ML20028D720
| ML20028D720 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 12/31/1982 |
| From: | Berry D, Easterling R, Kolb G, Kunsman D, Mccann M, Jeffrey Reed JACK R. BENJAMIN & ASSOCIATES, INC., SANDIA NATIONAL LABORATORIES, SCIENCE APPLICATIONS INTERNATIONAL CORP. (FORMERLY |
| To: | Office of Nuclear Reactor Regulation |
| References | |
| CON-FIN-A-1125, CON-FIN-A-1125-0 NUREG-CR-2934, SAND82-2929, NUDOCS 8301190377 | |
| Download: ML20028D720 (480) | |
Text
{{#Wiki_filter:NUREG/CR-2934 SAND 82-2929 Review and Evaluation of the Indian Point Probabilistic Safety Study l Prepared by G. J. Kolb, D. L. Berry, R. G. Easterling, J W. Hickman, A. M. Kolaczkowski, A. D. Swain, W. A. Von Riesemann, R. L. Woodfin/SNL J. W. Reed, M. W. McCann/JRBAl D. M. Kunsman/ sal Sandia National Laboratories Jack R. Benjamin & Associates, Inc. l
)
Prepared for , U.S. Nuclear Regulatory Commission l l kbR OK0 027 P PDR l
i l NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of re-sponsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights. Availability of Reference Materials dted in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:
- 1. The NRC Public Document Room,1717 H Street, N.W.
Washington, OC 20555 2 The N RC/GPO Sales Program, U.S. Nuclear Regulatory Commission, Washington, DC 20555
- 3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.
Referenced documents available for inspection anri copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and ir,ternal NRC memoranda: NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; Licensee Event Reports, vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence. The following documents in the NUREG series are available for purchase from the NRC/GPO Sales Program: formal NRC staff and contractor reports NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances. Documents available from the National Technica' information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission. Documents available from pubhc and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.
. Documents such as theses, dissertations, foreign reports and trans:ations,and non.NRC conference proceedings are available for purchase trom the organization sponsocing the pubhcation cited.
Single copies of NRC draft reports are available free upon written request to the Divis(on of Tech-nical Information and Document Control, U S. Nuclear Regulatory Commission, Washington, DC 20555 Copies of industry codes and standards used in a substantive manner in the NRC regulatory process r , are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available f there +or reference use by the public. Codes and standards are usually copyrighted and may be l purchased from the originating organization or, if they are American National Standards, f American National Standards Institute.1430 Broadway, New York, NY 10018. i GPO Ponted copy pr<e hl1.00_ _ .
NUREG/CR-2934 SAND 82-2929 Review and Evaluation ! of the Indian Point Probabilistic Safety Study Manuscript Completed: December 1982 Date Published: December 1982 Prepared by G. J. Kolb, D. L. Berry, R. G. Easterling, J. W. Hickman, A. M. Kolaczkowski, A. D. Swain, W. A. Von Riesemann, R. L. Woodfin J. W. Reed, M. W. McCann D. M. Kunsman* Sandia National Laboratories Albuquerque, NM 87185 Subcontractor: Jack R. Benjamin & Associates, Inc. 444 Castro Street - Suite 501 Mountain View, CA 94041 I i
- Sci nce Applications, Inc.
Prepared for Division of Safety Technology , Office of Nuclear Reactor Regulation l U.S. Nuclear Regulatory Commission i Washington, D.C. 20555 NRC FIN A1125-0
Abstract This report summarizes the review of the internal and external event portions of the Indian Point Probabilistic Safety Study (IPPSS). The review was conducted by Sandia National Laboratories and Sandia contractors over approxi-mately a 6-month period. The purpose of the review was to search for areas in the IPPSS where omissions and critical judgements were made which could impact the quantitative results. The review identified several of these areas. This report also evaluated, in a preliminary way, some proposed Indian Point plant modifications which were based on the insights of the IPPSS but were not included in the IPPSS results. A comparison of the quantitative results in this report, which assumes the plant modifications are in place, with the IPPSS results yields less than a factor of two difference on the overall plant core melt frequency. I ( iii
Table of Contents Page 1 Introduction....................................... 1-1 2 Areas of Review.................................... 2-1 2.1 Initiating Events.................................. 2.1-1 2.2 Event Trees........................................ 2.2-1 2.3 Mitigating System success Criteria................. 2.3-1 2.4 Fault Trees........................................ 2.4-1 2.5 Human Reliability Analysis......................... 2.5-1 2.6 Estimation Methodology............................. 2.6-1 2.7 External Events.................................... 2.7.1-1 2.7.1 Seismic............................................ 2.7.1-1 2.7.2 Wind............................................... 2.7.2-1 2.7.3 Internal and External Flood........................ 2.7.3-1 2.7.4 Fire............................................... 2.7.4-1 l 2.7.5 Transportation..................................... 2.7.5-1 2.7.6 Turbine Missiles................................... 2.7.6-1 2.7.7 Aircraft Crashes................................... 2.7.7-1 2.7.8 Seismic and Wind Pault Tree / Logic Models........... 2.7.8-1 3 Accident Sequence Analysis......................... 3-1 3.1 i Introduction....................................... 3.1-1 l 3.2 Indian Point 2 Dominant Accident Sequence Review... I 3.2.1-1
3.2.1 Seismic
Loss of Control or Power................. 3.2.1-1 3.2.2 Fire Involving Electrical Tunnel or Switchgear Room 3.2.2-1 3.2.3 Fires Involving Electrical Tunnel.................. 3.2.3-1 v
I
\
l 3.2.4 Turbine Trip Due to Loss of Offsite Power: Failure of Two Diesel Generators, RCP Seal LOCA, l 3.2.4-1 and Failure to Recover AC Power Until One Hour..... 3.2.5 Hurricane, etc., Wind: Loss of All AC Power Due to High Winds...................................... 3.2.5-1 3.2.6 Tornado and Missiles: Causing Loss of Offsite Power and Service Water Pumps or Control Building.. 3.2.6-1 3.2.7 Small LOCA: Failure of Recirculation Cooling...... 3.2.7-1 3.2.8 Large LOCA: Failure of Recirculation Cooling...... 3.2.8-1 3.2.9 Medium LOCA: Failure of Recirculation Cooling..... 3.2.9-1 3.2.10 Turbine Trip Due to Loss of Offsite Power: Loss of All AC Power, RCP Seal LOCA, Failure to Recover External AC Power Until After One Hour............. 3.2.10-1 3.2.11 Large LOCA: Failure of Low Pressure Safety Injection.......................................... 3.2.11-1 3.2.12 Turbine Trip Due to Loss of Offsite Power: Failure of Two Diesel Generators, RCP Seal LOCA, Failure to Recover AC Power (Uithin Three Hours).............. 3.2.12-1 3.2.13 Small LOCA: Failure of High Pressure Injection.... 3.2.13-1 3.2.14 Turbine Trip Due to Loss of Offsite Power: Loss of All AC Power, RCP Seal LOCA, Failure to Recover AC I , Power (Within Three Hours)......................... 3.2.14-1 , 3.2.15 Event V: The Interfacing Systems LOCA............. 3.2.15-1 3.2.16 Seismic: Direct Containment (Backfill) Failure.... 3.2.16-1 3.3 Indian Point 3 Dominant Accident Sequence Review... 3.3.1-1 3.3.1 Small LOCA: Failure of High Pressure Recirculation 3.3.1-1 Vi
3.3.2 Fires Involving Switchgear Room or Cable Spreading Room................................\............... 3.3.2-1 3.3.3 Large LOCA: Failure of Low Pressure Recirculation Cooling............................................ 3.3.3-1 3.3.4 Medium LOCA: Failure of Low Pressure Recirculation Cooling............................................ 3.3.4-1 3.3.5 Large LOCA: Failure of Safety Injection........... 3.3.5-1 3.3.6 Small LOCA: Failure of Safety Injection........... 3.3.6-1 3.3.7 Turbine Trip Due to Loss of Offsite Power: Loss of All AC, RCP Seal LOCA, Failure to Recover AC Power Until After One Hour............................... 3.3.7-1
3.3.8 Seismic
Loss of Control or AC Power.............. 3.3.8-1 3.3.9 Tornado and Missiles: Loss of Offsite Power and Service Water Pumps................................ 3.3.9-1 3.3.10 The Interfacing Systems LOCA....................... 3.3.10-1 3.3.11 Turbine Trip Due to Loss of Offsite Power: Loss of All AC Power, RCP Seal LOCA, Failure to Recover AC l Power (Uithin Three Hours)......................... 3.3.11-1 l 1 i 3.3.12 Seismic: Containment Failure...................... 3.3.12-1 l l 4 Special Issues..................................... 4-1 I l 4.1 Steam Generator Tube Rupture With Stuck Open I Secondary safety Valve............................. 4.1-1 l 4.2 Core Melt / Systems Interactions..................... 4.2-1 i I 4.3 Feed and Bleed Capability.......................... 4.3-1 4.4 Proposed Indian Point Plant Design Modifications as i [ a Result of the IPPSS.............................. 4.4-1 j 4.5 Reactor Coolant Pump Seal LOCA..................... 4.5-1 i Vii t
l 4.6 Loss of Component Cooling Water Due to a Pipe Break 4.6-1 4 4.7 Completeness....................................... 4.7-1 i 5 Summary and Conclusion............................. 5-1
! 5.1 Important Findings................................. .5.1-1 5.2 Estimated Plant Damage State / Release Category Frequencies and Sensitivity Issues................. 5.2-1 i 5.2.1 Internal Events.................................... 5. 2- 1
! 5.2.2 External Events.................................... 5. 2- 6
- 5.2.3 Combined Internal and External Events.............. 5.2- 11 i
l 5.2.4 Sensitivity Issues................................. 5.2- 17 i } Appendix A -A Review of the Indian Point Probabilistic Safety Study Seismic, Flooding, and Wind....... A-1 i i I l 1 l 4 i i 1 I i I t ... > V111
i Acknowledgements The authors wish to thank Sanford Israel and Scott Newberry 3 of the US Nuclear Regulatory Commission for their comments and guidance during this program. We also wish to thank Emily Preston for her help in typing and assembling this report. i a i i l l l ix l
l
- 1. Inttoduction i
J Sandia National Labotatories has performed a limited review of l the system analysis and external events analysis of the Indian Point Probabilistic Safety Studyl (IPPSS)for the Office of Nuc-leat Reactor Regulation of the Nucleat Regulatory Commission l (NRC). The teview has been conducted ovet a three and one-half l month petiod, by Sandia personnel with contractor support. To date, approximately 20 man-months effort has been expended in the review. The review has focused on the plant and external events analysis of the Indian Point study. Each majot topic area of the plant analysis portion of the study was teviewed: initiating evente; event trees, success criteria, fault trees, human reli-ability analysis, component data, and uncettainty. The treatment of external events, including seismic, fites, floods, missiles,
. wind, ttansportation of hazardous materials, and aitetaft crashes, was also teviewed. Not every topic was teviewed in detail.
Emphasis was on those pottions of the analysis which appeared most impor tant to the tesults of the Indian Point study. In addition to each topical area, the important accident sequences from the study were reviewed in detail. The sequences dominating risk were reviewed in detail as well as sequences important to the core melt probability but contributing little to l' tisk due to the low consequences anticipated for these accidents. The intent of the sequence review was to evaluate the analysis of the Indian Point study and to determine the changes in the esti-mated frequencies of the sequences which could arise from differences in assumptions and the treatment of data. Several issues and assumptions were evaluated in addition to i the sequences. The issues wete chosen as a result of interest on the pat t of NRC or because of their having been important in othet tisk assessments. Sevetal of these issues, such as feed and bleed capability and interactions between core melt and containment
~
systems, ate issues for which somewhat controvetsial assumptions must be made which may differ between analysts. Other issues, such as anticipated tr ansients without scram, are genetic, unresolved safety issues. Still othets, such as the treatment of teactor coolant pump seal LOCAs, arosa because of assumptions used in IPPSS. These issues were generally treated in the manner of a sensitivity study. Assumptions were varied to see what the effects on the results could be. Often, this took the form of a bounding calculation. ! It should be noted that the primary emphasis of the review was ( to seatch for significant omissions and critical judgments in the IPPSS. We thetefore did not keep close account of small diffet-ences (e.g., those that affect the cote melt frequency or tisk by approximately less than a factor of two). l 1-1 f
The results of our review are presented in the following sections. The review of plant analysis-and external events topics is presented in Section 2. Section 3 presents the review of selected accident sequences. Section 4 details the review of selected issues. Section 5 summarizes the principal findings and presents estimates of plant damage state frequencies for use in containment and consequence calculations. REFERENCE
- 1. Indian Point Probabilistic Safety Study, Power Authority of the State of NeV York, Consolidated Edison Company of New York, Inc., Spring 1982.
l i I l-2 l 1 I
- 2. Areas of Review The IPPSS, as any Probabilistic Risk Assessment (PRA), is com-posed of several intettelated tasks. A review of PRA is not complete unless the information and analysis which comprises each task is examined. The IPPSS PRA tasks are depicted in Figute 2-1.
Also shown there are the report sections which summarize our review of a task. As can be seen, this report does not teptesent a com-plete teview since several of the PRA tasks were 'not examined. For the most par t, these omissions ate in the containment and conse-quence analysis areas. It can be noted that we did not review the first task, " initial information collection." Out review assumes that the IPPSS has collected accurate Indian Point design and opet-ations information; e.g., correct piping and instrumentation layouts, etc. The findings of out teview are ultimately expressed quantita-Lively in terms of the effect they have on IPPSS plant damage state and/ot "NRC defined" damage state frequencies. Damage states ate, in essence, functional classifications of core melt accidents. Classification of cote melt accidents functionally is necessary to perform containment and consequence analysis. The IPPSS defined 22 plant damage states. These can be grouped as follows: 1) SEFC, SEC, SEF, AEFC, AEC, AEF, TEFC, TEC, TEF; 2) SE, TE, AE; 3) SLFC, SLC, SLF, ALFC, ALC, ALF; 4) SL, AL; 5)V; 6) Z. The nomenclatute is S ot A denotes small or large LOCA and T denotes transient, E or L denotes eatly ot late cote melt, F and C denote fans and sprays working respectively, V denotes an interfacing systems LOCA, and Z denotes a direct containment failure caused by a seismic event. The NRC has defined seven plant damage states, six of which cottes-pond to the six IPPSS groups listed above. These are 1) early core melt with containment cooling; 2) eatly core melt without contain-ment cooling; 3) late cote melt with containment cooling; 4) late cote melt without containment cooling; 5) containment bypass before cote melt; 6) direct containment failute due to a seismic event; and 7) steam generator tube rupture with a stuck open secondary safety valve. l l 2-1
ll ilii.I i - - 1
-- ; {
n 3a d {g * -* i u- , ! i i E l " l Is 14 .
- s 1 .
3 3 I s ! r------- 3* I i 9 ] } n :
<l " d i
e i
'g -. N -*
a
= s l w I I2 5 io E l
I M : I h z "h l 3 I 5
% .a is 1
li 1 4-- 4-N
- y l y
- I e .d ]e3 jf L- * *!!.'W'4-- -> o
,4 5[i%
#gT d W n+ y n n hfs
' n I19n 9
'H ,
2-la
i a 2.1 Initiating Events The initiating events covered in the IPPSS seem to be j relatively complete compared to those addressed in previous PRAs. 4 The initiating event categories analyzed were identical for both ) Indian Point units. IPPSS Table 1.5.1-23 summarizes the initiating 4 events considered and is reproduced here for reference. The treat-3 ment of these initiating events is discussed in other sections of this review. 1
!' Comparisons were made to other PRAs, an NRC list of concerns about potentially omitted initiating events, and EPRI NP 801.1 (It should be noted that the IPPSS used data contained in NP801 to i quantify the IPPSS initiating event frequencies.) In addition, several initiating events were identified by NRC as being of particular interest. These are discussed below. L
- 1) Excess Letdown or Decreased Charging j The result of this potential initiating event is lowering the reactor coolant inventory without detection to a level that would require reactor trip and mitigation via closure of the letdown line .
- by the operator. Although not addressed explicitly in the IPPSS, this event would be included in the EPRI NP-801 data used to quantify the reactor trip event (subcategory 12).
- 2) Insufficient Letdown or Increased Charging i
i This potential initiating event would cause RCS overpressure and thus falls under subcategory 12 (IPPSS Table 1.5.1-23) and is included in the EPRI NP-801 data used to quantify the initiating , l event, i
- 3) Pressurized Thermal Shock '
I ! This is a safety issue not addressed by the IPPSS or any of the l current or past PRAs. It is a complex issue which requires very detailed plant specific probabilistic, thermohydraulic, and frac-ture mechanics analysis. Due to the time limitations placed on j this review, we were not able to evaluate this initiating event.
- 4) Failure of the Pressurizer Sprays or Heaters This initiating event results in loss of RCS pressure control and thus falls under subcategory 12 (IPPSS Table 1.5.1-23) and is I
included in the EPRI NP-801 data used to quantify the initiating , event. $ l 5) Inadvertent Containment Spray Operation l This initiating event was not treated explicitly in the IPPSS or in previous PRAs. The apparent concern is actuation of the l [ 2.1-1 i k
t J TABLE 1.5.1-23 INDIAN POINT 2 INITIATING EVENT SUBCATEGORIES
- 1. Large Loss of Coolant Accidents (LOCAs)
- 2. Medium LOCAs
- 3. Small LOCAs
- a. Pressurizet relief or safety valve opening
- b. Miscellaneous small LOCAs
- 4. Steam Genetatot Tube Rupture
- 5. Steam Pipe Ruptute Inside the Containment
! 6. Steam Pipe Rupture Outside the Containment.
- 7. Loss of Feedwatet Flow
- a. Loss /teduction of feedwatet flow in one steam generator -
- b. Loss of feedwater flow in all steam generators
- c. Feedwatet flow instability--operator ettor
- d. Feedvatet flow instability--mechanical causes
- e. Loca of one condensate pump
- f. Less of all condensate pumps
- g. Condenser leakage a h. Miscellaneous secondary leakage
- 8. Full or Pattial Closute of One Main Steam Isolation Valve (MSIV)
- 9. Loss of Primary Flow
- a. Loss of primary flow in one loop
- b. Loss of primary flow in all loops
- 10. Cote Power Increase
- a. Uncontrolled tod withdt awal ;
- b. Boron dilution--chemical and volume control system '
malfunction . c. Cold watet addition ) 1 l 2.1-2 i
-- , , ,, , , , - , . - , , - . . , , - - --,-,-.m ,,n- ,,-,n- -
,-e- , , , -- ,, -- - . , , . _ . - . ,
TABLE 1.5.1-23 (continued) INDIAN POINT 2 INITIATING EVENT SUBCATEGORIES
- 11. Turbine Ttip
- a. Titbine trip i
- 1. Closute of all main steam isolation valves
- 2. Inctease in feedwatet flow in one steam generator
- 3. Loss of condenset vacuum
- 4. Loss of circulating watet i
- 5. Thr ottle valve closute/ electro-hydr aulic contr ol problems
- 6. Generatot trip or generatot caused faults
- 7. Inctease in feedwatet flow in all steam generators
- b. Tutbine tr ip due to loss of of fsite powet
- c. Tutbine trip due to loss of service watet
- 12. Reactor Trip
- a. Reactot Ltip
- 1. Control tod drive mechanism problems and/ot tod drop
- 2. High or low pressurizer pressure
- 3. Spur ious automatic tr ip--no transient condition
- 4. Automatic / manual trip--operator ertot
- 5. Manual trip due to false signal
- 6. S0utious trip--cause unknown
- 7. Pr imary system pressure, temperature, power imbalance
- 8. Loss of power to necessary plant systems
- 9. Spurious safety injection activation
- b. Reactor trip due to loss of component cooling water 2.1-3
il spray system during shutdown while on RHR. This could lead to a loss of RCS inventory since the sptay headets take suction from the
- RHR lines. Neithet did the IPPSS not we analyze possible events during shutdown.
- 6) Inadvettent Containment Isolation
! If this potential initiating event wete to occut the reactor may be shutdown and therefore challenge the safety systems. This would
- most likely lead to a loss of main feedwatet, initiating event 7.
i
- 7) Loss of Instrument and Conttol Power i This tefets to loss of insttument and conttol powet independent of total AC ot DC failure. Loss of an individual AC ot DC buses wete analyzed in the IPPSS in Section 1.3.5.12.2 for unit 2 and 4
1.3.6.12.2 fot unit 3. An IPPSS bounding analysis indicated that
; loss of a DC bus was ptobabilistically bounded by loss of the AC bus which served the same equipment. We genetally agree with the IPPSS l apptoach except for the turbine-driven APWS pump. Though this pump t
does not depend on either AC or DC power to statt, DC powet is required for instrumentation. Discussions with Indian Point personnel indicate that following loss of the turbine pump DC bus the purap would be controlled locally. Since the unavailability of the turbine pump is relatively high ( .02/ demand) we feel the non-consideration of the human ettot of failing to control the pump locally does not have a major impact on the pump unavailability. We thus find the IPPSS analysis of AC and DC initiating events to be adequate.
- 8) Events Occutting During Cold Shutdown l None of the PRAs to date, the IPPSS, or our review addressed these events.
- 9) Reactot Coolant Pump and Othet Internal Missiles Tutbine missiles ate considered under external events; howevet, RCP or othet internal missiles apparently were not and would appeat j to be logically considered as a failute mode of components in the i
vicinity of components potentially producing such missiles. t
, 10) Loss of Ventilation in the Auxiliary Building Loss of ventilation in the auxiliary building was not considered j as an accident initiatot or subsequent to another initiating event. I Power Authority of the State of New York (PASNY) has performed a loss of ventilation analysis with the aid of United Engineers subse-quent to the issuance of the IPPSS. The following information was l provided to Sandia by United Engineet s:2 2.1-4 1
4 Hr. Temp. (*F) 24 Hr. Temp. ( F) Area Whole Bldg. 108 116 RHR Middle 146 176 Pump Room SI Pump Room 126 150 CCW Pump Room 108 115 The above temperatures were based on the following assumptions:
- all equipment in the auxiliary building operational except ventilation,
- no credit taken for natural circulation through ducts, and gradient calculated between building F ft structure and ambient temperature at H = 1.5 Btu /hr Based on this analysis, United Engineers predicts no safety related equipment failures within the first 24 hours following a loss of auxiliary building ventilation.
- 11) Reactor Coolant Pump Seal Failure The RCP seal failure initiating event should be considered a small LOCA. However, it is not included in the data base. While it ,
is true they were not included, the small LOCA frequencies of approximately .02 quoted in the report for each Indian Point unit is a reasonable esti.dte. The NRC han conducted a study of RCP rupture LOCAs3 which suggests their frequency to be approximately .02. Conceivably, the Indian Point small LOCA frequencies could be .04. However, upon review of the data comprising the IPPSS small LOCA frequency, it was noted that many of the small LOCA events involved stuck open pressurizer PORVs. It is generally known that some of these events were recovered by the operators in a few minutes via closure of the PORV block valves. The IPPSS did not consider recovery and thus probably overpredicted the frequency of PORV LOCAs. It is felt that this overprediction would tend to cancel the l underprediction of RCP seal failure and thus the small LOCA frequency estimate of .02 is reasonable.
- 12) Loss of Component Cooling Water Due to a Pipe Break melt This potential initiating event could conceivably lead to core unless judicious operator recovery actions are performed within about an hour. Assuming no operator recovery, a large pipe break in the component cooling system would cause a reactor trip, could even-l tually cause a reactor coolant pump seal LOCA, and failure of the pumps which provide makeup to the reactor coolant system. It should be noted that the IPPSS analyzed a " loss of pump flow" induced loss of component cooling water initiating event. However, the IPPSS did not analyze one induced by a pipe break. The system responses are quite different for the two cases.
2.1-5
I In conclusion, review of the.NRC list of potential IPPSS initiating event omissions has indicated that pressurized thermal
, shock, shutdown events, and loss of component cooling water due to a i pipe break appear to be the only potentially significant events ! omitted in the IPPSS. The rest are implicitly or explicitly , included in the IPPSS existing initiating events or are judged to be i nculimiting. l The loss of component cooling water due to a pipe break is evaluated in Section 4.6 of this review. As stated earlier, an
- evaluation of pressurized thermal shock or shutdown events does not appear in this review.
i It should be noted t'aat seven external initiating events .' (seismic, fire, flood, wind, aircraft accidents, transportation and j hazard materials, and turbine missiles) were considered, which is ; more than most PRAs have attempted. The external event review appears in Section 2.7. j Initiating Event Quantification J Estimated initiating event frequencies are expected to vary I n from plant to plant depending on the plant characteristics, design, and its specific data base. The IPPSS initiating event data were i l compared to the data used in the Arkansas Nuclear One (ANO) IREP4 analysis. (The reason for choosing ANO is because it is a recently completed NRC-sponsored PRA.) The purpose of the comparison was to look for potential differences in judgment or calculation. The mean values from the IPPSS are: Occurrences / Year 4 Initiating Event Category IP2 IP3
- 1. Large LOCA 1.9x10-3 2.2x10-3
! 2. Medium LOCA 1.9x10-3 2.2x10-3
- 3. Small LOCA 1.9x10-2 2x10-2
- 4. Steam Generator Tube Rupture 2.7x10-2 3.4x10-2
- 5. Steam Break Inside Containment 1.9x10-3 2.2x10-3
- 6. Steam Break Outsiue Containment 1.9x10-3 2.2x10-3
- 7. Loss of Main Feedvater 6.7 3.8
- 8. Trip of One MSIV 1.3 9x10-2
- 9. Loss of RCS Flow 1.4x10-1 1.7x10-1
- 10. Core Power Excursion 2.2x10-2 2.6x10-2 d
lla. Turbine Trip 7.3 2.7 i 2.1-6
Occurrences / Year Initiating Event Categoty IP2 IP3 lib. Turbine Tr ip--Loss of Of fsite Powet 1.8x10-1 2.7x10-1 llc. Turbine Tr ip--Loss of Ser vice Water 1.9x10-3 c.2x10-3 1 12a. Reactor Tr ip 6.8 2.9 12b. Reactot Trip--Loss of Component Cooling 1.9x10-3 2.2x10-3 V. Inter facing System LOCA 4.7x10-7 4.6x10-7 The ANO PRA utilized WASH-14005 data for breaks greater than 2". For breaks less than 2" WASH-1400 data was added to the 2 x 10-2 teactot coolant pump seal tupture data discussed in 11 above. The following compates ANO, WASH-1400, and IPPSS LOCA frequency data: IP2~ IP3 ANO WASH-1400
, 1. Large LOCA >6" 5% 1.l(-6) 1.l(-6) 1(-5) 1(-5)
Median 1.2(-4) 1.2(-4) 1(-4) 1(-4) Mean 2(-3) 2. 2 (-3) 2.7 (-4 ) 2.7(-4) 95% 6.3(-3) 6.7 (-3) 1(-3) 1(-3)
- 2. Medium LOCA 2"-6" 5% 1.1(-6) 1.l(-6) 3(-5) 3(-5)
Median 1.2(-4) 1.2(-4) 3(-4) 3 (-4) Mean 2(-3) 2.2(-3) 8(-4) 8(-4) 95% 6.3 (-3) 6.7(-3) 3(-3) 3 (-3)
- 3. Small LOCA <2" 5% 1(-4) 1(-4) --
1(-4) Median 1. l (-2 ) 1. l (-2) -- 1(-3) Mean 1.9(-2) 2(-2) 2.l(-2) 2.7 (-3) 95% 5.2 (-2) 5.4 (-2) -- 1(-2)
- 4. Intetfacing Systems LOCA 5% 3.1 (-11)
- 2. 4 (-11) * -- --
Median 3.4(-9)* 2.2(-9)* -- -- Mean 3.4 (-7)
- 4. 6 (-7) * < 1 (-6 ) 4 (-6) 95% 6.l(-7)* 6. 5 (-7) * -- --
- Revised values--see Section 3.2.15 of this teport.
It can be noted that the IPPSS mean frequencies are significantly I greatet for the large and medium LOCA. The reason the means are gteatet is due to the IPPSS Bayesian methodology used to establish the i 2.1-7 1 -. .
. = _ - _. - - - - .- . - . - - -
probability distributions and 5 percent /95 percent bounds. Because of these differences, the IPPSS mean values are skewed higher than the
- WASH-1400 means even though the median values are fairly similar. Tne interfacing systems LOCA has a smaller estimate in the IPPSS because of more frequent testing of the low pressure injection check valves than the Surry Plant in WASH-1400. (Due to the more frequent testing, the dominant Indian point interfacing systems LOCA location is in the RHR
- suction path.)
Transients are subdivided differently at ANO but five are directly l related, l IP2 IP3 ANO l
- 7. Loss of Main Feedwater 6.7 3.8 1.0 lib. Turbine Trip--
! Loss of Offsite Power 1.8x10-1 2.7x10-1 3.2x10-1
- lle. Turbine Trip--
i, Loss of Service Water 1.9x10-3 2.2x10-3 2.6x10-3 lla. Turbine Trip-- 7 . 3,l g 4 .1 2.8,5.7 7.1 3 12a. Reactor Trip-- 6.8 2.9 The IPPSS transient initiating event frequencies appear reasonable; the differences are the result of the influence of plant specific data. (The other IPPSS initiating events were not explicitly analyzed at ANO because they were either a) not applicable, b) were not identified to be significant, or c) grouped with other transients.) The reactor vessel rupture LG"\ (R), is not considered mitigable and thus leads to core melt by itself. The IPPSS con-cluded that the frequency of such an event is small compared to other events leading to the same plant damage state; e.g., large LOCA followed by failure of low pressure injection. This conclusion is questionable since the IPPSS did not analyze a vessel rupture , sequence initiated by pressurized thermal shock. i In summary, these frequencies appear to be consistent with what would be expected from experience and from what was used in the ANO l PRA. The most significant differences are in the large and medium ; LOCA frequency estimates. However, these differences can be attrib- l uted to the use of Bayesian methodology in the IPPSS. The Bayesian methodology used to quantify the initiating events is reviewed in
- Section 2.6.4 of this report.
l Initiating Event / Safety System Interdepencies One of the most important tasks in a PRA is to search for system or component failures which can simultaneously cause a l 2.1-8 l
l l reactor trip and failure of safety systems. These type of initiat-ing events have occurred in the nuclear industry (eg, Rancho Seco, Crystal River) and have also been shown to be important contributors to risk in some PRAs (eg, ANO). The IPPSS search for such initi-ators is documented in Sections 1.3.5.11.3, 1.3.5.12.2, 1.3.6.11.3, and 1.3.6.12.2. Failures of service water, component cooling, and several DC busses were identified as initiating events. Of these, failure of service water and component cooling was explicitly modeled, while failure of a DC bus was not. A bounding analysis of the latter indicated that the frequency of such an event was small compared to other events which led to the same effect on the safety systems. We reviewed how these interdependencies were treated in the quantification process and found several problems. Our findings are documented in Section 2.2.2 (Event Tree 11c, 12b) and Section 4.6 of this report. REFERENCE
- 1. ATWS: A Reappraisal--Part III, Frequency of Anticipated Transients, EPRI NP-801, Interim Report, July 1978.
- 2. Memo from J. G. Simon (United Engineers) to Greg Kolb (Sandia Laboratories),
Subject:
PAB Ventilation Study, July 30, 1982.
- 3. NRC Memo from Thomas Murley to Darrel Eisenhug,
Subject:
Reactor Coolant Pump / Seal Failure, no date.
- 4. Interim Reliability Evaluation Program: Analysis of the Arkansas Nuclear One - Unit 1 Nuclear Power Plant, NUREG/CR-2787, June 1982.
- 5. Reactor Safety Study, WASH-1400, October 1975.
2.1-9
2.2 Even t Trees The IPPSS constructed 13 event trees to model the plant system response to the initiating internal events discussed in Section 2.1. We reviewed these trees for validity. During the review, several questions were generated which could not be answered by information or analysis presented in the text. These questions were, for the most part, answered during a meeting held in June 1982 between Sandia Laboratories and IPPSS personnel. The findings are of two types. General findings are those that apply to all or several of the event trees. Specific findings are those that apply to a particular event tree. These findings and the impact they may have on the IPPSS results will now be discussed. 2.2.1 General Event Tree Findings Containment Spray System Analysis There are two containment spray systems installed at an Indian Point unit. The containment spray injection system (CSIS) consists of two pump trains which take suction from the refueling water storage tank (RWST). Upon depletion of the RWST, the CSIS pumps are shut down. During the recirculation phase, the containment spray recirculation system (CSRS) is utilized. The CSRS is a two-train system which utilizes the same pumps as the low pressure recircula-tion system (LPRS). A portion of the LPRS flow is diverted to the CSRS spray headers. During recirculation, the LPRS pumps take suction from the containment sump. Though not explicitly stated in the IPPSS, no credit was given on the event trees for operation of the CSRS. Referring to event tree 2 (IPPSS Figure 1.3.4.2-1, event tree 2), for example, it can be seen that on sequences 43 and 46, the CSRS is defined to be oper-ating yet the plant damage state (AEF and AE, respectively) implies that sprays are not operating. This is a conservatism adopted in the Indian Point analysis and may be justified for the following reasons: 1) In the vast majority of core melt sequences the PRA analyzed, the LPRS is unavailable. Since the LPRS and CSRS share much of the same equipment, the CSRS may also be unavailable;
- 2) During a core melt accident, the CSRS valves or pumps that are inside containment may fail due to the physical processes associated with the core meltdown.
The CSIS, on the other hand, is given more credit on the event trees than may be justified. Upon close examination of event tree sequence plant damage states (e . g . , sequence 2, event tree 2) and the CSIS event definitions it is noted the IPPSS assumes the CSIS is available during the recirculation phase if it was successful during the injection phase. In order for the CSIS to be available during recirculation, the RWST must be refilled by the operators. 2.2-1
J- E. 4-- t - - - . , .-- ._ ._ - - - - + - - - N e i 5 C.J
* ** l h i , ,,,
40 I p.a p. e-
$N 08 t ed 9 g W89 99 5 fie. q) e er > >
SM W l *w M, .g 888 40 l " SN G GA
;' b 988 9 y 2 j -O SN 80 i I b
Dee EG De e i I
$II SO 1 n. . ,
en a i sw a sew ee , i wow se 1 l 1
; uw a I
989 M Se N 88 1 ,)-
== = . 1 I
$eM D p D i i
1 e. .. , I i w =
.e e ,
l ese et l e ne e 3M # a kN
- l
- 3. .
Sep E i ben E a l u,, .a 3M M ,
- s. = l
- n. =
asM M - i MN E 1 I 3s te et av 5 r
= , 1
$N 88 i es = l 8 9W U SM M i Sp M i l
$5W 00 See, se i hN M i k ue, e.
SW h a SW 44 i l 3R h 3439 Os a hp M . un es i to to , i 1 j st33rd 44 i GW OB y j t == . , i I SSDFW & [ l h4 9 i 54334 0 31, 9 i i SS30rW $ hw 5 g G43W G I 4 TS e 99=0*G E 40 J te S e su* 4 #9 asettatt es 6e e .2 IS*s3 FW mlka 3 FW eul>49N3, 54 Ot t1003 40maiOGW mesa 3 Fue M 93EP94 4 go. wood eae avse Ow De con tee Wid M terS00S me e M eeneat 68W18 SSMS seed alge4eisus.38e eSeaW1W385 645sesre se03 suswao0 amenares set estse enOS Ae 5s*9 2.2-2
, - - , . _ - - - - - --, , , , - - - . - - , c , , - -, ,v- - - - v- - ---- --, ,- -~, -, -- -,_, --- , -, . - . , - - - e-
We question the validity of giving credit for the CSIS during recirculation since we find no mention of refilling the RWST in the Indian Point LOCA emergency procedures. The IPPSS analysis team feel RWST refill should be given credit (Reference 4) because about 10 hours would be available to refill the tank. They argue emer-gency support personnel will be available to perform the actions. Though we agree that 10 hours seems more than adequate to perform the refill, we wonder if the operators would be cognizant that they should do this. The IPPSS avent trees imply that many of the refills would be performed after the onset of core melt. We feel the confusion in the control room at that point would be extreme and if the operators were doing anything constructive, they would probably be trying to restore core cooling. If one assumes that the CSIS will not be available during the recirculation phase, all core melts that are initiated during the recirculation phase would not have sprays available to mitigate the consequences of the accident. This implies that plant damage states characterized by C (spray injection operating) and L (core melt initiated in the recirculation phase) are not possible. Thus, IPPSS damage states SLFC, ALFC, SLC, and ALC become SLF, ALF, SL, and AL, respectively. The impact this finding has on the plant damage state frequencies is summarized in Section 5.2. Core Melt / Safety System Interactions The interdependencies incorporated into the Indian Point event trees imply that the containment spray and fan cooler systems may be utilized during a core melt accident. This is an important assumption since the Indian Point analysis predicts that the operation of these systems can significantly reduce the risk associated with a core melt accident. This topic is discussed more fully in Section 4.2. Sodium Hydroxide Addition All event trees model the additions of sodium hydroxide to the containment spray water. This was modeled because it was thought to enhance the radioactive material scrubbing capability of the spray water during a core melt accident. Discussions with IPPSS personnel revealed that analysis performed late in the study indicated that sodium hydroxide addition had a negligible effect on the assessment of plant damage states and release categories. All event trees could therefore be simplified by removal of the sodium hydroxide addition event. This is consistent with the findings of WASH-1400 with respect to sodium hydroxide addition. Main Feedwater System The Indian Point study assumed that the main feedwater system was unavailable for purposes of removing post shutdown decay heat following all internal and external initiating events analyzed. This is a conservatism adopted by the IPPSS which we do not feel is 2.2-3
justified. Discussions with Indian Point personnel indicated that the main feedwater system is available or can be testored following most reactor tt ips not caused by a loss of of fsite power . This conservatism primarily impacts the " feed and bleed" accident sequences reviewed in Section 4.3. (Refer to that section for a quantitative evaluation.) Operator Actions Performed During Event Tree Accident Sequences In response to the accidents modeled on the IPPSS event trees, Indian Point operators ane expected to follow one or several emer-gency procedures. These precedurcs outline the actions the operators perform to contend with the accident. If the 7tions are performed correctly, core damage can be avoided. The opt 2 tor actions outlined in the Indian Point procedures were compared with the IPPSS analysis of operator actions tequired to prevent core damage. In some cases, we found that the IPPSS modeled operator actions which were not outlined in the procedures. The most notable example of this is " feed and bleed" core cooling. The IPPSS assigned a high ptobability of success of this core cooling method, yet no feed and bleed procedutes exist at Indi an Point 2 and very limited ones exist at Indian Point 3. The impact that not giving credit fot feed and bleed core cooling has on the plant damage state frequencies is presented in Section 4.3. Based on discussions we had with IPPSS personnel, we discovered that the IPPSS did not model all operator actions which could affect the course of an event tree accident sequence; ie, they did not calculate a probability of human error, but rather assumed the oper-ator perfotmed a task with a negligible failure probability. An example was mentioned in the discussion of the containment spray injection system analysis. As discussed there, the IPPSS assumes the operator will tefill the RWST to allow continued operation of the CSIS. We could not find an analysis in the PRA which assesses the probability of opetator ertot in performing this task. If the probability of human er ror is close to unity, the effect on the plant damage states would be the same as discussed previously. Cote Melts Caused By Containment Overptessure Failure The Indian Point event trees do not model core melts caused by containment overpressure failure. These sequences have been shown
.to be important in other PRAs (e.g. , the S2 C sequence in WASH-1400).
We have assessed the effect of this potential sequence in the IPPSS and found it to be negligible. A review of the Indian Point ) cote cooling and containment heat removal systems indicated that it ! is almost completely assured that if core cooling during the recirculation phase is provided, so also will containment heat temoval. This is because the core cooling and one of the contain-ment heat removal systems shate most of the same equipment (ie, 2.2-4
l l l pumps and support systems). Because of this dependence, the probability of having core cooling and not containment heat removal is negligible. Transient Induced Pressurizer Safety Valve Demands The IPPSS event trees do not model the demand of the pressurizer safety. valves in response to a transient. This raised a concern that the study may have missed some important accident sequences. t We feel the IPPSS has not missed important accident sequences for the following reasons: With offsite power available, stuck open relief valve sequences are adequately modeled by considering them as small LOCA initiating events. Via review of the IPPSS small LOCA initiating event data, it is noted that pressurizer relief valve failures are included as initiating events. Following a loss of offsite power (LOP), it is very questionable whether the safety valves would be demanded. NUREG-06111 quotes two instances of PORV demands in Westinghouse plants following a LOP in approximately 150 reactor years. Based on this data, we roughly estimate the challenge rate of the PORVs to be approximately .07 following a LOP. However, it should be noted that these represent PORV rather than safety valve challenges and, since the safety valves open at a higher setpoint, the safety valve challenge rate would be lower. We conservatively calculated the most likely core melt accident involving a LOP and stuck open safety valve using a challenge rate of .1 and found that ! frequency to be much less than lx10-6 This value is small compared to the overall core melt frequency calculated in the IPPSS i and the frequency of the plant damage state in which this sequence would be placed. 2.2.2 Specific Event Tree Findings All of the event trees were reviewed in detail. The following subheadings delineate the significant event tree specific find-ings. If nothing is written for a particular event tree, this means there are no specific findings. The general findings delineated in Section 2.2.1 do apply to there trees, however. Event Tree 4--Steam Generator Tube Rupture Several problems were identified. IPPSS personnel are constructing a new event tree. The most significant finding was that the event tree does not address steam generator tube ruptures accompanied by stuck open secondary safety valves. These may be potentially high risk 2.2-5
accidents, if core melt ensues, since a direct path from inside con-tainment to the atmosphere would exist. These types of sequences are discussed further in Section 4.1. Event Tree llc--Turbine Trip Due to a Loss of Service Water and Event Tree 12b--Reactor Trip Due to a Loss of Component Cooling Water The IPPSS used the turbine trip and reactor trip event trees to model the plant response to a loss of service water and loss of component cooling water initiating event respectively. These event trees do not adequately model the plant response to these initiating events for the following reasons: a) the trees do not allow for a reactor coolant pump (RCP) seal LOCA to occur following a sustained loss of component cooling or service water, b) the systems which respond to a seal LOCA are not adequately modeled, and c) station blackout initiated by a loss of service water and followed by a loss of offsite power is not modeled (station blackout initiated by an LOP followed by a loss of service i water is modeled on 11b.) If a loss of component cooling occurs, the RCP seals will lose cooling within approximately 15 minutes due to failure of the charging pumps and cooling to the thermal barrier heat exchanger. The IPPSS predicts a 1200 gpm seal LOCA will occur approximately 30 minutes following a loss of seal cooling. If the safety injection pumps subsequently fail, a core melt would ensue leading to an SEFC plant damage state. Service water cools component cooling water via two heat exchangers. If service water to the heat exchangers fail, the com-ponent cooling system would heat up at approximately 5'F/ hour. If service water to the heat exchangers is not restored within ! several hours, RCP seal cooling and the safety injection pumps could fail. This could lead to a LOCA followed by core melt leading to an SEFC or SEC plant damage state, ie, SEFC if only the conventional service water header is lost and SEC if both the conventional and nuclear headers are lost. Service water also cools the diesel generators. If service water fails, followed by a loss of offsite power, the diesels black-out. If AC power is not restored within approximately an hour, a seal LOCA could occur followed by core melt. If AC power is not restored within approximately 3 hours, a containment overpressure I failure leading to an SE plant damage state could occur. Based on the abbreviated analyses we performed for those omitted sequences, we found the sequences frequency estiuates to be small 2.2-6
compared to other sequences which appear in the same plant damage state. The teason for this is because we feel there is a high like-lihood of recovet ing from such initiating events and because the probability of a loss of offsite power following these initiating events is small (< 10-3 ) . Following a loss of Component Cooling Watet (CCW), the plant can be successfully shut down by testoring CCW, via stattup of a backup CCW pump or realignment of CCW valves within about an hout, and actuation of the auxiliary feedwatet system ot feed and bleed cote cooling. Following a loss of service watet with offsite power available the plant can be successfully j shut down by testoring service water or cooling to the charging pumps, via stat tup of a backup service water pump or alignment of city water to the charging pump coolers within several hours, and actuation of the auxiliary feedwater system. I Event Tree 13--ATWS The event tree appearing in the IPPSS does not represent the as built plant response to ATWS events. At the time the IPPSS was con-ducted, Consolidated Edison and PASNY committed to perform plant modifications upon the recommendations of NUREG-04603 to reduce ATWS tisk. Event tree 13 represents the plant response after the modifications ate in place. Recently, Consolidated Edison and PASNY i have decided to delay their commitment to the ATWS modifications and thus the event tree must be significantly modified. Because of this, IPPSS personnel ate constructing a new event tree. The impact on the core melt and plant damage state frequencies by not install-ing ATWS modifications at Indian Point is investigated in Section 4.4. REFERENCES
- 1. Genet ic Evaluation of Feedwater Transients and Small Break Loss of Coolant Accidents in Westinghouse Designed Operating Plants, NUREG-0611, January 1980.
l 2. Indian Point Unit 2 Final Safety Analysis Repott, AEC Question 6.5, Consolidated Edison Co.
- 3. Anticipated Ttansients Without Sctam for Light Watet Reactors, NUREG/CR-0460, March 1980.
- 4. Response to Sandia Lettet Report of September 1, 1982 on the IPPSS, Octobet 1, 1982.
] 2.2-7
2.3 Mitigating Systems Success Criteria In response to LOCA and transient initiating events, vatious Indian Point cote cooling and containment systems are called upon to bring the plant to a safe shutdown condition. If cote cooling is unsuccessful and a core melt ensues, the containment systems may still be able to teduce the consequences of the accident by main-taining the containment boundaty and thus isolating the core melt from the envitonment. The combinations of plant systems required to co.)1 the cote and maintain the containment boundary constitute the Indian Point mitigating system success ctitetia. We have reviewed the validity of the success critetia employed in the IPPSS. We have judged the success criteria to be consistent with critetia employed in PRAs of similat p la n'. s . Table 2.3-1 summarizes the LOCA and transient success etitetia employed in the IPPSS. The IPPSS did not employ the containment ovetpressute ptotection success critetia stated in the FSAR. The FSAR critetia is 2/2 sprays OR 5/5 fans OR 1/2 sptays and 3/5 fans. The FSAR critetia applies to keeping containment pressure below the design pressure. The IPPSS does not employ the consetvative FSAR ctitetia and appatently employs a more realistic criteria. We found no tefetence in the IPPSS fot the critetia used. Howevet, the IPPSS critetia employed is supported by analysis of the Oconee contain-ment systems as part of the Reactot Safety Study Methodology Applications Ptogtam.1 In that study it was shown that one fan or one sptay, which had similar heat removal capabilities as Indian Point, adequately maintained the containment pressure within acceptable limits. Since both Oconee and Indian Point have similat MW tatings and containment volumes and design pressures, it is judged that the IPPSS ctiteria is reasonable. We could not find in the Indian Point FSARs an explicit statement of the cot e cooling success cr iter ia in response to the full tange of potential LOCA break sizes and transient initiating events. The IPPSS apparently made use of some Westinghouse docu-ments and the FSAR in establishing the critetia employed in the tepott. (The FSAR " toughly" defined a critetia which was similar to that used in the IPPSS.) The IPPSS gave credit fot " feed and bleed" cote cooling during transients and small LOCAs following failute of the auxiliary feedwatet system. Feed and bleed cooling is still an open question (see Section 4.3), but recent tests at the LOFT facility have suggested that it is a viable core cooling option. Though we could not validate the entire cote cooling success critetia employed in the IPPS, it is out opinior that it is teasonable since it is similar to that used in othet PRAs with which we ate familiat. In addition to the major cote cooling and containment system succens critetia discussed above, the IPPSS developed a vatiety of 2.3-1
i i 1 ) support system sercess criteria. These support systems must succeed to allow successful operation of the core cooling and
- containment systems. Support systems include pump cooling systems, electric power systems, and the plant operators. The support system criteria which influenced the IPPSS results the most are listed in Table 2.3-2. We reviewed these criteria with the aid of FSAR and previous PRA analyses and found them to be either realistic or conservative.
REFERENCE l 1. Reactor Safety Study Methodology Applications Program: l Oconee #3 PWR Power Plant, NUREG/CR-1659, May 1981. i i I i r I i
-2.3-2
) __ _ _ - - . _ . _ . . = . . - _ _ . - - . _ . _ _ _ . _ . _ _ _- _ , . -_ _ _ _ _ . - _ . _ _ _ _ _ . _ _ _ .
Table 2.3-1 IPPSS LOCA and Transient Mitigating System Success Criteria LOCA SIZE Emergency Emergency Containment Core Cooling Core Cooling Overpressure Radioactivity l Early (RWST) Late (SUMP) Protection Removal 0-2" 1/J Safety Injection 1/3 SI and 1/2 Containment Spray 1/2 Containment ! Pumps (SI) 1/2 RHR Pumps Pumps Spray Pumps and 1/3 Auxiliary OR OR Feedwater Pumps 1/3 SI and 3/5 Containment (AFWS) 1/2 Recirc. Fans O R, Pumps 1/3 SI and 2/2 PORVs 4-6" 4/3 SI and 2/3 SI and Same Same 1/2 RHR Pumps 1/2 RHR OR 2/3 SI and 1/2 Recirc. Pumps
>6* 3/4 Accumulators 1/2 Recirc. Same Same and 1/2 RHR Pumps Pumps OR 1/2 RER Pumps Steam 1/3 SI and Same Same Gener- 1/2 RHR ator OR Tube 1/3 SI and 1/3 SI and Rupture RCS Depressurization 1/3 Recire. Pumps i TRANSIENTS Emergency Core Emergency Core Containment Padicactivity Cooling Early Cooling Late Overpressure Removal (Seconuary or RWST) (Secondary or SUMP) Protection 1/J AFWS 1/3 AFWS 2!! SLR 1/3 SI arid 2/2 PORVs 1/3 SI and Same Same 1/2 RHR l OR 1/3 SI and l.
1/2 Recirc. 2.3-3 t I
Table 2.3-2 Important IPPSS Support System Criteria d i Major System / Support System j Components Support System (s) Criteria l l l Safety Injection Component Cooling Operating pumps will fail in 5 minutes if CCW [ and Water System (CCW) is not supplied to oil coolers. Charging Pumps I Containment Fan Service Water and Fans coolers cannot prevent a containment ) Coolers Electric Power overpressure if support systems do not succeed within 3 hours. , Core Cooling Electric Power and/or Following a transient initiating event these , Systens Operator Action core cooling support systems must succeed within one hour to prevent core melt. w Reactor Coolant CCW or Seal Failure of these RCP seal cooling support A Pumps (RCPs) Injection System systems will cause a 300 gpm LOCA per RCP after 30 minutes. Recirculation and CCW and Service CCW pump operation is not required during
- ! Residual Heat Removal Water the injection phase following a LOCA as long Pumps as the CCW water is available as a heat j sink. CCW pump operation and service water cooling of CCW is required during the j recirculation phase.
j t
b 2.4 Review of the IPPSS Fault Trees for Indian Point 2 and 3 The system fault trees ptesented in IPPSS Sections 1.5 and 1.6 (for Indian Point 2 and 3, tespectively) were reviewed for accutacy and completeness. The findings of thin review are ptesented in Sections 2.4.1 and 2.4.2 for Indian Point 2 and 3 tespectively. In Section 2.4.3 we compate out tevised system unavailability estimates with estimates fot similat systems given in othet PRAs and NUREG/CR2497.1 2.4.1 Fault Trees of Indian Point 2 Section 1.5 of the IPPSS presents the systems analyses fot the Indian Point 2 teactor. The teview of these analyses is presented below. Unless othetwise noted, system failure probabilities cited herein ate for the case of all power available, which is of ptimary concern except for a few systems. By the natute of the review, only those areas of disagreement are discussed. 2.4.1.1 IP-2 Emergency Electr ic Power System Fault Tree The emetgency electtic powet system fault tree fot IP-2 was extensively reviewed, in patticular its intta-actions among its AC, DC, and auxiliary constituents. Sixteen different fault trees for i the system were examined in the analysis, one for each " power state," with each state being defined as having powet eithet avail-able ot unavailable at four 480V busses. Only eight powet states
- were actually used because two of the four busses are tied together.
t In the teview, a simplified power dependency fault tree was ! consttucted for each of the fout busses to ascertain the subtle AC and DC interactions. Fot example, each bus can be powered by a diesel generatot (two busses ate powered by one) which then requires DC control power and a fuel oil pump, etc. These trees wete then compared to the analysis presented in the IPPSS. No disctepancy was found. (It must be noted, howevet, that not all of the electr ical system dependencies are modeled in the electrical system fault trees. Specifically, service water cooling of the diesel generators is omitted here. This results from the methodology employed in the IPPSS wherein the failute probability of the service water system (as well as other systems) is computed conditionally, that is based on the electric power state. This can be cumbersome and confusing initially but presents no great ob stac l e in understanding the analysis). In addition to the system interactions, three additional, specific items were investigated. The first was the handling in the analysis of the combinations of signals which could be present with an initiating event. These signals are safety actuation, under-voltage, and reactor trip. Various combinations of these signals strip emergency loads from the busses which then must be teloaded. The IPPSS cites the emetgency procedures which address this and 2.4-1
includes as a failute, the failute of the operator to teload. Furthetmore, the combinations of signals which cause the stripping appeat to have been modeled properly. The second specific issue examined in the review was that of multiple invetter failures. Lightning strikes at several plants have caused such failutes, and the IP-2 electrical system was studied to ascertain if it could be a potential problem. To fail a single invettet in this fashion at least two separate circuit breakets would have to fail to open on the power surge. In addi-tion, the diver sity of instrumentation for ESF actuation and the . tedundancy of instrumentation among the fout inverters indicate that l simultaneous fallute of at least six circuit breakers would be i necessat y to cr eate a potential pr oblem. Unable to find common cause data for such, we feel that this has probabilistically negligible impact on the tisk from IP-2. The third specific issue addressed in the review was that of common cause failures of the three diesel generatots. An Oak Ridge study 2 as part of TAP-A44 derived a " genetic" probability for common cause diesel genetator failute of 7(-4) fot two diesel j generators and 2(-4) for three, with both data for those diesel 3 generatots requiring cooling watet. No comparable common cause i values ate found in IPPSS. With the application of the genetic common cause values to the IPPSS unavailabilities, the system failure ptobabilities increase by about 50 percent ot less: Condition IP-2 Value IP-2 Value w/ Common Cause Failute of 2 DGs 1.4 (-3 ) 2. l (-3 ) Blackout 6.2(-4) 8.2 (-4) Thus, the onsite AC analysis appeats to be reasonable. In addition to the three diesel generatots, the IP-2 emetgency power system has three gas turbines available. Although we feel that the IPPSS gives too much credit to recovering failed diesel generators, the recovety analysis is relatively insensitive to such tecovery because of the presence of the gas turbines. 2.4.1.2 IP-2 Reactot Ptotection System Fault Tree The fault tree for the teactot protection system (RPS) of IP-2 was teviewed and found to be acceptable, except that the test and maintenance pottion of the analysis appeats to contain an ettor. Howevet, its numetical significance is negligible. The mean failute probability of the system is given as 2.01(-5), and this is compt ised mainly of the three contr ibutors: tandom hardware failures of two trains of the trip system with a proba-bility o f 9. 6 (-6) , failutes in test and maintenance with a proba-bility of 6.2(-6), and failure of the rod control cluster assemblies 2.4-2
to enter the core with a probability of 3.8(-6). It must be noted that the analysis presented does not address manual scram. This is important because, although the first two failure mechanisms above are recoverable by the operator pushing the scram button, the third one is not, and it represents 19 percent of the total. The probability for the rod control clusters failing to enter the core is derived from industry data and appears to be conserva-tive. The event is failing to fully insert and no attempt is made to analyze the difference between, eg, 90 percent insertion and 0 percent insertion. Both are considered to be system failures. The random hardware failures in two trains consider shorting to power and ground, reactor trip or trip bypass breakers failing closed, and relay and logic matrix failures. This particular portion of the analysis follows that of WASH-1400. The test and maintenance part of the analysis uses actual plant experience to determine the mean outage times for a train, and then this data was "ANDed" with random hardware faults in the other train. Finally, the value was doubled to account f or either t rain undergoing the T&M. The problem in the analysis arises with the description used for the random hardware faults of one train with the other in T&M. In this case, only the probability of shorting to ground was considered although other failure mechanisms are pos-sible. The logic matrix and relay failures contribute the same here as they do for the above two train case. However, for the T&M situation, both the reactor trip and bypass breakers would have to fail closed concurrently to cause the operating train to fail its function (see IPPSS Figure 1.5.2.2.2.-3) whereas above, the failure of either would cause train failure. It is fortunate for IPPSS that these ignored failure modes have negligible ( < l percent) contribution to RPS failure. Nevertheless, the description in Section 1.5.2.2.2.4.3 is wrong. The common cause portion of the analysis uses the probability of a single instrument channel failing as the common cause miscalibra-tion probability of a set of instruments. This approach may or may not be conservative because the calibration procedures do not appear to have been thoroughly analyzed. It must be noted, however, that the RPS has considerable diversity and redundancy in instrumentation and further that, should the common cause probability used be low by as much as an order of magnitude, the overall RPS failure probabil-ity would increase by less than 25 percent. Furthermore, the RPS failure probability derived for IP-2 compares favorably with that given in NUREG-0460, 3(-5), as a generic PWR RPS unavailability datum. 2.4.1.3 IP-2 Safeguards Actuation System Fault Tree The analycis of the IP2 safeguards actuation system is separated into two parts: safety injection (SI) and containment spray (CS) actuations. The analyses of both contain assumptions which could affect the unavailablity values presented in the IPPSS. 2.4-3
- _ -. _ -. . - _ _ _ = . - . -_- .
i Manual actuation is explicitly excluded.ftom the fault tree l analysis (but is considered at the event.ttee level). This exclu-sion at the fault tree level could pose ptoblems because different size LOCAs would result in different sets of actuation instrumenta-tion initiating the system (e.g., for many plants, high building pressute would not actuate high pressute injection for small LOCAs as soon as needed). At IP-2, however, the same set of parameters, in general, cause actuaton for all LOCAs. This is due to the tela-Lively low trip level (2 psig) for the high building ptessure sensors. In response to NRC questions on the IP-2 FSAR, the plant demons tr a ted that the building sensors would actuate before the pressurizer would empty for various LOCA sizes. , Test outage time is analyzed consetvatively in that the channel I undergoing monthly testing is assumed unavailable fot the entite ! test duration (1 to 6 houts). The channel, howevet, is not unavail-able for this entite period, and, even if it was, the tester could quickly switch it to the operating mode. (It should be noted that cut sets with a channel unavailable due to testing dominated the system failute probability.) The common cause value described in Section 1.5.2.2.3.4 is based on the value of a single instrument channel failing which is then 1 used as the ptobability of common cause miscalibration of a set of instruments. This value may ot may not teptesent such a failure possibility because the calibtation procedures do not appeat to have been closely examined. In past PRAs (e.g., ANO-1), howevet, such miscalibtation has been found to be of small importance. The possibility of failure to testore the channels aftet testing is not adequately addressed in Section 1.5.2.2.3.4.6. While i testctation following the monthly tests is discussed (and the analysis is cottect), testoration following tefueling outage tests is not analyzed. That is, no mention is made of the common cause human ettot that occutted at the Hatch teactot whetein the building pressute sensots were not restoted following the dead-weight testing petformed during the refueling outage. In discussions with the IPPSS analysts, we discovered that they had, in fact, considered such a failure to testote for the sensors. They had detetmined that this was of negligible probability at the IP plants because of the procedutes, and we concut with theit assessment. ~ The two subsystems (SI and CS) share common instrumentation for the sensing and amplifying of the teactot building atmosphere pressure. The bistables and logic are different. In addition, the actuation of the coolant injection pumps by low teactot coolant pressure is totally separate from the CS system. That is, the l equipment teceiving the SI signal is actuated by redundant patametets so that the IPPSS analysis of operating the SI and CS actuation systems is acceptable. 2.4-4 I
In conclusion, IPPSS should have analyzed the possibility of sensor miscalibration in more detail, but such an omission is assessed to be of negligible import for two reasons. Miscalibration in actuation systems has been found to be less probable than other system failure modes in the past, and secondly, the testing conserv-atism employed in the IPPSS analysis results in a conservative failure description of the system. 2.4.1.4 IP-2 High Pressure Injection System Tault Tree The IP-2 high pre ssure injection (HPI) system fault tree was reviewed, and problems were encountered with the IPPSS analysis. This is quite important because in one operating mode or another HPI is part of every IPPSS event tree except ET1, the tree for a large LOCA initiating event. Following are comments regarding the system in general after which the medium and small LOCA success criteria cases will be examined. The system is analyzed by segmenting it into " supercomponent s. " Supercomponent A (see IPPSS Figure 1.5.2.3.1.-3) is the HP suction line from the RWST and consists of three valves (see Figure 1.5.2.3.1-4): manual valve 846 which is locked open, motor-operated valve 1810 which is deenergized open, and check valve 847. The first of these, 846, should not be a part of this tree, given the structure of the IPPSS event trees, because it is not unique to this system. This valve is also in the suction line to the LP pumps and is thus common to both systems. Therefore, for the situation where both the HP and LP injection systems are required, the handling of this valve in the IPPSS analysis results in accounting twice for the failure probability of valve 846. (Its failure probability is given as 2.64(-5) on p. 1.5-479.) The only event tree thus affected is that of the medium LOCA, ET2. At the given failure probability for valve 846, the effects of this error are slight because, as shown below, it is but a small contributor to the overall system failure probability. It must be noted that although valve 846 is not alarmed, it is open with its handuheel removed and is on the startup and monthly check-off lists. In addition, in supercomponent A, MOV 1810 not only is deenergized open, but its position is tested monthly as part of the HP pump test. As with all MOVs in engineered safety systems, its position indication is given in the control room, and is alarmed should its position be "off normal." (The indication circuit and the deenergized open circuit are parallel so that the deenergization does not inhibit position indication.) of more significance is the modeling of supercomponents B, C, and D which contain, respectively, pumps 21, 23, and 22. The latter is the swing pump and can inject water into either injection path 15 or 56. The analysis of supercomponents B and C appears to be cor-rect but that of D does not. As stated in the IPPSS, MOV 851A, which connects pump 22 discharge to header line 56, will close if 2.4-5
pump 21 fails. Similarly, MOV 851B, which connects pump 22 discharge to header line 16, will close if pump 23 fails. This cction of the two valves is not explicitly modeled in the fault tree. It appears to be ignoted in the medium LOCA case and
" conservatively" analyzed for the small LOCA case. That is, for example, the analysis of the HP system for responding to a small LOCA initiating event uses the success criterion of 1-of-2 pumps, although three ate actually in the system. The two valves which connect. pump 22 to the discharge paths are assumed to fail closed.
Although IPPSS states that doing so results in a conservative analysis, we do not believe this is the case. Other failure mech-anisms of the system were missed. On p. 1.5-483 of the IPPSS, it states that ". . . the procedures of the monthly and quarterly tests appear to minimize human error. . . . " We feel that this is not the case because the pump tests are not staggered and are, in practice, performed by the same peoole on the same day. Thus, we feel that there is a strong human error dependency possible for this system. Because of this testing policy, common mode failures needed to be examined in this review. The literature was searched, and a repor t by Corwin Atwood (EGG-EA-5289) 3 on the historic G-f actor associated with pumps in the nuclear power industry was used in the review. The draft of the precursor study was also examined, and the HP failutes presented there are apparently accounted for in the Atwood work. (This appears to be true for the pumps of other systems as well.) TwoadditionalcommonmodegossibilitieswereexaminedintheHP review. A review by Brookhaven discovered two common mode fail-ures of the HP pumps at IP-2, both due to loss of suction. The first occurred in 1974 and was the tesult of precipitation of boric acid crystals through two parallcl valves from the boric acid tank. The second occurred in 1976 when, at shutdown, the pumps were tested with the common RWST suction valve closed. We discussed these events with the IPPSS analysts and assessed that these specific problems had already been rectified. The first incident resulted in a change of equipment and procedures, and the second in procedures alone. In fact, it is because of this second incident that the handwheel of valve 846 is removed, aftet opening, and MOV 1810 is deenergized open at a startup from a refueling shutdown with subsequent testing of the HP pumps. HPI for Medium LOCAs Event tree ET2 requires HP1 with success criteria of two of three pumps injecting into two of four headers. (Header lines 16 and 56 mentioned above split into two headers each.) IPPSS calcu-lates an unavailability for this system mode as 4.l(-4). The analysis allows for dependence among the pump trains by adopting a subjective B-factor of 0.014. As described above, literature was 2.4-6
seatched by us to determine the applicability of this value. Data ptesented in Atwood indicate that, for failutes and command faults for ESF standby pumps, a 0-factot of 0.158 should be used for a system which tequites two of three pumps to operate and has monthly testing. With the application of the above 3-factot to the pump train failute ptobability of 7.02(-3) given in the IPPSS, the system unavailability is recomputed to be 1.3(-3). This ptobability is potentially nonconsetvative for three reasons. Fitst, the dependency parameters taken from the tefetenced teport by Atwood are medians, not means, and hence the data pre-sented biases the results obtained to the low side. The distribu-
- t. ion of the data, however, indicates that the means and medians are quite close. In addition, the 8-factor is a ratio of common mode l fallutes to all failures, and as a ratio, the median-mean diffetence
! is less. Secondly, the data given in Atwood are taken ftom the whole nucleat industry, not just from IP-2. Hence, fot example, the ef fects of staggeted and nonstaggered tests ate included while IP-2 does not stagget tests, as noted above, and might therefore have stronger dependencies among the pump trains. We feel, however, that the IP-2 situation is adequately teptesented with the use of the genetic data. Thirdly, the use of a 0-factor tends to make the ettot in modeling supercomponent D (the automatic closure of valves) less significant, but it does not eliminate the etrot. Howevet, because the IPPSS did not considet operator actions to recovet the problem and it is recovetable, this review did not examine the problem futther. That is, the recovery of the valve fault by the operator would give it a negligible failure contribution to the system failure ptobability. HPI for Small LOCAs Event tree ET3 tequires HPI with success criteria of one of three pumps injecting into one of four headers. In addition, this model is part of evety othet event tree analyzed except for ETl and ET2. For event Ltees ET4, ET5, and ET6, the model is a part of SA2, safety actuation and high-head injection. For event trees ET7 thtough ET12, it i-s part of event OP-2, operatot establishing feed and bleed. Fot the ATWS event tree, ET13, it is part of event OP-5, manual actuation of feed and bleed with emergency boration. IPPSS attempted to conservatively analyze this HPI success l criteria case. The analysis considered a one of two pump situation l and thetefore sLtove to ignore the problem with the modeling of l supercomponent D. Howevet, hete IPPSS used no S-factor, ie, they l assumed that thete was no dependency between the two pump trains wheteas for the medium LOCA model there was dependency: The failure ptobability for the one of two cases is given as 1.86(-4). This teview used data from the Atwood reference to determine that, genetically for this type of system, a dependency among all thtee pump trains exists such that the genetic failure probability l l l 2.4-7
for all three trains is 3.6 (-4), and the genetic failure probability for one train is 3.2 (-3) , which yields a B-factor of 0.111 for this system alignment. With the use of the common cause probability, and the changing of the one of two situation to a one of three situation on,p. 1.5-486, the system failute probability becomes 9.2(-4). 2.4.1.5 IP-2 Low Pressure Injection System Fault Tree The IP-2 low pressure injection (LPI) system fault tree was '
.teviewed, and the only majot difficulty encounteted with the model was that of the common cause value used in the analysis. Of minor import, manual valve 846 is considered an unique part of the LPIS, (
but as discussed in Section 2.4.1.4 of this report, in reality it is ( not. However, the only event tree this ertot affects is ET2, and the probability of both the LPIS and HPIS failing is overestimated by 2.6 (-5) in the IPPSS. The LPIS fault tree is also used in event tree ET1, which is initiated by a large LOCA. As fat the HPIS, the LPIS is divided into supercomponents for the purpose of analysis (in fact, this method is used in the IPPSS for all fluid systems). The analysis considered common cause fail-ures between supercomponents B and C, containing RHR pumps 21 and 22 respectively, and supercomponents E and F, containing motor-operated valves and heat exchangers 21 and 22 respectively. As for the HP analysis, a 0-factotof 0.01 was subjectively assumed. Super-component B(C) was computed to have a failure probability of 6.5(-3), and E(F) , a failure probability of 2.3(-3). Hence, with the use of the 0.01 0-factor, the probability of failure for the Boolean combination of (B AND C) OR (E AND F), which becomes (BB OR GE) , was calculated to be 1.23(-4). Ovetall, the LPIS has a failure ptobability of 8.7(-4). (It should be noted that motor-operated valve 882, which is deenergized open and is a suction valve common to both pumps, contributes 4.9(-4) of the total. MOV 882 is veti-fled open only at refueling outages. If IP-2 al tered its testing, the fault exposure time of this valve could undoubtedly be significantly reduced.) As fot the HPIS review, the pump common cause data presented compiled by Atwood were used to determine the applicability of the 0.014 value. In fact, the failure and command fault probability for two pumps in an ESF standby system requiring one of two to operate for success and having monthly tests was found to be 5.7(-4) and the failure of one pump, 3. 5 (-3) . This suggests a 0-factor of 0.165 which is more than ten times greater than that used in the IPPSS. This B-factor was applied to the pumps in the IPPSS analysis and tesulted in a system unavailability of 1.5(-3). 2.4.1.6 IP-2 Accumulator System Fault Tree The fault tree consttucted for the IP-2 accumulatot system was
#ound to be correct.
2.4-8
l 2.4.1.7 IP-2 Recirculation System Fault Trees The hardware portions of the recirculation systems analysis were herein reviewed. The human error contributions, which in the IPPSS are the dominar.t causes of failure, are examined in Section 2.5 of this report. .n the IPPSS, there are three types of recirculation considered: high pressure, low pressure, and containment spray. High Pressure Recirculation (HPR) The mean failure probability for this system is calculated as 6.8(-4) in the IFPSS of which 3.9(-4) results from human error and 2.9(-4) results from hardware failure. For HPR, either the recircu-lation or RHR portion of the LPRS must be operating as well as component cooling water. These dependencies are explicitly modeled on the fault tree. In fact, the presented fault tree is quite comprehensive. However, the computation of system unavailability does not use the presented fault tree. Rather, conditional prob-abilities were calculated for the system based on whether or not the containment fan system (hence, service water which cools the fan coils and component cooling water) is working. This analysis was modified by the IPPSS analysts. The modification did not result in any significant differences in the risk. The analysis presented in the IPPSS explicitly models the common cause failure possibility among the HP pump trains but, inconsis-tently, ignores it for the recirculation and RHR pump trains. As will be shown below, we believe a better estimate for the LP hard-ware portion of recirculation (either through the RHR or recircula-tion pumps) is 6.0(-4), and this includes common cause failures. Thus, we need here to only reestimate the HP portion of the system to yield a failure probability for HPR. The equation given on p. 1.5-591 of the IPPSS was used to quantify the hardware faults (ie, the first, second, and fourth terms, which are human error related, are omitted here because the human error portion is analyzed in Section 2.5). The B-factor used for the pumps was taken from Atwood, and that for the valves was assumed to be 0.1. Thus, the total HPRS hardware failure probabil-ity is calculated to be 1.2(-3). As shown in Section 2.5, the human error contribution is insignificant, and thus the total unavailability is 1.2(-3). Low Pressure Recirculation (LPR) The failure probability for LPR at IP-2 is given as 5.5(-3) of which 5.3(-3) is due to human error. Table 1.5.2.3.4-18 of the IPPSS gives the dominant failure modes of the system. Here the recirculation pump trains have a 0-factor assigned of 0.014 whereas for HPR above, they had none. Also the table is noteworthy for the absence of the RHR pumps failing. Rather, the constructed model assumes, and the results in the table show, that should the recircu-lation pumps fail, the only failure in establishing RHR flow is the 2.4-9
failure of the operator to initiate the switchover from the recirculation to the RHR pumps. A probability of 0.26 is assigned to this, but the fact that the RHR pumps themselves could sub-sequently fail is neglected. It must be noted that the RHR failure probability is significantly less than 0.26, but the description should have stated why it was being ignored. To reestimate the probability of this system failing, B-factors of 0.165 and 0.1 were used for the pump trains (both recirculation and RHR) and valve sets, respectively. The former is that used for the LPIS review (see Section 2.4.1. 5) , and the latter is a sub-jective estimate on our part. Then, the failure probability for the LPRS can be expressed as: 0= (Sto recirc +O02 ggy) (310RHR + O ggy +O ggy + 0.20 pumps 1802A,B pumps 885A,B 1805
+
20ggy 822A,B where St is 0.165, 02 is 0.1, and tne failure probabilities for the others are taken directly from the IPPSS analysis (except the probability of the 885A,B valves failing are multiplied by 0.1 to allow for recovery by the operator because they are outside contain-ment). This results in a hardware unavailability for LPR of
- 6. 0 (-4) . (It must be noted that the above equation assumes that 01 Sjoi, which in this case, it is.) The human error in failing to go to recirculation for a large LOCA is shown to be 2(-2)-
in Section 2.5. Thus, the total LPR cystem unavailability is
- 2. l (-2) .
Containment Spray Recirculation (CSR) The failure probability of the CSRS is estimated in the IPPSS as 1.5(-3) of which 99 percent is human error. The only other failure possible, given that LPR is working, is for two motor-operated valves (8 89 A , B , see Figure 1.5.2.3.4-6) to fail closed. IPPSS evaluates this with its B-factor of 0.014 which results in a hard-ware contribution of 3.7(-5). If the 0.1 0-factor is used, this hardware contribution increases to 2.3(-4). However, as stated in Section 2.2.1, neither the IPPSS or we gave credit for the CSR in the analysis. 2.4.1.8 IP-2 Containment Spray Injection System Fault Tree The fault tree for the IP-2 containment spray injection system is inconsistent with the analyses of the other systems. Section 1.5.2.3.5.4.1.3 fo the IPPSS states: " Common cause failures of the same type of component in differenet trains could occur, but the probability in a standby system that is tested monthly and can be maintained during reactor operation is judged to be very small.... 2.4-10
Therefore, no common cause contribution has been assigned to this system." The standby condition and the test and maintenance characteristics of the CSI pumps are no different than those of the HPI and LPI pumps. Thus, the cited IPPSS statement is inconsistent with other IPPSS analyses. Other than the common cause discrepancy, the CSI systems analysis appears to be correct. Hence, the test of this section shall examine the effect on the system unavailability of including pump common cause failure considerations. IPPSS gives the CSIS unavailability as 7.5(-5) (sic) with random hardware failutes contributing 5. l (-5) , mai'ntenance on one train with failures in the other contributing 1.l('-5), and operator error in not restoring from a test condition contributing 1.4(-5). (Unavailability due to testing itself is several orders of magnitude lower.) The derivation of the latter two values appears to be correct, but the neglecting of the pump common cause failure pos-sibility makes the first value suspect. The failures of a spray pump to start and to run for two hours, given a start, is given as 6.5(-3). For a pump train, this value increases to 6.9 (-3) . Thus, the probability of tandom hardware failures of both trains is 5.5(-5) (not the 5.l(-5) given in the IPPSS). As presented in Section 2.4.1.5 of this report, for two pumps in standby, the generic a-factor for a 1 of 2 pump system in standby is 0.165. With the use of this common cause factor, the system failure probability becomes 1.2(-3), a factor of sixteen higher than that repotted in the IPPSS. 2.4.1.9 IP-2 Containment Fan Cooling System Fault Tree The fault tree constructed for the IP-2 containment fan cooling system is cottect, given the assumptions used in the analysis. Three assumptions could alter the calculated system unavailability, two of which would decrease the value and one of which, increase it. Of the former type, the success criterion assumed in the analysis is that of the IP-2 FSAR, that three of the five fan cool-ing units must operate to achieve system succsss. Other PRAs (such as ANO-1) have found that the success criteria for fan systems which are reported in safety analysis reports can be conservative, instead of tealistic (see Section 2.3). Hence, the calculated fan system failure ptobaility may be conservative. The second conservative assumption is that the analysis does not give credit for manual actuation of the system; only automatic actuation is considered. Because of the telatively long time available for operator recovery actions to testore system function and prevent containment over~ ptessurization, manual actuation is viable. Failure of automatic actuation, however, is a small conttibutor to the overall system ! unavailability. I 1 2.4-11 l L
The assumption which is potentially nonconservative is that the charcoal filter beds will not plug with airborne debris during the course of the accident. This assumption has been made in other PRAs (again, such as ANO-1) but has been a subject of sensitivity studies in them because the phenomenology is not currently well-defined. The sensitivity of the overall risk to this assumption was not done in IPPSS, but is investigated in Section 4.2 of this report. 2.4.1.10 IP-2 Component Cooling Water System Fault Tree The component cooling water (CCW) system at IP-2 is capable of cooling any heat source by water discharged from any pump. That is, the system is totally headered together. Also, during normal operation, two of the three pumps are running. The IPPSS gives the failure probability for CCWS as 1.0(-5) for the power condition of all busses available, 6.l(-4) for the condi-tion of 1 bus lost, and 6.5(-3) for the condition of power at two busses lost. The first case is for the situation in which the CCW pumps, which were operating prior to the initiating ' event, do not trip because of the initiating event. The last two casco are for the situation in which the CCW pumps are tripped as a result of the initiating event. Either loss of offsite power or a safety injec-tion signal will cause the pumps to be tripped and then sequentially loaded. An area of disagreement is that common cause effects are assumed to be negligible, which makes the CCWS analysis inconsistent with the rest of the IPPSS. Generic common cause data (Atwood, EGG-EA-5289) were again examined. For pumps such as those in the CCW, the data suggest a common cause B-factor of two of three fail-ing to start of 0.079 then failing to rurs for 24 hours of 0.091. In addition, for the failure to start and then run for 24 hours, the data suggest 0.041 for the common cause 3-factor for a one of three pump system. Both values are needed to review the CCWS because, without pump trip, two CCW pumps will continue to operate and, with pump trip, one of three is requied to start and operate. In the former situation, should both pumps fail, then the third is required to start. IPPSS gives the failure probability for this third pump as 6.54 (-3) . The equation presented on p. 1.5-786 of the IPPSS can be used to evaluate the pump failure contributulon to system failure for the various situations. (For all power conditions and initiating events, the remainder of the CCWS contributes 5.7 (-6) to the overall , failure probability). With the use of the above information and the IPPSS equation, the overall system unavailability, for the case of no pump trip and power available at all busses, is 6.3 (-6) , not the
- 1. 0 (-5) presented in the IPPSS. (It appears that failure to start 1
2.4-12
data was used instead of failure to run.) For the situation with pump trip and power available at all busses, the system unavailability is reestimated to be 5.9(-4). For the situation where the pumps trip and power is lost to one bus, the equation on p. 1.5-789 can be used to determine pump train contribution to system unavailability. With the use of the above common cause datum, the CCWS failure probability for this case is estimated to be 6.l(-4) which is the same as that reported in the IPPSS. For the situation of pump trip and power available to only one pump (loss of pour to pumps 22 and 23 is the worst cause because they are powered by the same diesel generator), the pump failing to start or to run is G.54(-3) which is the value reported by the ! IPPSS. However, for this bounding condition, they did not add in l the unavailability of pump 21 due to maintenance which is 1.39(-3) l as reported ou p. 1.5-776. Therefore, for this last situation, the system unavailability should be 7.93(-3). 2.4.1.11 IP-2 Service Water System Fault Tree The service water (SU) system consists of two subsystems, each having three pumps: the nuclear header and the conventional header. Each subsystem is completely headered together so the analysis complications are lessened. The analyses of both were reviewed and found suspect in certain respects. Success of the system is defined as two nuclear header pumps operating and one conventional header pump. (In the analysis of the loss of offsite power initiating event, IPPSS committed two mistakes. First, they kept to this success criterion although all three diesel generators can be cooled by one nuclear header pump, and secondly, they added the two subsystem unavailabilities together whereas the diesel generators do no require cooling at all from the conventional header.) i IPPSS gives the unavailabilities for the two subsystems as Nuclear Header Power Condition Two Pump Case One Pump Case Conventional Header All Power 2.4(-4) 4.6(-5) 5.4(-6) Available Power Lost at 1.8(-2) 7.8(-5) 5.9(-4) 1 bus Power lost at 1.0 7.0(-3) 7.9(-2) 2 busses t l Two problems arise from the analysis. First, the three gates to the intake structure are assumed to fail, by plugging, completely independently, of each other. (It should be noted that the SW pumps . normally take suction from only one, but upon a safety actuation l l l 2.4-13
signal, the other two have doors which are to open for the SW pump suction.) Secondly, common cause failures among the pumps of each of the two subsystems are assumed to be neglibible. As to the former concern, IPPSS uses a mean probability of the intake screen plugging of 2.66(-5) per hour and then combines this with the failure of either of the two doors to open or plugging of the screens of the other two intakes. All of these failures are assumed to be independent of each other, and the intake structure unavailability is estimated to be 6.0(-10) over the 24 hour period of the accident. The visit to IP-2 revealed that the three screens are side-by-side, each about 20 feet in width. They are cleaned daily, in succession. Because of their proximity and the sequential cleaning routine, it is felt that a strong dependency exicts among the three screens. NSIC data were reviewed to ascertain if nuclear plants are susceptible to plugging of the service water system. Six possi-bilities were found at Duane Arnold, Hatch, ANO-1 (twice), ANO-2, and San Onofre 1. None of these resulted in complete SWS failure prior to operator-initiated safe shutdown, but the instances do indicate the possibility of a common cause SW failure in the integrity of its source. Thus, it is felt that a B-factor of unity should be assigned to this event with the result that all three screens would plug at a failure rate of 2.66(-5) per hour. However, this failure rate datum is believed to be more appropriate as an initiating event frequency rather than a system failure mode following another initiating event. The operators allowing the ultimate heat sink to plug following an initiating event is unlikely in itself. Even if it should occur, several hours are available to clear the intake obstacle before plant response is adversely affected. Thus, with the recovery potential of such an event this failure mechanism is assessed to be negligible. The second problem with the IPPSS SWS analysis is that it neglects pump common cause failures, which is simply different from industry experience. The common cause data presented in Section 2.4.1.10 are used here. In addition, to compute the various system unavailabilities, the equations presented in IPPSS on p. 1.5-831, 839, and 843 are used as well as the presented data of 6.5(-3) for a pump faiing to start, of 1(-4) for a pump failing to ran for 24 hours, and of 7.0 (-2) for the maintenance unavailability of a pump. It must be noted that the IP-2 (and IP-3) technical specifications require that, if a nuclear header pump is in maintenance for eight hours, the alignment of the conventional and nuclear headers must be switched. Thus, for the nuclear header pump maintenance unavail-ability, the value of 6.4 (-5) is used, which is 7.0 (-2) divided by one year and multiplied by eight hours. The results are shown below. 2.4-14 l _ , l
Nuclear Header Power Condition Two Pump Case One Pump Case Conventional Headet All Power 5.l(-4) 2.9(-4) 7.8(-5) Available Power Lost at 1.8(-2) 3.5(-4) 6.0(-4) 1 bus Power lost at 1.0 7.l(-3) 7.9 (-2) 2 busses Most of the differenences are attributable to the use of the common cause failure values for the intake structute and pumps. Howevet, it should be noted that some differences arise because IPPSS did not include maintenance unavailability of the nuclear header for the eight hours a pump could be in maintenance. 2.4.1.12 IP-2 Auxiliary Feedwater System Fault Tree The fault Ltee for the IP-2 auxiliary feedwater (AFW) system was reviewed and found to be wrong in several instances. However, the ettots found do not significantly affect the system unavailability calculated in the IPPSS as 2(-5) for the all power available condition and 1. 4 (-2 ) for the case of no AC power available. We have two disasgreements with the AFWS analysis. First, although the two motor-driven AFW pumps trip off on loss of suction, the turbine-dtiven pump does not. It runs to destruction in under five minutes unless the operate tr ips it. The IPPSS analysis handles all thtee pumps as being identical in this respect, that, if the condensate storage tank water supply be lost, the operator has 30 minutes to align in the city water supply. No othet human actions ate considered given CST supply failute. Secondly, common cause failures between the two motot-dtiven pumps ate ignoted. As shown in previous sections, this tends to be non-consetvative. (The B-factot method presented by Atwood (EGG-EA-5288) cautions against using the method among dissimilat components, e.g., motot and turbine-driven pumps.) To evaluate the effect of these etrots, a simplified system fault tree was consttucted using the supercomponents identified in the IPPSS and, fot the most part, the data presented there. It was assumed that, if the CST source failed, the tutbine-driven pump would automatically fail with no recovery potential. From the Atwood reference given above, it was determined that the 3-factor for the two motot-driven pumps is 0.204. With the use of these values, the system unavailability was teestimated to be 3 (-5) for the all powet available case and 2. 3 (-2) for the blackout case. 2.4-15
- - _ . ._. _ _ __ ____ _____ x __ __
n
2.4.2 Fault Trees of Indian Point 3
-Section 1.6 of the IPPSS presents the systems analysis for the I- Indian Point 3 reactor . The review of these analyses is presented l below. Unless otherwise noted, system failure probabilities cited herein are for the case of all power available, which is of primary concern except for a few systems. By the nature of the teview, only those areas of disagreement are discussed.
