ML19292B771
| ML19292B771 | |
| Person / Time | |
|---|---|
| Site: | Limerick  |
| Issue date: | 09/23/1983 |
| From: | Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19292B772 | List:
|
| References | |
| FOIA-84-624 NUDOCS 8310110477 | |
| Download: ML19292B771 (75) | |
Text
REVIEW 0F SEISMIC HAZARD AND FRAGILITY IN THE LIMERICK GENERATIWG STATION SEVERE ACCIDENT RISK ASSESSMENT Division of Engineering Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Comission 8310110477 830923 CF ADDCK 05000 2
e Table of Contents Page INTRODUCTION.....................................................
1 SEISMIC HAZARD...................................................
3 GE TECHNICAL ENGINEERING.........................................
15 STRUCTURAL FRAGILITY.............................................
28 COMPONENT FRAGILITY..............................................
47 g
EQUIPMENT FRAGILITY..............................................
61 RECOMMENDATIONS AND
SUMMARY
71
. INTRODUCTION An evaluation of risk due to seismic initiating events has been presented by the applicant, Philadelphia Electric Company (PECO), in the report entitled " Severe Accident Risk Assessment, Limerick Generating Station" (LGS-SARA). The NRC requested Brookhaven National Laboratory (BNL) to review the LGS-SARA. The NRC staff review of seismic hazard and fragility in the LGS-SARA, which follows, is based upon its own review, the BNL review, meetings with BNL, PECo and their respective consultants and the respunse to questions from the NRC submitted to PECo.
The LGS-SARA represents the third probabilistic risk assessment (PRA) submitted to the NRC which incudes seismic intiating events. The previous submittals evaluated seismic risk at the Zion and hdian Point operating nuclear power plants. The LGS-SARA is submitted coincident with an operating license review that makes use of the extensive safety evaluation found in the Limerick Generating Stations Units 1 and 2 Final Safety Analysis Report (FSAR). Our review concentrates on assessing the adequacy of the numerical values used in describing seismic hazard, fragilities and their associated uncertainties and gaining insight into the seismic capacity of the plants, particularly at levels beyond the safe shutdown earthquake. The applicant's prediction of core melt frequency resulting from seismic initiating events as calculated in the LGS-SARA is reported as having a median value of 3.3 x 10~7 per year with a 95th percentile value of 2.7 x 10-5 and a 5th percentile value of 2.2 x 10-9 The applicant's point estimate of the mean annual frequency of a seismically induced core melt is reported to be 5.7 x 10-6 The
applicant indicates in the Response to NRC Questions that seismic events are not a major contributor to total core melt frequency. On the other hand, because of the specific nature of certain seismic sequences, they are major contributors to total early fatality risk. By comparison, in the Zion and Indian Point PRAs it was calculated that seismic events are major contributors to both core melt frequency and risk. The NRC staff recognizes that the current state-of-the-art of seismic event probabilistic risk assessments is greatly constrained by the limitations of current knowledge and methodologies. The applicant's presentation of discussions of the many contributions to uncertainties in the LGS-SARA reflects their awareness of these limitations. Due to the unavailability of precise definitive procedures to quantify seismic risk, the current state-of-the-art requires the use of generalized probabilistic models which for the most part rely heavily on engineering judgements and expert opinion. As a consequence the resulting numerical estimates may contain unknown systematic biases and they may be n.ost appropriately used in a relative rather than absolute manner.
It is our judgement that the reliance upon the mean or median seismic risk estimate to reflect actual ' risk is premature. The wide bands of uncertainty presented in the LGS-SARA can be thought of as representing a large part, but not all, of the actual uncertainties. They may be used to gain insight as to the range of the actual risk associated with seismic initiating events at Limerick.
The LGS-SARA, also affords evidence that the Limerick Generating Station Units 1 and 2 are capable of withstanding ground motion beyond the SSE and that there is no obvious weak link in their seismic design.
REVIEW OF SEISMIC HAZARD INPUT TO LIMERICK GENERATING STATION SEVERE ACCIDENT RISK ASSESSMENT 1.
Scope The probabilistic assessment of the seismic ground motion hazard at the Limerick Generating Station site was performed by Ertec for the applicant. The results of this study were incorporated with results of other studies to calculate the probabilities of structural, mechanical and equipment failure at the facilities. Our comments are based on our review of Chapter 3 and Apper. dix A of the Limerick Generating Station, Severe Accident Risk Assessment (LGS-SARA) report (Reference 1) and other relevant chapters related to the seismic hazard analysis in this report, on the review of our consultant Brookhaven National Laboratory (BNL) (reference 2) and upon our past experience in reviewing probabilistic estimates of earthquake hazar) at other nuclear power plant sites such as Zion (Reference 3) and Indian Point (Reference 4).
2.
Methodology The source of the earthquake data used in any Probabilistic Risk Assessment (PRA) is based on available earthquake catalogs. One of the fundamental problems with all methods of risk assessment is predicting hazard for extreme events at sites where little data exists and where the physical process of earthquake generation is not well known. For
example, in the eastern U. S. where the Limerick plant is located, our knowledge of the input parameters required for probabilistic scismic hazard analysis is limited because of the short seismic history, unknown tectonics and lack of strong motion data.
The seismic hazard model used in the SARA study is-described by Cornell (References 5 and 6) and McGuire (Reference 7).
In both these cpproaches the calculations of seismic hazard are based on the definition of the following key parameters:
1.
source region geometry, 2.
earthquake recurrence model, and 3.
attenuation model.
The source regions are defined on the basis of historical and instrumental seismicity, geologic and tectonic features. Observed seismicity and judgement are then used to estimate the recurrence statistics (a and b-values) and to describe the upper bound magnitude for each zone. Combining these with the attenuation model, the probability of exceedence as a function of acceleration is derived.
Since there is much subjective judgement introduced in choosing some of the parameters used in the hazard model, there is a large measure of uncertainty in the final hazard estimates.
In general, in the LGS-SARA study, the methodology used is based on the state-of-the-art approach and is up to date.
It is essentially the same
methodology used in the Indian Point study, and can be summarized as follows.
1.
In the LGS-SARA study four sets of seismogenic source zones were defined. These zones, as indicated by the applicant's consultant (ERTEC), cover a range of alternate interpretations around the Limerick site and they are:
3 a.
the Piedmont model, b.
the Northeast Tectonic model, c.
the Crustal Block model, and d.
the Decollement model.
For each model the seismicity of each zone was examined and the maximum historical earthquake in the zone was assigned. A subjective weight was then assigned for each set of zones.
2.
Using the historical earthquake catalogs of Bollinger (Reference 8), Nutt11 (Reference 9), and Chiburis (Reference 10); the rate of occurrence for each seismogenic zone was determined. Based on the Ertec assumption that smell magnitude events rarely cause structural damage due to their short duration the activity rates were calculated for earthquakes with m = 4.5 and greater. Based b
on expert opinion (Reference 11), a b-value of 0.9 was used for all the seismogenic zones.
Ertec used a single value indicating that uncertainty in the b-value has little effect on the hazard.
3.
Based on subjective judgement Ertec assigned upper bound magnitudes for each of the seismogenic zones. For the dominating zones in the Piedmont, Northeast, Crustal Block and Decollement models they used 6.3 and 5.8, 5.0, 6.0 and 5.5, and 6.8 respectively as the upper bound magnitudes.
4.
Using the Nuttli (Reference 12) formulation with adjustment for the i
anelastic attenuation constant in the northeastern U. S., sustained acceleration was estimated for the Limerick site. Th. affective peak acceleration (EPA) was assumed to be essentially equivalent to sustained acceleration.
Due to the variation of the strong motion data a lognormal distribution was used to represent the uncertainty in the ground motion estimates. A value of 0.6 was used for ground motion dispersion (e). Based on the assumption that Modified Mercalli (MM) intensities in a region are bounded, an upper bound cutoff acceleration for each region was assigned. These upper bound cutoffs are based on subjective judgement relating intensity to acceleration.
. 4 3.
Evaluation 3.1 Seismic Zonation The staff believes that the zones presented by Ertec are reasonable, except that the boundaries of some of the zones are not always drawn to coincide with well-defined geologic or seismologic features. There is great uncertainty, for example, in the Crustal Block and the Deco 11ement models. The Crustal Block hypothesis is based on gravity and magnetic lineations and the assumption that these lineations define large blocks of earth's crust along which movement would occur generating earthquakes.
In the LGS-SARA, Ertec identified eight zones to constitute the Crustal Block model.
The staff cannot see the correlation between the seismicity distribution and all of the eight zones identified in the LGS-SARA report. The staff concludes that since the site lies in the Triassic basin as indicated in the FSAR (Reference 13), and since zone 8 of the Crustal Block model represents the same Triassic basin, the Limerick site should be included eithin zone 8.
The staff estimates that variations in the bc ndaries in zone 8 of the Crustal Block model would contribute to ;hanges in the final results of the hazard. Similarly, definition of the Deco 11ement zone boundary is not well defined. The Deco 11ement zone was hypothesized to account for the generation of large earthquakes such as the Charleston, South Carolina earthquake of 1886.
Although no clear evidence thus far supports this hypothesis, a probabilistic study may consider the Deco 11ement as a source of large earthqJakes.
_a-The staff does not agree with the subjective weights assigned to the different zones. For example, although the Crustal Block model is not well defined and not well recognized in the scientific community it is weighted equally with the more accepted Piedmont and Northeast Tectonic models.
The applicant solicited expert opinion with regard to the weight that should be assigned to a tectonic hypothesis (not necessarily the Decollement model) that would allow the occurrence of a large magnitude earthquake (M 7) near the site. The four experts chose weights varying from 0.0 to 0.3.
BNL believes that the 0.1 weight assigned by the applicant should be considered as a lower bound.
Alternatively, BNL proposed that a large earthquake such as the Charleston event should additionally be considered for each of the four seismogenic zones proposed by Ertec. The staff does not completely support this hypothesis unless the seismotectonic zones are redefined to reflect seismicity patterns or tectonic features which may accommodate a Charleston type earthquake.
If such a large event (for which the applicant assumes no upper bound to effective peak acceleration) was considered, the hazard curves would be unbounded and they would contribute to an increase in the core melt frequency.
3.2 Seismicity Parameters:
Ertec used 0.9 for the b-value based on expert opinion. The staff concludes that an appropriate approach would be to use the available data from the different catalogs in the eastern U. S. and try to estimate a b-value which is more characteristic for the zones around Limerick than the one used in this study. No uncertainty in the b value was considered in the Ertec study.
It was simply stated that b-value would not have great effect on the seismic hazard and as a result the statistical uncertainty in the b-value was ignored.
The other parameter needed for estimating the seismic hazard is the upper bound magnitude for each of the seismotectonic zones. Regarding the Charleston-type earthquake of magnitude 6.8, Ertec did not provide any supporting evidence that this earthquake is the maximum event that could occur on a Deco 11ement type structure. A sensitivity study would have shed some light on the effect of variation in the upper bound magnitude on the hazard curves.
3.
Ground Motion Attenuation Using Nuttli's approach, sustained acceleration was estimated after adjusting for the attenuation factor by using a more representative value for the northeastern U. S. than the original value used for the central U. S.
