were looked for during the walkdown. When such concerns surfaced, the limited sample size of one component of each type for thorough inspection was increased. The increase in sample size which should be inspected depended upon the number of outliers and different anchorages, etc., which were observed. The following provides specific procedures used for the review of different classes of equipment inspected during the walkdown.

Tanks. Design drawings for the tanks and their foundations and or supports were reviewed to obtain a general understanding of the tank configurations and anchorage details. Walkdown procedures for the tanks included the following:

o Verification that the overall tank configuration and anchorage details conform with the design drawings.

o Review of piping flexibility and other attachments to identify any potential sources of damage due to seismic anchor movement.

o Inspection of any unique features, which are not common to tanks, but are identified during a review of the drawings.

o Identification and inspection of potential sources for seismic interaction.

Pumps. Historical performance during past earthquakes of horizontal and vertical pumps has shown high seismic capacities. The walkdown procedures concentrated on:

o Verifying pump and motor anchorage including type of anchorage, foundation configuration and integrity.

o Reviewing potential nozzle loads and piping flexibility.

o Identifying interaction potential from attached or adjacent components.

Heat Exchangers. Walkdown procedures for heat exchangers concentrated on:

o Reviewing the supports including support saddles and anchorage details between the saddles and the concrete piers.

o Reviewing nozzle loads and piping flexibility.

o Identifying interaction potential from attached or adjacent components.

SEWS sheets were used to record configuration and dimensional data from the walkdown for heat exchanger support, anchorage, and attached or adjacent component interaction potential details that were not available from the plant data reviewed prior to the walkdown.

Vol. 5 5- 3 NUREG/CR-6144

Diesel Generators. Past performance of diesel generators demonstrates their lower bound . ;

capacity levels higher than 0.5g pga. The walkdown procedures concentrated on:

o Reviewing anchorage and support integrity, noting if any vibration isolators were present.

o Reviewing the peripherals such as engine control panel, diesel day tank, fuel oil lines, air intake and exhaust ducting, and starting air receiver for positive anchorage.

SEWS sheets were used during the walkdown to record any problem areas encountered.

Electrical Distribution Equipment. Walkdown procedures for electrical distribution equipment included:

o Reviewing and collecting anchorage details of the cabinet or enclosures for subsequent analytical review.

o Verifying that the internal instruments and components are positively attached to the cabinet framing or enclosure walls and that the device mountings are not excessively flexible.

o Identifying any system spatial interaction problems or flood or spray concerns.

Past performance of electrical distribution equipment during earthquakes suggests lower bound seismic capacities to exceed 0.5g pga, providing the equipment and internals, instruments, breakers, contactors, etc., are properly anchored.

HY AC. Two procedures for reviewing the HY AC equipment were used:

o For HVAC equipment found mounted on vibration isolators, a detailed walkdown review was performed.

o For HV AC equipment found positively anchored to a supporting structure, an engineering judgmental evaluation was performed and documented during the walkdown.

HY AC equipment positively anchored, as well as vibration isolator supported equipment with positive lateral restraints, have performed well during past earthquakes.

The review for HY AC equipment mounted on vibration isolators included recording the dimensional data and support configuration sufficient to perform an analytical evaluation after the walkdown.

The review of components in the second case included air intake and exhaust dampers, and exhaust fans. The walkdown review assessed anchorage and any seismic deficiencies present in order to judge that the component has a high seismic capacity. The predominant form of documentation for these components was the use of photographs to record the walkdown findings.

HY AC Ducting. The walkdown procedures consisted of two approaches:

o Inspecting samples of the ducting system selected during the walkdown.

NUREG/CR-6144 5-4 Vol. 5

o Inspecting the ducting in close proximity to the HVAC equipment components reviewed.

This includes:

i) Vertical and lateral load resisting members of the ducting ii) Any possible anchor point displacements that could impart significant loads to connected ducting Documentation consisted of noting any anomalies and taking several photographs.

Valves. Walkdown procedures consisted of a review of valves identified in the equipment list.

Areas of concern reviewed during the walkdown included observing interaction potential between the valve operator and adjacent structure or component, evaluation of oversized or eccentric operators, and reviewing possible anchor point displacements between piping and valve. SEWS were used to document the walkdowns, and similar valves were reviewed by a less detailed walkby to verify similarity and to verify the absence of a seismic-interaction concern.

Piping. Past seismic PRA studies and earthquake experience data have shown that welded steel piping systems have a very high resistance to seismic loads.

Two piping failure modes that were addressed during the walkdown include:

o Impacting failures of valve operators o Damage to piping caused by the failure of anchorage of attached equipment.

The valve clearance issue and the equipment anchorage issue were addressed in the evaluation of the specific equipment component and not as a part of the piping review.

The procedure for walking down the piping system included following the piping layout drawings to verify support locations, assessing system interaction potential to the piping, and noting detailed configuration information for piping details that were judged to be of potential concern. Particular attention was placed on evaluation of nonseismic piping, such as fire protection piping, and potential impacts on critical components.

Cable Trays. Inspection of the cable trays was performed with a general survey of cable tray systems in the plant. This general survey was performed to obtain an overview of cable tray construction throughout the plant. This included a review of the variety of cable tray system layouts, support configurations, and construction details. The inspection also considered items identified as being of potential concern, including failure of taut cables due to large relative displacement, severing of cables caused by sharp edges at the ends of cable trays, and weld failure.

Instrument Racks. Walkdown procedures of instrument racks consisted of:

o Reviewing and collecting anchorage details of instrument racks supporting instruments.

o Reviewing and verifying positive attachment of the instruments and components to the racks.

o Identifying seismic spatial interaction concerns to instrument tubing or air lines due to seismic failure of adjacent equipment.

• Vol. 5 5-5 NUREG/CR-6144

5.2.3 Walkdown Documentation Walkdown documentation for equipment and structures consisted of recording the findings using SEWS farms (Figures 5.2-1 and 5.2-2) and photographs (Figures 5.2-3 through 5.2-18). The SEWS forms were developed for each particular class of component indicating specific information required to confirm the high seismic capacity of the component in place as well as to record details sufficient to perform a seismic fragility evaluation if necessary. The SEWS forms reflect the varying levels of information required between different classes of equip-ment depending on their seismic ruggedness (e.g. pumps require little review other than to verify anchorage and interaction potential whereas HY AC components supported by vibration isolators require a detailed* review, and thus a greater amount of information must be recorded for a fragility evaluation).

Photographs were also used to record details of the equipment walkdown review. Photographs provide a permanent record of what was reviewed and support any notes or details taken during the walkdown. System interaction concerns were typically documented with photographs. Additionally, photographs were used in the fragility evaluation to confirm details taken in the walkdown or to provide additional clarification.

5.2.4 Walkdown Findings 5.2.4.1 Structures Safety Related Structures: The following safety related structures were surveyed during the walk down:

o o

o o

Auxiliary Building Service Building Emergency Genera tor Enclosure Essential Service Water Pumphouse o Safeguards Building.

These structures are constructed of reinforced concrete except the service building which consists of a structural steel superstructure and a reinforced concrete substructure.

Information required to develop structural fragilities is obtained primarily from the structural drawings. Thus, the seismic walkdown review of building structures was limited to verification of building separations and identification of block walls which may pose a seismic interaction concern to safety related equipment components.

Block Walls: Masonry block walls that are located adjacent to safety related equipment were noted in several places such as the 125V DC battery enclosures (Figures 5.2-3 and 5.2-4), the control room, and the oil storage room of the ESW pumphouse. Seismic retrofits resulting from the I.E. Bulletin No. 80-11 activities were observed at these masonry walls. In the I.E. Bulletin 80-11 reevaluation effort, all safety related masonry block walls in the Category I structures of Surry Station were identified and were modified subsequently as needed.

Yard Tanks: Ground mounted storage yard tanks included in the walkdown are the emergency condensate water storage tank (CST), emergency condensate makeup tank, refueling water storage tank (R WST), and underground fuel oil tanks. The CST is a large diameter vertical storage tank completely enclosed in a reinforced concrete structure (Figure 5.2-5). It is NUREG/CR-6144 5-6 Vol. 5

• marginally anchored to the concrete foundation with only four (4) anchor bolts. Detailed information for fragility evaluation is obtained from vendor drawings and foundation drawings.

The emergency condensate makeup tank is a 100,000 gallon horizontal tank half-buried and continuously supported on well compacted backfill. The tank is enclosed with a reinforced concrete structure (Figure 5.2-6). The diesel fuel oil storage tanks are horizontal tanks buried underground. The tanks are accessible only through reinforced concrete hatches at the plant grade. Review of these tanks relied on the drawings.

The RWST is a vertical flat bottom storage tank with a nominal radius of 19 feet. The height of the contents is about 47 feet. The tank is sprayed with light weight insulation material (Figure 5.2-7). Thus, details of bolt and bolt chairs were not visible. The adjacent tall vessel, refueling water chemical additive tank, as noted in Figure 5.2-7 is a potential seismic interaction source that could impact the RWST. Details for the RWST fragility evaluation were obtained from vendor drawings and foundation drawings.

5.2.4.2 Equipment The Surry seismic walkdown reviewed the majority of the equipment components included in the study except RHR pumps and RHR heat exchangers which are located inside the containment. The following provides brief summaries for various classes of equipment reviewed during the walkdown.

Cable Trays: Cable tray systems in the plant were sampled. Both trapeze and floor mounted supports were observed as shown in Figure 5.2-8 and 5.2-9. No seismic deficiency was noted.

Mechanical Equipment: With few exceptions, the mechanical equipment including piping, valves, pumps, vessels and heat exchangers, was well anchored and appeared rugged in construction. Based on our experience with similar equipment in past earthquakes and in conducting other PRAs, we do not expect mechanical equipment in general to be dominant contributors to seismic risk. Each of the exceptions noted during the seismic walkdown is discussed next.

Low Head Safety Injection (LHSI) Pumps: These are long shaft vertical pumps located at Elevation 13 feet of the safeguards building. The pump casing is laterally supported at the top*

(Elevation 13'-4") and bottom (Elevation -28'-l"). The upper lateral support of the casing consists of a pair of upper and lower steel angle brackets which are anchored to the contain-ment wall as shown in Figure 5.2-10. The Unit 1 pump upper lateral support brackets are attached to the vibration plate of the pump casing by frictional assembly as shown in Figure 5.2-10. The frictional assembly of the Unit 2 pump was observed to be replaced with welds.

The eff ~cts of differential movements between the containment wall and the safeguards build-ing to the LHSI pumps may be of concern but was not included in this analysis.

Component Cooling Water Heat Exchangers: The component cooling water heat exchangers are located at the ground floor of the turbine building. There are four shell and tube type heat exchangers. The upper two exchangers are supported on a heavy braced steel frame as shown in Figures 5.2-11 and 5.2-12. The lower two exchangers are supported on concrete piers as shown in Figure 5.2-13. Seismic retrofits at the interface of the support saddles and the concrete piers were observed as shown in Figure 5.2-13.

Electrical and Control Equipment: Some concerns for the following electrical equipment were Vol. 5 5- 7 NUREG /CR-6144

Electrical and Control Equipment: Some concerns for the following electrical equipment were noted during the walkdown:

o 480V Unitrol Motor Control Centers o Normal Service Buses A, B, and C.

480-Volt Unitrol Motor Control Centers: The Unitrol MCCs were observed in the emergency switchgear room and the cable vault areas. These MCCs appeared to be well constructed.

However, the MCCs were not opened for inspection during the walkdown since they were energized. Thus, mounting of the internal components, bolting of the adjacent cabinets and base anchorage of the MCC cabinets were not inspected. Some MCCs were observed to be backed up against walls. Therefore, welding between the base channels and the steel embeds could not be verified.

Normal Service Buses: These buses are located in the emergency switchgear room in the service building. The cabinets of these buses appeared to be well constructed. However, the anchorage of the cabinets was not verified during the walkdown since the buses were energized.

Control Instrumentation Panels: Various control panels and bench boards are located in the control room. The safety injection and auxiliary f eedwater bench boards were observed to have low profiles and anchored to the floor. The vital bus distribution panels (35" high by 20" wide by 6" deep) are wall-mounted units in an area behind the control room panels (Figure 5.2-14). The units appeared to be well mounted. No concern with the control instrumentation panels was noted during the walkdown.

Batteries: All 125V battery banks were reviewed for construction of the battery cells (Exide G), flexibility of the cables, spacers between the cells and between the cells and racks, and construction and anchorage of the battery racks. A typical battery bank reviewed is shown in Figure 5.2-15. All the batteries and battery racks reviewed in the seismic walkdown were found to be well constructed and well anchored. The battery enclosures were constructed of masonry block walls. Retrofits of these walls in response to IE Bulletin No. 80-11 were observed during the walkdown.

Off site Power: A walkdown review of the switchyard components was performed. Equipment observed in the Surry switchyard is similar to what has been observed by the team members in other east coast power stations. Both the live tank design (Figure 5.2-16) and dead tank design (Figure 5.2-17) circuit breakers were observed in the switchyard. Circuit breakers of live tank design have been found to be susceptible to earthquake damage due to the heavy mass at the top of the porcelain bushing. Furthermore, anchorage of the steel support frames of these circuit breakers to the concrete foundation mat is provided by friction clips as shown in Figure 5.2-18. Heavy equipment anchored by similar friction clips were found to have moved in past earthquakes due to failure of the anchorage.

Seismic Spatial Interactions: Only a few potential seismic spatial interaction (SI) concerns were noted during the seismic walkdown. The SI concerns can be categorized into two groups:

o Impact of control room control panels or electrical cabinets by an adjacent unanchored bookcase.

o Impact of 125V battery banks by the masonry block enclosure. Seismic retrofits of these walls were observed in the walkdown such that the SI concerns were judged to be not significant.

NUREG/CR-6144 5-8 Vol. 5

5.3 Seismic Fragility Evaluation 5.3.1 Seismic Fragility Methodology The seismic fragility of a structure or equipment is defined as the conditional probability of its failure at a given value of peak ground acceleration. The methodology for evaluating the seismic fragilities of structures and equipment is documented in (Ref. Ravindra and Kennedy (1983); PRA Procedures Guide (1983), and Kennedy and Ravindra (1984)). It has been developed and applied in over twenty-five seismic PRAs.

The objective of fragility evaluation is to estimate the ground acceleration capacity of a given component. This capacity is defined as the peak ground acceleration value at which the seismic response of a given component located at a specified point in the structure exceeds the component's resistance, resulting in its failure. The ground acceleration capacity of the component is estimated using information on plant design bases, responses calculated at the design-analysis stage, as-built dimensions, and material properties. The ground acceleration capacity is a random variable which can be described completely by its probability distribution.

