ML20028B906

Forwards Nonproprietary Version of Revised FSAR Re Protection Against Possible Turbine Missiles

ML20028B906
Person / Time
Site:	Byron, Braidwood, 05000000
Issue date:	09/02/1982
From:	Tramm T COMMONWEALTH EDISON CO.
To:	Harold Denton Office of Nuclear Reactor Regulation
Shared Package
ML20028B902	List: ML20028B901 ML20028B905 ML20028B906 ML20028B910
References
4947N, NUDOCS 8212070198
Download: ML20028B906 (35)

Text

, . - . . - . - . . . - . . - -

~ * * - ' ~ '

' NON-PROPRIETARY VERSION t .. Commonwrith Edison Submitted 11-29-82

< one First National Plaza. Chicago, lilinois Address Reply to: Post Office Box 767

, , , . 1' ' Chicago, Illinois 60690 September 2, 1982 .

Mr. Harold R. Denton, Director Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, DC 20555

Subject:

Byron Station Units 1 and 2 Braidwood Station Units 1 and 2 Turbine Missile Study NRC Docket Nos. 50-454, 50-455, 50-456, and 50-457 References (a): May 4, 1982 letter from T. R. Tramm to H. R. Den to n .

(b): August 18, 1982 letter from T. R. Tramm to H. R. Den to n .

Dear Mr. Denton:

This is to provide advance copies of reviseo FSAR information regarding protection against possible turbine missiles at Byron and Braidwood Stations. NRC review o f this information should close Outstanding Item 2 of the Byron SER.

Re ference (b) provided occumentation o f the turbine missile analysis which was undertaken as described in reference (a).

i Enclosed are changes to several pages of that document. The changes

( are generally editorial in nature and were made primarily to correct typographical errors and improve the clarity of the text. Neither i

l the content nor the results of the analysis have been altered.

Revision of the text is indicated by a vertical bar in the right-hand ma rgin. Corrections to the fault tree in C.4 are described on the At tachment to this letter. These changes will be incorporated into the FSAR at the next opportunity. Please adress questions regarding this matter to this of fice.

l One signed original and fif teen copies of this letter and j the enclosures are provided for your review.

Very truly yours, f /W=

T. R. Tramm Nuclear Licensing Administrator 1m Attachment ~ N 494, A r N m.

_ ~# /

,/

~ ~~~

m. Z;. . _ ___. _ ____. .T . . _ . . . _ _ - - - . _ _ - - - - . . - _ . - --

,' Corrections To Fault Tree s . o In Section C.4 Figure No. Location of Correction Correction C.4-6 Lower right-hand side ; below Area designation box which reads, " Loss of 3.8A-1 changed to Division 12 AC Pump." 3.2A-1 C.4-7 Lower lef t-hand side, below Area designation box which reads, " Failure of 11.1-0 changed to AC Power Cables to Pump." 11.4-0 C.4-8 Lower center of page; below Areas designation box which reads, " Loss of 17.1-1 changed to Division 11 SW Cooling 17.2-1 Tower."

he l B/B-FSAR APPENDIX C TURBINE MISSILE STUDY TABLE OF CONTENTS PAGE C.1 _ INTRODUCTION C.1-1 C.1.1 General C.1-1 C.l.2 Organization of the Report C.1-2 C.l.3 Reference C.1-2 l C.2 'EORMULATION C.2-1 C.2.1 General C.2-1 C.2.2 Turbine Missile Generation C.2-1 C.2.3 C.2.4 Missile Characteristics C.2-3 Frequency of a Plant Damage State C.2-4 C.2.5 Simulation of Conditional Frequency of Damage States C.2.6 References C.2-6 C.2-9 C.3 PLANT MODEL FOR THE SIMULATION C.3-1

. C.3.1 General C.3.2 Targets C.3-1 C.3.3 Barriers C.3-1 C.3-2 C.3.4 Turbine Model C.3-3 C.3.5 Reference C.3-3 l C.4 FAULT TR'EE FOR PLANT DAMAGE STATES C.4-1 C.4.1 General C.4-1 C.4.2 Damage States C and M -

C.4.3 Damage State R C.4-1 C.4.4 References C.4-3 C.4-3 C.5 PRESENTATION AND DISCUSSION OF RESULTS C.5-1 C.S.1 General C.5-2

, C.S.2 Conditional Frequencies of Dama..e States C.S.3 C.5-1 Frequency of Plant Damage States per Year C.5-2 C.6

SUMMARY

AND CONCLUSIONS C.6-1 C-1

~

_ _... ._ _ _ _ _ - - - - - - - - - - - - - - - - ' ~ ~ ' ~

~

B/B-FSAR

s. o APPENDIX C

• TURBINE MISSILE STUDY C.1 INTRODUCTION C.l.1 General a probabilistic analysis of turbine missile hazard at Byron /

'raidwood Stations was made in 1978 and is presented in Refer-ence 1. Based on the values of missile generation probability l then availabge, the plant damage probability was reported i

as 4.3 x 10- per year. Westinghouse Electric Corporation l subsequently revised the probabilities of missile generation due to evidence of stress corrosion cracking in some nuclear turbines. This revision affects missile generation at rated speed and at design overspeed conditions but leaves the missile generation probability at destructive overspeed unchanged from the previously used values. The revised probabilities of missile generation depend on turbine operating time since the last inspection for stress corrosion cracking. Generally, these probabilities are several orders of magnitude greater than the value used in Reference 1.

The purpose of this report is to evaluate the probability of turbine missile hazard at the Byron /Braidwood Stations i

considering the revised values for the probability of missile generation. The following modifications have been introduced l

into the analysis in order to take advantage of current infor-mation and to make a more realistic assessment: l

a. The present analysis considers plant logic and redundancy of components through a fault tree analysis.

b. Perforation velocity of reinforced concrete barriers is predicted using CEA-EDF formula.

c. Possibility of missile ricochet is considered in the analysis.

d.

The current vendor information on turbine missile l characteristics is used.

Items a through c above make it necessary to adopt a simulation model for predicting conditional probabilities of damage given that a missile is generated. The basic information and assump-tions used in the simulation procedure are also described in the report.

C.1-1 l

i

--:--. = = . - _ . - - . . . . - - - - - - .- - .. . . .

s B/B-FSAR ,

Results show that the probability of damage from turbine missile depends on the turbine operating time since last inspection.

If the inspection time of low pressure discs remains below 43 months in terms of turbine running time, the corresponding conservgtive estimate of damage probability will be less than 1 x 10- per turbine per year. This result is obtained using the available missile generation probabilities of the Byron l Unit 1 turbine. This conclusion will be applicable to the turbines of Byron Unit 1 and Braidwood Units 1 and 2 if the missile generation probabilities for those units are less than or equal to those of Byron Unit 1.

C.l.2 Organization of the Report The report contains six sections. Section C.2 presents the infor-mation for modeling turbine missile generation and describes formulation of probabilistic analysis for determining probabil-ities of various plant damages. Section C.3 describes the plant structural model used for simulation of missile trajectories.