Using a factor of 1.23 Ertec then converted sustained acceleration to effective peak acceleration (EPA). The definition of EPA is a highly controversial issue. Additional studies supporting the applicant's definition of this parameter and the sensitivity of the
. u,,
results to its use would be helpful. For estimating the seismic hazard, a lognormal distribution about the mean value was used, with a value of U=o4.This value is based mainly on western U. S. data. _ Whether or not the value is applicable to the eastern U. S. is a question which needs further investigation. The statistical scatter about the mean attenuation relationship characterized by cr is an important parameter in the seismic hazard analysis. The influence of on EPA estimates is i
very significant particularly for low probabilities.
It is difficult to assess an appropriate value of cr for uce in Eastern U. S. seismic risk analysis, therefore a sensitivity study regarding this factor would provide more insight on its contribution.
Also, the choice of upper bound cut off to effective peak acceleration is highly judgmental. There is insufficient evidence to support this choice. A sensitivity study regarding this parameter would provide some insight on its effect on the hazard curves.
4.
Comparison of LGS-SARA with Indian Point PRA The staff compared the seismic hazard generated for the LGS-SARA with that for the Indian Point PRA. The comparison showed little difference between the ranges of the hazard curves for the.two sites. From examining the seismicity of the region, we expected a greater difference between the two seismic hazard studies due to the higher seismic activity around Indian Point. However, since LGS and Indian Point were generally assumed to lie in the same seismogenic source zone and since
. ~
the seismic activity in these zones is considered to be uniformly distributed, the differences in the computed hazard were minimized. The small differences that do exist between the two sets of hazard curves can be attributed to small assumed differences in the area of the seismotectonic zones considered in the two studies, the upper bound magnitude, and the activity rate considered for each zone.
5 5.
Conclusions The methodology used in the LGS SARA report to estimate the seismic hazard is adequate and the approach is well established.
It has been used before for the Zion and Indian Point PRAs.
Although Ertec used their best judgement in defining the different parameters used in the model, the staff has a few concerns regarding these parameter definitions.
1.
The uncertainty associated with the Crustal Block model was underestimated. The Limerick site should have been included within zone 8 of the Triassic basin in the Crustal Block model. With regard to the Deco 11ement zone, a higher weight and/or alternative models which allow a large magnitude earthquake to occur near the site should have been examined.
2.
The uncertainty associated with the two significant parameters (b-valueandgroundmotiondispersion7)shouldhavebeen considered.
3.
A single upper bound magnitude for the Decollement was used without justifying its uniqueness.
4.
Lincertainty was not considered in the choice of the upper bound cutoff to effective peak acceleration.
The staff recommends that although peak ground acceleration is an appropriate measure of damage over certain frequency ranges, the probabilistic analysis should more directly estimate ground motion at all relevant n +,2ency ranges of the spectrum.
Finally, the BNL review states that although the effect of the individual issues raised above on the mean frequency of core melt is judged to be small (less than a factor of 2), thc total effect could be moderate (2 <factorC10). Consideration should be given to verify that indeed this is the case.
e
. In conclusion, the staff considers the general methodology used in this study to be appropriate. It should be stated, however, that because of the extensive use of subjective input and the uncertainty this engenders, the results of these studies are more appropriate for relative comparisons than for absolute determination of hazard and the resulting risk.
4
. References
~
1.
Limerick Generating Station - Severe Accident Risk Assessment, Philadelphia Electric Co., Report No. 4161, April 1983.
2.
A Preliminary Review of the Limerick Generating Station, Severe
' Accident Risk Assessment, Vol. I, August, 1983.
3.
Zion Probabilistic Safety Study, Commonwealth Edison Company, September 1981.
4.
Indian Point Probabilistic Risk Assessment, Power Authority of the State of New York, 1982.
5.
Cornell, C. A., Engineering Seisnic Risk Analysis, Bull. Seism.
Soc. Am., 58, 1583-1606, 1968.
6.
Cornell, C.
A., Probabilistic Analysis of Damage to Structures under Seismic load, Dynamic waves in Civil Engineering, D. P.
Howells, I. P. Haigh, and C. Taylor, Editors, Wiley Interscience, London, 1971.
7.
McGuire, R. K., Fortran Computer Program for Seismic Risk Analysis, U. S. Geological Survey, Open-File Report 76-67, 1967.
8.
Bollinger, G. A., A Catalog of Southeastern United States Earthquake 1754 through 1974, Research Division Bulletin 101, Department of Geological Sciences, Virginia Polytechnic Institute and State University, Blacksburg, VA.., 1975.
9.
Nuttli, 0. W., Seismicity of the Central United States, Geol. Soc.
Am., Review in Engineering Geology, Vol. IV,1979.
- 10. Chiburis, E., Seismicity, Recurrence Rates, and Regionalization of the Northeastern United States and adjacent Southeastern Canada, USNRC,NUREG/CR-2309,1981.
- 11. TERA Corp., Seismic Hazard Analysis Solicitation of Expert Opinion.
NUREG/CR-1582,1980.
- 12. Nuttli, O. W., The Relation of Sustained Maximum Ground Acceleration and Velocity to Earthquake Intensity and Magnitude, Report 16, Misc. Paper S-7-1, U. S. Army Eng., Waterway Exp.
Station, Vicksburg, 1979.
- 13. Limerick Generating Station Unit 1 and 2, Philadelphia Electric Company, Final Safety Analysis Repurt, 1983.
REVIEW OF GEOTECHNICAL ENGINEERING RELATED ASPECTS OF THE LIMERICK UNITS 1 & 2 SEVERE ACCIDENT RISK ASSESSMENT I.
Scope The following summarizes the NRC staff's preliminary review of geotechnical engineering aspects of the Limerick Generating Station Units 1 and 2 Severe Accident Risk Assessment (LGS-SARA).
Specific LGS-St.RA elements reviewed I
include a) the applicant's consideration of geotechnical engineering re-lated potential failure mechanisms resulting from a seismic event, b) the applicant's treatment of the geotechnical engineering aspects of the seismic hazard analysis, and c) the applicant's treatment of geotechnical engineer-ing parameters affecting fragility analysis. The review was conducted in accordance with the applicable general guidance contained in NUREG-2300 Chapter 10, 11, and 12 (Ref. 1).
This review also considered appropriate elements of the draft report of the preliminary review of the LGS-SARA performed by the NRC's consultant, the Brookhaven National Laboratory (Refer. 2).
II.
Geotechnical Engineering Related Site Data 1.
General Site Description - Topography of the Limerick site area consists of gently rolling ridges dissected by the courses of the Schuylkill River and its tributaries. The main plant structures are on a broad ridge approximately 100 feet above the river.
The plant site is divided into three main subareas:
(1) the reactor / turbine area at grade elevation 217 feet msl, (2) the cooling tower area at grade elevation 257 to 265 feet msl, and (3) the spray pond area with bottom of pond at elevation 241 feet msl and a normal still pond level of 251 feet msl. Ground water in the site area decreases from approxi-mately 250 ft msl northeast of the spray pond area to an elevation of less than 120 feet msl southwest of the reactor / turbine area.
Detailed descriptions;of the geotechnical engineering aspects of the general site area are presented in Limerick FSAR Sections 2.5.4 and 2.5.5 (Ref. 3).
The bedrock in the site area consists of interbedded red sandstones, siltstones, and shales indurated to a depth of several thousand feet, which are moderately to closely jointed.
Bedrock in the immediate plant area dips 8 to 20 degrees to the north.
The soils at the site consist of red sandy and clayey silts with rock fragments derived from weathering of the underlying bedrock.
Soil thickness ranges from 0 to 40 feet, averaging 10 to 15 feet.
For the most part, soils below a depth of 10 feet consist of highly weethered and fractured rock with intermixed silts and clays.
I The main seismic Category I plant structures including the reactor enclosure, control structure, diesel generator enclosure, spray pond pump house, spray pond spray network, turbine enclosure and radwaste enclosure are founded on unweathered bedrock.
Seismic Category I facilities not founded completely on bedrock are founded totally or in part on natural soil or manmade fill and include the diesel fuel oil storage tanks, buried cooling water piping, a pipe valve pit, electrical ducts and the r.trthwestern portion of the spray pond.
2.
Properties of Site Subsurface Materials The Limerick site investigation program, which was accomplished between 1969 and 1977, was accomplished in a deterministic manner.
The applicant has reported in the PSAR (Ref. 4) and FSAR (Ref. 3) that site exploratory investigations included 380 borings, 17 test pits, and 10 seismic refraction traverse lines, totalling 5180 linear feet.
In addition, a surface shear wave velocity survey, a seismic uphole survey, inhole permeability testing, plate bearing testing, micromotion measurement testing, and in situ bedrock stress testing were accomplished in the site vicinity.
As sampling theory was not used in the development of the site invastigation program and as the number of samples of rock and soil materials tested would be considered small in a statistical sense,
. the NRC staff concludes that the application of probability theory to determine statistically significant estimates of means, variance, and probability density functions for pertinent soil and rock prop-erties at the Limerick site is neither justified nor appropriata for use in the LGS-SARA analyses. Therefore, it is the conclusion of the NRC staff that the use of deterministically estimated representative rock and soil material properties values in the LGS-SARA is acceptable.
III. Failure Mechanisms In the LGS-SARA, the applicant addressed earthquake-induced acceleration as the potential failure mechanism capable of producing structural and component failures at the Limerick site.
Other potential failure mech-anisms, including subsidence and acceleration-induced liquefaction and settlements were not explicitly considered.
1.
Subsidence - The NRC staff review of site data conteined in the Limerick PSAR (Ref. 4) and FSAR (Ref. 3) presented no evidence of zones of solutioning, caverns, or highly weathered areas in the foundation bedrock or soils which would allow significant subtidence under any proposed seismic loading.
The NRC staff therefore concurs with the applicant's exclusion of subsidence as a probable failure mechanism requiring consideration in the LGS-SARA.
2.
Liquefaction - The probability of failure of structures, systems, and components under seismic loading conditions due to liquefaction of foundation and backfill soil was not explicitly addressed in the applicant's report.
Based on the site data presented by the appli-cant in the FSAR, the NRC staff independently analyzed the liquefac-tion potential of the natural residual soils and backfill materials at the Limerick site and finds the following:
a.
The natural residual soils at the site evidence an average SPT resistance of 46 blows per foot, exhibit cohesive characteris-tics (as evidenced by an average plasticity index of 8), and in general can be considered to have a low potential for saturation
due to the relatively severe water table gradient at the site (Refs. 4 and 3).
The NEC staff considers that such soils have a negligible potential for liquefaction.
b.
The applicant reported in the FSAR that all fills associated with seismic Category I structures and piping were classified as either mass concrete fill, cementitious backfill, select granular backfill, or Type 1 random fill. The mass concrete fill and the cementitious backfill were batched to attain a 28-day compressive strength of 2000 psi and 80 psi, respectively.
Such materials are not capable of liquefaction.
The select granular backfill material consists of 3/4-inch maximum size aggregate with less than 10% by weight passing a No. 200 sieve and was compacted to 95% AASHTO T-180 maximum dry density. The Type I random fill consists of 8-inch maximum size broken rock graded course to fine and was compacted to 90% AACHTO T-160 maximum dry density (Refs. 4 and 3).