However, there is uncertainty in the estimation of the parameters of this distribution, the exact shape of this distribution, and in the appropriate failure model for the component. For any postulated failure model and set of parameter values and shape of the probability distribution, a fragility curve depicting the conditional probability of failure as a function of ground acceleration can be obtained. Hence, for different models and parameter assumptions, one could obtain different fragility curves. A satisfactory way to consider these uncertainties is to represent the component fragility by means of a family of fragility curves obtained as above; a subjective probability value is assigned to each curve to reflect the analyst's degree of belief in the model that yielded the particular fragility curve.

At any acceleration value, the component fragility (i.e., conditional probability of failure) varies from O to I; this variation is represented by a subjective probability distribution. On this distribution we can find a fragility value (say, 0.01) that corresponds to the cumulative subjective probability of 5%. We have 5% cumulative subjective probability (confidence) that the fragility is less than 0.01. Similarly, we can find a fragility value for which we have a confidence of 95%. Note that these statements can be made without reference to any probabili-ty model. Using this procedure, the median (50%); high (95%), and low (5%) confidence fragility curves can be drawn. On the high confidence curve, we can locate the fragility value of 5%; the acceleration corresponding to this fragility on the high confidence curve is the so called HCLPF (High Confidence Low Probability of Failure) capacity of the component. By characterizing the component fragility through a family of fragility curves, the analyst has ex-pressed all his knowledge about the seismic capacity of the component along with the uncertainties. Given the same information, two analysts with similar experience and expertise would produce approximately the same fragility curves. Development of the family of fragility curves using different failure models and parameters for a large number of components in a seismic PRA is impractical if it is done as described above. Hence, a simple model for the fragility was proposed as described in the above cited references. In the following this fragility model is described.

5.3.1.1 Fragility Model The entire fragility family for an element corresponding to a particular failure mode can be expressed in terms of the best estimate of the median ground acceleration capacity, Am, and

• Vol.5 5-9 NUREG /CR-6144 I

L_

two random variables. Thus, the ground acceleration capacity, A, is given by (Eq. 5.3-1) in which eR and eu are random variables with unit medians, representing, respectively, the inherent randomness about the median and the uncertainty in the median value. In this model, we assume that both eR and eu are lognormally distributed with logarithmic standard deviations, BR and Bu, respectively. The formulation for fragility given by Eq. (5.3-1) and the assumption of lognormal distribution allow easy development of the family of fragility curves which appropriately represents fragility uncertainty. For the quantification of fault trees in the plant system and accident sequence analyses, the uncertainty in fragility needs to be expressed in a range of conditional failure probabilities for a given ground acceleration. This is achieved as explained below:

With perfect knowledge (i.e., only accounting for the random variability, BR), the conditional probability of failure, f 0 , for a given peak ground acceleration level, a, is given by (Eq. 5.3-2) where t(.) is the standard Gaussian cumulative distribution function. The relationship between f O and a is the median fragility curve plotted in Figure 5.3-1 for a component with a median ground acceleration capacity Am= 0.87g and BR= 0.25. For the median conditional probability of failure range of 5% to 95%, the ground acceleration capacity would range from 0.58g to 1.31g.

When the modeling uncertainty Bu is included, the fragility becomes a random variable (uncertain). At each acceleration value, the fragility f can be represented by a subjective probability density function. The subjective probability, Q (also known as "confidence") of not exceeding a fragility f' is related to f' by f' = W[(ln(a/Am + Bu w- 1 (Q))/ Ba] (Eq. 5.3-3) where Q = P[f < f'I a] i.e., the subjective probability (confidence) that the condition-al probability of failure, f, is less than f' for a peak ground acceleration a

= the inverse of the standard Gaussian cumulative distribution function.

For example, the conditional probability of failure f' at acceleration 0.6g that has a 95%

nonexceedance subjective probability (confidence) is obtained from Eq. (5.3-3) as 0.79. The 5%

to 95% probability (confidence) interval on the failure at 0.6g is Oto 0.79 with a median value of 0.068 and mean of 0.20. Subsequent computations are made easier by discretizing the random variable probability of failure f into different intervals and deriving a probability qi for each interval (Figure 2-2). Note that the sum of the qi probabilities associated with all the intervals is unity. The process develops a family of fragility curves, each with an associated probability qi.

NUREG/CR-6144 . 5 - 10 Vol.5.

The median ground acceleration capacity Am and its variability estimates BR and Bu are evaluated by taking into account the safety margins inherent in capacity predictions, response analysis, and equipment qualification, as explained below.

5.3.1.2 Failure Modes The first step in generating fragility curves such as those in Figure 5.3-1 is to develop a clear definition of what constitutes failure for each of the critical elements in the plant. This definition of failure must be agreeable to both the structural analyst generating the fragility curves and the systems analyst who must judge the consequences of component failure. Several modes of failure (each with a different consequence) may have to be considered and fragility curves may have to be generated for each of these modes. The following definitions of failure are assumed for structures and equipment.

Structures: For elements of structures which support safety related equipment, failure is assumed to occur when inelastic deformations due to seismic motions are large enough to potentially affect the operability of equipment or when a concrete wall is cracked sufficiently so that equipment attachments fail. This is a conservative definition of failure of a structure, and is at a lower acceleration level than the acceleration level for total collapse of a building.

Considerable margin exists for structural collapse compared to the capacities calculated for failure related to equipment (functional and structural failure modes). Also, a structural failure has been generally assumed to result in a common cause failure of multiple safety systems, housed in the same structure. Structures which are susceptible to sliding are considered to have failed when sufficient sliding deformation has occurred to fail buried or interconnecting piping or electrical duct banks.

Equipment: Safety related equipment is assumed to fail when it can no longer perform its function. Failure can be caused by either direct failure (i.e. structural failure) or functional failure due to inertial loads or relative displacement-induced loading, or indirect failure caused by failure of an adjacent structure or component which can fall onto and fail the safety related equipment. Structural failure includes bending, buckling of supports, anchor bolt pullout, etc.

Functional failures include binding of valves, excessive deflection, and relay trip or chatter.

It may be possible to identify the failure mode most likely to be caused by the seismic event by reviewing the equipment design and considering only that mode. Otherwise, fragility curves are developed based on the premise that the component could fail in any one of many potential failure modes. Identification of the credible modes of failure is largely based on the analyst's experience and judgment. Review of plant design criteria, calculated stress levels in relation to the allowable limits, qualification test results, seismic fragility evaluation studies done on other plants, and reported failures (in past earthquakes, in licensee event reports and fragility tests) are useful in this task.

Consideration should also be given to the potential for soil failure modes (e.g., liquefaction, toe bearing pressure failure, base slab uplift, and slope failures). For buried equipment (i.e., piping and tanks), failure due to lateral soil pressures may be an important mode. Seismically induced failures of structures or equipment under impact of another structure or equipment (e.g., a crane) may also be a consideration.

Vol. 5 5 - 11 NUREG /CR-6144

5.3.1.3 Estimation of Fragility Parameters In estimating fragility parameters, it is convenient to work in terms of an intermediate random variable called the factor of safety. The factor of safety, F, on ground acceleration capacity above the safe shutdown earthquake level specified for design, AssE* is defined as follows:

A = F AssE F = Actual seismic capacity of element Actual response due to SSE Actual seismic capacity of element Calculated capacity X Calculated capacity Design response due to SSE X Design response due to SSE Actual response due to SSE F is further simplified as:

F Actual seismic capacity of element Design response due to SSE X Design response due to SSE Actual response due to SSE F (Eq. 5.3-4)

The median factor of safety, Fm, can be directly related to the median ground acceleration capacity, Am, as:

(Eq. 5.3-5)

The logarithmic standard deviations of F, representing inherent randomness and uncertainty, are identical to those for the ground acceleration capacity A.

5.3.1.4 Structural fragility For structures, the factor of safety can be modeled as the product of three random variables:

F (Eq. 5.3-6)

The strength factor, F 5, represents the ratio of ultimate strength (or strength at loss-of-func-tion) to the stress calculated for AssE* In calculating the value of F 8, the nonseismic portion of the total load acting on the structure is subtracted from the strength as follows:

(Eq. 5.3-7)

NUREG/CR-6144 5 - 12 Vol. 5

where Sis the strength of the structural element for the specific failure mode, PN is the normal operating load (i.e., dead load, operating temperature load, etc.) and PT is the total load on the structure (i.e., sum of the seismic load for AssE and the normal operating load). For higher earthquake levels, other transients (e.g., SRV discharge, and turbine trip) may have a high probability of occurring simultaneously with the earthquake; the definition of PN in such cases should be extended to include the loads from these transients.

The inelastic energy absorption factor (ductility), F 11, accounts for the fact that an earthquake represents a limited energy source and many structures or equipment items are capable of absorbing substantial amounts of energy beyond yield without loss-of-function. A suggested method to determine the deamplification effect resulting from inelastic energy dissipation in-volves the use of ductility modified response spectra (Ref. Newmark, 1977). The deamplifica-tion factor is primarily a function of the ductility ratio µ defined as the ratio of maximum displacement to displacement at yield. More recent analyses (Ref. Riddell and Newmark, 1979) have shown the deamplification factor to be a function of system damping. One might estimate a median value of µ for low-rise concrete shear walls (typical of auxiliary building walls) of 4.0. The corresponding median F 11 value would be 2.4. The variabilities in the inelastic energy absorption factor, F 11, are estimated as Ba = 0.21 and Bu = 0.21, taking into account the uncertainty in the predicted relationship between F , µ, and system damping.

11 The structure response factor, Fas, recognizes that in the design analyses structural response was computed using specific (often conservative) deterministic response parameters for the structure. Because many of these parameters are random (often with wide variability) the actual response may differ substantially from the design-calculated response for a given peak ground acceleration.

The structure response factor, Fas, is modeled as a product of factors influencing the response variability:

Fas = (Eq. 5.3-8) where FsA = spectral shape factor representing variability in ground motion and associated ground response spectra F+ = direction factor representing the variability in the two earthquake direction response spectral values about the mean value FIi = damping factor representing variability in response due to difference between actual damping and design damping FM = modeling factor accounting for uncertainty in response due to modeling assumptions FMc = mode combination factor accounting for variability in response due to the method used in combining dynamic modes of response FEc = earthquake component combination factor accounting for variability in response due to the method used in combining earthquake components

• Vol.5 5 - 13 NUREG /CR-6144

F 80 = factor to reflect the reduction with depth of seismic input F 88 = factor to account for the effect of soil-structure interaction The median and logarithmic standard deviations of F are expressed as:

(Eq. 5.3-9) and (B S 2 + B U 2 + J3 SA2 + --- + J3SS 2)1/2 (Eq. 5.3-1 O)

The logarithmic standard deviation BF is further divided into random variability, BR, and uncertainty, Bu* To obtain the median ground acceleration capacity Am the median factor of safety, Fm* is multiplied by the safe shutdown earthquake peak ground acceleration.

5.3.1.5 Equipment Fragility For equipment and other components, the factor of safety is composed of a capacity factor, F6 a structure response factor, FR8 ; and an equipment response (relative to the structure) factor, FRE. Thus, (Eq. 5.3-11)

The capacity factor F 0 for the equipment is the ratio of the acceleration level at which the equipment ceases to perform its intended function to the seismic design level. This acceleration level could correspond to a breaker tripping in a switchgear, excessive deflection of the control rod drive tubes, or failure of a steam generator support. The capacity factor for the equipment may be calculated as the product of F 8 and F ii* The strength factor, F 8, is calculated using Eq.

(5.3-7). The strength, S, of equipment is a function of the failure mode. Equipment failures can be classified into three categories:

1. Elastic functional failures

2. Brittle failures

3. Ductile failures.

Elastic functional failures involve the loss of intended function while the component is stressed below its yield point. Examples of this type of failure include the following:

o Elastic buckling in tank walls and component supports o Excessive blade deflection in fans o Shaft seizure in pumps.

The strength of the component is considered to be the load level at which functional failure occurs.

Brittle failure modes are those which have little or no system inelastic energy absorption capability. Examples include the following:

NUREG/CR-6144 5 - 14 Vol. 5

r-.-

/

o Anchor bolt failures o Component support weld failures o Shear pin failures.

Each of these failure modes has the ability to absorb some inelastic energy on the component level, but the plastic zone is very localized and the system ductility for an anchor bolt or a support weld is very small. The strength of the component failing in a brittle mode is therefore calculated using the ultimate strength of the material.

Ductile failure modes are those in which the structural system can absorb a significant amount of energy through inelastic deformation. Examples include the following:

o Pressure boundary failure of piping o Structural failure of cable trays and ducting o Polar crane failure.

The strength of the component failing in a ductile mode is calculated using the yield strength of the material for tensile loading. For flexural loading, the strength is defined as the limit load or load to develop a plastic hinge..

The inelastic energy absorption factor, F 11, for a piece of equipment is a function of the ductility ratio, µ. The median value F 11 is considered close to 1.0 for brittle and functional failure modes. For ductile failure modes of equipment that respond in the amplified acceleration region of the design spectrum (i.e., 2 to 8 Hz):

F 11

= e (2µ - 1) 112 (Eq. 5.3-12) where e is a random variable reflecting the error in Eq. (5.3-12) and has a median value of 1.0 and a logarithmic standard deviation, Bu, ranging from 0.02 to 0.10 (increasing with the ductili-ty ratio). For rigid equipment, F is given by 11

= e µ0.13 (Eq. 5.3-13)

Again, e is a random variable of median equal to 1.0 and logarithmic standard deviation ranging from 0.02 to 0.10.

The median and logarithmic standard deviation of ductility ratios for different equipment are calculated considering recommendations of (Newmark, 1977). This reference gives a range of ductility ratios to be used for design. The upper end of this range might be considered to represent approximately the median value, while the lower end of the range might be estimated at about two logarithmic standard deviations below the median.

The equipment response factor FRE, is the ratio of equipment response calculated in the design to the realistic equipment response; both responses are calculated for design floor spectra. FRE is the factor of safety inherent in the computation of equipment response. It depends upon the response characteristics of the equipment and is influenced by some of the variables listed under Eq. (5.3-8). These variables differ according to the seismic qualification procedure. For equipment qualified by dynamic analysis, the important variables that influence response and variability are as follows:

• Vol. 5 5 - 15 NUREG/CR-6144

o Qualification method (QM) o Spectral shape (SA) - including the effects of peak broadening and smoothing, and artificial time history generation o Modeling (affects mode shape and frequency results) (M) o Damping ( o) o Combination of modal responses (for response spectrum method) (MC) o Combination of earthquake components (EC).