2.4.2.1 IP-3 Emergency Electric Power System Fault Tree The IP-3 emergency electric power system is very similar to that of IP-2. The principal difference is that at IP-3, there is no automatic transfet to a backup DC supply for the diesel generator starting requirements. The review of the IP-3 system was identical to that of IP-2 (see Section 2.4.1.1), and the IPPSS analysis appeats to be reasonable. For example for the blackout case, IPPSS reports a failure probability of 1.0(-3) whereas this becomes 1.2(-3) with the inclusion of'the generic common cause diesel generator failures. 2.4.2.2 IP-3 Reactor Protection System Fault Tree The fault tree for the reactot protection system (RPS) of IP-3 was reviewed and found to be acceptable, with the same reservations as those expressed in Section 2.4.1.2 of this report. The mean system failure probability was found to be 3.93(-5) with the difference between the IP-3 and IP-2 values resulting from the different operational histories of the two plants. For example, the mean test unavailability at IP-3 is given as 8.54(-3) while it is 5.97(-3) at IP-2. Similarly, IP-3 has had far fewer demands of its RPS than has IP-2. (This results not only from the longer operating time of IP-2 but also from the greater number of transients which IP-2 has experienced). As given in the IPPSS, IP-3 has had 0 fail- ures of rod cluster assemblies to fully insert in 1908 demands whereas IP-2 has had 0 failures in 6784 demands. Thus, IPPSS gives the mean probability of this failure at IP-3 as 9. 2 (-6) , which means that at least 24 percent of the RPS failures ate not tecovetable by pushing the manual scram button. 1 2.4.2.3 IP-3 Safeguards Actuation System Fault Tree , l The comments for the IP-2 Safeguards Actuation System Fault Tree, Section 2.4.1.3 of this report, are applicable here as well. 2.4.2.4 IP-3 High Pressure Injection System Fault Ttee The same teservations we expressed in Section 2.4.1.4 about the IP-2 HPI analysis also hold hete for the IP-3 HPI system. The analyses presented in IPPSS Section 1.5.2.3.1 fot the IP-2 HPIS are identical to those ptesented in Section 1.6.2.3.1 for the IP-3 HPIS with the exception of the plant specific data. 2.4-16 n - -- n a _ _ _ _ _ _ _ _ _ _ _ - - _
The failure probabilities presented for the HPIS are 1.8(-4) for the medium LOCA success criter ia and 1.3 (-4) for the small LOCA success criteria. The latter value results almost exclusively from the failure of one of the three valves in the RWST suction line. The pump train failure probability is given as 1.5(-3) for the IP-3 HPIS whereas it was 7.0(-3) for the IP-2 HPIS. Our review again reanalyzed the system failure probability for the two different success criteria, particalarly with respect to pump train dependencies. With the use of the Atwood data (EGG-EA-5289), the recalculated failure probabilities become 4.0(-4) for the medium LOCA model and 3.0(-4) for the small LOCA model. 2.4.2.5 IP-3 Low Pressure Injection System Fault Tree The review of the IP-3 low pressure injection (LPI) system fault tree showed it to be the same as that for IP-2 (see Section 2.4.1.5) except for the handling of common cause failures and the different data used. The failure probability of the LPIS for IP-3 is given as 8.l(-4) in the IPPSS. As to common cause, the. presented analysis simply ignores it which seems to indicate that its omission is an oversight. With the data presented in the IPPSS and the use of the G-factor of 0.165 used by us for the IP-2 LPIS review, the IP-3 LPIS failure prob-ability is reestimated to be 1.2(-3). (It must be noted that motor-operated valve 882, which in the common suction line for both LP pumps and is normally deenergized open, contributes 6(-4) to the system unavailability, or roughly two-thirds of the total. This results primatily because the valve is vetified open only at refueling outages. A change in procedures could surely significantly reduce its fault exposure time.) 2.4.2.6 IP-3 Accumulator System Fault Tree Tne fault tree constructed for the IP-3 accumulator system was found to be correct. 2.4.2.7 IP-3 Recirculation System Fault Trees The same comments made in the review of the IP-2 recirculation system (Section 2.4.1.7 of this report) apply here as well. The differeneces which occur are the result of the different data used fot IP-3 than for IP-2. The failute probability for HPR is given as 4.l(-3) of which 3.9(-4) is operator error and 3.11(-3) is failure of the HP pumps to opetate during the 24 houts duration. However, as is stated in Section 3.3.1 of this repott, we believe this hardware value is false because the IP-3 HP component failure probabilities are a result of overapplication of the data. Thus, we shall use the 1.0(-3) value computed fot IP-2 (see Section 2.4.1.7). Again, for HPR, human ettot was found to be negligible (Section 2.5). 2.4-17 a - _______.______n______ a
For the'LPRS, if the IP-3 specific data is used and applied to the equation given in Section 2.4.1.7, the new estimation for the LPR hardware failure probability becomes 2.7(-4). 2.4.2.8 IP-3 Containment Spray Injection System Fault Tree The comments made for the IP-2 CSIS analysis apply here as well (see Section 2.4.1.8) . The identical rationale for neglecting common cause failures is cited in IPPSS Section 1.6.2.3.5.4.1.3 as in Section 1.5.2.3.5.4.1.3. The system, unavailability is given as 3(-5) (sic) with random hardware failures of the two trains contributing 1.3 (-5) , operator error in restoring f rom test contributing 1.4 (-5) , and one train out t for maintenance with hardware failures in the other contributing 4.5(-6). The human error probability is identical to that used for the IP-2 CSIS analysis, and the maintenance experience of the two plan'ts is nearly so (IP-3 gives a maintenance unavailability of 7.3(-4) whereas at IP-2, the value is 8.l(-4)). The major differ-ence in the two system failure probabilities is in the failure probabilities of pumps failing to start and failing to run for two hours, given start. Here, that probability is 1.4(-3), and for IP-2 4 it was 6.5(-3). Similarly, for a pump train, the IP-3 hardware i failure probability is 3.l(-3) and the IP-2 value was 6.9(-3). If the 5.7(-4) common cause failure probability is used (see Section 2 . 4 .' l . 5 ) , the IP-3 CSIS failure probability becomes 5.3(-4), a factor of more than fifteen greater than that reported. Thus, it would seem that industry experience indicates that pump common cause failures are very important for this system. 2.4.2.9 IP-3 Containment Fan Cooling System Fault Tree The fault tree constructed for the IP-3 containment fan cooling system is correct, given the assumptions used in the analysis. The assumptions are the same as that for the equivalent IP-2 system and are discussed in Section 2.4.1.9. The difference between the calculated fan system unavailabilities fot IP-2 and IP-3 is attributable to different component failure and maintenance histories, as well as differences in actuation, at the two plants. For example, as to the former, valve failure experience is different at the two plants, here specifically'in the air-operated service water discharge valves used in emergency operation. At IP-2, one of this type of valve has failed to open on demand during the history of the plant whereas there have been no failures of this type of valve at IP-3. Hence, two different data were used in the analyses of the two plants. l - 1 2.4-18 m _ -- n ^
! As to the differences in actuation, the safety equipment loads I at IP-2 ate stripped from their busses upon a safety actuation I system whereas they are not at IP-3. Thus, the system unavail-ability at IP-3 is also lower than that at IP-2 because, at the fotmet, the fans do not need to restart. 2.4.2.20 IP-3 Component Cooling Water System Fault Tree The component cooling water (CCN) system at IP-3 is different than that at IP-2 in that the three pumps do not trip off except on a loss of offsite power, and in that event they are each powered by a separate diesel generator. The system is like that of IP-2, how-evet, in that it is totally headered together. (Figure 1.6.2.3.7-4 in the IPPSS is in ettor. It shows valves 766C and D notmally closed when, in fact, they are normally open.) IPPSS gives the failure ptobabilities for the system as ptesented belos (common cause failure is assumed to be negligible): Powet Condition w/o LOP w/ LOP All Power 1.l(-7) 3.0(-7) Powet at 2 busses 1.8(-6) 3.0(-5) Power at 1 bus 8.3(-5) 1.5(-3) Fot IP-3e th3 failute of a CCW pump to statt is 1.44(-3), and the failute of tne pump to run, given start, is 9(-4). Furthermore, the unavailability of a pump due to maintenance is given as 1.84(-2) on p. 1.6-753. With the use of these data, the common cause data presented in Section 2.4.1.10, the equation presented on p. 1.6-762 of the IPPSS and the passive valve failure data given, the CCWS failute probability for the above cases is reestimated to be: Power Condition w/o LOP w/ LOP All Power 1.4 (-5 ) 9.8(-5) Power at 2 busses 2.9 (-5) 4.2 (-5) Power at 1 bus 1.8 (-2) 2.0(-2) The diffetences in our calculations and those of the IPPSS are attributable to out inclusion of common cause effects and theit omission to account fot maintenance for the two cases of power available at one bus. 2.4.2.11 IP-3 Service Watet Fault Tree The service water (SW) system at IP-3 is quite similar to that of IP-2. A majot difference in the two systems is that the SWS of IP-3 has thtee backup SW pumps with a separate intake structure on the discharge canal. Thus, the screen common cause event of IP-2 doec not exist at IP-3. It must also be remembered that a safety actuation signal does not strip loads at IP-3. 2.4-19 s_ ________________ _________ _n . -
~
J IPPSS gives the failure probabilities for the SWS as 1 Nuclear Header
- Power Condition w/o LOP w/ LOP, 1 Pump Conventional Headet All Power 3.l(-5) 8.3 (-5) 7.2(-5)
Available 4 Power Lost at 5.0(-3)- 9.3(-5) 1. 3 (-4) 1 bus Power lost at 1.0 3.3(-3) 1.8(-2) ] 2 busses As with the IP-2 SWS analysis, that for the IP-3 SWS neglects common cause pump failures. Furthermore, the analysis of the
- nuclear header. ignores completely pump maintenance outages for the eight houts they can occut under technical specifications, for j nuclear header pumps. (This pump . unavailability is 1.4 (-5) .
The data ptesented in Section 2.4.1.10 for common cause pump train failure ptobabilities are used here as are the data from IPPSS of a SWS pump having an unavailability due to maintenance of 1.47(-2) (for the convention 1 headet), a failure to statt of 1.43(-3), and a failure to run for 24 houts of 1.77(-3). With these data, the failure probabilities of the SWS are reestimated to be Nuclear Header Power Condition w/o LOP w/ LOP, 1 Pump Conventional Header i All Powet 7.2 (-5) 2.5(-4) 8.6 (-5) 3 Available Power Lost at 5.0(-3) 2.5(-4) 1.3(-4) 1 bus Powet lost at 1.0 3.3(-3) 1.8(-2) 2 busses 1 2.4.2.12 IP-3 Auxiliary Feedwater System Fault Tree The fault Ltee fot the IP-3 auxiliary feedwater (AFW) system was j teviewed and found to be in error in the two instances of errors in ' the IP-2 AFWS fault tree (see Section 2.4.1.12). IPPSS calculates l the system unavailability as 2(-5) for the all power available l condition and 1. 6 (-2) for the blackout condition. l l l As with the IP-2 AFWS review, a simplified fault tree was ! constructed for the IP-3 AFWS. With the use of the IP-3 data, the common cause failute datum for the two motor-driven pumps given in 2.4-20
^ ^ ^ _ _ _ _ _ - _ . _ _ . _ _
Section 2.4.1.12, and the assumption that the turbine-driven pump will fail if the CST supply fails, the AFWS unavailability was found to be essentially unchanged for the power available condition and to increase to 1. 9 (-2 ) for the blackout condition. 2.4.3 System Unavailability Comparison Presented in Table 2.4-1 is a comparison of the major system unavailabilities calculated in the IPPSS, our revised estimates, and estimates for similar systems given in other NRC sponsored PRAs and NUREG/CR 2497, " Precursors to Potential Severe Core Damage Accidents." Comparison of our revised estimates with the previous NRC sponsored PRA estimates reveals only one significant difference. All revised estimates except the fan cooler system at IP3 are either within the previous PRA ranges or are within a factor of four, high or low. The factor of four can be reconciled when one considers the Indian Point plant design differences, uncertainties in the PEA process, and the fact that we utilized plant specific data to quantify our revised estimates. The previous NRC sponsored PRA system estimates were based largely on generic data. Our revised IP3 fan coolar system unavailability is below the previous NRC sponsored PRAs by a factor of 12. Comparisonfor this. s.ith The the previous PRAs indicated there may be good reason previous PRAs identified several single failures in the fan cooler system that do not apply at Indian Point. Neverhteless, even if one adopts a previous PRA fan cooler unavailability, we estimate that ; none of our revised plant damage state frequencies would be signifi-cantly effected. Comparison of our revised estimates with NUREG/CR 2497 reveals one startling difference, namely, the auxiliary feedwater system unavailability. We reviewed the unavailability calculation in NUREG/CR 2497 to determine if it was applicable to the Indian Point AFWS design. The 1.1 x 10-3 estimate was derived from eight events in the nuclear industry. Of these eight, six could not occur at Indian Point due to design differences and two could possibly occur but did not significantly impact our revised AFWS unavailability. Of the six that could not occur at Indian Point, 1) two were due to clogged suction strainers, 2) one resulted from a nonnuclear instrumentation failure, 3) two were due to failure of an AFWS consisting of solely turbine driven pumps, and 4) one resulted from open full flow test lines. These four classes of events cannot occur at Indian Point because 1) suction strainers have been removed, 2) the non nuclear instrumentation failure was peculiar to older Babcock and Wilcox plants only, 3) Indian Point has one turbine driven and two motor driven pumps, and 4) the Indian Point design utilizes mini flow test lines. 2.4-21
- - - _ . . - - -- - . ~ . - _. . - -- .- ._ . - .
i 4 i Table 2.4-1 System Unavailability Comparison IPPSS iPPSS Revised Revised Previous NRC IP-2 IP-3 IP-2 IP-3 Precursor High Press. PRA Studies ** Study *** In.'. (Med. LOCA) 4.1(-4) 1.8(-4) i i 1.3(-3) 4(-4) --- High Press. Inj. (Small LOCA) 1.2(-4) 1.4(-4) 9.2(-4) 3(-4) 5(-2) - 1(-3) i Low Press. Inj./ Accumulators 8(-4)-2(-3) 2.8(-3) 3(-3) 3.4(-3) 3.1(-3) 1(-1) - 2(-3) High Press. Recire. 6.8(-4) /.l(-3) 1.2(-3) 1.2(-3) 1(-2) - 5(-3) Low Press. Recire. 6(-4) - 2(-3) 5.4(-3) 5.3(-3) 2(-2) 2(-2) Containment Spray Inj. 1(-1) - 4t-3) 8.l(-5) 3.6(-5) 1.2(-3) 5.3(-4) 5(-2) - 2(-3) Containment Spray Recirc. **** **** **** **** y Auxiliary Feedwater 8(-3) - 1(-4)
- 1.9(-5) 1.5(-5) 3(-5) 2(-5) 6(-4) - 1(-5) 4 Emergency AC (2 diesels) 1.l(-3) 1.4(-3) --
same Emergency AC (3 diesels) 1(-2) - 5(-4) 1.4(-3) - 2.2(-3) 6.2(-4) 1(-3) same same -- Reactor Protection Systems ':-5) 3.9(-5) same same 4(-5) - 5(-6) Fan Coolers 1.4(-6) G.3(-7) 5.l(-4) 8 (-5) 5(-3) - 1(-3)
**Sequoyah, (NUREG/CR-2515).
Oconee, Calvert Cliffs RSSMAP (NUREC/CR-1659), Surry (WASH-1400), Crystal River
***NUREG/CR-2497.
****Neither did the IPPSS or we gave credit for this system in the analysis.
Note - all system unavailabilities include support system faults and assume offsite powe r is atailable. l l 4 b
The two events that occurred that did not inpact our revised estimate are 1) failure of pumps to auto start due to failure to install fuses and 2) failure to deliver flow due to closed valves. The first event did not impact our revised estimate because follow-ing TMI the motor pumps are now required to have their auto start circuits tested regularly and, even if the fault did occur, it is The second recoverable by starting the pumps from the control room. event occured early during the TMI accident and involved the inad-vertent closure of two valves at the discharge of two pump trains. For a similar event to occur at Indian Point, eight valves at the discharge of three pump trains would have to be inadvertently closed. At Indian Point, then, one would expect a smaller probability of such an event occurring because cf the larger number of human errors which would have to be committed. The IPPSS assessed the probability of such an error to be about 10 percent of our total revised AFWS estimate of ~3 x 10-5 We found no reason to arrive at a remarkedly different estimate of this failure mode. In conclusion, we find our revised system unavailability estimates to be similar with values reported in other NRC sponsored PRAs and NUREG/CR 2497. Any difference that does exist can be reconciled when one considers Indian Point plant operation and design differences, the use of plant specific data in our revised estimates, and the uncertainties in the PRA process. REFERENCES Precursors to Potential Severe Core Damage Accidents: 1969-1979 1. A Statua Report, NUREG/CR-2497, June 1982.
- 2. Reliability of Emergency Onsite AC Power Systems at Nuclear Power Plants, NUREG/CR-2989, to be published.
- 3. Common Cause Fault Rates for Pumps: Estimates Based on Licensee Event Reports at US Commercial Nucleir Power Plants, January 1, 1972-September 30, 1980; Corwin Atwood, EGG-EA-5289, August 1982.
- 4. Internal Memo from A. J. Buslik and L. Coralli to R. A. Bari (Brookhaven Labs,
Subject:
BNL Peer Review of the IPPSS, May 17, 1982. 2.4-23
1 l 2.5 Human Reliability Analysis 2.5.1 Scope of the HRA Review Because of the large number of human activities analyzed in the IDPSS and the limited time available to perform out review, it became necessary to focus on a subset. The initial subsets chosen were those human activities identified by the system's analysis to have a major impact on the dominant accident sequences. The activi-ties identified were then investigated to determine if wr itten plant ptocedutes existed which desctibed the activity. This investigation revealed that either no or inadequate procedures existed for sevetal of the activities. It was not pos-sible to review these type of activities due to a lack of informa-tion. For these situations we genetally assigned human ettot ptobabilities tanging from 0.1 to 0.9, depending upon a variety of situation specific performance shaping factots. (For example, see Sections 4.6, 4.3, and 2.7.4.) Four important activities which were identified as having written ptocedures are reviewed in Section 2.5.4. The teview con-sidered the IPPSS analysis and a review of the Indian Point pto-cedures. Insights gained from out familiarity with the Zion Ptobabilistic Safety Study (ZPSS) (Reference 1) and the Zion Plant wete used in the review. (The Zion study and plant have many similatities with the IPPSS and Indian Point Plant.) The next section (2.5.2) repeats the 11 ateas of agreement / disagreement with the HRA in the ZPSS since they are applicable also to the IPPSS. In Section 2.5.3 each of these areas is discussed, with mention of any differences between the ZPSS and the IPPSS. Section 2.5.4 ptovides the quantitative evaluation of the fout ettot terms that have a significant impact on the dominant accident sequences. Section 2.5.5 provides a short summary of comments on the IPPSS HRA. 2.5.2 Ateas of Agteement/Disegreement with the IPPSS It is out opinion, despite some shortcoming, the IPPSS HRA teptesents a detailed, thoughtful, and objective attempt to analyze the most difficult-to-analyze system component--the human. The following is a list of 11 areas taken from out teview of the ZPSS (Reference 5) which also apply to the IPPSS. The next section ptovides a description of each.
- 1) Incomplete and incottect documentation of the HRA.
- 2) Use of latga uncertainty bounds in the HRA.
2.5-1
- 3) Use of undue optimism in assessment of credit for human redundancy.
- 4) Use of optimistic assessments of human performance under stress, especially for cacos of multiple problems.
- 5) Use of persons to estimate operator performance in place of simple measurements.
- 6) Lack of documentation on how expert opinion was used.
- 7) Incomplete documentation of data sources used for estimated hum n performance. f
- 8) Use of optimistic assessments of dependence among tasks done by same person.
- 9) Possible insufficient consideration of common-cause failures from human errors.
- 10) Possible insufficient consideration of errors in restoring safety components after test, maintenance, or calibration.
- 11) Frequent use of conservatism in the HRA.
2.5.3 Description and Qualitative Assessment of the Areas of Agreement / Disagreement This section. previous section discusses each of the 11 areas identified in the !
- 1) Incomplete and incorrect documentation of the HRA.
As near as ue can determine, the HRA portions and estimates of human error probabilities (HEPs) and assumptions about human behavior and interperson interaction are identical for the two Indian Point units (2 and 3), and nearly identical with the HRA done for the ZPSS. In view of the generic data for HRA available to 7nalysts, the near identity of the HRAs for all three plants should not be construed as a criticism. Apparently, the same personnel performed all three HRAs, and made the judgment that there was a very high degree of similarity in the operator behaviors required in these different PURs for the task evaluated. Therefore, the basic f tlEPs and many assumptions about operating teams made in the ZPSS were applied without change to the same tasks in the IPPSS. For some other tasks, changes were made between the ZPSS and IPPSS, eg, the giving of less credit for the STA (shift technical adviser) in the Indian Point plants to catch operator errors than in the Zion PWR because in the former plants the STA is not an SRO 2.5-2
(senior reactor operator) as is the case in the latter plant. Such axtrapolation can be warranted; this analyst is unable to evaluate this type of generalization of results becauce of the time limitation placed on this review. While we do not criticize the above generalization, the IPPSS ' should have made this procedure clear. In some cases, a reader might be led to believe that separate analyses were made in the Zion and Indian Point HRAs, when this does not appear to be the case. For example, on page 1.5-902, Section 1.5.2.3.9.4.4. " Human Inac-tion," with regard to the Indian Point 2 Auxiliary Feedwater System, it is stated, "The probability of human inaction has been quantified into histograms based on discussions with operators, supervisory personnel, engineers, and after a reviet. of the operating histories at other plants. The judgments take into account the high stress conditions in the control room during emergencies and the competing demands during the 30 minutes the operator has to perform his task." It may not be clear to the reader that the phrase "at other plants" applies to all of the foregoing--not just to a review of operating histories at other plants. The histograms on pages 1.5-903 and 904 are identical to those in the comparable section in the Zion PRA. It is reasonable to conclude that the PRA team decided that the Zion results could be applied to the Indian Point 2 PRA without modification. The same analysis was also applied to Indian Point 3. The use of NUREG/CR-12782 in this PRA (as well as for the Zion PRA) for many of the estimated human error probabilities (HEPs) made it easy to find sources of such estimates. However, it was not possible to fully understand and evaluate the HRA by reading only those sections clearly labeled as " human reliability," " human error," or " human factors." Because of the lack of documentation and the difficult-to-follow format, it was frequently difficult to impossible to evaluate estimates of some HEPs and to track the translation of these HEPs into questions which combined both equip-ment failure and human error terms. In this respect, the Indian Point HRA is more difficult to track than the Zion HRA. Because of the time limitation placed on this review, we based many of our evaluations on the assumption that the operator tasks and equipment support and procedures at these plants are equivalent (highly similar) to those at the Zion plant with which we are familiar. One major conclusion, then, is that HRA parts of a PRA should be documented in some systematic and reproducible manner, as is sug-gested in NUREG/CR-22543 and implemented in the Arkansas Nuclear One Unit 1 PRA. Unless this is done, independent evaluation of the HRA portions of a PRA by others will be difficult to impossible.
- 2) Use of large uncertainty bounds in the HRA.
In general the IPPSS HRA makes use of wider uncertainty bounds than are found in NUREG/CR-1278. When their estimates of median 2.5-3
4 HEPs are valid, the IPPSS HRA~is more conservative, ie,.less likely to be optimistic about human interaction and intervention in a plant, than would be the case if they used narrower uncertainty bounds. However,'as in the ZPSS, it is-stated in Section 0.15 (Vol. 1, page 0-99) that "We determine the log normal distribution by using l the best estimate as the median and the upper bound as the 90th ! percentile, rather.than the 95th percentile that the handbook recom-mends." (" Handbook" refers to NUREG/CR-1278.) Nevertheless, they forgot this conservatism and used the 95th percentile throughout the report. It is our opinion this is not a serious problem; there are j many cases in which other conservatisms are employed. As a minimum, I however, it does constitute an example of incorrect documentation. '
- 3) Use of undue optimism in assessment of credit for human redundancy.
On page 1.5-584 of the IPPSS it is stated that following an important transient there would be four people present in the con-trol room: two control board operators, one of whom is an SRO, the watch / supervisor (an SRO), and the STA who "does not have an operat-ing license, but has been trained in the mechanics of accident con-trol and plant response characteristics." For certain major
- transients (eg, a LOCA), the report makes the reasonable assump-tion that all four of these people would be present within half an
. hour following off-normal annunciator signals. One control board i operator reads the procedures related to the transient while the other does the actual interfacing with the contro1' boards. The 4 IPPSS reasonably assesses a high level of dependence between the two operators. A moderate degree of dependence is assessed between them and the watch supervisor and between these three and the STA. All of these levels of dependence seem reasonable when all four people are involved in the same activity. The problem is that for some transients, all four are presumed to be involved in the details of monitoring control :oom indications and verifying that correct i switching actions have'been carried out. Thus, for several applica-tions, including one of the two operator /small LOCA actions evalu-ated in Section 2.5.4 below, t he IPPSS assumes that four people would have to fail, whereas we would assume only three people at the most. Given an assessment of moderate dependence for the STA, the i assumption of his involvement in some detail can result in a ? recovery factor as high as about 85 percent. If the STA would not be involved, the IPPSS assumption results in undue optimism in their
- assessment of credit for human redundancy.
- 4) Use of optimistic assessments of human performance under i stress, especially for cases of multiple problems. I As in the ZPSS, perhaps the major fault in the HRA for the IPPSS
- is the use of more than one operator action designator (ie, OPl through OPS described beginning on page 1.3-127) in the same i
2.5-4
f without modifying the HEPs for sequence of events (ET designators)less practice or less familiarity the added stress of less time or with sequences involving multiple faults, eg,The lossuse of feedwater of more thanplus anticipated transient without scram (ATUS). one OP designator in a sequence implies an unreasonably optimistic
~
assumption that there would be no exacerbating effect due to the interaction of stress effects. Another problem in this HRA (as well as in the HRA for the Zion plant) is that the application of the IPPSS human performance models for LP or HP recirculation is sometimes made for response to events when considerably less time is available for successful operator intervention than was assumed for these two models. For example, on page 1.3-134 there is an event "PR ATWS Pressure Relief." This requires, according to the IPPSS analysis, that theAsoperator open in the ZPSS, the PORV block valves within 10 minutes of ATUS. the IPPSS uses the LP Recirculation Model for human performance response to this event. The model presames that four people are present; this is not a reasonable assumption in our opinion. Credit should not be given for the presence of the STA within 10 minutes of a transient initiation. Furthermore, if the analysis of the time available for manual intervention is incorrect (as it was judged to be so in our evaluation of the Zion study), and the available response time is actually only 2 minutes rather than 10, then no credit at all should be given for any operator intervention. (The ATUS reevaluation in Section 4.4 of this report does not give credit for operator intervention.)
- 5) Use of persons to estimate operator performance in place of simple measurements.
As in the Zion study, estimates of response times were obtained by interviewing operating personnel when it would have been possible to take actual measurements. Skilled personnel typicaly underesti-mate how much time it will take them to perform various tasks. For example, Table 1.5.2.2.1-14 on page 1.5-343 entitled " Indian Point 2 Offsite Power Recovery Actions" provides " estimated action time" for several recovery actions. Some of the time estimates have very wide margins because they deal with repair of defective equip-ment. For cases such as these, operator estinates and records of repair time would constitute reasonable sources of information. (However, the report does not document how these estimates were obtained.) For other operator actions requiring much shorter times, actual time measures could have been taken--or at least simulated in talk-throughs and timed.
- 6) Lack of documentation on how expert opinion was used.
As was noted in our evaluation of the ZPSS, nowhere in that report, or in the IPPSS report, is there a description of the methods used for psychological scaling (the technology of asing 2.5-5
expert opinion). Without evidence that recognized methods were i employed, it is not possible to have much confidence in data derived I by the use of expert judgment. This criticism especially applies to cases in which histograms of cumulative probabilities of correct action over time were derived from expert opinion. We have little confidence in the ability of operators to reliably make such multidimensional, absolute judgments.
- 7) Incomplete documentation of data sources used for estimated human performance. l Sufficient documentation was provided for tracing the use of estimates from NUREG/CR-1278. However, in the case of the use of expert opinion, and in some cases where the data source was not stated at all, or where a description of relevant performance shap-ing factors is not provided, it is not possible to evaluate the estimated HEPs in the IPPSS. There are many cases of this lack of documentation. One example is found on page 1.5-419 where it is apparently assumed that if there is a failed de power fuse, it will be detected 100 percent of the time during the operator check of the status of the panels once per shift. Without describing fully the
" operator check" each shift, one does not know whether this is merely a casual "look around the panels" as is done at some plants, 1 or whether that particular dc power fuse is an item on a shiftly checklist, such as that employed by Arkansas Nuclear One Unit 1 personnel. If the latter is the case, there would be a high prob-ability of detection each shift, but not 100 percent. If the former is the case, depending on the type of display, the credit allowed for the shiftly check might be very, very small.
- 8) Use of optimistic assessments of dependence among tasks done by the same person.
In addition to the optimistic assumptions about dependence, among team members (see item 3), the IPPSS provides (on page 1.5-123) a rule for within-person dependence that can result in , optimistic assessments. The rule is for the tasks of a person suc- l cessively restoring valves to their proper positions after test or maintenance. The report states, "For those routine actions, where written procedures are used, the level of dependence between the restoration of the first two valves is judged as moderate and the level of dependence for all other valves is complete." f This general rule could lead to extreme optimism for cases where the true level of dependence for the operator's errors of omission is complete. That is, for certain valve configurations (:ts described in Chapter 13 of NUREG/CR-1278) it is very likely that if an operator fails to restore one of two or more valves, he will always fail to restore the other(s). If for example, there are two redundant valves in a system, and if one assumes a basic error prob-ability of .003, the application of the above IPPSS general rule would result in an estimated joint HEP of 2.5-6
1 + 6(.003) =4x 10 -4
.003 x 7 wheteas the correct est'imate would be .003 x 1.0 = 3 x 10-3, nearly a factor of 10 highet.
This same problem was also found in the ZPSS, and as in that study, we could not find that the general tule was evet used. If it has been used, tecalculations are in ordet.
- 9) Possible insufficient consideration of common-cause failutes from human ettors.
Insufficient documentation was ptovided to evaluate whethet the possibilities for common-cause failures from human ettots wete apptoptiately assessed. For example, in the teactot ptotection system (RPS), the repott mentions (on page 1.5-389) the possibility of common miscalibration ettors but states that "...most calibration activities, even if petformed in ettot, do not tesult in an insttu-ment that fails to provide a trip." No further clarificaticn is given. Howevet, discussions with the IPPSS analysts indicated that many common cause human ettots were implicitly included in system ot linkage factots (see Section 2.6.8 of this teport).
- 10) Possible insufficient considetation of ettots in testoting safety components aftet test, maintenance, or calibtation.
It is not clear from the IPPSS if sufficient considetation was given to the possibilities fot unavailability of safety components due to testoration ettots aftet maintenance, calibration, or test-ing. We have the impression that optimism may have occutted. But the lack of discussion in this area did not petmit an accutate evaluation.
- 11) Frequent use of conservatism in the HRA.
Apart from specific comments above on the possibility of undue optimism in the IPPSS for certain analyses, it was apparent that in sevetal cases the PRA team did incorpotate measutes of conservatism in other analyses. In several cases, even though we judged that some aspect of tne IPPSS HRA for a given task was optimistically assessed, other aspects for the same task were treated so conserva-Lively that out ovetall imptession was that the final analysis was not optimistic--and even pessimistic in some cases. 2.5.4 Quantitative Evaluation Fout human ettot terms ate shown in Section 3.0 of this review to have a majot impact on the dominant accident sequences. These ate telated to high-pressute and low-ptessute tecirculation aftet a LOCA. 2.5-7
Following is an evaluation of the IPPSS HRA assessments for the four terms.
- 1) Failure to initiate cwitchover to high-pressure recirculation after a small LOCA.
On page 1.5-584, this term is designated as QH1, the failure to initiate switchover to high-pre'sure recirculation. The IPPSS estimates that it takes at least 2 nours, and more likely 10 hours, f'r HP recirculation to be needed after a small LOCA. This need should be recognized when the transient is properly diagnosed, and the time to initiate recirculation is indicated by a low level alarm in the ref ueling water storage tank (RUST) . A well-organized crew would be monitoring the RWST level indicator and would not likely be taken by surprise when the alarm sounds, tio assessment is given in the IPPSS for the operating crew to fail to recognize they have a small LOCA. By implication, the HEP is zero. This seems a reasonable assumption; our latest model for this type of diagnostic error by the control room team 2 hours after it is recognized that something is amiss gives a nominal HEP of between 10-4 and 10-5 with an error factor of 30.4 Given the fact that the Indian Point operators are well-versed on what pattern of stimuli is associated with a small LOCA, and that, as stated on page 1.5-583 of the IPPSS, the time window is 60 minutes, the failure of all four people in the control room to recognize the nature of the problem and still allow sufficient time for the switchover actions should be vanishingly low. The actual switchover procedures should be initiated when the RUST low level annunciator comes on. Given that no misdiagnosis has been made (as stated above), there should be plenty of time for tne operators to eyeball the vertical analog meter which displays RUST level. In one sense this is a dynamic task because it involveA the monitoring of a constantly but slowly changing display indication. However, even if the operators get involved elsewhere and forget to monitor this display (which seems unlikely), the RWST low level ( annunciator offers a very good signal to tell them it is time to l initiate switchover to recirculation. The effectiveness of this annunciator will depend on how many competing auditory annunciations ; are occuring at about t.he same time as the low level annunciator. The IPPSS does not provide this information. ' However, the crew apparently have 60 minutes in which to initiate switchover, so there is time to recover even if they forget to monitor the low level indication and if they don't take proper notice of the related annunciator. It appears to us that an operat- , ing crew would really have to be utterly confused if the switchover procedures were not initiated within the allowable time. The IPPSG uses the same arguments made in the ZPSS for the error of failing to initiate switchover. They use a basic HEP of .003 and 2.5-8
double it for moderately high stress, using NUREG/CR-1278 as their guide. They assume that the omission error would be a function of all four personnel in the control room, using the assessed levels of high dependence between the two operators, and moderate dependence for the watch supervisor and the shift technical advisor. On page 1.5-586 the HEP (median) is calculated correctly as 6.6 x 10-5, However, if the IPPSS is correct in assessing the switchover to the recirculation phase as a dynamic task (as stated on page
; 1.5-580), rather than .003, the report should use .015 as the nominal HEP for this task. (The .015 is calculated from Table 20-23 in NUREG/CR-1278 as the basic HEP of .003 times 5 for dynamic tasks under moderatly high stress by highly skilled operators.)
Recalculating their equations with .015 as the nominal HEP gives , 1.015 1 + 6(.015)
.015 x = .0012 2 7 e
This is a factor of 18 greater than the IPPSS joint HEP. If one works out the problem in a different manner, using more detailed gnalysis, the joint HEP is even smaller than their 6.6 x 10- . Assume for example that the monitoring of the RWST level indicator is considered a dynamic task and that only the two l control board operators are involved, with high dependence between them. Using the basic HEP of .003 but multiplying it by 5 (for dynamic tasks under moderately high stress) and again by .5 for the second operator (high dependence) gives a joint HEP of .0075. For the annunciator recovery factor, assume both operators and the watch
- supervisor are involved, with the above levels of dependence assigned to them. Also assume five alarms (ie, four nonrelated competing alarms). The basic HEP for responding appropriately to the low level annunciator is .003 (from Table 20-24 in NUREG/CR-1278), the second operator's HEP is .5, and the watch supervisor's HEP is about .15. The joint HEP for all three people failing to be cued by the alarm is thus 2 x 10-4 failure is then .0075 x .0002 ~ 10-6,The joint HEP a number to which for we total would assign epsilon.
In discussions with IPPSS personnel, it was determined that there the RWST are annunciators level indicator.for Therefore, both the low level and low-low level of the above analysis can be taken as an approximation of the failure to initiate switchover. This estimate does not include any other human error contribution not identified by the IPPSS analysts.
- 2) Switch 7 turned to the "ON" position and no corrective actions are taken (fails high pressure recirculation).
4 1 2.5-9
This term is identified in the IPPSS as 0.1360H1, and is " Switch 7 is turned to the 'on' position [which stops all safety injection pumps] and no corrective actions are taken." Once the switchover initiation is begun, it is still possible for the control room personnel to make a selection error in the "eight-switch sequence" described beginning page 1.5-576. They have decided that high-pressure recirculation is required, and they use a book of procedures, with one operator reading and the other performing the switching actions. For a small LOCA, switch 6 should be operated, but switch 7 skipped. If switch 7 is erroneously selected, all safety injection (SI) pumps will be stopped. There are several ways in which this error could be made. The operator giving the oral instructions could misread or misspeak. The second operator, given that the first operator is correct, could misselect. This is clearly a static (nondynamic) procedure, and the IPPSS correctly assigned a .003 basic HEP, multiplying it by 2 for the moderately high stress level. They also reasonably state that the error would be a function only of the two control board operators--the watch supervisor or shift technical advisor would not be involved in this detail. Given that the error was made, the IPPSS assigns a recovery factor. They use the same .006 HEP and assign it to the watch supervisor, and assume that the STA also has a chance of seeing the error, based on high dependence. It is not possible to evaluate the recovery factor because the report does not indicate what the recovery cue is. It is stated at the bottom of page 1.5-577 that " Low pressure in the SI pumps suction header is annunciated in the control room." If this means that the above error would result in an annunciation, the recovery factor should be much better than that indicated in the IPPSS. If the recovery cue really should be assessed a nominal HEP of .006, and if the STA if given no credit (which seems a reasonable assumption) and that the shift supervisor is assigned the usual moderate level of dependence, the joint HEP is much higher than that given in the IPPSS. Assuming that there is an annunciator as a recovery cue, it would be reasonable to give credit to three people. If it is further assumed that there are four competing annunciators (ie, a total of five nonrelated ANNs alarming at about the same time), the joint HEP for the recovery factor is the same 2 x 10-4 calculated earlier. Thus, the total unrecovered failure probability would be the same .006 x 1.006 = .003 probability of failure of the two 2 operators multiplied by 2 x 10-4, or epsilon. If there is no annunciator, and if we assume that the watch supervisor has a moderate level of dependence for this task, his failure probability would be .15. With no recovery credit for the STA, the total failure probab lity would be .003 (the joint HEP for 2.5-10
l the two operators) multiplied by .15 (for the watch supervisor), or 4 x 10-4 This is a sizeable increase from the IPPSS estimate of 6.6 x 10-5, In discussions with IPPSS personnel, it was determined that the above annunciator would indeed furnish a strong recovery factor as indicated in the sample analysis in this section. Therefore, the above analysis assuming the annunciation recovery factor can be taken as an approximation of the error and failure to recover from inadvertent turning of switch 7. The IPPSS analysts also determined that the operators when noting the annunciator would quickly turn back on the SI pumps, and that suction to the pumps would be avail-able. That is, there would be no danger of burning up the pumps because of lack of suction.
- 3) Failure to initiate switchover to low pressure recirculation after a large LOCA.
On page 1.5-602, for the joint failure probability of the control room personnel to initiate LPR within time, several assump-tions are made. It is assumed that LPR is needed 20 minutes after the large break and that the allowable time window is 20 minutes. It is assumed that all four people would be involved (the two con-trol board operators with high dependence and the watch supervisor and shift technical advisor with moderate dependence). This assump-tion seems reasonable. A very high level of stress is assessed, which yields a .1 basic HEP based on the Large LOCA curve in the Handbook. Then, because the crew have had extensive simulator practice in coping with a large LOCA, this .1 is divided by 2, or a modified basic HEP of .05. This was the same correction factor applied in the ZPSS, and we do not take issue with this modification. With the above assumptions, the IPPSS joint median HEP becomes 9.1 x 10-4, a value which is about the 30 minutes value for a team, as d transient.gtermined by our Using this new value asmodel for correct the median of lognormaldiagnosis of a distribu-tion, and using an error factor (EP) of 20, an HER of 4.75 x 10-3 is calculated. We accept the IPPSS estimate as reasonable.
- 4) For IP-2 (3), switch 6 (5), in addition to switch 7 (6), is turned to the "0N" position and no corrective actions are taken within the available time (fails low pressure recirculation).
On page 1.5-603 (paragraph 2) assessment is made of the unrecovered operator error of turning switch 6 to ON which closes MOVs 746 and 747, and later turning on switch 7 which trips the SI pumps. For this error, the .1 basic HEP is used without modifica-tion, a reasonable assessmer.t. However, the document now allows a level of low dependence for the STA and assigns recovery to all four people in the control room. For HPR, the recovery was restricted to the watch supervisor and STA and both were assigned moderate depen-dence. No reason is given for this change in assumptions. We believe these changes for LPR may well be optimistic. 2.5-11
Unlike the equivalent switching error for HPR, in the LPR situation, there is no annunciator recovery factor (information obtained from discussion with IPPSS personnel). Furthermore, in the emergency procedures, there is no direction to the operators to check the flow indic:) tors for the low head injection paths af ter completion of the 8-switch sequence. The only statement we could find occurs as a NOTE right after step 2.2 " Recirculation Phase" in the IP-2 procedures. Part of the lengthy note says that "recircula-tion flow to the RCS must be maintained at all times." It is very poor practice to place an important instruction in a note. This same note does not appear in the IP-3 emergency procedures, but there is a possible recovery about 11 steps after the 8-switch sequence is completed. This step tells the operator to check the number of Recirculation Pumps operating and whether or not both RHR heat exchanger flow paths are open (which include MOVs 746 and 747 which would have been closed if the switching error in question were made). It appears to us that at least there is a better possibility for operator recovery of the error in the IP-3 procedures than the IP-2 procedures. He assume that the situation is the same in both plants. The IPPSS analysis f'or the switching error for the two plants are identical. Lacking any specific instructions in the procedure to check th' i recirculation flow into the cold legs into the reactor vessel,
! reliance must be placed on the knowledge and memory of the operators to check flow. This is not an optimum method of operating under emergency conditions.
Using the IPPSS assumptions, the withaderivedmeanHERof5.26x10jointmedianHEPis10-4, (based on a lognormal dis-tribution of HEPs and an EP = 20). This estimatz would change j materially if the equivalent assumptions from the HPR analysis were made:
- 1) Recovery credit for the SWS and STA only.
- 2) SWS and STA both moderate level of dependence The joint HEP of .055 would not change, but the recovery factor would be much reduced. The faalure of recovery becomes:
l [1+6x.1}2 = .052 A 7 / Thus, the joint unrecovered HEP would be .055 x .052 = 0029, or about a factor of 30 higher than the IPPSS estimate cf 10-4 Presumably, the mean HER would also be increased about a factor of 30, to about 1.5 x 10-2, 2.5-12
- -e -
2.5.5 Summary of the Review of the Human Reliability Analysis This summary is very similar to our summary comments on the review of the Zion Probabilistic Safety Study. As in that review, the major problem in reviewing completely the HRA for the Indian Point Probabilistic Safety Study is the lack of documentation. While this is also a problem for the PRA as a whole, it is a much bigger problem for a review of an HRA. HRA deals with the most difficult component of a system to understand and to quantify. Because of the lack of documentation in the IPPSS, we had to interview IPPSS analysts to complete our evaluation of the only four error terms which impact the dominant accident sequences. These are four terms which deal with switchover to recirculation after a LOCA. We assessed the probability of failure of the operator to successfully establish high pressure recirculation to be negli-gible. However, we assessed the operator failure probability in establishing low pressure recirculation to be ~.02, ie, 4.7 x 10-3 + 1.5 x 10-2, The close correspondence of the IPPSS HRA with the ZPSS HRA apparently reflects a judgment by the human reliability analysts that there is sufficient similarity in the behaviors for the tasks analyzed in both PRAs so that such extrapolation is warranted. We did not have sufficient information to evaluate this generalization. While the IPPSS does not deliberately appear to be optimistic in its assessment of human errors, assumptions made regarding the credit to be given for more than one person in the performance of several tasks did on occasion have that effect. Furthermore, the development of only two stress models (for high-pressure recircula-tion and for low-pressure recirculation) and the misapplication of these models to completely different situations also had the net result of probably underestimating the effects of human errors in responding to some unusual events, especially in those cases where there is more than one unusual event to contend with or when the allowable time for the control room personnel to respond is so short that it is unlikely that all four persons would be present. The above optimism is countered, at least for some analyses, by a deliberate decision not to take full credit for certain recovery factors, and by the use of rather wide uncertainty bounds. REFERENCES
- 1. Zion Probabilistic Safety Study, Commonwealth Edison Co., Fall 1981.
- 2. Swain, A. D., and Guttmann, H. E., Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications (draf t for interim use and comment), U.S. Nuclear Regulatory Commission, Washington D.C., Oct. 1980.
2.5-13
- 3. Bell, B. J., and Swain, A. D., A Ptocedute fot Performing a Iluman Reliability Analysis of Nucleat Powet Plants, NUREG/CR-2254 (dtaft fot intetim use and comment), U.S. Nucleat Regulatoty Commission, Washington, D.C., 1981.
- 4. Swain, A. J., "Modeling of Response to Nucleat Powet Plant Ttansients fot Ptobabilistic Risk Assessment," Ptoceedings of the 8th Congress of the Intetnational Ergonomics Association, Tokyo, August 1982.
- 5. Review and Evaluation of the Zion Probabilistic Safety Study, Lettet Repott, Match 5, 1982, Sandia National Laboratories.
l l l l 2.5-14
2.6 Estimation Methodology 2.6.1 Inttoduction In this section, we examine the Indian Point Ptobabilistic Safety Study (IPPSS) estimates of initiating event tales and the failute probabilities and unavailabilities of components and systems. The estimation methodology is the same as that used in the Zion PSS, so the genetal comments made in out lettet repott (dated 3/5/82) to the NRC on Zion apply here. Out emphasis is on identify-ing the sttengths, weaknesses, and potential effects of the method-ology used. Contributions of the methodology to specific accident sequence estimates ate addressed in Section 3. Futut e events , such as human attots, the failute of teactot components and systems, and the tesulting consequences, cannot be fotetold exactly. Ilowevet, by cateful modeling of the occuttence of these events as the outcome of tandom processes, this unptedictabil-ity can be gauged and assessed. Developing these models is an essential activity in a ptobabilistic tisk assessment (PRA). The numbers that go into a probability model, eg, failute Lates and probabilities, component availabilities, and human ettot probabilities, ate not known exactly. Indeed, since they are quan-tities in a model, which is only an apptoximation to teality, the notion that they exist and ate knowable, as, for example, is the case fot a physical constant, such as the speed of light, la some-what ephemet al. Nevettheless, within the context of the specified model, it is necessaty to estimate these quantities. Obtaining estimates, substantiating them, and conveying the possible ettots-- the uncettainty--ptesent in these estimates pose considerable ptob-lems fot a risk analysis. The authots of the IPPSS, (whom we shall tefet to as Indian Point) apptoached these ptoblems using Bayesian methodology. Undet this approach, the study team tepresented, prob-abilistically, theit priot beliefs about the rates and ptobabilities of interest, then modified these beliefs by historical data obtained ftom Indian Point's expetience (if available), and convoluted them to yield a ptobability disttibution teptesenting theit postetiot beliefs about the frequency and consequences of vatious accidents. We undet take a limited sensitivity study which t he IPPSS authots did not do. If the IPPSS estimates are to be convincing, one nee (1, know the assumptions made and the extent to which the results J, .' on them. Bayesian methodology applied to risk assessment is also new. Readet s of the IPPSS might thetefote be ovetwhelmed, enthtalled, or mystified by it, so we begin this teview by making some general comments about Bayesian methodology and the IPPSS tendition of it. 2.6-1
2.6.2 Bayesian Methodology Consider a component that eithet succeeds or fails on demand. Assume that in a sequence of n demands the result on each demand-- success or failure--is independent of the results on the other demands and assume that a constant, unknown failure probability, p, underlies the sequence. That is, assume a coin-tossing model. Then the probability of observing k failures in n demands is P(k; n, p) = k!(n k)! p (1-p)n-k , the binomial distr ibution. The problem is to estimate p, given data of k failures in n demands. Conventional statistical methodology yields point estimates and confidence intervals based on this model. The Bayesian, howevet, seeks to incorporate othet information about p. He (the genetic he) expresses his state of belief about p by a probability disttibution, g (p) . In principle, this distribu-tion is specified priot to observing the data, to maintain indepen-dence, and so is called the prior distribution (Indian Point calls it the generic disttibution). By Bayes' Theotem (which is a straightforward mar.ipulation of conditional probabilities) the data ate used to modify the ptior distribution, the tesult being called the posterior distribution of p (Indian Point calls it the updated distribution). To wit, p(k;n,p) g(p) g (pl k ,n) = , [Ip (k ;n ,p) g (p) dp o One then presents this distribution or selected moments and percentiles to summarize his posterior degree of belief about p. The appeal of this analysis is that people cognizant of the component surely know more about p than just what is embodied by the data, so let's incorporate that information. A difficulty is in determining g (p) . One has to translate his knowledge and beliefs to l ptobability. He has to say, "What I know about p is equivalent to knowing that it was generated at random from g (p) . " This transla-l Lion is difficult. Whether one can justify such precision is open to question. Also, one can question whether the updated quanitified beliefs of some person or persons ate of much value to those who may not share those beliefs. In the following sections, we examine how Indian Point handled these difficulties. Fitst, though, some comments about terminology. 2.6-2
~
1 l In the pteceding and cubsequent discussions, we use the term "ptobability," as a patametet in a model, eg, the patameter p above, oc a patametet calculated from a model, such as the probability of no failutes in T houts, given the constant failute Late model with patameter A. One can think of a model as a mathematical teptesenta-tion of what would happen in infinite tepetitions of some hypo-thetical experiment, but that's not a _equirement. We use the term
" personal probability," or " Indian Point's ptobability," to denote ptobabilities calculated to reflect degree of belief. We also distinguish between failute tales, which are dimensioned failures pet unit time, and failute ptobabilities, which are dimensionless.
Indian Point calls both of the lattet " frequencies," and define these as the outcome of an experiment involving repeated trials, eithet an actual experiment ot a " thought exper iment" (p. 0. 4 -1) . Thus, tales and ptobabilities are not distinguished (so we see a
" probability" of 4.11 on p. 1.5-161), not ate estimates of prob-abilities ot tates, which tesult ftom a finite number of repeated Ltials, distinguished from the parametet being estimated, which cottespond to infinite repetitions. Indian Point uses " probability" variously as quantified degree of belief, confidence, ot knowledge (which at e not all the same) . In the following sections, we con-sidet the estimation of component failute rates and ptobabilities, initiating event t ales, and maintenance unavailability, and then combining these estimates to estimate system failute probabilities.
2.6.3 Tr eatment of Component Failute Data Indian Point's estimates of component failute rates and probabilities wete obtained from the following sources: Indian Point site-specific experience, as given by LERs and other station records Industty-wide LER summaries on valves, pumps, and diesel genetators published by EG&G. WASII-1400 IEEE-500 estimates of electrical component failure tales and ptobabilities The last three sources wete used to dcvelop priot distributions, which wete then modified by the Indian Point data, using Indian Point's DPD (discrete probability disttibutior.) atithmetic, to attive at the posteriors. The means and vatiances of these disttibutions ate tepotted in the IPPSS Tables 1.5.1-4 and 1.6.1-4. Ptom the authots' Bayesian otientation one would expect theit ptiot ptobability disttibutions, regardless of how they ate devel-oped, to be described only as theit priot degree of belief about the 2.6-3 l
i unknown Indian Point parameters. But they make the much stronger claim (p. O.14.3) that these are " frequency distributions," the l
"known results of experiments on populations." They are said to represent the " variation of performance of individual components within the population." This is a presumptuous claim and unneces-sary from the Bayesian viewpoint. It is unclear why Indian Point made it. They contradicted this claim when they subsequently assumed that individual components of a given type, e.g., all motor-operated valves at Indian Point 2, all have the came constant failure rate, rather than individually different rates.
Most of Indian Point's prior distributions are bascd in part on WASH-1400. It is not at all clear from WASH-1400 how the lognormal distributions given there are to be interpreted, but there is no basis to regard them as the results of (infinite) " experiments on populations." In fact, the nuclear plant data in WASH-1400 amount to one year's worth (1972) of (what are now called) LERs. For Indian Point to regard the distributions supplied by WASH-1400, even after they are stretched out so that the 5th and 95th percentiles become the 20th and 80th, as known frequency distributions, and to call them " generic" is unwarranted. One consequence of assuming that Indian Point's prior distributions are the frequency distributions of plant-to-plant variability is that in order to proceed with the derivation of the posterior distribution you must next assume that the Indian Point units are random camples from the population of plants. This, too, seems difficult to support. What seems most plausible is to regard Indian Plant's prior distributions as their representation of their prior personal. belief, or knowledge, of the failure rates and demand probabilities for classes of components at Indian Plant. These priors, rather than being obtained by careful introspection and elicitation of the knowledge possessed by the study team or the Indian Point personnel, as one would expect Bayesians to do, were obtained by applying ad hoc prescriptions to the numerical results published in the above sources. As we shall see, the effect of this approach is quite uneven. Also, as we shall see in our Sections 2.6.6 and 3, there are important, unannounced exceptions to Indian Point's treatment of WASH-1400's 5th and 95th percentiles as 20th and 80th. l 1 Regardless of whether one accepts, rejects, or ignores the claims made by Indian Point far their prior distributions, the important question remains as to what effect these distributions had on their estimates. Just looking at the data tables doesn't tell you. In fact, the lognormal distributions identified as
" generic" priors are not even used in Indian Point's calculations.
The actual prior distributions used are discretized versions of these distributions. Just how the discretization is done is not 2.6-4
~
described. Nor are the discrete priors ever provided in the report (which means it is impossible to verify any of the posterior dis-tributions). This might be a minor point except that in some of the systems analyses it was found that discretizing a distribution could considerably reduce its variance. S In order to identify the contributions of Indian Point's priors to their~results, we pretend the " updated results" are based on a statistical (as opposed to Bayesian) analysis. In a statistical analysis, given data consisting of f failures in T hours and assum-ing= a constant failure rate, one would estimate that failure rate by A* f/T, where the asterisk denotes an estimate. Under the assump-tion that T is fixed and known, the variance of A* would be esti-mated by var *(A*) = f/T2 Indian Point provides a posterior mean (thgirpoint estimate) and variance. If we equate f/T these to f/T and
, respectively, and solve for f and T, then we obtain pseudo-data effectively corresponding to the information assumed by Indian point in estimating a failure rate. Alternatively, one can do a Bayesian analysis beginning with some uninformative or " flat" prior distribution, then modify it by f and T to obtain a posterior dis-tribution which would have (agleast approximately) a mean and variance equal to f/T and f/T . Also, this correspondence between f/T and the posterior mean is consistent with Indian Point's prac-tice of equating the value of f/T in the EG&G reports to t: heir prior mean, so we are not doing anything funny by this transformation. If Indian Point had followed conventional Bayesian practice by choosing a " natural conjugate" prior distribution, in this case a gamma dis-tribution, then the parameters of the posterior distribution, which, fortunately, is also a gamma distribution, are directly interpret-able as effective data--number of failures and number of hours.
Indian Point used discretized lognormal distributions for their prior distributions, so we can't make this correspondence exactly. But, and this is one caving feature of a Bayesian analysis, with enough data the prior distribution doesn't matter too much, so approximating a discretized lognormal distribution by a gamma distribution should be reasonably adequate. Thus, the failure rate posterior means and variances in the IPPSS Tables 1.5.1-4 and 1.6.1-4 can be converted to effective data, say fPOST failures in TPOST hours. The Indian Point-specific f and T are given, so we can subtract them from the posterior effec-tivo f and T to deterniine the ef fective f and T associated with the prior distribution: fPRIOR " fPOST - fIP TPRIOR = TPOST - Typ 2.6-5
i For example, considet the fit st entty in IPPSS Table 1.5.1-4. , The posteriot mean and variance, labeled " Updated " ate 7.40(-8)/ht and S.39(-15)/ht 2 Equating these to f/T and f/T b yields T * = 1.26(7) hts. POST 5 89 - 5) f POST = 7. 40 (-8) x 1.26(7) = .9 That is, Indian Point's posterior mean and vatiance correspond to what one would estimate given only the data of .9 failures in 12.6 million houts (mhts). The Indian Point expetience consists of zero failures in 6.0 mhts. Thus, the difference, which is Indian Point's tendeting of the nonIndian Point information, amounts to .9 failure in 6.6 mhts. (We note in passing that expressing prior infotmation as being equivalent to .9 failutes in 6.6 mhts. is more sctutable than being told it is equivalent to a lognormal distribution with a 20th percentile of 2.8(-8)/ht. and an 80th percentile of 2.8(-7)/ht.) From the Indian Point data alone, the uppet 95 percent statistical confidence limit on the underlying failure tate would be 5.0(-7)/ht. Ptom the effective posterior data, the uppet 95 percent statistical confidence limit is 3.8(-7)/ht., so in this case, and from this view, the ptiot does not have a marked effect. a
- Fot demand ptobabilities, given data of f failutes in n demands, one would obtain the estimate, p* = f/n, and the estimated var iance, vat * (p*) = p*(1-p*)/n. These can be equated to Indian Point's posteriot mean and varianc9 to solve for an effective f and
- n. Fot small p*, these solutions correspond to those fot h* with n replacing T.
Table 2.6-1 gives the effective priot data for all the entties I in the IPPSS Tables 1.5.1-4 and 1.6.1-4. The contr ibutions of the ptiots to the final results vary considerably. In many cases, the
~
prior denominatot, n ot T, is roughly the same size as that for the Indian Point data, eg, Indian Point ~2 components 1, 5, 8, so the effect is roughly to dectease the vatiance by a factor of two. The precise effect depends on the numerator. In sevetal cases, the priot leads to a smallet and more precise estimate than would be obtained from the Indian Point data alone by effectively subttacting ftom the numetatot while adding to the denominator (components 4, 11, and 20 for IP-2; components 11, 14, 21, and 29 for IP-3). In other cases (including components 2, 7, 10, 16, 18, 19, 22, and and 34 at both units) the ptiot denominator is toughly ten or more times that for the plant-specific data alone, so considerable additional ptecision is impatted. One case that stands out is component 35, IP-3, wher e the pt iot effectively amounts to 712.7 failures in 52.9 x 106 hts. This is probably due to a typo in the positive vati-ance. There ate thtee cases (component 17 at both units, component 2.6-6
13 at IP-3) where the prior leads to less precision than the Indian Point data alone would by subtracting from both numerator and denominator. Whether or not the contributions of the prior distri-butions are fair and just, depends on the actual information con-tained in the source documents. Whether this question is worth worrying about in the IPPSS depends on where the various component events occur in the system models. We address this question in Section 3. It should be nor.ed that the preceding analysis, and Indian Point's, is predicated on the Indian Point data given in the report. We did not attempt to validate the data by determining the accuracy of the reported numerators and denominators via review of Indian Point licensee event reports. Sections 1.5.1 and 1.6.1 of the Indian Point study indicate a good deal of care in collecting component data. 2.6-7
l i Table 2.6-1 Plant-Specific and Effective Posterior and Prior Data INDIAN POIN7 2 E0MP No. OF SERVICE HRS UFDATED EFFECT!WE EFF EC TIVE F AILURES OR CEMANDS MEAN WARIANCE F051CR10E FRICk 1 0. 6.0 :0 E+:6H 7 402C-32 5. E 93 E -1 * .9 1 2*fE+C7 .9 6.564E+C6 3 3. 7.03JE**2 H 1 99CE-?6 1 63CE-12 .0 1.;c7C+C5 .0 1.CeiE*;5 3 0. 1 444E**3 0 7. 0 2 *E -3 3 1.C9Ci-CE .5 6.44CE+d3 5 4.993;*;3 0 1. 4.450L+#5 H 9. 201E-0 7 1. C 3 C E -12 ed 6 922C+C5 = .2 *.492E*;5 9 1. 3.010C+C5 H 2.SoCE-16 4.ElwE-12 1.4 !.322E*C" .4 2.312E*05 6 3. 1.261E+a3 D 2 32]E-0 3 1.190E-06 95 1 9
- CE*0 3 15 6.666E+;2 7 3. 8. l o0C +' 2 H 9 65 C-0 9 2 75JE-12 .0 2 5 73E.L4 .3 1 492E+34 8 1. 1.050E* 3 D 7. 4 9 0E-3 4 4.C10E-01 14 1 665E*C3 .4 e.17 s E + C 2 O C. 4.440E*?S H 1.71CE-07 7.293E-14 .4 2 34EE+C6 .4 1 9Cla*06 10 C. 3.72CE*C4 H 7 23CC=3 3 2 6330*12 .J 2 36;E*J" 0 2.11;E+C3 11 7. T.930E+.2 0 6. 413E-0 3 1.76JE 6t !.3 8 2 2SE*C2 - 1.7 3. 91E*:1 12 0. 1.7 CE*C1 D 2 01;E-J3 2.500t-01 .2 8.J 4 CE + C1 .2 i.34.E+L1 13 0. 8.4 3 0 E* 't H 1 19 0 E-C 5 1 61CE-Of .0 9 6 76E* C2 .0 9.C3tE+52 10 C. 6.5:0E*01 H 1 63 0E-11 1 67CE-GE .0 8 716E+C2 .C d.06tE+.2 19 C. 7.400E+t4 H 2 76CE-04 1 5 9 0E -11 .5 1 7 26E+ C5 .5 9.95cE+*4 16 0. 4. 3
- 3E +C 1 M 1 6dCE-3* 2.76JE-ot .C 6. 87E+C2 4 5.657E+C2 17 2. 7.4 J3E *: 4 H 1 52]E-3 ; 2. aiJ E *10 11 7.2 7 2E + 3 4 .9 -1 174E*;3 10 0. 2 070E+0J H 1.95;E-0. 1.653:=07 .0 1 215E+C2 . 1. Ache *02 19 0. 5.400 E+? 1 N 1 650E-05 1 160E=0E .0 7.5(SE*42 .? 7.L15E+s2 20 1. 5 120E+'3 H 5 54JE-05 1. C5 0 E -0 2 .4 6 22EE+C3 .o 1.1C5E+73 21 C. 6.4COE**2 H 1 15 CE-C
- 2*99:E-C5 .3 2 8d2E+03 .C ;.242E+u3 33 C. 3.50 CEC 1 D 7 26]E-0 4 1 22JE-06 .3 3 9E9E+C2 .3 ?.E2sE+C2 33 2. 7. 4 0 3 E.' 4 H 4.C6;E-3* 2.EC E-1C 4.6 1 122i+C5 26 3.9 32 E + C 4 30 C. 1.4E0E+05 H 8 420E-Q7 1.540c-42 .4 4.34wE+05 .4 J.66.E+35 37 4 4.240E*02 D 1. 2 93E -s 2 4.15JE-0* 4.0 3 1CSE*02 .C -1.122E+C2 26 C. 2 343E+'2 H 9. 370C-3 4 2.3 7J E -C 6 .3 2. 718 E + C 2 .3 7.37tE*;l 29 0. 2.960E+C2 0 2.4m:E-Oi 1 843E-GE .0 1 327E*C2 .C 1.C41E+C3 30 0. 2 9mCE**2 0 6 363E-14 2.140.-oc .2 2 9 72E*02 .2 1 19eE 63 31 C. 4.440E+"5 H 4 613C-4 7 f.71*E-12 .3 *.5 2 2E+C 5 .3 1.Cd2E*35 33 0. 1.650E**5 H 7.633C=:1 1.140E-12 .5 f.6 9 2E+05 .5 4.643E+.5 33 1. 9 58CE+04 H 1 55*E-0! 2 2CDE-10 1.1 7.0 45E+0 4 .1 -2 535!*C4 34 0. 9.Sc0E*C4 H 8 21 JE-C s 5.020E-14 .1 1 411E+C6 .1 1 315E+"6 35 O. 9.5 -C E+J 4 H 2.010E-Os 2 30LC-11 .2 8.7 2 5E+ C 4 .2 -t .4 C S E *3 3 36 1. 7.500E+ 1 D 2 71CE-3 c 6.910E-12 1.1 3 922E+C5 .1 3.92.E+C5 37 C. 1 033E+ 6 H 2 203C f. 9 33 E -15 .1 4.34eE+06 .1 3.w1LE+C6 39 0. O. H 3 220E-0 6 f.963E-11 .1 3 59 4E+0 4 .1 3 594E+C4 40 C. C. H 7 523E-06 4.EdCE-1C .1 1 5 41E + C 4 .1 1 541E+C4 41 C. 3. D 6 28JE-02 1 49JE-11 16 2 522E+35 16 i.52;E +C5 42 C. O. H 8. 60 3C-C 9 6.C0CL 1! .3 1 4 22E*C6 .C 1.433E+J6 43 0. O. H 8.EJ2E-1 E.C00E-11 .0 1.4 2 3E* 0 7 .0 1 433E+07 04 0. 6. H 8.48CE-10 * .103E-11 .0 1 642E+07 .C 1 663E*J7 45 0. 4.4:0E+t2 D 4.673E-Ce E.51GE-C7 .3 5 4E8E+02 .3 1.CeiE+L2 !
40 0. 3. H 8 320E-01 1.C80E-05 .0 7.7 C 4E *0 2 .0 7.704E+C2 l 47 0. C. D 1 15 JC-0 5 2.38.E-05 .0 3 402E*C3 .C 3. 4 C 2 E
- 2 3 48 0. S. H 2 43CE-C7 2 263E-12 .2 7 454E+.,5 .2 7.454E*35 l 49 U. O. D 3.dd E-C7 1.470E-12 1.0 2 6 25E*C6 1.3 2.639E+:6 50 C. O. H 1 66CC-0 6 f.2dwC-12 .4 2.o43E*05 .4 2 643E*C5 l 51 3. O. H 4 280E-01 2.363E-1C .0 1.274E*c3 .0 1.274E*23 r
2.6-8 l
Table 2.6-1 (Cont.) P]dnt-Specific and Effective Posterior and Prior Data INDIAN Po!NT 3 UPDATED EFFE CT I V E EFF ECT IV E COMP NO. OF SERVICE HRS ME A1 VARIANCE P 3 ST E 110 R PRIOR F A! LURES OR DEMA405 3 70 0E+ 0e H 9.lbO -38 1 010 E -14 .8 9 059E*06 .8 3 359E*06 1 0. 2.000 -38 1.890E-13 .3 1. C 58:+ 3 5 .0 1.356E*:5 0 0. 1. 9 73:+ C 2 H 1 550E+0 3 0 6. 910 E - 15 1. 0 30 E -Os .5 6. 7 C9 E + 0 3 .5 5 159E+03 3 0. 4 8 643E+35 H 2. 5 8 0E - 3 7 1 00 0 E -13 .T 2.5e0E+06 .7 1 716E+06 0. 3 560 -36 1.263E-11 10 2 4 59 E
- 0 5 .0 1 259E*05 5 1. 1 603:+J5 H 1.510:-33 2.640E-G5 .9 5. 7 20 E + 0 2 .9 3 280E*02 6 C. 2.440 +0? D 7 0. 2 930E+0g H 9.9 TOC-08 4.350E-12 .0 2. 2 53E + 0 4 .n 2 224E+04
- 0. 3.840E+12 0 4.980:-04 4.030E-CF +6 1 2 36E+ 0 3 .6 3 477E+02 6
9 0. 4.800E+35 H 1 690*.-3F 6.9C3E-14 .4 2. 4 49E + 0 6 4 1 969E+06 2 433E+04 H T.700E-39 2.47CE-13 .C 2 219 E+ 0 5 .0 1 979E+35 10 0.
.5 3 148E+32
- 2. 8.000E+G2 0 1.360 -33 1 220E-06 1.5 1 115 E + G 3 11 .3 1 202E+02 0, 4.003E*01 3 1 653:-33 1 033E-05 .3 1. 6C2 E+ 0 2 12 .9 -2.541E+00 13 1. 4.000:+31 H 1.190~-33 4.77CE-05 .1 3. 7 46 E
- 01 14503E-34 1.740E-C8 1.3 3 619 E* 0 3 .7 6.194E+02 14 2. 9.0 30E+ 0 3 H 4 9 3 3E+ 34 H 3.260E-36 2 470E-11 4 1 3 2; E + 0 5 .4 9.398E+G4 15 0.
.0 S.902E+02 5.300 *01 M 1 650:-35 2 220E-0$ .G F.4 TE+ue 16 0.
-4.264E+03 11 3. 4. 3 0 3E* 0 4 H 4.680:-05 1.0FCE-C7 2.0 4. 3 74 E + 0 4 -10 2.003E+0; H 1 9 6 0E - 3 5 1.FCOE-OF .0 1.153 E + 0 2 .0 1 133 E + 02 18 0.
2 0 0 3E+ 71 H 1.TF3-35 6.440E-C3 .0 2.743E*02 .0 2 54BE+02 19 0. 3.445E+03 20 C. 1. 2 0 3 E + C 3 4 9.990;-36 1 9h3E-09 .1 5.045E+03 .1 6.000E+32 H 3. 7 7 CE- 3 4 E.300E-0T .3 F.111E+02 .7 1 111E* J2 21 1.
.2 2 947E+02 22 0. 1. 0 0 0 E+ 11 3 T .4 3 0:- 3 4 2 560E-C6 .2 3. c 47 t + 02 4 833E+34 H 9.19 C:- 3 4 2 230E-13 4 4. 390 E+ 34 .4 -4.099E+C3 23 0.
.3 1.453E+35 9.e00E+04 H 9. 7 3 C - 0 7 3. 3 4 0 E - 12 .3 2. 913 E + 0 5 24 0.
9.6 25E + 31 27 2. 1 453E+ 02 D 1.4 4 C - 02 5 120E-05 4.1 2.813E*02 21 2 040E+02 H 9. 3 ; 3E-3 4 3.3FCE-C6 .3 2. 7 73 E + C 2 .3 7.371E*01 23 0. 7 67eE+01 29 1. 1.920!+02 0 1. 3 3 0 E - 0 3 5.573E-3~ .3 2 3b8E+02 .7 1.420E+02 3 1.453:-33 1.120E-C5 .2 1 295E+02 .2 -1.254E+01 30 0. 5.4 3 9E
- 05 31 1. 2. 4 8 0 E+ 3 5 a 2.6 7 CI-3 6 3 210E-12 22 8. 319 E + 0 5 12 1 280E+35 H 8.390:-31 1 570E-12 4 5. 3 44 E + 05 .4 4.G64E+05 32 0.
F.20]E+34 H 3. F 7 C: - 3 6 6 920E-11 .2 5. 4 48 E+ 0 4 .2 -1.752E+04 33 0.
- 7. 2 3 3E+ 3 4 H R.350E-38 6. 4 40 E- 14 .1 1. 2 97 E + 0 6 .1 1.J25E+06 34 0.
5.237E+07 35 2. 7.233E*04 H 1.350 -35 2 550 E -13 714. 7 5. 2 94 E+ C T 712 7 H 8.323 -37 1 030E-G) .0 7. FC4E* 0 2 .0 7.704E+02 36 0. C.
.C 3.402E+03 37 0. O. D 1.15 C:-3 5 3.390E-09 .0 3. 4 02E+ 0 3 D. H 2.430:-07 3.260E-13 .2 7. 454 E+ 0 5 .2 7.454E+03 38 0.
O. D 3. 9 8 CE - 0 7 1.473E-13 10 2.629E+06 10 2*639E+06 39 0. 2.543E+05 40 0. O. H 1.660E-36 6.280E-12 4 2.643E+05 4 O. H 4.280 -07 3.360E-13 .0 1. 2 74 E + 0 3 .0 1 274E+03 41 0. 2.314E+06 42 0. 5.453:+05 H 3 250;-39 1 273C-14 .1 2. 559E + 0 6 .1 H 3. 2 2 0E - 0 6 8. 9 6 C E - 11 .1 J,594E+04 .1 3.594E+04 44 0. O. H 7.520!-06 4.S63E-10 .1 1 5 41 E + 0 4 .1 1.541E+04 45 Oc 0. C. D 6.280 -06 2.490E-11 16 2. 5 22 E + 0 3 16 2.522E+05 46 0.
- 1. 4 33 E + 06 H 8.600:-39 6.CCOE-15 .0 1. 4 M ; + 0 6 .0 47 0. O.
8.400E-10 6.C00E-1T .0 1. 4 33 E + 0 7 .0 1. 4 3 3 E
- 0 7 48 0. O. H 49 O. H 8 3d0;-10 5.103E-17 .0 1.663E+0F .0 1.663E+07 0.
50 0. 1 4 4 0:+ 0 2 0 1 1TO -33 8.863E-03 .3 1. 3 21 E + 01 .0 -1.30SE+02 2.6-9
i The IPPSS analysis is al60' based on the assumption of constant i (across time and similar components) failure rates and probabili-ties. This is standard in risk assessments, but the reader should be aware that it may be the source of substantial errors that are not quantifiable except by Bayesian extremists (and Indian Point doesn't go that far). Aging ef fects may be present and f ailures may cluster due to imperfect repair. Modeling such effects can be dif-ficult and is often impossible to do with meaningful precision because of limited data. The result of the Indian Point study is not "the risk" from the Indian Point plant, but is an estimate of the Indian Point risk--an estimate built from a variety of simplifying assumptions and models. 2.6.4 Estimation of Initiating Event Rates The initiating event frequency data for all PWRs are given in IPPSS Table 1.5.1-32 (p. 1.5-148). The basic source of their data is EPRI NP-801, modified by the data obtained from detailed examina-tions of the Indian Point and Zion plant records. In examining their data, we noted some differences for Indian Point in this report and the data given in the Zion study. For example, the ZPSS shows 39 and 8 turbine trips at IP2 and 3, respectively; the IPPSS shows 32 and 4. The detailed examination of Indian Point records followed the Zion study and yielded different results from EPRI NP-801. The effect, though, should'be small since the Indian Point estimates, particularly for those events that have frequently occurred, are dominated by Indian Point data. Nevertheless, a detailed study of initiating event occurrences industry-wide would be of some interest. Also, we noted that in scme cases, the IPPSS listings of initiating events do not match the numbers in the sum-mary tables. For example, at IP-3, three turbine trip / loss of off-site power events are listed; only one was counted in their calculations. The method used (but not described) by Indian Point to estimate initiating event rates is to suppose that each PWR has its own c'onstant occurrence rate and the rates vary randomly among PWRs according to a lognormal distribution. They assume a prior distri- t butivn over a grid of (g,o) values--the parameters that identify a l lognormal distribution--then update it by the ensemble of PWR data I to obtain their posterior distribution of occurrence rates. This distribution, after discretization, serves as their prior distribu-tion which is then " updated" by the Indian Point data (units 2 and 3 being analyzed separately). These " generic" priors are different in the IPPSS from what they were in the ZPSS, and not just for reasons given in the preced-ing paragraph. In principle, they should be the same because the data and state of knowledge are the same. But consider the large LOCA initiating event. In the ZPSS, the occurrence rate had a prior mean of 1.0(-3) and a variance of 6.4(-6); in IPPSS they are 2.6(-3) and 1.8(-4). These same results pertain to all initiating events l l 2.6-10
^ ^ n
that have not yet occut ted. One wonders what was learned about these events between the two studies to wattant this injection of pessimism. It turns out (from conversations with the authors) that the answet is nothing. The difference is just due to diffetent choices of a (p,e) grid, guided by two analysts' concepts of what looked tight at the end of the analysis. The effect is not triv-ial. Indian Point is estimated to have large LOCAs (roughly) twice as frequently as Zion. As in the previous section, we can gauge the impact of the chosen prior distributions, aftet discretization by calculating the effective posterior data from Indian Point's posterlot means and variances. The IPPSS also gives percentiles from their posterior distributions. An alternative way to express theit tesults as effective data is to let f be the observed numbet of occuttences of a patticulat initiating event at Indian Point, then find the value of T (in years) such that the upper 95 percent statistical confi-dence limit on the occurrence tate is equal to Indian Point's posteriot 95th percentile. For example, fot large LOCA (and the other nonoccurring events), f = 0 and the 95th posterior percentile, A95, is 6.30 x 10-3 The effective T is given by x (2f+2,.95) T= 2A 95 where x2(m,Y) is the 100 yth percentile on the chi-squated distribution with m degrees of freedom. For large LOCA, T= = 475 yts.