Due to the relatively dense nature of the select backfill and Type.J. random fill material, the Nf.C staff considers these backfill materials would not be susceptible to liquefaction under tna seismic loading conditions postulated for the Limerick site.
The NRC staff therefore concludes that the potential for liquefaction of the Limerick site soil and backfill material due to postulated seismic loadings'uay be reglected without significantly influencing the overall LGS-SARA results.
3.
Settlements - The applicant has not explicitly analyzed rock and soil settlement and differential settlement as potential failure mechanisms in the LGS-SARA.
In the Limerick FSAR the applicant has deterministi-cally estimated a maximum settlement of the reactor building, the heaviest structure at the site, to be on the order of one quarter of an inch or less due to pseudo-elastic compression of the ro-k occur-ring upon application of loading with construction (Ref. 3).
The NEC staff has independently verified these findings using the procedures in Reference 5 and has further considered the potential for total
. settlement under possible seismic loadings.
Considering pseudo-linear-elastic response. and input seismic accelerations up to 4 times the SSE, the NFC staff has deterministically estimated an upper bound total rock deformation of less than 0.5 inches.
The NRC staff there-fore considers that there is a negligible low likelihood of rock set-tiement becoming a failure mechanism that would require assessment.
Consideration thould however be given to verifying that potential failure of safety-related piping and of small lines attached to safety-related piping near the junction of the containment building and the recctor Enclosure due to impact or relative displacement of the buildings will not contribute to tho frequency of core melt (Ref. 2).
The NRC staff has also analyzed the potential for settlement of residual soils and backfill materials due to a seism'ic event.
Using the procedtres of References 6 and 7, the staff concludes that the maximum upper-bout;d settlement of soils and backfill materials sup-porting seismic Category structures systems on components would be expected to be less than 1.0 inch for seismic loadings up to 4 times the design SSE.
The NRC staff considers that there is very little likelihood that soil settlement or differential settlements due to seismic events of this magnitude could become a significant failure mechanism for structural systems and components founded on soils.
The NRC staff therefore concurs with the applicant's exclusion of settlements and differential settlemer,ts as significant potential failure mechanisms requiring detailed analyses in the LGS-SARA.
IV.
Seismic Hazard Ana)ysis The procedures used by the applicant in the development of the Limerick seismic hazard rcodel do not explicitly consider the specific Limerick site scil and rock engineering properties.
In his analysis the applicant used an attenuation function to estimate peak ground accelerations that was developed from an analysis of existing recorded strong motion data.
The function was derived from a regression of peak ground acceleration against
. magnitude and distance and assumes a regionally constant anelastic atten-uation factor (Q).
Local site characteristics relating to the geometry and engineering characteristics of the riear surface soil and.ock materials associated with the strong motion records were not separately accounted for in the regression.
Uncertainties in the peak ground accelerations predicted through the use of this function attributable to local site conditions are therefore combined with those associated with source and propagation path effects.
In applying the developed attenuation function to the Limerick site the applicant assumed a lognormal distribution of acceleration about the mean value with a standard deviation of 0.6 selected as typical of the scatter associated with strong motion data j
sets from a specific geological region. This standard deviation value corresponds to a factor of 1.8 times the median value.
There are no geotechnical engineering related local site features known to the NRC staff which would preclude considering this site to be within the geologic regional average for which the applicant-developed attenua-tion equation is intended to apply. The NRC staff recognizes that the physical processes affecting local site response are not well understood.
The NRC staff is also aware that large uncertainties due to source and path parameters as well as local site-specific geotechnical engineering related parameters are already reflected in the variance in the data used to estimate peak ground acceleration. The staff therefore considers that a vigorous analysis of the influence of local soil and rcck property param-eters on the attenuation of acceleration at the Limerick site is not war-ranted nor appropriate in keeping with the general level of the state of the art in predicting ground motion in the eastern U.S.
V.
Fragility Analysis 1.
Structures, Systems, and Components Founded on Rock In the LGS-SARA the seismic fragility of structures, systems, and components founded on rock were described in terms of the median ground acceleration capacity associated with seismic-induced failure and of the logarithmic standard deviation of this median value. As
. an aid to computation, the applicant used an intermediate variable called the " median factor of safety." It was defined as the ratio of the estimated median ground acceleration capacity causing failure to the Safe Shutdown Earthquake (SSE) acceleration used in the design analysis.
Thus, rather than directly estimating the seismic fragil-ity of structures and components founded on rock, the applicant esti-mated median factors of safety and logarithmic standard deviations against failure based upon the deterministically accomplished design response analysis.
In the deterministic design of the Limerick Plant, two-dimensional lumped mass models were developed for the major seismic Category structures founded on rock.
Separate models were i
developed for the north-south, east-west, and vertical responses analyses for each structure.
Because of the relatively high stiff-ness of the rock the applicant treated the foundation rock as a fixed boundary for the analysis of all structures excepting the primary containment and the raactor enclosure and control structure.
The floor response spectra developed for these two structures for equip-ment analysis purposes were based upon mootis considering the elastic deformation of the supporting medium. The shear modulus, shear wave velocity, and the density of the supporting rock used in the analysis were 1.2 x 108 psi, 6000 ft/sec., and 150 lbs/fta respectively.
(On page 4-22 of Appendix B of the LGS-SARA the reported bedrock modulus of elasticity of 7.3 x 108 psi is in error. Revision 19 to the LGS FSAR corrected that value to 3.0 x 108 psi to reflect the value actu-ally used in design (Ref. 3)).
Embedment conditions were neglected in the design analysis.
To account for variations in the structural responses owing to uncertainties in the material properties and to approximations associated with the modeling techniques used in the design analysis, the computed floor response spectra were smoothed and the spectra were broadened on either side of the peak value by 15% of the frequency at which the peak occurred.
Additional soil structure interaction analysis were performed to access the sensitiv-ity of the design models to variation in roc! modulus. Model analysis demonstrated that for a variation in rock modulus of 50 percent, variations in structural frequencies did not exceed 10 percent for predominant modes.
In the LGS-SARA seismic fragility analysis the applicant did not explicitly consider geotechnical engineering parameters beyond.those in the deterministic design analysis.
The applicant treated the uncertainty introduced into the calculated design response of struc-tures due to variability in geotechnical engineering related param-eters only by including it as an element of all randomness and uncertainty associated with soil-structure interaction effects.
No uncertainty was assigned to the ground response spectrum factor used in the analysis due to variation in foundation material properties.
Lacking quantitative evidence from site specific sensitivity anelyses data to estimate the variability in the median factors of safety for structural capacity due to geotechnical engineering related parameters required to define the fragility curves for the plant structures, the applicant used subjective engineering judgment.
In the applicant's judgment the major plant seismic Category 1 structures are considered to be f3unded on competent rock and the design of the structures was conducted using assumptions and methods of analysis that result in small variation in frequency and response when significantly large variations in the flexibility of rock and of energy dissipation in rock by radiation damping are considered.
The applicant therefore concluded that the design results would have a median factor af safety of 1 based upon soil structural interaction considerations.
H3ing similar reasoning snd considering the nature of the model used in the deterministic design, the applicant assigned a relatively small loga-rithmic standard deviation of 0.05 to the uncertainties in the median factor of safety for the overall structural acceleration capacity due to all soil structure interaction effects.
The NRC r,taff considers that although the deterministically derived design structural response to the SSE cannot be accepted as an "abso-lute best estimate" of a median value for structural acceleration capacity when considering geotechnical engineering parameters at the Limerick site, it is an acceptable estimate considering the level of effort and the analytical model used.
In the applicant's methodology the individual uncertainties associated with each factor bearing on the valiance of the mean structural capacity are summed to obtain an
. overall logarithmic standard deviation using the " square root of the sum of the squares" process.
In this process, because of the number of factors considered and the relative size of the uncertainties for each factor, the addition of reasonable amounts of uncertainties to a few factors would result in only a very small increase in the overall summation. The NRC staff therefore concludes that although the appli-cant has not incorporated the total effect of variation due to geo-technical engineering related factors into the total overall struc-tura.1 acceleration capacity by the procedures used, the inclusion of a reasonable additional uncertainty value for geotechnial parameters would only produce a small effect which would not be significant in the final product of the analysis (Ref. 2).
The NRC staff also considers that neglecting embedment considerations in'the basic design tends to bias the "best estimate" of the median structural capacity to the conservative side especially at higher acceleration levels.
This conservatism is accept able to the NRC staff.
However, because embedment conditions were neglected in the original deterministic design the effect of soil pressure on buried walls expressed in terms of variance of the mean factor of safety for capacity, were not explicitly addressed in the LGS-SARA.
Considera-tion should be given to evaluating the impact of embedment on the fragilit.v of affected seismic Category I walls and any supported systems or equipment under greater than SSE loadings (Ref. 2).
2.
Structures, Systems, and Components not Founded on Rock The applicant did not address fragility of structures, systems, and components which are partially or totally founded on soils in the LGS-SARA.
Seismic Category I facilities not found completely on competent bedrock include the diesel oil tanks, underground piping, a piping value pit and electrical ducts.
These structures, systems, and components have been evaluated by the applicant deterministically for an SSE of 0.15g in conjunction with the Limerick Safety Evalua-tion.
Soil response studies were performed by the applicant using the come ter program " Shake" to estimate ground motion induced by a
. safe shutdown earthquake in the backfill material. surrounding and supporting buried seismic Category I piping system.
Earthquake motion was specified at the level of the top of rock and resulting peak accelerations were computed at the level of the pipe. The sensitivity of output to variation in soil shear modulus was also considered. The applicants reported results indicate an approximate 2 fold amplification of input acceleration results when input accelerations are equal to the SSE.
Since the response of soil to seismic input motion is nonlinearly strain dependent consideration should be given to verifying that soil supported safety-related piping, and other soil supported structures and components are not stressed to the point that they would signifi-cantly contribute to the frequency of core melt when considered to be exposed to seismic events greater than the SSE.
3.
Spray pond The fragility of the seismic Category I spray pond which provides the ultimate heat sink for cooling water was not addressed by the applic-ant in the LGS-SARA.
Based upon a review of information presented by the applicant in References 3, 4, 8, and 9, the NRC staff has evalu-ated the stability of the spray pond slopes.
The slopes of the ulti-mate heat sink spray pond were excavated partly in soil and partly in rock.
The applicant has deterministically designed the spray pond slopes using protection riprap stone materials with stone size, layer thickness, and slope geometry governed by the anticiated wave condi-tions expected during the Probable Maximum Flood (PMF).
In addition the applicant has deterministically analyzed the stability of the spray pond slopes to demonstrate the stability of the soil and rock slopes under the design basis conditions of an SSE of 0.15g.
The NRC staff concluded that the scope of the applicant's field and labora-tory efforts was adequate to define the bedrock and foundation condi-tions at the spray pond site and to establish appropriate determini-stic design basis strength parameters of the slope materials.
The
. NRC staff also found the rock and soil slopes acceptably stable under a design basis SSE of 0.15g.
The applicant has not presented an analysis of the effects of seismic loading grcater than 1 tiraes the design SSE on the stability of the spray pond slopes and of the water holding capability of t'he spray pond after such seismic events.