For rigid equipment qualified by static analysis, all variables, except the qualification method, are not significant. The equipment response factor is the ratio of the specified static coefficient divided by the zero period acceleration of the floor level where the equipment is mounted. If the equipment is flexible and was designed via the static coefficient method, the dynamic characteristics of the equipment must be considered. This requires estimating the fundamental frequency and damping, if the equipment responds predominantly in one mode.

The equipment response factor is the ratio of the static coefficient to the spectral acceleration at the equipment fundamental frequency.

Where testing is conducted for seismic qualification, the response factor must take into account the following:

o Qualification method (QM) o Spectral shape (SA) o Boundary conditions in the test versus installation (BC) o Damping ( o) o Spectral test method (sine beat, sine sweep, complex waveform, etc.) (STM) o Multi-directional effects (MDE).

The overall equipment response factor is the product of these factors of safety corresponding to each of the variables identified above. The median and logarithmic.standard deviations for randomness and uncertainty are estimated following Eqs. (5.3-9) and (5.3-10).

The structural response factor, Fas, is based on the response characteristics of the structure at the location of component (equipment) support. The variables pertinent to the structural response analyses used to generate floor spectra for equipment design are the only variables of interest to equipment fragility. Time-history analyses using the same structural models used to conduct structural response analysis for structural design are typically used to generate floor spectra. The applicable variables are as follows:

o Spectral shape o Damping o Modeling o Soil-structure interaction.

NUREG /CR-6144 5 - 16 Vol.5.

• For equipment with a seismic capacity level that has been reached while the structure is still within the elastic range, the structural response factors should be calculated using damping values corresponding to less than yield conditions (e.g., about 5% median damping for reinforced concrete). The combination of earthquake components is not included in the structural response since the variable is to be addressed for specific equipment orientation in the treatment of equipment response.

Median Fm and variability BR and Bu estimates are made for each of the parameters affecting capacity and response factors of safety. These median and variability estimates are then combined using the properties of lognormal distributions in accordance with Eqs. (5.3-6),

(5.3-8), and (5.3-11) to obtain the overall median factor of safety Fm and variability BR and Bu estimates required to define the fragility curves for the structure or equipment. For each variable affecting the factor of safety, the random (BR) and uncertainty (Bu) variabilities must be separately estimated. The differentiation is somewhat judgmental, but it can be based on general guidelines. Essentially, BR represents variability due to the randomness of the earthquake characteristics for the same acceleration and to the structural response parameters which relate to these characteristics. The dispersion represented by Bu is due to factors such as the following:

o Our lack of understanding of structural material properties such as strength, inelastic energy absorption, and damping.

o Errors in calculated response due to use of approximate modeling of the structure and inaccuracies in mass and stiffness representations.

o Usage of engineering judgment in lieu of complete plant-specific data on fragility levels of equipment capacities, and responses.

For structures such as concrete shear walls, prestressed concrete containment, steel frames, ma*sonry walls, field-erected tanks, and buried structures, the fragility parameters are generally estimated using plant-specific information. For major passive equipment (e.g., reactor pressure vessel, steam generator, reactor coolant pump, recirculation pump, major vessels, heat exchangers, and major piping), it is preferable to develop plant-specific fragilities using original design analyses.

For certain types of passive equipment that are used in very large quantities (e.g., piping and supports, cable trays and supports, HV AC ducting and supports, conduit, and miscellaneous vessels and heat exchangers), it is generally necessary to use generic fragilities. For active equipment, use of a combination of generic and plant-specific information is needed to develop fragilities.

5.3.2 Surry Seismic Fragilities The seismic fragilities of equipment included in the Surry low power probabilistic risk assessment are presented in Table 5.3-1. Selection of these equipment items was discussed in Section 5.2. Detailed discussions of the fragility evaluation are provided in this section.

Structural responses (i.e., floor response spectra) generated from the probabilistic response analyses for the Surry IPEEE program were used to develop the equipment fragilities.

Fragilities of Category I structures were not included in this study. The previous study (Ref.

Bohn et al., 1990) showed that Surry Category I structures generally were not significant seismic risk contributors.

5 - 17 NUREG/CR-6144

5.3.2.1 Median-Centered Response Analysis The median-centered in-structure response spectra generated from probabilistic response analyses were used for evaluating Surry equipment fragilities. The advantages of using the probabilistic response results for fragility evaluation are:

o The probabilistic response analysis is based on the best-estimates of input parameters and analysis procedures leading to median estimate of seismic response.

o Variability in the response resulting from variations in earthquake ground motion (spectral shape), the physical properties of the soil-structure system and the ability to model them are explicitly acknowledged and propagated throughout the analysis.

Detailed discussions of the Surry response analyses can be found in EQE's report (Ref. EQE, 1992). The following information provides a brief summary of the Surry response analyses and their results:

• I. Category I structures were modeled as three-dimensional stick models with lumped masses.

Eccentricities were explicitly considered in the models. Important structural parameters such as hysteretic damping and natural frequencies varied around their median values to account for uncertainties.

2. Soil-structure interaction effects were considered for all dynamic analyses. For each structure the foundation embedment was considered and frequency dependent impedance and scattering functions were calculated for each strain compatible soil case. Soil parameters varied around their median values to account for uncertainty.

3. Horizontal 10,000 year return period EPRI Uniform Hazard Spectra anchored to 0.15g, 0.30g, and 0.45g were used for input ground motion. Ensembles of thirty earthquake time histories were developed such that the median and the standard deviation of their spectra match the median and the standard deviation of the targets.

4. Median and 84th percentile in-structure response spectra were generated at 5% damping at all major floors of each Category I structure.

The use of Surry in-structure response spectra for developing seismic fragility of an equipment item supported in a Category I structure is illustrated by an example in Section 5.3.3.

5.3.2.2 Screening of Equipment Surry equipment that is inherently seismically rugged was screened from detailed fragility evaluation. Such equipment included all the horizontal motor driven pumps, small shell and tube type heat exchangers, and emergency diesel generators (including peripherals). Screening of equipment was performed following the procedures in (Ref. EPRI, 1988) including the seismic walkdown review and equipment anchorage evaluation. The 84th percentile floor response spectra from the probabilistic response analyses were used for anchorage evaluation.

Motor and air operated valves (MOY and AOV) were screened out after the walkdown review confirmed that there were no concerns of excessively high and heavy operator and seismic interaction of soft targets on the valves.

NUREG/CR-6144 5 - 18 Vol.5.

5.3.2.3 Generic Equipment Seismic Fragilities Some equipment items in this study were assigned generic seismic fragilities for the following reasons:

o Some equipment was not reviewed during the walkdown due to inaccessibility, such as RHR pumps and heat exchangers o Some anchorages could not be verified during the walkdown since the equipment was energized and could not be opened. This included the motor control centers and the distribution bus.

o Some itmes lacked design information such as as-built drawings for performing fragility evaluation.

For these equipment items, conservatively estimated seismic fragility values which were developed either from limited design information or from a review of (Ref. Bohn et al., 1990) and (Ref. Campbell et al., 1988) were assigned as indicated in Table 5.3-1.

5.3.2.4 Surry Specific Equipment Fragilities For the remaining Surry shutdown components, seismic fragilities were calculated following the methodology discussed in Section 5.2 using information such as walkdown data, design documents, and seismic qualification packages. The seismic demand on equipment was

• • calculated using the median-centered floor response spectra. Since uncertainties in structural damping, modeling (natural frequency) and soil-structure interaction and randomness of earthquake ground motion (i.e. spectral shape) were explicitly included in the probabilistic response analysis, a combined variability, Be can be estimated from the median and 84th percentile floor response spectra as shown in the example given in Section 5.3.3. Other variabilities associated with structural response factors such as mode shape, mode combination, and earthquake components combination were individually calculated and incorporated in the final equipment fragilities.

5.3.3 Example of Equipment Fragility Evaluation In this section, we describe the seismic fragility derivation of the low head safety injection (LHSI) pump. The LHSI pump is a vertical pump located in the Safeguards Building. It consists of a motor, a discharge head, pump shaft, pump column, and a pump casing.

Two lateral supports are provided to the pump casing, i.e., an upper support at Elevation 13'-4" (pump casing attached to the containment wall) and a lower support at Elevation (-) 28'-1" (casing bolted to the Safeguards Building basemat). The upper support consists of a pair of top and a pair of bottom steel brackets (or weldments) which are anchored to the containment wall with Red Head bolts. The pump column is attached to the discharge head flange at the top and is laterally supported by two intermediate lateral restraints at Elevation (-)4'-l" and Elevation

(-)24'-1", respectively. The unsupported length of the pump column is about 20 feet .

• Vol. 5 5 - 19 NUREG /CR-6144

Equipment Capacity Factor Strength Factor: The design calculations of the pump were reviewed in the course of the fragility evaluation. Loadings considered for the seismic analysis of the pump included:

o OBE (horizontal and vertical directions) o SSE (horizontal and vertical directions) o Dead loads o Operating loads o Piping loads o Containment displacements due to pressure (LOCA) and seismic environments.

The dynamic response spectrum method was used for the seismic analyses. Each of the pump major components including pump column, pump casing, pump shaft, discharge head, motor mounting bolts, pump flange to pump casing bolts, suction and discharge nozzles, and pump column flange bolts, was designed for the loads listed above and the factor of safety (defined as code allowable to demand) was discussed in the design calculations. Based on review of the design calculations, the following components were identified as critical and were evaluated for the fragility development:

o Discharge head o Motor mounting bolts (total of four) o Attachment of the upper lateral support to the pump casing.

The strength factor for the most critical failure mode (i.e. motor mounting bolts) is presented next.

The median strength factor (Fsm> of the motor mounting bolts was calculated using the original design loads and the best estimate bolt capacities along with the best estimate shear-tension interaction failure criteria for the bolts.

Fsm = 1.26 BR = 0 Bu = 0.13 The associated uncertainty included the variation of median bolt material ultimate tensile strength and failure criteria for bolts subject to both tension and shear.

Ductility Factor: Because the bolt ultimate failure criteria were used for the strength factor calculation, no more credit is given to the ductility factor. Thus, Fµm = 1.0 BR = 0 Bu = 0 NUREG/CR-6144 5 - 20 Vol.5.

J"

• Thus, the overall equipment capacity factor is Fem = 1.26 BR = 0 Bu = 0.13 Equipment Response Factors Qualification Method: A finite element model was used in the design analysis with proper boundary conditions considered, thus, FQMm = 1.0 BR = 0 Bu = 0 Spectral Shape: The conservatism in the use of design loads for the strength factor calculation was adjusted by comparing the design spectral acceleration level with the 5% damped median-centered floor response spectra at the dominant frequency of the motor.

Fssm = 7.66 Since the median-centered floor response spectrum was unbroadened and unsmoothed, there is no SR and Bu associated with peak broadening and smoothing. Variability between the median and the 84th percentile floor response spectra which is associated with the structural response factors is considered separately under the structural response factors.

Damping: The 5% damped median floor response spectrum was used in the spectral shape calculation, thus, Fam = 1.0 Estimating that 3% damping is -l.33B from the median value BR = 0.19 Bu = 0 Modeling: Judging that the model used for the design calculation was detailed and adequate to capture dynamic characteristics of the pump, FM= 1.0 was assigned. Variabilities associated with the modal frequency and mode shape of the pump are 0.15 and 0.10, respectively. The variability associated with the median response due to uncertainty of the modal frequency was estimated to be 0.08. Thus, the total Bu= (0.08 2 + 0.10 2) 112 = 0.13. Note that SR= 0 since there is no randomness associated with modeling.

Modal Combination: Since the response spectrum method was used and that the modes were combined using the SRSS method, FMc = 1.0. For the pump motor, the response was judged to be primarily a single mode response. Thus BR = 0.05 (nominal) and Bu = 0.

• Vol. 5 5 - 21 NUREG /CR-6144

Earthquake Component Combination: The design loads used in the strength factor calculation were obtained by absolute sum of response from one horizontal earthquake component and the vertical earthquake component. Based on the configuration of the mounting bolts and the contribution of the two horizontal earthquake components to the bolt tensile and shear loads, the median earthquake component combination was estimated to be 0.97. Since conservatism was already included in the estimation of the factor of safety, no value is assigned to .BR to avoid introducing additional conservatism.

Thus, the overall equipment response factor is:

FER = (7 .66) (0.97) = 7.43 BR = 0.05 Bu = 0.23 Structural Response Factor: Variabilities of the following structural response factors are estimated by using the median and 84th percentile floor response spectra:

o Spectral shape (input ground motion) o Structural damping o Structural modeling (frequency only) o Soil-structure interaction.

At the fundamental frequency of the motor (i.e 5.58 Hz), the 5% damped median and 84th

• spectral accelerations are 0.175g and 0.225g, respectively. Thus, B0 = In(0.225/0.175) = 0.25 The .BR and Bu were estimated to be 0.19 and 0.16, respectively. By combining them with variabilities assoc;:iated with the mode shape factor and earthquake component combination of the building response, the final BR and Bu associated with structural response factors were estimated to be 0.20 and 0.22, respectively.

Thus, the median peak ground acceleration capacity of the LHSI pump motor mounting bolts was determined to be:

Am = (1.26) (7.43) (1.0) (0.15g) = 1.40g The variabilities associated with this median PGA capacity were determined to be 0.21 and 0.34, respectively for BR and Bu, by combining variabilities of equipment capacity factor, equipment response factor and structural response factors (using Equation 5.3-10).

NUREG/CR-6144 5 - 22 Vol.5.

f Table 5.3-1 V,

SURRY LOW POWER PRA COMPONENTS SEISMIC FRAGILITIES COMPONENT COMPONENT DESCRIPTION Am ~R HCLPF COMMENTS ID (g) (g)

RHRP RHR PUMPS 1.40 0.25 0.35 0.52 Conservatively estimated median capacity with generic variabilities.

RHRHEX RHR HEAT EXCHANGERS 2.00 0.25 0.35 0.74 Conservatively estimated median capacity with generic variabilities.

V, 1-CC-P-1 A/8 Component Cooling Pumps 0.30 Screened per EPRI NP-6041 .

N vJ CCWHEX CCW Heat Exchangers 0.96 0.20 0.27 0.34 Surry specific fragility.

1-CH-P-1 A/8/C Charging Pumps Screened per EPAI NP-6041 .

MOV1115-B/D Charging Pump Suction from RWST Screened per EPAI NP-6041

• MOV1867-C/D MOVs Screened per EPRI NP-6041.

MOV1842- MOV Screened per EPRI NP-6041.