Section C.4 describes the fault tree analysis of the plant damage states. Section C.5 presents and discusses the probability results of the specific damage states due to turbine missile hazards. Section C.6 summarizes the study and its conclusions.

C.I.3 Reference l

1. Byron /Braidwood Stations, Final Safety Analysis Report, Volume 14, Amendment 34, Commonwealth Edison Company, l November 1981.

0 0

0 C.1-2

. ~

B/B-FSAR C.2 FORMULATION .

~

C.2.1 General This section summarizes the information available for use 'l as input in the probabilistic analysis of turbine missile hazard and presents a formulation for processing this infor-mation to obtain the probability of a specified damage state of the plant. A simulation model, which permits the damage probabilities to be estimated by using a realistic and detailed model of the plant and the missile transport phenomenon, is described.

C.2.2 Turbine Missile Generation The information used to determine the likely sources of turbine misciles and their probabilities of generation is derived from reports prepared by the turbine manufacturer. Each unit of the Byron /Braidwood Stations is equipped with one high-pressure (HP) and three low-pressure (LP) turbine units manufac-tured by Westinghouse Electric Corporation (herein called

, Westinghou se) . Each LP unit,has 12 discs, which are shrunk-fit onto the LP rotor. The HP unit, on the other hand, has a forged single-piece rotor (Reference 2) . As will be shown, this construction provides a basis for ruling out the HP unit as a potential source of missiles. Missile generation, therefore, refers to a process in which a single LP disc ruptures, and pieces of the ruptured disc perforate the turbine casing and become missiles. The perforation of the turbine casing gives rise to other missiles called associated fragments.

According to the turbine manufacturer (Reference 2), the rupture of LP discs or an HP cylinder may occur at one of three speed conditions: rated speed, design overspeed, or destructive overspeed. The rated speed for nuclear turbines is 1800 rpm.

The design overspeed is 120% of the rated speed; the destructive overspeed is 135% of the rated speed. When a disc fails under any of these speed conditions, it is assumed that the damage to the turbine which results from the rupture of a single l I

disc will prevent any further acceleration of the turbine or subsequent rupture of other discs.

The design overspeed condition can occur if, at the maximum generator load, the generator separate!, from the system and the speed governing mechanism fails simultaneously. In such an event, the turbine reaches about 120% of the rated speed, and is then stopped by the overspeed trip mechanism. Turbine rotors are designed for this overspeed condition.

The destructive overspeed condition can occur if, upon loss of the maximum generator load, the speed governing and trip C.2-1 4

y -s.iw-- ---w -- --rw, , . , . . , w .-- r- r-------v. -r --v---y -r & w- .-- - - - .a -y------

., B/B-FSAR r .

mechanisms fail in succession and steam continues to be fed to the turbine. Under this accelerating turbine condition, the tangential stress in one of the rotating parts eventually reaches its in-place rupture strength, causing the element to fail as a result of ductile burst. This occurs only in the case of the LP discs; it is shown in References 2 and

.3 that the HP unit is strong enough to prevent it from failing due to ductile burst before LP disc failure occurs. Therefore, missile generation from an HP cylinder at destructive overspeed l 1s not postulated. .

The two recognized rupture mechanisms under the rated and the design overspeed conditions are stress corrosion and fatigue (Reference 4). Stress corrosion has been observed in some keyways and bores of the LP discs. Because of its forged single-piece construction, the HP rotor is not expected to rupture due to stress corrosion. Thus, the LP units are the only potential sources of missiles under stress corrosion failure.

Fatigue crack growth resulting from speed cycling can occur in both LP and HP units. However, comparisons have i'ndicated that the probability per year of missile generation due to stress corrosion could be several orders of magnitude greater than that due to fatigue. Therefore, under the rated speed and the design overspeed conditions, stress corrosi.on is the

. probable cause of disc rupture. Since the potential for failure due to. fatigue is so small and the rupture of an EP unit due l to stress corrosion has been ruled out, the LP discs are the only potential sources of missile generation under the rated speed and the design overspeed conditions.

The estimates of the probability of missile generation per year for the LP units at Byron Unit 1 were obtained from References l 5 and 6. The values of the frequency of missile generation, I f i (wq ,At), are given in Table C.2-1. The symbol w , i = 1,2,2, r6fers to the rated speed, design overspeed, and des;tructive overspeed conditions, respectively. The symbol at identifies a preselected turbine inspection time in terms of turbine operation time since the last inspection. It should be noted in Table C.2-1 that f is dependent on the turbine inspection  ;

time for the rated spbed and the design overspeed conditions, '

but is independent of At for the destructive overspeed conditien.

I As indicated above, the discs of the LP units are the only credible sources of missiles. It is assumed that all discs are equally likely to rupture under the destructive overspeed condition, and the value of f of one of the 36 discs becomikg(w3, At) equals a missile the frequency source.

l l

O C.2-2

.. - .3,

- . - . +

, B/B-FSAR (

Examinations of the rupture frequencies of individual discs at the rated speed and design overspeed conditions show that l not all discs are equally likely to generate missiles. Type 2 discs are most likely to rupture at the rated speed condition, while Type 2 and Type 3 discs are likely to rupture at design overspeed. Table C.2-2 compares the values of f (w3 , at) of six Type 3 discs with the f y (u at values of 36 discs of Unit 1 at rated speed. Askmilkr,com)parisonismadewith the design overspeed condition. The missile characteristics of six Type 3 discs were used in the simulation model for rated speed, and the characteristics of 12 Type 2 and Type 3 discs were used for design overspeed, since these types

~ contribute most to the total frequency of missile generation I (Table C. 2-2) . For conservatism, however, the corresponding values of f y for all 36 discs were used in the calculations.

C.2.3 Missile Characteristics Based on the potential for distributed bore cracks and on field experience, an LP disc rupture may result in major seg-ments (hub-to-rim fractures) varying in size from 30* to approx-imately 200* (Reference 2). This implies that 90', 120',

and 180* segments are likely to result from a disc failure.

Westinghouse's assessment indicates that the 90' and the 120' disc segments are reasonable approximations because these missiles will have the greatest exit energy. The missile characteristics used in this report are based on 90' disc segments (Figure C.2-2).

When a disc ruptures into quarters, the impact with stationary parts of the turbine results in several other fragments with varying exit velocities and shapes. The fractured segments of the disc and'the associated fragments become missiles upon exiting the turbine housing.

Each 90* disc segment of a given disc type is assumed to produce the same number of fragments, each having similar characteristics.

Table C.2-3 lists the characteristics of discs and fragments used in the simulation model for each disc type at the rated speed, design overspeed, and destructive overspeed conditions.

The values for these parameters are provided by Westinghouse l in Reference 2.

In probabilistic evaluations, exit velocity is treated as a random variable. A uniform distribution is used for missile velocities ranging from -10% to +10% of the tabulated best estimate. .