However, it is the NRC staff judge-ment that considering the configuration of the spray pond, the topog-raphy of the site, and the geometry and strength of the rock and soil slopes, the impact would be small for acceleration levels up to 2 times the SSE.
Uncertainties associated with the strain dependent non-linear response of the ' soil slopes of the spray pond founded above near surface bedrock, preclude fragility judgements when greater input accelerations are considered.
Consideration should therefore be given to accurately defining the impact of the hypothesized expo-sure of the spray pond soil and rock slopes to seismic events 2 to 4 times the design SSE on the overall core melt frequency.
VI.
Conclusion The NRC staff review of the LGS-SARA indicates that the report of the applicant did not explicit 19 address geotechnical engineering parameters impacting upon core melt frequency. The staff's evaluation of the I.GS-SARA, however, indicates that the methodology used by the applicant in the seismic hazard and seismic fragility analysis for the most part adequately envelops geotechnical engineering parameters considering the state of the art of the methodology and the large uncertainties associ-ated with the overall analysis.
The NRC staff review of the LGS SARA also found that failure mechanisms relating to geotechnical engineering parameters other than acceleration, i.e., subsidence, liquefaction, and settlements were not explicitly addressed in the LGS-SARA.
Using the site data presented by the applicant in the PSAR and FSAR, the NRC staff analyzed the potential for occurrence of th se failure mechanisms in the soil and rock areas of the site.
The results of this analysis indicate that there is a negligibly low potential
. for structures, systems, and components failures due to possible effects of these mechanisms. The NRC staff therefore concurs with their exclusion from consideration in the LGS-SARA.
~
Based upon the NRC staff and consultants review of the information prescnt-ed in the LGS-SARA the following items related to geotechnical engineering aspects of the review are presented for consideration (a) Although settlement and differential settlements of structures are not considered to be viable failure mechanisms for the Limerick site requiring comprehensive treatment in the LGS-SARA, consideration should be given to verifying that potential failure of safety-related piping and of the small attached lines located near the junction of the containment building and the reactor enclosure caused by impact or relative displacement of the buildings will not contribute to the frequency of core melt.
(b) Because embedment condition were neglected in the original design, the effect of soil pressure on buried walls expressed in terms of variance of the median factor of safety for structural capacity was not explicitly addressed in the LGS-SARA.
Consideration should be given to evaluating the impact of embedment on the fragility of affected walls and supporting systems.
(c) Because of soil amplification considerations related to structures founded upon soil, consideration should be given to evaluating the fragility of soil supported safety-related piping and other soil supported structures at seismic levels greater than the SSE.
(d) Due to geotechniaal engineering related uncertainties associated with the capability of the spray pond slopes to withstand seismic loadings greater than about 2 times the SSE, consideration should be given to accurately defining the fragility of the spray pond at SSE levels greater than 2 times the SSE.
. VII. Reference 1.
NUREG-2300, "PRA' Procedures Guide, Volume 1 and 2," U.S. Nuclear Regulatory Commission, Washington, D.C.
2.
" Draft-Preliminary Review of the Limerick Generating Station Severe Accident Risk Assessment," Brookhaven National Laboratory, August 15, 1983.
3.
Limerick Generating Station Units 1 and 2 FSAR Volumes 2 and 3.
4.
Limerick Generating Station Units 1 and 2 PSAR Volume 1.
5.
Bowles, J. E. " Foundation Analysis and Design," McGraw-Hill Book Company NY, NY 1979.
6.
Lee, Kenneth L.,
and Albaisa, Aurelio
" Earthquake Induced Settlements in Saturated Sanc:s," Journal of the Geotechnical Engineering Division, ASCE, Vol 100, April 1974.
7.
Silver. Marshall L., and Seed, H. Bolton, " Volume Changes in Saqds During Cyclic Loading," Journal of the Soil Mechanics and Foundations Division, ASCE Vol 97, Sept. 1971.
8.
Limerick Generating Station Units 1 and 2, Philadelphia Electric Company -
Yard Work Spray Pond Drawings, Bechtel Drawings Nos. C-1103; C-1104; and C1105, Revision 12, 9/17/82.
9.
Geotechnical Engineers, Inc., " Report of Soil Testing - Limerick Nuclear Station Spray Pond, Winchester, Mass.," September 1974.
. REVIEW 0F STRUCTURAL FRAGILITIES IN THE LIMERICK GENERATING STATION SEVERE ACCIDENT RISK ASSESSMENT 1.0 Scope The review comments and evaluation presented here are based on the preliminary review of those portions of Section 3.0 and Appendix B i
of the Limerick Generating Station Units 1 and 2 Severe Accident Risk Assessment (LGS-SARA) which are related to structural resptnse and structural frag llity formulation for a seismic event. The major aims of this preliminary review are:
(a) to identify, where possible, sources of conservatism and nonconservatism; (b) form general impressions regarding the adequacy of the approach used of the findings of the LGS-SARA; (c) to identify key contributing structural components, if any; (d) compare the LAS-SARA with recent probabilistic risk assessments (PRAs) for other plants, if applicable; and (e) to gain insights regarding probable seismic capacity of the plant beyond SSE.
. In this review, the findings of the draft report prepared by the Brookhaven National Laboratory (BNL) (Reference 1) are relied upon heavily. The earlier review report prepared by Sandia National Laboratory (Reference 2) for the Indian Point Probabilistic Safety Study (Reference 3) is also relied upon extensively in this review.
Additional information obtained from the licensee and its representatives in a meeting of August 5, 1983 is also reflected in this review findings.
2.
Methodology of LGS-SARA A brief description of the methodology used for developing, structural frag'11 ties in the LGS-SARA is given in this section.
Structural fragility data are presented in the form of fragility curves which plot the fraction of expected failures versus effective peak ground acceleration.
In Fig. 1, an example of a fragility curve is shown.
In the LGS-SARA, generally, Seismic Class I Structures are considered to fail functionally when inelastic deformations of the structure under seismic load are estimated to be sufficient to potentially interfere with the operability of safety related equipment attached to the structure.
Thus, the conditional probabilities of failure for a given free field. ground acceleration for Class I structures are for operability limits and should not necessarily correspond to structural collapse.
In order to obtain fragility curves, the approach adopted in '
assigning capacities (failure fraction as function of effective peak ground acceleration) for the structures was to first determine the median factor of safety against failure and its statistical variability under the safe shutdown earthquake (SSE). Then the median effective ground acceleration causing failure was estimated by multiplying the SSE acceleration level by this factor.
f The overall safety factor was determined by evaluating the safety factors for a number of parameters, which fell into two categories:
structural capacity and structural response.
Parameters influencing the factor of safety on structural capacity include the strength of the structure compared to the design stress level and the inelastic energy absorption capacity (ductility) of a structure to carry load beyond yield.
In the LGS-SARA, an additional parameter, earthquake duration factor, is also included in computing the median factor of safety on structural capacity. The parameters in structural response for a given ground acceleration are made up of many factors. The most significant of these include:
(1) ground motion and the associated ground response spectra for a given peak free field ground acceleration, (2) energy dissipation (damping), (3) structural modeling, (4) method of analysis, (5) combination of dynamic response modes, and (6) combination of earthquake components. The derivation of each factor of safety considered variability.
In each case, a median
^
safety factor was assigned along with a variability. When combining the median safety factors
. of contributing pcrameters, their variabilities were also combined to define the overall safety factor.
From this overall s'afety factor, the median effective or sustained peak ground acceleration associated with failure was determined as explained earlier.
The entire fragility curve for any structure can be expressed in terms of the best estimate of the nadian ground acceleration caphcity and two random variables, one representing the inherent randomness of the event (B ) and the other corresponding to R
uncertainty associated with predicting response to ar event (B )*
U P ' r definition is irreducible. For example, it is not possible, ao. east in the foreseeable future, to predict the exact time-history of an earthquake event at a given site, assuming that the occurrence of the event can be predicted.
B, n a sense, U
represents a measure of our lack of knowledge for example, the mathematical modeling of a structure to predict the responses to a seismic event. As our knowledge advances, this uncertainty can be reduced.
In Fig. I an example of log-ncrmally distributed fragility curve is shown. The solid curve is, effectively, the median fragility curve incorporating inherent randomness uncertainty, B. The left and R
right dashed curves represent certain percentile curves to reflect the uncertainty (B ) in the median curve.
U
, Note that seismically induced failure data are generally unavailable for structures. Therefore, each factor of safety and its variability and hence the final fragility curves are developed primarily from analysis and engineering judgment supported by limited test data. Table 1 lists the key structural components with associated capacity data in terms of median acceleration capacity and associated log-normal standard deviations.
The earthquake duration factor used in LGS-SARA has not been used explicitly in other PRAs. This factor, according to LGS-SARA, reflects the additional capacity due to the shorter duration with correspondingly lower energy content and fewer strong motion cycles present in the Limerick median expected earthquake as compared to the earthquake which would generate the number of cycles used in the determination of the median factor of safety related to the ductility of the structure.
It should be noted that the methodology used in the LGS-SARA, as in other PRAs, does not include an explicit consideration of design andconstructionerrorsand,hence,maybebiased(Reference 1).
3.0 Evaluation of Findings In this section, review comments are presented on both general methodology and the key structural components listed in Table 1.
The following seismic Category I structures were evaluated in he LGS-SARA.
Primary Containment Structures Reactor Enclosure and Control Structures Spray Pond Pump Structure Diesel Generator Enclosure Spray Pond It was judged in LGS-SARA that the failure of non-Category I buildings, would not affect the seismic capacities of the Category I structures and, hence, fragility evaluation were not conducted for the non-Utegory I structures as part of this evaluation.
It is cur understanding that the selectior. of the critical structural components was based on the identification by NUS of system and components important to safety and a plant walk-down performed by SMA. As indicated in Reference 1, since the plant is still under construction, a systematic review of the potential for secondary components failing, falling, and impacting primary components was not undertaken. Therefore, we concur with the recommendation in Reference 1 (p. 4-7) to conduct a systematic review of this aspect after the construction of the plant is completed.
e 3.1 Comments on' General Methodology The methodology used in the LGS-SARA is very similar to the methodologyusedinotherPRAs(e.g. Reference 3),andassuchisa state-of-the-att approach. However, the methodology is based on simple probabilistic models and hence, in our opinion, contains large uncertainty due to methodology itself. Specific comments on the methodology are as follows.
(a) The multiplicative model (i.e. the median of the overall factor of safety is a product of the median factors of safety for each variable) proposed in the section 2 of Appendix B of the LGS-SARA requires the mathematical condition that each median factor of safety be an independent variable.
The licensee in a meeting and in a subsequent letter (Reference 4) indicated that the use of the above model is not intended to imply that each of these variables are totally independent. The estimated influence of dependency was considered in developing the factors of safety and log normal standard deviations for each variable. The applicant further stated that the overall median factor of saf2ty and associated variabilities are checked for reasonableness for each structure and mode of failure.
Considering the state-of-the-art, the methodology is reasonable when the above fact is taken into consideration and the evaluation is performed by an experienced engineer.
However, it must be noted that the above nethodology has not been verified by either analytical investigation or adequate test data and, therefore, contains a great deal of uncertainty.