-3 2 x 6.3 x 10 The Indian Point 2 experience is zero occurrences in 5 yeats, so the ptiot effectively adds on 470 LOCA-free years. Note that the total PWR expetience used in the IPPSS data base is 131 years, so the assumed ptiot " state-of-knowledge" is effectively 339 LOCA-free years. (For Zion, the 95th posteriot percentile corresponded to 0/844 years.)
The posteriot mean and variance for large LOCA yield effective data of .04/21. Note though that data of 0/21 would yield an upper 95 percent statistical confidence limit of .14 occuttences per year, which is considerably more pessimistic than Indian Point's 95th percentile. The calculation in the previous paragraph better conveys the information assumed in Indian Point's analysis. The calculation of effective data from the posterior mean and vatiance, when it yields small fractional occurrences, may not accurately reflect the information injected by the priot distribution. 2.6-11 e n n
Table 2.6-2 gives the effective posterior initiating event data calculated from Indian Point's posterior 95th percentile.and their j posterior means and variances. Note that in all cases Indian Point's 95th percentile is more optimistic than the data alone would yield: the ef fective T exceeds the observed T, considerably for nonoccurring events, negligibly for those that have occurred often at Indian Point. However, we feel the nonIP experience is relevant to estimating these rates and the effective weight given to this experience by the IPPSS analysis is not unreasonable. For example, the small LOCA data could reasonably be pooled over the population considered thus yielding an estimate based on 3/131. The IPPSS estimate is effectively based on 0/57, which is not at odds with
! 3/131.
' An assumption underlying Indian Point's analysis here, as in their analysis of component failure data, is that of a constant
. occurrence rate across time. No analysis is given to support this ! assumption, though the referenced source of transient data (EPRI NP-801) should permit such an analysis. There may be aging trends that need to be considered for transients such as steam generator tube rupture.
- 2.6.5 The Treatment of Maintenance Data Indian Point models the unavailability of a component .e to l
maintenance as the rate at which maintenance actions occur sactions i per component hour, excluding cold shutdown hours) times the mean duration of a maintenance. Prior distributions for both are devel-oped, modified by the Indian Point data to yield posterior distributions, then the distribution of the product is obtained. Table 2.6-3 provides a comparison of unavailability estimates (including estimated maintenance frequency and average duration) using the Indian Point posterior means and using just the reported maintenance data. Only for the turbine-driven AFWS pumps do the posterior estimates appear optimistic, relative to the raw data, and then by a factor of two to three. The largest difference in the other direction is for Indian Point 2, component cooling water pump 21, but only one maintenance action has occurred. Those unavailabilities that are important in selected accident
; sequences will be examined further in later sections.
4 i ! 2.6-12
' ^ -" -,
Table 2.6-2 Indian Point Observed and Effective Posterior Initiating Event Data; Table Entries Are (No. of Occurrences)/(No. of Yrs.) Indian Point 2 Effective Posterior Initiating Event Plant Fron 95th Category Data Pct. From Mean, Var.
- 1. Large LOCA 0/5 0/475 .04/21
- 2. Medium LOCA 0/5 0/475 .04/21
- 3. Small LOCA 0/5 0/57 .5/28
- 4. S/G Tube Rupture 0/5 0/32 .3/12
- 5. Steam Break Inside Cont. 0/5 0/475 .04/21
- 6. Steam Break Outside Cont. 0/5 0/475 .04/21
- 7. Loss of Feedwater Flow 35/5 35/5.6 39/5.8
- 8. Closure of One MSIV 7/5 7/6.6 6.7/5.4
- 9. Loss of Primary Flow 0/5 0/9 1.5/11
- 10. Core Power Increase 0/5 0/44 .4/16 lla. Turbine Trip 39/5 39/5.6 38/5.2 llb. T. T., Loss of Offsite Power 1/6 1/10.4 1.8/8.7 11c. T. T., Loss of Serv. Water 0/5 0/475 .04/21 12a. Reactor Trip 36/5 36/5.6 38/5.5 12b. Reactor Trip, Loss of Cooling Water 0/5 0/475 .04/21 Indian Point 3
- 1. Large LOCA 0/3 0/450 04/18
- 2. Medium LOCA 0/3 0/450 .04/18
- 3. Small LOCA 0/3 0/55 .4/18
- 4. S/G Tube Rupture 0/3 0/30 .3/8.0
- 5. Steam Break Inside Cont. 0/3 0/450 .04/18
- 6. Steam Break Outside Cont. 0/3 0/450 .04/18 7 Loss of Feedwater Flow 12/3 12/3.5 12.4/3.3
- 8. Closure of One MSIV 0/3 0/10 .5/5.2
- 9. Loss of Primary Flow 0/3 0/7 1.4/8.2
- 10. Ccre Power Increase 0/3 0/37 .3/11 lla. Turbine Trip 8/3 8/3.5 9.6/3.5 lib. T. T., Loss of Offsite Power 1/3 1/8.2 1.5/5.8 lle. T. T., Loss of Serv. Water 0/3 0/450 .04/18 12a. Reactor Trip 8/3 8/3.5 11/3.8 12b. Reactor Trip, Loss of Cooling Water 0/3 0/450 .04/18 2.6-13
_ _ _ _ _ _ _ _ _ _ _ _ _ ___ n _
i 1 Table 2.6-3 Comparison of Unavailability (Due to Maintenance) Estimated Means Indian Point 2 Posterior Plant Data Freq. Freq. Events / Dur. Events / Dur. Components Serv. Hr. (hrs) Unavail Serv. Hr. (hrs) Unavail ni Turbine-Driven AFWs Pumps 1.9(-4) 24 4.6(-3) 3.4(-4) 40 1.4(-2) 6 Motor-Driven AFWS Pumps 8.6(-5) 26 2.3(-3) 5.6(-5) 46 2.6(-3) 2 comp. Cool. Pump 21 1.3(-4) 11 1.4(-3) 5.6(-5) 1 5.6(-5) 1 Comp. Cool. Pumps 22, e3 1.4(-4) 306 4.2(-2) 8.4(-5) 406 3.4(-2) 3 cont. Spray Pumps 8.: -5) 10 8.1(-4) 8.4(-5) 5 4.2(-4) 3 Rnh Pumps 8.3(-5) 12 9.7(-4) 8.4(-5) 12 1.0(-3) 3 Safety In3 Pumps 9.6(-5) 12 1.2(-3) 1.1(-4) 17 1.9(-3) 6 serv. Water Pumps 3.3(-4) 213 7.0(-2) 3.5(-4) 254 8.8(-2) 37 Fan Coolers 6.7(-5) 16 1.4(-3) 5.6(-5) 3) 1.7(-3) 5 Diesel Gens. 9.1(-4) 33 3.0(-2) 9.9(-4) 29 2.9(-2) 53 Aux. Coup. Cool. Pumps 5.8(-5) 10 5.9(-4) No Maintenance Eventt Indian Point 3 Yurbine-Driven AFWS Pumps 1.6(-4) 25 4.2(-3) 2.5(-4) 36 8.9(-3) 5 Motor-Driven AFWS Pumps 1.7(-4) 23 4.0(-3) 2.0(-4) 30 6.1(-3) 8 l Lomp. Cool. Pumps 6.4(-5) 220 1.8(-2) 3.3(-5) 147 4.9(-3) 2 l Cont. Spray Pumps 7.1(-5) 10 7.3(-4) 5.0(-5) 10 5.0(-4) 2 unH Pumps 6.3(-5) 12 7.6(-4) 2.5(-5) 16 4.0(-4) 1 Safety In3. Pumps 5.5(-5) 15 8.1(-4) 1.7(-5) 66 1.1(-3) 1 l Serv. Water Pumps 3.2(-4) 46 1.5(-2) 3.3(-4) 60 2.0(-2) 40 i l i l Diesel Gens. 2.9(-4) 37 1.1(-2) 3.2(-4) 28 8.9(-3) 19 ' l l i Aux. C ol.ip . Lool. Pumps 4.4(-5) 44 1.9(-3) No Maintenance Events Fan Coolers 5.1(-5) 11 5.5(-4) No Maintenance Events l 2.6-14 a ~ w
I 2.6.6 Data-Free Estimates ! As discussed in 2.6.3 above, to obtain prior distributions Indian Point either equated WASH-1400 5th and 95th percentiles to their 20th and 80th, or they took theThis ratiocan of renult UASH-1400's 5/95 in quite skewed percentiles as their 20/80 ratio. and elongated distributions for which the mean and variance do not provide a very good description. Fortunately, the amount of data available from Indian Point and the DPD arithmetic can effectively chop off these long tails in the most extreme cases. There are,
- however, numerous probabilities and rates for which no data are available. Most of these pertain to human errors, but some pertain i to hardware failures. With respect to the latter, we have encountered some instances in which Indian Point accepted WASH-1400 bounds as their own 5th and 95th percentiles, rather than stretch them out to 20th and 80th percentiles as they did in those cases in which data were available. These are:
- Rupture of a motor-operated valve. As discussed l
in Section 3.2.15, rupture of two MOVs leads to an interfacing systems LOCA and one of the more serious releases. If Indian Point had stretched out the WASH-1400 bounds, the estimated probabil-ity of this event would increase by five orders of magni tude. Because of this extreme sensitivity, a 4
! new analysis was performed, at our request, by the IPPSS authors.
I - Pressure vessel rupture. By citing UALH-1400 bounds on the occurrence rate of this event, Indian Point dismissed it as a potential LOCA. If they had stretched these bounds, the contribution 2 would not have been negligible. Pipe rupture. For pipes exceeding 3" diameter, the WASH-1400 bounds are'3(-12) and 3(-3) pipe l failures per br. Equating the e to lognormal 5th
~
and 95th percentiles yields a mean of 8.6(-10)/hr. i Equating these to the 20th and 80th percentiles yields a mean of 4.5(-7), an increase by a factor of 500. Thus, for example, in the IP-2 service water system the IPPSS identifies 30 piping sec-tions and thus estimates the failure probability
- as 2.58(-8) over a 1-hour period. If they had used 20th and 80th percentile assumptions, this probability would have been estimated as 1.4(-5).
l The point of this discussion is not to claim one estimate is right, j the other wrong, or is it to insist that Indian Point should have
- been consistent in their treatment of UASH-1400 bounds. As Baye-
)
sians they can specify any prior distributions they feel represents their state of knowledge. One wishes, though, the reader would be l 2.6-15 l l .- -. - - . - . - _ . _ _ - - _ - . _
-- .~ - - - . __ _ .. - - _ - --- _ . - .
a ] told why in some cases WASH-1400 bounds are OK and why in others they should be stretched out. The main point of these examples is that the results can be quite sensitive to what would seem to be minor differences in assumptions. i As noted above c the DPD can chop off the tails of highly skewed lognormal (or other) distributions. Unfortunately, nothing is said in the IPPSS about the rationale for any particular discretization--
; how many and which discrete values were chosen. The effect can be nonnegligible. For example, the low pressure recirculation system j (IPPSS p. 1.5-606 for IP-2) model contains a first order term, 1.ll10HI, where Ogr is a human error term. This term is added to various other terms (treated as independent random variables) to yield the system failure probability, denoted by QLOW HEAD. The stated variance of Q H I is 6.0(-4). Thus the variance of Q LOW HEAD should exceed (1.111)Z x 6.0(-4) = 7.4(-4). The DPD convolution for QLOW HEAD, however, yields a variance of 1.4(-4). In effect, here DPD is like having five times as much " data." We find it dis-turbing that this unpresented portion of the analysis can have such an effect.
2.6.7 System Quantification i fault Define a system as a specified arrangement of components. By a j tree, or a reliability block diagram, a mathematical model can be developed which expresses the system failure probability as a i
! function of the component failure probabilities and rates. Given posterior probability distributions for these component parameters, and prior distributions where no data are available, the resulting posterior distribution of the system failure probability can then be derived or approximated. The approximation method used by Indian Point is their DPD arithmetic.
l In Section 3, we consider the results of this analysis for some specific systems. ! As in the cases of component and initiating event estimates, it is possible to express Indian Point's analysis in terms of effective data and a conventional statistical analysis and thus assess on methodology thetheir impact system of their prior distributions and analysis results. point. Here we consider a general In Section 0.16, the IPPSS authors make the excellent point (couched in Bayesian terms) that if a system contains two or more components whose failure probabilities are estimated by the same data, then this fact must be accounted for in estimating the system failure probability. Thus, for example, for two identical com-ponengs and B in series for which the posterior mean and variance are a terior mean respectively, and variance theofsystem 2n and failgre 4B probability has a pos- ' in If the two estimates were 2Bgorrectlyassumedtobe independent, the derived' variance would be
, which is tog small.
probauility is p , say, which Fortwoparallelcomponengs, tgefailurc has a mean value of a +B 2.6-16
l This is correct, but as a point estimate of p2, this mean value can be very conservative. Suppose one begins with a noninformative prior and modifies it with data, x/n, so that the posterior distribution has a mean of p* = x/n and var iance = p* (1-p) /n . Then, the posterior mean which is the Indian Point estimate of p 2 is: a 2+32 = p*2 + p* (1-p* ) /n The expected value of this estimate (with respect to the sampling distribution of p*) is (approximately) : E(u2+32) ,p2 + 2p (1-p) /n This result shows that, unless (1-p)/n is much less than p, the 2 Indian Point posterior mean value, regarded as an estimator of p , could be seriously biased (bu t in a conservative direction). This probleia affects Indian Point's estimate of the probability of an interfacing system LOCA, which is one of their dominating contributors to risk. From a Bayesian viewpoint, one could argue that both p and p2 should not be estimated by their posterior means. In full-blown Bayesian analyses, a point estimate is selected on the basis of a loss function. If squared error loss is chosen (which means the penalty for estimating p by p* is (p-p*)2), the posterior mean is the resulting estimator. However, squared error for p is not equiv-alent to squared error for p 2, so a Bayesian indiscretion occurs. Straightening this out is beyond the scope of this review. S e c <- tion 0.16 of the IPPSS creates the impression that if one has selected a point estimate, say p*, of p, with or without encumbering that estimate with lognornial connotations, then p*2 is unaccept-able as a point estimate of p 2. Not so, by either Bayesian or statistical arguments. For point estimates, we prefer just inser-ting point estimates into the system function. Determining statis-tical confidence limits though, requires accounting for the repeated use of the same data, analogous to the IPPSS accounting in obtaining their posterior distributions. Confidence limits should reflect this aspect of the analysis. Point estimates need not, and in fact, it is confusing and unnecessarily conservative to do so. 2.6.8 Common Cause Quantification This section discusses the various methods the IPPSS used to quantify common cause internal event failures. t 2.6-17
As an example, consider a system consisting of two identical trains. It can fail if (a) there are two independent train fail-ures, (b) one train is out of service for maintenance and the other fails, or (c) one train has been disabled due to a human error and the other fails. Additionally, there may be (d) a human error or errors that disable one or both trains and there may be (e) support system failures that disable one or both trains. The IPPSS explic-itly considers port all of these by conditioning on the state of a sup-system, generally electric power for which eight states are defined, then estimating the conditional probability of (a) through (d). Even so, it is recognized that there may be "other" causes of joint failure of the two trains. For example, there may be human or physical links not explicitly recognized. Indian Point estimates system ways: failure probabilities for these situations in a variety of l I
- 1. Inclusion of a B-factor (B).
- 2. Linkage to another estimate (L).
- 3. Judgment leading to a conclusion of negligible (N).
Table 2.6-4 shows the treatment of "other" failures in the IPPSS. The B-factor is in effect a factor to account for possible dependence between failure events. In the above example, if g denotes the failure probability of one train, then inclusion of a B-factor other leads terms to system in the failure model. system failure probability of q2 + Bq, ignoring If we write this as q(q + C), then q + B corresponds to the conditional failure prob-ability of the second train given failure of the first. In principle, IPPSS. B can be estimated from data, but it is not in the Indian Point specifies their personal probability distribu-tion for B as a lognormal distribution with a mean of .014 and a variance of .001 and of .05. 6.l(-4), which corresponds to 5th and 95th percentiles it is used. This " state-of-knowledge" is the same everywhere The basi's for Indian Point's assumed personal probability distribution for the a-factor is vague. A typical statement is the following:
"Most of the observed coupled failures in the industry involved motor- or air-operated valves that had to 1
change position on demand. The frequent partial tests and full refueling system tests indicate that an unforeseen commen cause failure is of low frequency. This factorstate withofrange k.owledge of 1.0isxexpgessed 10- to 5.0by taking a B x 10-2 which yields a mean and variance of: og = 1.4 x 10~ O g = 6.1 x 10-4" (p.l.5-483). l 2.6-18 l l !
Table 2.6-4 IPPSS Treatment of "Other" Failures System IP-2 IP-3 Electric Power L L Reactor Protection L L Safeguards Act. L L High Pressure Injection 0 0 Low Pressure Injection B N Recirculation 0 0 Containment Spray N N Fan Cooling N N Component Cooling N N Service Water N N Auxiliary Feedwater N N L = Linkage 0 = b-factor N = Negligible 2.6-19
. - =. -. _ - _ _ _ . - . _ . _
It would have been more straightforward for the authots to say, "We will model explicitly those dependencies we are aware of and deem important, such as by conditioning on electric power, and omit any others, because we feel they have negligible probability." The one case in which the IP-2 and IP-3 analyses diffeted (low pressute injection system) is probably an oversight. Exactly the i same words were used to discuss "other" failures. In only one case, . though, were they followed by a 0-factot calculation. 1 Fot the electric power systems, it was argued that "other" - l failures must be less likely than any specific failures, so the probability distribution assumed for the probability of "other" failures had its 95th percentile set equal to the smallest mean from ' an identified cause. For the other two systems where linkage was used, it was assumed that common calibration errots had the same probability as hardware failures. Alleffect. of these "other" failures estimated by linkage had a negligible In general, we find the use of the same 0-factor to be inappropriate. The impact of alternative methods of estimating the probability of (possibly) nonindependent failures were discussed in Section 2.4 as they arose for different systems. i l t 2.6-20 __ . _ . - _ _ _ _ _ . _ __ .. , ._ . . _ _ . _ _ _ _ , - _ _ _ _ ~ _ _ _
2.7 External Events 2.7.1 Seismic In this section, the seismic external event is reviewed. The material in Sections 2.7.1.2 to 2.7.1.7 is based on a report pre-pared by Jack R. Benjamin and Associatec, Inc. (JBA) . Their report is contained in the Appendix A of this report. Appended to the JBA report are reports by Professors Ronald L. Street and Erik H. Van-marcke which discuss the seismological and the seismic hazard analysis aspects, respectively. Subsegent to the August 25, 1982 draft of this report, Pickard, Lowe & Garrick (PLG) prepared a response to the review comments (Reference 6) and a meeting was held on October 13, 1982 in Albuquerque, New Mexico, to discuss the critical issues. We have incorporated consideration of PLG's response into this review. Since the draft report, a revised analysis was performed by PLG for Unit 2, wherein the impact between the Unit 1 and 2 control room roofs was eliminated by a planned modification. Reference 7 gives the results of the revised analysis. In support of this analysis, Reference 8, which gives the basis for the revised capacity for the Unit 2 control room, was prepared. We performed a cursory review of this report and generally concur with the revised fragility values. The revised analysis was considered in our review comments given in the following text. As discussed in subsequent sections, we feel that the capacity of the Unit 2 control room ceiling has the same problems as the ceiling for Unit 3. Thus, we feel that the revised frequencies for Unit 2 are low. As part of the recent USNRC program to investigate the seismic capacity of Auxiliary Feedwater (AFW) systems, the licensee of Indian Point 3 responded with a report addressing the seismic qualificaton of the AFW system (Reference 9). This report identi-fled components which have not been seismically qualified to the SSE level. A review sponsored by the USNRC concluded that the AFW system at Indian Point 3 cannot withstand an SSE (Reference 10). We perfortaed a cursory review of References 9 and 10. We doubt that the capacity of the components, which included piping, values / actuators, power supplies, initiation / control systems, and struc-tures have as low a capacity as concluded in Reference 10. However, we have not performed an independent review. We believe that the potential weaknesses raised by References 9 and 10 should be investigated and accounted for in the IPPSS. A study to determine the effects of interactions between seismic and nonseismic equipment on seismic core melt within the AFW system was also conducted for Unit 3 (Reference 11). We have also per-formed a cursory review of this study. We have not checked in detail the fault trees or calculations leading to the frequency of core melt. Our judgment is that the basic elements of the study are complete; however, we did not confirm that the results are 2.7.1-1
i accurate. The effects of failure of nonseismic equipment were found by PLG to be small for the frequency of core melt. The capacity values for the nonseismic equipment were based largely on engineer-ing judgment. The median capacity values given appear to be reason-able; however, we were unable to check them directly. i The comments given in Sections 2.7.1.1 through 2.7.1.7 represent the most significant issues in the review and summarize the final conclusions. More detailed discussions of the issues can be found in the JBA report (see Appendix A). 2.7.1.1 Seismic Logic Model The seismic logic model is reviewed in Section 2.7.8. 2.7.1.2 Seismic Hazard The methodology used in the IPPSS is appropriate and adequate to perform a seismic risk analysis. The procedure is based on a simple ! probabilistic model which uses some data, but currently relies
- heavily on engineering judgment. An important element of the seis-micity studies conducted for the Indian Point site is the explicit treatment of the sources of variability in the analysis. The uncertainty in the analysis can be attributed to the limited data available on eastern U.S. seismicity and ground motion. This uncertainty is reflected in the final family or seismicity curves.
i The two seismicity studies performed for the IPPSS by Dames and Moore (D&M) and Woodward Clyde Consultants (WCC) clearly identify the fact that variability due to modeling assumptions, or uncer-tainty as defined in the seismic fragility analysis, can contribute significantly to the uncertainty in the frequency of exceedance curves. In addition, the statistical variability due to limited data and the inherent randomness of the process, which is combined with the modeling uncertainty, is also a significant contributor to the variablility in the final family of seismicity curves. i In generating the family of seismicity curves, the results of the D&M study have been modified in two ways. First, sustained-base peak acceleration values have been shifted by a factor of 1.23 to provide sustained acceleration; and second, the hazard curves have been truncated to reflect the belief that there is a maximum ground shaking intensity which can occur. i We believe that even if the curves had not been shifted there would be only a small change to the frequency of core melt analyses , i presented in the IPPSS report for Unit 2 and a moderate change for j Unit 3. In general, we believe that a shifting factor F equal to 1.25 (which is. essentially the same as the value of 1.23 used in the D&M report) is on the conservative side for structures. For equip-ment located in structures, which have a capacity below the capacity of the equipment, this value of F is probably also conservative. 2.7.1-2 t
- , _ _ _ , , , . . . , _ , , - - . _ - , _ . . . , _ _ _ m_._, . _ , _ _ _ _ _ _ . - _ , _ _ _ _ . - _ _ . _ _ -v ,_-
i i I Equ ipmen t , which does not have inelastic energy-absorption
, capacity or which depends on function capacity, responds more closely to the peak ground acceleration capacity. One example of this type of equipment is the service water pumps which depend on
! binding of the pump shaft for capacity and which are located at the ground level. However, the capacity of this component is relatively high and eliminating the 1.25 acceleration f actor would not i significantly change the results of the analysis. Wehaveadoptedthefo$lowingscaletoquantifyourcommentsin reviewing the IPPSS report- , Effect on Mean Frequency ,l Comment of Consequences or Core Melt , Small Factor 6 2 j Moderate 2 5 Factor i 10 Large Factor > 10 i We agree that the upper-bound acceleration values applied to the D&M seismicity curves are reasonable. The WCC seismicity results were not modified in the main report as truncations were applied in the original study which is documented in the WCC section. We believe that the truncation of the hazard curves should more appropriately have been performed within the probabilistic analysis. However, as verified by an independent calculation, truncating outside the hazard analysis is conservative in that the l annual exceedance frequencies for accelerations below a truncation level will be higher than bad the truncation been performed in the probabilistic analysis. After considerable discussion and thought concerning the use of an upperbound cut-off on effective peak acceleration, we believe that it is more appropriate not to truncate the hazard curves at all, but to reflect a limit on damagability in development of the fragility curves. The mechanism to handle this effect is currently not an element of the fragility analysis. A new factor or redefini-tion of an existing factor is required to treat this frequency dependent effect. In both seismicity studies, a Ramapo fault zone was not explicitly considered. However, in recent years considerable scientific study of the geology and the historic and recent seis-micity, have lead to a belief that a Ramapo fault zone is an alter-i native hypothesis that should be considered in the hazard analysis (Ref. 1, 2, 3, 4, and 5) . At present, evidence to support the ' hypothesis that the Ramapo fault is a source of earthquakes cannot 2.7.1-3
be strongly supported by us and others (References 3 and 5). Recent evidence (Reference 3) confirms the location and orientation of the Ramapo faults; however, it does not support the theory that the zone is being reactivated. In Reference 5 an investigation of the stress in the Ramapo fault zone suggests that a regional compressional stress is trending northeast. This result does not support the thrust-type movements on the Ramapo fault. This conclusion contra-dicts previous results (References 1 and 4), that conclude the regional compressive stress is northwest trending and supportive of thrust-type movement. In our judgment, we feel that there does not exist strong evidence to support a hypothesis of a Ramapo source. Nonetheless, we investigate the impact of a Ramapo source on plant risk in Section 2.7.1.5 of this report. We agree that the overall seismic hazard methodology utilized by D&M and WCC is appropriate and adequate to determine frequency of exceedance curves on levels of ground shaking. Although the general probabilistic methodology is the same in both studies, there are differences in how the ground motion models were applied, the selec-tion of key parameters, and the definition of seismic source zones. In our judgment, the WCC study does not accurately represent the uncertainty in the earthquake process. Because of the low upper-bound intensity values used (ie, VII and VIII) in the WCC study; we believe that the seismic hazard is better represented by the D&M study. To obtain the final family of seismicity curves, the results of the D&M and WCC studies are given equal weight in the IPPSS. We disagree in two respects with this subjective combination; first with the method used, and second with the probability weights given to the two studies. The method of combining the results of the two seismicity studies has been carried out on the assumption that estimates of the same parameter have been provided by D&M and WCC. The D&M study has estinated the discrete probability distribution (DPD) on frequency. , We note that the WCC study, on the other hand, was undertaken to 1 provide "best estimates t'or actual input parameters," while attempt-ing "to formally accommodate the uncertainties associated with the various input parameters where such uncertainties are judged to be significant." We interpret this statement to mean that a "best estimate" seismicity study was conducted, as opposed to one in which the discrete probability distribution on frequency is estimated. This interpretation was confirmed at the meeting in Albuquerque. 2 The IPPSS combines the WCC "best estimate and the D&M DPD results to obtain a composite DPD on frequency. It is more appro-priate to perform a Bayesian combination of the mean values of the two studies. The "new" DPD on frequency is a distribution with an updated mean value, while retaining its previous shape and dis-persion (wh ich is given only by the D&M study). The approach used 2.7.1-4
in the IPPSS will not impact the mean value of the frequency of exceedance; however, it will have considerable effect on the result-ing DPD values in that it overestimates the spread (dispersion) of the distriDution. With respect to estimates of seismic risk the same conclusion applies. We also disagree with the subjective weights given to the D&M and WCC studies. Based on our review comments of Sections 7.9.1 and 7.9.2 (see Appendix A) we feel that the results of the D&M and WCC studies should be assigned probability weights of 0.80 and 0.20, respectively. 2.7.1.3 Seismic Fragility The methodology used in the IPPSS report for determining seismic fragility effects is appropriate and adequate to obtain a rational measure of the probability distribution of the frequency of core melt and associated release categories; however, the procedure is based on a simple probabilistic model which uses some data, but currently relies heavily on engineering judgment. Structural failure is defined as ". . . The onset of significant structural damage, not necessarily corresponding to structure col-lapse." This definition may be conservative in some cases and will tend to produce higher frequency of failure estimates compared to a definition based on collapse where functional failure is not an issue. It would be more appropriate to use a median definition and add uncertainty for the definition. We agree that it is appropriate to define failure as either rupture / collapse or loss of function, whichever occurs first. We agree with separating variability of seismic response and structural capacity into randomness and uncertainity components. Use of the lognormal distribution is appropriate as long as the extreme tails of the density function do not significantly influence the results of the analysis. It was found in performing the inte-gration of the hazard and fragility curves that most of the contri-bution (ie, greater than 90 percent) to the damage state SE and release category 2RW for Indian Point 2 in the IPPSS report was within three standard deviations from the median value for the con-trol building /superheater building impact fragility distribution which controlled the system fragility curve for SE/2RW. In con-trast, the contribution to SE/2RW for Indian Point 3 was generally beyond three standard deviations from the effective median value of the structure components which contribute to the mean frequency value of SE/2RW (ie, the control building and diesel generator fuel oil tanks at approximately 0.8g). We believe that the results for Indian Point 3 using the lognormal distribution are conservative since the lower tail of the lognormal density function tends to be higher than other reasonable distributions which could have been used. Ilowever, neglecting possible design and construction errors may overcompensate the possible conservatism in using the lognormal distribution. 2.7.1-5 l
- data, After reviewing the procedures used to produce the fragility we have a general impression which bears on the issue of con-sistency. We feel tnat the uncertainty of the parameters in the IPPSS report has probably been understated. There are various levels of sophistication ity parameter values, butwhich have been used to develop the fragil-we do not sense that enough uncertainty has been assigned to components where parameter values are based on more distant information.
Although in f airness to the IPPSS report, the values for au are generally larger for generic components as compared to plant specific components. On the other hand, we also believe that the median capacity values are probably low, which is conservative. Several obvious elements of uncertainty have been left out of the seismic fragility analysis. First, design and construction errors (eg, the problem cf piping supporte at Diablo Canyon) and dging effects are not included in the seismic fragility or fault tree analysis. These become extremely important issues for series systems such as piping and cables (ie, cable trays). We noted for several sections which we reviewed that PLG did not check the cal-culations which formed the basis for the fragility parameters that were developed. Thus, errors in the culculations could not be discovered by PLG. One approach used to develop fragility curves was based on analysis of generic data. Rather than working with the analysis of a plant specific component, failure and/or response data from similar components in similar environments are used as the basis to develop a fragility curve for the particular plant component being considered. We feel this procedure is appropriate under certain circumstances. If af ter determining the f ragility of a particular plant component using generic data it is found that the capacity is sufficiently high so that the component does not influence the release category analysis, then we feel the analysis is appro-priate. On the other hand, if the component is found to have a low capacity such that it influences (or could if changed by a small amount) the frequency of core melt analysis, then a more detailed analysis for that component should be conducted. As a result of our tour of the Indian Point Site, we question whether the IPPSS has considered all poscible failures of nonsafety-related structures or equipment, which could impact on safety-related j items. The IPPSS has included, for example, possible failure of the l stack, superheater building, and the turbine building onto the Unit l 2 control building for seiamic loads; however, the effects of fail-ure of nonsafety-related structures were not considered for the wind analysis. It was pointed out during the tour that the nitrogen bottles in the Unit 3 AFW pump room could fail and the released gas l propel them into safety-related control cabinets. This type of secondary failure was not considered in the original analysis; how-ever, as discussed above, it was considered as part of a recent study of the effects of nonseismic equipment within the APW system. 2.7.1-6
Another possibility which was not documented in the IPPSS report is potential failure of the polar crane structures in the containment buildings and possible failure onto equipment below. We believe that a systematic study should be conducted to identify and quantify the effects of all possible secondary failures throughout the entire plant which could affect safety-related structures and equipment. 2.7.1.4 Sensitivity Analysic In order to understand how changes in the analysis parameters might affect the mean frequency of release category 2RW, which is dominated by plant state SE, we performed a sensitivity analysis using the same discrete probability distribution procedure used in the IPPSS report. The mean frequency values given in the IPPSS report for SE/2RW are 1.4 x 10-4 per year for Unit 2 and 2.4 x 10-6 per year for Unit 3, which were used for comparison. The hazard curves from IPPSS report Sections 7.9.1 and 7.9.2 were used in the sensitivity analysis. The relative weights which were assigned were the same as used in the IPPSS report. The fragility curve values for SE/2RW were obtained from Table 7.2-4 for Unit 2 and Table 7.2-8 for Unit 3 from the IPPSS report. The purpose of the sensitivity study was to determine the differenceu between the D&M and the WCC seismicity curves and to investigate the effects of shifting and truncating the curves. The DSM curves were shifted by a factor of 1.23 (this was done to con-vert from peak ground acceleration to damage-effective ground acceleration) and truncated for assumed upper-bound cutoff values (see discussion for IPPSS report Sections 7.2 and 7.9.4 in Appen-dix A). The WCC curves developed in Section 7.9.2 were based on a damage-effective ground acceleration parameter and were also similarly shifted and truncated. (See discussion for IPPSS report Sections 7.2 and 7.9.2 in Appendix A.) The results of the sensitivity analysis are presented in Table 2.7.1-1. The combined results for the shifted and truncated curves at the bottom (0.8 x 10-4 for Unit 2 and 1.6 x 10-6 for Unit 3) should be the same as the IPPSS results for Units 2 and 3. We believe that the difference is due to the procedures used to perform the integration and the coarseness of the hazard and fragility data points. In addition, there probably are differences due to the lumping of curves done in the IPPSS analysis (Figure 7.2-4 does not replicate che seven D&M curves from Figures 7.2-1 and 7.2-2 and the four WCC curves from Figure 7.2-3). In some sense, the difference in the results represent an analysis procedure error or i uncertainty. In general, we believe that the data points for the hazard and fragility curves in the IPPSS are too coarse. A more refined set of points should be developed. Several conclusions can be made based on the results of the sensitivity analysis. 2.7.1-7
TABLE 2.7.1-1 RESULTS OF SEISMIC SENSITIVITY ANALYSIS Mean Frequency, SE/2RW (per year) Category Unit 2 Unit 3 D&M Unshifted and Untruncated 2.6 x 10-4 1.1 x 10-5 Shifted and Truncated 1.5 x 10-4 3.2 x 10-6 WCC Unshifted and Un runcated 1.7 x 10-4 1.6 x 10-6 Shifted and Truncated 1.3 x 10-5 3.5 x 10-9 Combined Results Unshifted and Untruncated 2.2 x 10-4 6.2 x 10-6 Shifted and Truncated 0.8 x 10-4 1.6 x 10-6 IPPSS Results 1.4 x 10-4 2.4 x 10-6 l 2.7.1-8
l
- 1) The mean frequency of SE/2RW for Unit 2 is greater by a factor of approximately 12 between the D&M and the UCC shifted and truncated hazard curves (ie, 1.5 x 10-4 per year compared to 1.3 x 10-5 per year). These are the curves ultimately used in the IPPSS analysis. Note that for Unit 3 the diffetence is about a factor of 1000. The reasonableness of this result is discussed for IPPSS report Section 7.2 in the JBA report (see Appendix A). Based on this study, it is clear that the UCC hazard curves are significantly different from the D&M curves.
- 2) For the D&M hazard curves the difference between the unshifted and untruncated results and the modified results is a factor of less than 2 for Unit 2 and slightly over 3 for Unit 3.
The low factor for Unit 2 is because the median fragility value of 0.279 for Unit 2 is well away from the upper-bound cutoff values. For Unit 3 the effective median fragility value of 0.89, is at the upper limit of the cutoff values. Note that plots of the hazard curves are given in IPPSS Figures 7.2-1 through 7.2-4.
- 3) For the UCC hazard curves, the difference between the +
unshifted and untruncated results and the modified results is a facter of 13 for Uait 2 and a factor of almost 500 for Unit 3. The high factors for both units is because the median fragility values are at or above the upper-bound cutoff values.
- 4) The difference between the shifted and truncated combined results (which are the basis for the final values given in the IPPSS report) for Units 2 and 3 is over two orders of magnitude. The reason is due to the effective capacity for Unit 2 being 0.27g and for Unit 3 being 0.89 2.7.1.5 Ramapo Zone Investigation The increase in the mean frequency of release category 2RW due to different representations of a Ramapo fault zone were calculated using a seismic hazard model and data in the IPPSS report. The results show an increase due to the Ramapo source in comparison to mean frequency values obtained in the IPPSS. He postulated, in a Bayesian sense, a subjective weight for the Ramapo source and then combined this source with the other postulated sources. We have investigated the implication of various weights which could be assigned. At one limit is the probability assigment of 0. This implies that the Ramapo source is incapable and t hus cannot possibly occur. At the other extreme is the probability assignment of 1.0 which says that the Ramapo source, plus a reasonable background seismicity which was added, replaces the other source zones con-sidered in the IPPSS. This is obviously a very conservative scenarie since it is highly unlikely that the only possibility is the Ramapo zone. For purposes of this sensitivity analysis, the D&M Piedmont zone with a M5.7 maximum magnitude is selected to be the backg round seismicity. This is also conservative.
2.7.1-9
Because there is a difference in integration procedures used by IPPSS and us, we have normalized the increase in mean frequency of consequences to correspond to the values given in the IPPSS report. In this investigation we have not included any other differences which we found in our review. Thus, the results presented here are given in addition to changes we noted elsewhere in this section. Figure 2.7.1-1 shows the effect of the Ramapo fault zone and its assumed background seismicity on the mean frequency of core melt or 4 release categories for subjective probability values between 0 and
- 1. The curves were developed for release category 2RW, which is dominated by plant state SE. However, we expect the trend to be similar for other release categories and for core melt as well.
Curves given for both Unit 2 and Unit 3 represent t he ratio of the total seismicity-caused mean frequency (including the weighted con-tribution from the Ramapo source and background seismicity) to the seismically-caused mean frequency values corresponding to the IPPSS report (ie, 1.4 x 10-4 per year for Unit 2 and 2.4 x 10-6 per year for Unit 3). Thus the results shown in Figure 2.7.1-1 pertain only to seismically-caused consequences. The two curves shown for each plant represent lower and upper cound possible Ramapo fault zones. Figures 2.7.1-2 and 2.7.1-3 show similar plots f or total mean frequency of SE/2RW and core melt, respectively. In these plots the mean frequency values given in IPPSS report Tables 8.3-2 and 8.3-3 were used as the base values for Unit 2 and Unit 3, repectively. Thus the effect of the Ramapo fault zone on higher level con-sequences as a function of the subjective probability for the zone can be seen. By comparing Figures 2.7.1-1 through 2.7.1.3, it is seen that the effect of the Ramapo fault Zone decreases monotonically from seismic-caused release categories, to total SE/2RW, and finally to core melt. For example, for the cases with and without the RamGpo fault for seismic-caused SE/2RW, total SE/2RW, and core melt corre-sponding to the upper bound curves for Unit 2 at a subjective probability value of 0.1, the ratios are 2.2, 1.5, and 1.4, respectively. The reason the effect of the Ramapo decreases is i because other events such as fire, hurricane, tornado, and internal l accidents dilute the contribution made by the Ramapo source. 1 Although we do not propose a probability weight for the Ramapo l source, we believe on the basis of geologic and seismologic evidence that it is small (less than 0.10). Thus the effect of a Ramapo source zone on plant risk is not significant. It should also be recognized that all the source zones in both the D&M and WCC studies contain the Ramapo fault Zone and consider it as an area capable of generating earthquakes. Therefore, in view of the above, we feel l that the seismicity of the Ramapo fault is reasonably well contained ~ in the IPPSS. l 2.7.1-10 l l . _ _
48.5-3 l l t :
- 3 35.8 -
I ..: ug . I ' 13.1 g gg, p _' Upper Bound o , 6.8 h Lower Bound L: '
- 3. 5 .5 1. 5 Ramapo Fault Zone Subjoettve Probability ..
(a) Unit 2 da. sr 34.9 as.s-
- /
3 l
- t ,
Upper Bound , 1 + . 4 kl. .g- 25.5- , j6 : s3 m. i 3 Lower Bound 6.8 33 .,/
.=
B. 5 .5 1.8 Renepo Fault Zone Subjootive FWb4111ty (b) Unit 3 Figure 2.7.1-1. Effect of Including a Ramapo Fault Zone on Seismic-Caused Consequences 2.7.1-11
- 7. 5 -
E8 - 6.1 b 5E-
- 4. 3 - Upper Bound '
3.5 s S. 5-Jl g oj
- 2. s-Lower Bound I%
E: ' i E3 .5 1. 3 R e ape F alt Zone S4 jaotiv m sIsty (a) Unit 2
- 7. 9 -
- 6. 9 -
3 5. 9-
- 4. 5-
- 3. 5-Jl
- 2. 5 - Upper g 15 33 3" "
7 -- i jg Lower Bound ! & ' ' j E3 .5 1. 3 Ramapo F=It Zone S4 jeeltve Prob aility (b) Unit 3 l Figure 2.7.1-2. Effect of Including a Ramapo Fault on Total Release Category 2RW l l 2.7.1-12
l l 1. 0 - l LS -
$ 5. 8 - '
4.6
.9-
, Upper Bound
- 3. 5 -
g 2.7 J 2. 5-
%p f, j 3, g Lower Bound b% '
1: 8
- 8. 5 .5 1. 8 Ramapo Fcult Zone S4jectiv Probability (a) Unit 2
- 7. 5 -
- 6. 8-3 5. 5 -
-tS. ...
JaA 2. s -
%g Upper Bound 1.6 3d 1. = 1.1
]g Lower Bound
- 8. : ' '
E3 .5 1.8
% o Fault Zone 54 jectiv Probaility (b) Unit 3 Figure 2.7.1-3. Effect of Including a Ramapo Fault Zone on Total Core !!elt 2.7.1-13
2.7.1.6 Systems Analysis We believe that the revised analysis mean value of 7.9 x 10-6 per year for the annual frequency of core melt for Unit 2 (Reference
- 7) is low because of the hazard curves and the assumed capacity for the control room ceiling.
We believe that the mean frequencies of exceedence values fot D&M and WCC hazard curves should be weighted 81 percent and 20 percent, respectively. In addition, we believe that the cor. trol room ceiling capacity is similar to the capacity for Unit 3 (see discussion below). Incorporating these two effects into the analysis increases mean frequency of core melt by a factor of 6.1 to an annual value of 4.8 x 10-5, Because of the higher level of subjective uncertainty leading to the tails of the core melt frequency density function, we do not believe the reported 90 percent confidence bounds for Unit 2 are credible. In regard to the seismic capacities for Unit 3 given in IPPSS report Table 7.2-7, the control building median capacity is equal to 1.209, which is based on a shear wall failure mode. We believe that this value may be high (ie, unconservative) for the Unit 3 control building. Both Unit 2 and 3 ceilings consist of egg-crate louvers and Transite barriers suspended from the control room roofs. An analysis of the Unit 3 ceiling was conducted by PLG in response to concerns raised in the August 25, 1982 draft of this report. The results of this analysis are given in Reference 6. The median structural capacity determined by PLG for the Unit 3 Transite panels (which weigh 25 pounds each, is 0.119 However, the failure was assumed to occur only if all three operators are incapacitated. We found the following discrepancies in this analysis: o There are arithmetic errors in the discrete l frequency values for ceiling failure l o Only one panel axis penetrating the cone of the influence was used (two axes should have been used) o The integration of the hazard and fragility curves should have included acceleration values as low as 0.05g l o The ceiling f ailure contribution to the mean l frequency of core melt was not added to the contributions from other component failures 2.7.1-14 i 1 _a
Based on these discrepancies, the mean probability of core melt is a factor of almost ten higher than the reported value of 3.6 x 10-6 given in Reference 6. In addition, if the effects of weighting the mean D&M and WCC hazard curves 80 percent and 20 percent, respectively. The net increase of the mean frequency of SE/2RW (which is the main contri-bution to core melt) is a factor of 16. However, we choose to increase the mean value by a factor of 10 to 2.4 x 10-5 since we believe that the true median capacity of the ceiling may be higher than 0.119 On the conservative side, the Transite panels may be wide enoagh to preclude them from sliding and falling off the support flanges of the light fixtures. In addition, all three operators may not always be in the control room at the same time. On the unconservative side, the Transite panels, which f all outside the zone of influence assumed in the PLG analysis, may still be capable of affecting the ability of the operators to perform their function. At best, the results of the analysis reported to date contain significant uncertainties. We believe that additional investigations and analyses should be conducted for this potential failure. The capacity of the diesel generator fuel oil tanks, which are buried, are based on generic data. Because this component contri-butes significantly to core melt and SE/2RW for Unit 3, a specific analysis for this component should be conducted. It is doubtful that any dependence between the components will affect the analysis results for Unit 3. Note that perfect depen-dence due to ground motion is implicitly assumed in the procedure for integrating the hazard and fragility curves. Since the control building and fuel tanks are separate structures, no capacity or other response dependence is present. We believe that the mean value of 3.3 x 10-6 per year for the annual frequency of core melt for Unit 3 may be low due to potential failure of the control room ceiling and our belief that the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, respectively. We feel that these differences would change the reported value by a factor of about eight. We do not believe that the reported 90 percent confidence bounds are credible. 2.7.1.7 Conclusions and Recommendations We believe that certain results may be unconservative. Based on our review Table 2.7.1-2 gives a revised list of mean frequencies for Indian Point Unit 2. Table 2.7.1-3 gives a similar list for Unit 3. Below each of the mean frequencies for seismic, hurricane, and tornado is the ratio of the revised value to the value given in the IPPSS report (see Tables 8.3-2 and 8.3-3 for the IPPSS report values for Units 2 and 3, respectively; except that the values for 2.7.1-15
seismic for Unit 2 are' based on the values given for the revised analysis, which eliminated the problem of impact between the control rooms). In the revised analysis of Unit 2, the capacity for item 2 (the control room) was increased by eliminating the problem of impact. However, because of potential failure of the control room ceiling, we feel the mean frequency values are low. In addition, we believe that the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, respectively. Combining these two consider-ations increases the mean frequency of core melt and the release categories / plant damage states. We believe that the capacity of the hung ceiling in the control room of Unit 3 may be lower than the equivalent median capacity value of 0.8g, implicitly used in the IPPSS. We estimate that the mean frequency for SE/2RW, which has a dominant contribution from the control building, increases the mean frequency. Similar to the revised values for Unit 2 for the increase in the hazard function, we increase the mean frequencies of all categories by an additional factor to produce a total factor equal to 10 for SE/2RW and a factor of less than 2 for other categories. Core melt due to seismic increases by a factor of almost eight. In order to resolve the most significant issues which have been raised in the review, we recommend the following be done.
- 1) For Units 2 and 3, the capacity of the hung ceiling in the control rooms should be reanalyzed to consider more realistic assumptions (see discussion above) . In addition, the possibility of failure of control room equipment due to-falling Transite panels should be included in the analysis.
- 2) For Unit 3, the capacity for the diesel generator fuel oil tank, which is a significant contributor, should be based on a specific analysis for this component. Generic-based values were used in the IPPSS.
- 3) Since the problem of the control room impact has been eliminated for Unit 2, a seismic fragility curve should be developed for the Unit 2 diesel generator building since its generic median capacity is 1.4g.
REFERENCES
- 1. Aggarwal, Y. P. and L. R. Sykes, " Earthquakes, Faults, and Nuclear Power Plants in Southern New York and Northern New Jersey," Science, vol. 200, rp. 425-429, 1978.
I l 2.7.1-16 i i l J
, 4
- 2. Fischer, J. A., " Capability of the Ramapo Fault System,"
Proceedings of Earthquakes and Earthquake Engineering: The Eastern United States, September 14-16, 1981, Knoxville, Tennessee.
- 3. Ratcliffe, N. M., " Brittle Faults (Ramapo Fault) and Phyllonitic Ductile Shear Zones in the Basement Rocks of the Ramapo Seismic Zones New York and New Jersey, and Their Relationship to Current Seismicity," Field Studies of New Jersey Geology and Guide to Field Trips, Rutgers University, Newark, New Jersey, 1980.
- 4. Yang, J. P. and Y. P. Aggarwal, "Seismotectonics of Northeastern United States and Adjacent Canada," J. Geophy.
Res., vol. 86, pp. 4981-4998, 1981.
- 5. Statton, C. T., Quittmeyer, R., Houlday, M., " Contemporary Strest and Fault Plana Solutions Inferred from Recent Seismicity in New York and New Jersey," presented at 54th Annual Meeting of the Eastern Section SSA, abstract to appear in Ear thquake Notes, 1982.
- 6. Pickard, Lowe, and Garrick, " Response to Sandia Letter Report of September 1, 1982 on the Indian Point Probabilistic Safety Study," October 1, 1982.
- 7. Letter to S. A. Varga, USNRC, From J. D. O'Toole, Consolidated Edison Company of New York, dated October 8, 1982.
- 8. Structural Mechanics Associates, " Indian Point Unit 2 Control Building Seismic Improvement Analysis," prepared for Pickard, Lowe and Garrick, SMA 12901.03, August, 1982.
- 9. Bayne, J. P., Power Authority of the State of New York, Letter to D. G. Eisenhut of U.S. Nuclear Regulatory Commission, August 28, 1981.
- 10. Rowsome, F., leismic Qualification of the IP Unit 3 Auxiliary Feedwater System, Internal U.S. Nuclear Regulatory Commission Note, October 12, 1981.
- 11. Pickard, Lowe and Garrick, Inc., " System Interaction Study of the Auxiliary Feedwater System Indian Point 3," Prepared for Power Authority of the State of New York, Preliminary Draft, not dated.
- 12. Memorandum for Edmund J. Sullivan, Jr., from Franz P. Schauer,
" Indian Point Probabilistic Safety Study," May 7, 1982.
- 13. Memorandum for Robert E. Jackson, from Leon Reiter, " Indian Point Probabilistic Risk Assessment (External Events)," May 14, 1982.
- 14. Memorandum for Edmund J. Sullivan, Jr., from Zoltan R.
Rosztoczy, " Indian Point Probabilistic Safety Study-Seismic Eq u i pme..t Fragility Review," May 19, 1982. 2.7.1-17
. _ = . -- ,
i TABLE 2.7.1-2 REVISED MEAN FREQUENCIES - UNIT 2 IPPSS IPPSS Damage Release State Category Seismic Hurricane Tornado Z-Q l.1 x 10-6* 0 0 (1. 6 ) *
- AE/Z-1 2.6 x 10-8 small small (2)
SE/2RW 4.7 x 10-5 5.4 x 10-4 1.6 x 10-5 (6.8 ) * * * (20) (1) 8A 5.5 x 10-9 0 small (1.3) 8B 3.4 x 10-10 0 0 (1.3) Core Melt 4.8 x 10-5 5.4 x 10-4 1.6 x 10-5 (6.1)*** (20) (1)
*Mean Frequency (typical) ** Ratio to IPPSS Value (typical) *** Relative to revised analysis value of 6.9 x 10-6 for release category 2RW and 7.9 x 10-6 for seismically caused core melt i
1 2.7.1-18
TABLE 2.7.1-3 REVISED MEAN FREQUENCIES UNIT 3 IPPSS IPPSS Damage Release ., 4 Category Seismic Hurricane Tornado S_ tate Z/0 5.9 x 10-8* 0 0 (1.6)** AE/Z-1 5.0 x 10-9 0 small (2) SE/2RW 2.4 x 10-5 0 9.2 x 10-7 (10) (1) 8A 9.2 x 10-7 0 4.1 x 10-7 (1.3) (1) 8B 2.9 x 10-7 o o (1-3) Core Melt 2.5 x 10-5 0 1.3 x 10-6 (7.6) (1)
*Mean Frequency
** Ratio to IPPSS Value 2.7.1-19
^ - - _ . _ _ _ _ _ __
2.7.2 Wind In this section, the wind external event is reviewed. The material in Sections 2.7.2.2 to 2.7.2.6 is based on a report pre-pared by Jack R. Benjamin and Associates, Inc. (JBA) . Their report is contained in Appendix A of this letter report. Appended to the JBA report is a report by Dr. Larry A. Russell who discusses the hurricane hazard analysis. The comments given in Sections 2.7.2.1 through 2.7.2.6 represent the most significant issues in the review and summary of the final conclusions. More detailed discussions of the issues can be found in the JBA report. 2.7.2.1 Wind Logic Model The wind logic model is reviewed in Section 2.7.8. 2.7.2.2 Wind Events We concur with the procedure to develop hazard curves for extreme winds, hurricanes, and tornadoes separately, and the assump-tion that the results from the three sources are independent. We believe that correction factors for the effects of height, which were included in the analysis, are small relative to the influence of adjacent structures, which were not explicitly included in the analysis. We believe that the tornado hazard curves are on the conservative side, but that the hurricane hazard curves are unconservative. The bases for these conclusions are discussed in the review of The Sections 7.5.3 and 7.9.5 of the IPPSS report given in Appendix A. implications of this result are discussed below. 2.7.2.3 Tornado Missiles and Winds on Concrete Structures The statement that the concrete stuctures were designed for 25 psf wind loading, and that there is "little deflection" is mislead-ing and not pertinent to the conclusion that potential wind pres-aures and tornado missiles are not significant to Indian Point safety-related concrete structures (ie, wall thickness greater than 12 inches). We concur with this conclusion based on review of Reference 1. The statement that tornado frequencies at Indian Point are lower , should be documented (although we do agree with this statement) . In general, other leading statements made in this section should be documented. 2.7.2.4 Tornado Missiles and Winds on Metal Structures We agree that it is conservative to base the fragility of metal structures and exposed equipment on the hit frequency; however, the 2.7.2-1 x - i
f fragility curves for the effects of tornado missiles were not developed based on possible hit f requencies as stated, but rather on wind velocities which could lift various missiles off the ground. However, we believe that using the tornado impact -f ragility curves shown in IPPSS report Figure 7.5-3 results in conservative fre-quencies of failure for the structures and equipment considered. We developed our conclusion using References 2 through 6 which reported the probability power plant. of hit frequency of specific structures at a nuclear The basis report (see Appendix A). for our opinion is documented in the JBA We feel that problem; however, hurricane-caused missiles are probably not a this potential cause of failure should be considered and documented in-the IPPSS report. We believe that the major uncertainty in wind loading on an-Indian Point structure wind (conditional on the occurrence of free-field tures.velocity) is due primarily to the influence of nearby struc-We do not believe that the randomness or uncertainty included for the capacity due to wind have been rationally developed in the IPPSS adjacent to Point Indian include the influence of the close proximity of structures. Also, we disagree with the development of the wind load correction f actor SF L. For hurricane winds, SFL randomness was based on consideration of differences in terrain and return period occurrence wind speeds. The influence of nearby structures is more significant than terrain variability and should have been explicitly included. Also dif-ferences in occurrence rate belongs in the wind speed hazard analysis rather than the fragility formulation. For tornadoes, SF L, randomness was based on the relatively insignificant differences in wind speed effects over the height of the structures. Because of the approach used to develop the factor SFL, the slope of the fragility curves for tornado effects are steep while the corresponding curves for hurricanes are less steep. We believe that the randomness (which is expressed by the slope of the fragility curves) tornado and hurricane should windbe essentially the same for the effects of speeds. 1 i j curves. We noted two discrepancies in the development of the fragility In Table 7.5-1, the velocity pressure for exposure C for a 100-year return period from Reference 7 should have been 27 psf instead of the value of 18.5 psf used in the analysis. The effect 1 , of this error would be to increase the randomness for hurricane wind fragility meltcurves which would lead to a slightly larger frequency of j core (probably a small effect). 1 The second discrepancy is the conversion of pressure to equivalent wind velocity using the equation: q = 0.00256 V2 (where q = psf, V = mph). structure shapes. This equation ignores the differences between For example, a rectangular building in the open 2.7.2-2 n a n
is more closely modeled by the equation of q* = 1.3q where 1.3 is the shape factor. Because of the influence of adjacent buildings, the shape factor will vary from structure to structure. We believe that a rational way to develop shape factors for buildings at Indian Point is through use of a wind tunnel model. Our judgment is that the shape factors for the Uni' 2 control building, the Unit 2 diesel generator building, and RWST also vary depending on the type of failure being considered. As discussed below, these structures control the core melt and release frequency analysis. Assuming a local failure may control the capacity of the diesel generator building, the median capacity may be smaller by a factor as much of 1.7; however, this building is shielded to some extent. For the RWST we believe that the implicitly-assumed shape factor of 1.0 is appropriate. Because of the location of the control build-ing, which is relatively sheltered, the shape factor is probably 1.0 or less. However, this should be confirmed by IPPSS personnel and documented. Because the methodology used to develop fragility values for wind speed effects is inappropriate, we have not attempted to determine whether the resulting capacity values in the IPPSS report are correct. The offsite power fragility is assumed in the IPPSS to be controlled by the fragility of the transmission line towers. Because the offsite towers have not been specifically identified and analyzed, we believe that a median fragility wind velocity value of 140 mph is unconservative. It is likely that offsite power will be lost at a much lower wind velocity. We believe that it woul be prudent to assume that offsite power is not available if her a tornado or hurricane occurs. The implication of th'~ assumption is - discussed below. , We feel that there is no rational basis for the assumption that the upper-bound and lower-bound fragility curves are each weighted with probability 0.1. The resu.It of this assignment causes the three middle fragility curves used for the hurricane and tornado analysis (see IPPSS report Tables 7.5-4, 7.5-5, and 7.5-6) to be nearly identical. Because of the apparently arbitrary assignment of probability values (ie, 0.2 could have equally baen used for the upper and lower-bound curves), we do not have confidence in the spread of the probability distribution. Also, the mean values will change significantly for hurricanes as the probability assignments are altered. This is due to the relative steepness of the hurricane hazard curves. We believe that the possibility of either the turbine building or the superheater building failing and falling on the control building should be considered. Also the possibility of the super-heater building failing and falling on the diesel generator building 2.7.2-3 n _______ n
and the condensate storage tank also should be considered. The fragility curves for these structures should be developed to deter-mine whether they effect the probability of core melt and subsequent release. We did not independently determine the capacities of these structures in our review. 2.7.2.5 Systems Analysis J Based on the fault trees given in IPPSS report'for Unit 2, Figures 7.5-6 a through f, the Boolean equations leading to core melt, Mg were checked. We generally agree with the final expres-sion given on page 7.5-12. We believe that part of the probability of the stack failing and falling on either the control building or the diesel generator building was omitted. This contribution amounts to 0.05 07wV0.05 7 7 Because of the high capacity of the stack relative to the control and diesel generator buildings, this discrepancy has no significant impact. The significant contributors to cor melt for Unit 2 are due to wind pressure failure of offsite power w, the control building (4)w, and the diesel generator building w. ' Note that the sub-script "W" refers to either hurricane or tornado winds, while "T" refers only to tornado missile effe ts. he si ficant portion of the core melt Boolean equation is 2 wA( 4wV w). The other parts of the equation are not impor ant since t e capacity for tornado missiles is relatively high. 't We believe that the mean annual frequency of core melt value of 4.3 x 10-5 per year for Unit 2 due to both hurricane and tornado effects may be low by a factor of about 13 (a large ef fect) . We do not believe that the confidence bounds given are meaningful. Based on the fault trees given in the IPPSS report, Figures 7.5-11 a through e, the Boolean equations leading to core melt, I, Mg, for Unit 3 were checked. We agreed with-the equations given in the IPPSS report. 3 The significant contribut'ons to core melt for Unit 3 are due to ilure of either the RWST, 9 T, or the service water pumps, 7 Other components in the sequence, such as offsite power and le AFW pump building, will fail due to wind pressure at much lower
- wind velocities than missile failure of the RWST or the service water pumps.
! We believe that the mean annual frequency of core melt value of 1.3 x 10-6 per year for Unit 3 is reasonable. We do not feel that the confidence bounds given are meaningful. 2.7.2.6 Conclusions and Recommendations i We believe that certain results may be unconservative. Based on our review, Table 2.7.1-2 gives a revised list of mean frequencies h . 2.7.2-4 4 A % n
l for Indian Point Unit 2. Table 2.7.1-3 gives i milar list for Unit 3. Below each of the mean frequencies for 1smic, hurricane, and tornado is the ratio of the revised valu ta ne value given in the IPPSS report (see Tables 8.3-2 and 8.3-3 for the IPPSS report values for Units 2 and 3, respectively; except that the values for seismic for Unit 2 are based on the values given for the revised analysis, which eliminated the problem of impact between the control rooms.) Two factors produce an estimated increase in SE/2RW for Unit 2 due to hurricane effects. Based on review of Section 7.9.5, we believe that the median hurricane hazard curve is unconservative. A comparison of the IPPSS median and upperbound curves was made with hazard values obtained from Reference 8. We believe that the hazard curves do not include complex surface roughness boundary layer effects and wind channelization caused by local hills and the Hudson River Valley. Using a range of hazard curves cased on an indepen-dent analysis and the median fragility curve from IPPSS Table 7.5-4, with and without conceding failure of the offsite transmission lines, we obtain a factor of 10 to 50 increase in SE/2RW. We believe that a factor of 20 increase is appropriate for differences due to the fragility and hazard curves because of the large uncertainty in these types of analyses. For tornado wind effects, we believe that the capacity of offsite power has been assumed too high. We estimate that the frequency of SE/2RW increases by a factor 2 for Unit 2. However, we judge that the hazard curves are on the conservative side by at least an equivalent factor; thus, we believe that the IPPSS mean frequency values for SE/2RW and core melt are reasonable. Hurricane winds are not a significant event for Unit 3. Since the frequency of release depends on tornado missile impact, we judge the IPPSS results for tornado hazard to be reasonable for Unit 3. In order to resolve the most significant issues which have been raised in the review, we recommend the following be done.
- 1) A fragility curve for offsite power should be developed which considers various possible failure mechanisms (ie, in addition to the failure of the transmission towers).
- 2) Wind fragility curves should be rationally developed for the Unit 2 control building and the diesel generator building. They should explicitly consider the structure shapes and the effects of adjacent structures. Possible local failure of siding and roofing should be considere.] in determining the structure capacities. Also, the fragility of the Unit 1 turbine and superheater buildings (or pieces of these buildings) should be calculated for wind. The possibility of these buildings failing and falling on safety-related 2.7.2-5 n i _ _ _ _ _ . _ _ _ _ . _ _
structures (ie, Unit 2 control building, diesel generator building. l and condensate storage tank) should be included in the plant ' analysis.
- 3) A hurricane hazard analysis which includes careful evaluation of the surface roughness boundary layer effects and wind channelization by the local hills and river valley should be performed.
- 4) A systematic comparison between the hurricane hazard curves given in the IPPSS and the results in NBS Building Science Series 124 report (Reference 8) should be made to provi6e the basis for the large differences that exist and justification of the reasonableness of the IPPSS results.
REFERENCES
- 1. United Engineers and Constructors, Inc., " Indian Point Generating Station - Unit No. 2, Report - Plant Capability to Withstand Tornadoes," Jtnuary 2 26, 1968.
- 2. Twisdale, L. A., W. L. Dunn, and J. Cho, " Tornado Missile Simulation and Risk Analysis," Meeting on Probabilistic Analysis of Nuclear Safety, ANS, Newport Beach, May 1978.
- 3. Twisdale, L. A., et al., " Tornado Missile Risk Analysis, prepared May 1978.
for Electric Power Research Institute, EPRI NP-768,
- 4. Twisdale, L. A., and Dunn, U. L.,
" Tornado Missile Simulation and Design Methodology, Volume 1: Simulation Methodology, Design Applications, and Tormis Computer Code," Prepared for Electric 1981.
Power Research Institute, EPRI NP-2005, Vol. 1, August
- 5. Science Applications, Inc., " Simulation of Tornado Missile Hazard to the Pilgram 2 Nuclear Thermal Generating Station,"
Prepared for Bostom Edison Company, Inc., SAI-77-501-SV, November 1977.
- 6. "Palo Verde Nuclear Generating Station Probabilistic Risk Assessment of Tornado Missile Damage to the Station Ultimate Heat Sink," USNRC Docket No. STN-50-528/529/530, File:
82-056-026; G.l.01.10, not dated.
- 7. American National Standards Institute, Inc., " Building Code Requirements for Minimum Design Loads in Buildings and Other Structures," ANSI A58.1-1972.
2.7.2-6
, - - ^
Batts, M. E. et al.,
" Hurricane Wind Speeds in the United 8.
States," UBS Building Science Series 124, National Bureau of Standard, May 1980. Memorandum for Edmund J. Sullivan, Jr., from Franz P. Schauer, 9.
" Indian Point Probabilistic Safety Study--Review Comments on Section 7.5 (Structural Fragility)," undated.
Sullivan, from Earl Markee, " Indian1982.
- 10. Memorandum for Edmund J.
Point Probabilistic Safety Study-External Events," May 11, E 2.7.2-7
.. - _ .. - - _ .. - . = . -_
i 2.7.3 Flooding In this section external and internal flooding events are reviewed. The material in Sections 2.7.3.1 and 2.7.3.2 is based on i a report prepared by Jack R. Benjamin and Associates, Inc. (JBA). Their repSrt is contained in Appendix A of this report. The comments given in Sections 2.7.3.1 and 2.7.3.2 present the i most significant issues in the review and summarize the final conclusione. More detailed discussions of the issues can be found l in the 'JBA ceport. 2.7.3.1 External Flooding The Indian Point plant is situated on the east bank of the Hudson River, appcoximately 43 miles north of New York City. The ] plant elevation is approximately 14.0 ft. which corresponds The to the
; elevation of the screenwall The structure for Unit 3 (Ref. 1).
consideration of potential flooding i plant grade is about 15 ft. at the site due to external flood is based principally on the flood studies conducted for the Indian Point Unit 3 operating license review, (Ref. 2, 3, 4, 5, and 6). The design basis of Unit 3 for l external flooding, and t hus the IPPSS, is based on the occurrence of
- extreme events such as the Probable Maximum Flood (PMF), the Prob-
- able Maximum Hurricane (PMH), high tides, and event combinations such as the standard project flood and failure of an upstream dam.
The IPPSS concludes that the contribution to the f requency of core melt due to external flood sources is extremely small. The basis of j this conclusion is reviewed and the adequacy of the probabilistic 1 methodology is discussed. The principal basis of the external flooding analysis in this ] section is the work in Reference 4, and various supplements or revisions (Ref. 5, 6). The intent of t hese studies was to evaluate maximum water surface elevations at the site. On the basis of a review of potential sources of flooding on the Hudson River, the i following events and event combinations were considered: .
- Probable Maximum Precipitation (PMP), which is assumed to produce the Probable Maximum Flood (PMF)
PMF and tidal flow I
- Standard Project Flood (SPF) and Ashokan Dam Failure
- SPF and the Standard Project Hurricane (SPH) at New York Harbor SPF, Ashokan Dam Failure and the SPH at New York Harbor
- Probable Maximum Hurricane (PMH) and spring high tide.
1 2.7.3-1
-r ._~._v~, . _ , _ _ _ , _ . _ _ _ . _ _ _ . _ . _ _ . . . , _ . . , , , _ , . , _ _ _ , , _ _ _ _ _ _ _ _ . _ _ . _ _ _ , _ _ . . . _ . . . , _ _
The result of deterministic provided in Reference 6. calculations for these events are The IPPSS estimates of the annual fre-queg/yr,cies 10- of occurrence of individual events range from 10-3/yr to values of while frequencigg/yr.of 10-8 /yr to 10- event combinations have estimated of the foregoing results that The IPPSS concludes on the basis to the annual frequency of core meltthe is contribution of external flooding extremely small. For this reason the study does not consider safety-related equipmenc or structures. the impact of flooding on The approach taken in the IPPSS to assess the frequency of external flooding at the Indian Point site is to consider only the most extreme events (ie, probable maximum events), and event combinations. The reason for this is apparently the fact these events were the basis of the flood design criteria used for the Indian Point site. This approach differs from a probabilistic flood hazard due to aanalysis range ofthat considers event sizes. aThe full complement of water elevations IPPSS has in effect chosen to consider for a given source of flooding one or two events and the resultant water surface profile produced at Indian Point. The approach taken to evaluate the likelihood that external flooding would affect safety-related equipment in our judgment, is not adequate. We feel that the methodology employed has not prop-erly treated the sources of uncertainty in the analysis which are generally considered to be large. To assesc the potential contribu-tion of flooding to plant risk, a preliminary or screening analysis can be conducted. Tne analyst can obtain teneric estimates of uncertainty in key variables (if site-specific estimates are not available), frequencies of critical events, ced available deter- ' ministic estimates of flood evaluations. From t his information a screening analysis can be conducted to make first order estimates of flood level frequencies. On the basis of preliminary frequency estimates of flood evaluations recching safety-related equipment or structures, is needed. an assessment can be tands ac to whether furcher analysis This type of probabilistic screening is considered below, s Routin: a flood downstream and estimating water-surface elevations is one of the elements of a flood analysis that has con-siderable uncert'ainty associated with it. In the IPPSS study no site-specific estimate of this uncertainty was made, therefore estimates available in the literature are considered. In Reference 7 an average value of the one standard deviation in the estimate of water surface profiles due to riverine flooding for the 100 year flood is approximately 23 percent of the estimated flood depth. Assuming estimates of water surface profiles are lognormally distributed (Reference 7), this variation corresponds to a logarithmic standard deviation value of 0.21. A second estimate is available in Reference 4, the flood study conducted for Unit 3, which references a Corps of Engineers graph of I l l 2.7.3-2 l
river discharge as a function of basin area. In their analysis, the Corps of Engineers estimates from a log-log plot of their data a mean and upper and lower bounds on the peak discharge of the six-hour unit hydrograph. Using the lognormal assumption and assuming the bounds correspond to the plus and minus three standard deviation range, a value of 0.47 for the one logarithmic standard deviation is derived. Based on the linear relationship at Indian Point between water-surface elevation and river discharge, this value also corresponds to the uncertainty in water elevation. Knowing the distribution on water surf ace elevation, preliminary estimates can be made of the f requency exceeding different levels. These calculations are made for the PMF, which is assigned an annual frequency of 1.0 x 10-4 The median flood elevation for the PMF is 12.7. The product of this value and the probability of exceeding a particular elevation given the PMF provides the frequency of exceeding that level. Using this approach, a range can be estimated f or the f requency of exceeding t he 16' base elevation of the Unit 2 service water pumps (Reference 8). The range is 3 x 10-5 to 3 x 10-6 These values are based on the two estimates of the uncertainty in water surface elevations given above and taking into account a possible conservative bias in the flood routing procedure used in the flood study for Unit 3 (Reference 4). The 16' water elevation does not include the effects of wave runup which is esti-mated to be 1.4' in the IPPSS. These results are based on certain assumptions, such as the storm frequency of 10-4 and the use of generic or nonsite specific estimates of the uncertainty in the i water surface profile. Another factor that must be kept in mind is the f act that a
- warning time is availab'e during extreme flood situations, as in the case for hurricanes. Also, specifications are in place for Unit 3 i for emergency action to begin (sand bagging) if the water level
- reaches 11 feet.
At a meeting with IPPSS personnel our concern that the , uncertainty in the flood analysis was not taken into account was expressed. The response by IPPSS provided in Reference 8, does not address this issue. We conclude from our review that the sources of external flooding at the Indian Point site have been identified and adequately considered in a deterministic sense. The probabilistic methodology employed for external flood hazards is a departure from the analysis conducted for other external events such as seismic, hurricane and tornado. The method is somewhat ad hoc in the sense that a conplete probabilistic hazard assessment was not conducted (ie, uncertainty in key parameters are not considered, and a family of flood elevation hazard curves was { not produced.) Although the state-of-the-art in flood hazard assessment is sufficiently developed to conduct such an analysis, 2.7.3-3
- . - - .~ .
external flooding'in the IPPSS'is not treated as thoroughly in a i probabilistic context as other external events. We do not agree with the methodology applied in the IPPSS to ~ evaluate external flood hazards at the site. The approach provides point frequency estimates for single events and event' combinations rather than considering a full-complement of event sizes, parameter values, and joint occurrence of events. .Therefore, at a given frequency of exceedance the uncertainty in flood depth cannot be evaluated, nor.can the probability distribution on frequency. We recognize that a reason for this approach.is.due in part to the traditional notion of a probable maximum flood (PMF). Since the PMF is an~ extreme event, an annual frequency of occurrence is typically not determined by hydrologists, nor is the variability in key param - eters considered. Nonetheless, the uncertainties in estimated fre-quencies of extreme events are generally considered to be large (Reference 9). Similarly, for a given storm, there are important sources of uncertainty to be considered in the estimation of flood water surface profiles.. The IPPSS'has not conducted a' sensitivity analysis nor has an analysis been c'nducted o to obtain the uncertainty in the frequency of exceedance. 1 In our judgment, flood hazards are not a major contributor to plant risk at Indian Point. However, we also feel that due to the
- 1arge uncertainties associated with flood hazard predictions, that the frequency of flood excavations exceeding the elevations of a safety-related equipment is not many orders of magnitude below the frequencies of other more' dominant external events.
I 2.7.3.2 Internal Flooding j ~ In this section the results of an analysis to consider the effects of internal flooding on safety related equipment is con-sidered. At a meeting with IPPSS personnel, a summary was'provided of the procedure-used to identify sources of internal flooding and to determine their effect. Three steps were followed:- , l 1. r Identify sources of flooding. -
- 2. Identify locations vulnerable to floods from those' sources determined in 1.
- 3. Simulate initiating events and evaluate the impact.
We generally agree that the above basic steps are required to con-duct an internal flood analysis. We suggest that the internal flood analysis should be conducted in a manner suggested in Reference 9 which recommends development of flood analysis fault trees. This would ensure that a thorough, systematic analysis of critical events and event sequences that may lead to a transient are considered. We l [ 2.7.3-4 _ _ . _ _ _ __._ - ~ - - - - - - --' - - - - - - - - - - - ~ ' ~ ' '
l e suspect, based on references in the text, that existing fault trees have been used to some degree in the analysis.
- 1) Noncategory I Systems An analysis was undertaken to consider the impact of internal floods on the core melt frequency. The IPPSS study presents an analysis for Indian Point Unit 2, and based on the similarities in the design of Units 2 and 3, it was assumed that conclusions reached also apply to Unit 3. This assumption is reasonable if it can also be assumed that age effects, particularly in locations where corrosion is likely, do not impact on the results. Also, since the units are not under the same ownership, it should also be verified that conditions have remained the same for both unit s. Since changes always take place, it is not apparent that equivalent alterations occur at the same time and in the same
! way in both units. Similarly, temporary blockage of flood passages will undoubtedly be different for each unit. These factors should be addressed in order to verify that the two units are the same. Unless significant changes between them are identified we believe that the difference in the contribution to plant risk will be 4 small. However, in our judgment, these factors should be addressed prior to accepting a conclusion that the results apply to both units. The IPPSS considered the impact of failure of Noncategory I systems on safety systems. The conclusions reached are based on extensive review by the utility and the NRC (Ref. 10, 11, 12, 13, and 14). The conclusion of the analysis is that the operation of safety systems will not be affected by flooding produced by failure j of Noncategory I systems. a) Circulating Water Failure A review of flood scenarios is presented due to a circulating water pipe failure. The situations described have been j reviewed by the NRC staff. We note that flooding due to a pipe i failure is considered to be self-limiting because the condensate pump motors and the 6.9 kV switchgear will be flooded, resulting in reactor trip and loss of offsite power, respectively. This logic presumes that f ailure events can be counted on to limit the event. The basis for this should be further qualified. Although a relatively high value for pipe failure is assumed, and no advantage is taken of operator corrective actions, considera-tion should also be given to potential incorrect action by the operator. Given the high value taken for a pipe failure, the effect of these factors is considered to be small. b) Fire Protection System Failure l Electrical Tunnel Flooding: Conditions for flooding due to failure of the fire protection system are described. The basis of this event is reasonable; however, no 2.7.3-5
information pipe is provided failure were regarding how the frequencies of valve and determined. Diesel Generator Building Flooding; the conclusion that the frequency of diesel generatorWefailure agree with is negligible clear that compared to other causes of failure. However, it is not sidered. We the frequency of inadvertent accuation has been con-judge that considering of this event will have a relatively small effect on the frequency of diesel generator failure. Charcoal Filter Flooding: We agree with the
- l. conclusion and have no additional comment.
i l 2) Category I Systems a) Primary Auxiliar? Building (PAB) The analysis of flooding in the PAB has been conducted in a nanner that identifies the effect of flooding due to the RWST, the service water system, and component cooling system. For each 4 system, the frequency of failure has been quantified and considered in the system fault trees. These frequencies are not quantified in the section on internal flooding. The approach taken in the IPPSS is to identify the events that would occur in the event a flood were to occur. It is not apparent from the discussion that the impact of flooding was included in the system fault trees. b) Diesel Generator Building (DGB) Flooding in the DGB can also be caused by a service water line break. This flood can be contained by the pit areas and the 12" drain-lines which drain to the circulating water discharge tunnel. Since a plant transient does not occur due to the diesel generators failing, the only event of interest is the joint occur-rence of this event and a plant transient. The frequency of this event has been treated in the failure of the service water cystem. We small. agree with the conclusion that the likelihood of this event is c) Auxiliary Feed Pump Building (AFPB) \ The AFPB has been designed to discharge water from a feedwater line break. However, flood discharge rates of a feed-water line break and drainage capacities are not quantified and, therefore, this statement cannot be evaluated. We have reviewed Reference is available. 14 and concur with the conclusion that sufficient drainage d) Control Building (CB) Flooding in the CB due to a service water break is considered. Of vital importance is the 480 V switchgear located at 2.7.3-6
level 15'. The analysis assumes that floor drains in the CB will remain available in the case of a flood. To fully P:monstrate this, the location of floor drains with respect to the service water lines and the 480 V switchgear must be provided. The conclusion is made that the frequency of power loss is less than the frequency of loss due to other causes. It should be demonstrated in the IPPSS report that the additional increase in the loss of power is negligible. e) Containment Building The recent experience of flooding in the containment building has led to significant changes in both units. The numerous changes which have been made are listed in the IPPSS report. No quantification has been made of the frequency of flooding and damage in the containment for the upgraded facility. The reason for this is apparently that a service water system rupture and a LOCA must occur, in order to contribute to plant risk. Due to past experi-ence, a quantification of the system reliability is called for, such as a comparison between the upgraded plant and the system at the time of the 1980 accident. We, in general, agree that the changes have increased the system reliability and that the contribution to plant risk is less than the original design. 2.7.3.3 Conclusions and Recommendations We believe that the external flood analysis employed in the IPPSS is inadequate since the uncertainties in flood analysis are generally believed to be large; to conduct a point frequency analysis as done in the IPPSS is potentially unconservative. A preliminary probabilistic analysis that considers the major sources of uncertainty should have been carried out for each of the events considered in the IPPSS study. In this sense the IPPSS is incom-plete. Based an a rough calculation, we feel that flood hazards are l not a major contributor to plant risk at Indian point. However, we also feel that due to the large uncertainties associated with flood hazard predictions, that the frequency of flood elevations exceed-ing the elevation of a safety related equipment is not many orders of magnitude below the frequencies of other more dominant external events. l l The analysis of internal flood events was carried in a manner ! th'.t consisted of the general steps required to identify whether damage to safety related equipment will result due to an internal flooding event. We feel that the major events and consequences to l those events have been identified and adequately treated. However, i the IPPSS study has assumed that their analysis, which was conducted for Unit 2, also applies to Unit 3. We have expressed our concern i i that since the two units are under different ownership, changes may have taken place in Unit 3 that are different from those at Unit 2. 1 In order to resolve the most significant issues which have been raised in the review, we recommend the following he done: 2.7.3-7
l. It should be verified that important features related to internal flood passages, etc., in Unit 3 are consistent with the IPPSS assumption that Units 2 and 3 are the same. .i REFERENCES
- 1. Westinghouse Electric Corporation Drawing, United Engineers and Contructors, Inc. Drawing Number, 9321-F-15353.
- 2. Indian Point Unit 3, PSAR, Supplement 1, Item 18.
- 3. . Corps of Engineers, Proceedings of the American Society of Civil Engineers, Journal Waterways and Harbors Division, Hurricane Study of New York Harbor, February 1962, Issue No. 1.