RWST Refueling Water Storage Tank 0.75 0.21 0.35 0.30 Surry specific fragility.

z c:::

,::J MDPSW10A/B Pumps Screened per EPRI NP-6041.

tT1 C')

MDPCC2A/B Pumps Screened per EPRI NP-6041.

( ')

,::J I

SW108A/B/C AOVs Screened per EPRI NP-6041.

°'

.i::..

.i::..

Table 5.3-1 (Continued)

SURRY LOW POWER PRA COMPONENTS SEISMIC FRAGILITIES COMPONENT COMPONENT DESCRIPTION Am HCLPF COMMENTS ID (g) (g)

HXCH5A/B/C Heat Exchangers Screened per EPRI NP-6041 .

HXCH7 A to F Heat Exchangers Screened per EPRI NP-6041.

HXSW1A/B Heat Exchangers Screened per EPRI NP-6041 .

VI MDPS11 LHSI Pumps 1.40 0.21 0.34 0.56 Surry specific fragility.

Iv

.i:,.

1864A/B MOVs Screened per EPRI NP-6041.

DG1&3 Emergency Diesel Generators Screened per EPRI NP-6041

• 1-CS-P-1A Containment Spray Pump Screened per EPRI NP-6041.

1-EE-TK-3 Fuel Oil Day Tank >2.0 High median seismic capacity

(>2g) was calculated.

DG1&3 Diesel Fuel Oil Tanks Screened per EPRI NP-6041 .

CNTRL-PNL Control Panels 1.10 0.21 0.31 0.47 Surry specific fragility.

BATTERIES Batteries 2.20 0.25 0.35 0.82 Fragility of Batteries 1A/B is assumed for DG batteries.

0 AIR-ACCUM Air Accumulators 1.20 0.21 0.31 0.51 Conservatively estimated capacity.

r-Vt

• t,

r Table 5.3-1 (Continued)

SURRY LOW POWER PRA COMPONENTS SEISMIC FRAGILITIES COMPONENT COMPONENT DESCRIPTION Am HCLPF COMMENTS ID (g) (g) 1 H1-12 MCCs 0.70 0.25 0.35 0.26 Generic median capacity from NUREG-1150.

1J1-12 MCCs 0.70 0.25 0.35 0.26 Generic median capacity from NUREG-1150.

VI Bus A/B DC Bus 0.70 0.25 0.35 0.26 Generic median capacity from tv NUREG-1150.

VI Battery 1 A/B Batteries 2.20 0.25 0.35 0.82 Surry specific fragility.

1864A/B MOVs Screened per EPRI NP-6041 .

1-FW-P-3A/B Motor Driven Aux Feed Pumps Screened per EPRI NP-6041 .

CST Emergency Condensate Storage Tanks 0.46 0.21 0.35 0.18 Surry specific fragility.

Offsite Power Offsite power 0.30 0.25 0.35 0.11 Generic values.

z C:

~

tr1 0

n

~ I 0\

.i,..

.i,..

Status Y N U SCREENING EVALUATION WORK SHEET (SEWS) Sheet l of 3 5~

Equip. ID No. 1-EPD-B-lA Equip. Class 15 - Batteries on Racks Equipment Description _E. . .E_.

. ./. .1_25_V

. . __BA_TT __E_RY__l_A__________________________________~

Location: Bldg. SERVICE Floor El. 9.5' Room, Row/Col EMER SWGR Manufacturer, Model, Etc. {optional) ___;;;E;;..;-,e;..;..;;,:clJz_:c.-._ _~.,___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ~

Jc JI :o'.I ( e,..r,~

• f tL \, ..-ff"{j r*~"-)

SEISMIC CAPACITY VS DEMAND

1. Elevation where equipment receives seismic input q.5"

2. Elevation of seismic input below about 40' from grade (JJ__,..,.N___,.,U,----

3. Equipment has fundamental frequency above about 8 Hz *Y N U~

4. Capacity based on: Existing Documentation DOC Bounding Spectrum BS GERS GERS 5 .. Demand based on: Ground Res onse Spectrum GRS

1. 5 x Boun ectrum ABD

( onserv. Des. In- tr. Re~. s.r.;Pe:. : c;.;. ._ __.,c.RSJ Realistic M-Ctr. In-Str. ~esp. Spec. RRS Does capacity exceed demand?

CAVEATS - BOUNDING SPECTRUM {Identify with an asterisk{*) those caveats which are met by intent without meeting the specific wording of the caveat rule and explain the reason for this conclusion in the COMMENTS section below)

1. Equipment is included in earthquake experience

• equipment c l a s s : = 3) N U N/A

2. Plates of the cells are of lead-calcium~~t-pl~

Plante or of Manchex design (i) N U N/A

3. Each individual battery wei hs less t h a n ~ ? Y N U N/A

4. Close-fitting, crush res1stan spacers f ~ -¥ two-thirds of vertic space between cells c.r.. ,~ .. 1.4.+*.. -< Y @ U N/A

5. Cells restrained by end and side rails N u-N/A

~,&,\,I.~

6. Racks have longitudinal cross bracing N U ~

7. Wood racks evaluated to industry accepted standards N U eJ

8. Batteries greater than 10 years old specifically evaluated for aging effects G) N U N/A

9. Anchorage adequate {See checklist below for details) Y N @ N/A

10. Have you looked for and found no other adverse concerns? (D N U N/A r,..

Is the intent of all the caveats met for Bounding Spectrum? Y l)U N/A CAVEATS - GERS (Identify with an asterisk{*) those caveats which are met by intent without meeting the specific wording of the caveat rule and explain the reason for this conclusion in the COMMENTS section below)

1. Equipment is included in generic seismic testing

• equipment class *y_ N U N/A

2. Meets all Bounding Spectrum caveats _ Y *N U N/A

3. Plates of the cells are of lead-calcium flat-plate design (i.e., not Manchex design) Y N U N/A

"* Fer( ~- ba b4+1~ ~)Je .... b~ - ~ c...- .... sL~ .. 1..1~ +ot:."'-J WJ"\.< ~f.

3 ,, ,, ,,, .

- z. h ~ ,

Figure 5.2-1 : SEWS of 125V Batteries NUREG/CR-6144 5 - 26 Vol. 5

SCREENING EVALUATION WORK SHEET (SEWS) Sheet 2 of 3

• Equip. ID No.

CAVEATS - GERS (Cont'd) s~

1-EPD-B-IA

4. Batteries supported on two-step racks or Equip. Class 15 - Batteries on Racks Equipment Description -=EE=/.. .;;;.1=25;;..;V-=BA..;;.;TI~ER;..;.Y~l;..;.A_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __

single-tier racks; restrained by double side and end rails which are symmetrically located with respect to the cell center-of-gravity Y N U N/A /"""\

Is the intent of all the caveats met for GERS? Y N Uf!!_j ANCHORAGE

1. Appropriate equipment characteristics determined (mass, CG, natural freq., damping, center of rotation) N U N/A 2.

3.

Type of anchorage covered by GIP µqt; -li..1ilc-Sizes and locations of anchors determ1ned

4. Adequacy of anchorage installation evaluate~

( w ~ n d length, nuts and washers,~~

• m N U N/A N U N/A

~ss"Cetc.)

5. Factorsa"ffectTng anchorage capacity or margin of Y N N/A safety considered: embedment length, anchor spacing, free-edge distance, concrete strength/condition, and 6.

concrete cracking For bolted anchorages, gap under base less than 8 N .u N/A 1/4-inch @N u N/A

7. Base has adequate stiffness and effect of prying -*

action on anchors considered G) N u N/A

8. Strength of equipment base and load path 9.

to CG adequate Embedded steel, grout pad or large concrete ~f d) N u N/A 1 -y pad adequacy evaluated 1,1.,-.:.k......,J d.:-r".cc;t~ -rv t" ,sv,/ N u ~y Are anchorage requirements met? ?l~b. N(0 INTERACTION EFFECTS

1. Soft targets free from impact by nearby equipment or structures U-N/A

2. Attached lines have adequate flexibility U N/A'

3. Overhead equipment or distribution systems are not likely to collapse

4. Have you looked for and found no other adverse concerns?

~~Y

'{:[) N N

~ ~p Is equipment free of interaction effects? a)N U IS EQUIPMENT SEISMICALLY ADEQUATE? Y@U

~ f aL ...fv;._~ lx-h..i.t.i.,. 1L.. rc1d* ~,.{ ;.I_ w~J.I "-t° f~ ~IV"~

r.-.uh t:., il ~h.u,.( ~ IL,.. ~r.L. ,:y'f' ~~;:r.,_,..... ( .,Lu_

~..,.A ,l.. ~ t rb.-t )

.::;.JI S"~:s~ic. V4-h.af{.s- -C.. .fl.... kli>, k  :.....,...:lJ.,o l.-1~ "')-i.., h. ) . ~-

.r:c-~ =-~.!.. *:;:-;;._- :i: ~= '--f~'-.

~r r~ .

, Figure 5.2':'1: (Continued)

Vol. 5 5 - 27 NUREG/CR-6144

SCREENING EVALUATION WORK SHEET (SEWS) Sheet 3 of 3

~

Equip. ID No. 1-EPD-B-lA Equip. Class 15 - Batteries on Racks Equipment Description _E=E"'-/12 ____5V-'"'"BA"""'TT~ER_Y"""'__l A_ _ _ _ _ _ _ _ _ _ _ _ _ _ __

COMMENTS c,.,r ~ J ~ ~~* --~

vi&J ~

C j

~"'--,---,-t_'olt--~-~~-~~-.[;/

A-A

""""1 ~ c:iP < le.. I ~ r.wrf c..,-.. .._~ t~ _J 1

( * ( -p, !,l.,/t. L.>~

r "iz

J &" '

.. I *' ot:"----*-*-f ,-

\ ( '3/ll;IJ..t ....0., 3'/~"P--J' st......( b~ 11 ~l.:..;t., 1,..;.., ...

l ...""l. 1t.. $J ,._:::);1:,-U=---/-d'>""")..,._= - - - - - - - - - - - - Date:

fflC~~ { ~l&o /43 j I Figure 5.2-1: (Continued)

NUREG/CR-6144 5 - 28 Vol. 5

Revision 2, Corrected, 6/28/91 Status Y N U SCREENING EVALUATION WORK SHEET {SEWS) Sheet 1 of 2

~ ~ s;; ~p~~:~ 4 6

r: '!; ~ ;!:.-,. E~:!~ ~. G1 ass _E=---~Ve::..!r~t:..!.i.:::;ca::..l:.......!.P.=ur.:""

..pc.:!:=---------

Equipment Description _....;S:...-;...T,1--,/'___;;..L;...H_5_r__,_fi.;..;.u;...+f--1_Pt_ _ _ _ _ _ _ _ _ _ _ _ _ _ _~

1 Location: Bldg. S'FGD Floor El. 1'2.a' Room, Row/Col -'~~e~r-~-tr_,.tf3_<..{.;...~ ..........- - - - - -

Manufacturer, Hodel, Etc. (optional) 6?7rcl')1 J.:r.c.lcscn1 &"'f' ( o...6 ;2 c.. "7fi) T .... ,.l,:h.J tP"'---,r~

0 Horsepower/Motor Rating (opt.)~- RPM (opt.)17S1' Head (opt.)~- Flow Rate (opt.)3~; ,.,,.

SEISMIC CAPACITY VS DEMAND 1.

2.

3.

4.

5. Demand based on:

CAVEATS - BOUNDING SPECTRUM (Identify with an asterisk(*) those caveats which are met by intent without meeting the specific wording of the caveat rule and explain the reason for this conclusion in the COMMENTS section below)

1. Equipment is included in earthquake experience equipment class . a) N U N/A

2. Casing and impeller shaft not cantilevered more than 20 feet, with radial bearing at bottom to d'\

support shaft Y N UJ.i°' N/A

3. No risk of*excessive nozzle loads such as gross pipe motion or differential displacement cf) N U N/A

4. Attached lines (cooling, air, electrical) have adequate flexibility (J) N U. N/A

5. Anchorage adequate (See checklist below for details) Y N /TI) ~ ( 1) (,.)

6. Relays mounted on equipment evaluated Y Nll~

7. Have you looked for and found no.other adverse concerns? a) N U N/A @

Is the intent of all the caveats met for_ Bounding Spectrum? Y NUN/A ANCHORAGE

1. Appropriate equipment characteristics determined (mass, CG, natural freq., damping, center of rotation) (y) NN U N/A

2. Type of anchorage covered by GIP .(fJ U N/A

3. Sizes and locations of anchors determined . (J) N U N/A

4. Adequacy of anchorage installation evaluated (weld quality and length, nuts and washers, expansion anchor tightness, etc.) u) N U N/A Figure 5.2-2: SEWS of LHSI Pumps 5 - 29 NUREG /CR-6144

Revision 2, Corrected, 6/28/91 SCREENING EVALUATION WORK SHEET (SEl{S) Sheet 2 of 2 quip. ID No. ~ P - IA Equ;p. Class 6 - Vertical Pumps *

~~:.:i ~:::e:-:-: ~-::scri ptian _...$"""':r::.,./'--"L:.r.H.:....::.5.:a!__,_{3""'1:A-..,..-ilPa....-..:..1_A_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __

' r ANCHORAGE (Cont'd}

5. Factors affecting anchorage capacity or margin of safety considered: embedment length, anchor spacing, free-edge distance, concrete strength/condition, and concrete cracking Y N(ID N/A

5. For bolted anchorages, gap under base less than 7.

1/4-inch Factors affecting essential relays considered: gap LY N u N/A under base, capacity reduction for expansion anchors y N u @)

8. Base has adequate stiffness and effect of prying action on anchors considered y H@ N/A

9. Strength of equipment base and load path to CG adequate (i) N u N/A

10. Embedded steel, grout pad or large concrete pad adequacy evaluated y N u @

Are anchorage requirements met? y N(_y)

INTERACTION EFFECTS

1. Soft targets free from impact by nearby en equipment or structures Y N@ N/A

2. If equipment contains sensitive relays, equipment free from all impact by nearby equipment or structures y N

3. Attached lines have adequate flexibility a) N

4. Overhead equipment or distribution systems are

~

not likely to collapse N U N/A

5. Have you looked for and found no other adverse concerns? N U N/A Is equipment free of interaction effects? YNU

~ -J. -;Ju. O*if- hYo.d:6,S o..,;dcl,.{ ~

N@

(A.~

IS EQUIPMENT SEISMICALLY ADEQUATE? ikt ri"j pla.J~. rt...; ...,.....u, ~ y in JR loa.ch d ...... ~d -lu tlv botf~ Cc:,,.*h,;"11<"

COMMENTS br... e k~ tr. t,J~t(

1. fu-hNi,,,, ~ r~:t....,

2. (<ll..Jiew of d..-c....,~ s o-1 dP.r:o G,..N:...lt.-..s v ...... k.J r-tf ... t ~+~ (.Q ....., pl,Je d,.J,,e r..r p,o ..... k rt.