(b) The explicit use of the factor of safety associated with the expected duration of the earthquake is unique to LGS-SARA.
In other published PRAs, the duration effect is accounted for by considering it to be incorporated in the concept of effective peak acceleration in the hazard estimation.
In the LGS-SARA, the duration factor is considered independently and in addition to the use of effective peak acceleration.
Reference I contains a detailed discussion of this factor including its effects on the risk results. The licensee provided additional information (Reference 4) to indicate that when the three factors of safety of (effective peak acceleration, ductility, and duration are considered simultaneously, the combined median factor of safety and uncertainty values are reasonable as compared to other PRAs.
This information is currently being reviewed by the staff.
(c) As discussed earlier, the design and construction errors are not accounted for explicitly in the fragility development.
It is recognized that this is the limitation of the current state-of-the-art.
(d) As discussed in Reference 1 and reviews of other PRAs (e.g.,
Reference 3), additional studies and research efforts are required to justify the use of ductility factor for single degree of freedom models to represent multidegree of freedom structures. We concur with Reference 1 that higher uncertainty value should be assigned to this factor.
1 (e) We concur with the Reference 1, that uncertainty in some of the parameters has been understated (particularly, modeling uncertainties). The median capacity value may be on the high side in some cases.
(f) As in other published PRAs, LGS-SARA does not contain sensitivity analyses to indicate the robustnes: cf the assumptions. However, in a August 5 meeting the licensee provided some discussion on the result; of a recent sensitivity study which examined, for example, the effects of the assumption of different distribution (other than log-normal). We have not reviewed the results of this study.
Reference 1 has included some sensitivity studies for some assumptions.
It appears that effects of the assumption used in the developing fragilities LGS-SARA on seismic risk are minor.
~
(g) It was not clear to us whether or not dynamic lateral earth pressures were considered in the structural fragility evaluation.
In a response to (Reference 4) the staff inquiry, the licensee stated the following:
"The Limerick structures are generally embedded in rock with lean concrete backfill. The rock ard concrete backfill are i
separated from the structures by several inches of rigid ins'ulation so that essentially no lateral loads can be transmitted to the structure from the rock. The seismic models, which were developed for the design analysis and which were used for the capacity evaluations, reflect this se?aration.
No lateral loads are transferred from structure to rock or vice versa except at the base slab, and all shears and moments developed in the structure are transferred down to the base slab rather than being taken out at higher elevations.
Any local soil loads on the walls were judged to be small in comparison to the out-of-plane capacities of the walls, and therefore no reduction in the seismic capacities of the Limerick structures was judged appropriate. There is no evidence that dynamic soil pressures have ever failed basement walls unless gross soil failures have occurred.
Such a failure is considered incredible at the Limerick site."
. It is recommended that the above judgment should be verified by a specific analysis of the embedded portion of a reactor enclosure wall which takes into account the effects of soil pressures, where applicable.
(b) We concur with -the Reference 1 that the implications of impact between the containment building and the reactor enclosure should be addressed for the following concerns:
a.
Failure of safety-related electrical and control equipment located in the reactor enclosure.
b.
Failure of safety-related piping which crosses between the two buildings due to relative displacements.
In addition, it should be verified that no safety-related components will be damaged by spilled concrete caused by impact of the two structures.
Finally, it should be verified that failure of small lines attached to the safety-related piping near the junction of the two structures and anchored to the reactor enclosure will not contribute to the frequency of core melt.
. Based on the above discussion of the general methodology, it is apparent that current state-of-the-art for seismic risk evaluation precludes the determination of " absolute" seismic risk and it only provides a relative measure of risk between different sites and plants provided the methodologies and assumptions are consistent in each risk evaluation.
3.2 Comments on Critical Structures / Components Listed in Table 1 Table 1 lists the critical structural components or compone nts which are affected by the estimation of structural response parameters. We have not performed a detailed review of the calculations for each of these critical components. However, we have reviewed the findings reported in the Reference 1 and the discussions in LGS-SARA.
(a) Condensate Storage Tank (S,,)
We concur with the findings in the Reference 1 that the fragility parameters for the condensate storage tank appear to be reasonable.
(b) Reactor Internals (S3), CRD Guide Tube (SS), Reactor Pressure Vessel (56)
In the fragility estimation for these three components, a value of 10% damping was assigned to concrete portions of the support structure (also see Reference 1).
In Reference 4, the licensee quoted results of a recent study (Reference 5) which indicates median dampings at various stress levels. Based on these damping values, the licensee performed an analysis to indicate that composite damping value to be between 9 and 10 percent for the RPV support system at the median RPV fragility level.
Provided the values in Reference 5 are acceptable, the issue of the damping value in j
concrete structure can be considered resolved.
We concur with Reference 1 that, as for other components, the modeling uncertainties are underestimated. According to Reference 1, the effect of doubling the uncertainty for modeling would have a small affect in the frequency of core melt.
(c) Reactor Enclosure and Control Structures (S4)
In Reference 1, it is estimated that the median capacity for this component should be 0.90g as opposed to 1.05g as indicatedinLGS-SARA (p.4-25ofAppendixB).
It is further estimated that the mean frequency core melt would increase, approximately, by 20 percent because of the lower median capacity.
(d) SLC Test Tank (58)
We concur with the recommendations in Reference 1 that the component specific analysis is needed to verify the parameters used in the fragility development.
e d
(e) SLC Tani: (S10)
As suggested in Reference 1, the possible failure of the SLC tank due to tearing of the base plate flange near anchor bolts should be checked to verify that it is not the weakest capacity.
4.0 Conclusions j
(a) Sources of Lanservatism and Unconservatism Following is a partial und preliminary list of possible sources of conservatism and unconservatism.
(1) Conservatism Structural fragility formulation does not have a lower-bound cut-off value.
It is believed that below certain acceleration value, an engineered structure or components will not fail.
The use of low ductility value (2 to 2.5) for flexural mode of failure of shear walls compared to other PRAs (4 to 4.5).
It appears that median values are generally conservatively estimated.
(ii) Unconservatism Omission of explicit consideration of design and construction errors. However, since it is possible
~
errors can it'd to either weaker or stronger members this ommission need not always be unconservative.
- Inclusinn of duration factor in conjunction with the effective peak acceleration. This is, in part, compensated by the use of low ductility values.
- The modeling uncertainties both due to probabilistic model to determine fragility and original design model, are, generally, underestimated. THe effects of increase in these uncertainties are discussed in the Reference 1.
(b)
It is concluded that the methodology used in the LGS-SARA is a state-of-the-art approach and this approach, although considered reasonable has not been validated and contains a great deal of uncertainty in itself. The estimated median structural fragility values in LGS-SARA appear reasonable or conservative (except for the case of the reactor enclosure building as discussed in Section 3.0) while the uncertainties are underestimated in some cases.
(c)
In Reference 1, it is indicated that further analyses are required to determine whether the mean frequency of core melt is dominated by contributions from structural failures or electrical component failures. Therefore, the issue of significantly contributing structural components will be
discussed at a later date.
It should be noted that any significant improvement i.n risk is not anticipated from any structural fixes.
(d) The methodology used in the LGS-SARA is essentially identical to the one used in the recent PRAs, such as, Zion Probabilistic Safety Study (ZPSS) and Indian Point Probabilistic Safety Study (IPPSS). Following are the major differences between the methodology used in LGS-SARA and ZPSS and IPPSS.
The LGS-SARA includes an expiteit factor of safet; for earthquake duration (see (a) above).
The LGS-SARA includes random failure (non-seismic) of components.
In the ZPSS and IPSS, structurtl components were found to be dominant seismic contributor to core melt frequency, while in the LGS-SARA electrical components have been found to be dominant seismic contributors to core melt frequency.
(see(c)above).
(e)
It appears that plant structures and structural components can withstand the earthquake levels well beyond the SSE level. Based on the median acceleration values and associated
s 44 -
variability listed in Table 1 in general, no significant probabilities of failure can be identified for these components in the range of the SSE level.
References 1.0 A Preliminary Review of the Limerick Generating Station Severe Accident Risk Assessment" (Draft), Brookhaven National Laboratory, August 15, 1983.
2.0 Review and Evaluation of the Indian Point Probabilistic Safety Study", NUREG/CR-2934, December,1982.
3.0 Indian Point Probabilistic Safety Study, Power Authority of the State of New York, Consolidated Edison Company of New York, Inc., Spring 1982.
4.0 Letter from Philadelphia Electric Company (PECO) to A. Schwencer of NRC dated August 29, 1983.
5.0 Stevenson, J.D., " Structural Damping Values as a Function of Dynamic Stress," Nuclear Engineering and Design, Volume 60(2) pp. 211-237, September 1980.
i Table 1.
Significant Structural Fragility Components Median Ground Failure Cause Acceleration O
8 No.
Component or Mode Capacity R
R S
Condensate storage tank Tank-wall rupture 0.24 0.23 0.31 7
5 Reactor internals Loss of shroud support 0.67 0.28 0.32 3
S Reactor enclosure and Shear-wall collapse 1.05 0.31 0.25 4
control structure S
CRD guide tube Excess bending 1.37 0.28 0.35 5
5 Reactor pressure vessel Loss of upper support 1.25 0.28 0.22 6
bracket 5
SLC-test tank Loss of support 0.71 0.27 0.37 8
S SLC tank Wall buckle 1.33 0.27 0.19 10 O
D 9
i
. J l
^
- d # ~
1.0 s,,.s
,,/
,/
/
l
/
2
/
/
/
3
/
/
5
/
>3 I
i"
/
/
i
/
/
a
/
3 l
l
'E
/
o
/
/
l
/
/
/
/
/
/
/
/
u-
--..e-o A
A A=At R'U n median ground acceleration per f ailure e U = random vanable represe%ng unceMainW e. rancem variable representing randomness A.4 effective peak acceteration Figure 1.0 Failure p ohabitioes fra erauspment and structures.
s b
g 9
i 47 -
REVIEW OF COMPONENT. FRAGILITIES IN THE LIMERICK GENERATING STATION SEVERE ACCIDENT RISK ASSESSMENT I.
INTRODUCTION The evaluat. ion presented here relied upon information provided by the applicant in References 1, 2 and 3, and included the applicable review and evaluaticn presented in Reference 4 by the Brookhaven National Laboratory (BNL). Our review focused on those portions of Section 3 of Chapter 3,andSections1,2,3and5of=/dpendixBofReference1which are pertinent to seismic fragility evaluation of components including piping systems, mechanical equipment and their supports, and the reactor pressure vessel internals.
II. METHODOLOGY OF LIMERICK GENERATING STATION SEVERE ACCIDENT RISK ASSESSMENT (LGS-SARA) s The seismic risk analysis of LGS SARA consists of the following four 9.
steps.
1.
Seismicity: estimation of the occurrence frequencies of ground-motion acceleration.
2.
Fragility-estimation of the inabilit) of plant structures and j
\\
~
cottponerits to vitesti.nd various seismically initiated ground N
accelerations and itentification of 5,ignifit, ant failures.
3.
Plant-System Analysis: construction of seismic event tree and fault trees.
3
4.
Accident-Sequence Analysis: quantification of seismic accident sequences.