- 4. Quirk, Lawler and Matusky Engineers, " Evaluation of Flooding Conditions at Indian Point Nuclear Generating Unit No. 3,"
Revision of Report of February, 1966, April 1970.
- 5. Indian Point Unit 3, FSAR, Supplement 10, January 1973.
- 6. Quirk, Lawler and Matusky Engineers, letter to Mr. John Inglima of Consolidated Edison Company of New York, Inc., dated January 21, 1972.
- 7. Burkham, D. E., " Accuracy of Flood Mapping," Journal of Research of the U.S. Geological Survey,'vol. 6, pp. 515-527, 1970.
- 8. Pickard, Lowe and Garrick letter to Mr. James F. Davis of the Power Authority of the State of New York, from Mr. Harcld F.
Perla of PLG, July 7, 1982.
- 9. "PRA Procedures Guide," prepared by ANS and IEEE for USNRC, NUREG/CR-2300, Review Draft, September 28, 1981.
- 10. Letter from William J. Cahill, Jr., Vice President, Consolidated Edison Company of.New York, Inc., to Mr. Richard C. DeYoungj Assistant Director for Pressurized Water Reactors, Directorate of Licensing, U.S. Atomic Energy Commission, dated l December 18, 1972. '
i
- 11. Letter from Carl L. Newman, Vice President, Consolidated Edison '
Company of New York, Inc., to Mr. George Lear, Chief, Operating Reactor Branch #3, Directorate of Licensing, U.S. Nuclear i Regulatory Commission, dated January 20, 1975.
- 12. Letter from William J. Cahill, Jr., Vice President, Consolidated Edison Company of New York, Inc. , to Mr. George Lear, Chief, Operating Reactor Branch G3, Directorate of I Licensing, U.S. Nuclear Regulatory Commission, dated I February 18, 1975.
2.7.3-8 w + --.e y + g .g -=w
-_ _ _ -. . . . - . .- _ =__ = .
- 13. Letter from Peter Zarakas, Vice President, Consolidated Edison Company of New York, Inc., to Mr. Steven A. Varga, Chief, Operating Reactor Branch #1, Directorate of Licensing, U.S.
Nuclear Regulatory Commission, dated July 14, 1980.
- 14. Letter from Steven A. Varga, Chief, Operating Reactor Branch
#1, Directorate of Licensing, U.S. Nuclear Regulatory Commission to Mr. John D. O'Toole, Assistant Vice President, Nuclear Affairs and Quality Assurance, Consolidated Edison Company of New York, Inc., dated December 18, 1980.
- 15. Memorandum for Ted Sullivan, from George Lear, " Indian Point-External Events," May 18, 1982, i
f 4 i j
- 2.7.3-9
2.7.4 Fire For Indian Point, Units 2 and 3, the Indian Point Probabilistic Safety Study (IPPSS) reports that fire accident sequences consti-tute a significant portion of the overall public risk of plant operations. Based on our review of the Indian Point fire analysis, we have found no evidence which contradicts the IPPSS conclusion that the risk of fire is significant. In fact, it appears that for some accident scenarios the potential importance of fire may be even larger than estimated in the Indian Point fire analysis, pri-marily because of uncertainties associated with defining the mechanisms by which fire damage occurs (eg, actual burning or high temperatures). This point will be discussed more thoroughly later in this section. Scope of Review our review of the Indian Point fire analysis considered each fire analysis step identified in the IPPSS. To help resolve ini-tial questions prompted by our review cf the fire analysis, we met with the authors of the analysis, and we inspected critical fire areas at Indian Point, Units 2 and 3. Based on this initial review effort, we concluded the following:
- 1) The Indian Point fire analysis appears to have identified all critical plant areas where a fire can cause an initla-ting event and, simultaneously, fail redundant safety systems.
- 2) The Indian Point fire analysis has adopted the best available data base for estimating the frequency of fires in nuclear power plant areas.
- 3) The Indian Point fire analfsis appears to have identified all important safety system components and cabling which are located in critical plant fire areas (See 1).
- 4) The Indian Point fire analysis reflects as-built plant conditions at the time the analysis was performed; how-ever, subsequent plant modificatiors to comply with Appen-dix R to 10 CFR 50, " Fire Protection Program for Operating Nuclear Power Plants," are not included in t he IPPSS.
- 5) The Indian Point fire analysis did not quantitatively assess the importance of a control room fire, even though an analytical basis for excluding the control room from analysis appears to be missing.
Consistent with these initial conclusions, we limited the scope of further review to the manner in which fire scenarios involving specific plant safety areas had been analyzed and quantified in the IPPSS. We did not reassess the selection of critical fire 2.7.4-1
areas, the adaptation of the fire frequency data base, the identi-fication of safety system components and cabling, or the impact of plant modifications implemented subsequent to the original IPPSS analysis. significanceFurthermore, we didfire. of a control room not attempt to estimate the safety The Fire Analysis Method As stated in the Indian Point fire analysis, "The occurrence of fires and their effects on plant safety are very complex issues which have not received as detailed attention as have other parts of the risk assessment in previous studies. Therefore, major assumptions had to be conservative in order to perform the analy-sis." In general, these assumptions involved fire occurrence fre-quencies, fire locations, fire propagation patterns, and fire damage. For each critical fire area in Indian Point, Units 2 and 3, the fire occurrence frequency was estimated using historical data, as represented by a gamma distribution. Within each area, specific fire locations were identified which were judged to constitute the greatest fire vulnerability (eg, where redundant cable trays cross). The fire occurrence frequency distribution then was reduced to reflect the lower chance that a fire in a critical area will occur at a particular location within the area. Next, the analysis postulated a fire initiation source (eg, cleaning solvent) and calculated a fire propagation pattern, based on a simplified fire plume model. A Delphi distribution for esti-mating the time required to extinguish fires was combined with the fire propagation model to arrive a' an estimate of the probability that a particular fire will be extinguished before damaging the redundant safety systems of concern. For those fire scenarios which required the subsequent random or operator failure of other safety systems before core melt would occur, the required system unavailabilities were estimated using the same techniques applied elsewhere in the IPPSS. Based on our review of this analysis method, we have identified two areas of concern which may impact the analysis results. First, the analysis assumes that fire damage occurs only through fire propagation within a fire plume, as a result of fire spreading between fuel zones. Second, the analysis sometimes gives significant credit for successful operator actions, even though the confused operating conditions resulting from a major fire could hamper an operator. Recent cable fire testing by Sandia has shown that a fire in one part of a room can generate a hot layer of gases along a l' ceiling, resulting in the failure of cabling located across the room. This testing has indicated that the failed cabling never reached its ignition temperature, but instead, it failed at a lower temperature corresponding to the melting point of its insu-lation. In the Sandia tests, both IEEE 383 qualified and noaqual-ified cabling shorted to ground or to other conductors, as a result of hot gas layers generated by both heptane fires and cable 2.7.4-2
)
i fires which were separated from the test cables by 20 feet. The time required to cause shorting ranged from 4.1 to 17.4 minutes depending on the fire configuration investigated. These times are comparable to or less than the fire plume propagation times esti-mated in the IPPSS (ie, 14.4 to 44.0 minutes). If these test results identify fire damage modes which are relevant to Indian j Point, then a damaging fire may start in a number of locations within a critical plant area, and the fire may need to be extinguished in a shorter time to ensure that redundant systems
- are not affected by the fire. The Indian Point fire analysis did not consider fire propagation by a hot gas layer or fire damage at temperatures below the ignition point of cabling.
Of course a number of factors can be identified which limit i the direct applicability of the Sandia test results to the Indian Point fire analysis. These include differences between the test room size and the Indian Point room sizes, between the types of cabling tested and the types of cabling used at Indian Point, between the test fire sources and Indian Point postulated fire sources, and between the relative height of the test cable trays and the Indian Point cable. tray. With regard to these differences, I the following information is known:
- 1. The room size used in the Sandia tests measured 25 x 14 x 10 feet high. By using burning rates comparable to those of the tests temperature calculations for larger room sizes as much as either 20 feet high or 50 feet wide were found to yield hot gas layer tempera';ures which could be expected to cause cable damage without cable ignition,
- 2. The IPPSS cites no data which discounts the possibility of
; Indian Pnint cables failing at temperetures below their 4
ignition point. In fact, there is evidence from tests conducted by the Electric Power Research Institute that t certain cabling used in Indian Point may fail below its I ignition point (ie, cabling designated as EPR/Nooprene insulated).
- 3. The source fires used in the Sandia tests and those postulated in the IPPSS primarily served to " start" fires in cable trays. Once cabling was ignited, the heat con-tribution of the source fires became relatively insig-nificant, and as a result, subsequent fire damage was determined by the rate of fire propagation among cabling and not by the source fire. The cabling and cable tray configuration in the Sandia tests do not vary significantly from those installed at Indian Point.
- 4. The cable trays which failed in the Sandia tests were l located within two feet of the ceiling in the test room.
( Based on temperature profiles measured during the tests l and the observed hot layer thicknesses, failure would not i have occurred under the test conditions for trays located 2.7.4-3
more than approximately 6 feet from the ceiling. Although this would indicate that some cabling at Indian Point may not be subjected to high hot layer temperatutes during a . fire, calculations or testing would be needed to confirm this conclusion. With regard to giving credit for operator actions, both the Unit 2 and Unit 3 fire analyses have stated that, in the event of a cable spreading room fire, an opetator ohould be able to control auxiliary feedwater pumps locally, by relying on " pneumatic steam generator level indication located inside containme9L at the ait-lock." We believe that the conditional mean failure frequency of an operator to achieve safe shutdown by this mode may be highet than the 2.5 x 10-2 value chosen in the IPPSS. Indian Point,_ Unit 2 The IPPSS identifies ten different plant damage states and release categories for fire-related scenarios at Indian Point, Unit 2. In terms of IPPSS notation, the ten fire scenarios are: IPPSS Mean Core Melt Frequency SE Electrical Tunnel 5.6 x 10-5 (PAB End) Switchgear Room 5.6 x 10-5 Elec tr ica'. Tunnel 3.2 x 10-5 (CB End) TE Cable Spreading Room 3.0 x 10-7 SLF l Electrical Tunnel Right Stack 2.4 x 10-5 (PAB End) Electr ical Tunnel Right Stack 2.4 x 10-5 (CB End) SEF Electrical Tunnel Right Stack 1.0 x 10-7 (PAB End) i Electrical Tunnel Right Stack 1.0 x 10-7
- (CB End) 2.7.4-4
IPPSS Mean Cote Melt Frequency TEFC Cable Spreading Room 1.6 x 10-6 OEFC Diesel Generator Room 9.0 x 10-7 In the IPPSS core melt and release frequency summary Table 8.3-9, the SE fire scenarios are added and, as a result, tie with seismic for first with respect to core melt f requency, while the SL1' scenarios rank third in terms of core melt frequency. Because of these high rankings, we discuss these two damage states and release categories more thoroughly in Sections 3.2.2 and 3.2.3 of this report. Before doing this, however, it is interesting to estimate the extent to which the cor? melt frequencies of the ten fire scenarios may change as a result of considering fire damage by a hot gas layer and placing less reliance on operator actions to achieve safe shutdown. In order to simplify our reanalysis of the Indian Point, Unit 2 fire scenarios, we will consider only those parts of the analysis which address either the assumed fire location within a critical fire area or the probability of successful operator action to i achieve safe shutdown. Parts of the fire analysis involving the frequency of fire occurrence in a critical area or the rate of fire propagation and extinguishment will not be reevaluated, even though these factors include conservatisms which may, in part, balance the l nonconservatisms inherent in the fire damage and operator action l portions of the analysis. As a first observation, the damage states involving a fire in the right cable tray stack of the electr. cal tunnel (SLF and SEF) would be diffic'lt to postulate in the context of a hot gas layer or cable failure without ignition. Because of the close proximity of the left and right stacks, it may be difficult to distinguish whether a hot layer of gases is generated by a fire on the left or the right or the center of the electrical tunnel. If this is true, then the SLP and SEF damage states should be replaced with a more probable SE event, corresponding to a fire occurring anywhere in the tunnel, not just in the aisle between the cable tray stacks. A reestimate of SE can De found by replacing the IPPSS average value for the fraction of electrical tunnel fires that are large and
)
occur in the aisle portion (ie, fg = 2.66 x 10-2) with the aver-age conditional frequency of vertical fire propagation (ie, Q( y) = j I 0.44). Although Q( y) strictly applies to the plume fire propaga-tion pattern considered in the IPPSS up one stack of cable trays in the presence of extinguishing capabilities, it may be viewed as con-servatively representing the probability of a hot layer formation, 2.7.4-5 f
l because the values estimated for my (extinguishment time) are 1 generally equal to or larget than the hot layer formation times found in Sandia tests. For a fire in the PAB end of the electrical tunnel, fA can be teplaced with Q(ry) to give a teestimate of the mean cote melt ftequency of about 1 x 10-3 However, for the electrical turnel, Q(Ty) appears not to reflect the extraordinary individual cable tray fire supptession systems installed in this location. With this suppression system Q(Ty) may be reduced by anothet order of magnitude. By using a value of Q(Ty) of 0.044 and setting fA equal to unity, the reestimated mean core melt frequency for a fite involving the PAB and CB ends of electrical tunnel both become about 1.0 x 10-4
- For the switchgeat toca fire which also conttibutes to SE, a reestimate can be found by replacing the conditional frequency i (fsn = 1.33 x 10-2) of a large exposure fire underncath a critical set of cables with a more conservative number reflecting a hot layet cable failute mechanism. The fgn factor used in the Indian Point study cortesponds to a large fire occurting in a patticular pottion of the switchgeat room floor. One way of viewing the fgn factot would be to considet only one in ten fires in the switchgear room as being big enough to cause a problem and that in order for such large fires to cause significant damege, they must occut in a patticular 13 percent portion of the fluvr atea. Another
- way of viewing fgn would be-to considet only 3 out of every 200 i fites in the switchgear room as being big enough to cause a problem, even if they occut anywhere within the switchgear room. Still j another approach would be to consider any reportable fire in the switchgeat room as being big enough to cause significant damage, ptovided the fite occurs in a particular 1.3 percent portion of the floor area. Although the IPPSS does not clearly state which inter-ptelation of fgn corresponds to the analysis assumptions, it appears that the fitst interpretation (ie, one of ten fires being significant) can best apptoximate the situation in the most areas of i Indian Point, Unit 2. This implies for the switchgear room that damaging fires must occut in a par ticular 13 percent nottion of the room's floot area, assuming cables are burned by an exposure fire.
However, if cables fail without burning, as a result of a hot gas
- 3ayer, then fites occutting over a larger floor area may cause l significant damage. If, for instance, fires occurring within 50 percent of the switchgear floor atea can cause significant damage by hot layet degtadation of cabling, then the switchgear room fire contribution-to SE would be atound 2 x 10-4 Fot the diesel generator toom fire which contributes to the SEFC r damage state and telease category, the Indian Point analysis assumed that only two diesel generatot fires out of a data base of sixteen j fires would have been latge enough to cause significant damage at l Indian Point. We believe that this assumption may be nonconserva-Live, because a dispropottionate number of the fourteen historically "small" diesel fires most likely took place while operators "ere test star ting diesel generators. Undet these conditions operators would have been present to extinguish a "small" fite, thereby
?.7.4-6
preventing the o urrence of a larger fire. However, when diesels are automatically demanded, following a loss of offsite power, operators could not necessarily be expected to detect and extinguish an incipient fire. Conservatively one could expect any one of the sixteen historical diesel generator fires to become "large." With regard to a hot gas layer failure mechanism, the conclusion that only a fire involving the middle diesel generator could damage the other two generators may be invafid. It may be possible to show that a large fire starting at any diesel can generate enough of a hot gas layer to fail the cabling which serves the unburning diesels. Taking into account all sixteen historical diesel fires and a possible hot layer failure mechanism of all three diesel genera-tors, the following reestimate of the mean core melt frequency of SEFC from a diesel fire can be made using IPPSS values: Loss of offsite powet Diesel generator Loss of (including the Unit 1 mean fire prob-offsite gas turbine) for at ability per power x least 60 minutes, as x demand times = 1.8 x 10-5 per year reestimated in Section three diesel (0.18) 3.2.4 of this report generators (5 x 10-2) (2 x 10-3) If analysis reveals that the assumed failure of teactor coolant pump seals leading to the SEFC damage state is overly conservative (see Section 4.7), then the diesel generator fire scenario can be viewed as a TEFC transient. For this type of transient sequence, an independent failure of the steam-driven auxiliary feedwater (AFW) train is needed. According to the IPPSS,2the unavailability of the stean-dtiven AFW train is about 1.5 x 10- per demand. This would yield a diesel generator fire initiated transient value of 2.7 x 10-7 for TEFC. For the cable spreading toom fire which contributes to the TE and TEFC damage states and release categories, a hot layer failure mechanism may increase the portion of the room floor area in which a damaging large fire (ie, one in ten fires) may occur from 26 percent to a larger percentage (eg, 50 percent) . In addition to this increase, the estimated frequency of the TE and TEFC events may inctease further, if the average failute frequency of an operatot to achieve safe shutdown using local AFW controls proves to be greatet than the 2.5 x 10-2 assumed in the IPPSS (eg, 10-1). The effect of these more conservative assumptions regatding a cable spreading room fire would be a factor of eight increase in the values estimated for TE and TEFC. 2.7.4-7
The following table summarizes for Indian Point, Unit 2, the estimated potential impact of assuming a hot layer failure mecha-nism and a higher operator failure probability for achieving safe
, shutdown. We have not attempted in these estimates to provide a l rigorous reassetament of the Indian Point, Unit 2 fire analysis, and therefore, caution should be used when quantitatively inter-preting or directly compatring the reestimated values with other core melt estimates in the IPPSS. Out purpose in making this reassessment was to examine the se'nsitivity of the Indian Point fire analysis results to the fire scenario assumptions invoked in the analysis.
IPPSS Mean Reestimated Mean Cote Melt Frequency Core Melt Frequency SE Electrical Tunnel 5.6 x 10-5 1,0 x 10-4 (PAB End) Switchgeat Roca 5.6 x 10-5 2.0 x 10-4 Electrical Tunnel 3.2 x 10-5 1,0 x 10-4 (CB End) TE Cable Spreading Room 3.0 x 10-7 2.3 x 10-6 SLF Electrical Tunnel 2.4 x 10-5 Included In Right Stack SE (PAB End) , Electrical Tunnel 224 x 10-5 Included In Right Stack SE (CB End) SEF ! Electrical Tunnel 1.0 x 10-7 included In l Right Stack SE (PAB End) - Electrical Tunnel 1.0 x 10-7 Included In Right Stack SE (CB End) TEFC Cable Spreading Room 1.6 x 10-6 1.2 x 10-5 l 2.7.4-8
IPPSS Mean Reestimated Mean Core Melt Frequency Core Melt Frequency SEFC Diesel Generator Room 9.0 x 10-7 1.8 x 10-5 Total Estimated Core 2.0 x 10-4 4.3 x 10-4 Melt Frequency From Fire Indian Point, Unit 3 The IPPSS identifies six different plant damage states and release categories for fire-related scenarios at Indian Point, Unit 3. In terms of IPPSS notation, the six fire scenarios are: IPPSS Mean Core Melt Frequency SE Switchgear Room 7.2 x 10-5* Cable Spreading Room 2.4 x 10-5 (Tunnel Entrance) TE Upper Cable Tunnel 7.8 x 10-7 Cable Spreading Roe:o 3.0 x 10-7 (North Wall) TEFC Cable Spreading Room 1.6 x 10-6 (North Wall)
- Reflects a reevaluation by IPPSS of a TE switchgear fire (page 7.3-105 of IPPSS) and a reassignment of the TE sequence to an SE damage state.
2.7.4-9
In the IPPSS core melt and release frequency summary Table 8.3-10, the SE fire scenatios are added and rank second with respect to core melt frequency. Because of this high ranking, we discusn this damage state more thoroughly in Section 3.3.3 of this report. Before doing this, howevet, it is interesting to estimate the extent to which the cote melt frequencies of the six fire scenarios may change as a result of considering fire damage by a hot gas layer and by placing less reliance on operator actions to achieve safe shutdown in the event of a cable spreading toom fire. In order to simplify out analysis of the Indian Point, Unit 3 fire scenarios, we will consider only those parts of the analysis which address either the assumed fire location within a critical fire atea or the probability of successful operator action to achieve safe shutdown. Parts of the fire analysis involving the frequency of fire occurrence in a critical area or the rate of fire propagation and extinguishment will not be reevaluated. For the switchgear room fires which contribute to SE, a reestimate can be found by replacing the conditional frequency (fsn = 1.33 x 10-2) of a large exposure fire underneath a l critical set of cables with a more conservative number reflecting a hot layer cable failure mechanism. The fgn figure used in the Indian Point study corresponds to a fire occurring in a particular 13 percent portion of the switchgear room floor (assuming one in ten fires is large).* If instead, a sufficient hot layer could be formed by fires in some larger fraction of the floor area (eg, 50 percent), than the switchgear room fire contributions to SE would be aiound 2.8 x 10-4 For the cable spreading room fires which contribute to the SE, TE, and TEFC damage states, a hot layer failure mechanism may increase the portion of the room floor area in which a damaging fire may occut from 17 percent to a larger percentage (eg, 50 percent). In addition to this, the estimated frequency of the TE and TEFC events may increase further, if the average failure frequency of an operator to achieve safe shutdown using local auxiliaty feedwatet pump controls proves to be greater than the 2.6 x 10-2 assumed in the IPPSS (eg, 10-1). The effect of these more conservative assumptions for cable spreading room fires would be a factor of eleven increase in the core melt values estimated for TE and TEFC and a factor of three increase for SE.
*See Unit 2 discussion of switchgear fire (SE).
! I 1 2.7.4-10 i
l l For the uppet cable tunnel contribution to TE, a reestimate can be found by teptesenting the IPPSS average value for the fraction of electr ical tunnel fires that are large and occur in the aisle portion (ie, fA = 2.66 x 10-2) with the average conditional frequency of vertical fire propagation (ie, Q(Ty = 0.44). Although Q (ry) strictly applies to the plume fire propagation pattern considered in the IPPSS up one stack of cable trays, it may be viewed as consetvatively representing the probability of a hot layet formation. We believe, however, the the value for Q (Ty) does not teflect this extraordinary individual cable tray fire suppression system installed in the Unit 3 electrical tunnel. With this supptession system, Q (Ty) may be able to be reduced by anothet order of magnitude to give a reestimated mean core melt frequency for the upper cable tunnel portion of TE of about 3 x 10-6, The following table summarizes for Indian Point, Unit 3, the estimated potential impact of assuming a hot layet failute mecha-nism and a highet operator failute probability for achieving safe shtudown. We have not attempted in these estimates to provide a tigotous reassessment of the Indian Point, Unit 3, fire analysis, and therefore, the teestimated values should not be quantitatively intetpreted ot directly compared with other core melt estimates in the IPPSS. Out purpose in making this reassessment was to examine the sensitivity of the Indian Point fire analysis results to the fite scenatio assumptions invoked in the analysis. IPPSS Mean Reestimated Mean Core Melt Frequency Core Melt Frequency SE Switchgear Room 7.2 x 10-5 2.8 x 10-4 Cable Spteading Room 2.4 x 10-5 7.2 x 10-5 (Tunnel Entrance) TE Uppet Cable Tunnel 7.8 x 10-7 3.0 x 10-6 Cable Spteading Room 3.0 x 10-7 3.3 x 10-6 (North Wall) TEFC Cable Spteading Room 1.6 x 10-6 1.8 x 10-5 (Notth Wall) Total Estimated Core 9.9 x 10-5 3.8 x 10-4 Melt Ftequency From Fite 2.7.4-11
Potential Impacts of Plant Modificatians Duting the coutse of Sandit's review of the I?PSS, it came to our attention that Indian Point, Units 2 and 3, ate evaluating sevetal proposed plant modifications which can decrease the overall tisk of fite. In the case of Indian Point, Unit 2, the proposed modifications have been described formally in a letter dated October 8, 1982, from John D. O'Toole, Vice President of Consol-idated Ed i son , to Steven A. Varga, Chief of NRC Operating Reactors Branch No. 1 - Division of Licensing. This letter also provides estimates of the safety imptovements that can be expected as a tesult of the modifications. Tot Indian Point, Unit 3, no fotmal descr iption of plant modificatiocs has been submitted to NRC. However, during a meeting in Albuquetque on October 13, 1982, rep-tesentatives from the Powet Authority of th6 State of New York (H. Specter and S. Schdenwiesner) discussed with Sandia Laboratoties (D. L. Betty and W. A. VonRiesemann) and NRC (D. Kubicki, R. Ferguson, and B. Buchbinder) one modification cuttently under eval- ' uation for Indian Point, Unit 3. Representatives from both Indian Point, Unit 2 and Unit 3, requested Sandia to evaluate the estimated safety benefits of the proposed modifications. In general, the Unit 2 and Unit 3 modifications focun on preventing the postulated seal LOCA accident sequences by providing hatd-wited cable hookups which ate independent of all critical fire areas to one component cooling pump, one chatging pump, and one service watet pump. Through component teliability data provided in Section 1.5.2.3 of the IPPSS, we estimated the unavailability of one component cooling pump or ene charging pump, using the hardwire hookup, to be about 5.5 x 10-2 per demand. This factor includes the probability that an operator will otr in switching over the two pumps to the alternate hard-wire hookuo (ie, about 4 x 10-2 demand), _< plus the probability that eithet pump will fail to start and keep tunning fot 24 houts (ie, 1.5 x 10-2/ demand). For these esti-mates, it was assumed that the switchovet involves and operator l leaving the control room and that a reliable offsite power supply is 1 available for thn pumps via the Indian Point, Unit 1, switchgear. It snould be noted that out estimated unavailability for the propo-sed modification dif fet s only slightly from the unavailability of l 4.6 x 10-2 estimated by Consolidated Edison (see footnote under l the following table). l Using the estimated unavailability of 5.5 x 10-2 for the hot layet failute mechanical case, the following comparison table war prepared for Indian Point, Unit 2. 2.7.4-12 i
1 d Indian Point 2 - Mean Core Melt Frequency For Fire Sequences Base Case with Reduced Fire Vulnerabilities for Component Cooling Base Case Water and Charging Pumps Sandia Sandia Reestimate Reestimate** IPPSS for Hot IPPSS* for Hot Estimate Gas Layer Estimate Gas Layer SE 1.4 x 10-4 4.0 x 10-4 4.1 x 10-0 2.2 x 10-3 TE 3.0 x 10-7 2.3 x 10-6 3.1 x 10-7 2.3 x 10-6 SLF 4.8 x 10-5 Included in SE - Included in SE SEF 2.0 x 10-7 Included in SE 2.2 x 10-6*** Included in SE TEFC 1.6 x 10-6 1.2 x 10-5 1.6 x 10-6 1.2 x 10-5 SEFC 9.0 x 10-7 1.8 x 10-5 9.0 x 10-7 1.8 x 10-5 Subtotal 2.0 x 10-4 4.3 x 10-4 9.1 x 10-6 5.4 x 10-S for Ten IPPSS Key Fire Sequences Non Key 1.6 x 10-5 1.6 x 10-5 1.6 x 10-5 1.6 x 10-5 Sequences Not Re-analyzed (Assumed Unchanged Values) Total 2.2 x 10-4 4.5 x 10-4 2.5 x 10-5 7.0 x 10-5 ' Estimated Core Melt Frequency
*As described in Consolidated Edison letter dated October 8, 1982, from J. D. O'Toole to S. A. Varga (NRC Operating Reactor Branch No. 1 Division of Licensing), using the estimated availability of 4.6 x 10-2 presented in the O'Toole letter.
**Using the Sandia estitaated unavailability of 5.5 x 10-2 for the proposed plant modification.
*** Consolidated Edison October 8th evaluation combined SLP and SEF states and assigned these states to SEF.
**** Seventy percent of this total was put in TEC and 30 percent in TEFC.
l 2.7.4-13 u -_ _ w
For Indian Point Unit 3, the lack of a formal proposal and core melt frequency reestimate by the utility precludes a comparison of estimated core melt frequencies similar to those just presented for Unit 2. However, ausuming that a Unit 3 plant modification compar-able to Unit 2 is adopted and that component and operator reliabil-ities at Unit 3 are about the same as Unit 2, then estimates of core melt frequency reductions can be made for Unit 3 by using the modification unavailabilities adopted for Unit 2. By doing this, the following comparison table was prepared for Unit 3. Indian Point 3 - Mean Core Melt Frequency For Fire Sequences Base Case with Reduced Fire Vulnerabilities for Component Cooling Base Case Water and Charging Pumps Sandia Sandia Reestimate Reestimate** IPPSS for Hot IPPSS* fot Hot Estimate Gas Layet Estimate Gas Layer SE 9.6 x 10-5 3.5 x 10-4 4.4 x 10-6 1,9 x 10-5 TE 1.1 x 10-6 6.3 x 10-6 1.1 x 10-6 6.3 x 10-6 TEFC 1.6 x 10-6 1.8 x 10-5 1.6 x 10-6 1.8 x 10-5 Total 9.9 x 10-5 3.8 x 10-4 7.1 x 10-6 4.3 x 10-5
*Using the estimated unavailability of 4.6 x 10-2 selected by Indian Point, Unit 2, for the proposed plant modification.
- Using the Sandia estimated unavailabilit1 of 5.5 x 10-2 for the proposed plant modification.
2.7.4-14 _m- n
2.7.5 Transportation and Storage of Hazardous Materials Section 7.7 of the PRA addressed, in essence, two generic hazardous environments: thermal and toxic. Each of these will be discussed in turn. A third generic environment, blast, was mentioned briefly in the context of secondary missiles. This is discussed in Section 2.7.5.3. 2.7.5.1 Thermal Hazards The hazards to nuclear power plants from large fires involve the potential for significant damage to safety related structures and equipment. Damage to exposed equipment from thermal hazards is generally not of concern as such equipment is not protected against tornado missiles, and hence is not safety related.1 An exception to this is the service water pumps which are exposed as discussed in the section on tornado hazards (IPPSS Section 7.5). l Reference 1 considered the potential effects from fires involving truck and rail car quantities of flammable materials. The standoff distances at Indian point are sufficient to reduce the thermal fluxes from such large fires to negligible levels at plant buildings. The heat capacity of large concrete structures is very high. Even the higher heat fluxes from fireballs (as compared to pool fires) would have negligible effects. In summary, the truck and rail transport of flammable materials would pose negligible risk to the plant. Section 7e3.3 of the IPPSS assessed the expected probability of a large, rapid spill of flammable materials on the Hudson River. The IPPSS assessed a range of 8 x 10-9 to 8 x 10-6 per year for a rapid petroleum spill on'the river. The NRC disagrees with this assessment and estimates the probability of a petroleum laden barge impact near the cooling water intake structures to be between 1.5 x 10-4 and 3 x 10-3 per year. It should be noted that the NRC did not estimate a probability of igniting the spill. Assuming the spill ignites, one could postulate failure of the service water pumps, eg, the pumps could draw the spill into their intake structure and ignite them. The loss of service water event tree was reviewed in Section 2.2 of this report. The discussion there indicated that a loss of service water may lead to core melt if recovery actions are not performed within several hours. However, the discussion also indicated that the frequency of accidents initiated by a loss of service water are small compared to the frequency of other accidents in the same plant damage states. This conclusion would also be true for a loss of service water due to a petroleum fire since the frequency of such an event is less than or equal to other causes of service water failure, ie, other causes ~ 2 x 10-3/yr. I 2.7.5-1 s _ n _ __
Section 7.7.4 of the PRA assessed the probability of a large leak from a natural gas pipeline located about 400 feet away from the closest safety related structures. A fire from such a large leak would have to burn for several hours before safety related concrete structure might be threatened. Such long exposures to high heat fluxes do not result in catastrophic failure of struc-tures, but rather in the (conservative) thermal design criteria for reinforced concrete structures being exceeded. In summary, accidents initiated by thermal fluxes from large fires are not expected to significantly impact the Indian Point plant damage states or risk. 2.7.5.2 Toxic Hazards Of the chemicals listed in IPPSS Tables 7.7-1 and 7.7-3, only chlorine, anlydrous ammonia and hydrogen cyanide need be consid-ered further. Large releases of these chemicals could lead to incapacitation of the control room operators. Accidents involving the remaining chemicals on the lists would not lead to significant airborne concentrations such that the control room operators could be endangered. The ongoing analysis mentioned in Section 7.7.6 for chlorine, ammonia and hydrogen cyanide would indicate the level of protection needed for the control room operators. 2.7.5.3 Blast Hazards In Section 7.7.4, a pipeline explosion was cited as leading to pipe fragments being propelled about 350 feet. It should be pointed out that such fragments would pose minimal risks to rein-forced concrete structures. These tumbling, irregular fragments would penetrate only a very small distance into reinforced con-crete structures as compared to the design basis tornado missiles (which the concrete structures are designed to withstand) . In summary, blast fragments would be a negligible threat to reinforced concrete structures and even less of a threat to safety related equipment located inside such structures. REFERENCE
- 1. Bennett, D. E. Finley, N. C., Hazards to Nuclear Power Plants from Nearby Accidents Involving Hazardous Materials - A
, Preliminary Assessment, Sandia National Laboratories, Albuquerque, New Mexico, SAND 80-2334, NUREG/CR-1748, April 1981. 2.7.5-2 i l n n J
2.7.6 Turbine Missiles The scope of the review was limited by the brevity of the presented analysis. Very little substantial description of methodology or assumptions was given. Additional information was provided by Harold Perla of Pickard, Lowe, and Garrick, and several specific questions were answered which permitted some understanding of the methodology and assumptions. After the above conversation, a short review of the FSAR, Section 14A, was conducted and some simple calculations were made to confirm that all values presented in the FSAR were conservative. . Mr. Perla stated that very little work had been done on this section. The plan was to wait on a forthcoming report, mentioned in the IPPSS, which is in preparation by Westinghouse. When this report became available, the utility was to complete the PRA. (The status of the report and the subsequent PRA is unknown at this writing.) The information presented in the IPPSS was basically taken from the FSAR. A brief review of the FSAR to determine the source of the value of 10-3 for the probability that the missile strikes safety related equipment confirmed that the value is defendable. Although there are several plausible sets of assumptions which might have yielded results similar to those quoted striking safety related equipment s 10-b,ie, the probability of not exact ones were stated in the FSAR. Even though there is no definitive way of evaluating the work done, it appears that the results are accepta-ble. A set of simple calculations confirmed that the missile penetration analyses were conservative and that the strike probabilities of 1 10-3 were reasonable. l 2.7.6-1 _ - - - - - - - - - _ _ _ -_n n . J
2.7.7 Aircraft Accidents The IPPSS section on aircraft accidents was reviewed and the results compared with those from analyses published in the litera-ture for aircraft impact. It was tacitly assumed in the IPPGS and continued here that the airborne, suicidal terrorist was not included in this analysis. The conclusions regarding frequency of impact are reasonable but conservative in several ways, particularly as it follows the standard review plan and as it takes no credit for terminal maneu- j vers to avoid hard structures by the pilot. This sort of maneuver ; is to be expected in at least some crashes. No real discussion of consequences of a crash is included but since light aircraft have a striking probability of only slightly greater than 10-7 per year and heavy aircraft less than 10-', this discussion was probably eliminated with justification. No mention was made on an onsite fire following a crash but this too has a combined probability significantly less than 10-7 per year. The conclusions of the IPPSS seem well justified. 2.7.7-1 l n a s
l 2.7.8 Seismic and Wind Fault Trees / Logic Models The approach to the system modeling used in the IPPSS started with the determination of the fragility of all major components All of the applicable plant safety-related systems and structures. but those components or structures, which were in the range of pos-sible seismic ground acceleration or were exposed to possibly damaging wind / tornado forces, were then eliminated. The systems / component considered seems to be reasonably complete. The core melt model is then represented entirely by f ault trees which were apparently developed from the event tree / fault tree models used in the internal events analysis by eliminating The all events not affected by seismic and wind / tornado failures. resulting fault trees seem reasonable on this basis, although the IPPSS procedure was not reconstructed. (The seismic and wind / tornado fault trees appear in IPPSS Section 7.2 and 7.5 respec-tively). The core melt models were then combined with the contain-ment fan cooler and spray system models so that the status of the This containment following the core melt could be evaluated. into release allowed placement of the various core melt cut sets categories. The IPPSS external event systems analysis was entirely separate from the internal event systems analysis until the application of the site matrix. An alternative method, which considers external and internal failures together, would be to apply the external cause directly to the basic internal event tree / fault tree model. As it is, the IPPSS fault trees may fail to identify some important cut sets involving combinations of external and They internal events. agreed that This point was discussed with IPPSS personnel. cutsets are missed; however, they felt that core melt accidents resulting from combinations of external and internal events are probabilistically small, or of less risk significance, in compari-son with solely externally caused accidents. This hypothesis seems reasonable to us since external events generally cause common mode failure of redundant systems with a much higher probability than failure of these systems by nonexternal event " random type" causes. To test this hypothesis, we postalated several external initiating events in combination with internal events identified in the IPPSS to have a relatively high random probability. The most significant combination of events identified was a core melt sequence at Indian Point 2 with an approximate frequency of 6 x 10-7 This sequence is initiated by a 0.2 g seismic event (5 x 10-4/Eyr, see IPPSS Figure 7.2-4) followed by a loss of off-site power (.5, see IPPSS Figure 7.2-5) , and failure ofsee diesel generators 21 and 23 due to random causes (2.1 x 10-3, Section 4.3). Due to the occurrence of the external event, neither offsite nor onsite power could be recovered. (This is consistent with the IPPSS assumption.) This combination of events would cause a seal LOCA and failure of core cooling and would result in plant 2.7.8-1
damage state SEC and release category 8B. Referring to the 8B proballity density in Figure 7.2-10 it can be seen that 6 x 10-7 lies outside the 8B 99 percent confidence limit. How7ver, it can also be seen that the 2RW release category dominates the frequency of seismic events. Release category 2RW is typified by common mode failure of safety systems and has a much higher associated risk than category 8B. The IPPSS hypothesis that " combinations of ext:3rnal and internal events are probabilistically small, or of less risk sig-nificance, in comparison with solely externally caused accidents" appears to be supported by this limited investigation. l l 2.7.8-2 l
l l i
- 3. Accident Sequence Analysis 3.1 Introduction In this section, selected accident sequence analyses are reviewed. Because of the very large number of sequences considered in tha report, it is necessary to focus on a subset. We considered the sixteen Indian Point 2 and twelve Indian Point 3 sequences circled on the attached copies of Tables 8.3-9 and 8.3-10, respec-tively. These include the sequences which, by the IPPSS estimates, dominate core melt frequency or serious radioactive material S or A release frequency. The plant damage state nomenclature is:
denotes small or large LOCA and T denotes transient, E or L denotes early or late core melt, F and C denote fans and spray working, i respectively. In the following subsections we review the IPPSS analyses of these sequences. First we compare the IPPSS point estimates, their posterior means, to alternative estimates based, where possible, on the reported IP data or on alternative data sources or assump-tions. For the most part, our alternative estimates are obtained by modifying a few terms in the IPPSS models--eg, 6-factors and human error probabilities--so the resulting point estimates are a mixture of IPPSS Bayesian results and our own less formal (but not necessarily less realistic) point estimates. We regard our results as " working values"--reasonable estimates to be used in subsequent calculations. Because any point estimate, no matter how derived, can convey an unwarranted aura of precision, we have also carried out a statistical uncertainty analysis for internal event accident sequences. The limited data available to us was not sufficient to do a similar statistical analysis for external events. To the extent possible we have identified data pertaining to the parameters of interest,The then combined them to obtain statis-methodology used is that given in a tical confidence limits. report by Maximusl extended to include the estimation of failure rates as well as failure probabilities. This methodology consists of a collection of reduction rules whereby the data pertaining to
" components" are reduced to effective " system" data, by ways that account for the series parallel structure of the system and for the In our analysis possible repeated use of the same component data.
we have generally simplified the model so that only the dominant cut sets, in terms of both the estimated occurrence probability and the imprecision of these estimates, are considered. Also, where only subjective estimates are available, we have translated them to i effective data. The resulting bounds don't have the status of statistical confidence limits, but they're the best we can do until data can be obtained. An intermediate step in obtaining statistical confidence limits by the Maximus approach is the calculation of the " maximum likeli-hood estimate" of the accident sequence rate (there's no connection 3.1-1 , I l _ J
VABLE 8.3-9 COMPARISON OF CORE MEL7 AND RELEASE FREQUENCY CONTRIBUTION OF MAJOR SCENARIOS, INDIAN POINT 2 Rank Containment gg,, Relative Relative g Maj o- Mean Split Rank With Containment Mean ant Annual Split Fraction Annual Rank With Re spec t Annual Fraction Frequentv Respect to Respect to to Sequence State / Frequency
- to Latent to Early Frequency of Latent latent Naths of Early Early Core Release (Contribution Effects 'C 5 Deaths Category to Core Melt) Release Effects kelease Deaths Melt p,7,,s, Release Release Frequency Release Frequency h Se ls?.ic : Loss of Control or Power SE/2RW 1.4-4 1.0-0 1.4-4 1 2.0-4 2.8-8 3 h Fire: Specific Fires in Electrical Tunnel and Switchgear Room Causing SE/2RW 1.4-4 1.0-0 1.4-4 2 2.0-4 2.8-8 4 RCP Seal LOCA and Failure of Power Cables to the Safety Injection Pumps.
Containment Spray Pumps, and Fan Coo lers. h Fire: Specific Fires in Electrical Tunnel Causing RCP Seal LOCA and SEF/8A 5.0-5 2.0-4 1.0-8 8 1.1-4 5.5-9 5 failure of Power Cables to All MCCs. Safety Injection Pumps, RHR Pumps, and Containment Spray Pumps, h Turbine Trip Due to Loss of Offsite SEFC/88 Power: Failure of Two Diesel Gener-3.0-5 1.0-4 3.0-9 9 1.0-4 3.0-9 8 atcr; RCP Seal LOCA, and failure to Recover Esternal** AC Power Until w After 1 Hour. g h Hurricane, etc., Wind: Loss of All AC Power Due to High Winds, SE/2RW 2.7-5 1.0-0 2.7-5 3 2.0-4 5.4-9 6 h Tornado and Missiles: Causing Loss of Of fsite Power and Service Water SE/2RW 1.6-5 1.0-0 1.6-5 4 2.0-4 3.2-9 7 Pumps or Control Building. h Small LOCA: Failure of Recirculation Cooling SLFC/8B 1.3-5 1.0-4 1.3-9 10 1.0-4 1. 3-9 9 h Large LOCA: Failure of Low Pressure Recirculation Cooling ALFC/8B 1.1-5 1.0-4 1.1-9 11 1.0-4 1.1-9 10 h Medium LOCA: Failure of Low Pressure Recirculation Cooling ALFC/8B 1.1-5 1.0-4 1.1-9 12 1.0-4 1.1 9 11
- Shorthand not.cion meaning 4.0 x 10-3
**0ffsite AC power or gss turbine generator.
T E 3.1-9 (ccatitaed; CCvPAR!'ON OF CGPE YELT A'O ;ELEA5E F EQUEN:V COU;;BJUM5 JF 'GR SCE'.Ai:0 3. ! *C : A', 2.' ".T ? Rank Cot tin it o.,3, Reiri /e 7 y, jehe Witn d" "*" W II 4Ed
- d,',* !t p" yynt ntien Ann W
^ t' g,, g p'tanta te, ynn;al .-ra: tier Fen 2e q !*'
' 50 '! ! 10 to EiO Fr m e';. '
"S t tU to Segaence s Pe! ease credency7 (Contribation ta Latent Effects of Litent b'I*'t tffe; s Deaths ~ of Ea-lf
,Destns Core gffg.g3 pgje33, 3,3 , s Category t3 Core 'Olt Relene q,g Dele is t pj, neleise
%)t feeoen;y Fregacecy h T srine '-ip Due to Lass of Offsite Paaer: 'n3 of All AC Power (Due t 2 3EFC/SB 6.5-5 1.0-1 6.5-10 13 1.0-4 6.$-13 12 Diesel :silare and Combined Diesel /
Service atter Failure), RCP Seal LOCA, an$ ra iture to Recover Cxter-n51** AC ?caer Uqtil After 1 Houe. 5.4-10 h Large LOCA: Failure of Low Pressare Isfety Injection. AEFC/SB 5.4-5 1.0-4 5.4-10 14 1.0-4 13 1.0-4 1.5-10 h T 2rbine T-ip Due to Loss of Of f site Power; :silure of Two Diesel-Gene - SEC/SB 4.4-6 1.0-1 4.4-10 13 14 atars, ;CP Seal LOCA, and Faf12re t: Recover Enternsl** AC Power. 1.0-4 3.$-10 h Small LOCA: Failure of High Pressr c Tje:tioq. SEFC/9B 3.5-6 1.0 4 3.5-10 15 15 14 Med i .rt LO.:A: Failure of Low AEFC/SB 1.7-6 1.0-4 1.7-10 17 1.0-4 1.7-10 17 f Pressure :qjection. F4 1.6-13 1 15 F Te: Spe:ific Fire in Cable TEFC/88 1.5-6 1 0-4
. 1.6-10 13 1.0-4 13 W Speeding Room Causing Loss of All Control Power.
2.9-4 2.0-10 16 h I;rbine Trip Due to Loss of Offsite SE/2RW Power: . ass of All AC Power (Due to 1.0-6 !.0-0 1.0-6 S Diesel tail 2re and Combined Diesel / Sereice Ester Failure), RCP Seal LOCA, and Fail..re to Recover Externe!** AC Pa er. 8.5-7 1.0-4 S.5-11 19 1.0-4 8.5-11 19 17 Tarbtoe ' rip: Failure of AFWS and TEfC/BB Faiiare af 31eed and feed Coaling. 7.9-7 1.0-4 7.9-11 20 1.0-4 7.9-11 20 19 Reactor Trip: Failure of AFWS aq1 TEFC/SB Fsilare cf 31eed and Feed Coaltog.
*Snorthand notation meaning 4.0 x 10-3,
**0ffsite AC power er gas turbine generitor.
TGLE 8.3-9 (contiteC COCIS'>N JF CO?E ME.T A".1 RELEASE FREjjE*CY cwa:3JT!O'$ 0: VA D SZNt.1:05 :'0I AN P T.NT ? g 3 n, Coaftq eit g, Relstf.e g t g .,.g g.,, g
,^ 3 N }#'e'at iy e a119 Pisnt [#
,nnan
,#'I'l rraction Annual N3"' "' '
Respe:t to S r t Frt:tian Anna s! a"?* "_. Sea;ence Respect to State / Freb ency* ta Let?nt #*D*"3 '.atent 0
#"fI "3#" # E Fly Release (Contribution Effects U[li# Effects De nns cf ca~iy M Category t3 Core Melt) Peleau f,jf,' Re'eas?
Frezaency g ;] 7,,gyg Release Freqqency 19 Medium LOCA: Fai1 Jre Of MiJh AEFC/83 7.9-7 1.0-4 7.9-11 21 1.0-4 7.9-11 21 Pressure Inje: tion. 20 Loss of Maic Feed =ater: Failure 7.9-7 1.0-4 7.8-11 TEFC/SB 22 1.0-4 7.5-11 22 of AFWS and failure af 31eed and Feed Cool hg. h Seismic: Direct Contsinment (Backftll) F311ure. 2/0 6.8-7 1.0-0 6.3-7 5 1.0-0 6.S-7 1 22 Tarbine Trip: AT45 ed Failure SEFC/88 6.3-7 1.0-7 5.3-11 23 1.0-4 6.3-11 23 cf AFWS. 23 Loss of Main Feednater: ATWS and SEFC/88 5.8-7 1.0-4 5.8-11 24 1.0-4 5.S-11 24 Fa'lare of AFWS.
@ hterf acing System LOCA V/2 4.7-7 1.0-0 4.1-7 7 1.0-0 4.7-7 2 w
h *5horthand notation meaning 4.0 x 19-3, 4 8
**0ffsite AC power or gas turbine generator.
___ _ .___ _ ___m__ . _ ._ - . ..-- __ _ _ _ . . _ __ _ . _ __. _ _ _ _ _ . . . _ _ _ _ _ . . . _ _ . .__ - . . . . _ _ _ . ~ , _ _ _ . __ TABLE 8.3-1] l t CMARISON OF CORE met AND RELEASE FJE0'JENCY CONTRIBUTIONS OF MAJOR SCENAR.105,._IN3IAN P)!NT 3 '/ r I Contain s t Reladva e ative Rank ge,, Containment Mean j Major Mean Split gnn,3j Raw mn Annual Rad Utn Mth Plant Annual Fraction N'SP'#E O Split Fra: tion N'5P'" Frequence Fraquency Respect rreguency* Latant to Early Early Seq.ence Stste/ to Latent o a t ts o Eae y Release (Contributien Effects Effects q ,g Deatns ) C e Category to Core Melt) Releass Release Release , Melt 9,j,,,, Release Frequency j Frequency 8.2-5 1.0-4 S.2-9 8 1.0-4 S.2-9 4 l
@ Small LOCA: Fail;re of High Pressure Recirculation Cooling.
SLFC/88 l Fire: Specific Fires in Switchgear 6.1 5 1.0-0 6.1-5 1 2.0-4 1.2-8 3 t
@ Room and Cable Spreading Room SE/2RW j Causing RCP Seat LOCA and
- Failure of Power Cabies to toe
! Safety injectiort ? umps, tne Contain-i ment 5,1 ray Pumps, and Fan Coolers. 1.0-4 1.1-9 5 f h large LOCA: Failure of Low Pressure Recirculation Coaling. ALFC/SB 1.1 5 1.0-4 1.1-9 9 1.1-9 h Medium LOCA: Failure of Low Prassure Recirculation Cooling, ALFC/88 1.1-5 1.0-4 1.1-9 10 1.0-4 6 1.0-4 6.4-10 7 y h Large LOCA: Failure of Safety Injection. AEFC/88 6.4-6 1.0-4 6.4-10 11 1.0-4 2.8-10 9 6-' h h Small LOCA: Failure of Safety Inje: tion. SEFC/88 2.3-6 1.0-4 2.8-10 12 1.0-4 2.7-13 10 h Turbine Trip Due to Loss of Offsite SEFC/8B Power: Loss of All AC (Due to 2.7-6 1.0-4 2.7-10 11 Diesel Failure and Combined Diesel / , i Service Water Failure), RCP Seal LOCA, and Fail 2re to Recover External ** AC Power Until After 1 Hour. i 2- 2.0-4 4.8-10 8 h Seismic: Losi af Control or AC Power. SE/2RW 2.4-6 1.0-0 2.4-5 1.7-6 1.0-4 1.7 10 14 1.0-4 1.7-10 12 j 9 Medium LOCA: Failure of Low AEFC/SB Pressure Safety Irje: tion. 1.6-6 1.0-4 1.6-10 15 .1.0-4 1.6-10 13 I' Fire- Specific Fire in the Cable SEC/88 , Spreading Room Causing Loss of All ]l Control Power.
~_ - . - _ _ _ _
- Shorthand notation meaning 4.0 x 10-3
**0ffsite AC power or gas turbine generator.
TABLE 8.3-10 (continued) COMPARISON OF CORE MELT AND RELEASE FREQUENCY _CONTRIBUTI3F JF MAJOR _ SCENARIO 11NDIAN POINT 3 E ank Containment Relative Rela W e Maj r Mean Mean Containment Nean 4th Split Annual Rank Wit. Rank in RespM t Plant Anaual Fraction Respect (t' 5 lit Fraction Annual Sequence Frequency to Ear?y Frequency Respect to U State / Frequency
- to Latent Latent Early 0
Release (CcNribution Effects Effects " Deaths y Category to Core Melt) Release Ef 9,j,33, Release R e th Release N'S' Frequency Fregaency h Te<nado and Missiles: Loss of Offsite Power and SW Pamps. SE/2PW 9.2-7 1.0-0 9.2-7 3 2.0 4 1.8-10 11 12 Loss of Main Feednater: ATWS and SEFC/8B 7.7-7 1.0-4 7.7-11 18 1.0-4 7.7-11 16 Fal Lre of Arv',. 13 Seismic. Loss of Witer Storage TEF/8A 7.1-7 2.0-4 1.4-10 16 1.1-4 7.8-11 15 Tanks , 14 Loss of Main Feedwater: Failure SLFC/8B 5.3-7 1.0-4 5.3-11 19 1.0-4 5.3-11 17 of AFWS and Long Term Cooling. h Interfacing System LOCA: V/2 4.8-7 1.0-0 4.8-7 5 1.0-0 4.8-7 1 h TT/ LOP: Loss of All AC, RCP LOCA. Failure to Recover. SE/2RW 4.8-7 1.0 4.8-7 4 2.0 4 9.6-11 14 17 Tornado and Missile: Loss of TEF/8A 4.1-7 2.0-4 8.2-11 17 1.1-4 4.5-11 18 Offsite Power and RWST. W
- 19 Medium LOCA: Failure of High AEFC/SB 3.8-7 1.0-4 3.8-11 20 1.0-4 3.8-11 19 y Pressure Injection.
19 Tarbine Trip: Failure of AFWS SLFC/88 3.8-7 1.0-4 3.8 11 21 1.0-4 3.8-11 20 and Long Term Cooling. 20 Loss of Main feedwater: ATWS and SEFC/8B 3.3-7 1.0-4 3.3-11 22 1.0-4 3.3-11 21 Failure of Pressure Relief. 21 Turbine Trip Due to Loss of SEFC/8B 2.4-7 1.0-4 2.4-11 23 1.0 4 2.4-11 22 Offsite Power: ATWS, Failure of AFWS. h Seismic: Containment Failure Z-10 3.7-8 1.0 3.7-8 7 1.0 3.7-8 2
- Shorthand notation meaning 4.0 x 10-3 "Of f site AC power or gas turbine generator.
between the company name and the estimate name). These estimates also are plausible working values, but since we're dealirg with reduced models and since the maximum likelihood estimate of the probability of an event that hasn't happened is zero, we believe it more prudent to use the point estimates obtained from modifying the IPPSS estimates as working values in subsequent calculations. One has a great deal of leeway in choosing point estimates and one purpose of calculating statistical confidence limits is to show a range within which one could choose a point estimate and not be inconsistent with the data. Correct interpretation of statistical confidence limits is important. Stating that a statistical upper 95 percent confidence limit on A , the occurrence rate of a particular accident sequence, i s 1. 5 ( - 5) /y r . , for example, means the following: If A were acctually greater than 1.5(-5), then the chance of observing data as favorable as those observed, or moreso, is less than .05. That is, values of A greater than 1.5(-5) are inconsistent with the data, to the extent indicated; the observed data would be fairly unlikely. Values of A less than 1.5(-5) are more consistent with the data since in that case the chance of such favorable data is Note that the chance, or probabilistic, basis of greater than .05. statistical confidence limits is the random variation of possible data, for a fixed A . The parameter A is not a random variable (nor is it in the IPPSS analysis--rather one's presumed state of know-ledge about that unknown constant is expressed as a probability distribution), so a 50 percent confidence limit, for example, is not the median of some distribution of A . There is no distribution of A around to calculate the median of. Neither do statistical confidence limits represent, necessarily, our feelings about A . They are simply statements about values of A that are consistent with the available data, given certain models that link the data to A . We think it is important to get a clear picture of what information can be extracted from the data. This review also tested the readability and reproducibility of The the IPPSS. In several respects, the report was found wanting. sources of numbers used in the event tree cal:ulations (Sec-tion 1.3) were difficult to trace because of:
- Incorrect references; eg, a referenced section sometimes would not contain the information claimed to be there.
- Incomplete references; eg, a reference to 1.5.2 would actually be to 1.5.2.3.4.1.2
- Nonmatching numerical results; in many cases, late changes in the system reliability estimates were not carried through to the event tree analyses so the numbers don't match. For example, the loss of offsite power dominant accident sequence Table 1.3.5.llb-4 was found to be completely wrong and a new table was supplied to us.
3.1-7
Unclear or inadequate descriptions af events and the IPPSS modeling of them. Descriptions mar.y times had to be clarified with help from the IPPSS authors. Specific instances will be cited in the following sections. To aid the reader, pertinent page copies from the IPPSS are included where appropriate. REFERENCE
- 1. Handbook for the Calculation of Lower Statistical Confidence Bounds on System Reliability, Maximus Inc, McLean, VA, February 1080.
3.1-8
3.2 Indian Point 2 Domitant Accident Sequence Review
3.2.1 Seismic
Loss of Control or Power, SE The Boolean expression for IPPSS seismic release category 2RW which is dominated by plant state SE was checked starting with the fault trees and found to be correct. An integration using the 11 hazard curves from IPPSS report Sections 7.9.1 and 7.9.2 with the five fragility curves from IPPSS report Table 7.2-4 was performed using the same relative weighting as the IPPSS, and a mean frequency value of 0.8 x 10-4 per year was obtained. This compares to the value of 1.4 x 10-4 per year reported by the IPPSS. We believe that the difference is due to dif ferences in the integration procedures used and probably the lumping of hazard curves into the final family used in the DPD operation. A finer discretation of the hazard and i fragility points would probably reduce this difference. The SE/2RW seismic sequence is dominated by the impact between the Unit 1 and 2 control rooms which has a median damage effective ground acceleration of only 0.279 in the original analysis. It is assumed that, if an earthquake large enough to fail the control room occurs, offsite power and the gas turbine will not be available. The next most significant contributor, the superheater stack falling on the control building, has a median capacity of 0.72g, which is almost larger than the upper-bound cutoff value of 0.8g used on the seismic hazard curves. Thus this component does not contribute much to the frequency of SE/2RW in the original analysis. For the revised analysis prepared by the IPPSS authors after completion of the IPPSS report and which eliminates the problem of impact between the Unit 1 and 2 control room roofs, we believe that the ceiling failure is now a dominant contributor to 2RW. Based on a review of the development of the structural capacities, we believe that the revised annual frequency for 2RW equal to 6.9 x 10-6 per year is a factor of 6.8 low due to the hazard curves and the low capacity of the control room ceiling. Our l estimated frequency for this sequence is thus 4.7 x 10-5 per year. l The following conservatisms and unconservatism were identified based on the IPPSS report and a revised analysis for the control room roof: l Conservatismg:
- 1. The method of combining the seismicity curves shown in l Figure 7.2-4 of the IPPSS report as obtained from the curves given in Sections 7.9.1 (D&M) and 7.9.2 (WCC) may be conservative by a factor of approximately 2._
3.2.1-1
- 2. In regards to the control room ceiling failure mode, considering all three operators to be present in the control room during an event is concarvative.
In addition, the Transite panela may have been cut wider than the distance between the angle supports (preventing them from falling if they slide to one side). Unconservatism: s
- 1. Neglacting design and construction errors and aging effects is unconservative.
f i i 1 1 l 3.2.1-2
l 3.2.2 Fires Involving Electrical Tunnel, SLF ., ! This accident sequence which contributes to plant damage state SLF combines separate estimates for the following two different fire scenarios: o IPPSS Mean Core Melt Frequency Electrical Tunnel 5.6 x 10-5 (PAB End) Switchgear Room 5.6 x 10-5 Electrical Tunnel 3.2 x 10-5 (CB End) h 1.4 x 10-4 A discussion of each of these fire scenarios follows. A fire that severely damages either of these critical fire areas can a f fect the power feed to the charging pumps, the containment sptay pumps, the component cooling pumps, the safety injection pumps, the PORVs, MCCs 26A and 260, and all five containment fan water pumps could be ! cst. Given the loss of component coeling pumps and all charging pumps, a postulated small LOCA thrugh failure of the reactor coolant pump seals was assumed in the IPPS analysis For each of these fire scenarios, the Indian Point fire assescuent applied the fire analysis method described in Section 2.7.4 of this report. As part of our reanalysis of these fire scenarios, we examined the sensitivity of the IPPSS cote melt fre-quency estimates to the type of fire damage phenomena postulated for the fire scenarios. In particular, we considered that cabling may be damaged by a hot gas layer, instead of by a fire plume, as assumed in the Indian Point analysis. Based on the limited rem.alysis which we performed given the tima and information available, we show in Section 2.7.4 that, when a hot layer failure mechanism is considered, the mean core melt fre-quency for this sequence may be as such as a factor of *hree higher than the value estimated in the IPPSS, i.e., 4 x 10-4 However, if consideration is given to the proposed plant modifications dis-cussed in Section 2.7.4 for the Indian Point, Unit 2, then the estimated mean core melt frequency for this sequence decreases from 4.0 x 10-4 to 2.2 x 10-5, The following potential conservatisms and unconservatisms were identified in our review of this sequence: 3.2.2-1
Conservatisms
- 1. India'n Point cables may not fail at temperatures as low as those observed during tests performed at Underwriters Laboratories (UL) or tests performed by the Electric Power Research Institute (EPRI).
- 2. Hot gas layers of sufficient size and temperature to cause cable damage may not form from all the fires assumed by Sandia to cause damage.
- 3. Not all improvements in fire safety as a result of Appendix R fire protection modifications were considered by IPPSS, and Sandia evaluated only one type of improvement. ,
l
- 4. The IPPSS fire occurrence data base may be pessimistic because !
data since 1978, reflecting an expected reduced fire frequency, was not considered.
- 5. The IPPSS temperature estimate from the source fire may be overconservative.
- 6. A reactor coolant pump seal LOCA was assumed by the IPPSS to occur following a loss of seal cooling (see Section 4.5) .
Unconservatisms
- 1. Hot gas layers of sufficient size and temperature to cause cable damage may form from more fires than assumed by Sandia to cause damage.
- 2. The IPPSS fire occurrence data base may not be complete because many small fires go unreported.
l 3.2.2-2 a
l 3.2.3 Fires Involving Electrical Tunnel, SLF This accident sequence which contributes to plant damage state SLF combines separate estimates for the following two different fire scenarios: IPPSS Mean Core Melt Frequency Electrical Tunnel Right Stack 2.4 x 10-5 (PAB End) Electrical Tunnel Right Stack 2.4 x 10-5 (CB End) 4.8 x 10-5 Note: Table 8.3-9 of the IPPSS incorrectly lists this sequence as SEF. A fire that severely damages either of these critical fire areas can affect the power cables for the component cooling pumps, charging pumps, containment spray pumps, and both safety related MCCs, 26A and 26B. Given the loss of component cooling pumps and all charging pumps, a postulated small LOCA through failure of the reactor coolant pump seals was assumed in the IPPSS analysis. The Indian Point analysis states that since the auxiliary feedwater and the high pressure injection systems would not be affected by a fire in the right stack of cable trays, both of these systems could prevent core melt until approximately ten hours after the fire, when the low head recirculation system is needed. Loss of MCCs 26A and 26B would preclude repositioning the necessary valves inside containment to permit low head recirculation with the result being an SLF damage state. For both of these fire scenarios, the Indian Point fire assessment applied the fire analysis method described in Section 2.7.4 of this report. As part of our reanalysis of these fire scenarios, we examined the sensitivity of the IPPSS core melt fre-quency estimates to the type of fire damage phenomena postulated for i the fire scenarios. In particular, we considered that cabling may be damaged by a hot gas layer, instead of only by a fire plume, as assumed in the Indian Point analysis. Based on this cable failure mechanism, we indicate in Section 2.7.4 that, because of the close proximity of the left and right cable stacks in the electrical tunnel, it may be difficult to distinguish whether a hot layer of gases is generated by a fire on the left or the right or the center of the tunnel. If this is true, t h e r, the SLF damage state could not reasonably occur, but instead it should be considered included in the SE damage state in the previous sequence (Section 3.2.2). 3.2.3-1
3.2.4 Turbine Trip Due to Loss of Offsite Power: Failure of Two Diesel Generators, RCP Seal LOCA, and Failure to Recover AC Power Until After One Hour, SEFC This sequence leads to plant state SEFC. In the IPPSS, it has an estimated rate of occurrence of 3.0 (-5)/yr which makes it the dominant interna' contributor to Indian Point-2's estimated core melt frequency. Point Estimation The loss of offsite power initiating event has occurred once in six years at IP-2. By merging this information with their assumed prior dictri- bution, the authors arrive at an estimated occurrence rate (their posterior mean) of .18/yr. (Note though that Table 1.5.1-34 in the data appendix gives .20.) In either case, the IP point estimate is consistent with their data and with industry-wide experience. Following loss of offsite power (LOP), power is to be provided by three diesel generators. Buses 2A and 3A are supplied by one diesel, bus 5A by a second, and bus 6A by the third. Failure of power at buses 2A, 3A, and 5A, or 2A, 3A, and 6A is assumed to lead to a pump seal LOCA in 30 minutes and a core melt in 60 minutes. Thus, the terms in this sequence probability are the failure of either of two pairs of diesels and the failure to provide power from other sources, primarily onsite or nearby gas turbines or from recovery of offsite power. Actually, though, component cooling water is not lost as long as bus 5A has power, so we find the assumption that a pump seal LOCA follows the failure of the two diesels powering buses 2A, 3A, ant 6A to be unnecessarily conservative. We would thus reduce the esti-mated F?quence rate by a factor of two, everything else being equal. Section 1.3.2.2 of the IPPSS gives the analysis leading to Indian Point's estimated recovery probabilities. In particular, the estimated probability that power is lost to buses 2A, 3A and 5A for 60 minutes some time during the six hours following LOP is given as 8.9 -5). Losing power to buses 2A, 3A, and 6A has the same prob-ability, so the esticated sequence rate is given by .18 x 8.9(-5) x 2 = 3.2(-5), apparently within rounding error of the 3.0(-5) given in Table 8.3-9, the summary table. Reconstr:.'cting the estimated failure to recover probability is hampered by the fact that the report gives distribution plots or medians, where reans are needed for the calculations. Nevertheless, some portions of the analysis can be examined. Power is unavailable initially if two diesels fail to start or if one is out for maintenance and the other fails to start. Thus, O g =H + 2HQm* 3.2.4-1
where H denotes failure to ntart cnd Qm denotes maintenance unavailability. The following table compares the IP posterior estimates to alternative estimates based on the IP-2 data alone: I' . Posterior Data Mean (H) 1.3(-2) 9.4 (-3) (4/424) i Var (H) 4.2(-5) 2.2(-5) Mean (Qm) 3.0(-2) 2.7 (-2) Var (Qm) 5.4(-3) 3. l (-5) Qo 1.0(-3) 6.0(-4) 1 Thus the IP estimate of Qo is slightly conservative relative to the data. Note, however, that only independent failures of the two diesels are considered. If the IP (and Zion) conventional G-factor of .014 times H was added to Qo, the resulting estimate would be
- 1. 2 (-3 ) , not markedly different. Alternatively, Oak Ridge (as part of TAP A-44) has estimated the probability of simultaneous failure cf two diesels by 7.0(-4) (see Section 2.4.1.1 of this report for the diesel generator S-factor discuccion). Adding this to the maintenance term yields an estimated Qo of 1.5(-3), again not greatly different.
! (Readers of the IPPSS will not find Qo in the study. In 2 supplementary documentation provided us, a quantity denoted by 1-EPO, representing failure of power to two diesels at time zero, , was given as 1.0 (-3) . The above calculations indicate that we have i identified the dominant contributors. Page 1.3-14 of the IPPSS ( gives a value of 1.4 (-3) for the probability of power at bus 6A following LOP, and this might be thought to be equivalent to 1-EPO. It is not, though, because it actually is the probability of being in that electric power state at some time during the six hours after LOP. Addi tionally , the table of dominant sequences for event tree llb (Table 1.3.5.llb-4) is incorrect, as is its footnote for the source of the modeling of electric power recovery.) The recovery of AC power must take into account the probabilities of recovering offsite AC power, the onsite diesels, or starting any one of three gas turbines. Examples of the approximate recovery values used in the IPPSS (applies to both Units 2 and 3)
- follow
l Time After Offsite Power Loss of Recovery Recovery of DGs Recovery Offsite Probability 2 DG 3DG Failure of Gas Power of Failure (Blackout) Turbine i 30 min. .37 .25 .08 .11 60 min. .55 .35 .18 .89 q 90 min. .68 .43 .25 .99 (applies j to longer times) r 3.2.4-2
Comparison with previous assessments of recovery shows that + offsite powsr recovery values are similar to past estimates. DG recovery values appear quite optimistic when compared with past experience. The IPPSS values are based on a critical review of DG failure modes and corresponding times to repair and not on actual experience. In part, this is a valid thing to do since actual experience is based on noncritical AC loss conditions, and therefore times to DG repair were unnecessarily long. However, the optimistic DG recovery values are relatively unimportant relative to the AC recovery potential based on starting a gas turbine. Therefore, the recovery model is most dependent on the gas turbines. The scenario assumed is that first an attempt to fix and start the diesels will be made. Failing that in 15 minutes, the decision will be made to start the onsite gas turbine. Failing that, an operator will drive one-half mile to the Buchanan substa-tion and attempt to start the two gas turbines there. Families of probability distributions for the tim.e required to perform these tasks were assigned, based on reviews of the steps involved, not actual experience. The resulting degree-of-belief median for the probability of failing to obtain power from a gas turbine is .11. This value can be read from the median curve in IPPSS Figure 1.3.2.2-5. The 5th and 95th percentiles shown correspond approxi-mately to statistical confidence limits based on 20 failures in 170 trials. We doubt that the speculation that went into the IP esti-mates is " worth" this much data, but we have no basis for an alternative point estimate. The times to perform each step for reaching and subsequently starting a gas turbine appear reasonable, if not conservative (eg, 4-15 minutes to drive one-half mile assumes speeds of 2-7 mph). In addition, the failure probability of each gas turbine at ~ lE-1 also appears consistent with other failure estimates, making the gas turbine recovery factors seem quite reasonable. Failure to recover offsite power within 60 minutes is estimated to have a probability of .45 (median value). This is consistent l with previous estimates (and conservative relative to the value of l .26 we assumed in our Zion review). Failure to obtain power from
- either the gas turbines or offsite within 60 minutes is thus esti-l mated by .11(.45) = .05. This product of medians is somewhat less than the mean of the product .09 which, by multiplying this value of l (1-EPO), yields 5.0 (-5) . This value is just over one-half of the
! 60-minute power failure probability of 8.9(-5). Plausibly, using mean values and accounting for other than initial failures could make up the difference. We thus find no reason for a markedly dif-ferent estimate from what Indian Point obtained, except to repeat that the considered bus failure combination is conservative, and the estimated sequence frequency can be reduced by about a factor of two with the inclusion of the bus 5A consideration, i.e., 1.5 x 10-5, The following potential conservatism and unconservatism were identified in our review of this sequence: I 3.2.4-3
Conservatism:
- 1) A reactor coolant pump seal LOCA was assumed to occur at 30 minutes due to a loss of seal cooling (see Section 4.5) .
Unconservatism:
- 1) The fan coolers were assumed to be available to mitigate the core melt accident (see Section 4.2) .
Statisti, cal Confidence Limits To assess the impression with which the occurrence rate of this sequence can be estimated we will simplify its model as follows: A = @llb
- 00
- 060 *O GT where llb = occurrence rate of initiating event, TT/ LOP 00 = unavailability of the two diesels powering busses 2A, 3A, and 5A due to independent failures of both or failure of one diesel and maintenance unavail-ability of the other 060 = Probability that offsite power is not recovered in 60 minutes O GT = Probability that the onsite gas turbine fails All these events are assumed to be statistically independent.
This expression omits:
- Nonindependent failures of the diesels.
- Failures of the diesels after initial starting.
( - Possible dependencies among the events in the sequence. I + Recovery of failed diesels.
- Availability of two gas turbines at the Buchanian l substation.
l The extent to which these omission.1 offset each other is a matter for conjecture. It seems to us, though, that on balance the above expression is conservative. ! The data pertaining to the above parameters, and the basis for our choices are as follows: Q11b : Turbine trip due to loss of offsite power rate. The IPPSS cumulative data are 34 occurrences in 131 reactor-years. There is some evidence of plant-to-plant differences, but not enough to introduce a l serious bias, so the cumulative data will be used. l (Note: the IPPSS point estimate of .18 is not prac-i tically or statistically inconsistent with these cumulative data.) 3.2.4-4
H : Fail-to-start probability of a diesel generator. The IP-2 data are 4/424 and the IP-3 data are 2/185. These are quite consistent and will therefore be combined to yield 6/609. Om : Diesel ger.erator maintenance unavailability. The average annual diesel unavailability for the IP-2 diesels, over five years, was .027 and the squared standard error of this estimate of the average unavailability is 3.l(-5). The same estimate and standard error would be obtained if in 850 random checks of a diesel it was found that 23 times the diesel was unavailable. Thus to combine the data for Om with the data for other terms in the model, we will treat the Om data as effectively 23/853. IP-3 diesel unavailability was somewhat less than IP-2, but for conservation the IP-2 results will be used for IP-3 also. 060 : Probability that lost offsite power is not recovered within 60 minutes: 13 occurrences in 36 events from data cited in a draft Oak Ridge report (see Section 2.4.1.1). QGT : Failure-to-start probability of a gas turbine generator. The IPPSS cites 22 failures in 172 demands. QO 00 = H 2 + 2HQm, where H is the diesel fail-to-start probability and Qm is diesel maintenance unavailability. The data for H are 6/609. Annual IP-2 maintenance data leads to Om= .027, s 2 ( g ,)
= 3.l(-5). Maximus methodology leads to effective data of 3/4600 for estimating 00 Multiplying the estimates yields
- 3 A =
1j , 4600 2
= 7.8(-6)/yr.
as the maximum liklihood estimate. The effective data corresponding to this estimate, by the Maximus methodology, are two occurrences in 260,000 years which leads to an upper 95 percent statistical con-fidence limit of 2.4 (-5)/yr. and a lower 95 percent confidence limit of 1.4 (-6) /yr .
- 3. 2.4 -5
3.2.5 Hurricane, etc., Wind: Loss of All AC Power Due to High Winds, SE For hurricane winds, IPPSS release category 2RW which is omina ed by lant state SE is dominated by the Boolean expression 2 WA( 4WV W) where the symbols correspond to offsite power, the ontro bull ing (which houses the switchgear and batteries for starting the diesel generator), and the diesel generator building, respectively. Other parts of the equation are controlled by tornado missile capacities which are not possible for hurricanes. Unlike analysis presented in the IPPSS, we believe that offsite power should be considered to have failed if a hurricane occurs. Loss of offsite and onsite AC power results in a small break loss of coolant (pump seal LOCA) sequence with no injection and no containment safe-guards. Because of the steepness of the hurricane hazard curves, assuming that offsite power is unavailable, will increase the mean frequency of 2RW by a factor of at least 2. We also believe that the fragility curves may be on the unconservative side; however, due to the protection provided by adjacent structures, the implicitly assumed shape factor value of 1.0 may have resulted in overpredict-ing the control room fragility capacity for wind pressure effects. We feel that there is a great deal of uncertainty associated with the current fragility analysis. In developing the Boolean equation for 2RW, part of the probability of the stack failing and falling on the control or diesel generator buildings was omitted. The capacity of the stack is relatively high and the omission of the stack failing does not significantly effect the frequency of 2RW. In summary, we believe that the 2RW mean failure frequency value of 2.7 x 10-5 per year for hurricane effects may be low by a factor of 20 due to revised fragility for offsite power and an increase in the hurricane hazard at the site. We suggest a valve of 5.4 x 10-4 The following conservatism and unconservatisms were identified based on the IPPSS report: Conservatism:
- l. A lead warning time exists for hurricane, which could be utilized to shut down the plant.
Unconservatisms:
- 1. The fragility curves for the hurricane wind effects may be unconservative.
- 2. Negle: ting design and construction error and aging effects is unconservative.
3.2.5-1
l 3.2.6. Tornado and Missiles: Causing Loss of Offsite Power and Service Water Pumps or Control Building, SE For tornado winds, IPPSS release category 2RN which is domi-nated by plant state SE, is controlled by the same Boolean expression as discussed above for hurricanes. Other parts of the sequence equation (ie, including service water pumps and the RWST) are controlled by tornado missile capacities which are high relative to wind pressure capacities. Assuming that offsite power is not available will not change the tornado 2RW frequencies quite as much as for hurricane effects. Because the hazard curves for tornado are less steep than the hurricane curves, it is estimated that, if offsite power is unavailable, the mean value will change by a factor of less than 2. We believe that the tornado hazard curves are on the conservative side. In summary, the mean value of 1.6 x 10-5 per year is reasonable and probably conservative. The following conservatism and unconservatisms were identified based on the IPPSS report: Conservatism:
- 1. The tornado hazard curves are on the conservative side.
Unconservatisms:
- 1. Using 140 mph as the median cat.acity for offsite power is unconservative.
- 2. The fragility curves for the tornado wind effects may be unconservative.
- 3. Neglecting design and construction errors and aging effects is unconservative.
3.2.6-1
i l 3.2.7 Small LOCA: Failure of Recirculation Cooling, SLF A small LOCA is estimated to occur at an annual frequency of
.0185/yr, and the recirculation failure probability is estimated as 6.8(-4). The product, 1.3(-5), is Indian Point's estimate of the frequency of this sequence.
Point EsLimation The small LOCA frequency is estimated by first estimating the distribution of the small LOCA rate among PWRs. Though the " state-of-knowledge" and data that go into the specification of this
" prior" distribution are unchanged from that which went into the Zion analysis, a aifferent prior was chosen here. In this case (in contrast to the large LOCA discussed in Section 2.6), the IP prior was more optimistic; the prior variance was less by a factor of 30.
This, plus the fact that IP has had no small LOCAs while Zion has had one, led to the above estimate for IP-2's small LOCA frequency, which is about one-half of the Zion estimate (3.5(-2)). The PWR data alone show no appreciable evidence of plant-to-plant variation and so, if combined, would yield an estimate of 3/131 = .023. The (high-head, for small LOCA) recirculation failure probability estimate is divided about 60-40 between operator errors and hardware failures, specifically 3.9(-4) and 2.9(-4), respectively. The operator errors are l'
- 1) Failure to initiate switchover to high pressure recirculation.
- 2) Inadvertent actuation of " Switch 7" instead of " Switch 6."
In the IPPSS, the probability of the first event is determined by first estimating the failure probability of one reactor operator (RO) to initiate switchover and then suosoquently estimating the conditional probability that three other people (another RO, the watch supervisor who is a senior RO, SRO, and the shift technical advisor, STA)- f ail to detect and correct the first RO's failure. Let P denote the first RO's failure. The Indian Point's expression for the probability of failure to initiate switchover is i \ g _ p ['l+P);{1+6P; (1+6P)j HI y2 )q 7 ; y7 )' the terms in the product corresponding to RO1, RO2, SRO, and STA. For small P (as assumed by IP) , (1) (112 O HI
* # l\ 5)l '\ i)l 2 .01 P ;
9 3.2.7-1 _ _ . _ _ _ _ . - - _ _ _ _ ,_ u -_ _ ,_
~
The initial error probability is estimated (in lognormal terms) as a madian value of .006 with an error factor of 5. The condi-tional probabilities are based on the authors' impression of _ the levels of dependence among the personnel, translated into numbers using " Swain 's Handbook . " To reflect uncertainty in these esti-mates, IP's assumed error factor on Qg7 is increased to 20 and the resulting mean probability of QHI is 3.5 (-4) . As discussed in Section 2.5 of this report, the dependence level of the other oper-ators is undoubtedly greater than that expressed in the IPP33, yet at the same time, the study did not account for the recovery poten-tial activated by the RW3T low-low level annunciator. Thus, it is believed that the first of the human errors arising in recirculation failure is negligible. It should be noted that the Brookhaven reviewers felt that no credit should be given for the fourth person in the control room and that the initial. error probability should be , larger; however, they did not consider recovery. , As to the second human error involved in changing to ! recirculation cooling, the analysis presented in Section 2.5 of this report shows that this, too, is of negligible probability. Indian point's hardware failure probability estimate is dominated by their estimate of nonindependent failures of any of four pairs of MOVs or three safety injection pumps. These estimates are based on their standard B-factor of 0.014. Given this assump-tion, their estimates are reasonably consistent with the available data. As discussed in Section 2.4.1.7, however, a better estimate of the G-factor for the dependence of the three pumps is ~.1. If this is used, the hardware contribution to high-head recirculation failure increases to 1.2 (-3) from 2.9(-4). Thus, in conclusion, it is felt by the reviewers that a better point estimate of the frequency of this sequence is 2.2(-5)/yr, instead of the 1.3(-5)/yr value reported in the IPPSS. The following potential conservatism and unconservatism were identified in our review of this sequence: Conservatism
- 1. The 6 factor used to calculate failure of the pumps is probably conservative since it does not
)
l consider operator recovery actions.