C.2-3 l

. ~ _ . . _ - _.. - _.. _. _ - . _ ._ . _ _

,, B/B-FSAR After a missile exits the turbine, it may impact various floors and walls of the plant. The impact area of'each missile at each impact is assumed to be uniformly distributed between the minimum and maximum impact areas, as shown in the table.

The assumption of an independent random variable at each impact also the plant. accounts for the rotational motion of the missile within It can be seen in Table C.2-3 that the minimum and maximum impact areas at the rated speed and the design overspeed differ from those at the destructive overspeed.

The initial direction of the missile at the time of ejection is defined by two random angles, O y and 0 O is the vertical angle measured from the vertical disc and e s is the deflection angle measured from the plane axis in tNe. p15no of the of the dis'. d For the disc in the first quadrant, O is assumed to be a random variable with a range of 0* to 90*. VFor discs in the remaining ouadrants, O y is established by adding 90*

to the B y for the disc in the preceding quadrant. This implies that only one random variable is required to define O y for all disc segments.

The vertical angles for all the fragments are selected randomly within the respective quadrants. Figure C.2-2 schematically represents the vertical angles for the discs and the fragments. l The range of deflection angles for the discs and the fragments was obtained from Reference 2. For each LP unit, the O 's for the inner discs and fragments vary from -5* to +5*;h for

" -5*,

outer fragments, eh varies from 5* to 25' (or from -25' to as applicable 7 in Figure C.2-3. Within These angles are shown schematically the specified range, all values of l the random variable under discussion are considered equally likely; therefore, a uniform density function is used to define the probability law of exit angles.

C.2.4 Frecuency of a Plant Damage State '

Let C denote a plant damage state such as the loss of cold shutdown level.

capability or a radiological release of a certain Precise expressions for C in terms of various equipment failures are defined from the plant logic. On the assumption that turbine missile generation can occur at any of the three speed conditions u.

i = 1 2,3, and using the theorem of total probability, the fhe,quency,of this damage may be expressed as:

3 f(C, At) =

}[ f2 IC!"i) f l i=1 I"1, At) (C.2-1)

C.2-4 '

l 9 .

.. B/B-FSAR in which f (c ,at) = frequency of damage state c per year for a selected inspection time At.

ft (wg ,a t) = frequency of missile generation per year at speed condition wg and inspection time At.

f 2 IC !"i) = conditional frequency of damage state q, given missile generation at speed con-dition wg.

For this report, at measures accumulated turbine operating l time since last inspection.

Using plant logic, c may be expressed as m

C "

UC3 (C.2-2) l j=1 where g = minimal cut sets of the G -fault tree

= operation of union on events q).

j=1 From Equation C.2-2, the following expression can be established:

m f

2 I'!"i I I j=1 f

2 ICj !"i) (C.2-3)

The conditional frequencies f are estimated by a simulation process in which missil'e!"i) 2 IG s are generated and traced through the plant spaces as described in Subsection C.2.5.

f is With calculated these conditional frequencies using Equation C.2-3. available,Then, thetion eva$ua(C of lu,)

the frequency of the damage state can be evaluated using Equatien C.2-1 and the data given in Table C.2-1. Because Equation C.2-3 presents the upper bound of f estimate of damage state freq3en(cted)is conservative. Clw. , it follows that the C.2-5

.. . .... - ~ . - . . . .. . .-

B/B-FSAR C.2.5 Simulation of Conditional Frecuency of Damage States The simulation model for determining the conditional frequencies f

2 I'j !"i) inv lves the following items,

a. Targets representing plant spaces in which safety-  !

related equipment, including cabling and piping, are located. These targets are considered prisms; for conservatism, it is assumed that they offer no resistance to a missile strike.

b. Barriers representing reinforced concrete walls

' and slabs, and in a few cases steel components, are modeled as planes at appropriate locations.

The CEA-EDF formula (Reference 7), which provides better correlation to data for reinforced concrete perforation by solid missiles (Reference 8), is used in the analysis. It is expressed as vp = 1.43t f,1/2(d/w)2/3 (C.2-4)

The BRL formula (Reference 8) is used for steel barrier, i.e.,

V = 1058.56kl/2 (dt) 3/4,-1/2 (C.2-5)

P where V

p = perforation velocity, fps

.t = concrete barrier thickness, inches f' = concrete compressive strength, psi' d = missile diameter, inches w = missile weight, lbs k = constant (usually equal to 1) for Equation C.2-5.

c. Missile sources, i.e., the LP dises, are generated depending on the speed condition u. selected.

Missile weights are treated as detdrministic quan-titles; exit speeds and angles are treated as random variablec, as described in Subsection C.2.2.

C.2-6 e

1 B/B-FSAR More details on the physical modeling of targets, barriers, and missile sources used for the Byron /Braidwocd Stations are given in Section C.3. Using plant logic, a fault tree is constructed for the damage state under consideration.

The basic events of this tree are the targets of the physical plant model. The minimal cut sets of the C-fault tree indicate which specific combination of plant spaces must be damaged in order to induce a certain undesirable event as defined in NRC Regulatory Guide 1.115; for instance, excessive offsite releases. Section C.4 provides details on the fault trees constructed for the Byron /Braidwood Stations.

To complete the description of the simulation model, the steps followed for one simulation trial at a particular speed condition are listed below. These steps are executed by the S&L program SIMULATE (Reference 9).

1. From the missile sources applicable to the selected speed condition w , a disc is selected at random and is assumed tobreakinkofourpieces. The associated fragments pertinent to the selected disc type are determined from Table C.2-3. Exit speeds'and directions of the missiles are then sampled from the applicable distributions of V,0,, and Oh described in Subsection C.7.3.

2. The possible missiles generated from the disc are then ejected, and their trajectories are traced. The governing equations of the trajectories depend on whether they are high or low. A high-trajectory missile enters the plant I complex on its downward flight. A low-trajectory missile enters the plant directly af ter exiting the turbine housing. l

. For low-trajectory missiles, gravity and air resistance are ignored, which implies that they follow a straight I line trajectory. For high trajectory missiles, the'effect of gravity is considered, but vir resistance is ignored.

After the type of trajectory is determined, the path of the missile from the selected disc is traced to determine what it hits first. If a barrier is hit, its capability to resist perforation is examined against missile impact in terms of velocities. If the missile perforates the l barrier, its residual velocity is calculated and the trajec-tory is trreed further. If the misulle is unable to per-  !

forate the barrier, two possibilities are considered:

a. embedment of the missile in the barrier, and

b. missile rebound (ricochet) .

C.2-7 l

. B/B-FSAR The angle.of incidence is the most sign'ificant parameter in determining the route the missile will take. If the angle of incidence (angle between the line of the missile t

trajectory and the normal to the barrier plane) is greater than 45*, it is highly probable

?. hat the missile will l be reflected (Reference 10). Since there are virtually no data on the embedment behavior of irregularly shaped missiles at various angles of incidence to the concrete, an angle of 15' is selected for determining the possibility l

! of ricochet. If the angl: of incidence is less than 15*,

i it is assumed that the missile embeds in the concrete; l the path of such a missile is not traced further. If the angle of incidence is greater than 15*, ricochet is considered; the missile is assumed to continue its flight with reduced velocity and a new initial angle.