This evaluation report only addresses the second step regarding the component seismic fragility analysis.
Component seismic fragility is defined as the conditional probability of failure via one of several defined failure mcdes for a given level of seismic ground-motion acceleration. The objective of a fragility evaluation is to estimate the median effective ground acceleration value for which the seismic response of a given component located at specified point in the structure exceeds the component capacity resulting in its failure via a defined mode. The basis of the method used by the applicant is to first estimate margin to failure or the median factor of safety against failure and its statistical variability under the design basis (generally the safe'-shutdown earthquake, SSE). Then the median effective ground acceleration causing failure'is estimated by multiplying the SSE (or OBE) acceleration level by this factor.
For equipment and other components, the overall factor of safety is made up of three parts consisting of-a capacity factor, an equipment response factor and a st"":tural response factor. The overall factor of safety is then the product of these three factors. The capacity factor is evaluated as the oroduct of the strength factor and the inelastic energy absorption factor (ductility ratio). The strength i
i
. factor represents the ratio of, ultimate strength for the defined failure mode to the stress calculated for SSE. The inelastic energy absorption factor accounts for the fact that equipment is capable of absorbing substantial amounts of energy beyond yield without loss of function.
The equipment response factor is the ratio of the realistic equipment retponse to the equipment response calculated in the design; thus it is the factor of safety inherent in the computation of equipment response.
It takes into account earthquake characteristics like the spectral shape, combination of modal response, damping, combination of earthquake components and the method used for the seismic qualification of the component. The structural respon"4 factor represents the margin associated with the response characteristics of the structure at the location of the component.
It includes structural variables such as spectral shape, damping, modeling and soil-structure interaction.
For each factor, a median value was assigned along with a variability due to randomness and uncertainty. When combining the median values, their variabilities are also combined to define the overall safety factor.
From this overall safety factor, the effective peak ground acceleration at failure is determined as explained earlier.
The source of irformation utilized in developing LGS-SARA component seismic fragility and detennination of component failure modes will be discussed in detail in Section III, EVALUATION, of this report.
. III. EVALUATION The objective of this review is to perform an evaluation of the appropriateness of the overall methodology used in the component seismic fragility analyses and a comparison of the LGS-SARA methodolgy with current state-of-the-art probabilistic Risk Assessment (PRA) technology.
Overall, the compor.ent seismic fragility analysis of LGS-SARA is found to be reasonably within the state-of-the-art of the current PRA approaches. The staff's evaluation findings and review comments are as follows:
1.
In determing the component seismic fragility, the applicant considered both functional failure (i.e., failure to perform its intended function) and structural failure (i.e., failure of the pressure boundary).
Because of the variety of equipment to be included in the risk model, the variety of failure modes, and the various sources of fragility information available, it is necessary to treat many groups of equipment generically. Several sources of information are utilized in developing the component seismic fragility in LGS-SARA. These sources include:
a.
Seismic Qualification Review Team (SQRT) Packages b.
Plant Specific Design Reports, Test Reports c.
Generic Fragility Test Data from Military Test Programs d.
Generic Analytical Derivations of Capacity Based on Governing Codes and Standards
For a piping system, the failure of a single support is very conservatively assumed to result in failure of a piping system.
In the analysis of piping systems, pipe support failure rather than plastic collapse of the pressure boundary was found to be the governing case. The inelastic energy absorption (ductility) associated with these failure modes has been considered in determining the seismic fragility of oiping system.
In References
[
2 and 3, the applicant indicated that available test data from several sources (References 5, 6, 7, 8, 9,10,11 and 12) were utilized in developing piping system fragility. Based on its review of the data base, the applicant concluded that the defined value of plastic collapse used in LGS-SARA together with the available ductility would not result in any serious ovalization which could impair function of the piping system.
As a result of its analysis, the applicant also concluded that the resulting median capacity factor (as defined earlier in Section II of this report) for piping systems is 6.64, a value far greater than any of the structures or components governing seismic risk discussed in Reference 1.
Furthermore, the applicant indicated that an additional conservative calculation, without considering the beneficial effect from inelastic energy aborption, was performed to substantiate its conclusion. The resulting peak ground acceleration capacity of piping systers is 1.44. This is a 9
fragility level significantly greater than many of the other components that played a dominant role. in the LGS-SARA.
Based on the information provided by the applicant, the staff determined that the applicant's methodology in determining the seismic fragility for piping systems is found to be reasonably within the state-of-the-art of the current PRA approaches.
With respect to the valve failure modes considered in LGS-SARA, the applicant indicated that the most critical failure mode for a valve is typically the loss of ability to change state due to yielding of the extended operator support. Valve bodies are stronger than the connecting pipe by ASME Code requirements, therefore, valve body rupture is not a credible fcilure mode. Valves were assumed to fail functionally when a plastic hinge formed in the operator support. An additional failure mode resulting from operator support yielding could be leakage past the stem seals. The applicant further indicated that if malfunction is assumed when the stress in valve operator supports reaches yield strength instead of when a plastic hinge forms, the resulting peak ground acceleration capacity for a va is 1.879 which is considerably higher than the seismic fragility level of other components that played a dominant role in the LGS-SARA.
Based on the information currently available in References 1 and 2, the staff determined that the applicant's methodology of estimating valve seismic fragility is considered appropriate.
. 2.
With respect to interaction of non-safety related structures or equipment with safety related items, the applicant indicated that a specific system interaction study was not conducted in the Limerick SARA. Major structure / system and component / system interaction potential was, however, addressed. Both safety-related and non tafety-related structural failures were analyzed, and the effect of structural failures on safety-related equipment was assessed. A plant walk-through was conducted at Lirerick. No obvious system interactions were observed that were felt to be contributors to seismic risk.
In addition, it is noted that the Limerick design requires that non-s&fety related components which are located in the vicinity of safety-related items are either analytically checked to confirm their integrity against collapse when subjected to seismic loading from the SSE or are separated from seismic Category I equipment by a barrier. However, it is possible that the responses and capacities, i.e., the factors of safety to withstand seismic ground motion acceleration above SSE, for some non-safety related items are different from the nearby safety-related 1tems. Because the walk-through was conducted before the completion of construction, a confirmatory assessment and walk-through should be conducted after construction of the plant is completed to locate non-safety related components which could fail, fall and impact safety-related items. Consideration should be given to the possible effects of actual response and capacity characteristics to determine whether the non-safety
~
related items are weaker than the nearby safety-related items.
3.
In Reference 1, the applicant indicated that -stresses resulting from seismic and normal loadings are utilized in determing the component seismic fragility. LOCA and other dynamic loading combined with seismic events is considered too low a probability combination to be included in the development of seismic fragility.
In Reference 2, the applicant also stated that pipe support failure were found to be the governing case for piping syr.tems in LGS-SARA.
For the design of pipe supports at Limerick, the stress produced by the seismic anchor point motion of piping in the supports is considered as primary stress which is utilized in the fragility calculation.
Furthermore, when inelestic deformation of the structure resulting from large structural displacements beyond the elastic limits is estimated (engineering judgement not analytical evaluation) to be sufficient to potentially damage the equipment attached to the structure, systems connected to the structures are considered to fail. Therefore, the applicant concluded that the differential movement of structues are implicitly considered in the development of fragilities for piping systems.
Based on the information provided by the applicant, the staff determined that in general, the applicant's procedures are considered appropriate. However, for the case of potential impact between the reactor building and containment, the staff agreed with the BNL review comment as addressed in Section 2.1.3.5 of Reference 4.
All the safety-related piping which connects both buildings
should be systematically reviewed to verify that sLfficient flexibility is provided to accommodate relative displacement between the structures.
With respect to potential impact due to tilting of structures, the applicant indicated that Limerick structures are formed on component rock and tilting of such a structure is not a credible failure mode. Therefore, failure of piping and equipment due to tilting of the structure is not a credible failure mode.
In add 1 tion, the applicant stated that buried pipe at rock sites is not subjected to excessive strains unless there is excessive block motion of the rock. Large block motion is not anticipated to occur at earthquake levels that cause failures of major structures and equipment. Therefore, buried pipes are not considered to be a governing element in the accident sequences. However, it is noted that a portion of the Limerick emergency service water cooling line is buried in backfill material of which the soil amplification factor could be greatly different from the rock. The applicant should verify that the potential failure of the buried pipe due to soil amplification is not credible. Evaluation of the appropriateness of the soil amplification factor is being reviewed by the Structural and Geotechnical Engineering Branch (SGEB).
4.
Three of the significant earthquake-induced component failures of LGS-SARA are associated with the reactor pressure vessel (RPV).
These include reactor internals, RPV and the CRD guide tubes. The
RPV is supported by a base skirt and an upper lateral supports.
The upper portion of the RPV is supported by a lateral stabilizer which spans the gap between the RPV and reactor shield wall. The reactor shield wall in turn, is anchored to the containment wall by a steel seismic truss.
In Reference 1, the applicant stated that the RPV support reactions are predominantly a function of the dynamic characteristics of concrete support structure rather then L
dynamic characteristics of the RPV itself.
In the development of the median capacity factor for the reactor internals, RPV, and the CRD guide tubes, it was assumed that the containment structure had an effective damping value of 10% which differs from the 5% damping used in the original design analysis addressed in LGS-FSAR Section 3.8.
The appropriateness of the applicant's analyses for concrete support structure and their impacts.on final results, i.e., the validities and uncertainties associated with these components fragility analysis, are being reviewed and addressed by the SGEB.
Based on its assessment, the applicant has identified 17 key components and structures whose failures affected the dominant sequances leading to core melt. A copy of the fragility calculations for these 17 significant components listed in Table 3-1 of Reference 1 were reviewed by the NRC consultant, Jack R.
Benjamin and Associates, Inc. (JBA). The detailed results of this review are addressed in Section 2.1.3.7 of Reference 4.
The significant earthquake-induced failures pertinent to the Mechanical Engineering Branch review included failure of the reactor vessel
internals shroud support, failure of the RPV upper support bracket, failure of CRD guide tubes, failure of hydraulic centrol unit, failure of the nitrogen accumulator anchor bolt ar a railure of the diesel generator heat and vent system support. ~.
staff agrees with the review comments addressed in Section 2.1.3.7 of Reference 3.
The applicant's methodology of evaluating the seismic fragilities for reactor internals, RPV and the CRD guide tubes is appropriate except the item addressed in Section III.4 above.
With respect to hydraulic control unit, nitrogen accumulator and diesel generator heat and vent system, in general, the applicant's results, i.e., the median capacity factors and the uncertainties are conservative. However, for these components, the analyses are based on either generic capacities or Susquehanna Nuclear Power Plant Tests and fragility calculations. Since they are important to the final risk, specific calculations based on the characteristics of these components for Limerick plant should be performed. Alternatively, the applicant should provide information to justify the validity of its data base including the consider-ation of the possible differences of component capacities and responses due to the different foundation conditions, installation and construction of the component.
5.
With respect to design and construction errors, the applicant indicated that an inadequate data base exists upon which to determine explicitly the contributions of design and construction errors to most Limerick structures and equipment seismic
. capacities. Minor design and construction errors are accounted for in the variabilities associated with the various modes of failure investigated. However, only gross errors car..nfluence the seismic risk results for a nuclear power plant.