- 2. Depressurization of the reactor coolant system and I
core cooling via RHR were not considered. Unco _nse r va tism
- 1. The fan coolers were assumed to be available to mitigate the core melt accident (see Secton 4.2) .
3.2.7-2 m m m
Statistical Confidence Limits The model for this sequence is A=43 QR-2, where $3 is the small LOCA rate and QR-2 denotes the failure probability of the r ecirculation system. This failure occurs if three safety injection pumps fail or if any of four pairs of MOVs fail. The possibility of nonindependent failures makes these the dominating events. Of these, the triple pump failure seems the more plausible, because pumps have a higher probability of failure and their failures are less likely to be recoverable, so, for the purpose of calculating confidence limits, QR-2 will be approxi-mated by the probability of three pump failures. Estimating the probability was done as follows. Assume that when pump tests are done that if it fails, the other redundant pump is immediately tested. Thus, in either case, each test amounts to a test of the event: both pumps fail. The nine IP pump failures listed in the IPPSS show no occurrences of redundant pump failures at essentially the same time, so the data taken to pertain to duel failures will be 0/1593 demands. This assumption can be further supported from results in EGG-EA-5289, by Atwood. There the rate of occurrence of the failure of two pumps, r2, is estimated as 7.9(-7)/hr, and lower and upper (approximate) 95 percent confidence limits are given. If monthly testing is assumed, the failure probability, of two pumps, is approximately (30 x 24/2)r2 = 360r2 Transforming the point estimate of 360r2 = 2.8 (-4) and the upper beund of 4.7(-4) to effective l binominal data yields effective data of 11 occurrences in 39,000 demands. Upper 50 and 95 percent confidence limits based on these data are 3.0(-4) and 4.7(-4). The IP data, 0/1593, lead to corres-ponding limits of 4.4 (-4) and 1.9 (-3) . The two sets of " data" are quite consistent. The IP assumed data are slightly more conserva-tive, and more directly applicable to that particular plant, and so will be used in our analysis. The preceeding discussion pertains to two pumps. For three we make the conservative assumption that the conditional probability the third pump fails, given that the first two have, is 1.0. Thus the same data, 0/1593, will be used for this event and hence for QR The datc pertaining to 4 3, from the PWR data listed in the IPPSS a;e three occurrences in 131 reactor-years. Combining these with the QR-2 data by the Maximus methodology leads to estimating the sequence occurrence rate from effective data of zero occurrences in 52,000 years. This yields an upper 95 percent confidence limit of A95 = 5.8(-5)/yr. Because the effective number of occurrences of this sequence is zero, the data alone do not rule out the possi-bility that the true occurrence rate is zero, so the lower 95 percent confidence limit on A is zero. 3.2.7-3
~ n a
l 3.2.8 Large LOCA: Failure of Recirculation Cooling, ALF Point Estimation A large LOCA is estimated (see Section 2.6 of this report) to occur at a rate of 1.95(-3)/yr and low pressure recirculation fail-ure probability is estimated as 5. 4 (-3) , thus leading to an estimated sequence rate of 1.l(-5)/yr. The determined dominant source of recirculation failure is failure to initiate switchover (over 97 percent of the failure probability). Relative to a small LOCA (see 3.2.7, above), the operators have less time to initiate switchover and are under higher stress. In Section 2.5.4 of this report, the IPPSS modeling of failing to correctly initiate switchover after a large LOCA was reviewed in detail. It was concluded there that the IPPSS under-estimated the "8 switch sequence error" by a factor of 30. We therefore feel a better estimate of failing to correctly initiate switchover is .02. Thus, a better estimate of the frequency of this sequence is 3.9(-5)/yr instead of the 1.l(-5)/yr estimate given in the IPPSS. The following potential conservatisms and unconservatism were identified in our review of this sequence: Conservatisms
- 1. The switchover human error probability of .02 is estimated to be close to an upper bound.
- 2. The 11 factor used to calculate failure of the pumps is probably conservative since it does not consider operator recovery actions.
- 3. The large LOCA initiating event frequency is conservative relative to what has been used in other PRAs.
Unconservatism
- 1. The fan coolers were assumed to be available to mitigate the core melt accident (see Section 4.2) .
Confidence Limits This sequence is dominated by the "8 switch sequence error," so the model is essentially A = d l QH e where 6 1 is the occurrence rate of large LOCAs and Qg is the human error. The Sandia revised model for QH is 1+6P O H =P (1+P 2/ \7 / 3.2.8-1
~ _~____________-_____-
from Section 2.5.4 of the Sandia review. The nominal value of p is j
.1 and Swain's handbook suggests five as an error factor. Thus, l
OH, upper = .5 (1.5/2) (4/7) 2
= .12 and !
OH, nominal = .003 In order to combine this with the data pertaining to 6 1 we will treat this bound as an upper 95 percent statistical confidence limit based on zero occurrences in n demands. Thus, n is the solution of (.88)"= .05, namely n = 23. We chose the numerator of zero because the nominal value of QH is nearly zero. That is, 1/40 would yield about the same upper 95 percent confidence limit,-but is fairly inconsistent with the nominal Og of .003, as well as being a more presumptuous rendering of the information available. ! For 6 1, the IPPSS lists zero occurrences in 131 reactor-years. The posterior 95th percentile on 41 that emerges from their two-stage Bayesian analysis is equal to a statistical 95% upper con-fidence limit based on zero occurrences in 475 reactor-years. Deciding what experience is appropriate for estimating the large LOCA rate at Indian Point is, ultimately, a matter of judgment. Since no large LOCAs have occurred at any plaat, there are no data-based reasons not to pool all reactor experience. World-wide, this totals over 2,000 reactor-years. The PWR total is about 650 reactor-years, and the Westinghouse total is about 350 reactor-years. The effective IPPSS data fall midway between these latter totals and seems to us to be a plausible result. We will just round it off and so assess 6 1 on the basis of zero occurrences in 500 reactor-years. Combining the d i data and the QH pseudo-data yields an assessment of the sequence rate based on 0/12,000 years: A L95 = 0 AU95 = 2.5(-4)/yr The subscripts denote whether the limit is a lower or upper 95% statistical confidence limit. 3.2.8-2 1 1
- - ~
3.2.9 Medium LOCA: Failure of Recirculation Cooling, ALF The analysis of this sequence is identical to that for a large LOCA (Section 3.2.8) . I 3.2.9-1 l
3.2.10 Turbine Trip Due to LOP: Loss of All AC Power, RCP Seal LOCA, Failure to Recover External AC Power Until After One Hour, SEFC Point Estimation This sequence differs from that discussed in Section 3.2.4 in that power is lost to all buses. This can happen if all three diesels fail or if one or two diesels start, but service water fails, thus failing all the diesels. In supplementary niaterial provided Sandia, the estimate in IPPSS of initial loss of all AC power is 4.0 (-4) and the 60-minute failure-to-recover probability is estimated as .08, thus yielding .18 x 3.2(-5) = 5.8(-6)/yr as the authors' estimated sequence rate. (Note: Table 8.3-9 gives 6.5(-6).) Consider the case of triple diesel failure to start. The approximate model is Qg =H3 + 3H O m* The mean value of Qo (based on the information in Tables 1.5.2.2.1-10L and -100) is 2.l(-5), so triple diesel failure is a minor contributor to this sequence relative to the various combina-tions of diesel and service water failure. Nonindependent failures are considered to be negligible. Even if the TAP A-44 estimate for the simultaneous failure of three diesels, namely 3.0(-4), is added in, the sequence estimate is not markedly changed. The diesel generator / service water interactions were examined, and with the use of the IPPSS assumption and methods, the failure probability of 4.0(-4) given above for the initial loss of all AC power was confirmed. There were two problems identified with the analysis presented in IPPSS, however. First, the service water values used for the interaction were for the entire system, both the nuclear and conventional headers, whereas the diesel generators receive cooling from only the nuclear header. This conservatism is slight, though, because the conventional header failure probability is generally small with respect to the nuclear header. The secorJ problem was the use of the nuclear header success 4 criterion for this sequenca. Although the IPPSS description states that for the cooling of all three diesel generators, only one nuclear header pump is necessary, the actual criterion used was the same as for other sequences, ie, that two nuclear header pumps were necessary. This discrepancy surfaced in discussion with the analysts. Subsequently, data have been supplied for the one pump
- criterion which indicate that the 4.0(-4) probability shod 1d be 1.7(-4) instead. (It must be noted that although the dierel gener-ator dependency on nuclear header service water was initially incor-rectly used, the electric power dependency of the nuclear header a
service water was correctly arplyzed.) 3.2.10-1
l I For other sequence considerations, the nonrecovery factor of 0.08 isbe); should consistent with that there so our comments discussed apply in here.our Section 3.2.4 (as it ! Overall, with the service water success criterior. relaxed for this sequence, the sequence f requency becomes 2.4 (-6) /yr . The following potential conservatism and anconservatism were identified in 9ur review of this sequence: . Conservatism
- 1. A reactor coolant pump seal LOCA was assumed to occur at 30 minutes due to a loss of seal cooling (sce Section 4.5) .
, Unconservatism
- 1. The fan coolers were assumed to be available to mitigate the core melt accident (see Section 4.2) .
Statistical Confidence Limits As indicated, several combinations of diesel failures and service water failures can lead to the loss of all AC. power. In examining these combinations it became apparent that the driving denominator in estimating the probability of loss of all AC power is 1593, corresponding to the multiple pump failure data of G/1593. The IPPSS estimate of the loss-of-power probability, given above, is 4.0(-4), which we accept. This estimate corresponds to data of
.6/1593. Thus, for the purpose of calculating confidence limits, these data will be used to assess 00, the probability that all .5C i power is lost, given the occurrence of lass of offsite power.
The sequence model is thus
/
A= d ilb *00 060 . Or, where the righ t-hand terms, besides Q0, are defined in Section 3.2.4. The resulting efffective data for estimating are .5 occurrences in 1.l(5) yr., leading to A L9 5 = 1. 8 (-8 ) /yr . A U95 = 3.6(-5)/yr. 3.2.10-2
l 3.2.11 La rge LOC A: Failure of Low Pressure Safety Injection, AEFC Point Estimation This sequence leads to plant state AEFC. The estimated probability of the failure of low pressure safety injection, labeled LP-1, is 2.8(-3), which when multiplied by Indian Point's estimate of the large LOCA rate (1. 9 5 (-3 ) /yr ) , yields an estimated sequence rate of 5.4 (-6)/yr. The IPPSS states that the source of the LP-1 estimate is given in IPPSS Section 1.3.3, which is a section that gives various sup-porting analyses. However, we could not find LP-1 in tnat Section. In Section 1.3.4.1.2, which discusses the large LOCA event tree, LP-1 is defined as failure of either the low pressure injection or accumulator system. The analyses for these two systems in Section 1.5 give estimated failure probabilities of B.7 (-4) for low pressuto injection and 1.9(-3) for the accumulators, which, when summed, yield the LP-1 estimate of 2.8(-3). An examination of the bases of this estimate, and supporting data from Zion as well as Indian Point, provides no reason to choose markedly different estimates, although further analysis can yield some change. The IPPSS does not give a variance or any percentile associated with the authors' state of knowledge distribution for LP-1. The variance, though, can be derived from the information given. The accumulators fail if any of six check valves or three MOVs fail. The former are treated as demand-dependent and the latter are time-dependent with a half-test interval of 9 months = 6570 hours. Thus, O ACC =6PCV + 3 (6570)A MOV ' denotes the check valve failure probability, on demand, where PCV and Agoy denotes the hourly failure rate of MOVs. The single failure and dominating term in the failure of low pressure injection are two check valve failures, two MOV failures, and one manual valve failure. Two of these valves are tested monthly, the other at 18 montns, and manual and motor-operated valves are assumed to have the same failure rate. Thus, O LP-1= 2PCV + 7290 AMOV
- Adding yields O LP-1
- PCV + '
^MOV
- IP's posterior mean and variance for the two right-hand parameters are:
i 3.2.11-1
Mean variance PCV 7.0 (-5) 1.1(-8) AMOV 7. 4 (-8) 5. 9 (-15) Thus, the variance of Onp_1 is (at least, since some failure modes have been omitted) var Q p_1 = 64 x 1.l(-8) + (27,000)2 x 5.9(-15)
= 5.0(-6)
The mean value of QLp_1, considering just single failures, is 2.6 (-3) ; so, using the methodology of Section 2.6, IP's estimate of LP-1 corresponds to effective data of 1.4 failures in 520 demands. If just the data from Indian Point 2 are considered, there have been no failures of either type, and the component data can be reduced to effective data for LP-1 of 0/180. The addition of IP-3 and Zion data (also no failures) leads to effective LP-1 data of 0/770. Hence, " adding in" IP's prior distribution has a more con-servative effect than adding in consistent experience from two other units. Based on these considerations, we find no cause for an appreciably different estimate than that given by the IPPSS for the valve failures. The last comment concerns possible. dependencies between the two LP pumps. IPPSS uses their general 0-factor of 0.014. As presented in Section 2.4.1.5 of this report, a 3-factor of 0.16 is deemed to be more appropriate. If this value is used, the failure probability of low pressure injection becomes 1.5 (-3) . Hence, with the use of this B-factor, a better estimate of the frequencr for this sequence is 6.2(-6)/yr, an overall increase of just 11 percent. The following potential conservatisms and unconservatism were identified in our review of this sequence: Conservatisms
- 1. The D factor used to calculate failure of the pumps is probably conservative since it does not consider operator recovery actions.
- 2. The large LOCa initiating event frequency is conservative relative to what has been used in other PRAs.
,Unconservatism
- 1. The fan coolers were assumed to be available to mitigate the core melt accident (see Section 4.2) .
3.2.11-2
Statistical Confidence Limits The Sandia-revised model for this sequence is A = 41*QLP where 61
= large LOCA rate OLP
= 8PCV + 27,000 AMOV, + Odoubles
= check valve failure probability PCV AMOV = MOV hourly failure rate, transfer closed Odoubles = failure probability of two MOVs or two pumps.
The data pertaining to these parameters, and the basis for their selection, are as follows: 41 : 0/500, discussed in Section 3.2.8 AMOV : Thcre have been no reported occurrences of this event at either IP-unit, which could reflect either a low occurrence rate or low exposure time. If just IP data are used, these failures can dominate the estimates in cases where other failures, such as pumps, seem more plausible. Thus it was decided to use the valve data from NUREG/CR-1363. Those data, across all plants, show seven occurrences of inadvertently closed (plugged) valves (two of wnich caused two valves to fail simultaneously) in 70 million hours. PCV : Again, no occurrences of this event at IP led to a consideration of NUREG/CR-1363. There, the data are one occurrence in 26,680 demands (not counting two check valves installed backwards--a failure mode presumably eliminated by now at IP). Odoubles: 0/1593, for double pump failure, as discussed in Section 3.2.7. Combining the data pertaining to QLp yields an assessment based on effective data of 4.8/1593 and combining these with the 0/500 data pertaining to di leads to an assessment of the sequence rate on effective data of 0/145,000 yrs.: A U9 5 = 2. l (-5) /yr . A L95 = 0 3.2.11-3
l Turbine Trip Due to LOP: Failure of Two Diesel Generators, 3.2.12 RCP Seal LOCA, Failure to Recover AC Power (Within Three Hours), SEC Point Estimate This sequence differs from that discussed in our Section 3.2.4 only in that recovery is not until after three hours rather than one. It leads to plant state SEC, rather than SEFC. The assumed AC recovery distributions lead to a three-hour f ailure of AC power probability of 1.4 (-5) , which is about 1/7 the estimated one-hour value of 8.9 (-5) . Such a ratio seems plausible when compared with the recovery potential difference in the gas turbines from one to three hours (see recovery probability table presented in Section 3.2.4). Since the greatest recovery change is in the gas turbines, which improves by a factor of ~ 10, a sequence f requency reduction f actor of *- 10 compares favorably with the factor of 7 just mentioned above. The following potential conservatism was identified in our review of this sequence:
- 1) A reactor coolant pump seal LOCA was assumed to occur at 30 minutes due to a loss of seal cooling (see Section 4.5) .
Also, as discussed in Section 3.2.4, the authors assumed there are two pairs of diesel failures that could lead to this core Thus, we melt sequence, while we conclude that only one pair does so. would halve this sequence estimate. Statictical Confidence Limits For the purpose of measuring the statistical imprecision with which the occurrence rate of this sequence can be estimated, the following simplified model will be assumed. A=611b
- 00
- Q180
- QGT2, where 11bs 00, and QGT are defined in the discussion of 3.2.4, and Q180 denotes failure to recover offsite power within three hours. The difference between this sequence model and that of 3.2.4 is the offsite power recovery time and the failure of a second gas turbine. Since three gas turbines are available, the assumption of two independent failures should be conservative. t The data pertaining to 6 11b, 00, and QGT are given in 3.2.4. For Ql80 the draft Oak Ridge report lists 5 occurrences in 36 demands. Applying Maximus methodology to QGT 2 leads to effec-tive data of 6/368. Combining this data for the sequence leads to estimating A with effective data of 1.2 failures in 3.0 (6) years.
The resulting lower and upper 95 percent confidence limits are A L95 = 3.4 (-8) /yr . A U9 5 = 1.7 (-6) yr. 3.2.12-1
l 3.2.13 Small LOCA: Failure of High Pressure Injection, SEFC This sequence results in plant state SEFC. The small LOCA rate is estimated as .0185/yr (see Section 3.2.7). High pressure injection fails if any of the three suction valves from the RWST fails or if two (of two) safety injection pump trains fail. The esticcated probability of system failure is 1.9(-4), two-thirds of which comen from the RWST single valve failures, the remainder from dual failures in the pump trains. The valve failure probability estimates are consistent with the available data (no such failure at Zion or Indian Point) . Common ~ cause failures are not considered by IP (apparently an oversight because for the same equipment following a medium LOCA, a B-factor of .014 was assumed). By including this G-factor, Indian Point's system failure estimate would increase to 2.8(-4). Brookhaven's reviewers argue that accounting for common cause failures and estiraating pump f ailure probability less op>.imistically (IP's prior is considered more optimistic than the plant specific data, apparently because different failure modes were considered) indicate a system f ailure probability of 1.5 (-3) , which is a factor of eight times the IP estimate. As presented in Section 2.4.1.4., a more appropriate B-factor is
-w .l. That is, as discussed in that section, the IPPSS 8-factor was subjectively chosen whereas the value used in this review is taken from a study of industry common mode pump failures. When the g-factor of 0.1 is combined with the rest of the IPPSS data for high the system failure probability becomes 9.2(-4).
pressure injection e This then would result in a sequence f requency of 1.7 (-5) , an increase by a factor of about 5. The following potential conservatism and unconservatism were identified in our review of this sequence: Conservatism
- 1. The $ factor used to calculate failure of the pumps is probably conservative since it does not consider operator recovery actions.
Unconse rva t i sm
- 1. Thc fan coolers were assumed to be available to mitigate the core melt accident (see Section 4.2).
Statistical Confidence Limits To estimate the occurrence rate of this sequence, it will be modeled as follows: 3.2.13-1
A = 43 Q, where qb3 = small LOCA rate Q = Pcy + 720A goy + Odoubles. Second order terms, including those for test and maintenance, have been omitted. The data discussed previously, pertaining to the parameters are: gb3 : 3 occurrences, 131 reactor-years PCV : 1 failure, 26,680 demands A MOV : 7 failures, 7(7) hours Qdoubles: One pump train consists of a pump and three MOVs, two of which are tested monthly, and one is (assumed to be) tested at 18 month intervals, plus a check valve. Thus, for a pump train, Q = 7290 A MOV + PCV + Opump Estimating Q, squaring the estimate, then adding in the estimated probability of nonindependent pump failures, leads to an assessment of Odoubles based on effective data of .07/1593. Adding the single failures to Odoubles leads to effective Q-data of
.24/1593 and combining these with the small LOCA data leads to effec-tive sequence data of .2/5. 8 (4 ) yrs. These yield the following lower and upper 95 percent statistical confidence limits:
A L95ev 1.0(-8)/yr. A U95 = 5.8(-5)/yr. 1 1 l l J 3.2.13-2
3.2.14 Turbine Trip Due to LOP: Losc of All AC Power, RCP Seal LOCA, Failure to Recover AC Power (Within Three Hours), SE Point Estimation This sequence leads to plant damage state SE, and has an estimated rate of occurrence of 1.0 (-6)/yr. This sequence differs from that discussed in Section 3.2.10 only in that recovery of AC power is after three hours, rather than cne. As discussed in Section 3.2.12, the probability of no recovery for three hours is estimated to be about one-seventh that for one ho 2r, which seems plausibic, based on changing the gas turbine recovery estimates from one to three hours. Because of the corrected service water criterion presented in Section 3.2.12, the frequency of this sequence should decrease by about a factor af two, ie, 5x10-7 The following potential conservatism was identified in our review of this sequence:
- 1. A reactor coolant pump seal LOCA was assumed to occur at 30 minutes due to a loss of sea' aling (see Section 4.5).
Statistical Confidence Limits The simplified sequence model on which confidence limits will be based is 2 A = hllb
- 0o
- 0180 . QGT ,
where the right-hand terms have been defined, and their associated data are given, in Sections 3.2.4, 3.2.10, and 3.2.12. The result-ing effective sequence data are .4 occurrences in 1.8 (6) yrs. which leads to A L95 a- 1.0 (-9) /yr . A U95 = 2.l(-6)/yr. l l ! 3.2.14-1
l 3.2.15 Event V: The Interfacing Systems LOCA, V The internal event which dominates risks, in terms of early j fatalities, according to the Indian Point estimates, is the inter-t facing systems LOCA--a LOCA that bypasses containment. The dominant V sequence is the joint failure of two_ motor-operated valves in the
, RHR suction path. A description of this event and the resulting 4
estimates are given on pages 1.3-241,242 for IP-2 and 1.3-448,446 for ' IP-3. Conversations with the authors indiaate that this description
; and tne calculation which accompanies it are " inoperative."
The real situation is apparently this: After a refueling outage j ' both valves are supposed to be closed. One valve may not be because of an undetected failure when the valve is demanded closed, but at least one valve must be closed in order to have a successful startup. In the subsequent (assumed) 18 months between refuelings, Event V can happen if one valve was not closed at startup and the other ruptures or if both valves were closed, but then the upstream, followed by the downstream, valve ruptures. At our request, IPPSS 1 personnel performed a revised analysis. We reviewed their analysis and based on the information presented, found it appropriate. The revised IPPSS model is P(V) = [1-e- T(1+AT)) + 2P(1-e' )
= ( A T) /2 + 2 PAT where P = probability of valve failure to close on demand in an unf*tected manner A = valve rupture failure rate (hr-1)
T = time between refuelings (hr) (assumed to be 13,740 ) hrs = 18 mos.) l In the analysis that appears in the IPPSS the prior distribution for A was obtained directly from NASH-1400 and not modified by IP-data, in contrast with the usual IPPSS methodology of stretching out the WASH-1400 5/95 bounds to become the IPPSS 20/80 bounds, then incorporating plant-specific data. The 5/95 versus 20/80 choice affects the results considerably, so, at our request, a reanalysis was done using industry-wide data. This led to the following posterior results for A: mean = 1.2 (-8) median = 2.2(-9) 5% = 1.l(-10) 95% = 4.4(-8) This ninety-fifth percentile effectively corresponds to data of zero l occurrences in 6. 8 (7) hrs., which is quite consistent with the data we identify below. 3.2.15-1
5 The parameter P is the probability of an undetectable valve failure and it was also estimated from industry-wide data (discussed below) and led to posterior means of 5.8 (-5) for IP-2 and 3.8 (-5) for IP-3. ?.pproximating the posterior distribution of P(V) by the DPD arithmetic yields the following: IP2 P(V) = 3.4 x 10-7 mean 3.4 x 10-9 median 3.1 x 10-11 variance 3.1 x 10-11 5 percent 6.1 x 10-7 95 percent IP3 P(V) = 4.6 x 10-7 mean 2.2 x 10-9 median 4 x 10-11 variance 2.4 x 10-11 5 percent 6.5 x 10-7 95 percent The mean values are dominated by the first term in the model which represents the rupture of both valves. The revised means are not significantly different from the means appearing in the IPPSS. The IPPSS distributions, however, are conservative with respect to the revised distributions. The above expression for P(V) is for the probability that event V occurs during an 18 month period. Under the model used, the occurrence rate of V is not constant. However, to obtain an effec-tive annual rate of occurrence for event V, and thus obtain a figure comparable to the other accident sequence rate estimates, the above Including this factor leads to valuescanbemultipliedby2f3. estimates for Ay of 2.3 x 10 /yr. , for IP-2, and 3.1 x 10-7/yr. for IP-3. However, as we next show by calculating confidence limits, these estimates are fairly pessimistic, relative to the data and under the assumed model, and the reason is, as discussed in our Section 2.6.7, the positive bias of the posterior mean. We thus I l take as our working value for event V, the upper 95% statistical confidence limit of 2.l(-7)/yr., for both IP-2 and IP-3. i Statistical Confidence Limits The first term in the above expression for P(V) corresponds to sequential rupture of the two valves, the second pertains to the failure of one valve to close and the rupture of the other. IP pro-cedures limit the possible valve failures to those that are unde-tectable, which means those in which there is a wrong indication of stem position. Supplementary data obtained by IP indicated that of 781 valve failures (industry-wide), 19 vere of this type. The IP data for valve failures, combined over the two units, are 3/1505. Thus, Qy will be estimated by (3/1505) x (19/781). 3.2.15-2
NUREG/CR-1363 lists a total No of known 7.0 (7)valve hrs. ruptures of valve have occurred.A exposure, so will be estimated based on data of 0/7.0(7) hrs. Applying the Maximus methodology leads to an assessment of V based on effective data of zero occurrences in 9.3 (6) demands. Here a " demand" equals 18 months of operation. That is, as discussed above, y is the probability of event V occur-i ring some time during the 18 months following refueling. The annual occurrence rate of V, by the usual approximation, would thus be two-thirds of V. These considerations lead to the following sta-i tistical confidence limits for the occurrence rate of event V: AL95 = 0 A U9 5 = 2. l (-7) /yr . i i l 3.2.15-3
3.2.16 Seismic: Direct Containment (Backfill) Failure, Z-lO The sequence leading te damage state Z consists entirely of failure of the containment building shear wall. Because of the relatively high capacity for this failure mode (ie, median value equal to 1.1g) the mean frequency of failure is only 6.8 x 10-7 per year. The frequency of Z is sensitive to the upper-bound cutoff on the hazard curves. Because we feel that the D&M and WCC mean hazard curves should be weighted 80% and 20 %, respectively, the frequency of Z is a factor of 1.6 low. The reason that the fre-quency of Z is higher for Unit 2 compared to Unit 3 is due to the large soil loading on the Unit 2 containment building. The median capacity of 1.lg for the containment building failure mode appears to be conservative. l l 3.2.16-1
i 3.3 Indian Point 3 Dominant Accident Sequence Review 3.3.1 Small LOCA: Failure of High Pressure Recirculation, SLF Point Estimation By IPPSS estimates, this sequence is the most likely cause of core melt at 19-3. A small LOCA is estimated to occur at a rate of
.020/yr, and the estimated recirculation failure probability is
- 4. l (-3) , thus yielding an estimated sequence rate of 8.2 (-5)/yr. By way of contrast, for IP-2 the estimated recirculation failure prob-ability was 6.8(-4), thus yielding a sequence rate of 1.3 (-5)/yr.
The systems (in the two units) appear similarly designed, and the data are consistent, so this much of a difference seems surprising. l In fact, it is an artifact due to an over-analysis of the data. The source of the dif ference between the IP-2 and IP-3 estimates is the experience of the safety injection pumps. IP-2 shows zero failures to operate in 84 hours; IP-3 shows 1/40 hours. When this fairly meager experience is merged with the assumed prior distribu-tion (which has a mean of 2.0 (-5)/hr) , the corresponding posterior means are 1.6(-5)/hr and 1.8(-3)/hr, two orders of magnitude apart. Thus, an independent triple failure to run 24 hours is the dominant estimated failure for IP-3, negligible for IP-2. If it were argued in the IPPSS that the SI pumps were markedly different in, say, manufacturer or operating procedures between the two units, one might accept different estimates. In fact, one might claim the IP-3 result is an underestimate because of the effect of the very optimistic prior. Without that argument, there is little reason to assume different failure rates for SI pumps at the two units and one would be led to combine the data, thus estimating the failure rate from data of 1/124 hours. When combined with IP's prior, the result would be sequence estimates for both units in the neighborhood of the IP-3 estimate. On the other hand, the IP-3 failure that was counted is based on a quite conservative interpretation of the LER. The pump did not fail, but was repaired because of degraded performance. Thus, we would discount this failure and accept the IP-2 estimated sequence rate of 1.5 (-5) as the starting point for further examination. As presented in Section 3.2.7, the operator errors considered by IPPSS have been evaluated to be negligible. Thus, with the use of the adjusted system hardware failure given in Section 3.2.7, we conclude that the frequency of this sequence is approximately 2.2(-5)/yr. The same accident sequence conservatisms and unconservatisms identified for IP-2 in Section 3.2.7 apply to IP-3. Statisti cal Confidence Limits The same limits obtained for this sequence at IP-2 (Section 3.2.7) apply here: A U95 = 5. 8 (-5) A L95 = 0 3.3.1-1
3.3.2 Fires Involving Switchgear Room or Cable Spreading Room, SE This accident sequence which contributes to plant damage state SE combines separate estimates for the following two different fire scenarios: IPPSS Mean Core Melt Frequency Switchgear Room 7.2 x 10-5 Cable Spreading Room 2.4 x 10-5 (Tunnel Entrance) 9.6 x 10-5 A fire that severely damages either of these critical fire areas can affect the power cables for the charging pumps, the containment spray pumps, the component cooling pumps, the safety injection pumps, and all five containment fan coolers. Given the loss of component cooling pumps and all charging pumps, a postulated small LOCA through failure of the reactor coolant pump seals was assumed in the IPPSS analysis. For each of these fire scenarios, the Indian Point fire assessment applied the fire analys.is method described in Section 2.7.4 of this report. As part of our reanalysis of these fire scenarios, we examined the sensitivity of the IPPSS core melt fre-quency estimates to the type of fire damage phenomena postulated for the fire scenarios. In particular, we considered that cabling may be damaged by a hot gas layer, instead of by a fire plume, as assumed in the Indian Point analysis. Based on the limited reanalysis which we performed given the time and information available, we show in Section 2.7.4 that, when a hot layer failure mechanism is considered, the mean core melt frequency for this sequence may be as much as a factor of 3.6 higher than the value estimated in the IPPSS, ie, 3.5 x 10-4 However, if consideration is given to the proposed plant modifications discussed in Section 2.7.4 for Indian Point, Unit 3, then the estimated mean core melt frequency for this sequence decreases from 3.5 x 10-4 to 1.9 x 10-5, The same accident sequence conservatisms and unconservatisms identified for the IP-2 fire sequences in Section 3.2.2 also apply to IP-3. 3.3.2-1
3.3.3 Large LOCA: Failure of Low Prescure Recirculation Cooling, ALF IP's estimate and analysis for this sequence are negligibly different from that for Unit 2 (see Section 3.2.8) . t I i t t I l 3.3.3-1
9 .i
.3.3.4 Medium LOCA: Failure of Low Pressure Recirculation Cooling, ALF No difference from IP-2 (Sections 3.2.8 and 3.2.9), and the same frequency presented above in Section 3.3.3 applies.
J l 1 i j t 1 l l 3.3.4-1 a e____. _ _ _._ x - -_
3.3.5 Large LOCA: Failure of Safety Injection, AEFC/8B The system model for IP-3 is virtually the same as for IP-2 (see Section 3.2.11). Negligible differences in the plant specific data plus different assumptions about common cause failures yield slightly different sequence estinates: 6.4(-6) for IP-3, 5.4 (-6) for IP-2. The analysis presented in S2ction 2.4.2.5 shows that the i LPI failure probability for IP-3 is closer to 1.2(-3) instead of the ! reported 8.l(-4) value. With this change, the estimated sequence failure probability becomes 5.8 (-6) . Statistical confidence limits are the same as obtained for IP-2 (Section 3.2.11) : AU95 = 2.1(-5)/yr. AL95 = 0 The same accident sequence conservatisms and unconservatisms identified for IP-2 in Section 3.2.7 apply for IP-3. l l l 3.3.5-1 n n__ - . n
3.3.6 Small LOCA: Failure of Safety Injection, SEFC Point Estimation Indian Point's model for IP-3 differs from that for IP-2 (Section 3.2.13) only in that where one MOV in an SI pump train was assumed to be tested every 18 months at IP-2, monthly testing is assumed for IP-3. Also, the plant specific data on pump fail-to-start probability indicates a possible difference between units: At IP-2, there have been seven failures in 793 demands; the IP-3 data are 2/800. The cumulative effect of these two differences (and other more minor ones) is that the sequence estimate for IP-3 is 2.8 (-6) versus 3.5(-6) for IP-2. The analysis presented in Section 2.4.2.4 shows that a better failure probability estimate of the safety injection system is 3(-4) instead of the 1.3(-4) presented in IPPSS. The difference is attributable to the fact that in the IPPSS three single failures contribute essentially all of the HP injection system failure probability as the system is analyzed. They are check valve 847, motor-operated valve 1810, and manual valve 846 which are all in the common pump suction line from the RWST. The analysis presented in Section 2.4.2.4 of this report suggests that, in fact, the failure of any of these valves is not the dominant contributor to system unavailability. Rather, common cause failure of all three pumps failing to start and run dominates. With the addition of this pump failure mechanism, the sequence frequency is recalculated to be 6 (-6)/yr. The same accident sequence conservatisms and unconservatisms identified for IP-2 in Section 3.2.13 apply to IP-3. Statistical Confidence Limits The same limits that were obtained for this sequence at IP-2 (Section 3.2.13) apply to IP-3: A U95 = 5.8(-5)/yr., AL95 = 1(-8)/yr. t 3.3.6-1 m m n
Turbine Trip Due to LOP: Loss of All AC, RCP Seal LOCA, 3.3.7 Failure to Recover AC Power Until After One Hour, SEFC Po s.. s !stimation This sequence leads to damage state SEFC. The model is virtually the same as that for the same sequence at Indian Point-2 (see our Section 3.2.10), but the estimated rate of occurrence is lower: 2.7 (-6) /yr versus 6.5 (-6) /yr . This difference can be traced primarily to different estimates of service water systems failure probability (recall that various combinations ofThe diesel failures service and water service water failure lead to loss of all AC). estimates differ primarily because the estimated probability of failure of a pump to start on demand differ. The IP-2 pump failure data are 7 failures in 753 demands; the IP-3 data are 2/800. When these were merged with the same opti-mistic orior distribution (optimistic because the prior excluded command faults, the plant specific data included them), the pos-terior means were 6.4(-3) and 1.4 (-3) . Under binomial distribution assumptions, the apparent difference between pumps at the two units In this case, the number of demands could easily be due to chance. are estimates and the data have been pooled across various types The of pumps, so it is-reasonable to combine the data across units. result is an estimated failure probability of 9/159 3 = 5. 6 (-3) , not greatly different from the IP-2 posterior mean. We would thus con-clude that the IP-2 estimated sequence rate of 6.5(-6) should also apply to IP-3. In addition, if the same diesel generator / service water interaction is used as in Section 3.2.10, the hardware failure con-tribution to this sequence becomes 1.5 (-4) which is not appreciably different than frequency that of IP-2. Thus, we conclude that this sequence should have a on the order of that of the recomputed IP-2 one, namely 2.4 (-6) /yr . The same accident sequence conservatisms and unconservatisms identified for IP-2 in Section 3.2.10 apply to IP-3. Statistical Confidence Limits The same limits that were obtained for this sequence at IP-2 (Section 3.2.10) apply to IP-3: l I AU95 = 3.6(-5)/yr. A L95 = 1. 8 (-8) /y r . l l l l 3.3.7-1
3.3.8 Seismic
Loss of Control or AC Power, SE/2RW The Boolean expression for seismic release category 2RW which is dominated by plant state SE given on IPPSS report page 7.2-20 was checked and could not be verified. The expression that we obtained follows: 2RW = V hV hV ( hV h )A hV h ( V hV h ) Aff( h V h) ( h ^ ( h V 0.05 ^ h )) hV hV f( (h V h )A hV h) )f V ( Our understanding is that the IPPSS used the following upper bound expression in the actual calculation.
^ V V ^ ( V ) V 2RW < (
(h V (h V ()) We agree that this equation is a reasonable approximation; however, it is not strictly an upper bound. An integration using the 11 hazard curves from IPPSS report Sections 7.9.1 and 7.9.2 with the 5 fragility curves from IPPSS report Table 7.2-8 was performed using the same relative weighting as the IPPSS and a mean frequency value of 1.6 x 10-6 per year was obtained. This compares to the value of 2.4 x 10-6 reported by the IPPSS. We believe that the difference is due to differences in the integration procedures used and probably the lumping of hazard curves into the final family used in the DPD operation. A finer discretation of the hazard and fragility points would probably reduce this difference. The SE/2RW seismic sequence is dominated by the capacities of the control building shear wall and the diesel generator fuel oil tanks, which together have an equivalent capacity which contribute significantly to the effective capacity of all contributors of about 0.89 We believe that the capacity of the hung ceiling in the con-trol room may be lower and the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, respectively; thus the mean frequency of an SE/2RW due to seismic effects is judged to be 10 times larger, ie, 2.4 x 10-5, We believe that the capacity for the diesel generator fuel oil tanks should be developed based on specific rather than generic data since this component is a significant contributor to seismic 2RW. Conservatisms and unconservativisms for SE/2RW are the same as for Unit 2 (see Section 3.2.1) . t 3.3.8-1 l
3.3.9 Tornado and Missiles: Loss of Offsite Power and SW Pumps, SE/2RW The category 2RW sequence which is dominated by plant state SE is dominated by the failure of the service water pumps, 1 T, since failure of offsite power will occur at a much lower wind velocity. Loss of offsite power and the service water pumps leads to a total loss of AC power. Total loss of AC power leads to a seal LOCA and failure of the core cooling systems. BecausetheRWST,O9T, is in seriesWe with offsitewith disagree power, the itstate-is not a major contributoT to 2RW release. ment in the IPPSS report, page 7.5-19, that the auxiliary feed Thispump building is a dominant contributor to release category 2RW. component is not part of the final Boolean expression. Since missiles from hurricanes are not a significant threat and hurricane wind pressures will not fail the concrete structures, there is no contribution to 2RW from hurricanes. As discussed in review of IPPSS Section 7.5.3, we believe that the failure of the service water pumps due to tornado effects is approximately 10-6 per year. Thus, the mean value of 9.2 x 10-7 per year for category 2RW due to wind loading is reasonable. No conservatisms or unconservatisms were identified for Unit 3 tornadoes and missiles. ( l l 3.3.9-1
i 3.3.10 Event V: The Interfacing Systems LOCA, V/2 See Section 3.2.15. l l l l l l 3.3.10-1
3.3.11 Turbine Trip Due to LOP: Loss of All AC, RCP Seal LOCA, Failure to Recover AC Power (Within Three Hours), SE Point Estimation This sequence leads to plant state SE and is the leading IPPSS internal event with respect to the risk of latent cancers. It diff'erc from the sequence discussed in Section 3.3.7 only in that recovery of AC power is not until after three hours. The difference between thiee-hour and one-hour recovery has been discussed in Section 3.2.12. The IPPSS estimated this sequence to have a frequency of 4.8x10-7 The IPPSS estimated the similar sequence at IP 2 to have a frequency of lx10-6 In Section 3.2.14, we concluded a In Section 3.3.7, we also con-better estimate should be 5x10-7 cluded that the loss of AC power frequency should be about the same for both IP 2 and IP 3. Since the recovey of AC power is also the same for both plants, we conclude here that the IP 2 frequency estimate for this sequence of 5x10-7 also applies to IP 3. The same accident sequence conservatisms and unconservatisms identified for IP-2 in Section 3.2.14 apply to IP-3 Statistical Confidence Limits The same limits that were obtained for this sequence at IP-2 (Section 3.2.14) apply to IP-3: AU95 = 2. l (-6 ) /y r . , AL9 5 = 1 ( ~9)/Yr
- 3.3.11-1
. 1 3.3.12 Seismic: Containment Fa ilu r e , Z-1Q The sequence leading to damage state Z consists entirely of l
failure of the containment building shear wall. Because of the relatively high the capacity mean of this failure frequency - of mode is(ie, failure median value only 3.7 x 10-8 equal to 1.79) per year. This result is sensitive to the upper bound cutoff on the hazard curves. Because we believe the D&M and WCC mean hazard curves should be weighted 80 % and 20 %, respectively, the frequency 1 of Z is a factor of 1.6 low. f l l i r I I i l l l 3.3.12-1
1 General Section 3 References l
- 1. Letter from Scott Newberry (NRC) to Greg Kolb (SNL),
Subject:
NRC Staff Comments and Utility Responses to the August 25, 1982, Indian Point " Letter Report," October 8, 1982. j
- 2. Internal memo from R. Vollmer to S. Hanauer (NRC),
Subject:
Review of the Sandia IPPSS Evaluation, October 1, 1982.
- 3. Internal Memo from R. Mattson to S. Hanauer (NRC),
Subject:
Review of Sandia IPPSS Evaluation, no date.
- 4. Internal memo from R. Bernero to S. Hanauer (NRC),
Subject:
DRA Comments on Sandia Review of IPPSS, October 5, 1982.
- 5. Letter from J. Bayne (PASNY) and J. O'Toole (Con. Ed.) to H.
Denton (NRC),
Subject:
March 5, 1982. Indian Point Probabilistic Safety Study,
- 6. Letter from A. Kolaczkowski (SNLA) to P. Baranowsky (NRC),
Subject:
Assessment of the Station Blackout Related Sequences in the IPPSS, May 17, 1982.
- 7. Memo from G. Kolb (SNLA) to S. Israel (NRC),
Subject:
IPPSS Questions, May 1982.
- 8. Internal Memo from F. Rosa to F. Rowsome and S. Israel (NRC),
Subject:
Review of System Modeling in the IPPSS, May 17, 1982.
- 9. Internal Memo from B. Sheron to A. Thadani (NRC),
Subject:
Review of Modeling in the IPPSS, May 24, 1982.
- 10. Internal Memo from S. Rhow to S. Israel (NRC),
Subject:
IPPSS, June 9, 1982.
- 11. Le tte r from W. Bennet (Con. Ed.) to D. Bley (PL&G),
Subject:
AFWS Fault Tree Analysis and Medium Break LOCA Event Tree; Near Site Risk Assessment Report, April 8, 1981.
- 12. Internal Memo from W. LeFave to S. Israel (NRC),
Subject:
IPPSS Component Cooling System, Service Water System and Auxiliary Feedwater System, May 11, 1982.
- 13. Review Questions for IPPSS, J. R. Benjamin and Assoc., June 1, !
1982 1 r ; l \ l l
- 3.3.12-2
4.0 Special Issues 4.1 Steam Generator Tube Rupture With Stuck Open Secondary Safety Valve As discussed in Section 2.2, several omissions were identified in the IPPSS steam generator tube rupture event tree. Because of our several findings, the IPPSS analysis team is performing a revised steam generator tube rupture analysis. One potentially significant omission was not modeling a steam generator tube rupture coincident with a stuck open secondary safety valve. If core meltdown occars, this may result in a direct radio-active material release to the atmosphere. This type of accident has recently become a concern at NRC because of the Ginna steam generator tube rupture incident which occurred earlier this year. (This was the first U. S. PWR steam generator tube rupture incident in which a secondary safety valve opened.) Point Estimation we quantified this omission by performing an abbreviated analycis; a simplified event tree was drawn which considered what we felt were potentially significant accident sequences, and event probabilities were estimated based on a review of the Indian Point steam generator tube rupture emergency procedures and our revised system unavailability estimates. The dominant sequences identified are presented and discussed below. It can be noted that IP 2's sequence A and B involve the same events as IP 3's sequence A and B. These two sequences will be discussed in turn. In sequence A, the tube rupture leads to a safety injection signal followed by successful operation of the high pressure injec-I tion system (HPIS). The pressure in the secondary of the faulted steam generator will begin to rise and the atmospheric dump valve may be demanded open. The IP 2 emergency procedures instruct the operator to isolate tha faulty steam generator and to locally close the dump valve blocking valve. This would eliminate leakage through I the dump valve if it failed to close. However, this action may ! cause the safety valves to be demanded open if the primary system is repressurized above the safety valve set point (e .g . , at Ginna this occurred because HPI was not throttled) or if the block valve is closed before the primary pressure is reduced below the safety valve setpoint. (The IP 2 procedures do not give firm guidance as to what the primary pressure must be before closing the block valve and thus we conservatively assume the safety valves will be demanded with a probability of 1.0.) If a secondary safety valve fails to close, the primary system will begin to " steam off" inventory to the atmosphere. We estimate that the high pressure injection system could make up this lost inventory for at least 12 hours. After this 4.1-1
Dominant IP 2 Sequences Secondary Failure [SteamGeneratorbl. Safety Valves \ [ At Secondary Least One } of Residual A) l Tube Rupture l Demanded l. I Safety Valve f. Heat Removal I = 2.7x10-7/R yr ( (.027/R yr) / ( Open / ( Fails(.01) to Close/ System / (1.0) (1x10-33 .. At Least One
! Steam Generator \ [ Failure of ) [ Secondary \ [SecondarySafetyig l= 2.5x10-7/R yr B)l Tube Rupture I .l High Pressure p l Safety Valves j. I Valve Fai,1s
( (.027/R yr) / (Injection Syste (DemandedOpen) ( to Close ) (9.2x10-4)* (1.0) (.01) Dominant IP 3 Sequences Secoadary Failure [SteamGenerator) [SafetyValves) [AtLeastOne Secondary Safety Valve
) [ofResidual )
Heat Removal = lx10-7/R yr Tube Rupture Demanded I. i.i A) l (.034/R yr) J .; Open Pails to Close System J j (
. (1.0) k (.01) $ (3x10-4)** I Y At Least One N
Failure cf Secondary [SteamGenerator) [HighPressure 3 Safety Valves} . [Seconda^ry Safety}= Valve Fails 1x10-7/R yr B) Tube Rupture . ; (.034/R yr) Injection Syste I to Close k (3x10-4)* DemandedOpen), (1.0) ( (.01) / Notes
- Derived in Section 2.4 of this report.
** 1(-3) = .16(6.4(-3)), 3(-4) = .16(1.8(-3)); where 6.4(-3) and l.8(-3) are the IPPSS RHR pump failure probabilities and .16 is a B-factor obtained from Atwood. Failure of both RHR pumps to start was considered to be the dominant RHR failure mode.
System failure due to valve failure is assumed negligible because sufficient time is available to open them locally. Failure of the component cooling water system and service water system pumps, which cools the RHR heat exchangers, as neglected since these pumps are normally operating at the start of the accident. Failure of these pumps to continue running in the post accident period is probabilistically small. Operator erros in establishing RHR are also assumed negligible (see text).
i J ! time, the refueling water storage tank may empty. To prevent core melt, therefore, the primary system must be depressurized by the RFWS within 12 hours _so that the leak rate out the safety can be reduced and so the low pressure residual heat removal (RHR) system can be activated. Once RHR is actuated, the primary system can be brought subcooled and thus steam off to the atmosphere will essen-tially cease. If RHR fails, steam off will continue and core melt will ensue. The probability of RHR failure we assigned is comprised of only hardware failures and assumes operator errors in establish-ing RHR are negligible. These actions are very familiar to the operators and are performed every time the plant is brought to cold shutdown. In sequence B, the tube rupture leads to a safety injection signal followed by failure of the high pressure injection system.
, As in the previous sequence, we assume the safety valve will be ! demanded because of the instructions provided in the IP 2 emergency procedures to isolate the atmospheric dump valve. If the valve d
- sticks open, we estimate that within approximately two hours, the core will uncover followed by core meltdown.
Summing these two sequences yields 5.2 x. 10-7/R yr for IP 2 and 2 x 10-7/R yr for IP 3. These sequences would probably be
! placed in a plant damage state not defined in the IPPSS.
As a final note, it should be understood that the sequence frequency estimate for IP 3 was based on IP 2 procedures since we did not have a current version of the IP 3 procedure.
; Statistical Confidence Limits The model for sequence A is k A = @4
- Psyo . QSVC e QRHR where these parameters, and the pertinent data, are defined as j follows:
d Q) 4 : Rate of occurrence of SG tube ruptures. Tne IPPSS reported PWR experience is seven occurrences in 131-i reactor-years. There is little evidence of
- plant-to-plant variability so these cumulative data will be used.
Psyo: Probability that the five secondary safety valves will be opened, given the initiating event; assumed to be
- 1.0.
! Oscy: Probability that at least one safety valve fails to close. EGG-EA-5485, by Atwood, gives safety valve data l which indicate zero failures-to-close in 665 demands, i l i l 4.1-3
We assume, somewhat conservatively, that all five valves open, so for five valves, the effective data pertaining to QSCV are 0/133. QRHR: nesidual Heat Removal failure probability. Assumed to be dominated by the failure of two pumps for which, as described in Section 3.2.7, the IP data are 0/1593. Combining these data, using the Maximus methodology, leads to an assessment based on zero occurrences in 3.5 (6) yrs. The resulting lower and upper 95 perceat statistical confidence limits are AL95 = 0 AU95 = 8.6(-7)/yr. The medel for sequonge B is A B = @( *OHPI
- Psyo
- QSVCr where the only term that dif fers from those in AA is QHpI, which refers to failure of high pressure injection. The effective data for this event, as described in Section 3.2.13, are .24 failures in
, 1593 demands. This differs from the double pump failure considered above in that two single valve cut sets are also included. The resulting assessment ofA B is based on effective data of zero occurrences in 2.8 (6) yrs, which yields A L95 = 0 AU95 = 1.l(-6)/yr. The statistical bounds for sequences A And B pertain to both IP-2 and IP-3. Bounds on the sum of sequences A and B can be obtained by summing the bound , because essentially the same data go into each. Thus AL95 (A+B) =0 AU95 (A+B) = 2.0(-6)/yr. 4.1-4
4.2 Core Melt / Systems Interactions As mentioned in Section 2.2.1, the Indian Point event trees imply that the containment spray system and fan cooler system may be utilized to protect the containment from overpressure during a core melt accident. The fault tree analysis of these systems also assumes that the system reliability will not be degraded due to the adverse environment within containment following a core melt. In this section we will investigate the effect that not giving credit for these systems has on the IPPSS plant damage state estimates. Following a core meltdown, the fan cooler system may possibly fail by one or a combination of the following mechanisms:
- 1) cabling or instrumentation failure due to containment hydrogen burns,
- 2) cabling or instrumentation failure due to radiation exposure, or
- 3) plugging of fan cooler filters or cooling coils due to aerosol generation.
The IPPSS analysis team do not feel these are likely failure mechanisms for the following reasons:1 li most and possibly all important fan cooler cabling either are adequately shielded from the containment atmosphere or the insulation exhibits combustion retardant properties,
- 2) the cabling should handle the radiation doses expected to exist at the location of the cables following the melt, and
- 3) the amount of aerosols reaching the coolers should be insignificant since most small aerosols i (2 to 4 micron) will be scrubbed out in the water in the reactor cavity and larger aerosols (100 micron--I mm) will fall out due to gravity before reaching the fans.
l Though the preceeding seem like good reasons to us, we did not i attempt to resolve this issue due to the limited time available to perform this review, and the fact that this issue is currently being addressed in several NRC and Sandia equipment qualification research programs. Rather, a sensitivity analysis was performed which investigated the effect that assuming fan cooler failure has on the plant damage states. Following a core meltdown, the spray recirculation system may fail due to one of the following mechanisms: l 4.2-1
- 1. failure of two motor operated valves (located in the containment) to open due to hydrogen burns or radiation exposure,
- 2. failure of the two recirculation pumps and two RHR pumps due to core melt debris in their sump water supply.
These issues do not affect the IPPSS plant damage state frequencies because, as stated in Section 2.2.1, the IPPSS does not give credit for operation of the spray recirculation system. If it assumed the fan coolers will fail during a core melt and the containment spray injection system is not available during the recirculation phase (see discussion in Section 2.2.1), the following changes to the IPPSS damage states are made:
- 1) SEFC becomes SEC,
- 2) SEF becomes SE,
- 3) SLFC becomes SL,
- 4) SLF becomes SL, I 5) SLC becomes SL,
- 6) TEFC becomes TEC,
- 7) TEF becomes TE,
- 8) AEFC becomes AEC,
- 9) AEF becomes AE,
- 10) ALFC becomes AL,
- 11) ALF becomes AL, and
- 12) ALC becomes A0.
The frequencies listed in the first column of Tables 4.2-1-and 4.2-2 assume the fan coolers are capable of operating in a post core melt environment'and represent our best estimate frequencies discussed in Chapter 5. The frequencies in the second column assume the fans fail following a core melt. REFERENCE
- 1. Response to Sandia Letter Report of SeptEaber 1, 1982 on the Indian Point Probabilistic Safety Study, October 1, 1982.
i ( 4.2-2
TABLE 4.2-1 Comparison of Indian Point 2 Damage States With and Without the Availability of the Containment Fan Coolers Following a Core Melt Accident Fans Potentially Available NRC Defined Plant (Taken from Table 5.2-7 Fans Damage States of this Report) Not Available Early core melt with 1.7(-4) 1. 7 (-4 ) containment cooling Early core melt without 6.3(-4) 6.3(-4) containment cooling Late core melt with 1(-4) O containment cooling Late core melt without 5.7(-8) 1(-4) containment cooling i 1 l l l 4.2-3
TABLE 4.2-2 Comparison of Indian Point 3 Damage States With and Without the Availability of the Containment Fan Coolers Following a Core Melt Accident Fans Potentially Available NRC Defined Plant (Taken from Table 5.2-8 Fans Damage States of this Report) Not Available Early core melt with 2(-4) 2(-4) containment cooling Early core melt without 5(-5) 5.l(-5) containment cooling Late core melt with 1(-4) O containment cooling Late core melt-without 9(-10) 1(-4) contairement cooling l l l l 1 l 4.2-4
4.3 Feed and Bleed Capability The IPPSS gave credit for post shutdown decay heat removal via feed and bleed (FB) core cooling. FB would be utilized during small LOCAs and transients if the auxiliary feedwater system (ie, the normal decay heat removal system) was unavailable. Initiation of FB at Indian Point requires the operator to:
- a. Recogr.ize that auxiliary feedwater and secondary heat removal has failed.
- b. Start a safety injection pump (if pressure is low enough).
- c. Open both pressurizer power operated relief valves and their associated block valves.
- d. Verify that adequate heat removal is taking place.
FB is currently not a fully accepted core cooling method at the NRC. We have bean asked to assess the affect that giving credit for FB has on the core melt frequency and on the risk calculated in the IPPSS. Before presenting the quantitative results, a discussion of the Indian Point operator training and emergency procedures regarding FB, and the IPPSS modeling of FB is in order. Point Estimation Discussions with plant operators at both Indian Point units revealed that they received FB simulator training. However, a review of Indian Point emergency procedures revealed that no FB procedures exist at Unit 2 and FB procedures are available at Unit 3 in response to small LOCAs only. The IPPSS has therefore made some assumptions regarding FB operator actions which are not supported by plant emergency procedures. The IPPSS assigned a probability of 3.9x10-4 that the operator would fail to establish feed and bleed. We feel this probatility is optimistic and would suggest a probability closer to 0.1. (In other PRAs with which we are familier, 0.1 is typically assigned to accident situations in which no or inadequate emergency procedures exist but the postulated I operator action seems likely.) If it is assumed that feed and bleed cooling is not possible, one replaces the IPPSS probabilities quoted for event tree events ( OP-1 and OP-2 with 1.0. This was done for the dominant accident sequences for each event tree and includes the affect of other sig-nificant findings of this report. The "no-feed and bleed" dominant accident sequences are summarized in Table 4.3-1. As can be seen from the table, assuming feed and bleed is not possible primarily l affects plant damage state TEFC. It should be noted that we feel that feed and bleed core cooling should be given credit. Recent tests at the LOFT facility and Westinghouse analysis suggest that feed and bleed is a viable core l l 4.3-1
cooling option. We do disagree, however, with the failure prooability the IPPSS assigned to feed and bleed. As mentioned above, we feel the probability should be closer to 0.1. This IPPSS nonconservatism is somewhat offset by the IPPSS conservative assump-tion that main feedwater is always unavailable following un initiating event. Discussions with Indian Point personnel indicate that following most initiating m'ents, main feedwater remains in operation at decay heat flow rates. Data appearing in the ANO PRA indicates that main feedwater remains in operation approximately 94 percent of the time following initiating events caused by reactor trips and turbine trips. The Sizewell PRA stated that two-thirds of loss of main feed trips do not involve a total loss based on a review of operating experience. If main feed is not totally lost it can be used to remove decay heat. And finally, data appearing in NUREG/CR-2497
" Precursors to Potential Severe Core Damage Accidents" indicates that approximately 50 percent of loss of main feedwater initiating events at Westinghouse PWRs are recovered within the short term.
As our best estimate, then, we modify the sequences presented in Table 4.3-1 with our probability estimates of feed and bleed core cooling and main feedwater operation. The results of this exercise are presented in Table 4.3-2. Statistical Confidence Limits All of the revised feed and bleed sequences involve the auxiliary feedwater system (AFWS). The dominant AFWS failure modes are both the CST and city water supplies fail or a turbine-driven pump and two motor-driven pumps fail. We model this failure by QAFWS " QW1
- QW2 + OP3 . OP12, where W1 and W2 are the supercomponents in the IPPSS analysis i pertaining to the two water supplies, P3 is the turbine-pump !
supercomponent, and P12 denotes the two motor-driven pumps. Reducing these supercomponents to components, and their data yields: QW1 = 438 AMOV + 08, where Agoy is the failure rate of MOVs (transfer closed), and is estimated, as discussed in Section 3.2.11, from data of seven failures in 7.0 (7) hours, and 08 denotes the failure to close probability of an air-operated valve (entry 8 in the data tables). The combined IP-2 and IP-3 data for 08 are one failure in 1438 demands. Next, QW2 = 1. 7 5 (5 ) Agoy because this value is never tested and one-half of the plant's assumed lifetime is 20 years = 1.75 (5) hours. 4.3-2
Table 4.3-1 Sequences Predominantly Affected by the No Feed and Bleed Assumption IP-2 IP-3 IP-2 (No Feed IP-3 (No Feed Event Tree Sequence (IPPSS Valve) and Bleed) (IPPSS Valve) and Bleed) Loss of Main Feedwater 7.8x10-7 3.3x10-5 2.6x10-7 1.8x10-5 Sequence 9 Closure of One MSIV 1.5x10-7 6x10-6 6x10-9 5x10-7 Sequence 9 Turbine Trap 8.5x10-7 1.3x10-5 1.8x10-7 4.9x10-6 s sequence 9 w Loss of Offsite Power 2x10-8 5.4x10-6 1.8x10-8 8.1x10-6 Sequence 9 Reactor Trip 7.9x10-7 1.2x10-5 1,9x10-7 5.2x10-6 Sequence 9 i
t Table 4.3-2 SNL Revised Feed and Bleed Sequences IP-2 IP-2 IP-3 IP-3 Event Tree Sequence (IPPSS Valve) (Revised) (IPPSS Valve) (Revised) Loss of Main Feedwater 7.8x10-7 3.3x10-6 2.6x10-7 1.8x10-6 Sequence 9 Closure of One MSIV 1.5x10-7 6-7 6x10-9 5x10-8 Sequence 9 Turbane Trap 8.5x10-7 1.3x10-6 1.8x10-7 4.9x10-7 Sequence 9 Loss of Offaite Power 2x10-8 5.4x10-7 1.8x10-8 8.1x10-7
** Sequence 9 Reactor Trip 7.9x10-7 1.2x10-6 1,9x10-7 5.2x10-7 Sequence 9 i
The turbine pump model is OP3 " OW1 + 012 + 08 where 012 denotes the probability that the pump fails to start and OW1 is included because failure of the CST water supply fails the turbine pump. The combined IP-2 and IP-3 data for 012 are 0/57. The double pump failure probability will be assessed, as before, on data of 0/1593. Combining these data yields effective data pertaining to OAFWS of .5/40,000. Next, consider the feed and bleed operation. Our point estimate for its failure probability is .l. For the purpose of combining this estimate with the other data pertaining to the sequences of interest, we will regard this as a 50 percent confidence limit based on zero occurrences. Data of 0 occurrences in six demands yield this result and so these pseudo-data will be used. The following subsections give our statistical results for the sequences in Table 4.3-2. Loss of Main Feedwater The sequence model is 7 ( ) 0 3pg3 *0 73 and the associated data are: g$ 7( ): IP-2 lists 35 occurrences in 5 years, IP-2 12 in 3 years. The (apparent) difference could he readily due to chance, so the combined data are 47 occurrences in 8 years. Gecause tnere have been numerous occurrences and because there is consider-able plant-to-plant variation, no other data will be added. The factor of one-sixth comes from an estimate that only one-third of feedwater looses are actually total losses of flow and one-half of those are premptly recoverable. We have not reviewed the 47 IP occurrences to see if these fractions are consistent with IP experience. On thj assumption that it is, we will base the estimate of W7/6 on data of 8 occurrences in 8 years. This amounts to regarding the 1/6 as an estimate based on 8/47. Combinino the initiating event data with the AFWS and feed and bleed adata" yields an assessment of the sequence rate based on 0/1.7 (5) 4.3-5
. m -
yrs., which results in an upper 95 percent confidence limit of AU95 = 1.8(-5)/yr. (Because the num'erator for QFB is zero, all lower confidence limits in this section will be zero. Closure of One MSIV The sequence model is 8 ) 0 37g3 *0 73 The initiating event has occurred seven times at IP-2, none at IP-3 and this difference is enough not to pool the data. Thus, incorpor-ating the factor of 1/6 leads to estimatinggb8 from 1/5 years for IP-2, 0/3 for IP-3. The resulting effective sequence data are 0/4.7 (5) years for IP-2, 0/5. 6 (5 ) yrs. for IP-3, leading to the following confidence limits. IP-2 IP-3 A U95 6.4(-6)/yr. 5.4(-6)/yr. Turbine Trip The sequence model is A " 9bila
- OFW
- OAFWS
- OFBs whereQ b lia denotes the occurrence rate of turbine trips and Og denotes the conditional probability that feedwater is lost, given a turbine trip. The available data are as follows:
gb ila: 39 occurrences in 5 years at IP-2; 8 occurrences in 3 , years at IP-3. Not poolable. Q pw : The ANO estimate mentioned above is based on one occurrence in approximately 20 opportunities The resulting effective sequence data and confidence limits are: IP-2 IP-3 j Data 0/2.4 (5) /yr s . 0/6. 5 (5 ) /yr s . ' A U95 1. 3 (-5 ) /yr . 4.6(-6)/yr. , Loss of Offsite Power The model for this sequence is A " @llb
- QAFWS
- QFB The initiating event rate,qbllb, can be estimated from the com-bined PWR data of 34/131 reactor-years. Combining these data with the other sequence data yields ef fective data of 0/7.0 (5) yrs. and ,
an upper 95 percent confidence limit of 4.3(-6)/yr., for both units. 4.3-6
4 Reactor Trip The sequence model is A" 12a
- OFW
- QAFWS
- OFB The initiating event data are 36 occurrences in 5 years at IP-2, 8 in 3 years at IP-3. These are not poolable and no separate data will be used for the two units. The effective sequence data and ,
I l resulting confidence limits are the following: i IP-2 IP-3 Data 0/2. 6 (5 ) /yr s . 0/6. 5 ( 5 ) /yr s . l 4. 6 (-6 ) /y r . AU95 1.2(-5)/yr. 1 l I , i a T l 1 l r l 4.3-7 n m m
i 4.4 Proposed Indian Point Plant Design Modifications as a Result of the IPPSS The IPPSS was not totally based on the current design of the Indian Point plants. During the course of the analysis, five p9 ten-tial problem areas relating to plant design were identified. Consoli-dated Edison and PASNY recognized these problems and committed to implement modifications to correct them. The IPPSS was based on the future Indian Point plant designs after the modifications are installed. The five modifications are listed below:4
- 1) Block off 2 inch vent valve at diesel / service water discharge to allow adequate flow to diesels with the system in accident configuration.1
- 2) Rearrangement of diesel generator fuel oil transfer pump power supplies such that the primary transfer pump for each diesel is powered from one of that diesel's electrical buses.
(Indian Point Unit 2 only)
- 3) Replacement of manual isolation valves with motoroperated isolation valves in certain of the fan cooler service water discharge lines. (Indian Point Unit 2 only)
- 4) Implementation of masonry wall upgrading modifications for station batteries in response to IE Bulletin S0-11.
- 5) Implementation of plant modifications for mitigation of ATWS.
The first four modifications are fairly straightforward; this allowed us to review the proposed modifications. However, during the review of the IPPSS, it was learned that PASNY and Coned delayed implementing the ATWS modification.3 The IPPSS analysis of ATWS events therefore needed revision. The revised ATWS analysis appears below. ATWS Modification The IPPSS analysis was based upon an ATWS modification which would make turbine trip independent of reactor trip. Nonimplementa-tion of this modification results in a much higher peak RCS pressure following a total loss of main feedwater ATWS event than was modeled to occur in the IPPSS. In response to a transient initiated by a loss of main feedwater, a trip signal is sent to the reactor. Upon opening of the reactor trip breakers, a trip signal is sent to the main tur-bine. Due to this series relationship, failure of reactor trip will cause failure of turbine trip. NUREG-0460 indicates that at Westinghouse plants a total loss ot main feedwater followed by reactor trip and turbine trip failure can result in a peak RCS pressure of 3800 psi or greater. 4.4-1 n n
The IPPSS analysis of ATWS events assumed that pressures exceeding 3200 psi cause failure of core cooling systems 2 and thus lead to core melt. Core cooling systems are conservatively postulated to fail via inoperability of the HPI injection line check valves; there are no tests or data on these valves beyond 3200 psi. Point Estimation The preliminary quantitative results of the IPPSS reanalysis were discussed with us. The frequency and contributors to the dominant sequences we identified based on our review, are listed below: A) (Loss of main feed) (Fraction of mainfeed losses which are total losses) - (Power level aoove 80 percent) - (failure to scram) - (failure of turbine trip) - (failure of high pressure injection due to pressure spike) Indian Point 2 A= (6.7) (.33) (.5) (2 x 10-5) (1.0) (1.0) = 2.2 x 10-5 Indian Point 3 A= (3.8) (.33) (.5) (3.9 x 10-5) (1.0) (1.0) = 2.5 x 10-5 We therefore estimate the ATWS core melt frequency for Indian Point 2 to be-w 2.2 x 10-5, and for Indian Point 3 as2.5 x 10-5, These sequences would result in plant damage state SEFC since it is likely that a 3800 psi pressure spike would cause a small LOCA. The IPPSS reported values for ATWS were asl.3 x 10-6 for Indian Point 2 and asl.1 x 10-6 for Indian Point 3. It can be noted that in the preceding equation we assigned a 33% probability that the loss of main feed was a total loss. It is ) important to determine this fraction since if some main feedwater is l available to remove core heat (eg one of the two pump trains) the ! peak pressure would not be expected to exceed 3200 psi. The probability was obtained from the Sizewell PRA and was based on operating experience. Statistical Confidence Limits The above sequence model is A A = d7 . (1/3) . P80 . Caps The factor of 1/3 is an estimate of the fraction of feedwater. losses
~
that are total losses as discussed in Section 4.3, dhcanbe estimated for both IP-2 and 3 by data of 47 occurrences in 8 years, so dg/3 will be estimated by 16 occurrences in 8 years. 4.4-2 n m n
The term, P80, refers to the probability that the power level e at the time of the transient, will exceed 80 percent. The IPSS cites Zion data of 48/99 to estimate this probability. The failure probability of the RPS is more difficult to assess. The 95th posterior percentiles given in the IPPSS correspond to 0/43,000 demands for IP-2, 0/18,000 for IP-3. The difference, though, is artifactual and can be traced to the fact that the experience pertaining to RPS breakers at IP-2 is 0/440, and at IP-3 is 0/144, which certainly does not suggest an inconsistency. Alternatively, consider system level tests. Lellouche5 gives an estimate of 23 RPS tests per year for PWRs. Assuming 500 yrs. of relevant PWR experience, as for a large LOCA, and no RPS failures, gives data of 0/11,500 demands. Combining the data for the terms in A A leads to effective sequence data of 0 occurrences in 1.l(4) years, which lead to A 95 = 2.7(-4)/yr. REFERENCES
- 1. Letter from J. O'Toole (Con. Ed.) to S. Varga (NRC),
Subject:
Indian Point Plant Modifications, October 8, 1982.
- 2. WCAP-8330, Appendix C, " Stress Evaluation of RCS Boundary Components f o r ATWT Ev e n ts .
- 3. Letter from J. O'Toole (Con. Ed.) to S. Varga (NRC),
Subject:
ATWS Modifications, May 7, 1982.
- 4. Memo from S. Newberry (NRC) to G. Kolb (SNLA),
Subject:
Responses to Interrogatories, July 9, 1982. 5 Lellouche, G. S., " Anticipated Transients Without Scram," Nuclear Safety, V21, No. 4, 4.4-4 469-480, July-August 1980. 4.4-3
- n. -_ _ _ ___-_________ _m___.____ ___
n
- 4.5 Reactor Coolant Pump Seal LOCA Several of the IPPSS dominant internal and external accident sequences involve reactor coolant pump (RCP) seal failure. Seal ' failure is assumed to occur following failure of the redundant means of providing seal cooling (ie, charging system and component cooling system) and is predicted to lead to a 1200 gpm LOCA at 30 minutes. The reason that seal LOCAs appear in so many dominant sequences is because failure of AC power causes common mode failure of the seal cooling systems and the emergency core cooling Fafety injection 1 pumps. If however, a seal LOCA did not occur following loss of seal i cooling, the reactor coolant system would not lose inventory and the safety injection pumps would not be required. With an intact reactor coolant system, decay heat could be removed with the AC independent turbine driven auxiliary feedwater pump via the steam generators. In this section, we assume that a seal LOCA will not occur following a loss of seal cooling and requantify the Indian Point dominant accident sequences. We suspect that the seal LOCA may not occur for two reasons. One, the Westinghouse memorandum upon which the IPPSS 1200 gem assumption was based is a very simplistic bounding analysis.2 Two, an experiment performed on a Byron Jackson RCP showed that sig-nificant leakage did not occur for 56 hours following interruption of seal cooling to a static RCP seal.1 We recognize that Byron Jackson RCP seals are not identical to Westinghouse RCP seals. How-ever, similarities do exist which might indicate that Westinghouse seals would not leak significantly. IPPSS personnel were requested to identify the dominant internal and external accident sequences under the assumption that a seal LOCA does not occur following a loss of seal cooling. The sequences they identified were reviewed and revised by us, where necessary, to reflect our other findings delineated in this report. The results of this exercise are displayed in Table 4.5-1 and 4.5-2 for Indian Point Unit 2 and 3 respectively. These tables list the dominant sequences in the significant "NRC defined" plant damage states. It should be noted that the fire sequence frequency estimates do not include the fire modifications discussed in Section 2.7.4. This is 1 because the fire modifications are of no use if it is assumed the seal LOCA does not occur. The value of 0.1 appearing in the " Notes" column of Table 4.5-1 I represents failure of the operator to take local control of the AFWS turbine pump following a total loss of AC power or during certain postulated fire scenarios. Following a total loss of AC power, the turbine pump must be controlled locally because instrument air is i lost. Plant personnel indicate this must be done within i I 4.5-1 1
Table 4.5-1 Indian Point 2 Dominant Sequenec s Assuming RCP Seal LOCA Does Not Occur Indian Point 2- *Early C'>re Melt Without Containment Cooling
- Dominant Accident Sequences Sequence Frequency Notes Hurricane: Loss of Control or Power 5.4 x 10-4 a) Frequency estimate taken from Section 3.2.5 b) Unaffected by seal LOCA since dominated by control room failure which also fails AFWS turbine pump control Seismic: Loss of Control or Power 4.7x10-5 a) ' Frequency taken from Section 3.2.1.
b) Unaffected by seal LOCA since dominated by control room failure which also fails AFWS turbine pump control Tornado and Missiles: Loss of 1.6x10-5 a) Frequency taken from IPPSS m Control Power Table 8.3-9 a b) Unaffected by seat LOCA since dominated by control room failure which also fails AFWS turbine pump control Fire: Electrical Tunnel (CB End) 1.0410-5 a) 1.0x10-5 = (1.Gx10-4)(.1), where 1.0x10-4 taken from Section 2.7.4 of this report and 0.1 is the probability of failing to take local control of the AFWS turbine pump. Pare: Electrical Tunnel (PAB End) lx10-5 a) 1x10-5 = (1x10-4)(.;), where 1x10-4 taken from section 2.7.4 of this report and 0.1 is the proba-bility of failing to take local control of the AFWS turbine pump. Fire: Cable Spreading Room 2.3x10-6 a) Frequency taken from Section 2.7.4. b) Turbine pump failure already factored into this estimate Turbine Trip Due to Loss of Offsate 5x10-8 a) 5x10-8 = (5x10-7)(.1), where Power: Failure of All AC Power 5x10-7 taken from section 3.2.14 and Turbine Driven AFWS Pump and 0.1 is the probability of failing and Fatlure to Restore AC Within to take local control of the AFWS 3 Hours turbine trip Total 6.2x10-4
Table 4.5-1 (Cont.) Indian Point 2- "Early Core Melt With containment Cooling" Dominant Accident Sequences Sequence Frequency tiotes Loss of Main Feedwater: ATWS Failure of 2.2x10-5 a) Frequency taken from Section 4.4 Turbine Trip and Safety Injection b) Unaffected by seal LOCA Small LOCA: Failure of High Pressure 1.7x10-5 a) Frequency taken from Section 3.2.13 Injection b) Unaffected by seal LOCA Fire: Cable Spreading Room 1.2x10-5 a) Frequency taken from 2.7.4 b) Turbine pump failure already factored into this estimate Small LOCA: Failure of High Pressure 1.7x10-5 a) Frequency taken f rom Section 3.2.13 Injection (others) b) Unaffected by seal LOCA Turbine Trap Due to Loss of Offsite 2.4x10-7 a) 2.4x10-7 = (2.4x10-6)(.1), where a Power: Pa11ure of All AC Power and 2.4x10-6 taken from Section 3.2.10 " Turbine Driven AFWS Pump. AC and 0.1 is the probability of failing Restored Between 1-3 hours to take local control of the AFWS turbine pump 9x10-4
Table 4.5-1 (Cont.) Indian Point 2-
- Late Core Melt With. Containment Cooling
- Dominant Accident Sequences Sequence Frequency Notes Large LOCA: Failure of Recirculation 3.9x10-5 a) Frequency taken from Section Cooling 3.2.8 b) Unaffected by seal LOCA ,
Medium LOCA: Failure of Recirculation 3.9x10-5 a) Frequency taken from section Coolin9 3.2.9 b) Unaffected by seal LOCA Small LOCA: Failure of Recirculation 2.2x10-5 a) Frequency taken from Section Coolin9 3.2.7 b) Unaffected by seal LOCA 1x10-4
?
T i
- - . . . . . - _ . . - - . . - - . - . - - -- _-. . - - . ~ . . - . _ _ - _ , - _ _ ..- - _ _ . _ - _ . - - -
l Table 4.5-2 Indian Point 3 Dominant Sequences Assuming RCP Seal LOCA Does Not Occur Indian Point 3- *Early Core Melt Without Containment Cooling" Dominant Accident Sequences i Sequence Frequency Notes Setsmic: Loss of Control 2.4x10-5 a) Frequency taken from Section 3.3.8 b) Unaffected by seal LOCA since dominated by control room ceiling failure which also fails AFWS turbine pump control Fire: Switchgear Room 2.8x10-5 a) 2.8x10-5 = (2.8x10-4)(.1), where i 2.8x10-4 taken from Section 2.7.4 i and 0.1 is the probability of failing i to take local control of the AFWS turbine pump i a j
- Fire: Cable Spreading Room (Tunnel 7.2x10-6 a) 7.2x10-6 = (7.2x10-5)(.1), where e Entrance) 7.2x10-5 taken from section 2.7.4
- and 0.1 is the probability of failing to take local control of APWS turbine pump Fire: Cable Spreading Room (North Wall) 3.3x10-6 a) Frequency taken from 2.7.4 4
b) Turbine pump failure already factored into this estimate Fire: Upper cable Tunnel 3x10-6 a) Frequency taken from 2.7.4 b) Turbine pump failure already factored into this estimate Turbine Trip Due to toss of Offsite 5x10-8 a) 5x10-8 = (5x10-7)(.1), where Power: Failure of All AC Power 5x10-7 taken from Section 3.3.11 and Turbine Driven AFWS Pump and and 0.1 is the probability of failing Failure to Restore AC Within to take local control of the AFWS 3 Hours a turbine pump 6.6x10-5
-~ . , - _ . - - _ - . - _ . - - _ . . . _ . - - - - ~ . . _ - ~ . . . ... . . - , - -. _.-- --. . ~ - - . _ _ - . - . . . _ . . _ , - . ~ . _ . _ _ - - . _ _ . - - - ?
i i I Table 4.5-2 (Cont.) l Indian Point 3- *Early Core Melt With Containment Cooling' Dominant Accident Sequences j Sequence Frequency Notes Fire: Cable Spreading Room (North Wall) 1.8x10-5 a) Frequency taken from 2.7.4 4 l b) Turbine pump failure already factored [ into this estimate , Small LOCA: Failure of Safety Injection 6x10-6 a) Frequency taken from 3.3.6 ] (others) b) Unaffected by seal LOCA r l Turbine Trip Due to Loss of Offiste 2.4x10-7 a) 2.4x10-7 = (2.4x10-6)(.1), where l Power: Failure of All AC Power and 2.4x10-6 taken from 3.3.7 and 0.1 Turbine Driven AFWS Pump AC Restored is the probability of failing to Between 1-3 Hours take local control of the AFWS q turbine pump t ' 3.8x10-6
? >
T I
- i '
1 1 I
i i l r Table 4.5-2 (Cont.) Containment Cooling
- j Indian Point 3-
- Late Core Melt With .
1 Dominant Accident Sequences ' Frequency Notes Sequence Large LOCA: Failure of Low Pressure 3.9x10-5 a) Frequency taken from 3.3.3. Recirculation Cooling r b) Unaffected by seal LOCA a) Frequency taken from 3.3.4 I Medium LOCA: Failure of Low Pressure 3.9x10-5 Recirculation Cooling b) Unaffected by seal LOCA a) Frequency taken from 3.3.1
- Small LOCA: Failure of High Pressure 2.2x10-5 f Recirculation Cooling a b) Unaffected by seal LOCA 1
1x10-4 l = l i w 4 I I l l l
k approximately one hour. as discussed in 2.7.4, the During certain postulated fire scenarios, operator must control the pump locally because instrumentation is lost 1 in the control room. During the fire, the operator relies on instrumentation outside the control I room and which is a considerable distance from the AFWC pump room. We have assigned a probability of failure of .1 to both of these situations because, as stated previously, in Sandia PRAs as a first cut, we typically assign this value for accident situations in which no emergency procedures exist but the postulated operator action seems likely. In Section 5.2.4, we summarize the effect that the assumption of the RCP seal LOCA has on our revised plant damage states. REFERENCE
- 1. Memorandum from J. Zudans, NRC, to Z. Rosytoczy, NRC,
Subject:
I St. Lucie 2; Reactor Coolant Pump Seal Hot Standby Test, September 19, 1980.
- 2. Letter from W.E. Kortier, Festinghouse, to J. Davis (PASNY) and W. Bennit (Con Ed),
Subject:
Indian Point Risk Assessment 4 and Mitigation Study Leakage Due to Pump Seal Failure, May 20,
! 1982.