If the missile hits a target, information such as the target name, the missile weight, and the energy with which l the target is hit is stored in a data file for future processing. It is assumed that a missile which hits a target continues its flight with the same speed and direction, i.e., the loss of energy during impact is ignored.

3. Steps 1 and 2 are repeated a predetermined _ number of times (N=1000) and information regarding the hit targets is stored. .

t

4. The information created in Item 3 is condensed by eliminating I those targets which are hit repeatedly in a single trial.

Repeated hits of a target during a trial can occur either because the same missile ricochets or because different l

-. . fragment missiles hit the same target during the trial.

The condensation process considers all of these as a single hit.

5.

WLetnkstandforthenumberoftinesatsceedcondition thk the target hits defining C are realized in the ~

cbndensed list. Thentheconditiobalfrecuencyisexpressed as:

f 2 (5j !"i) 11, i = 1,2,3; j = 1,2,...,m (C.2-6)

N C.2-8

[

3 i

TABLE C.2-1 . j l

g FREQUENCY OF MISSIT.E GENERATION PER YEAR FOR BYRON UNIT 1 TURBINE j i

INSPECTION INTERVAL IN TERMS OF TURBINE OPERATING TIME g '( '

(at in YEARS) I )

SPEED "i 1 2 3 4 5 10 [.

. l M

1  ;:

Rated j' speed er s l,

," Y  !.

M w [;

O *2 5 1

• I

! Design

, Overspeed  ;

1 ,

"3  !

Destructive  ;

Overspeed 1.70x10-6 1.70x10-6 1.70x10-6 1.70x10-6 1.70x10-6 1.70x10-6 ,<

a I

E:

I',

NOTE: The values contained in this table are Westinghouse proprietary information.  !

values for m3 and "2 are taken from Reference 5, and the value for v3 is ,

taken from R0ference 6.

i A

~

TABLE C.2-2  ;

CONTRIBUTION OF DISC TYPES 2 AND 3 TO TOTAL FREQUENCY f

, OF_ MISSILE GENERATION, fy, DUE TO STRESS CORROSION -

f TURBINE N SPM DESIGN MMPm  ;

INSPECTION f f f f -

INTERVAL (6DkSCS (36DkSCS/ DISC 3 x100 Q2DIdCSOP (36DkSCS/ DISCS 2G3  !

_(At in YEARS) OF TYPE 3) UNIT 1) UNIT 1 TYPES 2 & 3) UNIT 1) UNIT 1 x100 l j

. n i;

1 I; w '

N O

W q w 2 4  ;

i m  :

w >

w w t, 3 ,{

t li

. 4 1 i

i ,k i 5 l[

!  !?

e 10 i li li n

TABLE C.2-3

?

MISSILE CHARACTERISTICS FOR BYRON /BRAIDWOOD STATIONS  :

l  ;

RATED SPEED DESIGN OVERSPEED DESTRUCTIVE OVERSPEED  ;

A DISC AND VNIGHT Vel mn max mn max mn max Vel Vel FRAGMENTS lbs ft/sec ft ft 2 ft/sec ft ft ft/sec ft ft 1 3095 NA NA NA NA NA NA 75 1.49 5.65 i 1.1 5400 NA NA NA NA NA 75 NA 1.47 12.99 1.2 3740 NA NA NA NA NA NA 75 0.80 9.66 1.3 380 NA NA NA NA NA NA

• 0.09 2.66  ;

1.4 270 NA NA NA NA NA

• NA 0.05 11.04 P , l w ;r  !

J, 2 3500 NA NA NA 120 1.62 5.26 417 i  !

" 1.62 5.26 g  !

2.1 2555 NA NA NA 120 0.74 7.20 417 0.74 7.20 y 2.2 350 NA NA NA

• 0.09 2.46 417 0.09 2.46 i 2.3 3295 NA NA NA 120 0.94 8.51 417 f 0.94 ,8.51 e 2.4 1640 NA NA NA 120 7.32 0.39 417 0.39 7.32 2.5 250 NA NA NA

• 0.05 10.24 417

, 0.05 10.24 i l

3 4225 195 1.87 6.57 278 6.57 i 1.87 533 1.87 6.57 3.1 2395 161 0.71 8.16 226 0.71 8.16 427 0.71 8.16 {

3.2 1010 161 0.26 4.50 226 0.26 427 4.50 0.26 4.50 {

3.3 3435 195 0.96 11.86 278 0.96 11.86 533 0.96 11.86 j 3.4 1540 195 0.37 6.87 270 6.87 0.37 533 0.37 6.87

TABLE C.2-3 (Cont'd) '.

i.

I i

RATED SPEED DESIGN OVERSPEED DESTRUCTIVE OVERSPEED DISC AND WEIGHT Vel mn max mn max *" ""*

' Vel Vel FRAGMENTS lbs ft/sec ft ft ft/sec ft ft ft/sec ft ft '

f, 3380 4 NA NA NA NA NA NA 852 1,46 3.39  !.

4.1 770 NA NA NA NA  !

NA NA 825 0.23 4.11 {.

4.2 640 NA NA NA NA NA NA 558

[ 0.36 2.85 5 3465 NA NA NA NA NA 578 1.49 NA 3.64 5.1 1255 NA NA NA NA NA NA 578 0.39 5.59 5.2 1465 NA NA NA NA NA NA 578 0.43 6.31 5, P 5.3 200 NA NA NA NA n NA NA 610 0.05 7.05 Y

d. 5.4 340 NA NA NA NA t

NA 578 0.09 $

w NA 6.94

{

6 3720 NA NA NA NA NA i'

NA 707 1.89 4.35 f 6.1 780 NA NA NA NA NA , NA 707 0.28 .4.91 i

6.2 50 NA NA NA NA NA NA 707 0.02 0.91 f

l NOTE: -

t NA = Not applicable for negligible f y values (Subsection C.2.2).

= According to Reference 2 (Section C.2), missile energy less than 105 ft-lb is not reported. l

, B/B-FSAR C.3 PLANT MODEL FOR THE SIMULATION C.3.1 General The physical model of the entire plant complex is described I in this section. The plant model is used for simulating turbine missile trajectories through the plant. The physical plant model includes a detailed description of targets and barriers.

The targets represent the safe shutdown equipment or reactor ,

coolant system components, and the barriers represent the various structural elements, such as concrete walls and slabs, that resist missile penetration.

C.3.2 Targets ,

Targets are usually those safety-related structures, equipment, and components whose destruction or malfunction is detrimental to the safe (cold) shutdown or results in a LOCA of the plant.