T .

.J

3. Ova..rl,u,-J r,,,;Jl;le, r!..=c lcl

4. 01'\A "' .. t i.s oLs~...~ i-:SJ:..J yi,.11 E=*~=;;~

.)

l"kt. f"lf7nt,J Ii.

I' r -~~

c,.t" rw. ,..u..~R. brll'c.~ "+ fl...+ - - . '\ ~ t-i., {t. A 5*""f"ft ,;.. +... b:"j ( 30 ,., :rl)  %:

(1-s1-P-1A~)

.,1('* S. (

Seis'"',*, l,,o.clc,h c-J.. ri"j pl,Jc..

o.itc.cl,-'-1: bol+J o.J.,.rc. ol:,,i:.e,...,,.,1. fl- A r,*.,..11,ol ~ 2- ~r-f-1 8.

Evaluated by: _ _ _ _ _ _ _ _ _ _ ___..4..,A.., .......~-=;..,;*_._i~-r'__

. I

_ _ _ _ _ _ _ _ _ _ _ _ Figure 5.2-2: (Continued)

( 4{e11,*11.w t::-., ,h.,.,. ...C ~ -t/...t fil !lo ... ,"-~

[o~bMJ ,

• 2HD 688nb/Surrych5

• Aiii.,l. ...~-4 o( tl...t bYc..el,A .{.., of'<.... c-f'r..;1,..._,_:f, 1 , . 1 ~

t Mt1H~~ of -,L..._ bl"c;.c:k.,.;t °(.:> of{,..,. y;"."j p(MA,..

I  ;, l+c. C(., ......._t b.e h,...u..,.. rl..i. I,,.\ .,fw rl-4 (:.G.,4 ~ *i!

NUREG/CR-6144 5 - 30 Vol. 5

Figure 5.2-3: Masonry Block Walls of 125V Battery Enclosure Figure 5.2-4: Masonry Block Walls of 125V Battery Enclosure Vol. 5 5-31 NUREG/CR-6144

Figure 5.2-5: 110,000 Gallon Condensate Water Storage Tank Concrete Enclosure Figure 5.2-6: 100,000 Gallon Emergency Condensate Makeup Tank NUREG/CR-6144 5-32 Vol. 5

... * . . *----;--* - * ~ - - .~.*-******- *-.-** *-* .. ,~.*** "*' ~-***v*,,

• Figure 5.2-7: Refueling Water Storage Tank

\,*,\.,

• \

~~:h...~---*-*-

Figure 5.2-8: Trapeze Supported Cable Trays

• Vol. 5 5-33 NUREG /CR-6144

~-;*;1:~_:::

. .;.:~:

Figure 5.2-9: Floor Supported Cable Trays NUREG/CR-6144 5-34 Vol. 5 *

\.,

1. i , ..

. .,.,. C

-r

,!._ ___Q..:

.i, r.;.....

'1. '-'.

Figure 5.2-10: LHSI Pump Upper Lateral Support Vol. 5 5-35 NUREG /CR-6144

© Figure 5.2-11: Lower CCW Heat Exchangers Figure 5.2-12: Upper CCW Heat Exchangers NUREG/CR-6144 5-36 Vol. 5

,~

Figure 5.2-13: Anchorage Details at the Concrete Pier of Lower CCW Heat Exchanger Figure 5.2-14: Vital Bus Distribution Panel in the Control Room Vol. 5 5-37 NUREG/CR-6144

Figure 5.2-15: Typical Battery Rack of 125V Batteries Figure 5.2-16: Live Tank Design Circuit Breakers in the Switchyard NUREG /CR-6144 5-38 Vol. 5

,~

Figure 5.2-17: Dead Tank Design Circuit Breakers in the Switchyard Figure 5.2-18: Friction Clip at the Base of Steel Frame Supporting Circuit Breakers

• Vol. 5 5-39 NUREG/CR-6144

Am =0.87g flR =0.25 flu = o.3s

....................*.~.~...................... .

w 0.8 a:

> 95% Median Mean

_J

<( Confidence u.. ......

u.. **************************************************************** ************************************************* ...# ....................................................................

0.6 0

I-

J CD

<( ..................................................................................................

0.4 ~

CD 0

a:

a. ... ...

0.2 0 0.2 0.6 0.8 1.2 1.4 HCLPF 0.32g PEAK GROUND ACCELERATION (g)

Figure 5.3-1: Median, 5% Non-Exceedance, and 95% Non-Exceedance Fragility Curves For a Component 5-40 Vol. 5 NUREG/CR-6144

• ~

6. SEISMIC RISK QUANTIFICATION FOR SURRY 6.1 Base Case The key elements of seismic risk quantification are seismic hazard analysis (Chapter 3), systems analysis (Chapter 4) and seismic fragility evaluation (Chapter 5). In this Chapter, these are assembled together to obtain estimates of the frequencies of different plant operating states.

In Chapter 4, two plant operating states were studied, because they were selected by the Brookhaven team (Ref. BNL, 1994) for analysis for internal intiators during shutdown. Based on the event trees described in Chapter 4, we have developed the Boolean equations for these plant operating states, and they are shown in Figure 1.

Note that the basic events in these Boolean equations are seismic-induced failures and human errors. The seismic fragilities of components appearing as basic events have been estimated as described in Chapter 5. The human error rates have been discussed in Chapter 4.

The seismic quantification, using the methodology described in Chapter 2, was done using the software package EQESRA (proprietary to EQE International Inc.) which takes as input the family of seismic hazard curves and the family of seismic fragility curves for all components appearing in the Boolean equations along with the probability distribution of human error rates. The component failures are treated as statistically independent in the computations.

Table 6-1 shows the base case results. The base case consists of the Surry plant (systems and fragilities) at the Surry site with EPRI and LLNL seismic hazard curves. In Table 6-1, the mean, median, 5 percentile and 95 percentile frequencies of the two plant operating states are shown. It is seen from the table that mean annual frequency of the two plant operating states is less than 10*6 per year using either the LLNL or the EPRI seismic hazard curves. Therefore, we conclude that the seismic contribution to mean annual core damage frequency during both POS 6 and POS 10 is very small at Surry Unit I.

6.2 Sensitivity Studies In the following, we describe the sensitivity studies conducted to assess the robustness of the insights obtained in this analysis.

6.2.1 Impact of Seismic Hazard Since one objective of this study is to derive generic conclusions on the significance of seismic events to shutdown risks, it is of interest to know how the seismic core damage frequency would vary with the site location. For this purpose, we assumed that the Surry plant could be at a site with a seismic hazard typical of the ensemble of nuclear power plants in the eastern United States. The Zion nuclear power plant site in Illinois was chosen. To study the effect for the plant with one of the highest seismic hazards in the eastern U.S., we chose the Pilgrim site in Massachusetts. Table 6-2 compares the frequency of plant operating state POS 6 for the two sites with that at Surry site.

Vol. 5 6- I NUREG /CR-6144

It can be seen from the Table that the core-damage frequency would be a factor of about 1.8 higher if the Surry plant were located at Zion, and slightly more than a factor of 10 higher if it were located at the Pilgrim site.

6.2.2 Uncertainty Analyses In the following, we describe the analyses performed to treat the uncertainties in human actions.

6.2.2.1 Hunian Actions: Human error rates and uncertainty bounds for different operator actions were discussed in Section 4.3. The error rates given in Table 4-1 were used in the risk quantification described above (Sections 6.1 and 6.2.1). In order to study the sensitivity of these results, we have assumed that the 95% upper bound human-error rates used in the base case are constant (deterministic) values and we have used these in this sensitivity study.

Table 6-3 shows the results of increased human error rates: for both POS 6 and POS 10, the increase in core-damage frequency is a factor of about 7.5.

6.2.2.2 Human Error Performing the Stub Bus Connection: A somewhat unique feature of Surry is the manual connection of the RHR pumps to the stub bus which is powered by the emergency AC power system following the loss of offsite power. For other plants, this connection is done automatically with a resultant increase in reliability and decreased sensitivity to human error. In order to examine the impact of this manual stub bus connection, we performed a sensitivity study wherein the human error in this operation was assumed to be the lower bound of the base case (i.e., 0.02). Table 6-4 compares the revised mean annual frequencies of the two plant operating states (POS 6 and POS 10) with the base case results.

It is seen that the seismic contribution to the shutdown risk is much lower: for both POS 6 and POS 10, the reduction in core-damage frequency is a factor of slightly less than 5.

6.3 Comparison with CDF from Internal Initiators During Mid-loop Operations and with CDF at Full Power It is instructive to compare the results for annual core-damage frequency (CDF) from this study with the CDF during shutdown arising from so-called "internal initiators", which has been analyzed by Brookhaven National Laboratory (Ref. BNL, 1994). Also instructive is a comparison with the NUREG-1150 findings for CDF at Surry for full-power operation.

The comparison of core-damage-frequency results is shown in Table 6.5. From examining the table, several important observations emerge:

o During shutdown conditions (in POS 6 + POS 10 combined), the total annual mean CDF arising from earthquakes is small compared to the CDF arising from internal initiators from (Ref. BNL, 1994): a factor of about 15 smaller for the LLNL seismic hazard curves and a factor of about 60 smaller using the EPRI hazard curves.

o The seismic mean CDF during shutdown (in PCS 6 + POS 10 combined) is small compared to the mean CDF at full power from seismic initiators from (Ref. Bohn, 1990):

a factor of about 350 times smaller for the LLNL hazard curves and about 300 times smaller for the EPRI hazard curves.

NUREG/CR-6144 6-2 Vol. 5

0 The Error Factor (EF) in this seismic study is significantly greater than the EF in Brookhaven's analysis of CDF from internal initiators during shutdown (POS 6 plus POS 10). This is primarily due to the large uncertainty in the seismic hazard curves but another contribution arises from the uncertainty in the seismic fragilities .

• Vol.5 6-3 NUREG/CR-6144

FIGURE 6.1 SURRY: BOOLEAN EXPRESSIONS FOR THE TWO PLANT OPERA TING ST A TES POS6 = SBHE. [ CCWHEX * { RHRP * ( RHRHEX

• EDG + RHRHEX

• SEQl

+ RHRP + SEQl } + CCWHEX

• SEQl ] + SBHE

• SEQ2 POS10 = CI * [SBHE * { CCWHEX * ( RHRP * (RHRHEX * (SRV * ( l-EE-TK-3 +

CNTRL-PNL +BATTERIES+ AIR-ACCUM + lHl-12 + lJl-12 + SRV * ( l-EE-TK-3 + CNTRL-PNL + BATTERIES + AIR-ACCUM + lHl-12 + lJl-12 } * ( RWST

• GFDHEl + RWST } } + RHREX

• SEQ3 } + RHRP

• SEQ3 } + CCWHEX

• SEQ3}

+ SBHE2

• SEQ4 ]

where SEQl = SRV * ( CST * ( SFBHEl * ( l-EE-TK-3 + CNTRL-PNL + BATTERIES

+ AIR-ACCUM + lHl-12 + lJl-12 } + SFBHEl * ( RWST * ( PFBHEl * ( l-EE-TK-3 + CNTRL-PNL + BATTERIES + AIR-ACCUM + lHl-12 + lJl-12 } +

PFBHEl } + RWST } } + CST

• SFBHEl .* ( RWST * ( PFBHE~ * ( l-EE-TK-3 +

CNTRL-PNL + BATTERIES + AIR-ACCUM + lHl-12 + lJl -12 } + PFBHEl } +

RWST } } + SRV * (RWST * ( PFBHEl * ( l-EE-TK-3 3 + CNTRL-PNL +

BATTERIES + AIR-ACCUM + lHl-12 + lJl-12 } + PFBHEl } RWST }

SEQ2 = SRV * ( CST * ( SFBHE2 * ( l-EE-TK-3 + CNTRL-PNL + BATTERIES

+ AIR-ACCUM + lHl -12 + lJl -12 } + SFBHE2 * (RWST *( PFBHE2 * ( l-EE-TK-3 + CNTRL-PNL + BATTERIES + AIR-ACCUM + lHl-12 + lJl-12 ) +

PFBHE2 ) + RWST } ) + CST

• SFBHE2 * ( RWST * ( PFBHE2 * ( l-EE-TK-3 +

CNTRL-PNL + BATTERIES + AIR-ACCUM + lHl-12 + lJl-12 } + PFBHE2 ) +

RWST ) } + SRV * ( RWST * ( PFBHE2 * ( 1-EE-TK-3 + CNTRL-PNL +

BATTERIES + AIR -ACCUM + lHl -12 + lJl -12 } + PFBHE2 } + RWST )

SEQ3 = SRV * ( RWST * ( PFBHEl * ( l-EE-TK-3 + CNTRL-PNL + BATTERIES

+ AIR-ACCUM + lHl-12 + lJl-12 ) + PFBHEl } + RWST } + SRV * ( RWST *

( PFBHEl * ( 1-EE-TK-3 + CNTRL-PNL + BATTERIES + AIR-ACCUM + lHl-12

+ lJl -12 }

• GFDHEl + PFBHEl

• GFDHEl ) + RWST }

and SEQ4 = SRV * ( RWST * ( PFBHE2 * ( l-EE-TK-3 + CNTRL-PNL + BATTERIES

+ AIR-ACCUM + lHl-12 + lJl-12 ) + PFBHE2 } + RWST } + SRV * (RWST *

( PFBHE2 * ( 1-EE-TK-3 + CNTRL-PNL + BATTERIES + AIR-ACCUM + lHl-12

+ lJl -12 )

• GFDHE2 + PFBHE2

• GFDHE2 ) + RWST }

NUREG/CR-6144 6-4 Vol.S.