I I t i l l 4.5-8
4.6 Loss of Component Cooling Water Due to a Pipe Break As stated in Section 2.1, the IPPSS did not analyze this initiating event. This section will assess the impact that this omission has on the IPPSS results. If a pipe break occurs in one of several of the larger component cooling water system lines, the 25000 gallon system would empty in a short time (e.g., approximately 5 minutes). Loss of I this water means that the following important equipment will not receive cooling: a) four reactor. coolant pump (RCP) thermal barrier heat exchangers, b) three charging pump oil coolers, and l c) three safety injection pump oil coolers. The IPPSS predicts that failure of a) and b) will lead to a 1200 gpm RCP seal LOCA within 30 minutes. Indian Point plant personnel predict that each charging pump will operate 5 minutes without cooling. Since the charging pumps would be operated in succession, the seal LOCA would occur 30 minutes after failure ot these pumps, or approximately 50 minutes after the pipe break (5 minutes to empty system, 15 minuted to f ail charging pumps and 30 minutes for seal LOCA). Following the seal LOCA, all three safety injection pumps will actuate automatically upon low RCS pressure. Indian Point person-nel predict that each safety injection pump will operate 5 minutes without cooling. Since these pumps must operate to prevent core melt, a core melt accident will be assured unless cooling to the safety injection pumps is not restored in about 1 hour following the pipe break (50 minutes from pipe break initiation to seal LOCA, a 5 minutes to fail all three safety injection pumps following the seal LOCA). At Indian Point 2, the following two operator actions could be performed to recover from this accident:
- 1) realign manual valves and establish city water cooling to the charging pumps within approximately 20 minutes following the pipe break, or
- 2) realign manual valves and establish city water cooling to the safety injection pumps within approximately 1 hour.
Point Estimation We assign a probability of .5 of failing to perform action 1) since the IP 2 loss of component cooling water procedure instructs i 4.6-1 1
. _ _ - ._ _ ~ . _ . - _ .. .-
(though not very explicitly) the operator to perform this action but the time available is small. We assign a probability of 0.5 of f ailing to perform action 2) since the procedures do not address ' the realignment of city water to the injection pumps early in the accident but discussions with the operators revealed they were aware of the city water connection. somewhat larger time available to perform The 0.5thevalue action. also reflects a The total nonrecovery probability for IP 2 is therefore .25. At Indian Point 3, the following operator action could be performed to recover from this accident:
- 1) connect a spool piece and establish city water cooling to the charging pumps within approximately 20 minutes i
We assign a probability of 0.9 of failing to perform this action since the IP 3 loss of component cooling water procedure does not address this action but discussion with the operators revealed that they were aware of the city water connection. The .9 value also reflects the fact that connection of a spool piece is unlikely within the 20-minute time window. (It should be noted that no safety injection pump city water connection exists at IP 3.) The total sequence frequency for IP 2 and IP 3 is calculated as: IP 2 (1.5x10-4 LOCAs/R yr) - ( . 25) = 3.8x10-5/R yr, IP 3 (1.5x10-4 Lochs /R yr) * (0. 9) = 1.4x10-4/R yr These sequences would result in plant damage state SEFC. In these calculations, we derived the loss of compo- nent cooling water pipe break frequency from the piping analysis of this system presented in the IPPSS (see pages 1.5-800, 801, 1.6-778, and 779). We feel this value is a reasonable estimate since it compares favorably with the large LOCA frequency presented in WASH-1400, ie,
- lx10-4 It should be noted here, however, that quantification of pipe breaks involves large uncertainties.
Statistical Confidence Limits For the purpose of combining the above estimates with others, i they will be regarded as 50% confidence limits based on zero occurrences. The effective data are thus 0/1.8(4) yrs. for IP-2 and 0/5. 0 ( 3) for IP-3. The 95% confidence bounds are calculated to be 1.6 x 10-4 for IP-2 and 6 x 10-4 for IP-3. 4.6-2
4.7 Completeness ! One of the major sources of uncertainty in any PRA is i completeness. These types of uncertainties arise from the inabil- { ity of the PRA analysts to completely identify all possible acci-dent sequences and system failure modes. Our review identified several accident sequences and system failure modes which were apparently omitted in the IPPSS. The more important omissions are summarized below. l
+ Pressurized thermal shock--discussed in Section 2.1 and not evaluated in this review.
3
+ Steam generator tube rupture coincident with a stuck open secondary safety valve--discussed and evaluated in Section 4,1.
4
- Hot gas layer failure mode of safety system cabeling during a
- fire--discussed and evaluated in Section 2.7.4.
j - Safety System failure caused by core meltdown phenomena-- discussed and evaluated in Section 4.2. i - An initiating event caused by a pipe break in the component a cooling water system--discussed and evaluated in Section 4.6. - - Wind channelization surface roughness boundary layer effects for hurricane winds--discussed and evaluated in Section 2.7.2
- Low pressure system and containment spray system D factors were <
omitted--discussed and evaluated in Section 2.4. i
- Reactor coolant pump seal ruptures were not included in the j small LOCA initiating event data base--discussed and evaluated . in Section 2.1.
1
+ Steam generator overfill scenarios were not considered--not ,
discussed or evaluated in this report. -
- Unit 3 control room ceiling failure due to a seismic event--
- discussed and evaluated in Section 3.3.8.
I ! - Ground roughness and shape of building effects on wind l dispersion --discussed in Section 2.7.2. Cold shutdown events--discussed in Section 2.1 and not evaluated in this review.
- Unit 2 control ceiling failure due to a seismic event--discussed i in Section 2.7.1.6 and 3.2.1.
l l b l 4.7-1
Potential failure of Unit 1 turbine and superheater buildings (or pieces of these buildings) due to wind, which could fall onto safety-related structure (ie, Unit 2 control building, diesel generator building, and condensate storage tank)--discussed in Section 2.7.2.4. Design and construction errors and the effects of aging were not considered, i l l l l 4.7-2 l
- 5. Summary and Conclusions over the past several months, we have reviewed the Indian Point Probabilistic Safety Study. Our review was limited to the treatment of the plant systems and external events. This section summarizes some of our more substantive findings.
Section 5.1 lists several of the more important findings in Sandia's review of the Indian Point Probabilistic Safety Study (IPPSS). Section 5.2 presents our recommended estimate of plant damage state frequencies for use in the containment and consequence analysis. This estimate reflects, to the degree possible given the lialted scope of our review, our best judgment of these frequen-cies. Included in these estimates are the significant quantitative conclusions presented in the text. Section 5.2.1 summarizes our findings for the internal events, and Section 5.2.2 summarizes our findings for the external events. Section 5.2.3 combines these, and Section 5.2.4 highlights the sensitivity issues investigated. In general, we found the systems analysis portion of the study to be consistent in scope and detail with ongoing probabilistic risk assessments. The treatment of external events represents an advancement over what has been done in the past. We commend the IPPSS analysis team for their utilization of plant-specific data in their analysis. We found the documentation for the report, though voluminous, often lacking. This made review difficult and, at times, raised questions. Many of these questions, however, were resolved through the cooperation of those who performed the study. Our principal findings are summarized in the following section. By the very nature of the review process, we concentrate on negative findings and impressions with respect to the IPPSS. We have tried, however, to place these in perspective with respect to their impact on the frequency of core melt and risk. In some instances, we note l where the Indian Point treatment appears reasonable to us. 5.1 Important Findings Among the important findings of our review are the following, grouped by topic: Initiating Events
- The initiating events covered in the IPPSS seem to be relatively complete compared to those addressed in previous PRAs, and their estimates of initiating event frequencies appear reasonable.
5.1-1
An exception to this was found. The initiating event of a pipe break in the component cooling water system' was not considered. This was analyzed by us in Section 4.6. The initiating event frequencies for each plant are based on the operating history of each plant. Event Trees The treatment of the containment spray system (CSS) is questionable. The IPPSS assumes that the CSS can be used throughout an accident in the injection mode rather than having to draw from the sump. They assume that the operator will act to refill refueling water storage tank RWST if depleted. We question this assumption and do not give credit for refilling the RWST. Core melts caused by overpressure failure of containment (eg, S2 C type accidents in WASH-1400) were not considered. However, this would have negligible effect based on our review. Based on our review of existing procedures, feed and bleed capability is given more credit than we would recommend. We , assessed a higher human error probability than IPPSS. As a result of our review, the steam generator tube rupture and ATWS event trees are being reconstructed. In IPPSS currently, we judged the former ir. appropriate, and the latter does not represent the as-built plant. We performed an abbreviated analysis in order to identify the dominant accident sequences the IPPSS missed. Success Criteria Success criteria used in the analysis appear to be reasonable and consistent with those used in PRAs of similar plants. i l Fault Trees In general, the fault trees presented in the IPPSS are an accurate representation of the IP-2 and IP-3 systems. The analysis was considerably aided by the fact that the fluid systems have common headers, thus making the construction of supercomponents much easier. The Indian Point plant test procedures do not require staggered tests of safety systems. This practice tends to increase system failure probabilities due to common mode test errors. We feel this Indian Point practice provides a basis for use of our common mode G factors. 1 5.1-2 L
. The analyses are inconsistent in the application of common cause failure possibilities, not only among systems, or different modes of the same system, at the one plant but also for the came system in the other plant where no difference could be discerned. The IPPSS, however, should be commended for its examination of common cause failures although we would recommend more reliance on historic data. In several instances, we modified IPPSS common cause failure estimates via examination of generic historic data. + In the degraded power states, the IPPSS ignored maintenance unavailability for the pumps which could still receive power in the component cooling water service water and conventional header systems. The IPPSS analysts demonstrated that this ommission was not risk significant. - In the sequence evaluations for the loss-of-offsite power initiating event, an inappropriate service water system unavailability was used. The IPPSS analysts requantified the affected sequences and found negligible differences. - We recommend several improvements in the analysis of the auxiliary feedwater system. However, their effect was shown to be of small importance. + We recommend improvements in the analysis of the interaction of the service water system with the containment fans and high pressure recirculation. As a result of this recommendation, the IPPSS analysts revised the analysis. We reviewed their reanalysis and found it appropriate.
Human Reliability Analysis
- The human reliability analysis reflected a diligent and sincere effort to use eccepted human reliability analysis methods. A complete evaluation by us was not possible due to a lack of documentation; We judged that undue optimism existed in the assessment of
, credit for human redundancy; l - We recommend less optimistic assessments of human performance under stress, especially for the case of multiple problems; We believe that estimates of operator performance should be based on simple measurements rather thaa personal estimates; l We found inadequate documentation on the use of expert l l opinion; 1 We judged that optimistic assessments of dependence among tasks done by the same person were used; 5.1-3
l l 1 We found apparent nonconsideration of some possibilities for l common cause failures from human errors; ' We found possible insufficient consideration of errors in restoring safety components after test, maintenance, or calibration. The failure to switchover to high-pressure recirculation appears to have been overestimated in the IPPSS while the equivalent error for low pressure recirculation appears to have been underestimated, based on our reevaluation. Estimation Methodology Indian Point's estimates of maintenance unavailabilities appear to be consistent with Indian Point data. The treatment of uncertainty associated with estimates from existing data sources is inconsistent. Generally, 5 and 95% bounds from WASH-1400 were used as 20% and 80% limits in IPPSS. Notable exceptions to this were the treatment of interfacing system LOCAs, pressure vessel rupture, and pipe ruptures. In all three cases, substantially higher estimates would have been obtained had their general rule been followed. The results are highly sensitive to this assumption. (It must be noted that the revised Sequence V analysis used the 5 and 95% bounds.) The Bayesian methodology used to estimate accident sequence rates was evaluated. Where Indian Point data exist and are used to modify IPPSS's prior to probability distributions, the effect of the prior distributions is generally unimportant with respect to the estimated accident sequence rates. Where Indian Point data are not available or used, the estimates are quite sensitive to the assumed prior distribution. External Events For the seismic hazard and fragility analysis, the methodologies used in the IPPSS are appropriate and adequate to perform a seismic risk analynis. The procedure is based on a simple probabilistic model which uses some data, but currently relies heavily on engineering judgment. l l The Ramapo fault zone was not included in the analysis; however, it is believed that this source does not significantly affect the results of the IPPSS. In general, the uncertainty of the parameters used in the seismic analysis are believed to be understated, but the median values are considered to be conservative. 5.1-4
. For seismic events, the core melt frequency may be low by a factor of 6 for IP-2 (based on the revised analysis) and by a factor of 8 for IP-3. The potential for failure of the hung ceilings in the Unit 2 and 3 control rooms should be reanalyzed.
If the problems of the control room ceiling failure are resolved, then the seismic capacity of the diesel generator building for Unit 2 and the burned diesel oil fuel tank for Unit 3 will be significant contributors to the frequency of core melt. Since the capacity of these structures are currently based on generic data, more detailed analyses should be conducted.
- The tornado hazard curves are on the conservative side, but the hurricane hazard curves appear unconservative. - We recommend a core melt frequency due to a hurricane at IP-2 which is higher by a factor of 20, and a median hurricane hazard curve which is also higher. - Many statements in the wind fragility analysis are undocumented. In general, we recommend a more detailed analysis.
The major uncertainty in wind loading on an IP structure is due to the influence of nearby structures. The analysis does not adequately represent the influence of adjacent structures. The conversion of pressure to equivalent wind velocity ignores the shape factors of the buildings. The analysis presented in the IPPSS for the loss-of-offsite power caused by wind appears unconservative.
- Based on the site visit by the review team, we recommend the possibility of either the turbine building or the superheater building failing due to wind and falling on the control building be considered as well as the latter falling on the diesel generator building.
The systems / components considered in the seismic and wind logic models seem to be reasonably complete. The external flood analysis does not adequately account for significant sources of uncertainty. We agree with conclusions of the internal flooding analysis that tne effect on plant risk is small. The assumption that the internal flood analysis applies to l Unit 3 as well as to Unit 2, for which the analysis was conducted, should be verified. l 5.1-5
j The IPPSS fire analysis 1 appears to have identified all critical plant areas where a fire can cause an initiating event and, simultaneously, fail redundant safety systems. has adopted the best available data base for estimating the frequency of fires in nuclear power plant areas. appears to have identified all important safety system components and cabling which are located in critical plant fire areas. reflects as-built plant conditions at the time the analysis was performed. did not quantitatively assess the importance of a control room fire, even though an analytical basis for excluding the control room from analysis appears to be missing. The fire analysis assumes that fire damage occurs only through , fire propagation within a fire plume. This may be nonconserv-ative. In addition, significant operator recovery actions are allowed in a few fire situations, although confused operating conditions during a fire could hamper such actions. With more 4 conservative assumptions in these two areas, the core melt frequency due to fire at Unit 2 can increase by a factor of 2 and at Unit 3 by a factor of 4. However, giving credit for the proposed Indian Pt. fire modifications lowers the core melt fire frequency of IP2 by a factor of 3 and IP3 by a factor of 2. The analyses in the IPPSS concerning the transportation and storage of hazardous materials, turbine missiles, and aircraft accidents appear to be reasonable with their associated risks being negligible. Although external and internal events were considered separately in the external event logic models until containment systems were considered, the review substantiated the IPPSS hypcthesis j that combinations of such events are probabilistically small. 2 It is our understanding that new analyses to address some of the issues raised above are currently being performed by PLG. It is l recommended that the revised results be reviewed and compared to the current analysis when they are completed. Accident Sequence Analysis j - In general, the IPPSS accident sequence analysis was difficult
- to follow because of I
incorrect and/or incomplete references. nonmatching numerical results. l 5.1-6 l
- unclear or incomplete description of events or the modeling of them.
- Reliance by the IPPSS on more representative fragility hazard curves and giving credit for the proposed seismic modification at IP2 reduces the seismic initiated, SE/2RW, sequence at IP-2 by a factor of three.
- Reliance by the IPPSS on more representative hazard curves and consideration of the control room ceiling failure at IP3, increases the seismic initiated, SE/2RW, sequence at IP3 by a factor of ten.
- For the two dominant IP-2 fire scenarios listed in IPPSS Table 8.3-9, the SE/2RW scenario would decrease by a factor of six and the SLF/8A scenario could not occur (and instead become part of the SE/2RW case) if the hot layer failure mechanism, described in Section 2.7.4, occurs and credit is given for the proposed fire modifications. Similar observations hold for the fire scenarios of IP-3.
- The assumption that loss of power to busses, 2A, 3A, and 6A at IP-2 leads to a seal-LOCA is conservative because component cooling water has power as long as power to bus 5A is not lost.
Thus we would recommend a frequency of scenario 4 in Table 8.3-9 which is lower by a factor of two. This also affects scenario 12.
- IPPSS may have underestimated the frequency of IP-2 scenario 5 in Table 8.3-9 by as much as a factor of 20 because of question-able assumptions made about the hurricane hazard at the site and the offsite power fragility.
l
- Tornado initiated sequences at IP-2 appear to have been l
reasonably estimated. l
- We would recommend a lower probability for failure of the operators to initiate switchover to recirculation for the small LOCA sequences and a higher probability for the large and medium LOCA sequences. This applies to both IP-2 and IP-3.
- Our recommend use of industry historical common cause pump failure data instead of the subjective IPPSS common cause value increases the contribution of system hardware failures in the internal accident sequences for both IP-2 and IP-3.
- The failure criterion we believe is more appropriate for diesel generator cooling by service water results in a lower estimate IP-2 scenarios 10 and 14 in Table 8.3-9 by greater than a factor of two. This is true as well for the equivalent II-3 scenarios.
- At the request of the reviewers, the sequence V for both IP-2 and IP-3 was reanalyzed. The results of the revised analysis are not appreciably different than those presented in the IPPSS.
5.1-7
In the IPPSS, some IP-3 sequence frequencies are higher than those of identical IP-2 sequences from what seems an over-application of the data. We feel this is not justified. t l i l ( 1 1 I l l l [ { 1 1 5.1-8 1 l
5.2 Estimated Plant Damage State / Release Category Frequencies and Sensitivity Issues 5.2.1 Internal Even ts Tables 5.2-1 and 5.2-2 summarize the effect that the findings discussed in the previous sections have on the Indian Point Unit 2 and 3 internal event plant damage states and release category frequencies. The first column is a listing of 21 plant damage states defined in the IPPSS. The nomenclature is: S or A denotes small or large LOCA. T denotes transient, V denotes interfacing systems LOCA, E or L denotes early or late core melt, F and C denotes fans and sprays working, respectively. Also appearing in column one are the mean frequencies of those damage states as calculated irs the IPPSS. The second column represents the revised estimates of the IPPSS plant damage states, based on the significant findings in Sections 2 through 4. It can be noted that a dash appears instead of a frequency estimate in several places. A dash denotes that we did not attenpt to recalculate a frequency because these damage states were found r.o have a small impact on risk as calculated in the IPPSS. The third column represents the revised "NRC defined" plant damage states. The "NRC defined" Grates consist of the sum of IPPSS damage states listed to the left. Also listed in colenn 2 and 3 are the upper and lower 95% confidence limits for the damage states. These were obtained by estimating the sum of the accident sequence rates for those dominant sequences that make up each damage state, using the Maximus methodology. Unit 2 Internal Events - Table 5.2-1 l Via comparison, it can be noted that 14 of the 21 IPPSS damage state frequencies have been revised for Unit 2. These revisions are summarized below. l l l 5.2-1
._. __ ___. . . . . _ . . . _ _ _ . _ . _ . _ - . - __.___...__.m__ ._ ._ _ _ _ _ _ _ _ . _ _ _ . _ . _ _ . _ . _ _ _ _
i Table 5.2-1. Indian Point 2 Internal Event Reculta j IPPSS Plant Revised Plant Revised NRC Lefined Damage States Damage States , Plant Damage States k Mean Point Estimate AL95 AU95 Point Estimat) A L95 AU95 SEFC 3.8(-5) SEFC 9.4(-5) 1.0(-8) 2.6(-4) AEFC 8.0(-6) AEFC 1.2(-5) 0 4.2(-5) SEC 4.l(-6) SEC 1.7(-6) 3.4(-8) 1.7(-6) Early Core ] AEC 2.7(-8) AEC -- -- -- Melt With 1.2(-4) 2.l(-8) 2.6(-4) l ! TEFC 3.3(-6) TEFC 7.0(-6 0 3.9(-5) Containmcat TEC 2.0(-7) TEC -- -- -- Cooling SEF 3.8(-9) SEF -- -- -- AEF 7.6(-10) AEF -- -- -- TEF 1.4(-9) TEF -- -- -- l I SE 1.0(-6) SE 5.0(-7) 1.0(-9) 2.1(-6) Early Core
'u Melt Without' b TE 1.l(-7) TE -- -- -- Containment 6.l(-7) 1.0(-9) 2.l(-6)
AE 3.2(-9) AE -- -- -- Cooling j SLFC 1.3(-5) SLFC N/A Late Coro i ALFC 2.l(-5) ALFC N/A Melt With SLC 5.7(-8) SLC N/A Containnent 1.G(-4) 0 5.0(-4) : ALC 4.2(-10) ALC N/A Cooling SLF 4.3(-9) SLF 2.2(-5) 0 5.8(-5) < ALP 1.8(-9) ALP 7.8(-5) 0 5.0(-4) _- SL 8.2(-11) SL 5.7(-8) Late core Melt Without 1 ' AL 1.l(-12) AL 4.2(-10) -- -- Contsinment 5.I(-8) -- -- Cooling V 4.6(-7) y 2.1(-7) 0 2.1(-7) Containment [' Bypass 2.l(-7) 0 2.l(-7) I SG -- SG 5.2(-7) 0 8.6(-7) SG Tube 5.2(-7) 0 8.6(-7) Tube Tube I c
Table 5.3-3. Indian Point 3 Internal Event Results IPPSS Plant Revised Plant Revised NED Defined Damage States Damage States Plant Damage States Mean Point Estimate AL95 Point Estimate AU95 A L95 AU95 SEFC 7.9(-6) SEFC 1.7(-4) 0 6.0(-4) AEFC 8.7(-6) AEFC 9.3(-6) 0 4.2(-5) SEC 1.4(-7) SEC -- -- -- Early Core AEC 3.2(-8) AEC -- -- -- Melt With 1.8(-4) 0 6.0(-4) TEFC 5.2(-7) TEFC 3.6(-6) 0 1.1(-5) Containment TEC 7.5(-8) TEC -- -- -- Cooling SEF 1.0(-9) SEF -- -- - AEF 4.2(-10) AEF -- -- -- TEF 3.9(-10) TEF -- -- - u, SE 6.3(-7) SE 5.0(-7) 1.0(-9) 2.lt-6) Early Core y Melt Without W TE 7.1(-8) TE -- -- -- Containment 5.7( 7) 1.0(-9) 2.1(-6) AE 1.4(-9) AE -- -- -- Cooling SLPC 8.4(-3) SLFC N/A Late Core ALFC 2.3(-5) ALFC N/A Holc With SLC 1.2(-9) SLC N/A Containment 1.0(-4) 0 5.0(-4) ALC 7.7(-10) ALC N/A Cooling SLP 3.1(-9, SLP 2.2(-5) 0 5.8(-5) ALP 8.5(-10) ALP 7.8(-5) 0 5.0(-4) SL 7.9(-11) SL 1.2(-9) -- -- Late Core Malt Without AL 8.2(-10) AL 1.6(-9) -- -- Containment 2.8(-9) -- -- Cooling V 4.6(-7) V 2.1(-7) 0 2.1;-7) Containment Bypass 2.1(-7) 0 2.1(-7) SG -- SG 2.0(-7) 0 2.0(-5) SG Tube 2.0(-7) 0 2.0(-6) Tube Tube
f SEFC - The Value 9.4(-5) is the summation of 5 numbers. They are: i 1) 3.8(-5) = loss of component cooling water event discussed in Section 4.6,
- 2) 2.2(-5) = ATUS event discussed in Section 4.4.1, 1
- 3) 1.5(-5) = loss of offsite power event discussed in Section 3.2.4, 4} 2.4(-6) = loss of offsite power event discussed in
- Section 3.2.10, j 5) 1.7(~5) = small LOCA event discussed in Section l 3.2.13.
AESC - The value 1 2(-5) is the summation of 3 numbers. They are: 4
- 1) 6.2(-6) = the large LOCA event discussed in Section 3.2.11, t
- 2) 2.9(-6) = a medium LOCA and failure of low pressure injection (Sequence 14 on IPPSS Table-8.3-9).
] 3) 2.5t-6) = a mediun LOCA and failure of high pressure injectiori (Sequence 19 on IPPSS Table 8.3-9). High pressure injection is discussed in 1 J Section 2.4. SEC The value 2.2(-6) was calculated in Section 3.2.12 and represents a loss of offsite power event. SLF - The value 2.2(-5) was calculated in Section 3.2.7 and represents a small LOCA event. 4 ALF - The value 7.8(-5) is the summation of 2 numbers. They are:
- 1) 3.9(-5) = the large LOCA event discussed in Section 3.2.8.
- 2) 3.9(-5) = the medium LOCA event discussed in Section 3.2.9.
j TEFC - The value 7.0(-6) was calculated in Section 4.3 and i e represents several " feed and bleed" sequences. 1 i SE - The value 5(-7) was calculated in Section 3.2.14 and represent a loss of offsite power event. l i i 5.2-4
i.
. V - The value 2.l(-7) is the interfacing systems LOCA event described in Section 3.2.15.
- SG -
5.2(-7) = the steam generator tube rupture event Tube described in Section 4.1.
- SLFC ALFC - The value zero reflects our finding in Section 2.2.1 SLC that these damage states are not possible.
ALC
+ SL - The value 5.7 (-8) is the IPPSS value for damage state SLC. In Section 2.2.1 we found that damage state SLC 1 should be SL.
i
- AL - The value 4.2 (-10) is the IPPSS Jalue for damage state ALC, In Section 2.2.1 we found that damage state ALC should be AL, Unit 3 Internal Events - Table 5.?-2 Via comparison c it can be noted that 13 of the 21 IPPSS damage state frequencies have been revised for Unit 3. These revisions are summarized below.
- SEPC - The val ue 1.7 (-4) 10 the summation of 4 numbers. They are:
- 1) 1.4(-4) = loss of component cooling water event discussed in Section 4.6.
- 2) 2.5(-5) = ATWS event discussed in Section 4.4.1.
- 3) 6.0(-6) = the small LOCA event discussed in Section 3.3.6.
- 4) 2.4 (-6) = the loss of offsite power event discussed in Section 3.3.7.
- AEFC - The value 9.3(-6) is the summation of 3 numbers. They are:
- 1) 5.8(-6) = the large LOCA event discussed in Section i
3.3.5, 1 l 2) 2.6(-6) = a medium LOCA and failure of low pressure injection (sequence 9 on IPPSS Table 8.3-10) . Low pressure injection is discussed in Section 4.2.
- 3) 8.6(-7) = a medium LOCA and failure of high pressure injection (sequence 18 on IPPSS Table l 8.3-10). High pressure injection is discussed in Section 2.4.
5.2-5
SLP - The value 2.2(-5) is the small LOCA event discussed in Section 3.3.1,
+ ALF - The value 7.8(-5) is the summation of 2 numbers. They are:
- 1) 3.9(-5) = the large LOCA event discussed in Section 3.3.3.
- 2) 3.9(-5) = the medium LOCA event discussed in Section 3.3.4.
TEFC - The value 3.6(-6) was calculated in Section 4.3 and represents several " feed and bleed" sequences. SE - The value 5(-7) was calculated in Section 3.3.11 and represents a loss of offsite power sequence.
- V -
The value 2.l(-7) is the interfacing systems LOCA event described in Section 3.2.15. t SG - 2.0(-7) = the steam generator tube rupture event Tube described in Section 4.1. a SLPC ALFC - The value zero reflects our findings in Section 2.2.1 SLC that these damage states are not possible. ALC
+ SL -
The value 1.2(-9) is the IPPSS value for damage state SLC. In Section 2.2.1 we found that damage state SLC should be SL.
+
AL - The value 1.6(-9) is the summation of 7.7(-10) and 8.2(-10), the IPPSS values for damage states ALC and AL respectively. In Section 2.2.1 we found that damage state ALC should be AL. 5.2.2 External Events Tables 5.2-3 and 5.2-4 summarize the effect that the findings discussed in the previous sections have on the Indian Point Unit 2 and 3 external event plant damage states. (The IPPSS did not report the external event plant damage state frequencies. They were deduced by comparing IPPSS Table 8.3-9, 8.3-10 with analysis presented in IPPSS Section 7 for external events.) The first column is a listing of the IPPSS external event plant damage states. The nomenclature is: S or A denotes small or large LOCA, T denotes transient, E or L denotes early or late core melt, F and C denotes fans and sprays working, respectively. Z denotes a 5.2-6 ____ _ _ _ _ _ _ _ _ _ _ _ _ _ - - ~
direct failure of the containment due to a seismic event. Also appearing in column one are the deduced mean frequencies of those damage states as calculated in the IPPSS. l The second column represents the revised estimates of the IPPSS plant damage states based on our significant findings in Sections 2 through 4. It can be noted that a dash appears instead of a frequency estimate in several places. A dash denotes that we did not attempt to recalculate a frequency because these damage states l were found to have a small impact on risk as calculated in the IPPSS. The tnird column represents the revised "NRC. defined" plant damage states. The NRC defined states consist of the sum of IPPSS l damage states listed to the left. f i l l l I t l 1 5.2-7
4 Table 5.2-3. Indian Point 2 External Event Results IPPSS Plant- Revised Plant Damage States Revised NRC Defined Damage States Plant Damage States (Mean) (Point Estimate) (Point Estimate) AEFC < l(-7) AEFC -- AEF < l(-6) AEF -- j AEC < l(-7) AEC -- Early Core 1 SEFC 1. 4 (-6) SET 2 1. 8 (-5) Melt With SEF 4.9(-5) SEP C 1(-6) Containment 4. 5 (-5) SEC 2. 8 (-7) SEC -- Cooling TEFC 5.l(-6) TEFC 1. 6 (-5) TEF < 10(-6) TEF -- 1 TEC 1.l(-5) TEC 1.1(-5) AE 1.3(-8) AE 2.6(-8) Early Core Melt Without SE 3.2(-4) SE 6.3(-4) Containment 6.3(-4) TE <1(-5) TE -- Cooling Late Core SLF 4. 8 (-5) SLF < l (-6) Melt With <l(-6) Containment Cooling 1 Direct Z 6.8(-7) Z l.l(-6) Containment 1.l(-6) Failure I 1 5.2-8
]
Table 5.2-4. Indian Point 3 External Event Results IPPSS Plant Revised Plant Revised NRC Defined Damage States Damage States Plant Damage States (Mean) (Point Estimate) (Point Estimate) AEFC <2(-7) AEFC -- AEF (1 (-7) AEF -- , AEC (2(-7) AEC -- Early Core SEFC <2(~7) SEFC -- Melt With SEF <l (-7) SEF -- Containment 1. 9 (-5) SEC (2(-7) SEC -- Cooling TEFC 1.6(-6) TEFC 1.8(-5) TEF 1.l(-6) TEF 1.3 (-6 ) TEC (2(-7) TEC -- AE 2.5(-9) AE 5.0(-9) Early Core Melt Without SE 6.3(-5) SE 4.4(-5) Containment 5.0(-5) i TE a-l.8(-6) TE 6.3 (-6) Cooling Direct Z 3.7(-8) Z 5.9 (-8) Containment 5.9(-8) Failure 2 l I 5.2-9 m n s__ _
Unit 2 External Events 1--Table 5.2-3 The revisione to the IPPSS Unit 2 plant damage state fre-quencies are summarized below. Z - The value 1.l(-6) was calculated in Section 3.2.16 and represents a seismic event which causes a direct failure of containment. SE - The value 6.3(-4) is the summation of 4 numbers. They are:
- 1) 2.2(-5) = the switchgear room and electrical tunnel fire events leading to damage state SE discussed ir: Section 2.7.4 (this value assumes Indian Point 2 fire modifications are in place),
- 2) 4.7(-5) = the seismic event discussed in Section '
3.2.1,
- 3) 5.4(-4) = the hurricane event discussed in Section 3.2.5,
- 4) 1.6 (-5) = the tornado event discussed in Section 3.2.6.
SEFC - The value 1.8(-5) represents the diesel generator fire event discussed in Section 2.7.4. TEFC - The value 1.6(-5) is the summation of 2 numbers. They are
- 1) 1.2(-5) = the cable spreading room fire event discussed in Section 2.7.4.
- 2) 3.5(-6) = the sum of nondominant fire events at IP-2 mentioned but not described in '
Reference 1. SEF - The value 10 (-6 ) is obtained by placing the SEF and . SLF SLF fire events discussed in Section 2.7.4 into SE. l TEC - The value 1.l(-5) is the sum of several nondominant fire events at IP-2 which were mentioned but not described in Reference 1. AE - The value 2.6(-8) represents the seismic event listed in Table 2.7.1-2. REFERENCE l
- 1. Appendix B of letter from John O'Toole (Coned) to Steven Varga (NRC), October 8, 1982.
l 5.2-10 l I m m .
Unit 3 External Events - Table 5.2-4 The revisions to the IPPSS Unit 3 plant damage state fre-quencies are summarized below. Z - The value 5.9(-8) was calculated in Section 3.3.12 and represents a seismic event which causes a direct failure of containment. SE - The value 4.4(-5) is the summation of 3 numbers. They are:
- 1) 1.9(-5) = the switchgear room and cable spreading room fire events leading to damage state SE discussed in Section 2.7.4 (this value assumes Indian Point 3 fire modifications are in place),
- 2) 2.4(-5) = the seismic event discussed in Section 3.3.8, ,
- 3) 9.2(-7) = the tornado event discussed in Section 3.3.9.
P
- TEFC - The salue 1.8(-5) represents the cable spreading room fire event leading to damage state TEFC discussed in 2.7.4.
TEF - The value of 1.3(-6) is the summation of 2 numbers. They are:
- 1) 9.2(-7) = the seismic event listed in Table 2.7.1-3,
- 2) 4.l(-7) = the tornado event listed in Table 2.7.1-3.
- TE - The value 6.3(-6) represents the cable spreading room and cable tunnel fire events described in Section 2.7.4.
- AE - The value 5(-9) represents the seismic event listed in Table 2.7.1-3.
5.2.3 Combined Internal and External Events Tables 5.2-5 and 5.2-6 lists the revised dominant core melt (ie , > 10 (-5 ) ) internal and external accident sequences. Tables 5.2-7 and 5.2-8 summarize the effect that the internal and external event findings have on the "NRC defined" plant damage state fre-quencies. The frequencies listed in Table 5.2-7 were obtained by summing the frequencies listed in Table 5.2-1 and 5.2-3. The frequencies listed in Table 5.2-8 were obtained by summing the frequencies listed in Tables 5.2-2 and 5.2-4. l l 5.2-11
Table 5.2-5 Indian Point 2 Revised Dominant Accident Sequences ( 2 10-5/Ryr) Rank With Plant Respect to Damage Core Melt Sequence State Frequency 1 Hurricane, etc., Wind: Loss of All SE 5.4(-4) AC Power Due to High Winds 2 Seismic: Loss of Control or Power SE 4.7(-5) 3 Large LOCA: Cooling Failure of Recirculation ALF 3.9(-5) 4 Medium LOCA: Failure of Recirculation ALF 3.9(-5) Cooling
." 5 Loss of Component Cooling Due to a SEFC y 3.8(-5)
Pipe Break Causing RCP Seal LOCA [ and Failure of Safety Injection Pumps , 6 Fire: Specific Fires in Electrical SE 2.2(-5) Tunnel and Switchgear Room Causing RCP Seal LOCA and Failure of Power Cables to the Safety Injection Pumps, Containment Spray Pumps, and Pan Coolers 7 Loss of Main Feedwater: ATWS, Failure SEFC 2.2(-Fi of Turbine Trip and Safety Injection System 8 Small LOCA: Failure of Recirculation SLF 2.2(-5) Cooling ___ _ = _ _ . _=
Table 5.2-5 (Continued) Rank With Plant Respect to Damage Sequence State Frequency Core Melt 9 Turbine Trip Due to Loss of offsite SPFC 1.8( 5) Power: Failure of Diesels Due to Fire, RCP Seal LOCA and Failure to Recover External AC Power Until After 1 Hour 10 Small LOCA: Failure of High Pressure SEFC 1.7(-5) Injection 11 Tornado and Missiles: Causing Loss of SE 1.6(-5) Of f site Power and Service Water Puraps or Control Bu11 ding 12 Turbine Trip Due to Loss of Offsite SEFC 1.5(-5) u,
- Power: Failure of Two Diesel Generators, RCP LOCA, and Failure to U Recover External AC Power Until After 1 Hour 13 Fire in Cable Spreading Room Causinq TEFC 1.2(-5)
Failure of Safety Injection Pollo%ad by Failure of the Operator to Take Local control of AFWS
Table 5.2-6 Indian Point 3 Revised Dominant Accident Sequences ( >10-5/Ryr) Rank With Respect to Plarat Core Melt tamage Sequence State Frequency 1 Loss of Component Cooling Due to SEFC a Pipe Break Causing RCP Seal 1.4(-4) LOCA and Failure of Safety Pumps 2 Large LOCA: Failure of Recirculation ALF 3.9(-5) Cooling 3 Medium LOCA: Failure of Recirculation Cooling ALF 3.9(-5) 4 y' Loss of Main Feedwater: ATWS, Failure SEFC 2.5(-5) w of Turbine Trip and Safety Injsetton System O
- 5 Seismic: Loss of control SE 2.4(-5) 6 Small LOCA: Failure of Recirculation SLP 2.2(-5)
Cooling 7 Fire: Specific Fires in Switchgear SE 1.9(-5) Room or Cable Spreading Room Causing RCP Seal LOCA and Failure of Power Cables to the Safety Injection Pumps, The Containment Spray Pumps, and Pan Coolers 8 Fire in Cable Spreading Room Causing Failure of Safety Injection Followed TEFC 1.8(-5) by Failure of the Operator to Take Local Control of AFWS
Table 5.2-7 Combined Indian Point 2 Internal and External Event Results IPPSS Revised NRC Defined Frequency Frequency Damage State ( Mea r.) (Point Estimate) l Early Core Melt With Containment Cooling 1.2(-4) 1.7(-4) Early Core Melt Without Containment 3.2(-4) 6.3(-4) Cooling Late Core Melt With Containment Cooling 8.2(-5) 1.0(-4) Late Core Melt Without Containment 9.0(-11) 5.7(-8) Cooling Y Containment Bypass Prior to Core Melt 4.6(-7) 2.l(-7) SG Tube Rupture / Stuck Open Safety -- 5.2(-7) I Direct Containment Failure 6.8(-7) 1.l(-6) w
Table 5.2-B Combined Indian Point 3 Internal and External Event Results IPPSS Revised NRC Defined Prequency Trequency Damage State ( Meare ) (Point Cstimate) Early Core Melt With Containment Cooling 2.0s-5) 2(-4) Early Core Melt Without containment 6 5(-5) 5.0(-5) CoolancJ Late Core Melt with Containment Cooling 1.l(-4) 1.d(-4) Late Core Melt Without Containment 9.0(-10) 2.0( 9) Coolang Containment Bypass Prior to Core Melt 4.6(-7) 2.lf-7) j SG Tube Rupture / Stuck Open Safety -- 2.0(-7) Direct Containment Failure 3.7(-8) 5.9(-8)
- - - - _ _ - - - - - - - - _ . - - - _ - - - - _ _ _ _ - - - - _____ _ _ _ _ _ _ - - __ _ _m - ~ - - - - _ _ _ _ - - - - - - _ _ . -
As can be seen, the revised damage state frequency estimates are all within a factor of two of the IPPSS estimate except for "Early Core Melt With Containment Cooling" at Indian Point 3, " Steam Generator Tube Rupture / Stuck Open Safety" at both units, and " Late Core Melt Without Containment Cooling" at both units. In the field of PRA, factors of two are usually not considered a significant disagreement. The difference in the "Early Core Melt With Containment Cooling" category is due primarily to the inclusion of the loss of component cooling due to a pipe break sequence in our revised frequency estimate. The IPPSS did not identify such a sequence. (See Section , 4.6.) The IPPSS did not identify a sequence initiated by a steam generator tube rupture followed by a stuck open safety valve; ' therefore no fcequency estimate is listed for the IPPS$. (See Section 4.1.) , The difference in the " Late Core Melt With*ut Containnent Cooling" category is due to our conclusion that ene spray injection system should not be given credit during the recirculation phasa (See Section 2.2,1). It should be noted that our revised estimates give credit for the recently proposed plant modifications in the seismic area for Unit 2 and in the fire area for Units 2 and 3. If tbesa modifications are not installed, dif ferent conclusior.a may be appropriate (see Section 5.2.4 below). In closing, it can be noted that we did not attempt to place statistical confidence limits on our final combined internal and external event plant damage state frequencies. Although we estimated confidence limits for internal events, we did not feel comfortable estimating external event uncertainties because of the paucity of data and immaturity of the methodology. External event analysis as applied to PRA is in its infancy. We commend the IPPSS for attacking this difficult problem, a problem which the vast majority of other PRAs did not include within their scope. However, the IPPSS external event data and the mathematical models, as well as the alternate data and models we used in this review, are somewhat simplistic. 5.2.4 Sensitivity Issues Presented below is a summary of the results of sensitivity analyses for selected issues. 5.2-17
Issue Results
- 1) No feed and bleed (Section IP-2 4.3) -
"Early core melt with containment cooling" plant damage state increased by
~40%.
IP-3 "Early core melt with containment cooling" plant damage state increased by
~20%.
- 2) Core melt /systen intticaction IP-2 and IP (Section 4.4) -
"Lete core meTt with con-cainment cooling" sequences i
become " late core melt with-out containment cooling" sequences. The frequency of the latter is assessed at 1 x 10-4/Ryr.
- 3) Reactor Coolant Pump Seal IP-2 LOCA (Section 4.5) -
Assuming a RCP LOCA does not eccer yields: , a) 9 x 10 "Early core melt with containment b) cooling" 6.2 x 10 "Early core melt without containment cooling" c) 1 x 10 " Late core melt with containment cooling" Assuming a RCP LOCA may occur and giving credit for the IP-2 fire modification (see 2.7.4) yields: a) 1.7 x 10 "Early core melt with containment cooling" b) 6.3 x 10 "Early core melt without containment cooling" c) 1 x 10 " Late core melt with containment cooling" l .I 5.2-18
IP-3
- Assuming a RCP LOCA does not occur yields:
a) 3.8 x 10 "Early Core Melt with containment b) cooling" 6.6 x 10 "Early core melt without containment cooling" c) 1 x 10 "La te core melt with containment - ' cooling"
- Assuming a RCP LOCA may occur and giving credit for the IP-3 fire modification (see 2.7.4) yields:
a) 2 x 10 "Early core melt vlth containment. cooling"
'o ) S x 10 "Early core nelt without containment cooling" ,
c) 1 x 10 " Late core melt with containment cooling"
- 4) Nonimplementation of seismic IP-2 and fire modification at - "Early core melt without con-IP-2 and fire modification tainment cooling" frequency at IP-3 (Section 2.7.4 for increases by a factor of 3.8 fire and via discussions to 1.2 x 10-3/Ryr.
with Jack R. Benjamin Assoc. for seismic) - Other NRC defined damage states remain unchanged. IP-3 ' - "Early core melt without containment cooling" fre-quency increases by a factor of 5.8 to 3.8 x 10-4/Ryr. l
- Other NRC defined damage states remain unchanged.
5.2-19 l
J Distribution: USNRC Distribution Contractor (CDSI) 7300 Pearl Street Bethesda, Maryland 20014 Copies for 9E, GF 25 Copies for NTIS D. M. Kunsman Science Applications, Inc. 505 Marquette NN Suite 1200
- Albuquerque, New Mexico 87102 Dr. J. W. Reed '
Jack Benjamin & Associates ; Mountain Bay Plaza 444 Castro Street
. Suite 501 i Mountain View, California 7223 R. R. Prairie 7223 R. G. Easterling (2) 7223 A. D. Swain 9400 A. W. Snyder 9410 D. J. McCloskey 9411 P. R. Bennett 9411 S. W. Hatch i 9412 J. W. Hickman (25) 9412 N. L. Brisbin 9412 W. R. Cramond 9412 F. T. Harper
- 9412 A. M. Kolaczkowski 9412 G. J. Kolb (5) 9412 A. C. Payne 9412 R. G. Spulak 9412 T. A. Wheeler 9414 G. B. Varnado i
9414 D. L. Berry 9414 G. A. Sanders 9415 D. C. Aldrich 9415 D. E. Bennett 9442 W. A. von Riesemann 9442 R. L. Woodfin 8214 M. A. Pound 3141 L. J. Erickson (5) 3151 W. L. Garner (3) For DOE / TIC (Unlimited Release)
i I APPENDIX A l i i REVIEW 0F THE , INDIAN POINT PROBASILISTIC SAFETY ST3JDY SEISMIC, FLOODING, AND WIND , c ' by John W. ReeJ l Martin W. ikCann, Jr. i I l l Prepared for Sandia National Laboratories Albuquerque, New Mexico November 15, 1982 l l 1 ( l A-1 l
REVIEW 0F INDIAN POINT PROBABILISTIC SAFETY STUDY TABLE OF CONTENTS PAGE 1.0 INTR 000CTICN............................................. 1-1 2.0 OVERALL METH000 LOGY...................................... 2-1 3.0 REPCRT SECTIONS.......................................... 3-1 7.2 Seisaic.......................................... 3-2 7.2.1 M e t ho do l o gy . . . . . . . . . . . . . . . . , . . . . , . . . . . . . . . . . . . . . . 3-4 7.2.2 Seismicity....................................... 3-4 7.2.3 Fragi11ty........................................ 3-8 7.2.4 Indian Point Unit 2............................ . 3-10 7.2.5 I n di an Poi n t Uni t 3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-15 7.4 F l oo d i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-20 7.4.1 External Flooding................................ 3-22 7.4.2 Internal Flooding................................ 3-25 7.5 Winds and Wind Induced Missiles.................. 3-30 7.5.1 Wind Events...................................... 3-32 7.5.2 Tornado Missiles and Winds on Concrete Structures............................ 3-32 7.5.3 Tornado Missiles and Winds on Metal Structures............................... 3-33 7.5.4 I ndi an Poi nt Uni t 2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-36 7.5.5 Indian Point Unit 3.............................. 3-39 7.9.1 Dames and Moore Sei smicity Study. . . . . . . . . . . . . . . . . 3-42 7.9.2 Woodward Clyde Seismicity Study.................. 3-46 7.9.3 Scructural Mechanics Associates, Inc. Fragility Study................................ 3-54 iii
JBA 106-020-01 TABLE OF CONTENTS (Continued) PAGE 7.9.4 Structural Mechanics Associates, Inc. Damage-Effective Ground Acceleration............ 3-98 7.9.5 Research Triangle Institute Report Windspeed Risk Analysis of the Indian ) Poi nt Nucle ar Generating Station. . . . . . . . . . . . . . . 3-102 1 I i 8.3.4 Identification of Mejor Scenarios, Systems ; and Structures Contributing to Risk - l Indian Point 2...... .......................... 3-111 8.3.5 Identification of Major Scenarios, Systems, l and Structures Contrib7 tin", to Risk - 1 Indian Point 3......................... ....... 3-113 ; 4.0 SEISMIC HAZARD ANALYSIS................................... 4-1
5.0 CONCLUSION
S AND RECOMMENDATIONS........................... 5-1 APPENDIX A - Review of Ronald L. Street APPENDIX B - Review of Erik H. Vanmarcke APPENDIX C - Review of Larry R. Russell l l i iv
i l I 1
- 1. INTRODUCTION I
; Jack R. Benjamin and Associates, Inc. (J8A) was retained by Sandia National Laboratories (Sandia), Albuquerque, New Mexico, to perform an in-depth review of the following sections of the Indian Point Prchabilistic Safety Studt (referred to as the IPPSS report), prepared for Consolidtted .
Edison Lo. of New York, Inc. (owner of Unit 2), and the Power Authority of the State of New York (owner of Unit 3), Copyright 1982.
! 7.2 Seismic
- 7.4 Flooding 7.5 Winds and Wind Induced Missiles 7.9.1 Dames and Moore Seismicity Study 7.9.2 Woodward-Clyde Seismicity Study -
7.9.3 Structural Mechanics Associates, Inc., Fragility Study 7.9.4 Structural Mechanics Associates, Inc., Damage Effective Ground Acceleration 7.9.5 Research Triangle Institute Extreme Wind Analysis 8.3.4 Identification of Major Scenarios, Systems, and Structures l Contributing to Risk - Indian Point 2 (Seismic and Wind) 8.3.5 Identification of Major Scenarios, Systems, and Structures Contributing to Risk - Indian Point 3 (Seismic and Wind) These sections present the results of the analysis for Units 2 and 3 for seismic, flooding, and wind external events, and flooding internal events. Both the development of hazard and fragility curves as well as the integration leading to unconditioned core melt and release category frequencies were reviewed. As an aid in the review, a seismic hazard model was developed to l investigate the assumptions of varying the parameters leading to the frequency of occurrence of ground motior,. Considerable interest concerning the effects I of a postulated Ramapo fault zone has been expressed by the various 1-1
i 4 l ! reviewers. As an aid during the review in determining the impact of a Ramapo j fault zone, seismic hazard analyses were conducted for a range of assumptions. l } As part of the review, a meeting was held with Pickard, Lowe, and Garrick l
- (PLG), who prepared the IPPSS report, to discuss questions which arose from the review. At the first session the seismic and flood analyses were dis-
} cussed. Woodward-Clyde Consultants (WCC) and the engineer who performed the analysis for Dames and Moore (D&M) represented PLG in the area of seismic { hazard curve development. Structural Mechanics Associates (SMA), who was the seismic fragility censultant, also participated in the meeting. Pickard, Lowe, and Garrick performed the flood analysis themselves. At the second session of the PLG meeting, the analysis for the effects of ; j wird was disco: sed. Research Triangle Institute, who developed the hazard l
- curves for hurri ane and extratropical winds, and tornado, were represented.
The fragility curves for wino loading were developed directly by PLG. In addition to attending the PLG meeting, Dr. John W. Reed and Dr. Martin l W. McCann of JBA visited the Indian Point site and spent one day each tcuring ] i tne Unit 2 and 3 plants. The purpose of the visit was to acquaint :he
. reviewers with the plants end the safety-related equipment and structures.
4 Dr. Reed directed the review of the IPPSS. Dr. McCann assisted in the review concentrating primarily on the seismic hazard analysis and the analysis for 4 flooding. Subsequent to the 19 July 1982 draft of this report, PLG prepared a j response to the review coments (Ref.1)* and a meeting was held on 13 October
- 1982 in Albuquerque, New Mexico to discuss the critical issues. We have T
]. incorporated consideraton of PLG's response into this report. Since the draft report, a revised analysis was performed by PLG for Unit 2, wherein the impact
- between the Unit 1 and 2 control room roofs was eliminated by a planned modification. Reference 2 gives the results of the revised analysis. In
- support of this analysis, Reference 3, which gives the basis for the revised capacity for the Unit 2 control room, was prepared. We performed a cursory
. review of this report and generally concur with the revised fragility values.
i i
- References for Chapter 1 are given at the end of the Chapter.
1-2 b
The revised analysis was considered in our review comments given in this report. As discussed in subsequent sections, we feel that the capacity of the Unit 2 control room ceiling has the same problems as the ceiling for Unit 3. Thus, we feel that the revised frequencies for Unit 2 are low. As part of the recent USNRC program to investigate the seismic capacity of Aur.iliary Feedwater (AFW) systems, the licensee of Indian Point 3 responded with a report addressing the seismic qualification of the AFW system (Ref. 4). This report identified components which have not been seismically quali-t ied to the SSE ine1. A review sponsored by the USNRC concluded that the AFW system at Indian Polnt 3 cannot withstand an SSE (ref. 5). We performed a , curscry review of References 4 and 5. We doubt that the capacity of the conocnents, which included piping, values / actuators, power supplies, initiation / control systems, and structures have as low a capacity as concluded in Reference 5. kowever, we have not performed an independent revieu. Ve believe that the potential weaknesses raised by Referer.ces 4 and 5 should be investigated and accounted for in the IPPSS. A stuoy to determine the effects of interactions between seismic and . nonseismic equipment on seismic core melt within the AFW system was also conducted (Ref. 6). We have also performed a cursory review of this study. We have not checked in detail the fault trees or calculations leading to the frequency of core melt. Our judgment is that the basic elements of the study are complete; however, we did not confirm that the results are accurate. The effects of failure of nonseismic equipment were found by PLG to be small for the frequency of core melt. The capacity values for the nonseismic equipment were based largely on engineering judgment. The median capacity values given appear to be reasonable; however, we were unable to check them directly. Three consultants to JBA provided additional review of the IPPSS report. Professor Ronald L. Street reviewed the development of the seismic hazard curves from the seismologist's viewpoint. Professor Erik H. Vanmarcke also l reviewed the seismic hazard curves. Dr. Larry R. Russell performed the review of the hurricane hazard curves. Reports from the three consultants are included as appendices to this report. l 1-3 l
The remaining chapters in this report discuss the review of the overall methodology, provide review of specific IPPSS report sections, discuss our seismic hazard analysis, and end with the final conclusions of the review and reconmendations. These chapters are entitled:
- 2. Overall- Met hodology
- 3. Report Sections 4 Seismic Ha:n.rd f.nalysis
- 5. Conclus1ons and Reconinendations The remaining sections "# thit chapter descrite the approach used to review the IPPSS report and present the results of a sensitivity study which was conducted to gain insight into tha seismic hazard and fragility curves.
In order to avoid confusion in reading inis report, the chaoter sections are rot nun:bered. The figures, tables, and references are each r. umbered consecutively in each chapter. In cen!.rast, sections, figures, tables. l references, and pages of the IPPSS report have a decimal (or sometimes dashed) numbering systen. By organizing the review report in tnis manner, references to the locations of material in the IPPSS report and in this report are more obvious. REVIEW APPROACH A dual approach was used to review the IPPSS report. One part consisted of systematically reading, reviewing, and commenting on the sections of the IPPSS report. In the second part, the review consisted of a continuous search for the parameters, assumptions, etc., which controlled or contributed signif-icantly to the results of the analysis. As part of this effort, a sensitivity study for the seismic effects was conducted to determine how the mean frequency of release category 2RW changes as the relationship between the hazard and fragility curves is varied. Using this procedure, structures and equipment which contributed significantly to the frequency of 2RW were identified. Our review concentrated more heavily on the major contributors. 1-4
Comments concerning the integration of the wind hazard and fragility curves are made for IPPSS Section 7.5. The Seismic Safety Margins Research Program (SSMRP) being conducted by the Lawrence Livermore National Laboratory (LLNL) for the U.S. Nuclear Regulatory Commission (USNRC) is currently developing a crocedure for estimating the risk of an earthquake-caused radioactive release from commercial nuclear power plants. Zicn Nuclear Generation Station has been used as a nudel facility for the development of the SSMRP methodology. Ve have utilized the results which have been published to date for the SSMRP in our review of the IPPSS report. - It shoulc be roted that the engineers who contributed to the develepnea of fragility data for the SSMRP are the same professionals who performed the fragility analyses for the IPPSS report. In this sense, the results of the I SSMPP are not an independent comparison of the IPPSS results. Howe /er, numerous detailei analyses of the structures and prooabilistic sensitivity studies have been performed in the SSMRP, which provida aa independent indication of the appropriateness of some of the assumptians made in the IPPSS study. . In our review, we have attempted to make comments on both minor and major issues, looking for both conservative and unconscrvative assumptions. In order to help the reader and to maintain perspective ourselves, we have tried to indicate, where possible, the ultimate impact of the issues which we have raised. As an aid in doing this we have selected the mean frequency of core melt or the important release categories as the basis for comparison. We have adopted the following scale to quantify our comments in reviewing the IPPSS report: Effect on Mean Frequency Comment of Consequences or Core Melt Small Factor < 2 Moderate 2 < Factor < 10 Large Factor > 10 1-5 l _ -. _- --
We have indicated in our report in several places where effects of changes in parameters will have a greater effect on the tails of the frequency of core melt or release category density functions. In general, we expect a greater impact on the tails as compared to the mean frequency; however, we feel that the mean frequency is a more important parameter in the IPPSS study. SENSITIVITY ANALYSIS FOR SEISMIC EFFECTS In order to understand how changes in the analysis parameters might affect the mean frequency of release category 2RW, we integrated the hazard and , fragility curves using the same discrete probability distribution procedure i used in the IPPSS report. The mean frequency values given in the IPPSS report for 2RW are 1.4 x 10-4 per year for Unit 2 and 2.4 x 10-6 per year for Unit 3, which were used for comparison. The hazard curves from IPPSS report Sections 7.9.1 and 7.9.2 were used in the sensitivity analysis. The relative weights which were assigned were the same as used by PLG (see discussion for IPPSS report Section 7.2). The fragility curve values for release category 2RW were obtained from Table 7.2-4 for Unit 2 and Table 7.2-8 for Unit 3. The purpose of the sensitivity study was to determine the differences between the D&M and the WCC seismicity curves and to investigate the effects of shif ting and truncating the curves. The D&M curves were shifted by a f actor of 1.23 (this was done to convert from peak ground acceleration to damage-effective ground acceleration) and truncated for assumed upper-bound cutoff values (see discussion for IPPSS report Sections 7.2 and 7.9.4). The WCC curves developed in Section 7.9.2 were based on a damage-effective ground acceleration parameter and were also similarly shif ted and truncated. (See discussion for IPPSS report Sections 7.2 and 7.9.2.) The results of the sensitivity analysis are presented in Table 1. The combined results for the shifted and truncated curves at the bottom (0.8 x 10-4 for Unit 2 and 1.6 x 10-6 for Unit 3) should be the same as the IPPSS results for Units 2 and 3. We believe that the difference is due to the ' procedures used to perform the integration and the coarseness of the hazard 1-6 l .
I 4 and fragility data points. In addition, there probably is some difference due to the lumping of curves done in the IPPSS analysis (Figure 7.2-4 does not replicate the seven D&M curves from Figures 7.2-1 and 7.2-2 and the four WCC curves from Figure 7.2-3). In some sense, the difference in the results represent an analysis procedure error or uncertainty. In general, we believe that the data points for the hazard and fragility curves in the IPPSS are too coarse. A more refined set of points should be developed. We note that the difference between the modified and unmodified results (i.e., unshifted and untruncated to shifted and truncated) are more signifi-cant for Unit 3 than Unit 2. In the integration for Unit 2 the mean value for 2RW release category is dominated almost entirely by the failure of one component with a median capacity of 0.27g, which is generally within the body of the hazard curves (which is more true for the D&M curves). In contrast, the difference is much larger for Unit 3. The median fragility capacity for this plant is approximately 0.8g which is at the upper tail of the hazard curves. For Unit 3 the results are dominated by uncertainty and depend on the upper-bound cutoff values for the hazard curves. Several conclusions can be made based on the results of the sensitivity ; analysis.
- 1. The mean frequency of release category 2RW for Unit 2 is greater by a factor of approximately 12 between the D&M and the WCC shifted and truncated hazard curves (i.e., 1.5 x 10-4 per year compared to 1.3 x 10-5 per year). These are the curves ultimately used in the IPPSS analysis. Note that for Unit 3 the difference is about a factor of 1000. The reasonableness of this result is discussed for IPPSS report Section 7.2. Based on this study, it is clear that the WCC hazard curves are significantly different from the D&M curves.
- 2. For the D&M hazard curves the difference between the unshifted and untruncated results and the modified results is a factor of less than 2 for Unit 2 and slightly over 3 for Unit 3. The low factor for Unit 2 is because the median fragility value of 0.279 for Unit 2 is well l-7
i 1 away from the upper-bound cutoff values. For Unit 3 the effective l pedian fragility value of 0.8, is at the upper limit of the cutoff :
- values. Note that plots of the hazard curves are given in IPPSS Figures 7.2-1 through 7.2-4 I
- 3. For the WCC hazard curves, the difference between the unshifted and untruncated results and the modified results is a factor of 13 for Unit 2 and a f actor of almost 500 for Unit 3. The high factors for both units are because the median fragility values are at or above the upper-bound cutoff values.
4 The difference between the shif ted and truncated combined results (which are the basis for the final values given in the IPPSS report) for Units 2 and 3 is over two orders of magnitude. The reason is due to the effective capacity for Unit 2 being 0.279 and for Unit 3 being 0.8g. ]; 1 I The experience we gained in these analyses was used in estimating the effects of potential changes of individual parameters of the safety-related structures and components, and to judge the adequacy of the hazard analyses. References i a
- 1. Pickard, Lowe and Garrick, " Response to Sandia Letter Report of )
September 1,1982, on the Indian Point Probabilistic Safety Study," ! October 1, 1982.
- 2. Letter to S. A. Varga, USNRC, from J. D. O'Toole, Consolidated Edison Company of New York, dated October 8, 1982.
- 3. Structural Mechanics Associates, " Indian Point Unit 2 Control Building Seismic Improvement Analysis," prepared for Pickard, Lowe and Garrick, SMA 12901.03, August, 1982 4 Bayna, J. P., Power Authority of the State of New York, Letter to D. !
G. Eisenhut of U.S. Nuclear Regulatory Commission, August 28, 1981. I 1-8
- . . . . _ _._. - . - - - - - . . . . _ _ _ - ~ _ . _ - .. . .-
4 ll
'l
- 5. Rowsome, F., Seismic Qualification of the IP Unit 3 Auxiliary Feedwater System, Internal U.S. Nuclear Regulatory Commission Note, October 12, 1981.
- 6. Pickard, Lowe and Garrick, Inc., " System Interaction Study of the 4
Auxiliary Feedwater System Indian Point 3 " Prepared for Power Authority of the State of New York, Preliminary Draft, not dated. i .1 4 1 a l 1 i I i r 1-9
_ - - . =_ - - - . - . -. _ . . . - - . _ . - .-. . -. I 1 , I i TABLE 1 i RESULTS OF SEISMIC SENSITIVITY ANALYSIS Mean Frequency, Release Category 2RW (per year Category Unit 2 Unit 3 D&M
! Unshifted and Untruncated 2.6 x 10-4 1.1 x 10-5 l Shifted and Truncated 1.5 x 10-4 3.2 x 10-6 i
I WCC Unshifted and Untruncated 1.7 x 10-4 1.6 x 19-6 Shifted and Truncated 1.3 x 10-5 3.5 x 10-9 l l Combined Results Unshifted and Untruncated 2.2 x 10-4 6.2 x 10-6 Shifted and Truncated 0.8 x 10-4 1.6 x 10-6 IPPSS Results 1.4 x 10-4 2.4 x 10-6 4 i I 1-10
- - ~ _ _ _ - _ _ _ _ _ _ . _ - - - _ - . _ -_ .---
- 2. OVERALL METHODOLOGY l
A general discussion of the overall methodology used to obtain the probabilistic description of failure for earthquake, flooding, and wind is presentad. Specific comments on the IPPSS report sections are given in Chapter 3. The purpose of this chapter is to give general impressions of the adequacy of the procedures used. SEISMIC
> Our impression of the methodologies for seismic hazard and seismic fragility development used in the IPPSS is given below, j
Seismic Hazard The seismic hazard methodology employed in the IPPSS is appropriate and
' adequate to perform a seismic risk analysis. The procedure is based on a simple probabilistic model which uses some data, but currently relies heavily on engineering judgment. An important element of the seismicity studies conducted for the Indian Point site is the explicit treatment of the sources
( of variability in the analysis. The uncertainty in the analysis can be attributed to the limited data available on eastern U.S. seismicity and ground ! motion. This uncertainty is reflected in the final family of seismicity Curves. The two seismicity studies performed for the IPPSS clearly identify the f act that variability due to modeling assumptions, or uncertainty as defined in the seismic fragility analysis, can contribute significantly to the variability in the frequency of exceedance curves. In addition, the statistical variability due to limited data is also a significant contributor to the variability in the final f amily of seismicity curves. l In the last ten to fifteen years the procedures to conduct a probabilistic seismic hazard analysis have improved considerably and stabilized in their basic probabilistic format. However, it is equally well recognized that the l 2-1
analyst is allowed considerable discretion as to model selection (e.g., source areas, attenuation relations, f ault-rupture models, magnitude-Modified Mercalli Intensity relations, etc.) and assumptions in application. This allowance is considerably greater in evaluating the seismic hazard in the eastern U.S. The IPPSS is an example of this. In conducting seismic hazard analyses, seismicity data is generally collected from available catalogs. We note in the IPPS$ and in most applica-tions, that a detailed review of the data for accuracy of event sizes and locations is not made. A consequence of this has led us to conclude that inconsistencies can enter into the analysis. We suggest that a step be added to the seismic hazard analysis, particularly those relying on Modified Mercalli Intensity, that reviews the seismicity data, and, if necessary, includes an investigation of the details of critical earthquakes in the data base. The investigation should be made on the basis of state-of-the-art analysis tools and standards for assigning event size. An alternative of ten chosen to model the seismic hazard in the eastern U.S. is the use of Modified Mercalli Intensity (MMI) as the parameter to characterize the size of earthquakes and the intensity of ground. This approach was adopted in the WCC seismicity study. The differences in the two seismicity studies demonstrated in Chapter 1 led us to raise questions about the overall consistency of the studies. Note that the original seismicity data are essentially the same in the two studies. , We suspect that the use of intensity as a source parameter, to which a l peak ground acceleration is related, leads to results whose meaning cannot be entirely known. The reason for this is the fact that intensity, by 3 definition, is a measure of response of masonry buildings, tombstones, railroad tracks, the ground, etc. In each case of observed response, a
)
transfer function is implicitly involved which produces the result that is observed after the event. l Not surprisingly, efforts to later relate magnitude or peak acceleration to intensity, exhibit considerable scatter. The reason is because information is lost concerning the transfer of seismic energy in the form of ground motion to structure response. We feel that in a way not very well understood, 2-2 t
intensity-acceleration attenuations and intensity-magnitude relations are values smoothed by the complex response process of those structures considered in the intensity scale. As a minimum, the careful use of an intensity based approach is indicated. On a more broad scale the need for uniformity in intensity scales is apparent. Seismic Fragility The methodology used in the IPPSS report for seismic effects is appropriate and adequate to obtain a rational measure of the probability distribution of the frequency of core melt and associated release cate-gories. In the application of the methodology, we offer the following comments. The notion of separating variability into randomness and uncertainty components is an appropriate concept. Randomness by definition is irreducible while uncertainty in the parameters and models can be eliminated by analysis, testing, research, or combinations of these techniques. However, it is our experience that in practice these definitions become blurred. What is random-ness today may be uncertainty tomorrow. In other words, as the state-of-the-art advances, new techniques are developed which can be used to solve problems which yesterday were unsolvable. Even the classic example of the randomness of compressive stresses obtained from testing concrete cylinder samples may some day fall prey to an advanced analysis technique. Hence, knowing for certain the values of some obscure set of parameters (e.g., aggregate shape and location, cement properties, e.tc.), the compressive stress may be predicted almost perfectly. In reality, this may never occur, because today we have remaining such a small randomness component that there may not be sufficient incentive to pursue the development of a more refined theory. In the methodology used in the IPPSS report, the median capacity value is the only uncertain parameter. It should be kept in mind that there are other uncertainties associated with the methodology (e.g., randomness Sr, the lognormal model, and even S u i tsel f) . It is implicitly assumed that the variability in these other parts of the methodology, is relatively small so l 2-3 A ^ 4,
that their uncertainty can be neglected. Also, there is some evidence that variability may be constant with response level (Ref.1*). There are some who believe that all variability is uncertainty and the frequency of failure (fragility) curve for a component is equal to 0 up to some uncertain acceleration value and equal to 1 for higher values (i.e., the
" cookie-cutter" fragility curve). Others choose to think of variability as being all randomness. The IPPSS report has taken a middle road and considers both types to be present. The implication of how dependencies are affected by these two types of variability is discussed later in this report. We personally feel that generally it is more rational to have more uncertainty and less randomness for structural components subject to seismic ard other forces.
It is important that the indu'stry adopt a consistent approach to be applied to PRA analyses. In this manner, results between PRAs can be compared (e.g., " apples with apples"). It is naive to think that the answers we produce are absolute truth. The best we can do today is to be rationally consistent and to communicate to others exactly how our analyses are performed, so that the results can be compared in a relative sense. Af ter reviewing the procedures used to produce the fragility data, we have a general impression which bears on the issue of consistency. We feel that the uncertainty of the parameters in the IPPSS report has probably been understated. There are various levels of sophistication which have been used to develop the fragility parameter values, but we do not sense that enough uncertainty has been assigned to components where parameter values are based on more distant information. Although in fairness to the IPPSS report, the values for 8 u are generally larger for generic components as compared to plant specific components. We indicate in the discussion for the various IPPSS report sections where the uncertainty assignment may be low. On the other hand, we also believe that the median capacity values are probably low. Structural and mechanical engineers have an inbred tendency to l l
- References for Chapter 2 are given at end of Chapter.
2-4 _. - ^
be conservative, and our guess is that this tendency has persisted in develop-ing median capacity values. It is useful to remember that the median value is the value in which there is a 50 percent chance that the "true" value is larger. We suspect that over-conservatively stating the median values and understating the uncertainties is sufficiently self-compensating such that reasonable final results are still obtained. Several obvious elements of uncertainty have been left out of the seismic fragility analysis. First, design and construction errors (e.g., the problem of piping supports at Diablo Canyon) and aging effects are not included in the seismic fragility or fault tree analysis. These become extremely important issues for series systems such as piping systems and cables (i.e., cable trays). We noted for several sections which we reviewed that the authors did not check the calculations which formed the basis for the fragility parameters that were developed. Thus, errors in the calculations could not be discovered by PLG. In an approximate way the lower tail on the lognormal distribution for capacity accounts for possible errors. This is true since the capacity tail goes to zero which is not supported by reality. However, the frequency distribution for design and construction errors certainly varies from component to component. Since the lognormal tail is a function of only the capacity parameter, it may or may not properly account for these types of errors. Our conclusion is that design and construction errors are not specifically accounted for in the analysis. Another uncertainty (and bias in the median value) is created by the fact that structural components are not built to produce the maximum allowable stress. Construction practices often produce components which are stronger than needed. It is tempting, but incorrect, to say that design and construc-tion errors can be balanced by overconstruction such that these effects in total can be neglected. We feel these considerations individually should be taken into account in the systems analysis. l In the IPPSS report the weakest part of a structure or equipment was used ! to develop fragility values. In general, this approach is satisfactory. It should be pointed out that it is possible for a slightly stronger part to 2-5 L. . .
produce a greater frequency of failure. This occurs if the variability of the stronger component is large enough to overcompensate for the weaker but less variable part. Thus, it is not always sufficient to consider just the weakest part. Slightly stronger parts should also be reviewed and disregarded if their variability is found to be relatively small. One approach used to develop fragility curves was based on analysis of generic data. Rather than working with the analysis of a plant specific component, failure and/or response data from similar components in similar environments are used as the basis to develop a fragility curve for the particular plant component being considered. We feel this procedure is appropriate under certain circumstances. If after determining the fragility of a particular plant component using generic data it is found that the capacity is sufficiently high so that the component does not influence the release category analysis, then we feel the use of generic data is appropriate. On the other hand, if the component is found to have a low capacity such that it significantly influences (or could if changed by a small amount) the frequency of core melt analysis, then a more detailed analysis for that component should be conducted. In the IPPSS, one component in this category for the current seismic failure analysis (i.e., other components may become critical if the strength of critical components are changed) is the diesel generator fuel oil tank for Unit 3. This component, along with the control building N-S shear walls, contribute significantly to the failure frequency for Unit 3. Other components in this category are identified in the review of Section 7.9.3. We feel that because the capacities of these components are low, more detailed analyses should be conducted to verify that the generic-based capacities are appropriate. l It is important that median parameter values be selected to give frequency of behavior (i.e., failure, capacity, response, etc.) at acceleration values which are significant to the frequency of core melt analysis. In the integra-tion of the hazard and fragility curves, the major contribution to the mean , frequency of core melt will generally come from a specific range of acceleration values. For example, in developing the median factor for damping, the stress level in a structure for this range of accelerations 2-6 j I i L , m x
should be taken into account in selecting the structure damping value. If the stress level in a structure is less than yield, then 3 percent may be appropriate, or if yield level is reached,10 percent may be more represen-tative. This is particularly important for equipment items which have natural frequencies close to a fundamental building frequency. Based on the discussion at our meeting with PLG, it is our understanding that the yield level of the structures is below the yield level for the safety-related equipment supported in the structures. Thus, it is appropriate to use damping values for a structure corresponding to the yield level. One assumption implicit in the methodology is that everything occurs at once, and no phasing of events is considered. Structures and components either f ail or do not f ail at the same instant in time. For ductile struc-tures, the loading sequence is less critical compared to the maximum load or number of cycles of large motion. For brittle elements, the loading sequence is more important. There is a dependence between the loading and response in reality, because structures f ail sequentially leading to many possible f ailure histories. We wonder how this process might be applied to electrical control functions and the interaction of electrical equipment functional failures with f failures of structural elements. As reviewers, there is one area which is missing from the IPPSS report which should be part of all public documentations of PRA studies. Results of sensitivity calculations should be performed to provide the reader with an understanding of what elements control the results of the analysis. For example, how sensitive is the frequency of core melt to the upper-bound earth-quake magnitude cut-off? What would happen to the mean frequency of core melt if the median acceleration capacity of the control room failure for Unit 2 was one-half of the computed value? As discussed in our introduction chapter, we have attempted to do this to a small degree to assist us in our review. We feel that the results of sensitivity studies should be provided as part of all basic PRA documentation. I In our review of the IPPSS report, we spot-checked calculations which could easily be done as we read the report. We also performed sensitivity studies of the hazard and tragility curve integration (see Chapter 1). In 2-7
l addition we reviewed the calculations for dominant components as part of our review of Section 7.9.3. However, we did not perform independent calculations or check the original design computations. As a result of our tour of the Indian Point Site, we question whether the IPPSS has considered all possible failures of non safety-related structures or equipment, which could impact on safety-related items. The IPPSS has included, for example, possible failure of the stack, superheater building, and the turbine building onto the Unit 2 control building for seismic loads, i It was pointed out during the tour that the nitrogen bottles in the Unit 3 AFW pump room could fail and the released gas propel them into safety-related control cabinets. This type of secondary failure was not considered in the original analysis; however, as discussed in Chapter 1, it was considered as part of a recent study of the effects of nonseismic equipment within the AFW system. Another possibility which was not documented in the IPPSS report is potential failure of the polar crane structures in the containment buildings and possible failure onto equipment below. We believe that a systematic study should be conducted to identify and quantify the effects of all possible secondary failures throughout the entire plant which could affect safety-related structures and equipment. One area which we have not commented on concerns the adequacy of the fault and event trees, except we question the absence of consideration for a moderate size earthquake occurring during a time when some safety-related components may not be available due to maintenance procedures, etc. Our understanding is that Sandia will make comments in this area. Thus, for the purposes of our review, we accept the fault trees given in the IPPSS report. .l In addition, Sandia has reviewed these trees and has determined that the safety-related components which are included are complete. Based on the fault trees presented in this subsection, we checked the Boolean algebra and l determined that the final expressions for core melt and the various release categories are correct, except as noted. 2-8 m - -
FLOODING The possible contribution of flood events to a core melt frequency have been evaluted in the IPPSS for external and internal flood sources. The methodology employed for external flood hazards is a departure from the analysis conducted for other external events such as seismic, hurricane and tornado. The method is somewhat ad hoc in the sense that a complete proba-bilistic hazard assessment was not conducted (i.e., uncertainty in key parameters was not considered, and a f amily of flood elevation hazard curves was not produced.) Although the state-of-the-art in flood hazard assessment is sufficiently developed to conduct such an analysis, external flooding in the IPPSS is not treated as thoroughly in a probabilistic context as other external events. An outline of a procedure to perform a flood hazard assessment is provided in Reference 2. We do not agree with the methodology applied in the IPPSS to evaluate external flood hazards at the site. The approach provides point frequency estimates for single events and event combinations rather than considering a full complement of event sizes, parameter values, and joint occurrence of events. Therefore, at a given frequency of exceedance the uncertainty in flood depth cannot be evaluated, nor can the probability distribution on fre-quency. We recognize that a reason for this is due in part to the traditional approach taken in hydrology in which extreme flood events are related to the probable maximum flood (PMF). Typically, such an approach does not evaluate an annual frequency of the PMF, nor does it consider the variability in key parameters. The uncertainties in estimated frequencies of hydrologic events (e.g., river discharge, flood profiles) are generally considered to be large (Ref. 2). Unlike other external hazards, flood events can be screened to determine whether their occurrence is possible. A screening approach can also be extended to probabilistic evaluations to assess whether the event is a l potential contributor to plant risk. The IPPSS has not conducted such an ( l analysis. In our judgment a flood hazard analysis should be conducted that accounts for modeling variability and the variability in key parameters of the flooding process. 2-9 i
An analysis was conducted to consider the impact of internal floods on safety-related equipment and the frequency of core melt analysis. We agree with the steps performed in the analysis. However, the steps are not given in the IPPSS but were provided at the meeting with PLG. We recommend that the methodology and procedures applied be described in the IPPSS report. The steps used, follow the recommendations in Reference 2; however, there are differences in the mechanics of conducting the analysis. In future PRAs we would recommend the use of a more systematic approach, such as recommended in Reference 2. An internal flood analysis was conducted for Unit 2. An assumption was made that similarities in the design of Units 2 and 3 allow the analysis to apply to both units. To fully accept this assumption, consideration should be given to such f actors as age, temporary floodway blockages, changes in plant structure, etc. In general, we agree with the conclusions of the analysis that any flooding damage will be localized and will not result in a plant transient. WIND Our impression of the methodolgies for wind hazard and wind fragility used in the IPPSS is discussed in the following sections. Wind Hazard Extreme winds were categorized as tornados, hurricanes and extratropical cyclones and thunderstorms. Hazard curves were developed for each category. The hazard results for extratropical cyclones and thunderstorms were combined I with the hazard results for hurricanes. In the IPPSS analysis it was assumed that these wind hazards are statistically independent. Comments concerning the methodology for the three wind types are given below. Tornado: Hazard functions were developed specifically for the site. Although, hazard curves could have been developed for specific structrees or group of structures, we believe that in regard to the state-of-the-art it is adequate to only develop site specific data. 2-10
In our comments for Section 7.9.5 we feel that the procedure used to determine the mean rate of tornado occurrence for the Indian Point site produced frequency values on the conservative side. We found in performing an approximate hazard analysis that reasonable differences in the wind speed, ' tornado length and width values, and other physical parameters did not cause a large change in the results. This gave us a sense of confidence that the distribution of tornado wind occurrence at the site is reasonable. We do not agree with the methodology used to develop the probability dis-tribution of hazard curves. The approach used in the IPPSS was to identify lower, median, and upper bound values for each of the basic parameters. Then three hazard analyses were conducted with the corresponding three parameter sets. The results for the lower- and upper-bound parameter sets were assumed to define the 5th and 95th windspeed percentiles, respectively. We believe that this approach is arbitrary and does not lead to a believable probability distribution. We recommend that a stratified statistical sampling procedure be used with multiple hazard analyses to develop a probability distribution for the tornado hazard curves. Hurricane: We generally concur with the methodology used to develop hurricane wind ' speed hazard curves. The methodology rigorously considers the various basic parameters pertinent to the problem. However, because the methodology does not account for the complex surf ace conditions which exist at Indian Point or the potential wind channelization by the local hills and river valley we believe that the frequencies of occurrence are low. The probability distribution of hurricane hazard curves was developed in the same manner as for tornados. Our coments concerning the methodology used to develop the probability distribution of hazard curves for tornado are also applicable to the hurricane analysis. In sumary, we do not believe the resulting hurricane probability distribution, and we recommend that a more consistent and rigorous approach be used. Extratropical Cyclone and Thunderstorm Risk: The probability distribution ! of annual maximum gust speeds of fully-developed pressure system storms was j approximated by the Fisher-Tippett Type I distribution. The data from the l t.aGuardia station, which is about 50 miles from the Indian Point site, were 2-11
I used to develop the statistics of the wind speed distribution. As we noted in the review, new data from Reference 3 indicate that the wind speed used in the IPPSS may be low by about 10 percent. We do not feel this.is potentially serious since hurricane hazard / fragility curves tend to be more important to the risk of offsite consequences. The procedure leading to the distribution of hazard curves is based on the sampling error for the 31 observations comprising the LaGuardia data set. We feel that part of the uncertainty, which was not accounted for, is due to the f act that the Indian Point site is about 50 miles from the observation station. We judge that the distribution at Indian Point is different from La Guardia due to terrain roughness effects. Wind Fragility We believe that the methodology used to develop the fragility curves for tornado and hurricane wind speeds and tornado missile impact is not adequate. The basis for our position is given below. The wind speed hazard curves for tornado and hurricane were based on the original design capacity and design charts given in American National Standards Institute (ANSI) Standard 58.1 (Ref. 4). The approach used to obtain lower , median , and upper-bound curves was to consider variations in j terrain conditions and return period wind speeds. Also included was the effects of wind speed variation with height. We believe that the wind speed return period variation is related to the hazard functions not the fragility data. More important than the variation of wind speed with height is the effect of building shape and adjacent structures on the wind loading. Our view is that variation due to these effects are extremely important and have not been properly considered in the analysis. We are particularly concerned ' with possible f ailure of the metal structures starting with the tearing of ( roofing or siding at a corner where the suction coefficient can be as high as 2 or 3. The best way to include these spatial effects is through a boundary layer wind tunnel study of the Indian Point site. As a minimum, the very large uncertainty in the shape f actors should be systematically included in the analysis. More discussion concerning this issue is given in our review of IPPSS Section 7.5. 2-12
1 The fragility due to tornado missiles was developed based on the conser-vative assumption that if a missile hits a structure, f ailure occurs. This implicity assumes that the missile will penetrate the structure, strike the safety-related item, and cause f ailure. Our problem with the methodology is that the tornado strike fragility curves were not developed considering the potential missile population and the probability of strike given a tornado at the site. Instead an argument was made based on the speed required to lif t a missile off the ground. As discussed in our review of IPPSS report Section 7.5, we determined that the resulting mean frequency of impact is reasonable. However, we do not agree with the methodology leading to the development of the frequency values. The probability distribution for capacity due to wind speed and tornado strike also is not acceptable since the methodology does not properly account for the randomness and uncertainty in a systematic manner. References
- 1. Johnson, J. J., G. L. Goudreau, S. E. Bumpus, and O. R. Maslewikov,
" Phase I Final Report SMACS--Seismic Methodology Analysis Chain with Statistics (Project VIII)," Seismic Safety Margins Research Program, Lawrence Livermore National Laboratory, Livermore, California, NUREG/ CR-2015, Vol. 9, UCRL-53021, Vol. 9, September 1981.