The detailed modeling of every target in the plant is not l practical because it involves enormous amounts of physical effort and computer time. To simplify the modeling effort, .

large cubicles are used to define the targets. The boundaries of these cubicles are mainly based on the zones defined for the isolation of fire hazard. These zones usually extend from the floor to the ceiling and are bounded by the reinforced concrete walls and slabs. A target is thus assumed to be the volume occupied by the zone. A zone may actually house one or more safety-related components or equipment. With this definition of target it is assumed that once a missile perforates the boundary of a zone, the equipment or components located inside are damaged. This is a conservctive assumption and it also addresres efficiently the problem of secondary missiles that might be ejected as a result of the primary missile's impact on reinforced concrete walls. The system fault tree constructed for plant damage states (Section C.4) is in agreement with this definition of targets.

The fire zones used in this report are taken from the Fire l

Protection Report for Byron /Braidwood Stations (Reference 11  !

Table C.3-1 lists only those fire zones which are pertinent to the turbine missile hazard analysis. All the targets listed herein are not necessarily taken from Reference 1; the excep-tions are thote within the containment identified in Table C.3-1 as targets 1.1 through 1.4.3. This addition of targets was necessary because of the refinement required by plant log ic. The target sizes used, however, are conservative and l allow for physical sizes of actual missiles. The analysis I

of the crane damage due to the turbine missile strike shows that there is a potential for the crane girder to collapse C.3-1 l

l

i I

B/B-FSAR  !

l onto reactor coolant system components. For this reason,  !

the crane girder is listed as target 1.4.3 in Table C,3-1.

In modeling the crane girder, it was assumed that the crane is parked in the north-south direction.

A number of targets outside of the plant structures were also considered in the study because of plant logic consideration.

These are identified in Table C.3-1 as targets 0-1 through 0-4. Figures C.3-1 through C.3-10 show the location of the targets within the plant structures.

C.3.3 Barriers Barriers are those objects in the plant complex which offer resistance to turbine missile penetration. For conservatism  !

and ease in modeling, only reinforced concrete walls and slabs having thicknesses greater than or equal to 6 inches are con-sidered in the plant model. Other objects, like piping, valves, tanks, etc., have been assumed to offer no resistance to missiles, i

and to be unable to alter the missile path. The moisture

! separators and part of the steam generators, however, are 1 modeled as steel barriers. There idealizations are shown in Figure C.3-1. Precast concrete roof slabs, sidings, gratings and all the blockwalls are neglected. Being closer to the source of the missiles, the turbinet pedestal concrete girders are idealized as two barriers. These girders run parallel to the run of the turbine shaft. Most of the missiles ejected

.in the second quadrant are intercepted by these massive girders and thus reduce the chances of missiles hitting the targets in the auxiliary building.

The moisture separators are located on the main floor (elevation 451 feet 0 inch) of the turbine building on either side of the turbine. They are modeled as 1-1/2 inch thick steel barriers.

l These barriers help stop some of the mi?siles from entering the auxiliary building.

Since missile strike damage to the upper. portion of the steam l generators (above elevation 426 feet 0 inch) would not cause a LOCA, the steam generators are modeled as targets up to l elevation 426 feet 0 inch and as steel barriers for their upper portions.

For reinforced concrete barriers the values of concrete com-pressive strength, ff, used in the analysis are 5000 psi in the containment buil' ding and 3500 psi elsewhere. Since these values are design values and are less than that for aged-in-place concrete, the values are conservative.

l C.3-2 i

l  : .

1 .

B/B-FSAR C.3.4 Turbine Model The locations of three low-pressure turbines in the model -

are shown in Figure C.3-1. These units are identical and symmetrical about the axial center point. The number of discs and their relative locations along the shaft are modeled and shown in Figure C.2-1. These locations then serve as the initial points of ejection of the missiles. The turbine shaft is 4 feet 6 inches above the turbine main floor (elevation 451 feet 0 inch). For destructive overspeed, all 36 discs are modeled as missile sources. For the design overspeed, Types 2 and 3 discs (total of 12 discs) are used as missile sources. For the rated speed condition, only Type 3 discs (total of six discs) are modeled. The reason for this choice is given in Subsection C.2.2 and Table C.2-1.

l C.3.5 Reference

1. Byron /Brai^ wood Stations Fire Protection Report, Vol. 1, Commonwealth Edison Company, October 1977.

e e C.3-3

D/B-FSAR

~

TABLE C.3-1 (Cont'd)

TARGET IDENTIFICATION DESCRIPTION 1.4.1 Control Rod Drive Mechanism Housing 1.4.2 Pressurizer 1.4.3 Polar Crane 2.1-0 Control Room 3.1-1 Cable Tunnel 3.2A-1 Nonsegregated Bus Duct Area 3.2B-1 Lower Cable Spreading Room, Zone B-1 3.2C-1 Lower Cable Spreading Room, Zone C-1 3.2D-1 Lower Cable Spreading Room, Zone D-1 3.2E-1 Division 12 Cable Riser, Lower Spreading Room 3.3A-1 Upper Cable Spreading Room, Zone A-1 3.3B-1 Upper Cable Spreading Room, Zone B-1

~

3.3C-1 Upper Cable Spreading Room, Zone C-1 3.3D-1 Upper Cable Spreading Room, Zone D-1 3.4A-1 Division 12 Cable Riser Area (Elevation 451 feet 0 inches) 4.4-1 Computer Room 5.1-1 ESF Switchgear Room, Division 12 5.2-1 ESF Switchgear Room, Division 11 5.4-1 Miscellaneous Electrical Equipment and Battery Room, Division 12 5.5-1 Auxiliary Electrical Equipment Room (Contains  !

Electrical Panels and HVAC Equipment) 5.6-1 Miscellaneous Electrical Equipment and Battery Room, Division 11 9.1-1 Diesel-Generator Room, 1B C.3-5 -

, B/B-FSAR -

TABLE C.3-1 (Cont'd)

TARGET IDENTIFICATION DESCRIPTION 11.3C-1 Centrifugal Charging Pump 1B Room 11.3-1 Auxiliary Building, Unit 1 Area (Elevation 364 feet 0 inches) 11.4-0 Auxiliary Building General Area (Elevation 383 feet 0 inches) 11.4A-1 Auxiliary Feedwater Pump Diesel Room 11.4C-0 Radwaste and Remote Shutdown Control Room 11.5-0 Auxiliary Building ventilation System, Boric Acid Tank, Filters, Transfer Pumps, etc. l (Elevation 401 feet 0 inches) ll.5A-1 Containment Electrical Penetration Area, Division 11 (Elevation 414 feet 0 inches) 11.6-0 Auxiliary Building Ventilation System, Boron Injection Recirculation Pumps, Surge Tanks, Cable and Panels, etc.