In general, for a plant as new as Limerick with current design and QA procedures, the possibility is considered remote that major design and construction errors exist which can significantly affect the seism'ic capacity of a component. Nevertheless, there is a possibility that unidentified design and construction errors may exist which can affect the seismic capacity. Since the LGS-SARA analysis does not include a comprehensive consideration of design and construction errors and hence, may be biased (note that errors may be conservative or unconservative), the results are useful only in making relative comparisons.
V.
CONCLUSION Based on its review of the information in Reference 1, 2, 3 and 4, the staff concluded that the methodology used in the LGS-SARA for component seismic fragility analysis is appropriate and adequate to obtair a relative measure of the seismic capability of the Limerick plant. As addressed in Reference 4, the mean frequency of seismically induced core melt in LGS-SARA is dominated primarily by electrical components. This differsfromtheIndianPointProbabilisticSafetyStudy(IPPSS)andthe Zion Probabilistic Safety Study (ZPSS), which the non-electrical components and structures controlled the results. As addressed in
.Section III, Evaluation, of this report, the procedures used in LGS-SARA in determining the component seismic fragility are based on limited available test data and rely heavily on engineering judgement. The analysis does not include a comprehensive consideration of design and construction errors and, hence, may be biased (note that errors may be either conservative or unconservative). The specific issues and comments raised in Section III of this report need to be resolved before judging the impact on final results, i.e., the validity and uncertainty associated with numerical estimation of component seismic fragility.
Nevertheless, the results from the LGS-SARA are useful in obtaining a relative measure of seisraic capability of components for Limerick plant and should not be viewed in an absolute sense. The staff has been able to conclude that the component seismic fragility analysis of LES-SARA is reasonably within the state-of-the-art of the current PRA approaches.
4
REFERENCES 1.
Report, " Severe Accident Risk Assessment, Limerick Generating Station," PhiladelpLia Electric Company, dated April 1982 2.
Letter, John S. Kemper to A. Schwencer, " Response to NRC Questions on the Severe Accident Risk Assessment,"
Philadelphie Electric Company, dated August 24, 1983 3.
Letter, John S. Kt.mper to A. Schwencer, " Response i.o NRC Questions on the Severe Accident Risk Assessment," Philadelphia Electric Company, dated August 29, 1983 4.
Report "A Preliminary Review of the Limerick Generatoring Station, Severe Accident Risk Assessment," Engineering and Risk Assessment Division, Department of Nuclear Energy, Brookhaveu National Laboratory, dated August 15, 1983 5.
Rodabaugh, E. C. and S. E. Moore, " Evaluation of the Plastic Characteristics of Piping Products in Relation of ASME Code Criteria, July 1978," NUREG/CR-0261, ORNL/Sub-2913/3, July 1978 6.
Gerber, T.
L., " Plastic Defornction of Piping Due to Pipe-Whip Loading," ASME Paper 74-NE-1 7.
Franzen, W. E., and W. F. Stokey, "The Elastic-Plastic Behavior of Stainless Steel Tubing Subjected to Bending, Pressure and Torsion",
Second International Conference on Pressure Vessel Technology, San Antonio, Texas, Published by ASME, New York 8.
Del Puglia, A. and G. Nerli, " Experimental Research on Elasto-Plastic Behavior and Collapse Load of Statically Indeterminate
. Space Tubular Beams", Second International Conference on Structural Mechanics in Reactor Technology", Berlin, Germany,1973, Vol. 2, Part 2 9.
Sherman, D. R. and A. M. Glass, " Ultimate Bending Capacity of Circular Tubes", Proc. Offshore Technology Conference, Dallas, 1974, OTC Paper No. 2119
- 10. Jirsa, J. O., F. H. Lee, and J. C. Wilhoit, "0valing of Pipelines Under Pure Bending ", Proc. Offshore Technology Conference, Dallas, Texas,1972, OTC Paper No.1569
- 11. Sorenson, J. E., R. E. Melson, E. Rybicki, A. T. Hopper and T. J.
Atterbcrry, " Buckling Strength of Offshore Pipelines ', Battelle-Columbus Labs Report to the Offshore Pipeline Group, July 13, 1970
- 12. Kennedy, R. P., R. D. Campbell, and Hardy, H. Benson, " Subsystem Fragility, Seismic Safety Margin Research Program (Phase 1)",
NUREG/CR-2405, UCRL 13407, February 1982
REVIEW 0F EQUIPMENT FRAGILITIES IN THE LIMERICK GENERATING STATION SEVERE ACCIDENT RISK ASSESSMENT 1.0 Scope The review comments and evaluation presented here are based mainly on the review of Chapter 3 and Appendix B of Limerick Generating Station Severe i
Accident Risk Assessment (LGS-SARA), (Reference (1)), in relation to equipment fragility.
The purpose of the review is to present the staff comments regard-ing the adquacy of the approach taken by the applicant as wel; as the findings of the study.
During the review process, frequent interactions have been main-tained between the staff and the Brookhaven National Laboratory (BNL), the staff's consultant on this review task.
As a result, BNL's evaluation forms
~
the main body of the review comments.
2.0 Methodology af SARA Fragility descriptions fer each of those equipient items participating in the accident sequences were deseloped utilizing available information from Utility, Architect engineer, the NSSS vendor, and other sources of fragility
. formation.
Fragility levels are expressed as frequencies of failure vs effective peak ground acceleratio The procedure used in deriving fragility descriptions is similar to that used for structural fragility desc,iptions, wherein, median factors of safety and variability are first developed for equipment capacity and equipment response.
These two factors, along with the median factor of safety on structural response, are then multiplied together to obtain an overall median factor of safety for the equipment items.
The logarithmic standard deviations associated with the above individual factors are combined by Root-Sum-Square (SRSS) method to establish an overall
. variability on the equipment fragility. The logarithmic standard deviations are further divided into variabilities due to randomness and uncertainty.
The median overall factor of safety obtained is tnen multiplied by the reference earthquake peak ground acceleration to arrive at the equipment capacity in terms of peak ground acceler6 tion.
The SSE is generally used as the reference earthquake.
Several sources of information were used to derive plant specific and generic fragilities for equipment. These sources include (a) Final Safety Analysis Report (FSAR), (b) Seismic Qualification Review Team (SQRT) submittals for the Susquehanna Steam Electric Plant, (c) United States Corps of Engineers Shock Test Reports, and (d) Other Probabilistic Risk Assessment (PRA) Reports.
Susquehanna is a very similar plant designed and constructed by the same Architect Engineer (Bechtel Corporation) and same NSSS Vendor (General Electric Co.) as Limerick.
Consequently, advantage was taken of previous fragility description derivations for Susquehanna equipment where applicable. Many of those derivations were based on information contained in Susquehanna SQRT submittals, in which summaries of analysis or test methods and results are available.
Analysis results can be used directly to develop fragility descriptions. Test results are used in conjunction with generic fragility test data to develop approximate fragility levels.
In some cases, capacities are developed from summaries of design reports contained in the FSAR.
Some generic fragility test data were utilized in the derivation of fragility descriptions.
Fragility tests and severe chock environment tests have been conducted for off-the-shelf type equipment similar to electro-rachanical, electrical and control equipment installed in nuclear power plants.
The results of some 60 test programs are summarized by U.S. Corps of Engineers.
Information from these shock test reports are used in deriving generic capacities of equipment where plant specific information was not readily available or could not be extrapolated to a failure level.
, Because of the variety of equipment to be included in. the risk model, the variety of failure modes, and the various sources of fragility information available, it is necessary to divide the equipment items into distinct groups.
The selected major categroies of equipment are:
1.
Plant specific equipment whose fragility descriptions are based on structural failure and for which summaries of design reports are reviewed.
2.
Plant specific equipment whose fragility descriptions are based on functional limits and for which summaries of design reports were reviewed.
3.
Equipment for which generic structural capacities can be derived from knowledge c he design specifications and the strength factors of safety inherent in the governing codes and standards.
4.
Equipment for which generic structural and functional capacities can be derived from fragility test data, military shock test data, seismic qualification test reports or other generic tests.
5.
Valves for which generic structural and functional capacities can be derived from sampling of capacities of several valves qualified for Susquehanna or other nuclear power plants, and from shock tests of piping systems containing valves.
The equipment response factor, as mentioned previously, is a measure of the conservatism er nonconservatism and the associated variability in determining the seismic response of equipment.
Because of the variety of methods used in qualifying equipment for seismic service, the response factor derivations are further grouped into the following several generic qualification categories:
1.
Equipment qualified by dynamic analysis 2.
Equipment qualified by static analysis 3.
Equipment qualified by test 4
. Depending upon the specific categories of equipment and its qualification method, the pertinent variables that affect the computed response and its dispersion may consist of some of the followin'g parameters:
1.
~
Spectral shape 2.
Static coefficient used vs spectral acceleration 3.
Modeling 4.
Damping 5.
Boundary conditions in the test vs installation 6.
Equipment fundamental frequency 7.
Combination of modal responses 8.
Combination of earthquake components 9.
Test method (sine beats, sine sweep, complex wave form, etc.)
10.
Multi-axial coupling and directional component Equipment capacity factors and their variabilities, on the other hand, can be derived for each of the equipment categories by considering the affecting parameters, such as st ength factors based on static strength, and/or ductility factor based on inelastic energy absorption much in the same manner as for structures.
The capacity factor is then the product of the streng'h and t
ductility factors, as applicable.
Based on the above mentioned methodology, the applicant has compiled an infor-mation summary (see LGS-SARA Appendix B Table 5-5) of equipment capacity, equipment response, and structural response factors, their logarithmic standard deviations and the median ground acceleration capacities for equipment items identified as important to the seismic risk study.
Systems for which the information is included consist of Reactor Core Isolation Cooling (RCIC)
Systems, High Pressure Coolant Injection (HPCI) System, Core Spray Systems, Residual Heat Removal / Low Pressure Coolant Injection (RHR/LPCI) Systems, Automatic Depressurization System (ADS), Electrical Power System, Emergency Service Water System, Standby Liquid Control System, Reactor System, and Scram System.
. In the event / fault tree modeling for LGS-SARA, individual fault trees for the mitigating systems represented in the seismic event tree were modified by incorporating seismic component failures into the system fault trees developed for the analysis of internal eve'nts and modular 1 zing the system fault trees until each system fault tree is represented by a non-seismic failure, a seismic failure or failures, or a combination of seismic and non-seismic failures.
Each individual fault tree was further reduced by neglecting seismic failures with very low probabilities of occurrer,ce and hence negligible contributions to core-melt frequency.
Through this process it was possible to identify 17 significant seismic failures, each of which I
has a median ground acceleratioa capacity of less than or equal to 1.56 g.
In LGS-SARA Table 3-1, these 17 components are listed together with the corresponding failure mode, and the median ground acceleration capacity and its variabilities.
3.0 Evaluation and Finding As stated in the BNL evaluation report (Reference (2)), Jack R. Benjamin and Associates, Inc. (JBA) was retained by BNL to perform a preliminary review of the LGS-SARA for the effects of seismic events.
JBA has performed similar reviews for the Indian Point Probabilistic Safety Study (IPPSS) and the Zion Probabilistic Safety Study (ZPSS).