TABLE 6.1 SURRY: POS FREQUENCY ESTIMATES (all values are core-damage frequency per year) 5% 95%

POS State Mean Median Confidence Confidence EPRI Hazard Curves POS 6 6.6 E-8 7.4 E-9 1.9 E-10 2.8 E-7 POS 10 2.0 E-8 2.3 E-9 6.2 E-11 8.8 E-8 Total, POSs 6 & 10 8.6 E-8 9.7 E-9 2.5 E-10 3.7 E-7 LLNL Hazard Curves POS 6 2.6 E-7 3.0 E-8 9.6 E-10 1.0 E-6 POS 10 9.1 E-8 1.0 E-8 3.5 E-10 3.5 E-7 Total, POSs 6 & 10 3.5 E-7 4.0 E-8 1.3 E-9 1.4 E-6 TABLE 6.2 SURRY: SENSITIVITY OF POS 6 CDF TO SEISMIC SITE HAZARD (all values are core-damage frequency per year)

(using EPRI hazard curves)

Median 95% Confidence Surry Site 6.6 E-8 7.4 E-9 2.8 E-7 Pilgrim Site 7.2 E-7 1.9 E-7 2.8 E-6 Zion Site 1.2 E-7 2.8 E-8 6.6 E-7 a) This sensitivity study represents "moving" the Surry reactor to the other two sites shown, with all other features of Surry remaining the same as in Table 6-1 Vol. 5 6-5 NUREG /CR-6144

TABLE 6.3 SURRY: SENSITIVITY OF CDF TO INCREASING ALL HUMAN ERROR RATES (all values are mean core-damage frequency per year)

(using EPRI hazard curves)

POS State Base Case Increased Human Error Ratesa POS 6 6.6 E-8 5.1 E-7 POSIO 2.0 E-8 1.5 E-7 a) Human error rates: use of the 95% upper confidence-bound error rates (representing poorer human perfor-mance) instead of the mean rate that is used in the base case, for all human errors in Table 4-1 TABLE 6.4 SURRY: SENSITIVITY OF CDF TO IMPROVED HUMAN ERROR RATE FOR STUB-BUS CONNECTION (all values are mean core-damage frequency per year)

(using EPRI hazard curves)

Stub-Bus Connection:

POS State Base Case Decreased Human Error Ratea POS 6 6.6 E-8 1.3 E-8 POS 10 2.0 E-8 4.1 E-9 a) The human error rate for the stub-bus connection:

sensitivity of using the 5% upper-confidence bound (representing improved human performance) as a deterministic value instead of the mean rate that is used in the base case NUREG/CR-6144 6-6 Vol.5.

• TABLE 6.5 COMPARISONS OF CDF FOR SHUTDOWN vs. FULL-POWER CONDITIONS AND FOR SEISMIC INITIATORS vs. INTERNAL-INITIATORS Analysis Condition Reference Mean CDF /year Error Factora Shutdown (POSs 6 & 10) Brookhaven 5.0 E-6 5.6 internal initiatorsb (Ref. BNL,1994)

Shutdown (POSs 6 & 10) This study 3.5 E-7 (LLNL f 32 seismic initiator 8.6 E-8 (EPRif 37 Full power NUREG-1150 4.0 E-5 4.4 internal initiatorsb (Ref. NRC/1150,1990)

Full power NUREG-1150 1.2 E-4 (LLNL)c 33 seismic initiator (Ref. Bohn, 1990) 2.5 E-5 (EPRI)C 19 Footnotes for Table 6.5:

a) The Error Factor is the ratio of the 95%-percentile value to the median value of CDF (core-damage frequency/year).

b) The notation "internal initiators" includes all initiators that start with internal plant faults or loss of offsite power, but excludes internal fires and internal flooding.

c) The notation (LLNL) and (EPRI) indicates use of the LLNL or the EPRI seismic hazard curves for the Surry site .

• Vol.5 6-7 NUREG /CR-6144

7. CONCLUSIONS AND

SUMMARY

A number of important insights emerge from this Surry analysis, including:

Core-damage frequency: The core-damage frequency for earthquake-initiated accidents during refueling outages in POS 6 and POS 10 is found to be low in absolute terms, below 10*6/year.

The reasons for this are (i) Surry's seismic capacity in responding to earthquakes during shutdown is excellent, well above its design basis and similar to its ability to respond to earthquakes during full-power conditions; (ii) the Surry site enjoys one of the least seismically active locations in the United States; (iii) the Surry plant is only in POS 6 and POS 10 (combined) for an average (mean) of 6.6% of the time.

The core-damage frequencies are also low relative to the frequencies during POS 6 and POS 10 for internal initiators, as analyzed in the companion study by Brookhaven (Ref. BNL, 1994).

This can be seen in Table 6.5.

The results are plant-specific: We believe that the results for Surry are highly plant-specific, in the sense that the seismic capacities, the specific sequences that are found to be most important, and the seismicity of the site are all difficult to generalize to other reactors elsewhere.

Shutdown seismic sequences are similar to full-power seismic sequences: Nevertheless, it is important to observe that all of the sequence types, components, and human errors that emerge in the key sequences in this analysis are similar or identical to sequences, components, and human errors that appear in typical full-power seismic PRAs. That is, nothing that has arisen as important in this study appears to be unique to earthquakes occurring during shutdown conditions. Whether this observation is generalizable to other reactors at other sites is unknown to us.

Sensitivities: Sensitivity studies reveal that if the Surry reactor were moved to the Zion site in Illinois (a typical midwestern site) or the Pilgrim site in Massachusetts (one of the most seismically active sites among all of the reactor sites in the eastern U.S.), the mean annual CDF from this study would increase by factors of about 1.8 and 10, respectively.

Uncertainties: While there are significant uncertainties in the numerical values of core-damage frequencies found in this study (see Tables 6.1 through 6.5), the above conclusions are relatively robust --- they do not depend on the detailed numerical values found.

Vol. 5 7- 1 NUREG/CR-6144

• ~

• 8. REFERENCES Bernreuter et al, 1989: D.L. Bernreuter, J.B. Savy, R.W. Mensing and J.C. Chen, "Seismic Hazard Characterization of 69 Nuclear Plant Sites East of the Rocky Mountains," NUREG/CR-5250, Lawrence Livermore National Laboratory, January 1989 BNL, 1994: T-L. Chu et al., "Evaluation of Potential Severe Accidents During Low-Power and Shutdown Operations at Surry Unit I", NUREG/CR-6144, Volume 2, "Analysis of Core Damage Frequency from Internal Events during Mid-Loop Operations", Brookhaven National Laboratory for the U.S. Nuclear Regulatory Commission, June 1994 Bohn et al, 1990: MP. Bohn, J.A. Lambright, S.L. Daniel, J.J. Johnson, MK. Ravindra, P.O.

Hashimoto, MJ. Mraz, and W.H. Tong, "Analysis of Core Damage Frequency: Surry Power Station, Unit I, External Events", NUREG/CR-4551, Vol. 3, Rev. 1, Part 3, Sandia National Laboratories, December 1990 Breeding et al, 1990: R.J. Breeding, J.C. Helton, W.B. Murfin, and L.N. Smith, "Evaluation of Severe Accident Risks: Surry Unit 1, Main Report", NUREG/CR-4551, Vol. 3, Rev. 1, Part 1, Sandia National Laboratories, October 1990 Brown et al, 1990: T.D. Brown, R.J. Breeding, H.-N. Jow, J.C. Helton, S.J. Higgins, C.N. Amos, and A.W. Shiver, "Evaluation of Severe Accident Risks: Grand Gulf, Unit 1, Main Report",

NUREG/CR-4551, Vol. 6, Rev. 1, Part 2, Sandia National Laboratories, December 1990 Budnitz, Lambert, and Hill, 1987: R.J. Budnitz, H.E. Lambert, and E.E. Hill, "Relay Chatter and Operator Response After a Large Earthquake", NUREG/CR-4910, Future Resources Associates, Inc., August 1987 Campbell et al., 1988: R.D. Campbell, MK. Ravindra, and R.C. Murray, "Compilation of Fragility Information from Available Probabilistic Risk Assessments", Report UCID-20571, Rev. 1, Lawrence Livermore National Laboratory, Livermore, California, 1988 Chen et al, 1991: J.T. Chen et al., "Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities," NUREG-1407, U.S. Nuclear Regulatory Commission, June 1991 EPRI-1988: Electric Power Research Institute, "A Methodology for Assessment of Nuclear Power Plant Seismic Margin,", EPRI Report NP-6041, 1988 EPRI, 1989: Electric Power Research Institute, "Probabilistic Seismic Hazard Evaluations at Nuclear Power Plant Sites in the Central and Eastern United States: Resolution of the Charleston Earthquake Issue," Prepared by Risk Engineering Inc., Yankee Atomic Power Company and Woodward Clyde Consultants, EPRI Report NP-6395-D, April 1989 EOE, 1992: "Transmittal of Final Seismic Response Analysis Results for Surry and North Anna IPEEE and USI A-46 Resolution", EQE Correspondence No. 52182-0-015, EQE International, San Francisco, November 30, 1992

• Vol. 5 8- 1 NUREG /CR-6144

FRA, 1991: R.J. Budnitz and P.R. Davis, "A Scoping Evaluation of Severe Accidents at the

• Surry and Grand Gulf Nuclear Power Plants Resulting from Earthquakes During Shutdown Conditions", Future Resources Associates, Inc. for the U.S. Nuclear Regulatory Commission, 1991 FRA/Grand Gulf, 1994: R.J. Budnitz, P.R. Davis, M.K. Ravindra, and W.H. Tong, "Evaluation of Potential Severe Accidents During Low-Power and Shutdown Operations at Grand Gulf",

NUREG/CR-6143, Volume 5, "Analysis of Core Damage Frequency from Seismic Events for Plant Operational State 5 During a Refueling Outage", Future Resources Associates, Inc. for the U.S. Nuclear Regulatory Commission, August 1994 Kennedy and Ravindra, 1984: R.P. Kennedy and MK. Ravindra, "Seismic Fragilities for Nuclear Power Plant Risk Studies," Nuclear Engineering and Design, Vol. 79, No. I, pp. 47-68, May 1984 Lambright *et al, 1990: J.A. Lambright, M.P. Bohn, S.L. Daniel, J.J. Johnson, MK. Ravindra, P.O. Hashimoto, MJ. Mraz, W.H. Tong, and D.A. Brosseau, "Analysis of Core Damage Frequency:

Peach Bottom Unit 2, External Events", NUREG/CR-4550, Vol. 4, Rev. I, Part 3, Sandia National Laboratories, December 1990 Newmark, 1977: N.M Newmark, "Inelastic Design of Nuclear Reactor Structures and Its Implications on Design of Critical Equipment", Paper K 4/1, "Proceedings of the Fourth Conference on Structural Mechanics in Reactor Technology", San Francisco, California, August 1977 NRC, 1983: PRA Procedures Guide, Chapter 10, "Analysis of External Events", and Chapter 11, "Seismic Risk Analysis", NUREG/CR-2300, U.S. Nuclear Regulatory Commission, January 1983 NRC/NUREG-1150, 1990: U.S. Nuclear Regulatory Commission, "Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, Final Summary Report", NUREG-1150, December 1990 Ravindra and Kennedy, 1983: MK. Ravindra, and R.P: Kennedy, "Lessons Learned from Seismic PRA Studies," Paper M6/4, in "Proceedings of the Seventh Conference on Structural Mechanics in Reactor Technology," Chicago, Illinois, August 1983 Riddell and Newmark, 1979: R. Riddell and N.M Newmark, "Statistical Analysis of the Response of Nonlinear Systems Subjected to Earthquakes", Report UILU 79-2016, University of Illinois, Urbana, August 1979 Sandia, 1994: D.W. Whitehead et al., "Evaluation of Potential Severe Accidents During Low-Power and Shutdown Operations at Grand Gulf", NUREG/CR-6143, Volume 2, "Analysis of Core Damage Frequency from Internal Events for Plant Operational State 5 During a Refueling Outage", Sandia National Laboratories for the U.S. Nuclear Regulatory Commission, June 1994 Swain and Guttmann, 1980: A.D. Swain and H.E. Guttmann, "Handbook of Human Reliability Analysis With Emphasis on Nuclear Power Plant Applications", NUREG/CR-1278, Sandia National Laboratories, April 1980 Zion, 1981: Commonwealth Edison Company, "Zion Probabilistic Safety Study", 1981 NUREG /CR-6144 8-2 Vol. 5

• ~

• Kiyoharu Abe Dept. of Reactor Safety Research Nuclear Safety Research Center Takai Research Establishment JAERI Tokai-mura, Naga-gun Ibaraki-ken, Ephraim Asculai Division of Nuclear Safety Wagramestrasse, 5 P.O. Box 100 A-1400 Wien AUSTRIA JAPAN Vladimar Asmolov Head, Nuclear Safety Department Sarbes Acharya I. V. Kurchatov Institute Department of Energy of Atomic Enegry NS-1/FORS Moscow, 123181 Washington, DC 20585 RUSSIA Dr. Ulvi Adalioglu J. de Assuncao Cekmece Nukleer Arastraima ve Cabinete de Proteccao e Egitim Merekezi Seguranca Nuclear P.K. 1 Ministerio da Indusstria Havaalani/ISTANBUL Ave. de Republica 45-6 TURKEY 1000 Lisbon PORTUGAL Dr. Eng. Kiyoto Aizawa Senior Engineer H.P. Balfanz, Head Reactor Eng. Dev. Department Institute of Probabilistic PNC Safety Analysis 9-13, Chome, Akasaka TUV Nord Minato-K, Tokyo Grosse Bahnstrasse 31 JAPAN D-22525 Hamburg 54 GERMANY Harry Alter Manager Applied Tech Pat Baranowsky Nuclear Systems Tech USNRC-AEOD/TPAB NE-46 MS: T-4A9 US DOE Washington, DC 20585 Robert A. Bari, Deputy Chairman Dept of Nuclear Energy R.M. Andrews Bldg l97C Nuclear Installations Insp. Brookhaven National Laboratory St. Peters House Upton, NY 11973 Balliol Raad, Bootle Merseyside L20 31Z UNITED KINGDOM Librarian Technical Information Section Battelle Pacific Northwest Lab George Apostolakis P. 0. Box 999 UCLA Richland, WA 99352 Boelter Hall, Room 5532 Los Angeles, CA 90024-1597 Dr. John Baum Dept of Nuclear Energy Director of Reactor Engineering Radiological Sciences Div Argonne National Laboratory Bldg 703 M 9700 S Cass Ave Brookhaven National Laboratory Bldg 208 Upton, NY 11973 Argonne, IL 60439

• Dist-1

Eric Beckjord USNRC-RES/DO MS: T-10Fl2 Robert Bernero USNRC-NMSS/DO Dennis Bley Buttonwood Consulting 17291 Buttonwood St.