(Elevation 426 feet 0 inches)

~

i ll.6A-1 Boron Injection Piping 11.6-1 Electrical Penetrations Area, Division 12 11.7-0 Auxiliary Building HVAC Exhaust Complex 17.2-1 Essential Service Water Cooling Tower, Unit 1 1

Essential Service Water Cooline Tower,

) 17.2-2 i Unit 2 18.1-1 Diesel-Generator IB and Switchgear Room Air Shaft 18.2-1 Diesel-Generator lA and Switchgear Room Air Shaft i

18.3-1 Main Steam and Auxiliary Feedwater Pipe Tunnel l

1 C.3-7

,, , .. ., . . * - * * + - *

. B/B-FSAR C.4 FAULT TREE FOR PLANT DAMAGE STATES C.4.1 General I

In previous sections, the turbine missile generation mechanisms l and frequencies, and the structural plant model through which simulated missile trajectories and structural penetrations occur were discussed. In the following, the consequences of turbine missiles impacting various plant equipment and initiating an accident is examined.

In this analysis, fault trees are developed to determine the sequence of failure of plant co.Tponents from turbine missile impact that could lead to accidents beyond the current design basis as defined in Regulatory Guide 1.115. These accidents l referred to as damage states in this report are summarized in Table C.4-1. The relationship of our definitions to the specific criteria given by Regulatory Guide 1.115 is also presented in this table. Fault trees also include the failure of various components required to mitigate accidents to start on demand. Minimal cut sets of the developed trees are used in Section C.5 to quantify the probability of the plant damage states.

C.4.2 Damace States C and M ,

! . A turbine missile could initiate many plant events. While i the exact sequence of events can become quite involved, only I

a limited number of key functions must be examined to ask l the questions necessary for determining if the consequences j

would be beyond the results considered in the plant design basis. When the disc ruptures to form the missile, the turbine will trip. After the turbine trip, two accident scenarios can be identified which would be more severe than the d,esign basis. The first scenario, designated as C, involves missiles penetrating containment and striking components and/or subsystems within containment. This is assumed to result in a LOCA.

The additional element in C involves the opening left in the containment wall created by the turbine missile. This would l prevent complete containment of the LOCA which is beyond design l basis. For this analysis, a LOCA will be assumed when any l single component or system within the containment is struck by a missile. This is a very conserva'.ive assumption, as a single component failure inside the containment (such as a RCFC or main steamline) does not necessarily result in a LOCA.

The second scenario involves missiles striking plant components outside of containment resulting in loss-of-hot-shutdown capa-

! bility, but in response to the requirements of Regulatory 1

C.4-1 l . . .

., B/B-FSAR Guide 1.115, this scenario will also address loss-of-cold-shutdown capability and is designated as M. Thus, for this analysis, an accident'beyond design basis is assumed if M or C occurs.

The plant logic for M and C is presented by means of a fault tree. The master f ault tree is given in Figure C.4-1. Further branch expansions for M are shown in Figures C.4-2 through .

C.4-14. The branch for C is shown in Figure C.4-2, and it simply consists of the 20 components / equipment listed as con-tainment targets 1.1 through 1.4.3 in Table C.3-1. Each event in the fault tree represents an important plant component or components, the failure of which is assumed to result in failure to achieve cold shutdown or LOCA.

The circle below each event in the fault trees represents

' the space designation in which one or more of those components I are located or through which cabling or piping are routed.

Turbine missile entry into a seace is assumed to result in failure of all components in that space. The symboltCirepresents I an OR condition whereby the f ailure of any event in the branch i would result in failure of the branch. The symbol ([) indicates l l an AND condition such that all events immediately below the

branch must fail in order for the branch.to have failed.

l In this way, the fault tree can be interpreted as indicating the space combinations which, if penetrated by a turbine missile,

. will lend to M or C. This assumption is conservative because, in most cases, the components of interest do not consume the entire space in which they are located, and a missile entering the space may not necessarily impact the component. In addition, failure of the components may not necessarily result in the assumed accident.

It is noted that operator interdiction is not included in the fault tree. This is a conservative assumption as including recovery actions would result in lower failure frequencies.

It has been shown in Reference 1, that for certain components, failure to start on demand is significant, thus, this is included in the fault tree where appropriate. Table C.4-2 lists the median frequency and assessed range of these special conditions.

l Before proceeding, it is important to roote some points in the fault tree logic. It is assumed that for the large Pumps, failure of the control room or DC power does not mean failure to start or stop the pumps. The switchgears for these pumps can be operated mechanically. Also, it is again pointed out that conservatism is involved when the containment is breached.

C.4-2 a

.. - . . - . . . . . ~ . . . ~ . . .. .- -

, B/B-FSAR To realistically create a situation leading

• to M or C, primary and secondary (backup) systems within the containment would need to be damaged simultaneously. In this analysis, it is assumed that any single compenent or system damaged inside containment constitutes an accident beyond the design basis.

It is necessary to use the fault tree as a basis for identifying the space combinations which, if penetrated, will lead to M or C. The computer program SLRAS (Reference 2) was used for this purpose. From the fault tree and all of its branches, the minimal cut sets, or minimum failure event paths which lead to the undesirable event were identified. Each of these minimal cut sets is identified as q$ in Subsection C.2.4.

From the analysis of Figures C.4-3 through C.4-14, Table C.4-3 is obtained. This table lists the minimal cut sets leading to the damage state defined as loss-of-cold-shutdown capability (M).

Table C.4-3 includes all the ettt sets with two or less space hits; cut sets with more than two events have not been included because the event of ont missile penetrating three zones is not realized according to discussion in Section C.S.

For C, each of the components represents a minimal cut set, and a computer analysis of the C-fault tree is not necessary. l

, C.4.3 Damage State R It is conservatively assumed that any breach of containment or loss-of-cold-shutdown capability could also result in a radiological release. The Boolean expression for the occurrence of this damage state can be written ,as:

R= CUM (C.4-1)

Thus for this analysis, there is only one offsite release and it is assumed to be the worst case scenario. l C.4.4 References

1. N. J. McCormick, " Reliability and Risk Analysis - Methods and Nuclear Power Applications," Academic Press, New York, 1981.

2. Sargent & Lundy Computer Program, Program No. 09.7.203.

C.4-3 1

)

l .

TABLE C.4-1 DEFINITION OF DAMAGE STATES AND THEIR RELATION TO NRC REGULATORY GUIDE 1.115 CRITERIA DAMAGE STATE NRC REGULATORY GUIDE (C) DEFINITION 1.115 CRITERION C Damage of reactor coolant Damage of the integrity of the reactor system components coolant pressure boundary w

n M Loss of cold shutdown

. Capability Loss of the capability to shut down the. D reactor and maintain it in a cold shut- 4 i down condition g R Excessive offsite releases Loss of the capability to prevent acci- i (R = C U M) dents that could result in potential  ;

offsite exposures that are a significant  !  ;

fraction of.the guideline exposures of  ;

10 CFR Part 100, " Reactor Site Criteria." ,

I e

P 4

. toss Or PUMPING .