It is noted that the hazard and fragility calculations for LGS-SARA were performed by the same engineers and were based on the identical methodologies used for the IPPSS and ZPSS, and therefore many of the issues a1d concerns generic to all sites and plants already'have been discussed and evaluated (Reference (3)).
As a result, the current JBA review focused primarily on critical areas which may impact the results and documented the important concerns applicable to the Limerick plant.
- As part of the review, a meeting was held at the Structural Mechanics Asso-ciates (SMA) office in Newport Beach, California, on July 8, 1983, with representatives from NRC, SMA, JBA, Nuclear Utility Service (NUS), and Dames and Moore participating to discuss issues raised to date concerning the LGS-SARA and to direct the review effort on the critical compoents and issues.
Subsequent to this meeting, a tour of the Limerick plant was conducted on July 15, 1983, with representatives from NRC, JBA, and NUS participating to review the installation of the above mentioned significant components as well as other equipment items of interest whose fragilities were reviewed in relation-ships to their potential impact on the mean frequency of core melt.
For example, the median capacity of the batteries and racks is reported to be as high as 2.56 g and thus was not included in the sequences.
This component was inspected during the plant tour, and its capacity value is judged to be reasonable.
Based on the staff evaluation of LGS-SARA, the applicant's submittal of August 24, 1983 responding to staff qu ' ions, and the recommendation provided by BNL (Reference (2)), the following comments on the LGS-SARA in regard to equipment in general as well as significant components in particular are presented for applicant's consideration.
1.
Impact between the reactor building and containment might cause high frequency uotion to safety related electrical equipment items located in the reactor building.
The capacities of these equipment items range between 1.46 g and 1.56 g.
This is considerably higher than the motion level of 0.45 g at which impact may occur; hence, these capacities may, in reality, be less than the above estimated values.
Additional study by the applicant may determine the actual effect of the impact and con-sequently the realistic reduction of the capacity of the electrical equip-ment.
2.
The staff was concerned about the effect of a potential, excessive leakage of mechanical :omponents, such as main steam isolation valves (MSIV's),
on the integrity of pressure boundary as well as other related systems.
In the August 24, 1983 submittal the applicant states that for MSIV, which is normally open and would have to change state after a seismic event, the critical failure mode is more likely to be failure-to-close thar leakage once the valve closes.
The fragility description for the MSIV was developed for a failure mode to close, which is judged to be the lowest capacity and the governing mode of failure.
The staff has found this response acceptable.
3.
The staff was concerned about the fragility description of purge and vent valves which were not spacifically addressed in LGS-SARA.
i The applicant, in his August 24, 1983 submittal, states that valves in Limerich have, in general, an estimated peak ground acceleration capacity of around 1.87 g which is considerably higher than any of the frag!11 ties that played a dominant role in the SARA.
He further states that for purge and vent valves, similar capacities are antici-pated.
In addition, these purge and vent valves are normally closed (typically open only 1 percent of the time) and_significant leakage would require even higher accelerations.
The staff found the above response acceptable and determine that purge and vent valves play an insignificant role in LGS-SARA.
4.
In regard to relay chatter, although reset of the system may be readily possible at the control room under certain circumstances, there are those relay trips which may require resetting at local panels and would cause high failure probability of the operator to reset; failure to do so would result in the equivalent of a relay failure.
Furthermore, there is the underlying question that, in view of the different modes of relay trips, the operator may be presented with a scenario for which he has not been trained and for which no written procedure is available for guidance, what would be the probability that he will perform adequately to reset the relays.
It is felt that LGS-SARA should include additional analysis on the relay chatter and address its impact upon various systems.
Failure of human action required to reset under stressed condition, and hence leading to relay fail-ure, should be considered.
a
. 5.
For Offsite Power (500/230-KV Switchyard) (S ) in LGS-SARA Table 3-1, y
the fragility description is based on the failure of porcelain ceramic insulators.
Based on historic data, the capacity is estimated at 0.2 g and appears to be reasonable.
6.
For 440-V Bus /SG Breakers (Syy), power circuit failure was identified as the failure mode.
The capacity was developed based on test data from the Susquehanna SQRT submittals.
The median capacity from Susquehanna was scaled by the ratio of the two SSE peak ground acceleration values.
Although the fra0ility parameter values (acceleration capacity is 1.46 g, standard deviations for randomness and uncertainty are 0.38 and 0.44 respectively) appear reasonable, it is not apparent whether the calculation by scaling has considered such important factors as differences in foundation condition, and, hence, the response of the reactor building, and the locations of the corresponding components in the two plants.
Since this component is a significant seismic contributor to the mean frequency of core melt, it is felt that a specific analysis should be conducted for this component.
7.
For 440-V Bus Transformer Breaker (S12), 125/250-V DC Bus (513),and 4 KV Bus /SG (Sy4), the failure modes were identified to be loss of function, loss of function, and breaker trip.respectively.
The capacities for these three components are the same (acceleration capacity is 1.49 g, standard deviations for randomness and uncertainty are 0.36 and 0.43 respectively) and are based on the fragility analysis of the diesel generator circuit breakers which, in turn, are based on the analysis of test data for the Susquehanna plant.
Same comments as given for S are, therefore, also applicable.
11 In summary, the fragility description for these three components appears reasonable.
However, because they are significant seismic contributors to the mean frequency of core melt, it is felt that a
^
specific component analysis should be conducted for each.
. 8.
For Diesel Generator Circuit Breakers (S15), the failure mode identi-fied is loss of function.
The fragility parameters (acceleration capacity is 1.56 g, standard deviations for randomness and uncertainty are 0.32 and 0.41 respectively) appear reasonabic. However, for the same reasons as -tated for Syy, 512' S13, and Sy4, it is felt that a specific analysis should be conducted for this component.
4.0 Conclusion Based on our review it is felt that the methodology and approach used in LGS-SARA in developing equipment fragilities are generally acceptable and the fragility descriptions presented appear reasonable.
However, more supporting information needs'to be furnished in LGS-SARA to resolve the comments presented in Section 3.0 before final staff judgement of the adequacy of the methodology and the results of the study can be made.
It appears that LGS-SARA differs from the IPPSS and ZPSS in that the seismic contribution to the mean frequency of core melt is dominated primarily by five electrical components in series (see Item Nos. 6, 7 and 8, Section 3.0),
which have nearly the same median capacties.
In contrast, nonelectrical components and structures controlled the results of the IPPSS and ZPSS.
The capacities for the LGS-SARA electrical components are derived based on generic tests and are not component specific.
This approach is reasonable as long as the components do not control the final results.
Since the electrical components are significant seismic contributors to the PRA, a more detail analysis regarding equipment fragility should be conducted, as recommended in Section 3.0.
References (1) Severe Accident Risk Assessment, Limerick Generating Station, Philadelphia Electric Company, Report No. 4161, dated April,1983.
70 -
(2) Azarm, M. A., et al., "A Preliminary Review of the Limerick Generating Station Severe Accident Risk Assessment," Volume I:
Core Melt Frequency, Brookhaven National Laboratory, draft NUREG/CR Report, dated August 15, 1983.
(3) Kolb, G. J., et al., " Review and Evaluation of the Indian Point Probabili-tic Safety Study," Prepared for U.S. Nuclear Regulatory Commission, NUREG/CR-2934, December, 1982, a
- 4 RECOMMENDATIONS AND
SUMMARY
Our review and that of BNL have indicated areas of the earthquake related portion of LGS-SARA that could be improved by additional clarification and sensitivity studies. These recommendations, outlined in each of the previous sections on seismic hazard and structural, mechanical, component and equipment fragilities, address a wide range of specific seismological and engineering topics. While addressing these specific issues, such as the postulated error in a Boolean expression pointed out by BNL, will improve the LGS-SARA, there are several fundamental shortcomings of the seismic event PRA which are inherent in the problem itself and it is beyond our means to adequately address them.
First and foremost is the inadequacy of the existing historical and instrumental seismic record (two to three hundred years). PRAs try to utilize this record to draw inferences on earthquake that appear to have mean return periods on the order of tens and hundreds of thousands and perhaps even millions of years. This extrapolation to provide rigourous numerical estimates must be viewed as highly speculative, particularly since we lack a fundamental understanding of the causative nature of the earthquake potential in the eastern U. S.
Attempts to deal with the problem lead to the observation that most of the calculated uncertainty in seismic event PRAs, such as LGS-SARA, is related to uncertainty in the seismic hazard. A second problem relates to the fact that the characterization of fragility is based on little data and a great deal of engineering judgement.
Finally there are some aspects of the problem where useful and comprehensive models
. incorporating engineering judgement have not even been proposed.
In the LGS-SARA, design and construction errors fall into this category. As a result, there exists a significant potential for systematic bias that cannot be simply accounted for. However when making relative comparisons, that is ratios, where such biases may be common to the-entities being compared (e.g. determining which are the major contributors to seismic risk), then errors resulting from them tend to be minimized. We therefore agree with our consultant (BNL) who states that "the results from the LGS-SARA are useful in a relative sense and should not be viewed as absciute numbers".
It is our judgement that reliance upon simple point estimate such as means or medians to characterize actual risk may be premature. However there has been an extensive effort to define the uncertainty. The wide bands of uncertainty presented in relation to the seismic elements of the LGS-SARA can be thought as representing a large part, but not all, of the actual uncertainties. They may be used to gain insight as to the range of the actual risk associated with seismic initiating events at Limerick. We do not mean to imply that higher risk estimates (e.g. 95th percentile) are more appropriate than the median, mean or lower (5th percentile) estimates.
Indeed the most significant earthquake damage anywhere within the vicinity of the Limerick Site, in the two to three hundred years during which we have records, are fallen chimneys 50 kilometers away during an eat....,;-ba at Wilmington, Delaware in 1871 whose magnitude can be estimated to have been less than 5.0.
We certainly cannot exclude from the range of reasonable assumptions the judgement that there essentially is no risk to the public resulting from earthquake-induce.d damage at the seismically-engineered nuclear power plant at Limerick during its operating life.
The nature of seismic PRAs such as the LGS-SARA requires us to look at the behavior and fragility of plants at ground motion levels well beyond the SSE as evidenced by Table 3.1 (Significant Earthquake Induced Failures) of the LGS-SARA. Even though some of these ground motion levels may appear extremely high for such a seismically quiet site as Limerick, they do provide us with insight as to the seismic capacity of the plant. For example, the applicant in response to NRC questions, estimates that the reactor and control buildings shear walls have a 95%
confidence of less than a 5% failure fracture at approximately twice the SSE. Although such conclusions are based upon the generalized assumptions needed to carry out the LGS-SARA, it is our judgement based on past experience that a detailed seismic margins analysis would support the conclusion that the Limerick Nuclear Power Plant can withstand postulated earthquake ground motion well beyond that defined by the SSE.
Finally a seismic PRA affords an opportunity to examine postulated accident chains and sequences that could lead to serious damage and result in radioactive release. Our review of the LGS-SARA indicates that there are no meaningful outliers in Table 3.1 (Significant Earthquake Induced Failures) such that simple modification to any of these structures, components are equipment would result in a significant reduction in risk to the public.