Fountain Valley, CA 92708 Roger Blond MS: T-8A23 Boaz-Allen & Hamilton 4330 East West Highway Bethesda, MD 20814 Andrea Besi Institute for Systems Engineering and Informatics M. P. Bohn CEC Joint Research Centre Division 6449 CP N 1 Sandia National Laboratories 1-21020 Ispra (Varese) Albuquerque, NM 87185 ITALY Dr. Mario Bonaca John Bickel Manager, Reactor Engineering Idaho National Engineering Lab. Northeast Utilities EG&G MS: 3850 P.O. Box 270 P.O. Box 1625 Hartford, Conn. 06141 Idaho Falls, ID 83415 Robert B. Borsum Vicki Bier Nuclear Power Division Dept. of Industrial Engineering B & w Nuclear Tech University of Wisconsin-Madison 1700 Rockville Pike 1513 University Avenue, Room 389 Suite 525 Wisconsin, WI 53706 Rockville, MD 20852 Scott Bigelow Stephen Bault S-COBED Electrowatt Engineering Services 2501 Yale SE, Suite 300 (UK) Ltd.

Albuquerque, NM 87106 Grandford House 16 Carfax, Horsham West. Sussex RH12 IUP Prof. Dr. Dr.-Ing. E. H. Adolf ENGLAND Birkhofer Gesellschaft fur Anlagen und Reaktorsicherheit (GRS) mbH Gary Boyd Forschungsgelande Safety & Reliability Optimization D-8046 Garching Services Federal Republic of Germany 9724 Kingston Pike, Suite 102 Knoxville, TN 37922 David Black American Electric Power Brookhaven National Laboratory (2) 1 Riverside Plaza Attn: Lev Neymotin Columbus, OH 43215 Arthur Tingle Building 130 Upton, NY 11973.

Harold Blackman Idaho National Engineering Lab.

EG&G MS: 3850 David M. Brown P.O. Box 1625 Paul C. Rizzo Associates, Inc.

Idaho Falls, ID 83415-3850 300 Oxford Drive Monroeville, PA 15146-2347 Dist-2

• Tom D. Brown Sandia National Laboratories Dept. 6413 P.O. Box 5800 Albuquerque, NM 87185 A. L. Camp Division 6412 MS: 0748 Sandia National Laboratories Albuquerque, NM 87185-0748 Robert J. Budnitz John Forbes Campbel Future Resources Associates, Inc. HM Superintending Inspector 2039 Shattuck Avenue, Suite 402 Health & Safety Executive Berkeley, CA 94704 St. Peter's House Balliol Road Bootle L20 31Z Gary Burdick UNITED KINGDOM USNRC-RES/SAIB MS: T-10Fl3 Leonel Canelas New University of Lisbon Arthur Buslik Quinta de Torre USNRC-RES/PRAB 2825 Monte de Caparica MS: T-9F31 PORTUGAL Edward Butcher Harold Careway USNRC-NRR/SPSB General Electric Co., M/C 754 MS: 0-10E4 175 Curtner Ave.

San Jose, CA 95129 Technical Library B&W Nuclear Service Co D. D. Carlson P. o. Box 10935 Division 6411 Lynchburg, VA 24506 Sandia National Laboratories Albuquerque, NM 87185 Stefaan Caeymaex Safety & Systems Section Jose E. De Carlos Nuclear Generation Dept. CSN International Coordinator TRACTEBEL Consejo de Seguridad Nuclear Avenue Ariane 7 Calle Justo Dorado 11 B-1200 Bruxelles 28040 Madrid BELGIUM SPAIN Leonard Callan, Administrator Annick Camino U.S. Nuclear Regulatory Couunission International Atomic Energy Agency Harris Tower and Pavilion Wagramerstrasse 5, P.O. Box 100 611 Ryan Plaza Drive, Suite 400 A-1400 Vienna Arlington, TX 76011-8064 AUSTRIA J .. Calvo S. Chakraborty Division of PSA & Human Factors Swiss Federal Nuclear Safety Consejo de Seguridad Nuclear Inspectorate Calle Justo Dorado, 11 Hauptabteilung fur die Sicherheit 28040 Madrid ' der Kernanlagen SPAIN CH-5232 Villigen-HSK SWITZERLAND Erulappa Chelliah USNRC-RES/PRAB le Dist-3 MS: T-9F31

Mike Check S . Daggupaty NUS Environment Canada 910 Clopper Road 4905 Dufferin Street Gaithersburg, MD 20878 Downsview Ontario, M3H ST4 CANADA Nilesh Chokshi USNRC-RES/SSEB MS: T-10L1 Louise Dahlerup Inspectorate of Nuclear Inst.

Danish Civil Defense &

T. L. Chu Emergency Planning Agency Brookhaven National Laboratory 16, Datavej Department of Nuclear Energy DK-3460 Birkerod Bldg. 130 DENMARK Upton, NY 11973 John Darby Peter Cooper SEA, Inc.

SRD/AEA Technology 6100 Uptown Blvd. NE Wigshaw Lane Albuquerque, NM 87110 Culcheth

.Cheshire WA3 4NE England Gerald Davidson Fauske and Associates, Inc.

16 W 070 West 83rd Street Susan E. Cooper Burr Ridge, IL 60521 Science Applications Int'l. Corp.

11251 Roger Bacon Drive Reston, VA 22090 Peter Davis PRD Consulting P.O. Box 2046 Michael Corradini Sheridan, WY 82801 University of Wisconsin 1500 Johnson Drive Madison, WI 53706 P. De Gelder Secretary, BELGIAN NUCLEAR SOCIETY (BNS)

E.R. Carran AV Nuclear ANSTO Reasearch Establishment Avenue du Roi 157 Lucas Heights Reserch Labs. B-1060 Brussels Private Mail Bag 1 BELGIUM Manai, NSW 2234 AUSTRALIA Lennart Devell Studsvik Nuclear Massimo Cozzone Studsvik Energiteknik AB A.N.P.A. S-611 82 Nykoping Via v. Brancati, 48 SWEDEN I-00144 Rome ITALY J. Devooght Service de la Metrologie Nucl George Crane University Libre de Bruxelles 1570 E. Hobble Creek Dr. Faculte des Sciees Appliqu.

Springville, Utah 84663 SO Avenue F-D Roosevelt Bruxelles s BELGIUM Mark Cunningham USNRC-RES/PRAB MS: T-9F31 Dist-4

• G. Diederick Commonwealth Edison Co.

LaSalle County Station RRl, Box 220 2601 North 21st Rd.

Marsielles, IL 61341 John Flack USNRC-RES/SAIB MS: T-10F13 Karl Fleming Pickard, Lowe & Garrick 2260 University Drive Chuck Dobbe Newport Beach, CA 92660 Idaho National Engineering Lab.

EG&G MS: 3840 P.O. Box 1625 Terry Foppe Idaho Falls, ID 83415 Safety Analysis Engineering Rocky Flats Plant Energy Systems Group Mary Drouin Rockwell International Corp

. USNRC-RES\SAIB P.O. Box 464 MS: T-10F13 Golden, CO 80401 Duke Power Co. (2) RH. Gauger Attn: Duncan Brewer Manager-Reliability Engr Steve Deskevich A/E Div 422 South Church Street Holmes & Narver Inc.

Charlotte, NC 28242 R Roanne Circle Irvine, CA 92714 Bill Eakin Northeast Utilities Robert Gobel Box 270 Clark University Hartford, CT 06141 Center for Technology, Envirorunent and Development 950 Main St.

Stewart D. Ebneter Worcester, MA 01610-1477 USNRC 101 Marietta St., Suite 2900 Atlanta, GA 30323-0199 Paul Govaerts Studiecentrum veer Kernenergie (SCK/CEN)

Adel A. El-Bassioni Boeretang, 200 USNRC-NRR/PRAB B-2400 Mel MS: 0-10E4 BELGIUM ENEA/DISP ( 2 ) Mr. Gubler Attn: Alvaro Valeri International Atomic Energy Agency Alfredo Bottino NENS/SAD B0842 Via Vitaliano Brancati, 48 Wagramerstrass~ 5, P.O. Box 100 00144 Roma EUR A-1140 Vienna ITALY. AUSTRIA Walter P. Engel Paul M. Haas, President PRAG MGR Analysis & Reg Matter Concord Associates, Inc.

NE-60 725 Pellissippi Parkway CRYCITY Suite 101, Box 6 US DOE Knoxville, TN 37933 Washington, DC 20585

• Dist-5

F. T. Harper Division 6413 MS: 0748 Sandia National Laboratories Albuquerque, NM 87185-0748 Steven Hodge Oak Ridge National Laboratories P. O. Box Y Oak Ridge, TN 37831 Gary Holahan Dr. U. Hauptmanns USNRC-AEOD/OSP Gesellschaft Fur .Anlagen und MS: T-4A9 Reaktorsicherheit (GRS) mgH Schwertnergasse 1 D-sooo Koln 1 N.J. Holloway GERMANY A72.1 Atomic Weapons Establishment Ademaston Sharif Heger Reading RG7 4PR UNM Chemical and Nuclear UNITED KINGDOM Engineering Department Farris Engineering, Room 209 Albuquerque, NM 87131 Griff Holmes Westinghouse Electric Co.

Energy Center East Jon C. Helton Bldg. 371 Dept. of Mathematics P.O. Box 355 Arizona State University Pittsburgh, PA 15230 Tempa, AZ 85287 William Hopkins Dr. P. M. Herttrich Bechtel Power Corporation Gesellschaft fur .Anlagen und 15740 Shady Grove Road Reaktorsicherheit (GRS) mbH Gaithersburg, MD 20877 Schwertnergasse 1 5000 Koln 1 GERMANY Dean Houston USNRC-ACRS MS: P-315 Dr. D.J. Higson Radiological Safety Bureau Australian Nuclear Science & Der-Yu Hsia Technology Organisation Institute of Nuclear Energy Research P.O. Box 153 Lung-Tan 325 Roseberry, NSW 2018 TAIWAN AUSTRALIA Alejandro Huerta-Bahena Dr. Mitsumasa Hirano National Commission on Nuclear Deputy General Manager Safety and Safeguards (CNSNS)

Institute of Nuclear Safety Insurgentes Sur N. 1776 NUPEC C. P. 04230 Mexico, D. F.

3-6-2, Toranomon, Minato-ku MEXICO Tokyo 108 JAPAN Peter Humphreys US Atomic Energy Authority Dr. S. Hirschberg Wigshaw Lane, Culcheth Paul Scherrer Institute Warrington, Cheshire Vurenlingen and Villigen UNITED KINGDOM, WA3 4NE CH-5232 Villigen PSI SWITZERLAND Dist-6

i \ - I

• W. Huntington Commonwealth Edison Co.

LaSalle County Station RRl, Box 220 2601 North 21st Rd.

Marsielles, IL 61341 Dr. H. Kalfsbeek DG/XII/D/1 Commission of the European Communities Rue de la Loi, 200 B-1049 Brussels BELGIUM J.S. Hyslop USNRC-RES/PRAB Yoshie Kano MS: T-9F31 General Mngr. & Sr. Engineer Systems Analysis Section 0-arai Engineer. Centr, PNC Idaho National Engineering Lab. (2) Higashi-Ibaraki-gun Attn: Doug Brownson Ibaraki-Ken, 133-13 Darrel Knudson JAPAN EG&G MS: 3840 P.O. Box 1625 Idaho Falls, ID 83415 William Kastenberg UCLA Boelter Hall, Room 5532 Idaho National Engineering Lab. (2) Los Angeles, CA 90024 Attn: Art Rood Mike Abbott EG&G MS: 2110 Barry Kaufer P.O. Box 1625 OECD/NEA Idaho Falls, ID 83415 "Le Seine St. Germain" 12 Boulevard des Iles 92130 Issy-les-Moulineaux Hanspeter Isaak FRANCE Abteilung Strahlenschutz Hauptabteilung fur die Sicherheit der Kernanlagen (HSK) Paul Kayser CH-5303 Wurenlingen Division de la Radioprotection SWITZERLAND Avenue des Archiducs, 1 L-1135 Luxembourg-Belair LUXEMBOURG Brian Ives UNC Nuclear Industries P.O. Box 490 Ken Keith Richland, WA 99352 TVA W 20 D 201 400 West Surmnit Hill Kamiar Jamili Knoxville, TN 37092 DP-62/FTN Department of Energy Washington, D.C. 20585 G. Neale Kelly Commission of the European Communities Robert Jones Joint Research Centre USNRC-NRR/DSSA Rue de la Loi 200 MS: 0-8El B-1049 Brussels BELGIUM Edward Jordan USNRC-AEOD/DO John Kelly MS: T-4Dl8 Sandia National Laboratories P. 0. Box 5800 MS 0742 Albuquerque, NM 87185

• Dist-7

Knolls Atomic Power Laboratory (2)

Attn: Ken McDonough Dominic Sciaudone Box 1072 Schenectady, NY 12301 Dr. J.M. Lanore CEA/IPSN/DAS Centre d'Etudes Nucleaires de Fontenay-aux-Roses B.P. n° 6 92265 Fontenay-aux-Roses CEDEX FRANCE Dr. K. Koberlein Gesellschaft fur Reaktorsicherheit mbH Jose A. Lantaron Forschungsgelande Consejo de Seguridad Nuclear D-8046 Garching Sub. Analisis y Evaluaciones GERMANY Calle Justo Dorado, 11 28040 Madrid SPAIN Alan Kolaczkowski Science Applications International Corporation Josette Larchier-Boulanger 2109 Air Park Rd. s. E. Electricte de France Albuquerque, NM 87106 Direction des Etudes Et Recherches 3 0, Rue de Conde 75006 Paris Jim Kolanowski FRANCE Commonwealth Edison Co.

35 1st National West Chicago, IL 60690 H. Larsen Head of Department Riso National Laboratory John G. Kallas P.O. Box 49 Institute of Nuclear Technology and DK-4000 Roskilde Radiation Protection DENMARK N.R.C.P.S. "Demokritos" P.O. Box 60228 GR-153 10 Aghia Paraskevi Lawrence Livermore Nat'l Lab. (4)

Attiki Attn: George Greenly GREECE Marvin Dickerson Rolf Lange Sandra Brereton S. Kondo Livermore, CA 94550 Department of Nuclear Engineering Facility of Engineering University of Tokyo Shengdar Lee 3-1, Hongo 7, Bunkyo-ku Yankee Atomic Electric Company Tokyo 580 Main St.

JAPAN Boston, MA 17407 D. Lamy B.T .F. Liwaang

• CEN/SCK Dept. of Plant Safety Assessment Dept. Scientific Irradiation Swedish Nuclear Power Inspec.

Experiment & Study BR2 P.O. Box 27106 Boeretang, 200 S-10252 Stockholm B-2400 Mel SWEDEN BELGIUM Peter Lohnberg Expresswork International, Inc.

1740.Technology Drive San Jose, CA 95110 Dist-8

("t.