(C11ARCINC) ,

3

=

FIGURE C.4-6: LOSS OF CHARGING >

LOSS Or IDSS OF DIVISION 11 -

DIVISION 12 ,

e PU?tPING PUMPING T T ' '

I eAl*,,* gar or goss or rAII.URC 0:' CD P:Pl?:C TR71 CO?:;2CL GR p p p' T CO L OR PU't? PUXP TO P2 PING TPO*t O R*:S; TO TL :P pot?ER CONTAIN!!ENT POWER CO::TAl?:xtNT ,. DST M P D*P Z '

f 11.3D-1 11.3G-1 ,

P T m -s m + '

WS Or IDSS Or - f 1.3-1 jf 11. 3:? .. LOSS Or Lg33 g7 11.3r-1 CONTROt. 11.3A-1 11.3 1 coNypog 11.3G-1 11.3-1 11.3G-1 11.3-1 11.3r.1  ;

(St:tTCliccant (swgTeriGtA3 3 5.2-1

() 5.1-1 () -  ;

~

T T , .

FAILtRE or LOSS if OF

• IDSS OF IDSS OF AC Pot': Eft DIVISI6 11 SWITCTICEAR SWITCHGEAR e CAD'.,ES TO l'OfP AC POtfER. AC POWER CABLES TG PLDtP A A S i ,

A --

A S.1-,

n . ,,

1.2-1 11.3-1 (11.3-o

11. e-i li.4-o 11.s-o n.c-o 3.2A-1 11.3-1 11.3c-1 11.sA-1 11a-1 s.t.1 t

e

• 1D55 OF

• PUMPING (SAFETY INJ.)

i 4\ [ FIGURE C.4-7: LOSS OF SAFETY INJECTION I

IDSS OF . LOSS OF , .

DIVISION 11 MVISIOtt 12

, , PU** PING t

.Pl.NPING '

n v FAILURE OF LOSS OF LOSS OF FAILURE OF FAILURE OF P F OM FAILURE OF l ,* F PIPING FROM CONTROL OR pyp PUI4P TO CONTROL PIPI*:G FROM pnp ;o p ,p RWST TO PUMP POWER , CONTAINMCNT gg pgggg CQ:;TA!!2 C;T pyg7 99 pygp I*

. II,3n-1 11.3F-1 11.3F-1 I q rm T m T l LOSS OF- IDSS OF IDSS OF LOSS OF .

11.3F-1 ]. 11.3-1 11.34-1 Cox;not 11.3A-1 11.3-l' ' CONTROL, gg*37,*. g3,3.g POWER , g,gg (Sed!!CHOCAR) (SWITCflGCAR) 5.2-1

• 5.1-1 rAILURE OF LOSS OF LOSS OF FAILURE OF IDSS OF  : DSS OF

.sC Pct 4ER DIVISION 11 gyg g gggg DIVISION 12 AC POWER SWITCMCEAR CA*1 CS TO PU!!P AC POWER . / AC POWER CABLES TO PUMP l 6 5.2-1 5.1-1

., 7%

5.2-1 11*6-0 11*5-0 11.4-0 11.3-0 11.3-1 gg,3A.t 5.1-1 3.2A-1 11.6-1 11.5A-1 11.3-1 l 11.2F-1

~

NN Mp.g ^ w, geg .pw - A g,g, , , , ,

=

e Loss or 6 -.

SEnVICE

[ UATER *

/s\f)

T '

• IDSS Or . , ,

BUnit:D IDSS OP. ,

SW PIPING PUMPING -

k%

. I r r

.tp 1455 Or LOSS or

• W l 0-2 j 0-3 } DIVISION 11 g DIVISION 12 PUMPING PUMP!NG k

D p

(S

= .

m I

I

-s -

~ I _t ross or AC I i ,

t.oss or Loss or '"S8 ' i 1 .

PCWIft CADLt3 soss or loss or toss or Ac ross or

.> UMP SW1TCitCEAR DIVISION 11 5%f TO PUMP PUPIP fWITClfCEAR R CABI.ES DIVISICM 12 sw .

COOT.ING' TOWER TO PU.'!P COOCING MlCA .

~

11.1-1 ) 5.2-1

• l 17.2-1 11.1-2 5.1-1

-m 17.2-2 l l

.-w '

mn 5.2-1 j 6'11.5-0lj(11.50 11.4-0 l{ 11.3-0 11.2-0 11.1-1 5.1-L 3.1-1 6

{ }j i 11.5-0 11.4-0 ) 11.3-0 11.3-0 l l 18.1 2

• d PIGUllE C.4-8 LOSS OF SERVICE WATE11 *

• _ _ _ _ _ _ _ _ . . _ _ _ . _ _ . _ _ . _ _ . _ _ _ _ ~ ._. _ . _ .

l B/B-FSAR i ,

q C.5 PRESENTATION AND DISCUSSION OF RESULTS j C.5.1 General This section discusses the manner in which formulation in  !

Section C.2, plant model in Section C.3, and plant logic in Section C.4 were used to identify contributors to turbine l l missile risk in the Byron /Braidwood Stations. Conservative l

evaluations have been made throughout the analysis. Results l

indicate that a practical turbine inspection time can be deter-mined with an acceptably small risk of turbine missile hazard. l C.5.2 Conditional Frecuencies of Damage States l It is shown in Equation C.2-3 that the conditional frequency of a certain damage state C at speed condition o g is less l m than the frequency given by the expresion }[ f 2 ICj!"i}*

j=1 The quantities f 2 (C at speed condition w4 are estimated by the simulation prd'c!"i) ess for the specific minimal cut sets c4 of each damage state due to turbine missile hazards as ddfined in Table C.4-1.

l For each speed condition w , results from 1000 simulation trials were sorted to calchlate the required conditional frequencies. Table C.5-1 shows the calculated conditional frequencies f f and l the three dam $ge(c.lw )

Stakes.orthethreespeedconditionsw.The contributing targets to eAch frequency and their percent contributions are also identified in this table.

The main contributors to damage state C are failures of the l steam generator (target 1.3. 3) , the containment spray rain i riser (target 1.2.lY), and the main steam and feedwate: piping I (target 1.3.lA). Damage to the spray riser and main ; team l and feedwater piping would not actually result in ei'.her a LOCA or failure to attain cold shutdown conditions, but were l included because of their safety functions. It is expected that a more detailed analysis could significantly reduce the contribution of these targets.

It is noted that damage state C is realized only under the design overspeed and the destructive cierspeed conditions.

This indicates that no missile would be able to damage any l of the specified containment targets at the rated speed condition.

Damage state M is realized under all the three speed conditions.

The main contributors to this damage state are:

a. failure of essential service water and condensate storage pipings (target 0-2).

C.5-1 t

I

B/B-FSAR

b. failure of electrical panels and HVAC equipment (target 5.5.1). This target contributes only at the destructive overspeed condition.

It follows from Equation C.4-1 that the major contributors to damage states C and M are also major contributors to damage state R. It is also noted from Table C.5-1 that the minimal cut sets with two basic events make minor contribution to the calculated frequencies. Minimal cut sets with three or more basic events did not contribute to the 1000 trials for any speed condition.