! 2. "PRA Procedures Guide," prepared by ANS and IEEE for USNRC, NilREG/CR-2300, Review Draft, September 28, 1981.
- 3. Changery, M. J., " Historical Extreme Winds for the United States -
Atlantic and Gulf of Mexico Coastlines," prepared for U.S. Nuclear Regulatory Commission, NUREG/CR-2639, May,1982.
- 4. American National Standards Institute, Inc., " Building Code Requirements For Minimum Design Loads in Buildings and Other Structures," ANSI A58.1-1972.
2-13
1
- 3. REPORT SECTIONS i The sections of the IPPSS pertaining to the analyses for seismic, flooding, and wind were reviewed. Specific comments for the following sections are given in this chapter.
7.2 Seismic 7.4 Flooding 7.5 Winds and Wind Induced Missiles 7.9.1 Dames and Moore Seismicity Study 7.9.2 Woodward-Clyde Seismicity Study 7.9.3 Structural Mechanics Associates, Inc., Fragility Study 7.9.4 Structural Mechanics Associates, Inc., Damage Effective Ground Acceleration 7.9.5 Research Triangle Institute Report Windspeed Risk Analysis of the Indian Point Nuclear Generating Station 8.3.4 Identification of Major Scenarios, Systems, and Structures Contributing to Risk - Indian Point 2 (Seismic and Wind) 8.3.5 Identification of Major Scenarios, Systems, and Structures Contributing to Risk - Indian Point 3 (Seismic and Wind) l l I l 3-1 1
i. SECTION 7.2 SEISMIC Scope of Review In this section, the effects of earthquake-induced loads are reviewed. Both seismic hazard and fragility information given in this section are discussed. Additional review comments concerning the hazard curves are given for IPPSS report Sections 7.9.1, 7.9.2, and 7.9.4 and comments concerning fragility curves are given for IPPSS report Section 7.9.3. The implications of discrepancies and differences that were found are discussed. The references which were considered in the review of this section are listed below, i References
- 1. Cornell, C. A., H. Banon, and A. F. Shakal, " Seismic Motion and Response Prediction Alternatives," Earthquake Engineering and Structural Dynamics, vol. 7, pp. 295-315, 1979.
- 2. McCann, M. W. and D. M. Boore, " Variability in Ground Motions: Root Mean Square Acceleration and Peak Accelerations for the 1971 San Fernando, California Earthquake," submitted to the Bull. Seims. Soc.
Am., 1982, i
- 3. Darragh, R. B. and K. W. Campbell, " Empirical Assessment of the Reduction in Free Field Ground Motion Due to the Presence of
- Structures," (Abstract), Earthquake Notes, 52, 1981.
9
- 4. Agnarwal, Y. P. and L. R. Sykes, " Earthquakes, Faults, and Nuclear Power Plants in Southern New York and Northern New Jersey," Science, vol. 200, pp. 425-429.
i i l 1 1 3-2 d
- 5. Yang, J. P. ana Y. P. Aggarwal, "Seismotectonics of Northeastern United States and Adjacent Canada," J. Geophy. Res., vol. 86, pp. 4981-4998, 1981.
- 6. Ratcliffe, N. M., " Brittle Faults (Ramapo Fault) and Phyllonitic Ductile Shear Zones in the Basement Rocks of the Ramapo Seismic Zones New York and New Jersey, and Their Relationship to Current Seismicity,"
Field Studies of New Jersey Geology and Guide to Field Trips, Rutgers University, Newark, New Jersey, 1980.
- 7. Statton, C. T., R. Ouittmeyer, M. Houlday, " Contemporary Stress and Fault Plane Solutions Inferred from Recent Seismicity in New York and New Jersey," presented at 54th Annual Meeting of the Eastern Section SSA, abstract to appear in Earthquake Notes,1982.
- 8. Kennedy, R. P., et al., " Subsystem Fragility," Seismic Safety Margins Research Program, (Phase 1), Lawrence Livermore National Laboratory, Livermore, California, NUREG/CR-2405, UCRL 15407, February,1982 (Prepared by Structural Mechanics Associates).
- 9. Letter to S. A. Varga, USNRC, from J. D. O'Toole, Consolidated Edison Company of New York, dated 8 October 1982.
- 10. Pickard, Lowe, and Garrick, " Response to Sandia letter Report of September 1,1982, on the Indian Point Probabilistic Safety Study,"
October 1,1982. 3-3
SECTION 7.2.1 METHODOLOGY l We agree that a seismic safety analysis consists of the five main steps which are listed in this section. I 1 SECTION 7.2.2 SEISMICITY ; This section of the IPPSS describes the seismicity studies conducted by Dames and Moore (D&M) and Woodward-Clyde Consultants (WCC) and the method used to combine the results of the two studies to provide a family of seismicity curves. The review of this section is limited to general comments about the method of analysis and tne development of the f amily of seismicity curves. Our review comments initially address the seismic hazard methodology, then the question of the Ramapo Fault, and finally the method of combining the results of the two seismicity studies. A review of each seismicity study is presented in the comments for Sections 7.9.1 and 7.9.2 which contain the D&M and WCC studies, respectively. The seismicity studies by D&M and WCC used the same seismic hazard metisodology to estimate the frequencies of exceedance curves on levels of ground shaking. The method is adequate and appropriate to perform a seismic risk analysis. The probabilistic format for conducting a seismic hazard analysis is generally accepted and at the moment quite stable. However, each study has selected different models to simulate the seismicity and the ground l shaking hazard near the Indian Point site. Certain of these aspects are discussed below. In the D&M and WCC studies, ground shaking is a function of the intensity i of the earthquake at the source and distance between the source and the site. Each study has used a different method to characterize the seismic source and thus applied different models to attenuate motion to the site. Modified Mercalli Intensity (MMI) data were used in each study to develop earthquake recurrence relationships. In the D&M study MMI values were converted to body wave magnitude (Mb ). Earthquake recurrence relationships and acceleration attenuation models were then described in terms of 3-4
magnitude. The conversion from MMI to Mb was made through an empirical relation developed by Nuttli. WCC on the other hand used MMI directly as the source parameter. An attenuation model was developed that attenuated epicentral intensity (Ig) with distance to obtain the site intensity (Is)* The site intensity was then converted to peak ground acceleration. The two approaches are quite comon, particularly for hazard analyses conducted for the eastern U.S. The difference between the studies is the path taken to determine sustained acceleration at the site. The choice of a source parameter and ground motion prediction model affects the degree of variability in the predicted acceleration level. As discussed in Reference 5, the effect of taking a direct versus an indirect path in making spectral response predictions can increase the total uncertainty in the estimate. The study demonstrates that the total variability in the ground motion parameter is dependent on the path taken in making a ground motion prediction. In the D&M study the path used is: Ig - Mb-A 3 while in the WCC study the path is: Ig 4 I -A-Ap 3 s where an arrow refers to an empirical relation, and Apis peak ground acceleration and A , the desired value of sustained acceleration. 3 In neither of the two studies was this source of variability included in the logarithmic standard deviation, in a, about the attenuation equation. In addition to the variability about a given regression equation, (e.g., I g - Mb ), there can also be considerable variability in the mean curve. This point was demonstrated in Section 7.9.2 by WCC for I g -M b relationships (see Figure 6 in Section 7.9.2). The actual impact of this source of variability was not evaluated as part of the IPPSS. The logarithmic standard deviation value used in each seismicity study was 0.60, which is a value typical of the variability in magnitude - distance regressions on peak ground acceleration. The effect of increased values of in a on the frequency of exceedance curves is demonstrated in Chapter 4 For an increase of 0.20 in the logarithmic standard deviations, the increase in the frequency of exceedance is within a factor of 3 for accelerations up to 0.70g. 3-5
We note that the above concern does not impact on the selection of acceleration truncation values, either for specific values or in the manner in which the truncation is carried out. The selection of truncation values is made by arguments independent of the path taken in making acceleration predictions. In the seismic hazard analysis, the variability in ground motion attenua-tion has been accounted for by a lognormal distribution with a standard deviation, in a, of 0.60, a value typical of the scatter in ground motion data. Recent studies suggest that in a is in reality a composite parameter whose components include travel path, building, and local geologic effects (Refs. 2 and 3). The variability due to buildings has been identified as a function of the depth of structural embedment. In the seismic risk analysis, soil-structure interaction effects and variability in response are considered. Since free-field accelerations are specified, it may be more appropriate to account for the part of randomness (not uncertainty) in the attenuation equation due to building effects in the soil-structure interaction fa ctor. The standard deviation corresponding to embedment effects, oBldg, was found to be approximately 0.07, corresponding to a factor of 1.2 for data from the 1971 San Fernando earthquake (Ref. 2). In the IPPSS, sofl-structure interaction does not affect the ground motion input level. In recent years considerable scientific study has led to a hypothesis that a Ramapo fault zone is an alternative hypothesis that should be considered in a hazard analysis of the southeastern New York area (Ref. 4, 5). Neither the D&M or the WCC study explicitly considered a Ramapo source. The issue of whether a Ramapo source should be included as an alternative hypothesis was reviewed on the following basis; first from a geologic and seismologic point of view, assessing whether the fault is in fact a source of earthquakes; and second in terms of the IPPSS what is the impact on plant risk of including a Ramapo source. We have concluded from results of recent studies, (Ref. 6, 7) that scientific evidence to support a hypothesis that the Ramapo fault is a source of earthquakes in the southeastern New York region cannot be strongly supported. These studies contradict previous results (Ref. 4, 5) that support such a contention. We have concluded that a reasonable probability weight 3-6
assigned to a Ramapo source hypothesis would be very low. We also note that both seismicity studies have attributed seismicity to the Ramapo f ault zone as part of larger source areas. Chapter 4 of this report investigates the implications of including a Ramapo f ault zone on plant risk. Our conclusion is that for reasonable subjective probability weights that could be considered appropriate for a Ramapo f ault, (less than 0.10), the IPPSS results are not affected in a significant way. We also note that the seismicity curves associated with proposed source parameters for a Ramapo f ault are reasonably well contained within the dispersion of the IPPSS family of seismicity curves. To generate the f amily of seismicity curves, the results of the D&M study have been modified in two ways. First, sustained-base peak acceleration values have been shif ted by a f actor of 1.23 to provided sustained accelera-tion; and second, the hazard curves have been truncated to reflect the belief that there is a maximum ground shaking intensity which can occur. The basis for limiting peak ground acceleration, given a specific value of Modified Mercalli, intensity is discussed in Section 7.9.4. The WCC seismicity results were not modified in this section as truncations were applied in the original study. As discussed at the PLG meeting, it was agreed that the truncation of the hazard curves should more appropriately have been performed within the j probabilistic analysis. However, as pointed out at the meeting and verified by an independent calculation, truncating outside the hazard analysis is conservative in that the annual exceedance frequencies for accelerations below a truncation level will be higher than had the truncation been performed in the probabilistic analysis. To obtain the final family of seismicity curves, the results of the D&M and WCC studies were given equal weight. We disagree in two respects with l this subjective combination; first with the method used to obtain the final family of seismicity curves, and second with the probability weights given the two studies. The method of combining the results of the two seismicity studies has been carried out on the assumption that estimates of the same parameter have been provided. 3-7
The D&M study has estimated the discrete probability distribution (DPD) on frequency, while the WCC study provides a "best estimate." The IPPSS combines the WCC "best estimate" and the D&M DPD to obtain a composite, in a Bayesian i sense, DPD on the frequency of exceedance. More appropriately, the combina-tion of the two studies should be made based upon a Bayesian combination of the mean values. The "new" DPD on frequency has an updated mean, retaining its previous shape and dispersion. The approach used in the IPPSS will not impact the mean frequency values; however, it will have considerable effect on the resulting DPD in that it will overestimate the spread of the distribution. With respect to estimates of seismic risk, the same conclusion is appropriate. We also disagree with the subjective weights given to the D&M and WCC studies. Based on our review of Sections 7.9.1 and 7.9.2, we feel that the results of the D&M and WCC studies should be assigned probability weights of 0.80 and 0.20, respectively. SECTION 7.2.3 FRAGILITY The methodology used to develop the fragility curves for structures and equipment is discussed in this section. We agree that this methodology is appropriate for the Indian Point Plants. The basis for accepting the methodology cnd specific comments concerning application of this methodology to the IPPSS study are given in Chapter 2 of this report. ' We noted the statement that the factor of safety is equal to the resistance capacity divided by the response associated with the DBE. In the probabilistic analysis, dividing median values for capacity and response implicitly assumes that these parameters are independent. Due to the effects of load combinations and f ailure sequences this may not always be true. SECTION 7.2.3.1 Definition of Failure Structural failure is defined as ". . . The onset of significant structural damage, not necessarily corresponding to structure collapse." This 3-8
i definition may be conservative in some cases and will tand to produce higher frequency of f ailure estimates compared to a definition based on collapse where functional f ailure is not an issue. It would be more appropriate to use
; a median definition and add uncertainty for the definition. We agree that it 4 is appropriate to define failure as either rupture / collapse or loss of j function, whichever occurs first.
, SECTION 7.2.3.2 Fragility Curve Formulation We agree with separating variability of seismic response and structural capacity into randomness and uncertainity components. Use of the lognormal distribution is appropriate as long as the extreme tails of the density function do not significantly influence the results of the analysis. It was found in performing the integration of the hazard and fragility curves that must of the contribution (i.e., greater than 90 percent) i to the release category 2RW for Indian Point 2 was within three standard deviations from the median velue for the control building /superheater building impact fragility distribution which controlled the system fragility curve for 2RW. In contrast, the contribution to release category 2RW for Indian Point 3 i was generally beyond three standard deviations from the effective median value i of the structure components which contribute to the mean frequency value of l 2RW (i.e., the control building and diesel generator fuel oil tanks at approximately 0.89). We believe that the results for Indian Point 3 using the lognormal distribution are conservative since the lower tail of the lognormal density function tends to be ligher than other reasonable distributions which could have been used. However, ar stated in Chapter 2, neglecting possible design and construction errors and the effects of aging may over-compensate the possible conservatism in using the lognormal distribution. The shape of the upper tail of the lognormal density function does not significantly affect the results, since the cumulated probability of failure ! is close to 1.0, and variations in tail shape do not significantly affect the l integration process and the final frequency of core melt values. l The results of the fragility analysis are given in Tables 7.2-1 through l l 3-9
7.2-7. As noted in Chapter 1, the review concentrated on those structures and equipment which contributed significantly to the frequency of release. As discussed in the following sections, the basis for the fragility of critical structures and equipment was reviewed in detail. Other components in Tables 7.P-1 through 7.2-7 were reviewed generally (i.e., do the fragility parameter values look reasonable, and are they consistent relative to the main con-tributingitems?). For the non-key components, the possibility that they may be much weaker than calculated in the fragility analyses was considered. Specific comments on the fragility parameters for the structures and equipment are given in review of Section 7.9.3, " Structural Mechanics Associates, Inc. Fragility Study." Some general comments on Tables 7.2-1 through 7.2-7 are included in the discussion below. We noted that the plots of the fragility curves at the end of this section (i.c., Figures 7.2-5 and 7.2-11) for identical components from Units 2 and 3 are different. We assume that this is just a plotting error. SECTION 7.2.4 INDIAN POINT UNIT 2 SECTION 7.2.4.1 Systems and Plant Logic It was learned at the meeting with PLG that failure of nonbearing masonry
- walls would affect an area out from a wall equal to a distance of one-half the wall height. This was in response to a question concerning the statement,
. . . f ailure would essentially be vertical collapse of the wall." We agree that blocks may f all as f ar as one-half the wall height.
At the meeting with PLG, we discussed the basis for the assumption that nonrecoverable f ailure of electrical components is about three times the value corresponding to recoverable interruptions (i.e., relay chatter or breaker trip). We also reviewed Reference 8, which discusses the basis for this as:smption. Since those components do not affect the results, even at lower fragility values corresponding to relay chatter or breaker trip, this issue is not critical for Indian Point. However, we believe that any generic component which is a major contributor should be analyzed individually to obtain 3-10
component-specific capacity values. At best, there is uncertainty in using a generic factor of three between nonrecoverable failures and recoverable interruptions. In regard to itemh (f an cooler ductwork), we cannot judge whether the f an coolers are mechanically capable of adequately mixing the containment gases without the ductwork. If this is true, this is sufficient reason to eliminate this component from further consideration. The argument that it is improbable that all the duct risers would f ail from the same earthquake may be weak. If these components are identically constructed and attached to the same portion of the building, their capacities and seismic responses may be highly correlated. If so, then the failure of one would imply the failures of others. We did not investigate the details of construction for the fan cooler ductwork. We concur with the assumption that the gas lines which cross the plant property do not pose a significant hazard to the plant. However, we question that their median capacity is 1.4g, since these lines were probably not designed and constructed with the same high quality assurance requirements used in the design of the plant. At the meeting with PLG, revisions to the fragility parameter values for Indian Point 2 components were made. The following changes were noted: By Symbol Structure / Equipment a 6R Condensate Storage Tank 1.28g .22 .25 i City Water Storage Tank .25 .25 .30 Refueling Water Storage Tank .70 .22 .28 120 VAC Transformers 1.07 n/ c* n/ c RCS Power-Activated Relief Valve 3.17 n/ c .61
- n/ c: not changed The only change that might have potential effects on the analysis is the city water storage tank, which originally had a median capacity of 0.83g. Pickard Lowe, and Garrick redid the probability analysis with the lower value (i.e.,
0.25g) and found no change in the results. This was reported to us at the PLG 3-11
i meeting. This is reasonable because failure requires that both the city water ! storage tank and the condensate storage tank f ail. The latter component, which has a median capacity of 1.28g, dominates the results. As stated in Chapter 1, we did not review the fault trees (IPPSS report Figures 7.2-6a through 7.2-6f) for completeness or functional relationships. i Based on the trees, we did check the logic leading to the core melt and i release category equations. We found that the system equations given are correct. Because component h (impact between control rooms of Units 1 and 2) dominates the analysis, possible dependence between capacities and/or responses of other components does not affect the analysis results in the IPPSS report. This conclusion is also true for the revised analysis, which eliminated the control room impact problem, since the f ailure of the control room ceiling dominates. In the case of piping, the pipe segments are connected in series; thus, the frequency of failures for a piping system may not be conservatively represented by the frequency of the weakest component, unless the capacities and responses of all segments are individually (i.e., capacity with capacity and response with response) perfectly correlated or unless the capacity is dominated by a single weakest component. Because piping extends a relatively long distance and is supported at many places in a structure, piping response will not be perfectly correlated. Also, because different components may come from different manuf acturers or material runs, capacity also is not perfectly correlated. A similar problem also exists for electric cables supported by cable trays, j This issue was discussed at the meeting with PLG. It was pointed out by I SMA that the strength of piping systems usually is controlled by only one or two elements. Thus the design stress is at or near the allowable value for only a few elements. Because other elements are over-designed, the issue of dependence or independence does not affect the fragility of the piping system as a whole. At Indian Point, cable trays were not specifically designed. Generic supports were designed and allowable distances between supports specified and I 3-12
used in construction. It is difficult to apply the same argument to cable trays as was given for piping systems. By the time of the second session of the PLG meeting, PLG had investigated the effects of considering multiple independent cable tray supports (i.e.,10 to 15) on the frequency of release category 2RW. It was found that considering the cable tray supports to be independent had almost no effect on the results. This is reasonable considering the relatively high capacity of a single cable tray support (i.e., median equal to 1.lg) versus the controlling median fragility value of 0.279 for impact between the Unit 1 and 2 control rooms. This conclusion is also true for the revised analysis, since the control room ceiling f ailure now dominates. However, if this latter problem is eliminated, the effects of cable tray dependencies may be significant. In general, the issue of dependence should be considered for both piping systems and cable tray supports. Additional coments on this issue are given for Section 7.9.3. SECTION 7.2.4.2 Seismic Core Melt Frequencies We did not directly check the distribution for core melt frequency, Ms-As discussed in the next section the analysis for release category 2RW was checked. Because of the relationships between the various components in the systems equations, core melt and 2RW for seismic effects are essentially identical for Unit 2. j We believe that the revised analysis mean value s 7.9 x 10-6 per year for l the annual frequency of core melt (Ref. 9) is low because of the hazard curves and the assumed capacity for the control room ceiling. We believe that the hazard mean frequencies of exceedance values for D&M and WCC should be weighted 80 percent and 20 percent, respectively. In addition, we believe that the control room ceiling capacity is similar to the ! capacity for Unit 3 (see discussion for Section 7.2.5). Incorporating these two effects into the analysis increases mean frequency of core melt by a factor of 6.1 to an annual value of 4.8 x 10-5, Because of the higher level of subjective uncertainty leading to the tails of the core melt frequency density function, we do not believe the reported 90 percent confidence bounds are credible. 1 3-13
SECTION 7.2.4.3 Initial Assembly Leading to Release Category Frequencies The Boolean expression for release category 2RW was checked starting with the f ault trees and found to be correct. An integration using the 11 hazard curves from IPPSS report Sections 7.9.1 and 7.9.2 with the 5 fragility curves from IPPSS report Table 7.2-4 was performed using the same relative weighting as PLG and a mean frequency value of 0.8 x 10-4 per year was obtained. This compares to the value of 1.4 x 10-4 per year reported by PLG in the original analysis. We believe that the difference is due to differences in the inte-gration procedures used and probably the lumping of hazard curves into the final family used in the DPD operation. A finer division of the hazard and fragility points would probably reduce this difference. The 2RW seismic sequence is the largest contributor to latent effects. It is dominated by the impact between the Unit 1 and 2 control rooms which has a median damage effective ground acceleration of only 0.279 in the original analysis. It is assumed that, if an earthquake large enough to f ail the control room occurs, off-site power and the gas turbine will not be available. The next most significant contributor, the superheater stack f alling on the control building, has a median capacity of 0.72g, which is almost larger than the upper-bound cutoff value of 0.8g used on the seismic hazard curves. Thus this component does not contribute much to the frequency ; of 2RW in the original analysis. l For the revised analysis reported in Reference 9, which eliminates the l problem of impact between the Unit 1 and 2 control room roofs, we believe that the ceiling f ailure is now a dominate contributor to 2RW. Based on a review of the development of the structural capacities, we l believe that the revised analysis mean annual frequency for 2RW equal to 6.9 x 10-6 per year is a factor of 6.8 low due to the hazard curves and the low capacity of the control room ceiling. The sequence leading to release category Z-10 consists entirely of failure of the containment building shear wall. Because of the relatively high 3-14
capacity for this failure mode (i.e., median value equal to 1.1g) the mean frequency of failure is only 6.8 x 10-7 per year. The frequency of Z-1Q is sensitive to the upper-bound cutoff on the hazard curves. Because we feel that the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, respectively, the frequency of Z-1Q is a factor of 1.6 low. The reason that the frequency of release for category Z-1Q is higher for Unit 2 compared to Unit 3 is due to the large soil loading on the Unit 2 containment building. The median capacity of 1.lg for the containment building failure mode appears to be conservative. The Boolean expression for the other Boolean equations for release categories Z-1, 8A, and 8B were checked starting with the fault trees and found to be correct. These release categories do not contribute significantly to offsite effects. SECTION 7.2.5 INDIAN POINT UNIT 3 SECTION 7.2.5.1 Systems and Plant Logic In regard to the seismic capacities given in IPPSS report Table 7.2-7, the control building median capacity is equal to 1.20g, which is based on a shear wall failure mode. We believe that this value may be high (i.e., unconserva-tive) for the Unit 3 control building. Both Unit 2 and 3 ceilings consist of egg-crate louvers and Transite barriers suspended from the control room roofs. An analysis of the Unit 3 ceiling was conducted by PLG in response to concerns raised in the 19 July 1982 draft of this report. The results of this analysis are given in l Reference 10. The median structural capacity determined by PLG for the Unit 3 Transite panels (which weigh 25 pounds each) is 0.11g. However, the failure was assumed to occur only if all three operators are incapacitated. We found the following discrepancies in this analysis: l j e There are arithmetic errors in the discrete frequency values for ceiling failure 3-15
e Only one panel axis penetrating the cone of influence was used (two axes should have been used) e The integration of the hazard and fragility curves should have included ' acceleration values as low as 0.05g e The ceiling f ailure contribution to the mean frequency of core melt was not added to the contributions from other component f ailures Based on these discrepencies, the mean probability of core melt is a f actor of almost ten higher than the reported value of 3.6 x 10-6 given in Reference 10. In addition, if the effects of weighting the mean D&M and WCC hazard curves 80 percent and 20 percent, respectively, are included the net increase of the mean frequency of release category 2RW (which is the main contribution to core melt) is a f actor of 16. However, we choose to increase the mean value by a factor of 10 to 2.4 x 10-5 since we believe that the true median capacity of the ceiling may be higher than 0.11 9. On the conservative side, the Transite panels may be wide enough to preclude them from sliding and f alling off the support flanges of the light fixtures. In addition, all threa operators may not always be in the control room at the same time. On the unconservative side the Transite panels, which f all outside the zone of infleance assumed in the PLG analysis, may still be capable of affecting the ability of the operators to perform their function. At best, the results of the analysis reported to date contain significant uncertainties. We believe that additional investigations and analyses should i be conducted for this potential f ailure. The capacity of the diesel generator fuel oil tanks, which are buried, are based on generic data. Because this component contributes significantly to
- core melt and 2RW, a specific analysis for this component should be conducted, l Comments concerning the capacity of electrical components, piping and cable tray dependencies, and f ailure behavior of nonbearing masonary walls are the same as for Unit 2 as discussed above for IPPSS report Section 7.2.4 At the meeting with PLG, revision to the fragility parameter values for Indian Point 3 components were made. The following changes were noted
i 3-16
O Symbol Structure / Equipment E OR U Condensate Storage Tank 1.28g .22 .25 City Water Storage Tank .25 .25 .30 Refueling Water Storage Tank .70 .22 .28 RCS Power-Activated Relief Valve 3.17 n/ c* .61
*n/ c: not changed Since f ailure of both the condensate storage and city water tanks is required for loss of function, these changes will not significantly effect the results of the analysis.
As stated in Chapter 1, we did not review the f ault trees (IPPSS report Figures 7.2-12a through 7.2-12f) for completeness or functional relation-ships. Starting with the fault trees, we did check the logic leading to the core melt equation. We found that the equation for M is correct. s It is doubtful that any dependence between the components will affect the analysis results. Note that perfect dependence due to ground motion is implicitly assumed in the procedure for integrating the hazard and fragility curves. Since the control building and fuel tanks are separate structures, no capacity or other response dependence is present. SECTION 7.2.5.2 Seismic Core Melt Frequencies We did not directly check the distribution for core melt frequency, M s* As discussed in the next section, the analysis for release category 2RW was checked. Most of the contribution to core melt comes from 2RW. We believe that the mean value of 3.3 x 10-6 per year for the annual frequency of core melt may be low due to potential failure of the control room ceiling and our belief that the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, respectively. We feel that these differences would change the reported value by a factor of about 8. We do not believe that the reported 90 percent confidence bounds are credible. 3-17
SECTION 7.2.5.3 Initial Assembly Leading to Release Category Frequencies The Boolean expression for release cetegory 2RW given on IPPSS report page 7.2-20 was checked and could not be verified. The expression that we obtained follows:
- A A _
2RW = h V h V h V _ ( h V h )^( @ V h V h V h ) A((( h V h ) ^ ( h^ ( h V 0.05 h )) V h V } V ( ( h V h ) A( h V h ) )} Our understanding is that PLG used the following upper-bound expression in the actual calculation. 2RW < ^ ( hVhV ^ ( h V O ); v @ v @ v @ ) We agree that this equation is a reasonable approximation; however, it is not strictly an upper bound. An integration using the 11 hazard curves from IPPSS report Sections 7.9.1 and 7.9.2 with the 5 fragility curves from IPPSS report Table 7.2-8 was per-formed using the same relative weighting as PLG and a mean frequency value of 1.6 x 10-0 per year was obtained. This compares to the value of 2.4 x 10-6 reported by PLG in the original analysis. We believe that the difference is due to diff erences in the integration procedures used and probably the' lumping of hazard curves into the final family used in the DPD operation. A finer division of the hazard and fragility points would likely reduce this difference. The 2RW seismic sequence is a ma,ior contributor to latent effects. It is dominated by the capacities of the control building shear wall and the diesel generator fuel oil tanks, which together have an equivalent capacity which contribute significantly to the effective capacity of all contributors of about 0.89 . We believe that the capacity of the hung ceiling in the control room may be lower and the D&M and WCC mean hazard curves should be weighted 80 3-18
percert and 20 percent, respectively; thus the mean frequency of a 2RW due to seismic effects is judged to be 10 times larger. We believe that the capacity for the diesel generator fuel oil tanks should be developed based on specific rather than generic data since this component is a significant contributor to seismic 2RW.
! The sequence leading to release category Z-10 consists entirely of f ailure of the containment building shear wall. Because of the relatively high capacity of this f ailure mode (i.e., median value equal to 1.7 )9 the mean I frequency of failure is only 3.7 x 10-8 per year. This result is sensitive to the upper-bound cutoff on the hazard curves. Because we believe the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, respec-tively, the frequency of Z-10 is a f actor of 1.6 low.
The Boolean expression for the other Boolean equations for release categories Z-1,8A, and 8B were checked starting with the f ault trees and found to be correct. These release categories do not contribute significantly to offsite effects. I i 3-19
SECTION 7.4 FLOODING l Scope of Review In this section, the effects of external and internal flooding at the Indian Point plants are reviewed. In the IPPSS report Section 7.4.1 external flood hazards at the plant site were considered, and in Section 7.4.2 the impact of internal flooding on safety-related equipment was considered. The adequacy of these analyses are reviewed and the implications of discrepancies are discussed. References utilized in our review of this section are listed below. References
- 1. Westinghouse Electric Corporation Drawing, United Engineers and l Constructors, Inc. Drawing Number, 9321-F-15353.
- 2. Indian Point Unit 3, PSAR, Supplement 1, Item 18.
- 3. Corps of Engineers, Proceedings of the American Society of Civil
, Engineers, Journal of Waterways and Harbors Division, Hurricane Study of New York Harbor, February 1962, Issue No.1,
- 4. Quirk, Lawler and Matusky Engineers, " Evaluation of Flooding Conditions at Indian Point Nuclear Generating Unit No. 3," Revision of Report of February, 1969, April 1970.
- 5. Indian Point Unit 3, FSAR, Supplement 10, .lanuary 1973.
l 6. Quirk, Lawler and Matusky Engineers, letter to Mr. John Inglima of Consolidated Edison Company of New York, Inc., dated January 21, 1972. l i l l 7. Burkham, D. E., " Accuracy of Flood Vapping," Journal of Research of the ! U. S. Geological Survey, vol. 6, pp. 515-527,1970. 3-20
- 8. PLG Response to Sandia letter Report of September 1,1982 on the Indian Point Probabilistic Safety Study, October 1,1982.
- 9. Pickard, Lowe and Garrick letter to Mr. James F. Davis of the Power Authority of the State of New York, from Mr. Harold F. Perla of PLG, July 7, 1982.
- 10. "PRA Procedures Guide," prepared by ANS and IEEE for USNRC, NUREG/CR-2300, Review Draft, September 28, 1981.
- 11. Letter from William J. Cahill, Jr., Vice President, Consolidated Edison Company of New York, Inc., to Mr. Richard C. DeYoung, Assistant Director for Pressurized Water Reactors, Directorate of Licensing, U.S.
Atomic Energy Commission, dated December, 18, 1972.
- 12. Letter from Carl L. Newman, Vice President, Consolidated Edison Company of New York, Inc., to Mr. George Lear, Chief, Operating Reactor Branch
#3, Directorate of Licensing, U.S. Nuclear Regulatory Commission, dated January 20, 1975.
- 13. Letter from William J. Cahill, Jr., Vice President, Consolidated Edison Company of New York, Inc., to Mr. George Lear, Chief, Operating Reactor Branch #3, Directorate of Licensing, U.S. Nuclear Regulatory Commission, dated February 18, 1975.
l
- 14. Letter from Peter Zarakas, Vice President, Consolidated Edison Company of New York, Inc., to Mr. Steven A. Varga, Chief, Operating Reactor Branch #1, Directorate of Licensing, U.S. Nuclear Regulatory f Commission, dated July 14, 1980.
l
- 15. Letter from Steven A. Varga, Chief, Operating Reactor Branch #1, Directorate of Licensing, U.S. Nuclear Regulatory Commission to Mr.
John D. O'Toole, Assistant Vice President, Nuclear Aff airs and Ouality Assurance, Consolidated Edison Company of New York, Inc., dated December 18, 1980. 3-21 m . o
SECTION 7.4.1 EXTERNAL FLOODING The Indian Point plant is situated on the east bank of the Hudson River, approximately 43 miles north of New York City. The plant elevation is approx-imately 14.0 ft, which corresponds to the elevation of the screenwall structdre for Unit 3 (Ref.1). The plant grade is about 15 ft. The consid - eration of potential flooding at the site due to external events is based principally on the flood studies conducted for the Indian Foint Unit 3 operating license review, (Ref. 2, 3, 4, 5, and 6). The design basis of Unit 3 for external flooding, and thus the IPPSS, is based on the occurrence of extreme events such as the Probable Maximum Flood (PMF), the Probable Maximum Hurricane (PMH), and event combinations such as the standard project flood and failure of an upstream dam. The IPPSS concludes that the contribution to the frequency of core melt due to external flood sources is extremely small . The basis of this conclusion is reviewed and the adequacy of the probabilistic methodology is discussed. The principal basis of the external flooding analysis in this section is the work in Reference 4, and various supplements or revisions (Ref. 5, 6). The intent of these studies was to evaluate maximum water surface elevations at the site to extreme event scenarios. On the basis ofka review of potential sources of flooding on the Hudson River, the following events and event combinations were considered: 1 e Probable Maximum Precipitation (PMP), which is assumed to produce the Probable Maximum Flood (PMF) e PMF and tidal flow e Standard Project Flood (SPF) and Ashokan Dam Failure l e SPF and the Standard Project Hurricane (SPH) at New York Harbor e SPF, Ashokan Dam Failure and the SPH at New York Harbor o Probable Maximum Hurricane (PMH) and spring high tide. I i 3-22
The result of deterministic calculations for these events is provided in Table
- 1. The IPPSS estimates of the annual frequencies of occurrence of individual events in Table 1 range from 10-3 to 10-4, while frequencies of event combinations have estimated values of 10-8 to 10-12 The IPPSS concludes on the basis of the foregoing results that the contribution of external flooding to the annual frequency of core melt is extremely small. For this reason the study does not consider the impact of flooding on safety-related equipment or structures.
The approach taken in the IPPSS to assess the frequency of external flooding at the Indian Point site is to consider only the most extreme events (i.e. probable maximum events), and event combinations. The reason for this is apparently the fact these events were the basis of the flood design criteria used for the Indian Point site. This approach differs from a probabilistic flood hazard analysis that considers the full complement of water elevations due to a range of event sizes. The IPPSS has in effect chosen to consider for each source of flooding (i.e., precipitation, hurricane, etc.) one or two events and their resultant water surf ace profile produced at Indian Point. The approach taken to evaluate the likelihood that external flooding would effect safety-related equipment in our judgment is not adequate. We feel that the methodology employed has not properly treated the sources of uncertainty in the analysis which are generally considered to be large. To assess the potential contribution of flooding to plant risk, a preliminary or screening analysis can be conducted. The analyst can obtain generic estimates of uncertainty in key variables (if site-specific estimates are not available), frequencies of critical events, and available deterministic estimates of flood elevations. From this information a screening analysis can be conducted to make first order estimates of the frequency of flood levels. On the basis of preliminary frequency estimates of flood elevations reaching safety-related equipment or structures, an assessment can be made as to whether further
- analysis is needed. This type of probabilistic screening is considered below, i
l 3-23
Routing a flood downstream and estimating water-surface elevations is one of the elements of a flood analysis that has considerable uncertainty associated with it. In the IPPSS study no site-specific estimate of this uncertainty was made, therefore estimates available in the literature are considered. In Reference 7 an average value of the one standard deviation in the estimate of water surface profiles due to riverine flooding for the 100-year flood is approximately 23 percent of the estimated flood depth. Assuming estimates of water surface profiles are lognormally distributed (Ref. 7), this variation corresponds to a logarithmic standard deviation value of 0.21. A second estimate is available in Reference 4, the flood study conducted for Unit 3, which references a Corps of Engineers graph of river discharge as a function of basin area. In their analysis, the Corps of Engineers estimates from a log-log plot of their data a mean and upper and lower bounds on the peak discharge of the six-hour unit hydrograph. Using the lognormal I assumption and assuming the bounds correspond to the plus and minus three
- standard deviation range, a value of 0.47 for the one logarithmic standard deviation is derived. Based on the linear relationship at Indian Point between water-surface elevation and river discharge, this value also corresponds to the uncertainty in water elevation.
Knowing the distribution on water surface elevation, preliminary estimates can be made of the frequency of exceeding different levels. These calcula-I tions are made for the PMF, which is assigned an annual frequency of 1.0 x l 10-4 The median flood elevation for the PMF is 12.7 ft. The product of this value and the probability of exceeding a particular elevation given the PMF provides the frequency of exceeding that level. Using this approach, a range can be estimated for frequency of exceeding the 16 ft. base elevation of the Unit 2 service water pumps (Ref. 8). The range is 3 x 10-5 to 3 x 10-6 These values are based on the two estimates of the uncertainty in water surface elevations given above and taking into account a possible conservative bias in j the flood routing procedure used in the flood study for Unit 3 (Ref. 4). The 16 ft. water surface does not include the effects of wave runup which is estimated to be 1.4 ft. in the IPPSS. These results are based on certain 4 3-24 i -
assumptions, such as the storm frequency of 10-4 and the use of generic or non-site specific estimates of the uncertainty in the water surf ace profile. Another f actor that must be kept in mind is the f act that a warning time is available during extreme flood situations, as in the case for hurricanes. Also, specifications are in place for Unit 3 for emergency action to begin (sand bagging) if the water level reaches 11 feet. At the meeting with PLG our concern that the uncertainty in .the flood analysis was not taken into account was expressed. The response by PLG provided in Reference 9, does not address this issue. We conclude from our review that the sources of external flood at the Indian Point site have been identified and adequately considered in a deter-ministic sense. However, in view of the potentially large uncertainties associated with the estimated frequencies and levels of floods, it has not been adequately demonstrated that the contribution to a core melt frequency can be neglected. Since the question of uncertainties has not been addressed at all, we feel that the present analysis is inadequate. In our judgment, flood hazards are not a major contributor to plant risk. However, we also feel that due to the large uncertainties associated with flood hazard predictions that the frequency of flood elevations exceeding the elevation of safety-related equipment is not many orders of magnitude below the frequencies of other more dominant external events. SECTION 7.4.2 INTERNAL FLOODING In this section the results of an analysis to consider the effects of internal flooding on safety related equipment is considered. At the PLG meeting, a summary was provided of the procedure used to identify sources of internal flooding and to determine their effect. Three steps were followed:
- 1. Identify sources of flooding.
- 2. Identify locations vulnerable to floods from those sources determined in 1.
- 3. Simulate initiating events and evaluate the impact.
3-25
We generally agree that the above steps are required to conduct an internal l flood analysis. We suggest that the internal flood analysis should be conducted in a manner suggested in Reference 10 which recommends development of flood analysis fault trees. This would ensure that a thorough, systematic analysis of critical events and event sequences that may lead to a transient l are considered. We suspect, based on references in the text, that existing fault trees have been used to some degree in the analysis. 1 7.4.2.1 Noncategory I Systems An analysis was undertaken to consider the impact of internal floods on the core melt frequency. The IPPSS study conducts the analysis for Indian Point Unit 2, and based on the similarities in the design of Units 2 and 3, it was assumed that conclusions reached also apply to Unit 3. This assumption is reasonable if it can also be assumed that age effects, particularly in locations where corrosion is likely, do not impact the results. Also, since the two units are not under the same ownership, it should also be verified that conditions have remained the same for both units. Since changes always take place, it is not apparent that equivalent alterations occur at the same time and in the same way in both units. Similarly, temporary blockage of flood passages will undoubtedly be different for each unit. These factors I
- should be addressed in order to verify that the two units are the same.
Unless significant changes between them are identified we believe that the difference in the contribution to plant risk will be small. In our judgment these factors should be addressed prior to accepting a conclusion that the I results apply to both units. ( This section considers the impact of failure of Noncategory I systems on ! safety systems. The conclusions reached are based on extensive review by the l utility and the NRC (Ref. 11,12,13,14 and 15). The conclusion of the l I analysis is that the operation of safety systems will not be affected by i flooding produced by failure of Noncategory I systems. 3-26 A
Y T 7.4.2.1.1 Ouantification of Internal Flooding From NonCategory I Sources 7.4.2.1.1.1 Circulating Water Failure A review of flood scenarios is presented due to a circulating water pipe We failure. The situations described have been reviewed by the IJSNRC staff. note that flooding due to a pipe f ailure is considered to be self-limiting
- because the condensate pump motors and the 6.9kV switchgear will be flooded, resulting in reactor trip and loss of offsite power, respectively. This logic The basis presumes that f ailure events can be counted on to limit the event.
! for this should be further qualified. 7.4.2.1.1.2 Fire Protection System Failure i Electrical Tunnel Flooding Conditions for flooding due to failure of the fire protection system are described. The basis of this event is reasonable; however, no information is provided regarding how the frequencies of valve and pipe f ailure were l j determined, f Diesel Generator Building Flooding i We agree with the conclusion that the frequency of diesel generator , failure is negligible compared to other causes of failure. However, it is not We clear that the frequency of inadvertent activation has been considered. judge that consideration of this event will have a relatively small effect on the frequency of diesel generator f ailure. Charcoal Filter Flooding We agree with the conclusion and have no additional comment. l l l 3-27
7.4.2.2 Category I Systems 7.4.2.2.1 Primary Auxiliary Building (PAB) The analysis of flooding in the PAB has been conducted in a manner that identifies the effect of flooding due to the RWST, the service water system and component cooling system. For each system the frequency of failure has been quantified and considered in the system f ault trees. These frequencies are not quantified in this section. The approach taken in this section is to identify the events that would occur in the event a flood were to occur. Since the review of the system fault trees is not a part of this review section and is being conducted by Sandia, it is assumed that the f ailure of the RWST, service water system and component cooling system has been taken into account. It is not apparent from the discussion that the impact of flooding was included in the system f ault trees. 7.4.2.2.2 Diesel Generator Building (DGB) Flooding in the DGB can also be caused by a service water line break. This flood can be contained by the pit areas and the 12 inch drain-lines which drain to the circulat:1g water discharge tunnel. Since a plant transient does not occur due to the diesel generators failing, the only event of interest is the joint occurrence of this event and a plant transient. The frequency of this event has been treated in the f ailure of the service water system. We agree with the conclusion that the likelihood of this event is small. 7.4.2.2.3 Auxiliary Feed Pump Building (AFPB) The AFPB has been designed to discharge water from a feedwater line break. However, flood discharge rates of a feedwater line break and drainage capacities are not quantified and, therefore, this statement cannot be evaluated. We have reviewed Reference 14 and concur with the conclusion that sufficient drainage is available. The appropriate failure frequencies are 3-28
quantified for the auxiliary feedwater system. We have no further comment on this section. 7.4.2.2.4 Control Building (CB) Flooding in the CB due to a service water break is considered. Of vital importance is the 480V switchgear located at level 15 f t. The analysis assumes that floor drains in the CB will remain available in the case of a flood. To fully demonstrate this, the location of floor drains with respect to the service water lines and the 480V switchgear must be provided. The conclusion is made that the frequency of power loss is less than the frequency of loss due to other causes. It should be demonstrated in the IPPSS report that the additional increase in the loss of power is negligible. 7.4.2.2.5 Containment Building i The recent experience of flooding in the containment building has led to significant changes in both units. The numerous changes which have been made are listed in the report. No quantification has been made of the frequency of flooding and damage in the containment for the upgraded f acility. The reason , for this is apparently that a service water system rupture and a LOCA must occur, in order to contribute to plant risk. Due to past experience, a quantification of the system reliability is called for, such as a comparison between the upgraded plant and the system at the time of the 1980 accident. We, in general, agree that the changes have increased the system reliability and that the contribution to plant risk is less than the original design. l 3-29
l l 1 l l l SECTION 7.5 WINDS AND WIND INDUCED MISSILES : i Scope of Review In this section, the effects of tornado and hurricane wind pressure and tornado missile loads are reviewed. The hazard curve information is reviewed for IPPSS report Section 7.9.5. The fragility curves are given in IPPSS report Section 7.5 and are reviewed below. The implications of discrepancies that were found on core melt and release categories 2RW and 8A are dis-cussed. The references which were considered in the review of this section are listed below. References
- 1. United Engineers and Constructors, Inc., " Indian Point Generating Station - Unit Nc. 2, Report - Plant Capability to Withstand Tornadoes," January 26, 1968.
- 2. Twisdale, L. A., W. L. Dunn, and J. Cho, " Tornado Missile Simulation and Risk Analysis," Meeting on Probabilistic Analysis of Nuclear Safety, ANS, Newport Beach, May 1978.
- 3. Twisdale, L. A., et al., " Tornado Missile Risk Analysis, prepared for Electric Power Research Institute, EPRI NP-768, May 1978.
- 4. American National Standards Institute, Inc., " Building Code Requirements for Minimum Design Loads in Buildings and Other Structures," ANSI A58.1-1972.
- 5. Structural Mechanics Associates letter to Pickard, Lowe and Garrick, Inc., dated August 5, 1981.
- 6. Batts, M. E., et al, " Hurricane Wind Speeds in the United States," NBS Building Science Series 124, National Bureau of Standards, May 1980.
3-30
- 7. Twisdale, L. A., and W. L. Dunn, " Tornado Missile Simulation and Design Methodology, Volume 1: Simulation Methodology, Design Applications, and TORMIS Computer Code," Prepared for Electric Power Research Institute, EPRI NP-2005, Vol 1, August 1981.
- 8. Science Applications, Inc., " Simulation of Tornado Missile Hazard to the Pilgram 2 Nuclear Thermal Generating Station," Prepared for Boston Edison Company, Inc., SAI-77-501-5V, November 1977.
- 9. "Palo Verde Nuclear Generating Station Probabilistic Risk Assessment of Tornado Missile Damage to the Station Ultimate Heat Sink," USNRC Docket No. STN-50-528/ 529/ 530, File: 82-056-026; G.1.01.10, not dated.
3-31
SECTION 7.5.1 WIND EVENTS Review of Research Triangle Institute's wind hazard analysis report is discussed under IPPSS report Section 7.9.5. We note that wind exceedance functions were not provided for specific structures as stated in the IPPSS but rather were provided only for the Indian Point site. Discussion concerning implications of this fact are given below. We concur with the procedure to develop hazard curves for extreme winds, hurricanes, and tornadoes separately, and to assume the results from the three sources are independent. We believe that correction f actors for the effects of height, which were included in the analysis, are small relative to the i influence of adjacent structures, which were not explicitly included in the analysis. This concern is discussed further for IPPSS report Section 7.5.3. We believe that the tornado hazard curves are on the conservative side, but that the hurricane hazard curves are unconservative. The implications of this result are discussed below for IPPSS, Sections 7.5.4 and 7.5.5. SECTION 7.5.2 TORNADO MISSILES AND WINDS ON CONCRETE STRUCTURES The statement that the concrete stuctures were designed for 25 psf wind loading, and that there is "little deflection" is misleading and not pertinent to the conclusion that potential wind pressures and tornado missiles are not significant to Indian Point safety-related concrete structures (i.e., wall thickness greater than 12 inches). We concur with this conclusion based on review of Reference 1. In addition, as discussed for IPPSS report Section 7.9.5, we believe that the hazard due to tornadoes is lower than stated. The connent that the 12-to-14 inch thick walls have weights over 150 pounds per square foot should be clarified (although true, the reviewer expected " pounds l per cubic foot"). The statement that tornado frequencies at Indian Point are lower should be documented (although we do agree with this statement). In general, other leading statements made in this section should be documented. 3-32 L
SECTION 7.5.3 TORNADO MISSILES AND WINDS ON METAL STRUCTURES We agree that it is conservative to base the fragility of metal structures l and exposed equipment on the hit frequency; however, the fragility curves for the effects of tornado missiles were not developed based on possible hit frequencies as stated, but rather on wind velocities which could lift various missiles off the ground. However, we believe that using the tornado impact fragility curves shown in IPPSS report Figure 7.5-3 results in conservative frequencies of f ailure for the structures and equipment considered. This conclusion was partially based on References 2 and 3 which reported the probability of hit frequency of specific structures at a nuclear power pl ant. In one reported analysis, 5000 missiles which included over 2000 missiles with a mean weight less th.an 105 pounds were located close to the plant. For a tornado occurrence rate corresponding to USNRC tornado Region I, the mean hit frequency ranged between 1.38 x 10-6 per year to 3.09 x 10-5 per year. Adjusting for a lower tornado occurrence rate at the Indian Point site 2 (i.e., from 4 x 10-4/yr/ mi 2 to 2 x 10-4/ yr/ mi or even lower as discussed for Section 7.9.5) and the size of the critical safety-related structures at Indian Point (i.e., service water pumps and RWST), a conservative hit fre-quency of 10-6 per year is obtained. From the IPPSS analysis the mean hit frequency is inferred to be 9.2 x 10-7 per year (based on release category 2RW for Unit 3 which is dominated by f ailure of the service water pumps). In addition, References 7, 8, and 9 which report tornado missile strike frequencies were also reviewed. Considering the size of the metal-covered structures at Indian Point and the general tornado hazard environment at this site, it can be concluded that the conditional frequency of a missle impact on a structure given a tornado occurrence is approximately 10-2 Since the a frequency of tornado occurrence at Indian Point is on the order of 10-4 , combined value of missile impact of 10-6 is reasonable. This coupled with the additional conservatism that a missile hit does not always mean f ailure leads us to conclude that the missile impact calculations are conservative. We feel that hurricane-caused missiles are probably not a problem; however, this potential cause of f ailure should be considered and documented in the IPPSS report.
' 3-33
-- - - -w ~- -
We believe that the major uncertainty in wind loading on an Indian Point structure (conditional on the occurrence of free-field wind velocity) is due primarily to the influence of nearby structures. We do not believe that the randomness or uncertainty included for the capacity due to wind have been rationally developed to include the influence of the close proximity of adjacent Indian Point structures. Also, we disagree with the development of , the wind load correction factor SFL
- For hurricane winds, SFL randomness was based on consideration of differ-ences in terrain and return period occurrence wind speeds. The influence of nearby structures is more significant than terrain variability and should have been explicitly included. Also differences in occurrence rate belong in the wind speed hazard analysis rather than the fragility formulation. For torna-does, SF L , randomness was based on the relatively insignificant differences in wind speed effects over the height of the structures. We disagree with the statement that site exposure considerations are not particularly applicable to tornado phenomena. This may be true for residential areas where tornadoes will completely destroy and flatten all structures in their path. However, at Indian Point all of the major concrete structures will survive a tornado strike. Thus,'the presence of these structures will effect the flow of wind around the metal buildings and hence effect the loading on these structures.
Because of the approach used to develop the factor SF t
, the slope of the fragility curves for tornado effects is steep while the corresponding curves for hurricanes are less steep. We believe that the randomness (which is expressed by the slope of the fragility curves) should be essentially the same for the effects of tornado and hurricane wind speeds. This would be consis-tent with the implicit assumption made in the IPPSS report that the wind speeds for tornadoes and hurricanes are the same at 33 feet above the ground. If this is true (and we believe this is a reasonable assumption), it should also be true for other elevations between the ground and top of structures at Indian Point. Implications of the slopes of the fragility curves are discussed for IPPSS for report Sections 7.2.4 and 7.2.5.
We noted two discrepancies in the development of the fragility curves. In Table 7.5-1, the velocity pressure for exposure C for a 100-year return period 3-34
from Reference 4 should have been 27 psf instead of the value of 18.5 psf used in the analysis. The effect of this error would be to increase the randomness l for hurricane wind fragility curves which would lead to a slightly larger l frequency of core melt (probably a small effect). The second discrepancy is the conversion of pressure to equivalent wind velocity using the equation: q= 0.00256V 2 . This equation ignores the differences between structure shapes. For example, a rectangular building in the open is more closely modeled by the equation of q* = 1.3q where 1.3 is the shape factor. Because of the influence of adjacent buildings, the shape factor will vary from structure to struc-ture. In addition, shape factors should be developed for potential local siding or roofing failures. We believe that a rational way to develop shape factors for buildings at Indian Point is through the use of wind tunnel models. Our judgment is that the shape factors for the Unit 2 control building, the Unit 2 diesel generation building, and RWST also vary depending on the type of failure being considered. As discussed below, these structures control the core melt and release frequency analysis for Unit 2. The fragility curves for the effects of wind correspond to failure of a major structural element such as the shear walls or siding. However, the local shape factor for failure at a building corner may be as high as 3.0 (negative pressure). Tearing of siding or roofing due to negative pressures ' is a common failure mode for metal buildings. Assuming a local failure may control the capacity of the diesel generator l l building, the median capacity may be smaller by a factor of as much as 1.7; i however, this building is shielded to some extent. For the RWST we believe that the implicitly-assumed shape factor of 1.0 is reasonable. Because of the location of the control building, which is relatively sheltered, the shape factor is probably 1.0 or less. However, this should be confirmed by PLG and documented. Because the methodology used to develop fragility values for wind speed effects is inappropriate, we have not attempted to determine whether the resulting capacity values in the IPPSS report are correct. The offsite power fragility is assumed in the IPPSS to be controlled by the fragility of the transmission line towers. Because the offsite towers have not been specifically identified and analyzed, we believe that a median I i f 3-35 l
fragility wind velocity value of 140 mph is unconservative. It is likely that offsite power will be lost at a much lower wind velocity. We believe that it would be prudent to assume that offsite power is not available if either a tornado or hurricane occurs. The implication of this assumption is discussed below. We feel that there is no rational basis for the assumption that the upper-bound and lower-bound fragility curves are each weighted with probability 0.1. The result of this assignment causes the three middle fragility curves used for the hurricane and tornado analysis (see IPPSS report Tables 7.5-4, 7.5-5, and 7.5-6) to be nearly identical. Because of the apparently arbitrary assignment of probability values (i.e., 0.2 could have equally been used for the upper- and lower-bound curves), we do not have confidence in the spread of the probability distribution. Also, the mean values will change significantly for hurricanes as the probability assignments are altered. This.is due to the relative steepness of the hurricane hazard curves. We have not investigated further the influence of this effect. We reviewed Reference 5 and concur with the conclusion that the capacity of the main steam and feedwater 1ines correspond to an extremely high wind velocity value. For Unit 2, we believe that the possibility of either the turbine building or the superheater building (or parts from these buildings) failing and falling on the control building should be considered. Also tne possibility of the superheater building failing and falling on the diesel generator building and the condensate storage tank should be considered. The fragility curves for these structures should be developed to determine whether they effect the probability of core melt and subsequent release. SECTION 7.5.4 INDIAN POINT UNIT 2 SECTION 7.5.4.1 Plant logic Based on the fault trees given in IPPSS report, Figures 7.5-6 a through f, the Boolean equations leading to core melt, Mywere checked. We generally 3-36
agree with the final expression given on page 7.5-12. We believe that part of the probability of the stack failing and falling on either the control building or the diesel generator bu11 ding was omitted. This contribution amountsto0.05hg y0.05hT. Because of the high capacity of the stack relative to the control and diesel generator buildings, this discrepancy has no significant impact. The significant contributors to core melt are due to wind pressure failure of offsite power h, the control buildingh, and the diesel generator building h. Note that the subscript "W" refers to either hurricane or tornado winds, while "T" refers only to tornado missile effects. The signifi-cantportionofthecoremeltBooleanequationishgA(@g V h ). The other parts of the equation are not important since the capacity for tornado missiles is relatively high. The implications of the differences between our opinion and the IPPSS approach in developing the hazard and fragility curves are discussed below in connection with release category 2RW. SECTION 7.5.4.2 Wind Core Melt Frequencies Based on the discussion below for release category effects, we believe that the mean annual frequency of core melt value of 4.3 x 10-5 per year for hurricane and tornado effects may be low by a factor of about 13 (a large e f fec t) . We do not believe that the confidence bounds given are meaningful. SECTION 7.5.4.3 Initial Assembly 1.eading to Release Category Frequencies Based on the fault trees given in IPPSS report Figure 7.5-6, 7.5-8, and 7.5-9, the Boolean equations leading to the release categories 2RW and 8A were checked. Implication of differences between our opinion and the IPPSS approach in developing the hazard and fragility curves is discussed for each ca tegory. 3-37
Release Category 2RW For hurricane winds, release category 2RW is dominated by the Boolean expressionhgA (hg V h) where the symbols correspond to offsite power, the control building (which houses the switchgear and batteries for starting the diesel generator), and the diesel generator building, respectively. Other parts of the equation are controlled by tornado missile capacities which are not possible for hurricanes. As discussed for Section 7.5.3, we believe that offsite power should be considered to have f ailed if a hurricane occurs. Loss of AC power results in a small break loss of coolant (pump seal LOCA) sequence with no injection and no containment safeguards. Because of the steepness of the hurricane hazard curves, assuming that offsite power is unavailable, will increase the mean frequency of 2RW by a f actor of at least 2. We also believe that the fragility curves may be on the unconservative side; however, due to the protection provided by adiacent structures, the implicitly assumed shape f actor value of 1.0 may have resulted in over predicting the control room fragility capacity for wind pressure effects. We feel that there is a great deal of uncertainty associated with the current fragility analysis. Based on review of Section 7.9.5, we believe that the median hurricane hazard curve is unconservative. A comparison of the IPPSS median and upper-bound curves with the curves obtained from an independent hazard analysis is shown in Appendix C. Using a range of hazard curves based on the independent analysis and the median fragility curve from IPPSS Table 7.5-4, with and without conceding failure of the offsite transmission lines, we obtain a f actor of 10 to 50 increase in release category 2RW. We believe that a factor of 20 increase is appropriate for differences due to the fragility and hazard curves because of the large uncertainty in these types of analyses. In developing the Boolean equation for 2RW, part of the probability of the stack f ailing and falling on the control or diesel, generator buildings was I omitted. The capacity of the stack is relatively high and the omission of the stack f ailing does not significantly effect the frequency of 2RW. In sumary, we believe that the 2RW mean failure frequency value of 2.7 x 10-5 per year for hurricane effects may be low by a factor of 20 due to revised fragility for offsite power and an increase in the hurricane hazard at the site. 3-38
For tornado winds, release category 2RW is dominated by the same Boolean expression as discussed above for hurricanes. Other parts of the sequence equation (i.e., including service water pumps and the RWST) are controlled by tornado missile capacities which are high relative to wind pressure capac-ities. Assuming that offsite power is not available will not change the tornado 2RW frequencies quite as much as for hurricane effects. Because the hazard curves for tornado are less steep than the hurricane curves, it is estimated that, if offsite power is unavailable, the mean value will change by a factor of less than 2. We believe that the tornado hazard curves are on the l conservative side and, if decreased based on comments made for Section 7.9.5, would lower the mean value by a factor of about 2. In summary, the mean value , of 1.6 x 10-5 per year is reasonable and probably conservative. Release Category 8A The Boolean equation for release category 8A was checked, and we agree with the final results except for the small contribution from failure of the stack which was neglected. For hurricane effects, the Boolean equation leads to a nearly impossible sequence involving failure due to missiles. For tornado effects, the control room must not fail while the RWST fails due to tornado missile. Since the capacity of the RWST is much higher than the control room, this sequence is not very likely; thus, the probability of 8A is essentially zero. SECTION 7.5.5 INDIAN POINT UNIT 3 SECTION 7.5.5.1 Plant Logic Based on the fault trees given in the IPPSS report, Figures 7.5-11 a through e, the Boolean equations leading to core melt, M, were checked. We agreed with the equations given in the IPPSS report. The significant contributions to core melt are due to failure of either the RWST, @ T, or the service water pumps h T. Other components in the sequence, such as offsite power and the AFW pump building, will fail due to 3-39
wind pressure at much lower wind velocities than missile failure of the RWST or the service water pumps. SECTION 7.5 3.2 Wind Core Melt Frequencies Based on the discussion below for release category effects, we believe that the mean annual frequency of core melt value of 1.3 x 10-6 per year is reasonable. We do not feel that the confidence bounds given are meaningful. SECTION 7.5.5.3 Initial Assembly Leading to Release Cateogry Frequencies Based on the fault trees given in IPPSS report, Figures 7.5-11, 7.5-13, and 7.5-14, the Boolean equations leading to the release categories 2RW and 8A were checked and found to be correct. Release Category 2RW The category 2RW sequence is dominated by the failure of the service water pumps, h T since failure of offsite power will occur at a much lower wind velocity. Because the RWST, hT, is in series with offsite power, it is not a major contributor to 2RW release. We disagree with the statement in the IPPSS report, page 7.5-19, that the auxiliary feed pump building is a dominant contributor to release category 2RW. This component is not part of the final Boolean expression. Since missiles from hurricanes are not a significant threat and hurricane wind pressures will not fail the concrete structures, there is no contribution to 2RW from hurricanes. As discussed in review of Section 7.5.3, we believe that.the failure of the service water pumps due to tornado effects is approxi-mately 10-6 per year. Thus, the mean value of 9.2 x 10-7 per year for category 2RW due to wind loading is reasonable. Release Category 8A Since missile failure of the RWST while the service water pumps remain operable is required for a category 8A release, hurricane wind pressures do not contribute to this release category. Without failure of the fan coolers, the dominant sequence fw an 8A category release is non-failure of the service 3-40
water pumps, h T, and f ailure of the RWST, hT. Both events are associated with missile capacities. An approximate check confirmed that the mean value of category 8A equal to 4.1 x 10-7 er year is reasonable. 3-41
l l J i SECTION 7.9.1 DAMES AND MOORE SEISMICITY STUDY Scope of Review In this section the seismicity study performed by Dames and Moore (D&M) is reviewed. The methodology used in the study to obtain a rational measure of the probability of frequency of levels of ground shaking is reviewed for adequacy and appropriateness. Important model assumptions, parameter selec-tions, and the evaluation of significant sources of uncertainty are also reviewed. In conducting our review, the references listed below were used. References
- 1. TERA Corporation, " Seismic Hazard Analysis - Solicitation of Expert Opinion," Lawrence Livermore Laboratory, NUREG/CR-1582 UCRL-53030, 1979.
- 2. Aggarwal, Y. P., and L. R. Sykes, " Earthquakes, Faults, and Nuclear Power Plants in Southern New York and Northern New Jersey," Science, vol. 200, pp. 425-429, 1978, i
\
l Seismic Hazard Model The seismic hazard methodology used in this study is adequate and appro-j priate for use in evaluating the seismic hazard. The seismic hazard model is I, typical of the modeling technique generally used and is a relatively stable procedure. We agree that the steps in the hazard analysis are: e Defining of seismogenic zones l e Estimation of seismicity parameters e Selection of an attenuation model We note that these steps are iterated upon to consider different interpretations of the data and variations in modeling assumptions. Each step is reviewed below. 3-42
Seismogenic Zones The selection cf seismogenic zones was based principally on the work in Reference 1. Two zones are considered in the analysis: a Northeast tectonic zone and the Piedmont and Piedmont-Cape Ann zones. The Northeast tectonic zone was derived on the basis of geologic considerations and the identifi-cation of small tectonic zones. The Piedmont zone was the preferred choice of the experts polled in the TERA study (Ref.1). The Piedmont-Cape Ann zone is an extension of the Piedmont zone to the north to include the Cape Ann area. As noted in the report, each of these source zone selections represents a rather broad interpretation of the seismicity in the region near the Indian Point site. We imply from the text, and the source zones selected, that no effort was made to review the seismicity in the region near the site. The report addresses the issue of a Ramapo fault zone as described in Reference 2. The study concludes, on the basis of the opinion expressed by the experts in the TERA study and the conclusion reached by the Advisory Committee on Reactor Safeguards, that insufficient evidence exists to consider . the Ramapo fault as an active earthquake generating source. Therefore, the source zone hypothesis set neglects a Ramapo fault zone. In Chapter 4 of car report we consider the impact of including a Ramapo zone in the hazard analysis. Seismicity Parameters Body wave magnitude (M b
) was selected as the earthquake source para-meter. To determine a recurrence relationship on M ,b historical Modified Mercalli Intensities were converted to magnitude using an empirical relation developed by Nutt11 from central U.S. data. Although the relation was apparently checked with northeastern U.S. data, and verified as to its appro-
, priateness for use in this region, this was not documented. This transfor-l l mation is a source of uncertainty in the analysis. The WCC seismicity study in Section 7.9.2 demonstrated the significant effect different mean I o -Mb curves can have on the annual frequency of exceedance curves. 3-43
.. _ _ _ _ - . _ _ .- = . --
The treatment of the uncertainty in the Richter b-value is considered l adequate. Also, the selection of Mb = 4.0 as the lower-bound magnitude is I reasonable. The selection of maximum magnitudes is based on the maximum observed intensity and the In-Mb relationship of Nuttli. The method used to define M b max is reasonable; however, the effect of using other reasonable lo - Mb relations should be considered. It is anticipated that the effect of consid-j ering other relations would result in lower frequencies of exceedance values. Estimation of Seismic Ground Motion The attenuation relation developed by Nuttli for sustained acceleration defined as a function of magnitude and distance is used. In our review of this section, we do not comment on the use of sustained acceleration as a measure of effective acceleration. Our comments on this topic are reserved for our review of Section 7.9.4 We agree that the Nuttli attenuation is a reasonable choice. The modification of suttained acceleration used in the DLM study to obtain peak acceleration is disregarded in our review because this effect is later removed when the family of seismicity is developed in Section 7.2. The study considers the development of a peak acceleration attenuation relation by attenuating epicentral intensities, applying an acceleration-
! intensity relation and then converting intensity to magnitude. This alter-native is rejected (given a probability weight of zero), due to the fact that ! the data base used to develop the relation is limited and not necessarily appropriate to apply in the northeast. We note that D&M has also given a probability weight of zero to the alternative of using an acceleration atten-uation function that describes peak acceleration in terms of epicentral
! intensity and distance. 4 The uncertainty about the attenuation curve is described by a lognormal t distribution with a logarithmic standard deviation of 0.60. This value is typical of the scatter in strong motion data. However, since sustained accel- , eration is used in the analysis, it would have been more appropriate to use I 3-44
i the logarithmic standard deviation derived in Nuttli's study. It is antici-pated that this difference will be small. Also, alternate assumptions on oln a could have been tested (with appropriate weights attached), but we suspect this would not have had much impact on the final results. Results of Analysis A series of results are presented indicating the sensitivity of the fre-quency of exceedance curves to variations in key parameters. The results are particularly sensitive to Mb max values and the activity rate for each zone. These two factors appear to be the dominant reasons for the Piedmont-Cape Ann zone producing the highest seismicity curve. The sensitivity analysis and the assigning of probabability weights to key parameters is considered reasonable and representative of the uncertainty in the process. Summary Comments The seismic hazard analysis conducted is judged to be reasonably compre-hensive in its treatment of the key elements of the process. A major drawback of the study is the absence of any detailed study and direct consideration of the seismicity in the area near the site. The importance of this is not significant due to the wide range of hypotheses considered in the study. The results of our seismic hazard analysis presented in Chapter 4, verify certain of the D&M calculations and investigate the impact of a Ramapo source. l 3-45
SECTION 7.9.2 WOODWARD-CLYDE SEISMICITY STUDY Scope of Review In this section the seismicity study performed by Woodward Clyde Consul-tants (WCC) is reviewed. The methodology used in the study to obtain a rational measure of the probability of frequency of levels of ground shaking is reviewed for adequacy and appropriateness. Important model assumptions, parameter selections and the consideration of significant sources of ! uncertainty are also reviewed. In conducting our review, the references listed below were used. References
- 1. Aggarwal, Y. P., and L. R. Sykes, " Earthquakes, Faults, and Nuclear Power Plants in Southern New York and Northern New Jersey," Science, Vol. 200, pp. 425-428, 1978.
i i l l 3-46
a INTRODUCTION We note that the WCC study was undertaken to provide "best estimates for actual input parameters," while attempting "to formally accommodate the uncertainties associated with the various input parameters where such uncertainties are judged to be significant." We interpret this statement to mean that a "best estimate" seismicity study is conducted, as opposed to one in which the discrete probability distribution on frequency is estimated. This interpretation was confirmed at the meeting in Albuquerque. The implications of this are discussed in our review comments of Section 7.2. . DESCRIPTION OF THE SEISMIC EXPOSURE MODEL 4 The seismic hazard methodology used in this study is adequate and appropriate for use in evaluating the seismic hazard. The seismic hazard model is typical of the modeling technique generally used and is a relatively stable procedure. We agree that the steps in the hazard analysis are: l e Identification of seismicity sources e Characterization of activity of seismicity sources e Characterization of attenuation of ground motion. We note that these steps are iterated upon to consider different interpretations of the data and variations in modeling assumptions. Each step in the analysis is reviewed below. Identification of Seismicity Sources We agree that seismic activity beyond a 200 km radius from the site will l l cause negligible ground motion at the site and can therefore be neglected in the analysis. 3-47
i Characterization of Activity of Seismicity Sources We agree that the mean activity rate of earthquakes can be expressed by the Gutenburg-Richter recurrence relationship. We further agree that upper and lower bounds may be used, however, we suggest that the use of the term,
" maximum credible earthquake," is an inappropriate description of the upper bound on earthquake size.
1 Characterization of Attenuation of Ground Motion We agree that the two sets of attenuation equations can be used in the analysis. No further comment on this section is required. SOURCE AREAS OR SEISM 0 GENIC ZONES The selection of seismic source zones was based on the following criteria:
- 1. Seismic activity throughout the area appears uniform,
- 2. The contemporary tectonic environment and geological structures are similar throughout the area supporting the model criteria of uniform likelihood of earthquake occurrence.
Selecting source areas on this basis, five source zones were identified for consideration in the analysis. We note that among the zones considered there is a comparatively small source area that encompasses the Ramapo f ault. The WCC report addresses the issue of the Ramapo f ault as a potential source zone. A conclusion is reached, on the basis of a review of Reference 1 and historic seismicity that a small Ramapo fault zone cannot be justified. Chapter 4 of this report investigates the impact of including a Ramapo f ault zone in the hazard analysis. The WCC study has selected Modified Mercalli Intensity as the source parameter. The selection of MMI is a common practice, particularly for seismic hazard studies in the eastern U.S. This approach is an acceptable 3-48
modeling alternative; however, as expressed in our review of Section 7.2, careful use should be made of this parameter in order to avoid potential inconsistencies in the analysis, l UPPER B0UND A key parameter in the seismic hazard analysis is the choice of an upper-bound epicentral intensity. The WCC study has chosen MMI VII with a 0.80 probability weight and MMI VIII with a 0.20 probability weight as estimates of an upper-bound epicentral intensity. The basis for this selection and the probability assignments is historical seismicity, recommendations for a design earthquake at Indian Point, expert opinion surveys, and subjective opinion. For reasons described below, we judge the distribution on maximum epicentral intensity is inadequate. Of importance in assigning maximum event sizes is to determine the largest historical events that have occurred in the area of concern. In WCC Source 1 three earthquakes of interest for assessing maximum event size are the December 19, 1737 earthquake, the November 30, 1783 event and the August 10, 1884 event, which had Modified Mercalli Intensities of VII, VI, and VII, respectively. Appendix A to this report contains the critical review of Professor Ronald Street. On the basis of a preliminary review of available references, for each of these events, Dr. Street provides estimates of the magnitude of these earthquakes on felt area. Using newspaper reports to determine felt areas and applying the magnitude-felt area relation by Street and Lacroix, Appendix A reports the following: Event Mb ,Lg Magnitude ] December 19, 1737 4.8 (10.30) November 30, 1783 5.2 August 10, 1884 5.6 (10.15) 3-49
A comparison between the preferred WCC I-Mb relation and Nuttli's relationship is shown in Figure 1. Based on the WCC magnitude-intensity relation, a composite estimate of the upper-bound magnitude using the WCC weighting of intensities VII and VIII is 4.87 Using instead Nuttli's relation, the composite estimate is 5.35. In our judgment, the upper-bound events used in the WCC study are low, based on the historical evidence. The discussion in this IPPSS report section regarding the selection of an upper-bound intensity contains the following statement: "The composite value h not an accurate representation of our uncertainty regarding upper bound." Should this be h? The following statement is made in the text, "Thus, historical events of significant size have not tended to localized near the site area. . ." The exact meaning of this statement with regard to assessing the upper-bound event size is not clear. The implication that this is a basis to limit the event size is a weak one, and it contrasts with the notion of uniform seismicity in the source zone. We note the fact that a number of intensity VII events have occurred in the region, and the assigning of a probability weight of 0.80 to intensity VII expresses a belief that the maximun. event which has been observed on a number of occasions is probably the largest event that can be generated in the region. Figure 2 shows the location of the largest events in the area near the Indian Point site. On the basis of the above points, we judge that the distribution on the maximum epicentral intensity is not adequately represented. We suspect that the mean value of the distribution, as well as the uncertainty in the estimate of this event are inadequate. As noted in other sections of this report, the selection of an upper-bound event is critical for the estimation of the frequency of exceedance for acceleration and also for the frequency of core melt and offsite consequences. Intensity Attenuation l To express the attenuation of ground motion a model is developed in two steps; site intensity, I ,s is expressed in terms of epicentral intensity, Io , 1 1 I l 3-50
and distance; and a peak acceleration intensity relation is obtained. The uncertainty about the attentuation relation is described by a lognormal distribution with a logarithmic standard deviation of 0.60. The standard deviation of 0.60 is claimed as being in the upper range of values used in previous studies; which previous studies is not clear. Also, since the basis of selecting the 0.60 value is not presented, we assume its selection is based on the results of regression studies on peak ground acceleration. If this is the case, the value of 0.60 is a typical value and not in the upper ranges as claimed. RELATIONSHIP BETWEEN EARTHQUAKES AND GR0l'ND MOTION The intensity-acceleration relation of Trifunac-Brady was selected for use in the study. It is interesting to note that the work by Murphy and O'Brien is considered to be more thorough, but is not the preferred choice. As results later indicate, the Trifunac-Brady relation is conservative in that higher frequencies of exceedance are obtained. Intensity - Magnitude - Ground Motion The dif ferences in intensity-magnitude relations are discussed. The statement is made, and we feel correctly so, that there is no physical reason to expect an exact relationship between intensity and magnitude. However, as a result of the differences between the WCC and D&M analysis, caution must be exercised in conducting a hazard analysis based on intensities. We feel that it is informative when conducting such an analysis to make a comparison with I-Mb relations and to assess magnitudes of the dominant events in the data base. This additional check will aid in ensuring consistency in the analysis. Discussion of Sensitivity to Input Parameters A sensitivity analysis was conducted to investigate the variability in results to assumed values of input parameters. The sensitivity studies demonstrate the ef fect of maximum event size, source zone geometry, intensity attenuation, intensity-acceleration relations, and the effect of different 3-51
I-Mb relations. An important result of the study shows that an intensity-based analysis and a magnitude-based analysis produced essentially the same result for exceedance frequencies for sustained acceleration. The result of j the sensitivity study is evidence of the degree of variability in the seismicity curves, as associated with modeling uncertainty. CHARACTERIZATION OF GROUND ACCELERATION Effective Acceleration Comments on the choice of effective acceleration are reserved for the review of Section 7.9.4 Upperbound for Sustained Acceleration Arguments are presented to determine an upper-bound estimate on sustained acceleration. The basis of these arguments follows consideration of past experience, and the need to limit the mathematical model that describes the dispersion in ground motion. In order to define the upper-bound accelerations, the study chooses to use an approach that does not consider the intensity-acceleration model employed in the hazard model. Instead, sustained acceleration data reported by Nuttli were used. Although we agree that other arguments can be applied to define the limit on the extreme value, the basis provided here (Nuttli data) suggests that an acceleration attenuation model would have more appropriately been
- defined on intensity and calculated sustained acceleration.
As discussed at the PLG meeting, if truncation of the hazard curves is to be carried out, it would be more appropriate to truncate the lognormal distribution within the hazard analysis. However, it was also agreed, and later verified in an independent calculation, that the method of truncation used in the IPPSS is conservative in that the annual frequencies of exceedance of accelerations below the truncation level would be higher. l 3-52 l
I i i 1, i I . CONCLUSIONS To conclude our review of this section, we feel that the mean and the uncertainty in the distribution on the upper-bound intensity is inadequate. We note that the study provides a "best estimate" of the seismicity curves, rather than the discrete probability distribution on frequency. For this reason the uncertainty in the seismicity curves is not as great as obtained in the D&M study. The results of our seismic hazard analysis presented in Chapter 4 verify certain of the WCC calculations and investigate the impact of a Ramapo source. 4 ! 3-53
SECTION 7.9.3 STRUCTURAL MECHANICS ASSOCIATES, INC., FRAGILITY STUDY Scope of Review In this section, the development of the fragility curves for seismic effects is reviewed. In addition to comments on the text, we reviewed the calculations for selected structures and equipment. The results of the calculation check are discussed in the appropriate section beicw. The references used in the review are listed below. References
- 1. Newmark, N. M. and W. J. Hall, " Development of Criteria for Seismic Review of Selected Nuclear Power Plants," NUREG/CR-0098, May 1978.
- 2. Wesley, D. A., P. S. Hashimoto, and R. B. Narver, " Variability of Dynamic Characteristics of Nuclear Power Plant Structures," Seismic Safety Margins Research Program, Lawrence Livermore National Laboratory, Livermore, California, NUREG/CR-1661, UCRL-15267, July 1980 (prepared by Structural Mechanics Associates).
- 3. Structural Mechanics Associates, " Engineering Characterization of Ground Motion," Presentation of Task I, USNRC Research Project, San Francisco, California, December 2, 1981
- 4. Riddell, R. and N. M. Newmark, " Statistical Analysis of the Response of Nonlinear Systems Subjected to Earthquakes," Department of Civil Engineering Report UILU 79-2016, Urbana, Illinois, August 1979.
- 5. Wesley, D. A. and P. S. Hashimoto, " Seismic Structural Fragility Investigation for the Zion Nuclear Power Plant," Seismic Safety Margins Research Program, Lawrence Livermore National Laboratory, Livermore, California, NUREG/CR-2320, UCRL-15380, October 1981 (prepared by Structural Mechanics Associates).
3-54
~ _- _ _ _ _ _ _ _ - _ _ - _ . _ _ __ __ . - _
- 6. Benda, B._ J., J. J. Johnson, and T. Y. Lo, " Phase I Final Report--Major Structure Response (Project IV)," Seismic Safety Margins Research Program, Lawrence Livermore National Laboratory, Livermore, California, NUREG/CR-2015, Vol. 5, UCRL-53021, Vol. 5, August,1981.