• I Steven M. Long Hideo Matsuzuru USNRC-NRR/SPSB Tokai Research Establishment MS: 0-10E4 Tokai-mur Maka-qun Ibaraki-ken, 319-11 D. Eugenio Gil Lopez JAPAN Consejo de Seguridad Nuclear Calle Justo Dorado, 11 28040 Madrid Jim Mayberry SPAIN Ebasco Services 60 Chubb Ave.

Lyndhurst, NJ 07071 Los Alamos National Laboratory (2)

Attn: Kent Sasser N-6, K-557 Andrew S. McClymont Los Alamos, NM 87545 IT-Delian Corporation 1340 Saratoga-Sunnyvale Rd.

Suite 206 Christiana H. Lui San Jose, CA 95129 USNRC-RES/PRAB MS: T-9F31 Michael McKay Los Alamos National Laboratory John Luke A-1, MS F600 Services Florida Power & Light P.O. Box 1663 P.O. Box 14000 Los Alamos, NM87545 Juno Beach, FL 33408 Zen Mendoza Daniel Manesse SAIC ISPN 5150 El Camino Real Bai te Postale n° 6 Suite C3 1 92265 Fontenay-aux-Roses CEDEX Los Altos, CA 94022 FRANCE Dr. J. Mertens Fred Mann Division of Risk Analysis &

Westinghouse Hanford Co. Reactor Technology WIA-53 Institute of Safety Research P.O. Box 1970 Research Centre Julich (KFA)

Richland, WA 99352 D-52425 Julich GERMANY Nadia Saide Falcao Martins Comissao Nacional de Energia Nuclear Jim Meyer R General Severianao 90 S/408-1 Sci en tech Rio de Janeiro 11821 Parklawn Dr.

BRAZIL Suite 100 Rockville, MD 20852 Harry F. Martz Analysis and Assessment Division Joe Minarick Los Alamos National Laboratory Science Applications Int'l Corp.

Los Alamos, NM 87545 301 Laboratory Road P.O. Box 2501 Oak Ridge, TN 37830 Herbert Massin Commonwealth Edison Co.

35 1st National West Chicago, IL 60690 Dist-9

rt ,- 1 Jose I. Calvo Molins, Head Division of P.S.A. and Human Factors Consejo de Seguridad Nuclear Calle Justo Dorado, 11 28040 Madrid SPAIN Ken O'Brien University of Wisconsin Nuclear Engineering Dept.

153 Engineering Research Blvd.

Madison, WI 53706 Theresa Oh Ken Muramatsu INEL Tech Library Risk Analysis Laboratory EG&G MS: 2300 Japan Atomic Energy Research P. 0. Box 1625 Institute Idaho Falls, ID 83415-2300 Tokai-mura, Naka-gun Ibaraki-ken, 319-11, Tokyo JAPAN N. R. Ortiz, Director Nuclear Energy Technology Division 6400 Joseph A. Murphy Sandia National Laboratories Division of Safety Issue Resolution Albuquerque, NM 87185 U.S. Nuclear Regulatory Commission MS: T-10E50 Washington, DC 20555 Robert Ostmeyer U.S. Department of Energy Rocky Flats Area Office Kenneth G. Murphy, Jr. P. o. Box 928 US Department of Energy Golden, CO 80402 19901 Germantown Rd.

Germantown, MD 20545 Robert Palla USNRC-NRR/SPSB Shankaran Nair MS: 0-10E4 Central Electricity Generating Board Berkeley Nuclear Laboratories Gareth Parry Berkeley NUS Corporation Gloucestrshire CL13 9PB 910 Clopper Rd.

UNITED KINGDOM Gaithersburg, MD 20878 Ray Ng Vern Peterson NEI Building T886B 1776 Eye St. N EG&G Rocky Flats Suite 300 P.O. Box 464 Washington, DC 20006-2496 Golden, CO 80402 G. Niederauer G. Petrangeli Los Alamos National Laboratory ENEA Nuclear Energy ALT Disp P.O. Box 1663 Via V. Brancati, 48 MSK 575 00144 Rome Los Alamos, NM 87545 ITALY Oak Ridge National Laboratory (2) Ing. Jose Antonio Becerra Perez Attn: Steve Fisher Comision Nacional De Seguridad Sherrel Greene Nuclear Y Salvaguardias MS-8057 Insurgentes Sur 1806 P.O. Box 2009 01030 Mexico, D. F.

Oak Ridge, TN 37831 MEXICO Dist-10

William T. Pratt M. Roch

• Brookhaven National Laboratory Manager of Design, Nuclear Building 130 Department Upton, NY 11973 TRACTEBEL Avenue Ariane 7 B-1200 Bruxelles Urho Pulkkinen BELGIUM Technical Research Centre of Finland A.E. Rogers Laboratory of Electrical & General Electric Co Automation Engineeering 175 Curtner Ave Otakaari 7B, 02150 Espoo 15 MC-489 FINLAND San Jose, CA 95125 Blake Putney Judy Rollstin Science Applications GRAM Inc International Corporation 8500 Menual Blvd. NE 5150 El Camino Real, Suite C31 Albuquerque, NM 87112 Los Altos, Ca 94022 Marc Rothschild Dr. V. M. Raina Halliburton NUS Project Manager-Risk Assessment 1303 S. Central Ave.

Ontario Hydro Hll Gl Suite 202 700 University Ave. Kent, WA 98032 Toronto, Ontario MSG 1X6 CANADA Christopher Ryder USNRC-RES/PRAB William Raisin MS: T-9F31 NEI 1726 M. St. NW Suite 904 Takashi Sato, Deputy Manager Washington, DC 20036 Nuclear Safety Engineering Section Reactor Design Engineering Dept.

Nuclear Energy Group, Toshiba Corp.

Ann Ramey-Smith Isogo Engineering Center USNRC-RES/PRAB 8, Shinsugita-cho, Isogo-ku, MS: T-9F31 Yokohama 235, JAPAN Dale Rasmuson Martin Sattison USNRC-AEOD/TPAB Idaho National Engineering Lab.

MS: T-4A9 P. 0. Box 1625 Idaho Falls, ID 83415 John Ridgely USNRC-RES/SAIB Dr. u. Schmocker MS: T-10Fl3 Hauptabteilung fur die Sicherheit der Kernanlagen CH-5232 Villigen HSK Richard Robinson (2) SWITZERLAND USNRC-RES/PRAB MS: T-9F31 A.J. Seebregts ECN Nuclear Energy Westerduinweg, 3 Postbus 1 NL-1755 Petten ZG THE NETHERLANDS

• Dist-11

Dr. S. Serra Ente Naxionale per !'Energia Electtrica (ENEL) via G.B. Martini 3 I-00198 Rome ITALY Stone & Webster Engineering Corp Technical Information Center A. Hosford 245 Summer Street 245/01 Boston, MA 02210 H. Shapiro Dennis Strenge Licensing & Risk Branch Pacific Northwest Laboratory Atomic Energy of Canada Ltd. RTO/ 125 Sheridan Park Research Comm. P.O. Box 999 Mississauga, Ontario L5K 1B2 Richland, WA 99352 CANADA Technadyne Engineer. Consultants (3)

Nathan 0. Siu Attn: David Chanin Center for Reliability and Risk Jeffery Foster Assessment Walt Murfin Idaho National Engineering Lab. Suite A225 EG&G MS: 3850 8500 Menual Blvd. N P.O. Box 1625 Albuquerque, NM 87112 Idaho Falls, ID 83415-3855 Ashok Thadani E. Soederman USNRC-NRR/ADT 0 ES-Konsult AB Energy and Safety P.O. Box 3096 MS: 0-12G18 S-16103 Bromma T. G. Theofanous SWEDEN University of California, S. B.

Department of Chemical and Nuclear Engineering Desmond Stack Santa Barbara, CA 93106 Los Alamos National Laboratory Group Q-6, Mail Stop KS56 Los Alamos, NM 87545 Catherine Thompson USNRC-RES/SAIB MS: T-10F13 Jao Van de Steen KEMA Laboratories Utrechtseweg, 310 Soren Thykier-Nielsen Postbus 9035 Riso National Laboratory NL 800 ET Arnhem Postbox 49 THE NETHERLANDS DK4000 Roskile DENMARK Eli Stern Israel AEC Licensing Div. R. Toossi P.O. Box 7061 Physical Research, Inc.

Tel-Aviv 61070 25500 Hawthorn Blvd.

ISRAEL Torrance, CA 90505 Dr. Egil Stokke Ennio Traine Advisory Group ENEL OECD Halden Reactor Project Via Vialiano, 48 P.O. Box 173 00144 Rome N-1751 Halden ITALY NORWAY Dist-12

r**, 1 Ulf Tveten

• Environmental Physics Section Seppa Vuori Institutt for Energiteknikk Technical Research Centre of Finland Postboks 40 Nuclear Engineering Laboratory N-2007 Kjeller Lonnrotinkatu 37 NORWAY P.O. Box 169 Sf-00181 Helsinki 18 FINLAND US Department of Energy Energy Library Room G 034/GTN Dr. Ian B. Wall AD-622.1 81 Irving Avenue Washington, DC 20585 Atherton, CA 94027 US Department of Energy Edward Warman NS-50 (GTN) Stone & Webster Engineering Corp.

NS-10.1 P.O. Box 2325 S-161 Boston, MA 02107 Washington, DC 20585 J.E. Werner U.S. Environmental Reactor Research & Techn Division Protection Agency (2) US DOE Idaho Operations Attn: Allen Richardson MS: 1219 Joe Logsdon 850 Energy Drive Office of Radiation Programs Idaho Falls, ID 83401-1563 Environmental Analysis Division Washington, DC 20460 Dr. Wolfgang Werner Safety Assessment Consulting GmbH Harold VanderMolen Veilchenweg 8 USNRC-RES/PRAB D 83254 Breitbrunn MS: T-9F31 GERMANY Dr. A. Valeri Westinghouse Electric Corp A.N.P.A. Technical Library Via Vitaliano Brancati, 48 P. 0. Box 355 I-00144 Rome East 209 ITALY Pittsburgh, PA 15230 Magiel F. Versteeg Westinghouse Electric Corp Ministry of Social Affairs NTD and Employment Central File Nuclear Safety P.O. Box 90804 P. 0. Box 355 2509 LV Den Haag 408 1-A THE NETHERLANDS Pittsburgh, PA 15230 Martin Virgilio Westinghouse Electric Company (3)

USNRC-NRR/DSSA Attn: John Lacovin MS: 0-8E2 Burt Morris Griff Holmes Energy Center East, Bldg. 371 R. Virolainen, (Chairman PWG5) P.O. Box 355 Systems Integ. Off. (STUK) Pittsburgh, PA 15230 P.O. Box 268 Kumpulanite 7 SF-60101 Helsinki FINLAND Dist-13

, 1 1r J Westinghouse Savannah River Co. (2)

Attn: Kevin O'Kula Jackie East Safety Technology Section 1991 S. Centennial Ave., Bldg. 1 Aiken, SC 29803 Donnie Whitehead Department 6412, MS: 0747 Sandia National Laboratories P.O. Box 5800 Albuquerque, NM 87185-0747 Keith Woodard PLG, Inc.

7315 Wisconsin Ave.

Suite 620 East Bethesda, MD 20814-3209 John Wreathall John Wreathall & Co.

4157 MacDuff Way Dubin, OH 43017 M. K. Yeung University of Hong Kong Mechanical Engineering Dept.

Polfulam HONG KONG Bob Youngblood Brookhaven National Laboratory Department of Nuclear Energy Bldg. 130 Upton, NY 11973 Carlo Zaffiro A.N.P.A.

Directorate for Nuclear Via Vitaliano Brancate, 48 I-00144 Rome ITALY Dr. X. Zikidis Greek Atomic Energy Comm.

N.R.C.P.S. "Demokritos" GR-153 10 Agia Paraskevi Attiki GREECE Dist-14

NRC FOAM 335 U.S. NUCLEAR REGULATORY COMMISSION 1. REPORT NUMBER (2-89) (Aulgned by NRC. Add Vol., Supp., Rev.,

NRCM 1102, end Addendum Numbers, if any.I 3 3202 BIBLIOGRAPHIC DATA* SHEET (See instructions on the reverse)

NUREG/CR-6144 LE AND SUBTITLE Vol. 5 Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Surry, Unit 1: Analysis of 3. DATE REPORT PUBLISHED Core Damage* Frequency from Seismic Events During Mid-loop MONTH YEAR Operations-Main Report August 1994

4. FIN OR GRANT NUMBER L1922

5. AUTHOR(S) 6. TYPE OF REPORT R.J. Budnitz, Future Resources, Inc.

P.R. Davis,PRD Consulting M.K. Ravindra, W.R. Tong, EQE International, Inc. 7. PERIOD COVERED (Inclusive Dates/

8. PER FORMING ORGANIZATION - NAME AND ADDRESS (If NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address; if contractor, provide name and mailing address.)

Future Resources Associates, Inc. PRD Consulting EQE International, Inc.

2039 Shattuck Avenue, Suite 402 P.O. Box 2046 18101 Von Karman Avenue, Suite 400 Berkeley, CA 94704 Sheridan, WY 82801 Irvine, CA 92715

9. SPONSOR I NG ORGAN IZA Tl ON - NAME AND ADDRESS (If NRC. type "Same as above": if contractor, provide NRC Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address.}*

Division of Safety Issue Resolution Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission hington, DC 20555-0001 PLEMENTARY NOTES

11. ABSTRACT 1200 words or Jess/

During 1989, the Nuclear Regulatory Commission (NRG) initiated an extensive program to carefully examine the potential risks during low power and shutdown operations. The program includes two parallel projects being performed-by Brookhaven National Laboratory (BNL) and Sandia National Laboratories (SNL). Two plants, Surry (pressurized water reactor) and Grand Gulf (boiling water reactor), were selected as the plants to be studied. The objectives of the program are to assess the risks of severe accidents initiated during plant operational states other than full power operation and to compare the estimated core damage frequencies, important accident sequences and other qualitative and quantitative results with those accidents initiated during full power operation as assessed in NUREG-1150. The objective of this report is to document the approach utilized in the Surry plant and discuss the results obtained. A parallel report for the Grand Gulf plant is prepared by SNL.

12. KEY WORDS/DESCR :PTO RS (List words or phrases that will assist-researcher.; in locating the report.I 13. AVAILABILITY STATEMENT Surry-1 Reactor, reactor shutdown, risk assessment, failure mode analysis, reactor accidents, reactorcoredisruption, reactor start-up, RHR systems, systems analysis, thermodynamics, seismic events Unclassified (This Report)

Unclassified

15. NUMBER OF PAGES

16. PRICE NRC FORM 335 (2-89)

.'I ~

Printed

• on recycled paper Federal Recycling Program