C.S.3 Frequency of Plant Damage States per Year To assess the significance of turbine missile risk, values of the frequency of damage states per year have been examined for various turbine operating times. By using the values of f

2 from Table C.5-1, and the values of f 3 from Table C.2-1 for tne Byron Station Unit 1 turbine, and applying Equation C.2-1, Table C.5-2 was prepared. This table presents frequencies per year of three damage states for values of continuous turbine operating time since last inspection equal to 1, 2, 3, 4, 5 and 10 years. The percent contribution from each of the three turbine failure speed conditions are also given in the table. These results are plotted in Figure C.5-1. It is I noted from this information that the frequencies of the three

' damage states depend on the turbine inspection interval At.

' These frequencies increase with the increase of at. The increase in frequency of damage state M (or R) is greater than that of damage state C; this is because damage state M (or R) occurs l at any of the three speed conditions while damage state C occurs only at the design overspeed and destructive overspeed l conditions (see Table C.5-2) .

1 It is emphasized that a number of conservative assumptiens have been used to obtain the results shown in Figure C.5-1.

These sources of conservatism are listed below:

a. Targets are modeled as cubicles larger than the actual size of the safety-related equipment, thus increasing the changes of the targets being hit by missiles.

b. After a missile enters a cubicle, all the safety-related equipment inside the cubicle is considered damaged. No credit is taken for the possibility of partially damaged equipment.

c. Reinforced concrete walls and slabs with thicknesses less than 6 inches are ignored in the plant modeling.

C.5-2 l

i . . _ __ ._... _ _ _ . . .

B/B-FSAR

d. The entire blockwalls, sidings, and gratings are assumed to offer no resistance to the motion of the missile.

e. All equipment devices (safety-related or non-safety-related) except moisture separators and steam generators are assumed to offer no resistance to the motion of the missile.

f. The design values of concrete strength are used in the analysis; the increase in strength for aged concrete is not taken into consideration.

g. It is assumed that if any one of the containment targets listed in Table C.3-1 is damaged, a less-of-coolant accident will result. Actually, only six of the twenty targets (reactor pressure vessel, pressurizer, and four steam generators) contain reactor coolant and, if severely damaged, could be considered the source of a LOCA. The remaining fourteen targets are included because of the poten-tial subsequent damage to the reactor coolant l system or the potential loss of redundant elements of the safety systems.

In view of the a frequencyof10goveconservatismintheanalysis,adamage per turbine unit per year is considered acceptably small. Using this limit on damage state R, which l has the highest frequency of the three damages studied, Figure C.5-1 yields an inspection time of 3.6 years (43 months).

Therefore, the operation of the turbine at Byron Station Unit I will be in conformance with Regulatory Guide 1.115 if the low pressure turbine discs are inspected at an interval not l exceeding 43 months and measured in terms of turbine running time. For Byron Station Unit 2 and for Braidwood Station Units 1 and 2, the same conclusion should apply if their corre-sponding f, values, when available, are found to be less than or equal t0 that of the Byron Unit 1 values.

l -

C.5-3 l

TABLE C.5-1 CONDITIONAL FREQUENCY OF THE THREE DAMAGE STATES

• FOR THREE SPEED CONDITIONS i f2 ( 5 l "I  !,

S FE RATED SPEED DESIGN OVERSPEED DESTRUCTIVE OVERSPEED (q) f2{C!M1) CONTRIBUTORS f 2I5!"2) CONTRIBUTORS f2 (C l wg) CONTRIBUTORS l Damage of neactor 0.00 None 2.0x10 -3 1.3.3 (100 %) 17.5x10 -3 1.2.lY (52.4%)

Coolant System Components 1.3.lA (34.3%)

e; C 1.4.3 (7.6%) J8 1.2.5 (5.7%) w 1 Y

^ 5 1.0x10 -3 20.0x10 -3 1

Loss of Cold 0-2 (100%) 8.0x10 -3 0-2 (100%) 0-2 (50%) $

Shu tdown l Capability 5.5-1 (30%) j M 0-3 (10%)  :

18.25-1 (5%) t 17.2-1 and 17.2-2 (5%)

h

' Excessive Offsite 1.0x10-3 Same as,that 10.0x10~3 Sum of the 37.5x10~3 Sum of the Releases - of the second above two R row above two .

rows rows (R = CU M) l i

NOTE: Numbers in the parentheses indicate the percent contribution of the target (s)

! to the conditional frequency at the specified speed condition.

i l

l I

i

e . .a [

e i

. t. s

. x .

[

t- ;.c j

5 s.

TAsta C.5-2 , e t.

s Plibr.Wi PER YEAR OF DMIAGE STATES  !

, s ,

3

{ctcl. girt.gati etc.ati =

a i=1 i l * '

Ij Ii;!

O E STATE SINE OF ALL SPEED CONDITIOleS I.

(C) *At = 1 Tr et = 2 yr at = 3 ve' At = 4 vr et = 5 yr at = le vr  !

l>8 ft C w 3h

. N me I. ? -

e. i . 'g :y I .

l[..

ir M '

Ii p ' l-f4 l f R= CUM t 1 l j

) ii i

- l

+;

NOTE:

Numbers in the pT entheses indicate percent contribution crom rated speed, design overspeed, and I destructive overspeed respectively. *

. i 5

4 9 .*

9 9 **O' 9 *## # D h e9 N 9 985G S g, wg ,,

O

- B/B-FSAR C.G

SUMMARY

AND CONCLUSIONS

• A probabilistic analysis of turbine missile hazard for the Byron /Braidwood Stations has been made using plant logic through a fault tree analysis and a three-dimensional plant model for missile trajectories. In the simulation model, numerous reinforced concrete barriers based on plant layout were used and their perforation velocity was calculated using CEA-EDF

~

formula. The model also included a few steel barriers whose perforation velocity was obtained.using BRL formula. Possibility of missile ricochet was also considered in the simulation model.

The most recent :alues of missile generation probabilities, l available for the Byron Unit 1 turbine from Westinghouse Electric Corporation (" Turbine Missile Report," Report No. CT-24890, Rev. 3, March 1982), are used in the analysis. The study l considered missile generation at rated speed, design overspeed, and destructive overspeed conditions. The major findings of this analysis are as follows:

a. The values of probability of damage to the reactor coolant pressure boundary, loss of safe shutdown capability, and significant radiological release all depend on the turbine inspection time as shown in Figure C.5-1. -

~

b. The results in item a above were obtained using I conservative assumptions enumerated in Subsection C.5.3. Therefore, it is reasonable to consider a probability of 1 x 10~6 per turbine unit per year as an acceptably small limit for turbine missile damage. -

c. It follows from item b above that turbine operation l at Byron Unit 1 will be in confer.9ance with Regula-I tory Guide 1.115 if the 1cw pressure turbine discs are inspected at intervals no longer than 43 monthu in turbine running time. This criterion makes l

damage probability per year to be less than 1 x 10-6 ,

d. The conclusion in item e also will apply to turbines of Byron Unit 2 and of Braidwood Units 2 and 2 if the probabilities of missile generation for these units are demonstrated to be less than or equal to probabilities used in this report for the Byron Unit 1 turbine.

C.6-1 .

.