- 7. Wesley, D. A. and P. S. Hashimoto, " Nonlinear Structural Response Characteristics of Nuclear Power Plant Shear Wall Structures,"
Transactions of the 6th International Conference on Structural Mechanics in Reactor Technology, Paris, France.
- 8. Pickard, Lowe, and Garrick, Inc., " Zion Probabilistic Safety Study,"
USNRC Docket Number 50-295 and 50-304, 1981.
- 9. ASCE, Structural Analysis and Design of Nuclear Plant Facilities, Manuals and Reports on Engineering Practice, No. 58, 1980.
- 10. Ang, A. H-S and N. M. Newmark, "A Probabilistic Seismic Safety Assessment of the Diablo Canyon Nuclear Power Plant," Report to the USNRC, November 1977,
- 11. Kennedy, R. P., et al., " Subsystem Fragility," Seismic Safety Margins Research Program, (Phase 1), Lawrence Livermore National Laboratory, Livermore, California, NUREG/CR-2405, UCRL 15407, February 1982 (Prepared by Structural Mechanics Associates).
3-55
SECTION 1. INTRODUCTION Differences between Units 2 and 3 were noted on IPPSS report page 1-4. In addition, the Unit 2 diesel generator building and portions of the primary auxiliary building are steel frame structures. The completeness of the components listed in Table 1-1 was checked , indirectly by Sandia in their review of the seismic fault trees in IPPSS Section 7.2. SECTION 2. GENERAL CRITERI A FOR DEVELOPMENT OF MEDIAN SEISMIC SAFETY FACTORS SECTION 2.1 DEFINITION OF FAILURE We accept the definition of failure used in this study. SECTION 2.2 BASIS FOR SAFETY FACTORS DERIVED IN STUDY We noted on IPPSS report page 2-4 that there was a general lack of detailed information available for this study concerning seismic fragility of structures and equipment. As discussed in Chapter 2, we believe that more detailed analyses should be conducted for structures / equipment which are . I
\
dominant contributors to the offsite consequences. ! SECTION 2.3 . FORMULATION USED FOR FRAGILITY CURVES We believe that the mathematical presentation in this section tends to confuse the casual reader. Because of the inherent simplicity of the method, we offer the following explanation of how it works. It is assumed in the analysis that the capacity of a structure or equipment, in terms of ground acceleration, is lognormally distributed. Thus, the frequency of failure is a function of three parameters: (1) the median capacity value, A; (2) the logarithmic standard deviation for capacity, 87 , 3-56
- ~ _~ . _ _ _ _ _ . .___-
i and (3) the ground motion input acceleration value. Note that any randomness in the ground motion value or building or equipment response is included in the Br value. Figure 7(a) shows the capacity frequency density function which v is determined by A and 67 . If the ground motion value is A g , then failure occurs for all values of A less than Ag . Thus, the frequency of failure is just the area under the density function between A equal to 0 and Ag . We could stop at this point and just use this procedure to obtain various values of frequency of failure (for different Agvalues) and plot the fragility curve as shown in Figure 7(a). The problem is that A is not known with certainty. (It is assumed that the logarithmic model and 8 7 value are known in a vrelatively certain sense). Thus, a second lognormal distribution for A is used to quantify the uncertainty fo this parameter. It is determined by two parameters: the median value, , and the logarithmic standard deviation for uncertainty in the median value,Su. The probability density function for k is shown in Figure 7(b). v v Now depending on what value of A is picked from the distribution on A (see Figure 7(b)), a corresponding fragility curve can be calculated (see Figure 7(a)). For example, if the 95 percent probability fragility curve was v desired, then A would be selected sucg that there is a 0.95 probability that a larger median value woufd occur. If A is 0.77g and B u
= 0.39, then for the 0.95 probability level A = .4g. This value comes from the following equation, which is the mathematical representation of the solution shown in Figure 7(b):
v V - A = A exp Su
- l II - P) where 4(-) = Standard cumulative normal distribution and $-1 is the inverse function p = Probabil ity value (e.g. , 0.95 )
Now, if the fragility frequency of failure value, assuming 8 7 is 0.36 is desired corresponding to a ground at e aration A g equal to 0.4 9, the answer 3-57
. _ m
^
i l l 1 i , l ) can be found from the lognormal distribution with median value to 0.4g (see l Figure 7(a) and Br equal to 0.36). The answer is 0.50 and is found from the ! following equation: i
. v.
F(A9 ) =$ in A/A Or ' SECTION 3. DIFFERENCES BETWEEN CURRENT METHODS AND CRITERI A USED FOR INDI AN POINT FOR SEISMIC QUALIFICATION OF STRUCTURES AND EQUIPMENT. SECTION 3.1 EARTHQUAKE LEVEL SPECIFIED FOR DESIGN No comments are made for the introductory paragraphs. SECTION 3.2 FREE FIELD STRUCTURAL RESPONSE SPECTRUM ANCHORED TO PEAK GROUND ACCELERATION It is not obvious why as (sustained acceleration or damage-effective) can be used to anchor the ground response spectral shapes from Regulatory Guide
]
(RG) 1.60 which is based on peak response acceleration. It would be more l appropriate to redo the statistical analysis using recomputed spectral shapes for the earthquake time histories normalized to the as response level (as i opposed to peak ground acceleration as done in the original study for RG l l 1.60). In the text, two methods for defining design spectra are recognized:
- specifying site dependent spectra, or using broad-banded spectra such as in Regulatory Guide 1.60. The IPPSS risk analysis used broad-banded spectra. By this selection a source of modeling error is created in the analysis.
In the IPPSS report, there is no uncertainty component for variability in ! the response spectra at all, only randomness. If this were true, then there would be no motivation to ever conduct site studies to develop site-specific spectra. Remember that randomness is irreducible and the IPPSS report broad-banded ground response spectra have no uncertainty. Based on discussions at 3-58 l m _ _
the meeting with PLG, it was suggested that assuming variability to be evenly divided betveen randomness and uncertainty would be a reasonable division. The effect on the total parameter values for Indian Point structure / equipment (i.e., median, Br, andB u ) is not significant. SECTION 3.3 D AMPI NG The damping values given in IPPSS report Table 3-1 are reasonable values for structures and equipment items when the applied stress is near yield. These values are the same as values recommended by Newmark and Hall (Ref. 1). A study of the sensitivity of response of the Zion Auxiliary building for dif ferent effects was conducted for the Lawrence Livermore National Laboratory Seismic Safety Margins Research Program (SSMRP) program (Ref. 2). As part of It this study, the effect of damping on structure response was investigated. was found that structure response for a particular earthquake time history (or set of time histories) is weakly affected by damping in the range of 3 to 10 percent. Variation of the median responsa value was less than 25 percent in this range. For in-structure response spectra (which affects equipment response) the damping of the structure had a minor effect except near the fundamental frequency of the structure where the difference was approximately a factor of 2 between the response for 3 and 10 percent damping. This last result indicates that the fragility curves for equipment or substructures with naturai frequencies near the fundamental frequency of a supporting structure should reflect the expected structural damping. From discussion at the meeting with PLG, it was verified that all structures which support safety-rela 6ed equipment will probably yield before the equipment capacity is reached. This substantiates using yield level damping values for determining structure response. 3-59
SECTION 3.4 LOCATION AT WHICH FREE-FIELD GROUND RESPONSE SPECTRA ARE SPECIFIED We agree with the assumption that the free-field motion is the same as the input motion at the base slab foundation level for the Indian Point site. SECTION 3.5 SOIL-STRUCTLRE INTERACTION We agree with this section. SECTION 3.6 COMBINATION OF RESPONSES FOR EARTHQUAKE DIRECTIONAL COMPONEN j We agree that the alternate method, consisting of combining 40 percent of , the response in two orthogonal directions of motion with 100 percent of the response in the principal direction, is appropriate to use as a median centered method. SECTION 3.7 SPECIFICATION OF SEISMIC INPUT FOR PIPING AND EQUIPMENT It is not clear from the description what differences were found between ! the algebraic summation procedure and the SRSS procedure for combining modal responses. We assume that these differences, if any, were incorporated into , the development of the piping fragility parameters.
- SECTION 3.8 LOAD COMBINATIONS The possibility of a severe event which causes a LOCA, followed by an aftershock should be considered. Pressurization of the containment building may fail the reinforcing steel which would weaken the capacity of the building. If this situation occurs, an aftershock could cause additional damage and possibly failure. Although we doubt that this type of occurrence will contribute significantly to the frequency of failure, the possibility should be analyzed and the results documented.
3-60
SECTION 3.9 STRESS CRITERIA FOR SEISMIC DESIGN OF CRITICAL STRUCTURES AND CONTAINMENT Since in the Indian Point reactor building analysis the reinforcing steel was held to the yield value rather than allowing the full ductile capacity to be developed, the Indian Point design criteria appear to be generally more conservative than the USNRC Standard Review Plan criteria. We noted in the review of the strength parameters for the containment walls that the strength of concrete in shear was considered in developing the fragility curves. SECTION 3.10 ALLOWABLE STRESS CRITERIA FOR SEISMIC DESIGN OF PIPING AND MECHANICAL EQUIPMENT Since above-ground piping were not found to be critical components, this section was not reviewed in detail. Thus, no specific comments are made for this section. However, comments concerning piping as a series system are made for Section 5.2.3.1 SECTION 3.11 SEISMIC CLASS I ELECTRICAL AND INSTRUMENTATION No specific comments are made for this section. Comments concerning development of fragility values for electrical components and instrumentation are made later in this chapter. SECTION 4. STRUCTURES SECTION 4.1 SAFETY FACTORS, LOGARITHMIC STANDARD DEVIATIONS, t AND COEFFICIENTS OF VARIATION No comments are made for the introductory paragraphs. 3-61 l . _ _
SECTION 4.1.1 Structure Capacity No comments are made for the introductory paragraph. SECTION 4.1.1.1 Concrete Compression Strength We noted that the overstrength f actor was based on data typically reported for other nuclear power plants rather than data from Indian Point test results. It is our understanding from the meeting with PLG that extra uncertainty was included for this consideration, but found to be small. It is implied in this section that the strength of test cylinders is similar to the strength of in-place concrete. However, it is stated in this section that some decrease in strength is present in in-place concrete. We believe that the variability between test cylinders and in-place concrete is larger than the variability factors for concrete cylinders. Thickness of concrete members and the availability of moisture contribute to actual concrete strength in concrete members. Our estimate is that a logarithmic standard deviation of at least 0.2 would be appropriate. What is more relevant to the question of capacity is the properties of in-place reinforced concrete strength which includes factors such as construction joints, boundary condition, shrinkage and creep properties, etc., which can be more important than the f ff value for concrete material. SECTION 4.1.1.2 Reinforcing Steel Yield Strength The values used were compared with similar values given in Appendix A of Reference 3 and were found to be in agreement. We feel that it is inappropriate to lump No. 3 through No. 11 bars in the same category. No. 3 bars are stronger per unit area than No. 11 bars. How-ever, larger bars comprise the reinforcement generally found in reinforced concrete members in nuclear power plants. This may create a slightly uncon-servative bias. However, we judge that the effect of this bias is small. 3-62
l l i 1 SECTION 4.1.1.3 Shear Strength of Concrete Walls The basis for Equation 4-3 given in this section of the IPPSS report was reviewed and we agree that this equation is an acceptable prediction of the ultimate strength of shear walls bounded on four sides by concrete members. ' We feel that the contribution of reinforcement steel given by Equation 4-5 is questionable; however, we did not review the references which led to its derivation. This equation implies that for an aspect ratio (height / width) of 1.0 the vertical steel has no effect on the strength. We find this hard to believe. Also, the logarithmic standard deviation value of 0.15 appears low. 4 SECTION 4.1.1.4 Strength of Shear Walls in Flexure Under In-Plane Forces We did not review this section in detail. We have no comments. SECTION 4.1.1.5 Strength of Steel Frame Structures i We concur that the medium yield strength of 44 ksi for dynamic motions is reasonable; however, due to the uncertainty in strength of plates and webs versus flanges, we would have expected the total variability expressed by the logarithmic standard deviation to be larger than 0.11 (i.e., value corres-
- ponding to webs). A value of 0.15 would be more reasonable. However, the small difference between 0.11 and 0.15 is not significant to offsite consequences.
SECTION 4.1.2 Structure Ductility Figure 4-3 in the IPPSS report shows the relationship between the ductility value and the deamplification f actor used to increase the median capacity of shear walls for inelastic energy absorption. It should be noted that the results shown in this figure are based on single-degree-of-freedom (S00F) elastoplastic systems. At a workshop held in December,1981, sponsored by the USNRC, SMA presented the results of a research project directed to the f i 3-63
development of a basis for selecting design response spectra based on free-field motion (Ref. 3). The results of the analytical studies support the deamplification curves given in Figure 4-3. It was found for one example comparison that the difference between Figure 4-3 (IPPSS report) and the metho'd ology developed by SMA when applied to a broad-banded spectrum was less i than 10 percent. The study done for the USNRC is based on a different approach than taken by Riddell and Newmark (Ref. 4) which is the basis for Figure 4-3 and thus is a good check. Both the SMA and the Riddell and Newmark studies were based on S00F models. As noted in Reference 5, considerable uncertainty exists in the application of these techniques to multi-degree-of-freedom (MD0F) systems. No I accepted methods currently exist for applying the deamplification factor for SD0F models to MD0F systems. This problem is particularly complex when localized ductilities contribute significantly to the overall strength of a building. 1 In addition to the variability in the ductility model (it appears that a value of 0.12 was used) an uncertainty measure should also be included for the ' inaccuracy of using a SD0F model to predict behavior of a MDOF system. A non-linear MD0F analysis of the auxiliary building was conducted for the (SSMRP) (Refs. 6 and 7). As part of this study, five input time histories were applied to the model until a ductility value of four was reached in the weakest element. The ratio of the peak ground acceleration value at failure (defined at a ductility value of four) to the corresponding value at yield was found to range between 1.33 and 1.60 with a median value of 1.43. In compari-son, the method used in the IPPSS report to account for inelastic behavior (Figure 4-3) gives a deamplification factor of 0.43 for 10 percent damping. The inverse of this value is 2.35, which is much larger than the more rational I median value of 1.43. This comparison points out the potential differences which can exist between the response of a MDOF structure and the response as predicted by a S00F model. Our judgment is that there is a large uncertainty which exists ! and which should be reflected in the fragility parameters. For the dominant structure contributors to offsite consequences (i.e., impact between the Unit i 3-64 l l
_ . _ . - = .- . - _ . . _- - .. - . ... - I i 1 and 2 control rooms for IP-2 and the control building shear wall failure for IP-3), the inelastic energy absorption f actors are close to 1.0. Thus very little energy absorption is being relied upon. This conclusion is also ! applicable to the analysis for the control room ceiling f ailure. We feel that 4 this issue does not impact on the final results. However, in general, the i uncertainty for the energy absorbing f actor is equal to a B-value of 0.1, which we consider to be too small. SECTION 4.1.3 Structure Response We accept the methodology described in this section. We note that soil-structure interaction is left out of the list, but is discussed in Section 4.1.3.4. i i SECTION 4.1.3.1 Model Response This category includes the effects of: l e Input ground spectra e Damping e Frequency e Mode shape We generally agree with the approach used in this section except for the following areas. As discussed above (see comments for Section 3.2), a larger uncertainty value should be included for the response spectrum input to reflect the
- potential error between site-specific spectra and the broad-banded site-independent spectra which were used in the analysis.
There is in general a coupling (dependency) between damping and frequency effects. The logarithmic standard deviation values would be different if a combined value were calculated rather than computing the contributions from
- frequency and damping separately. We judge that this consideration would have l a small effect on the IPPSS results.
I ! 3-65 l
The logarithmic standard deviation on frequency was estimated to be about 0.2 for all Indian Point structures. This value is different from the value of 0.3 which was used by S?M in the Zion probabilistic safety study (Ref. 8). The results of a study conducted for the SSMRP, where four mathematical models were developed for the same structure, support using the value of 0.3 (Ref. 6). Since the calculations for the original design analyses were not checked, we feel it is more consistent to use 0.3. The small difference between 0.2 and 0.3 is not significant to offsite consequences. For the effect of mode shape, a logarithmic standard deviation value of 0.10 was used for all Indian Point Class 1 structures. We agree that this is a reasonable value as long as the model has sufficient detail to predict the response of interest. For example, if a flexible floor slab is lumped at a column line in a finite element model, the uncertainty in predicting vertical response at the center of the floor is much larger as compared to results obtained from a model where the floor slab details are included. It was learned at the meeting with PLG that potential flexibility of elements which may not have been modeled (e.g., out-of-plane response of walls) was considered in the fragility parameter calculations. SECTION 4.1.3.2 Modal Combination The values used for this consideration appear to be reasonable based on the data provided in Figure 4-4 SECTION 4.1.3.3 Combination of Earthquake Components The 100 percent-40 percent-40 percent method is discussed in Reference 9 where it is stated that it is more conservative than the SRSS method.
- However, we feel that either of the two methods, can be used to predict median
! response. Comments on parameter values for this effect are discussed below as appropriate for specific structures. 3-66
} SECTION 4.1.3.4 Soil-Structure Interaction Effects
- We agree with this section.
i SECTION 4.1.3.5 Response Factor Estimate l We noted that in general the median factor of safety for the response j factor is between 0.84 and 1.5 for the concrete structures and as high as 2.3 for steel structures. Many of the median factors are close to unity. The primary contribution to the median value comes from the difference between the design response spectra and the median response spectra used in the IPPSS. Most of the conservatism in the design of structures is due to strength and
! energy absorption.
No discussion is given in the IPPSS report concerning the basis for separating variability into the randomness or uncertainty components. It was confirmed at the meeting with PLG that the variability separation was based almost c tirely on subjective judgment. We believe that this fact should be stated i.. the IPPSS report so that the reader knows the basis. SECTION 4.2 REACTOR BUILDING The calculations for the shear capacity of the containment walls for Units 2 and 3 were reviewed. From the calculation sheets, we conclude that the computations follow the general procedure described in the IPPSS sections. The strength factor was obtained using half of the total containment wall length. This apprears to be reasortDip considering that the unit strength is based on formulas for walls with ace dary elements; one could argue that the remaining half length of tb J. 9 aerforming that function. We note, however, that the strength ryovided f.y the steel was reduced instead of increased due to the 45 0 inclination of the reinforcement. The overall strength appears to be about 25 percent larger than the reported values. We also estimated the strength using a different assumption (including projection of the walls normal to the loading direction), whic!< yielded strengths more i than 50 percent higher than reported. We conclude that the reported median l 1 2 3-67
values are conservative; on the other hand, the variations produced by the various assumptions indicate that the uncertainty has been underestimated. The 10 percent increase in ductility (from 4.0 to 4.5) due to the diagonal reinforcement is adequate, if not conservative. Diagonal reinforcement will delay the development of diagonal cracks. This fact, in addition to the potential reserve of strength mentioned above, offsets doubts concerning the implicit assumption that onset of significant structural damage occurs at a i ductility level of 4.0. The reported median strength f actor for Unit 2 is lower than the value for Unit 3, although Unit 2 has about twice the amount of steel (which increases overall strength by about 25 percent). The additional horizontal load on Unit 2 is caused by the earth backfill. There are no details available in the calculations concerning how the additional force was resisted. We made an approximate calculation of the height of backfill corresponding to the total force in the calculations. It is our impression that the IPPSS estimate is conservative and that the Unit 2 strength factor is higher than reported. j We tried to g&in additional insight from the calculations as to how the uncertainty, and in some cases, the overall variability was estimated. The calculation sheets tend to confirm that variability was almost entirely based on subjective judgment. As mentioned before, we do not disagree with this method, given the general lack of information. However, we feel that the reported logarithmic standard deviations are generally smaller than they should be. Calculations for other f ailure modes of the containment (e.g., failure of the base mat ) were not available. The same situation occurs for the
- auxiliary pump building. However, we do agree that the critical f ailure mode of the reactor buildings is damage to the containment walls; thus, the review of other calculations is not necessary.
In regard to the substantial reduction of capacity which wculd occur due to a LOCA, we believe that this possibility should be evaluated (see discussion for IPPSS report Section 3.8 above). For the 1.1g capacity of the Unit 2 containment building, the corres-ponding vertical acceleration probably would be less than lg; thus, it is , unlikely that it would be thrown into the air. 1 l 3-68
SECTION 4.3 AUXILIARY BUILDING The results for individual wall panels appear to be reasonable. The basis for the statement that gross structural f ailure has a median capacity greater than 39 should be documented. SECTION 4.4 UNIT 3 CONTROL BUILDING AND DIESEL GENERATOR BUILDING The calculot. loris for the capacity of the Unit 3 masonry walls at El. 53'-0" and the masonary walls enclosing the battery room, and the shear capacity of the N-S walls of the control building were reviewed. Masonry Walls The calculations for the block walls in Unit 3 based on the retrofitted capacities were reviewed. Our general impression is that the fragility values for the retrofitted walls are based on subjective assumptions. The major contributors to the median safety f actor and its variability are strength and ductility. The latter is assumed to be 3.0 which appears reasonable. The strength f actor is inferred from Brown's Ferry data (not available to us) and a subjective, probably conservative, modification. We have not pursued this component further because the walls are not a key component. One wall is logically in parallel with the diesel generator batteries, and it appears that a moderate change in the wall safety f actors would have only a minor impact on the overall plant fragility. N-S Shear Walls of Control Building The set of calculations that was provided to us consists of two main l parts: a dynamic analysis of the control building-diesel generator building complex tied at elevation 32'; and a strength analysis of the governing walls (earliest expected f ailure), labeled here and in the IPPSS report as "N-S l Shear Walls of Control Building." We did not check the dynamic analysis in detail. Although, our general impression is that it is adequate for the purpose of the IPPSS. The masses 3-69
and stiffnesses appear to be properly considered, including details such as openings and plan locations of the walls. By comparing the resulting net seismic forces with the size (length) and location of the walls, it appears that the critical wall was properly selected. The strength analysis of the critical wall appears to be based on reasonable assumptions (e.g., linear strain distribution) and incorporates pertinent details (e.g., openings, flanges of transverse walls). There is some degree of conservatism present due to the assumed length to height ratio for the critical pier and the assumed load demand, but the effect of changing this assumption would be negligible (from the numerical results point of view). The randomness estimate is consistent with values for other shear walls. The basis for the uncertainty estimate is not documented. For the energy absorption factor, it was assumed that the structure was rigid (11 Hz) which reduced the median factor to almost unity (1.2). The randomness (SR = 0.03) does not match the value reported in Table 4-10 (BR* 0.13). The small randomness in the calculations is also due to the rigid j structure condition. The other contributor to the overall safety factor is the spectral shape which is less than unity because of the structure rigidity. We have no specific comments concerning other potential contributors to the safety factor and its variability. The basic assumptions made to account for variability are consistent with those for other components. SECTION 4.5 UNIT 2 CONTROL BUILDING The calculations for the capacity of the Unit 2 control room based on impact between the Unit 1 and 2 roof slabs were reviewed. The calculations for the higher capacity value which assumes that the impact problem is l eliminated were not checked. Note that the median capacity of the roof impact mode is 0.279 and is the predominant contributor to the offsite consequences for Unit 2 in the original analysis. l The main concern for this building is the possibility of impact with the superheater building of Unit 1 which would occur at a low acceleration level 3-70
well within the elastic limit of the structural system. A rigorous analysis for this problem would involve random vibration theory. The IPPSS calcula-tions indicate that an SRSS combination of the displacements of the two structures was used. This is probably the simplest acceptable method of evaluation and we agree that the results are reasonable. Our only concern is the possible dynamic " beating" effect that has a period of about 2 to 3 seconds (which is less than the duration of the strong motion caused by the closeness of the principal vibration periods of the two structures). The main contributor to the safety factor is the relatively small displacements predicted by the median response spectrum (which produces smaller responses than those predicted by the original design spectrum). We agree that the nominal gap between the buildings can be increased for the additional deformation required to f ail the connection between the roof and its supports. Local member flexibility is the basis for increasing the gap. The deflections were linearly scaled from the results of the elastic dynamic analysis. This is reasonable since yielding will not occur at the level associated with impact. We did not find any explicit reference in the calculations to document the statement that no combination of out-of-phase motions is expected to cause impact below 0.22g. We ,iudge this lower limit to.be slightly higher (0.25g), thus, we consider the 0.22g value to be conservative. We believe that the IPPSS estimate is conservative in the sense it assumes that the control room is out of operation as soon as the roof welds f ail. There may be some margin of safety beyond that point, although it is difficult to assess this belief quantitatively.
- SECTION 4.6 UNIT 1 SUPERHEATER STACK The calculations for the capacity of the Unit 1 superheater stack were reviewed and found to be consistent with the procedures followed for other components. It appears that not all the structural data were available to SMA (e.g., the thickness of the steel plates was backfigured from the allowable 3-71
buckling stress from the original design results; also, the top diameter of the stack was assumed). The original structural model also was not available (e.g., it is not clear if a rotational spring support or a superheater roof response spectrum was used). Due to these uncertainties and the other assumptions made concerning the dynamic behavior of the shortened stack, we are not able to state whether the evaluation is conservative or not. Since basic information was not available, we did not attempt to perform a check analysi s. We believe that the strength factor uncertainty (given as 8 equal u to 0.15 which is not documented) is too small considering the analysis that was performed. However, it was noted that the total reported variability (Sc = 0.42) is the largest of all the critical components (see IPPSS Table 4-14). We agree with the assumption that the stack could collapse in any direc-tion, provided the superheater building does not have a dominant direction of vibration (which was the assumption explicitly stated in the calculations). However, if there is a dominant direction caused by either the characteristics of the ground motion or the building, the frequency of hitting a specific structure will change (e.g., either increase or decrease). We judge that any reasonable assumptions would not significantly effect the risk of offsite consequences. SECTION 4.7 UNIT 1 SUPERHEATER BUILDING We did not check the calculations for this structure; however, we noted that the inelastic energy absorption factor median value is 3.2 (corresponding to a relatively high ductility value of over 7) and an uncertainty 8-value of l only 0.10. As discussed above for IPPSS report Section 4.1.2, we feel that a ' much higher uncertainty value should be used. This is even more applicable to structures with high median inelastic energy absorption factors such as the superheater building. Since this structure is not a dominant contributor, we do not believe that an increase in the uncertainty will have a significant effect on the frequency of offsite consequences. 3-72
SECTION 4.8 UNIT 2 TURBINE BUILDING Comments for the Unit 2 turbine building are the same as given above for the superheater building. SECTION 4.9 UNIT 2 DIESEL BUILDING Comments for the Unit 2 superheater building are also applicable to the Unit 2 diesel building. Because the dominant capacity for Unit 2 is low relative to the capacity for this structure, a more detailed analysis was not performed. However, because of the importance of this structure, and since the Unit 1 and 2 control room impact problem was eliminated in the revised analysis, a detailed analysis of this structure should be conducted. SECTION 4.10 BURIED CONCRETE STRUCTURES We concur that the strengths of the buried concrete structures are relatively high. SECTION 4.11 FUEL STORAGE BUILDINGS The calculations for this structure were not reviewed. SECTION 4.12 NONCRITICAL STRUCTURES Based on our tour of the Indian Point site, we did not observe any other major structures which could f ail and f all on safety-related systems and components. SECTION 5. EQUIPMENT FRAGILITY SECTION 5.1 GENERAL APPROACH AND INFORMATION SOURCES We noted that no new analyses were conducted for equipment items. 3-73
SECTION 5.1.1 Information Sources for Equipment No comments are made for this subsection. SECTION 5.1.2 Equipment Categories I No comments are made for this subsection. SECTION 5.1.3 Response Factor Categories We agree with the categories in this subsection. SECTION 5.1.4 Structural Response As noted for Subsection 4.1.3.1, we raised the issue of mode stape ordinate error due to flexibility of a local element or substructure. This is particularly appropriate for development of fragility data for subsystems which are supported by the structure. Modal combination is not included in the list of variables. This is because the floor response spectra used to design the equipment were developed using a direct integration procedure. SECTION 5.2 EQUIPMENT CAPACITY FACTORS 4 Specific comments are made for each of the sections in the following text. In order to assist in determining the implication of issues and questions which are raised, the components listed in Table 5-3 of the IPPSS report were associated with the various report sections. Table 2 lists the IPPSS report sections, components, and median ground acceleration values. Particular attention was given to key equipment (see IPPSS report Tables 7.2-3 and 7.2-7). , 3-74 l
In reviewing many of the fragility parameters, it was not clear what specifically constituted the underlying bases. We raise this issue for specific parameters in order to determine which ones are based on data, engi-neering judgment, or a combination of these sources. For example, one parameter which is common to almost all components is material yield strength. The basis for assuming that the median yield value is 1.25 times the code specified value should be documented (however, this does appear to be a reasonable value). The basis for the variability S cvalue of 0.14 and the associated randomness and uncertainty components of pS equal to 0.1 and B u equal to 0.1 also should be documented. It was learned at the meeting with PLG that the separation of variability into its randomness and uncertainty components was primarily based on judg-ment. We believe that this should be documented in the IPPSS report. In instances where analysis or data form the basis for selecting parameter values, this should be documented. We do not object to determining parameter values subjectively, but feel it is imperative that the reader know what was done. SECTION 5.2.1 Plant Specific Structural Capacities Derived from Design Reports It is stated in this section that the logarithmic standard deviations for capacity (i.e., randomness and uncertainty), were derived in the same manner as for structures. We noted for Subsection 4.1.3.5 that the basis for separating the total variability into randomness and uncertainty components for structures is not provided. Our understanding is that this was done primarily using engineering judgment. This should be jocumented in the IPPSS report. The ductility factor used vor equipment (Equation 5-5) is different from the approach used for structures, which was based on deamplification factors for elastic-perfectly plastic systems (see Figure 4-3 in IPPSS report). For structures, the ductility factor is a function of ductility and damping, while the factor for equipment is a function of only ductility. However, the differences between the two approaches are small. 3-75
Since both factors (i.e., for structures and equipment) are for single-degree-of-freedom elastic-perfectly plastic systems, there is inhei ent error in using these models for multidegree-of-freedom equipment (see comments for i Subsection 4.1.2 for the same problem for structures). A lagarithmic standard deviation value of 0.2 was used for uncertainty. We believe that a realistic value is higher and that an additional small value for randomness should also be included. SECTION 5.2.1.1 Reactor Pressure Vessel It is not clear from the description exactly how the median strength and variability were calculated. In particular, variability is not documented for the shape factor. The basis used to determine the two logarithmic standard deviation bounds and the basis for the ultimate strength (i.e., versus the yield strength) used in determining the upper-bound strength should be documented. The variability of Equation 5-5 aue to variability of only ductility , gives Sequal to 0.23 based on the combined value being 0.30 and the varia-l bility in the equation itself being 0.20. The value of 8 equal to 0.23 ' apparently comes from the following calculation:
~
g_ _l- in V2m - 1 2
/2(1.5) - 1 .
Another way to compute the value is to use a Taylor series expansion approach which gives a median value of F , equal to 2.27 (compared to 2.24) and S equal to 0.21 (compared to 0.23). Thus, the method used in the IPPSS report gives acceptable values. SECTION 5.2.1.2 Reactor Pressure Vessel Intervals 4 l The basis for the median shape f actor value for collapse moment equal to l.86 (we noted that 4/r x 1.144 equals 1.46, not 1.86) should be docu-
- mented. Also, the basis for assuming that 4/r is minus 2 logarithmic l standard deviation values below the median should be given.
3-76
The derivation of the strength f actor is not clear from the text. At the start of the section, seismic stresses, for a Housner spectrum anchored to 0.259 for the OBE, were found to be 51.2 percent of the code allowable value of 1.5 S m. For the DBE, considered to be twice the OBE, the stresses were found to be 1.12 times median yield strength (does this imply that median yield is 1.37 S,?). The strength f actor is then computed to be 1.86 divided by 1.12 or equal to 1.66. It is not clear what ground acceleration value this calculation is related to. We feel that these issues will not ultimately impact on the user of offsite consequences. SECTION 5.2.1.3 Steam Generator The approach used for this component appears to be reasonable. Any small changes in the parameter values will not affect the frequency of core melt analysis since the median capacity is relatively high. SECTION 5.2.1.4 Reactor Coolant Pump 4 The capacity for this component is relatively high. SECTION 5.2.1.5 Pressurizer The calculations for this component were reviewed. The calculations contain the analysis for the equipment capacity f actor. There was no infor-mation about the derivation of the response f actor. The response f actor computations are discussed for IPPSS Section 5.3.2.1. In determining the capacity f actor, two conditions were analyzed: the capacity of the base flange and the capacity of the bolts. We did not checked numerically the computations, but we agree with the general flow of calcula-tions and the details that were considered. The sources of information for the structure data are referenced except for the DBE load which is only stated. We believe that sufficient detail was consid2 red to produce reliable results. 3-77 i i
Although we do not have complete information, we generally agree with the the median acceleration capacity. The variability parameters appear to be consistent with other IPPSS results. SECTION 5.2.1.6 Control Rod Drive Mechanisms We estimate the median ground acceleration value for this component to be between 29 and 3g, which agrees with the IPPSS report. SECTION 5.2.1.7 Reactor Coolent Piping Basically the capacity of this component is the same as for the reactor pressure vessel except thermal stresses have been removed since they are considered to be self-limiting. Even if the thermal stresses were included, the capacity of the component is very high and thus, will not affect the frequency of offsite consequence calculations. SECTION 5.2.1.8 Safety Injection Pump In developing the median strength f actor value of 1.64, a shape f actor of 1.5 and a yield strength f actor of 1.25 are assumed (i.e.,1.64 = (35 x 1.50 x 1.25/ 40)) . The shape f actor value should be documented in the report. I We understand, based on the meeting with PLG, that the variability logarithmic standard deviation for material equal to 0.14 is based on data. This f act should be documented along with the data or literature source where the analysis of the data can be found. I In developing the uncertainty for the strength f actor, uncertainty also should be included for the f act that the pump material is not specified and an assumption that it is carbon steel was made. Although the shaf t/ bearing interaction median capacity is slightly larger, variability for this f ailure mode should be computed. A large variability for a slightly weaker mode may produce a larger probability of frequency of f ailure at acceleration values below the median. 3-78 1 _ _ ._ - - -
SECTION 5.2.1.9 Residual Heat Exchanger In developing the uncertainty for the strength factor, uncertainty also should be included for the fact that the heat exchanger shell material is not known and an assumption that it is 516-Gr 60 was made. In an identical PRA analysis for the Zion plant, the possibility of buckling in the shell was considered. In this case, no inelastic energy absorption was assumed (Ref. 8). In the IPPSS, a median energy absorption f actor of 1.73 was used corresponding to anticipated ductile behavior. Since the heat exchangers are essentially the same in both plants, only one of the assumptions should be correct. Since the median capacity for this component is relatively high, the resolution of these issues will not affect the frequency of offsite consequences. SECTION 5.2.1.10 Component Cooling Heat Exchanger The capacity for this component is relatively high. SECTION 5.2.1.11 Accumulator Tanks The capacity for this component is relatively high. SECTION 5.2.1.12 Boron Injection Tank The capacity of this component is relatively high. SECTION 5.2.2 PLANT-SPECIFIC FUNCTIONAL CAPACITIES DERIVED FROM DESIGN REPORTS We believe that eliminating inelastic energy absorption is conservative; however, it may be more appropriate in some cases to include the effect of ductility. In these cases, the median capacity would be higher, which would 3-79
be offset to some degree by a higher uncertainty value to reflect the ; inability to determine when a functional f ailure occurs. SECTION 5.2.2.1 Containment Fan Coolers I Based on our meeting with PLG, we learned that the worst case manuf ac-turing tolerance stack-up would occur approximately 2 in 1,000 cases (i.e., approximately -3a ) based on manuf acturing experience. We feel that this should be documented in the IPPSS report along with the data or literature source for the data. The basis for other assumptions in this section should also be documented. Calculations for the containment f an coolers were reviewed. The calcula-tions show the development of the safety f actors and associated logarithmic i standard deviations. The development follows the procedure given in the IPPSS report, and the variabilities are consistent with the general assumptions used throughout the IPPSS report. The selection of the critical strength factor from three possible f ailure modes is documented; the main data, however, are only referenced and not otherwise given. From this information we are unable to conclude about the accuracy of the strength f actors. All we can state is that a systematic procedure was used. We note, however, that this equipment is logically in parallel with two other component paths. The impact of changes to the capacity of the fan coolers will be negligible to the overall plant fragility. SECTION 5.2.2.2 Residual Heat Removal Pumps (RHR) The basis for the assumptions made in this section should be documented. i l 3-80
i SECTION 5.2.3 GENERIC STRUCTURAL CAPACITIES DERIVED FROM DESIGN CRITERIA No comments are made for the introductory section. SECTION 5.2.3.1 Piping and Supports We believe that it can be unconservative to base the fragility of the pipir,g system on the single component type most likely to f ail. This
! procedure implicitly assumes that the individual components are perfectly correlated. In reality, a piping system consists of a series of components ! whose capacities and responses are each partially dependent (Ref.10). One approach for including this effect would be to determine an equivalent number of independent components, which would be based on the type of elements (e.g.,
butt welds, their number, location, etc.). Because piping systems can be very long, it is prudent to make a best estimate of the effect of dependency even if it is only based on engineering judgment. In discussions with PLG it was stated that most piping systems have only one or two critical components. The rest of the components are generally overstressed. If this is the case, then it does not matter whether or not l partial independence is assumed. We believe that it is prudent to look at each safety-related piping system to determine that it is in fact reasonable to assume that only one component controls the capacity, i It is not clear in later development of the fragility parameters if the effect of the combination "0.751" in the stress acceptance equation was incorporated. SECTION 5.2.3.1.1 Support Failure Modes The decision to base the fragility analysis on supports that only carry seismic load implicitly assumes that the total applied stress as a percentage of the design stress is essentially the same whether normal stresses are present or not. This assumption appears to be reasonable. 4 3-81
SECTION 5.2.3.1.2 Piping Fragility In developing the ratio of static collapse load to allowable design load (i.e., P /PL D
), if we assume a ratio of S to h yield to be between 0.625 and 0.9 (along with the other f actors given in this section), we find that P L/PD ranges between 1.62 and 2.33. If we then incorporate the various P N/PD and P /P ratios given in this section into equation 5.4, we'obtain a median 0BE D value of 4.6 (compared to 5.9) and a ss of 0.40 (compared to 0.27). We believe that these differences would not affect the frequency of offsite consequences.
SECTION 5.2.3.1.3 Support Fragility Description It was learned at the meeting with PLG that the logarithmic standard deviation value of 0.42 for the strength factor was obtained by establishing a lower bound f actor of safety using a minimum strength (code yield stress of 25 ksi reduced 15 percent for welding or threads, i.e., 21.2 ksi) and a maximum load stress of 1.1 times design strese which is 50/4 x 1.2 x .75 = 11.25 ksi where 1.2 is a short term load f actor and 0.75 is also a f actor for threaded connections. The lower bound f actor of safety is then equal to 21.2/(1.1 x 11.25) or 1.7. T' un 8 is equal to 1/3 (in 5.9/1.7) or 0.42, where 5.9 is the median factor. We believe that this is incorrect since the effect of threaded connections appears to be included twice and the code yield stress is not increased by a f actor of 1.25 to a median value. A more rational 8-value would be 0.28 instead of 0.42. On the other hand, a 3e range seems high. If a more defendable 20 range is used, the S-value is back to 0.43. Thus, we concur with the value used. 3-82
- SECTION 5.2.3.1.4 Governing Criterion for Piping i
Except for the issue of dependence between piping system components, we l feel that the issues raised will not affect the frequency of core melt analysis. However, as stated above, since the piping systems can be long with many components (hence potentially many locations for f ailure), the effect of dependency could lower the effective piping capacity sufficiently such that piping becomes an important component. We are willing to accept the argument, in general, that only one or two components are stressed to allowable values ! in a piping system; however, we feel that each critical piping system should be reviewed to determine that this assumption is appropriate. SECTION 5.2.3.2 Generic Fragility for Other Equipment That Fails in a Structural Mode It appears that the combined normal plus OBE load could range as high as 1.3 times (not 1.1) the allowable design load. i We reviewed the calculations for the median strength f actor and the ' associated logarithmic standard derivations. We do not agree entirely with the method used, but feel that the values obtained are reasonable. We note in IPPSS report Table 5-3 that median ground acceleration values i for low capacity components in this category are as follows: , Unit 2 Unit 3 i Condensate Storage Tank 1.28 g 1.28 g RWST 0.70 g 0.70 g Diesel Generator Oil Storage Tanks 1.14 g 1.14 g i 1.07 g Batteries and Racks 1.37 g ' Service Water Pumps 2.47 9 2.47 g Spray Additive Tank 1.01 g 1.01 g Duckwork and Dampers 1.12 g 1.12 g i We reviewed the calculations for the condensate storage tank, the RWST, the diesel generator oil storage tanks, the batteries and racks, and the service water pumps. I l 3-83 f l
4 1 l Diesel Storage Tanks According to the documentation provided to us by SMA, the tanks were not . analyzed. The tanks were assigned a generic capacity for heavy equipment (page 5-43, 5-44 of IPPSS which is 1.14g). For an underground structure this j capacity is credible and probably conservative, but somewhat arbitrary. The most important component for Unit 3 is the diesel generator fuel oil , tanks which is a significant contributor. We believe that specific fragility calculations should be performed for this component. i Other Components We reviewed the calculations for the battery racks, service water pumps, RWST, and the condensate storage tanks. The method of development of the safety f actors is consistent with the IPPSS report. Actual strength calcula-tions were not found but the calculations point out the sources of information (i.e., previous Zion plant PRA results) or state previously calculated strengths, presumably from separate computations (e.g., condensate storage tank). The randomouss and uncertainty measures appear to be consistent with i others used in the report; although this is difficult to check on an item-by- ) item basis. While the accuracy of individual values may be low, it is our j opinion that in combination they represent a systematic way of assembling the
- basic information.
l l We note that, except for the battery racks in Unit 2, all the components l discussed in the previous paragraph have at least one degree of redundancy, l according to the fault trees. SECTION 5.2.4 Capacities Derived from Tests for Higher Seismic Zone Criteria 4 i
- The capacities for components that are included in this category are relatively high such that any small changes in the parameter values will not affect the frequency of offsite consequence analysis.
i f
- 3-84 i
SECTION 5.2.5 Generic Capacities Derived From Military Shock Test Data No comments are made for the introduction. SECTION 5.2.5.1 Electro-mechanical Equipment It is not clear fron Table 5-3 which component fragility values were developed based on Army Corps of Engineers test data for electrical-mechanical equipment. This should be documented in the IPPSS report. Comments concerning capacities determined using data from the SAFEGUARDS program tests are discussed in the next subsection. SECTION 5.2.5.2 Electrical and Control Equipment Reference 11, which was prepared for the SSMRP by SMA, gives background on reduction of data from the SAFEGUARDS program. This reference does not represent on independent check since both this IPPSS report section and Reference 11 were prepared by the same authors. We generally concur with the development of hazard curves for relay chatter and breaker trip. However, we are unconfortable with the general conclusion that f ailure occurs at a level three times the fragility level for recoverable interruptions. Our position is based on two points. First, the duration of the input in the SAFEGUARDS tests was only 2 seconds long. During a large seismic event, the duration of motion will be on the order of ten to twenty seconds long. We 4 can conceive of f ailure at a lower acceleration level due to the effects of duration. Second, we are concerned whether the equipment tested in the SAFEGUARDS program is representative of the specific safety-related equipment at Indian Point. We agree that nonrecoverable f ailure is higher than relay chatter or breaker trip. However, we question whether the strength is a f actor of three higher, or possibly only fif ty percent higher in some specific cases. We recommend that if a particular electrical or control component is a dominant contributor (or potentially a contributor) to offsite consequences, that a 3-85
specific analysis be performed for that piece of equipment. At a minimum, the ; particular components (i.e., switches and breakers) should be compared to the l units tested in the SAFEGUARDS program. If the units are different, then an independent basis for determining the fragility should be found. For the case of Indian Point, the following equipment from Tables 5-3 and l 5-4 are potential contributors. The values given are median ground l acceleration capacity values for recoverable interruption. Unit 2 Unit 3 Equipment Symbol Capacity Symbol Capacity Diesel Generator Controls 1.30g 1.30g 120 VAC Distribution Panels 1.65 1.19 480 VAC Motor Control Centers 1.65 1.17 480 VAC Switchgear and Station Transformer - - h 1.51 For Unit 2, any reasonable f ailure capacity is much larger than the dominant contributor which has a median capcity at 0.279; thus, we see no problem for Unit 2. This conclusion is also valid for the revised analysis, if the failure of the enntrol room ceiling is included. However, for Unit 3 the equipment associated with the diesel generator has recoverable capacities similar to the fuel oil tanks which is a dominant contributor. We recommend that the capacities of three times the values for equipment listed above for Unit 3 be confirmed. SECTION 5.2.6 Generic Capacities for Valves Based on discussion at the PLG meeting and inspection of Indian Point, we concur that the capacities for the safety-related valves at Indian Point are l l relatively high. 1 I 3-86
SECTION 5.2.7 Cable Trays The calculations for the cable trays at Unit 2 were obtained. These refer back to this section of the IPPSS report. However, we feel that the capa-cities of individual cable trays (and supports) are reasonable. As discussed above, we feel that the capacity of a single support may be unconservative since there are many cable tray supports in series which are safety-related. Since they are not perfectly dependent, the frequent . of f ailure may be less than for a single support. Based on our inspection of Indian Point and our review, we believe that potential f ailure of cable trays are not dominant contributors to offsite consequences. SECTION 5.2.8 Offsite Power We agree that the median capacity of ceramic insulators is low and it is reasonable to assume in the systems analysis that they have f ailed. SECTION 5.2.9 Diesel and Gas Turbine Generators Based on our inspection of Indian Point, we agree that the fragility of these units is dominated by the control panel fragility. See comments for Section 5.2.5.2 above. SECTION 5.3 Equipment Response Factors We have no ccmment on the introduction to this subsection. SECTION 5.3.1 Plant-Specific Equipment Qualified by Dynamic Analysis The residual heat exchanger was selected as an example to demonstrate the methodology of deriving the response f actors. For clarification and use in the review of later sections, the enveloped floor response spectrum used in the design, and the applicable IPPSS floor response spectra should be pro-3-87
vided. No discussion was given as to what method was used to determine the applicable IPPSS floor spectra. Depending on the method used to develop the applicable Indian Point floor response spectra, the basis for determining uncertainty due to modeling may be different. SECTION 5.3.1.1 Spectral Shape l l The basis for the variability value of 0.10 should be documented. SECTION 5.3.1.2 Qualification Method We agree that the response spectrum method is median centered with variability equ'al to zero. SECTION 5.3.1.3 Damping The approach used in this section is reasonable. Since the response spectra are not available, we did not review the calculations. SECTION 5.3.1.4 Frequency The approach used in this section is reasonable. Since the response spectrum was not provided, we did not review the calculations. SECTION 5.3.1.5 Mode Shape l We agree that the response factor for mode shape is 1.0. The assumption that the logarithmic standard deviation is 0.15 for multi-degree-of-freedom and 0.1 for single-degree-of-freedom systems is not substantiated in the text I or in the referenced report (Ref. 50). Clarification of these values is I needed. It is unrealistic to assume tMt the variability is constant for all equipment. 3-88 1 i 1 1 i L _ _ 1
It has been assumed here and in previous sections that the residual heat exchanger responds predominantly in a single mode. No basis is provided to support this. However, we anticipate that any change to the mode shape parameter will have a small effect on the frequency of offsite consequences. SECTION 5.3.1.6 Mode Combination The approach used in this section is reasonable. SECTION 5.3.1.7 Combination of Earthquake Components It appears that the variability value of 0.09 comes from assuming a 30 difference between the median value of 1.08 and the maximum value of 1.41. We agree with the median response f actor value that was derived. SECTION 5.3.1.8 Combined Response Factor and Variability We have no additional comments for this subsection. SECTION 5.3.2 Plant Specific Equipment Qualified by Dynamic Analysis We have no additional comments for this section. SECTION 5.3.2.1 Flexible Equipment We reviewed the calculations for the pressurizer as discussed below. i i l , 3-89 t -
I SECTION 5.3.2.1.1 Oualification Method SECTION 5.3.2.1.2 Damping It was stated but not referenced in the calculations, that the DBE static load was 0.969 . This, and a 5 percent damping spectrum yielded a factor of
- 2.4 which is consistent with the combined f actors in the IPPSS report (1.28 for 1 percent damping and 1.88 to reduce it to a 5 percent damping value).
The damping variabilities in the calculations seem to be an earlier version of those used in the final report; differences are minor. Provided the input data are correct, we agree with the results. SECTION 5.3.2.1.3 Frequency SECTION 5.3.2.1.4 Mode Shape SECTION 5.3.2.1.5 Mode Combination Frequency, mode shape, and mode combination are treated in the calcula-tions as a general modeling error. Again the calculations seem to be an earlier version of the final reported values in the IPPSS report. We agree with the values in the final report. SECTION 5.3.2.1.6 Combination of Earthquake Components Since the E-W floor response is small compared to the perpendicular direc-tion (0.4g vs 0.19 )9 the 100 percent-40 percent-40 percent method gives a i median value barely above the 0.4g value for the strong direction. The vector l sum was taken as a worst case and the 0.4g value as the best case; then the median was obtained by a logarithmic average using a 2 standard deviation ! range. The value obtained is canservative. The effect of this result on the ! fragility of the pressurizer 15. about 4 percent. I i i 3-90 4 f
i SECTION 5.3.2.1.7 Combined Response Factor and Variability We have no additional comments for this section. SECTION 5.3.2.2 Rigid Equipment We agree that the only response f actors to be considered for rigid equip-ment are the qualification method and earthquake component. SECTION 5.3.2.2.1 Qualification Method The applicable floor response spectrum was not available to verify the qualification method f actor of 5.56. We agreed that there is a small variability associated with the qualifi-cation method f actor, with the exception that there may be an uncertainty This component due to the method of determining the floor response spectrum. concern was also raised earlier in comments for Section 5.3.1. SECTION 5.3.2.2.2 Earthquake Component Combination We reviewed the calculations for this f actor. Although we do not entirely agree with the method used, we feel that the median and variability v~alues are reasonable. SECTION 5.3.2.2.3 Combined Factors and Variability l We have no additional comments for this section. SECTION 5.3.3 Plant-specific Equipaent Qualified by Test We agree that the response f actors cited are those which should be considered for equipment qualified by testing for the IPPSS. 3-91
SECTION 5.3.3.1 Spectral Shape We have no additional comments for this section. SECTION 5.3.3.2 Boundary Conditions We agree that the test conditions can be assumed to be median centered with respect to the conditions at the plant. We note, however, that different failure mechanisms may exist for the supports in the IPPSS plant. For example, in the tests, bolt support failure was a possibility while under plant conditions; this is reportedly not a likely event. However, the report (Ref. 50) does not provide variability for this difference. During our tour of the Indian Point facilities we did see numerous panels which were bolted to the floor slab. Hence, we feel that the test conditions may be very similar to the Indian Point construction. SECTION 5.3.3.2 Damping We agree that the median response f actor due to damping is 1.0; however, L insufficient information was provided to verify the derivation of the variability factors. SECTION 5.3.3.3 Frequency Insufficient information was provided to verify the derivation of the response f actor and variability. The basis for assuming that the response corresponding to the frequency range 5 to 10 Hz is a +2a range should be documented. This assumption results in a low logarithmic standard deviation ! on response. l 3-92 l
SECTION 5.3.3.4 Multi-mode Effects [ l The basis for assuming the range 1 to 1.5 to be +2a above the median sho~uld be documented. SECTION 5.3.3.5 Earthquake Component Combination We reviewed the calculations for this f actor. Although we do not entirely agree with the method used, we feel that the median and variability v'alues are reasonable. SECTION 5.3.3.6 Combined Response Factors and Variability We have no additional comments for this section. SECTION 5.3.4 Response Factors for Generic Categories of Equipment The basis for defining various types of equioment as generic, particularly in situations where the systems are complex, should be provided. SECTION 5.3.4.1 Piping 6" in Diameter and Less The approach used to establish the median factor and variability due to qualification method is reasonable. Note that the section number 5.3.4.1.1 evidently was dropped. SECTION 5.3.4.1.2 Damping A simple assumption was used to determine the frequency of all piping systems. Although the estimate appears to be reasonable, there is an additional uncertainty component in the method used to develop the response f actor and variability, particularly since the f actor is being applied to all piping situatinns. It is anticipated that only small changes would result if additional uncertainty was added for this effect. 3-93
SECTION 5.3.4.1.3 Frequency. Mode Shape and Mode Combination We agree that these variables are all contained in the qualification method and its variability. SECTION 5.3.4.1.4 Combinations of Earthquake Components The method for developing the parameter values for this section is the same as for Section 5.3.2.2.2, which we reviewed and concur that the parameter values are reasonable. SECTION 5.3.4.1.5 Total Response Factor and Variability We have no comments for this section. SECTION 5.3.4.2 Piping 6" in Diameter and Greater ni We agree that the f actors cited are those to be addressed for this class , of piping. , SECTION 5.3.4.2.1 Spectral Shape We have no additional comments for this section. SECTION 5.3.4.2.2 Qualification Method We have no comments for this section. 3-94
l 1 l I t SECTION 5.3.4.2.3 Damping 4 The basis for choosing 10 Hz as the frequency to develop the response 1 I f actor for damping should be documented. Given the various piping configura-tions, a single frequency is not appropriate. In addition to the variability associated with the randomness due to material effects, there would also be a ) component of uncertainty due to the method for selecting pipe frequencies and ! the variability in frequencies throughout the plant. I l SECTION 5.3.4.2.4 Frequency We agree that the modal analysis is median centered. The basis for using 10 Hz as the median value sho.uld be documented. l f SECTION 5.3.4.2.5 Mode Shape _ We agree that the response spectrum analysis is median centered. The , basis for the logarithmic standard deviation of 0.15 should be documented. The same comments we made for mode shape for structures (see Subsection 4.1.3.1) also apply here. !I SECTION 5.3.4.2.6 Mode Combination We have no additional comments for this section. SECTION 5.3.4.2.7 Combination of Earthquake Components We have no additional comments for + his section. 1 J 1 l 3-95 1 c.----
i i I l SECTION 5.3.4.3 Valves T 4 We agree that valves can be considered rigid for frequencies above 20 Hz. No reference is provided, however, to support the assemption that all valves have frequencies greater than 20 Hz. We agree that the response j acceleration of a rigid valve will be equal to the acceleration of the pipe at $ the point of attachment. We feel that a similar set of parameters could be i developed for valves similar to the development for piping less than 6 inches i in diameter. i SECTION 5.3.4.3.1 Qualification Method The basis for using a range equal to the ZPA to 1.5 times the peak spectral acceleration as a +2 orange should be documented. , i ! SECTION 5.3.4.3.2 Damping I l Wc agree that the factor is median centered; however, there should also be 1 i l a component of variability attributable to the valve, in addition to that associated with the piping, albeit this may be small. J l SECTION 5.3.4.3.3 Frequency, Mode Shape and Mode Combination We have no additional comments for this section. t SECTION 5.3.4.3.4 Combination of Earthquake Components l We agree that this factor is identical to that. determined for piping. We have no additional enr* r.ts for this section. I j 3-96 i l l
.,_-..---_-,m,-_ _. - , _ . - _ _ _ _ . - _ , - - . _ . . _ _ _ . . _ ,_ ,__._ _,_. _.._, . _ _ _ - _ _ . , _ _ . . . _ - - _
d iI ! i 1 I J i SECTION 5.3.4.4 Floor and Wall-Mounted Equipment With Generic Capacities [ We have no additional comments for this section. ! 7 i SECTION 5.3.4.5 Cable Trays f We agree with the method for determining the response factor. 1 SECTION 5.4 Structural Response Factors Comments concerning these f actors are made for the Sections 4.1.2.1 through 4.1.2.6 from Chapter 4 of IPPSS Section 7.9.3. i SECTION 5.5 Fragility Description J l No coment. I { I i i t l i 4 e 3-97 i
. - - - - . , - . . _ _ - - - _ . - - - . . --_r-,, -- ,--,m,,. . - - - , - , , _ _ , - , _ ._ _ _ . -
< - . . , v- -- - - , , -,
SECTION 7.9.4 STRUCTURAL MECHANICS ASSOCIATES, INC. DAMAGE-EFFECTIVE GROUND ACCELERATION Scope of Review The basis for converting peak ground acceleration to damage effective ground acceleration and the upper bound cutoff on effective acceleration was reviewed. Two additional sources were also read and used in the review of these two concepts. References
- 1. Kennedy, R. P., " Peak Acceleration as a Measure of Damage," Presented at Sixth International Seminar on Extreme-Load Design of Nuclear Power Facilities, Paris, France, August 1981. l l
- 2. Kennedy, R. P., W. H. Tong, and S. A. Short, " Earthquake Desion Ground i Acceleration Versus Instrumental Peak Ground Acceleration," SMA 1205.01R, Structural Mechanics Associates, Newport Beach, California, ,
December 1980. 3-98
t i i i ! SiCTION 1. INTRODUCTION l i 1 We concur with the concept that near-field lower magnitude earthquakes are ! generally less damaging than f ar-field magnitude events with the same instru-
! mental peak ground acceleration value. We raise several issues, which are
^ discussed in the next section, which question how this concept was applied in l the IPPSS. 1 SECTION 2. EFFECTIVE PEAK VERSUS INSTRUMENTAL PEAK AND SUSTAINED PEAK ACCELERATIONS As part of our review for this section, we read Reference 1, which explained in more detail the concepts discussed in Section 7.9.4. Reference 1 in turn refers to a report which documents the basis, that for the purpose of predicting elastic response of structure in the 2 to 10 Hz frequency range, median broad-banded amplification spectra (such as used in developing the fragility curves) are more accurately anchored to an acceleration value equal In Reference 2, twelve earthquake response spectra to 1.25 x A3F (Ref. 2). are compared to the mean plus one standard deviation WASH-1255 amplification for each time history. spectrum anchored to 1.25 x A3F Visually, the comparison between the two types of spectra (actual and broad-banded) in Reference 2 are convincing. In the 2 to 10 Hz frequency region, the comparison appears to be median centered. However, it is difficult to visually determine what the difference would be if the median amplification spectrum (which was used in the IPPSS report) had been used instead. It woeld be more comforting if a statistical analysis had been performed to verify that 1.25 is the appropriate f actor. The adjustment of the anchor acceleration value must be done with caution. Near-field low magnitude response spectra tend to be peaked at one (or more) natural frequency for a particular site. In general, the broad-banded spectrum will be conservative except near the peak of the site-specific spectrum, where it may be just right. Thus, the correction factor F is appro-priate in a median sense; however, there is uncertainty which exists for any 3-99
specific structure. It makes a difference whether a fundamental building frequency is higher or lower than the frequency corresponding to the peak of a site-specific spectrum, in regards tc whether significantly less damage will ocenr for a near-field. low magnitude event. A rational procedure for det,ermining a value for F for a specific struc-ture would be to determine the relative damageability between the best esti-mate of the site-specific response spectrum and the broad-banded spectrum used in the IPPSS analysis at the fundamental frequencies of the structures being considered. We are also concerned about applying this concept to equipment located in j a building without first confirming that it is appropriate to do so. A struc-ture acts as a filter which smooths the incoming seismic time history to produce a more sinusoidal appearing time trace at equipment support loca-tions. Whether the same argument for the factor F can be made for equipment housed in a structure as for structures supported on the ground needs to be documented. The value of F recommended in this section is equal to 1.25. We believe that even if the value were 1.0 that only a small effect would occur to the frequency of core melt analysis for Unit 2 and a moderate effect for Unit 3 for the original analysis given in the IPPSS report. In general we believe that a value of F equal to 1.25 is on the conservative side for structures. For equipment located in structures, which have a capacity below the capacity of the equipment, this value of F is probably also conservative. The argument given by SMA at the meeting with PLG is that the sof tening of the structure stiffness at high levels of ground motion d il decrease the input to the equipment. All safety-related equipment which affects potential offsite consequences f alls into this category. This value may not be conservative for certain equipment located on the ground or attached to the base of structures. Equipment, which does not have inelastic energy-absorption capacity or which depends on function capacity, respond more . closely to the peak ground acceleration capacity. One example of this type of equipment is the service water pumps which depend on binding of the pump shaft for capacity and which are located at the ground level. However, the capacity of this 3-100
component is relatively high and eliminating the 1.25 acceleration f actor 1 would not significantly change the results of the analysis. SECTION 3. UPPER BOUND CUT OFF ON EFFECTIVE PEAK ACCELERATION t Af ter considerable discussion and thought concerning the use of an upper-bound cut-off on effective peak acceleration, we believe that it is more appropriate not to truncate the hazard curves, but to reflect a limit on i damagability in development of the fragility curves. The mechanism to handle this effect is currently not an element of the fragility analysis. A new f actor or redefinition of an existing f actor is required to treat the frequency dependent effect. I 3-101
, , - .__,,,y, -e----_w,
SECTION 7.9.5 RESEARCH TRIANGLE INSTITUTE REPORT WINDSPEED RISK ANALYSIS OF THE INDIAN POINT NUCLEAR GENERATING STATION Scope of Review This section of the IPPSS report gives the basis for the tornado and hurricane (including extratropical winds and thunderstorms) wind speed hazard curves. We performed an approximate analysis for torntdo effects, which convinced us that the hazard curves are conservative. Dr. Larry R. Russell reviewed in depth the material in the section on hurricanes (see Appendix C). We also offer comments concerning the development of the hurricane hazard curves. Comments concerning extratropical wind hazard curves and the approach used to develop the probabilistic f amily are also given. References
- 1. Fujita, T. T., "Workboo'K of Tornados and High Winds for Engineering Applications," Department of the Geophysical Sciences, The University of Chicago, SMRP Research Paper 165, September 1978.
- 2. Thom, H. C. S., "New Distribution of Extreme Winds in the United States," J. of Structural r ision ASCE, Paper 6038, IC68.
- 3. Changery, M. J., " Historical Extreme Winds for the United States -
Atlantic and Gulf of Mexico Coastlines," prepared for U.S. Nuclear Regulatory Commission, NUREG/ CR-2639, May,1982. 4 Mcdonald, James R., "A Methodology for Tornado Hazard Probability Assessment," NUREG/CR 3058, August,1982. l S. Abbey, R. F., and T. T. Fujita, "Use of Tornado Path Lengths and Gradations of Damage to Assess Tornado Intensity Probability," American Meteorlogical Society 9th Conference on Severe Local Storms, Norman, Oklahoma, 1975. ! 3-102 l \ .- . _ _ ..- - -
l 1
- 6. Abbey, R. F., and T. T. Fujita, " Dapple Method for Computing Tornado Hazard Probabilities and Refinements and Theoretical Considerations,"
American Meteorlogical Society lith Conference on Severe Local Storms, l' Kansas City, Missouri,1979. i l l l l l 3-103
- SECTION I.. INTRODUCTION We interpret the statement
- "no localized wind regime mechanism is assumed to be present," to mean that the effects of topography in the vicinity of the site and the arrangement of buildings at Indian Point were not specifi-cally included in the mathematical models used to develop the wind speed hazard curves given in the IPPSS.
SECTION II. PROBLEM DESCRIPTION We note below that probabilities were subjectively assigned to the lower and upper bounds. The probability distribution for the frequency of wind speed occurrence was not obtained by assigning uncertainty to the fundamental underlying parameters. IPPSS report Table 11-1 and the description of the structures at the Indian Point site are not pertinent to the analysis documented in this section. The wind hazard curves which were developed are for the Indian Point site and not for any specific structure or pairs of structures. It was learned at the meeting with PLG that a draft report for this section contained hazard curves for individual structures. Subsequently, curves were presented for the Indian Point site in general. Evidently, the discussion concerning plant and target definition is lef t over from the draft report. Our understanding is that IPPSS report Figure II-l outlines an area which was used to establish upper- and lower-bound hazard curves for tornado effects. We believe a more natural selection of a target area should also include structures from Unit 3. The effects of a large area would be to lower the lower-bound and raise the upper-bound hazard curves slightly. However, since significant tornado strike areas are large relative to the site area overall effects of this difference are judged to be small to moderate, i i 1 l 3-104
SECTION III. TORNADO WIND SPEED RISK ANALYSIS General An independent chck of the tornado wind speed hazard curves was conducted
- to confirm that the median IPPSS curve is reasonable. An approximate analysis 4
was performed to verify the frequency value of 1.1 x 10-4 per year for tornadoes of any size hitting the site (see IPPSS Figure III-7) and to verify the frequency distribution of wind speeds given a tornado strike (i.e., the shape of the median hazard curve . IPPSS Figure III-7). The frequency of occurrence of tornado strike was obtained using a mean l rate of 2.425 x 10-4/sq. mi/yr. from IPPSS report Table III-13 (note: as discussed below, we believe that this value may be on the conservative side), distribution of F-scale values from IPPSS report Table III-11, and distribution of tornado lengths and widths from Appendix B of IPPSS report, Section 7.9.5. Average tornado lengths and widths were calculated, and an average tornado origin area was computed to be equal to the sum of the average areas for the F-scale values weighted by the frequency of F-scale occurrence. This value times the mean rate of tornado occurrence produced a strike frequency of 1.2 x 10-4 /sq mi/yr which compares closely to the reported value of 1.1 x 10-4/sq milyr. The approximate value assumes that all velocities in the tornado area are effective and that dependencies between F-scale value, tornado lengths, and tornado widths do not exist. Two calculations were made to verify the distribution of wind speeds given a tornado strike. In the first check, only wind speeds corresponding to the median wind speed intervals from IPPSS report Table III-12 coupled with the distribution of F-scale values from IPPSS report Table 11-11 were used. The velocity distribution was combined with the mean rate of tornado strike frequency (i.e., 1.1 x 10-4/sq milyr). Figure 4 shows the results super-imposed on the reported curves. The approximate analysis gives conservative values. This was expected since the reduction of origin area at higher wind speed was not incorporated into the calculation. In a second analysis, the origin area was reduced using average path lengths and path widths with frequencies corresponding to F-scale values obtained from Appendix B of I?PSS i 3-105
report Section 7.9.5. Figure 5 shows the results superimposed on the reported Curves. Based on these approximate calculations, we believe that the median curve has been rationally develo' ed. As discussed below, we feel that the tornado i hazard curves as a whole are on the conservative side. I SECTION A. Methodology i The transmission line system component was not used in the analyses j documented in the IPPSS report. Also, no tornado wind loads or effects of missiles are given in this report. , i SECTION 1. Tornado Risk Model We agree with the assumptions in this section. SECTION 2. Tornado-Target Strike Model We agree with the expression for a union definition of tornado-target interaction. SECTION a. Target Intersection Damage Events We agree with the expressions for an intersection and point source definitions of tornado-target interaction. SECTION b. Transmission Line Targets Hazard curves based on tornado-transmission line target inn:actica are not used in the IPPSS report; hence, this section was not reviewed. 3-106
SECTION 3. Tornado Windfield Model The windfield model was not reviewed in detail. The results of the approximate analysis verlfied that the velocity distribution produced a secondary effect on the resul?ing hazard curves for Indian Point. The model used in the IPPSS gives reasonable results. SECTION 4 Path Length Intensity Variations One difference between the approximate calculations performed to verify the tornado hazard curves and the IPPSS analysis is that nc path length adjustment was made in the former analysis. The close comparison with the results in the IPPSS report as shown in Figure 4 suggests that using the entire path length may not always greatly overpredict the probabilities of wind speed exceedance, although, in general, we believe that it will overpredict. SECTION 5. Probabilistic Model of Tornado Data No comment for this section. SECTION 6. Simulation Methodology No comment for this section. SECTION B. Analysis of Tornado Data Record Justification should be provided in the IPPSS report that 29 years of data (from the NSSFC record) is adequate to develop hazard curves. If the uncertainty in the hazard curves is rigorously developed, ti.e small reporting period will be reflected in the spread in the resulting curves. 3-107
SECTION 1. Site Regionalizations We agree that it is reasonable to study various regions surrounding the site in order to assess the variability of tornado risk for Indian Point. i i SECTION 2. Prior Analysis and Selection of Tornado Population ! In reviewing the statistical analysis given in Table III-4, we see no reason to f avor the subregion over the 1-degree, 2-degree, or 5-degree areas. As an independent check, we reviewed the tornado statistics presented in Reference 1 which give maps of the United States that show numbers of tornado and path lengths are shown. A grid of numbers from the DAPPLE data base (trom 1916 to 1977) shows the trend of tornado occurrence with loca-tion. There is a definite decrease in tornado activity at the Indian Point site as compared to a 5-degree area surrounding the site. A visual comparison indicates that the tornado rate at the site is less than half the rate based on a 5-degree area, and no F4 or F5 events are recorded at the site. In addition, a comparison between the tornado hazard values given in the IPPSS with values obtained using methodologies described in References 4, 5, and 6 are presented in Table 3. These comparisons suggest that the tornado hazard at Indian Point which is based on the subregion is on the conservative side. We do not feel that the confidence bounds, which are provided, are meaningful. This bound assumes that the subregion area is correct and only reflects possible error in the tornado count. We believe that more useful bounds should include the effects of local conditions. We accept the path length and path width distributions as reasonable. SECTION 3. Adjustments and Error Analysis We agree that data adjustments and error correction is worthwhile. However, the effect of this type of potential bias is overshadowed by the uncertainty in the statistics which are applicable to the Indian Point site. l 3-108 ]
SECTION C. Tornado Wind Speed Risk Based on approximate analyses, we feel that the median hazard curve shown in IPPSS report Figure III-7 is on the conservative side. The bounds on the curves were assumed to represent the 5th and 95th wind speed percentiles. No attempt was made in the analysis to rationally propa-gate the uncertainties in the individual problem parameters through the analysis. The procedure used is inconsistent with the approach used to develop the probability distribution of seismic hazard curves. In developing the seismic hazard curves, probabilities were assigned to maximum magnitude cutoff and source zones. Hazard curves were then systematical.y developed and the probabilities rigorously obtained. In addition, at the meeting with PLG, no evidence was available to suggest that the procedure used to establish the tornado hazard bounds could be verified by other studies conducted both rigorously and using this approximate approach. Based on these observations, we do not believe that the two bounds or their associated 5-curve counterparts developed in Chapter VI are entirely rational. In terms of offsite consequences, we believe that tornado effects do not dominate. Thus, the questions of whether the bounding curves are reasonable is not important for the IPPSS. SECTION IV. Hurricane Windspeed Risk Analysis The review of Section IV was performed by Dr. Larry R. Russell. His basic conclusion is that the median hurricane hazard curve is unconservative because the IPPSS analysis did not consider severe topographic conditions for certain wind directions. We also have reviewed the results given in NBS Building Science Series 124 and find that this reference also gives results in excess of the IPPSS median hurricane hazard curve. An independent hazard analysis was performed by Dr. Russell and is given in Appendix C. He found that considering topographic influences produced hazard curves significan.tly higher than the curves given in Section 7.9.5. l 3-109
I l l In regard to the probability distribution of hazard curves, the IPPSS ' approach as documented in this section is identical to the approach used for J tornadoes. We do not believe that the two bounding curves nor their associated 5-curve counterparts developed in Chapter VI are entirely rational. I SECTION V. EXTRATROPICAL CYLONE AND THUNDERSTORM RISK The hazard values obtained for extratropical cyclones and thunderstorms were checked against References 2 and 3. The values from Reference 2 compared reasonably well with the curves in the IPPSS. Reference 3, which is the more recent report, indicates that the wind speed values may be low by approxi-mately 10 percent. SECTION VI. WIND SPEED PROBABILITY FUNCTIONS The procedure used to develop the 5 hazard curves for each wind type is rational and reasonable. However, as explained previously, we do not believe that the bounds for hurricane or tornados are meaningful. Hence, the two lower and two upper bounds created for each wind type also are not meaning- l ful. This is not a problem for tornado effects since this wind type ulti-mately is not a major contributor. This is not the case for the effects of hurricane and extratropical cyclones. As stated for Section IV, we recommend that a set of curves be developed which rationally propagates parameter uncer-tainties through the analysis leading to a family of hazard curves each with a associated probability value. We noted an error in Table VI-1. The value for the median curve at 200 j mph is 2.6 x 10-0 per year which appears to be low by an order of magnitude. 3-110
SECTION 8.3.4 IDENTIFICATION OF MAJOR SCENARIOS, SYSTEMS, AND STRUCTURES CONTRIBUTING TO RISK - INDIAN POINT 2 Scope of Review This section of the IPPSS summarizes the major scenarios, systems, and structures / equipment which contribute to the risk of the various conse~ quences. We offer general comments here concerning the statements made and specific comments where appropriate. More comprehensive comments are made earlier in this report for the other sections of the IPPSS. SECTION 8.3.4.1 Seismic Although the median capacity of the city water tank has been downgraded to 0.25g since the IPPSS was published, the failure of both the RWST and the condensate storage tank are required for core melt. Other components in series which individually could cause failure (i.e. cable trays, containment shear wall, and diesel generator fuel oil tanks) have only slightly higher capacity than the RWST and condensate storage tank. These components also l would be significant contributors if item h did not fail. In addition, if the cable tray supports are considered to be independent (see discussion for IPPSS Section 7.2.4) this component would likely become the next most important contributor to frequency of offsite consequences after item h. In the revised analysis for Unit 2, the capacity for item h (the control room) was increased by eliminating the problem of impact between the control rooms. However, because of potential failure of the control room ceiling, we feel the mean frequency values are low. In addition, we believe that the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, respectively. Combining these two considerations increases the mean frequency of core melt. 3-111
.- =_ .. .- _ . .. _ ,. _
SECTION 8.3.4.2 Wind i We agree with the description of the various contributors. As discussed for Section 7.5.1 we believe that offsite power will f ail at a wind velocity much lower than the median capacity of 140 mph postulated in the study. In addition, we believe that the hurricane hazard curves are unconservative. This will raise the frequency of total loss of AC power and hence 2RW release by a f actor of 20 for the effects of wind. 1 l i i 1 3-112
SECTION 8.3.5 IDENTIFICATION OF MAJOR SCENARIOS, SYSTEMS, AND STRUCTURES CONTRIBUTING TO RISK - INDIAN POINT 3 SECTION 8.3.5.1 Seismic i We agree with the description of the major seismic core melt scenarios. It should be noted that failure of the diesel generator fuel supply and the control building shear wall contribute significantly to the core melt fragility where the equivalent median f ailure value is about 0.8g. As discussed for Section 7.2.5.3 we believe that the capacity of the hung ceiling in the control room is less than this value (f ailure of the ceiling could incapacitatetheoperators). In addition, we believe the seismic hazard is higher. We judge that the mean frequency of core melt is about 8 times larger than given in the IPPSS. SECTION 8.3.5.2 Wind Even using the median fragility wind velocity valve of 140 mph for offsite power, the logic for 2RW release is dominated by only the service water pumps, since the powe is more likely to f ail. As discussed for Section 7.5.3 we l believe that effsite power will be lost at a lower wind velocity than 140 mph. However, since the tornado hazard curves are on the conservative side, we judge that the mean frequency of core melt and offsite consequences for wind are reasonable. 3-113
TABLE 1 (Ref. 6) WATER SURFACE ELEVATICNS AT INDIA *i POINT RESULTING FRCH STATED FLOW AND ELEVATICN CONDITIONS Instanta-Sustained neous Elevation at Plow elevation at Signifi- Maximum Component riow the Battery Indian Point Indian Point cent wave Elevation et Indian Point (MSL Datun) (millions of efs) (MSL Catum) runup (ft) (MsL Catum)
- 1. Protable sutzimum Mean Sea Level flood (0.00) 1.100 1,2.7 +1.4 14.1
- 2. Probable maximum flood & tidal Mean High Water flow (+2.2) 1.014+ 12.7 +1.4 14.1 Mea, Low Water
(-2.2) 1.165+ 12.7 +1.4 14.1 Spring High Water (+ 2.7) 1.179+ 12.7 +1.4 14.1 Spring Low Water (- 2. 7) 0.998+ 12.7 +1.4 14.1
- 3. Standard Project Plood & Ashokan Mean Sea 1.evel Dan failure (0.00) 0.705 7.2 +1.4++ 8.6
- 4. Standard Project Standard Project flood hurricane (+11.0) 0.550 13.0 1.5-2.0* 14.5-15.0
- 5. Standard Project flood & Ashokan Standard project Den failure hurricane (+11.0) 0.705 14.0 1.5-2.0* 15.5-16.0
- 6. Probable Maximum hurricane & Spring Probable maximuun high tide hurricane (+17.5) - 12.4 2.0-2.5** 14.4-14.9 l
bOIEss
- Standard project hurricane wave runup determined for: ** Prcbable reximum hurricane wave runup deterrined fort forward specd of hurricano . 34 knots forward speed of hurricane . 34 knots maximum speed of hurricane (inland factor 0.7) . 75 MPH maximum speed at it.dian Point duration of maximium wind speed . 0.13 hrs (inland factcr 0.7) . 90 MPH O duration of maxinum wind speed . 0.13 hrs Plow corresponds to reach of the Hudson River affected by tidal variation under probable maximum flood conditions. ** Wave runup assumed approximately the same This reach extends f rom the Battery to the Tappan Zee as for PMF conditions.
Bridge, about mile p int 27. tctual flow at Indian Point, some 16 miles above the Tappa . Zee Bridge is 1.100 million afs. I 3-114
TABLE 2.
SUMMARY
OF EQUIPMENT CAPACITY VALUES l l Median Ground Acceleration (g) Section Component Unit 2 Unit 3 Reactor Pressure Vessel 3.80 3.80 5.2.1.1 1.04 1.04
- 5.2.1.2 *RPV internals 1.84 1.84 I 5.2.1.3 Steam Generator 3.04 3.04 5.2.1.4 Reactor Coolant Pump 0.87 0.87 5.2.1.5
- Pressurizer 2.84 2.84 5.2.1.6 Control Rod Mechanism 6.16 to 8.85 5.59 to 17.70 5.2.1.7 Reactor Coolant Piping 2.40 2.17 5.2.1.8 Safety Injection Pump 10.56 10.56 i 5.2.1.9 Residual Heat Exchanger 5.2.1.10 Component Cooling Water Heat Enchanger 5.43 6.13 13.71 15.37 5.2.1.11 Accumulator Tanks 5.2.1.12 Boron Injection Tank 2.53 4.95 1.16 2.17 5.2.2.1
- Containment Fan Coolers 5.2.2.2
- Residual Heat Removal Pumps 1.70 1.70 1.40 to 12.45 1.40 to 17.70 5.2.3.1
- Piping and Supports 5.2.3.2 Generic Equipment Structural Mode
- Diesel Oil Storage Tank 1.14 1.14 Service Water Pumps 2.47 2.47 0.70 0.70
*RWST
- Condensate Storage Tank 1.28 1.28
*Ductwork and Dampers 1.12 1.12 1.69 1.69
- Transformer 1.37 1.37
- Relief Tank
*8atteries and Rack 1.37 1.07 to 1.29
- Key Equipment: From Tables 7.2-3 and 7.2-7 of IPPSS Report 3-115
1 1 i l TABLE 2.
SUMMARY
OF EQUIPMENT CAPACITY VALUES (continued) 't Median Ground Acceleration (g) Section Component Unit 2 Unit 3 J 1 1 5.2.4 Capacities Derived from Tests (Reactor Protection Systems) 4.75 5.07 5.2.5
- Generic.Electromechanical and Electric and Control Equipment 1.30 to 2.49 1.17 to 1.51 5.2.6
- Generic Capacities for Values (Motor and Air Operated) 3.17 to 5.11 3.17 to 5.11 1
] 5.2.7
- Cable Trays 1.10 2.20 5.2.8 *0ffsite Power 0.2 0.2 5.2.9 Diesel and Gas Turbine 1.30 1.51 Generators I
t 3-116
TABLE 3. COMPARISON OF TORNADO HAZARD VALUES Fastest Quarter Mile Wind Speeds (mph) Frequency of IPPSS Based on Ref. 4 Based on Ref. 5 and S Methodology Methodology Occurrence Section 7.9.5* 140 113 100 10-5 178 150 10-6 190 230 236 200 10-7
- median values 3 117
l l l l l 1
- 7. 9 -
i l i
- 6. 0 -
o E
- 5. 0 -
G U 3
-+)
'y Nutt11 m 4. e -
U Z l
- 3. e -
1 i
- 2. 0 i i i IV V y1 yII VIII IX Modified Mercalli Intensity l
Figure 1. A comparison between WCC I-M relation and b Nuttli's curve. l 3-118
- ~ _
S v, g 4,
% /
I P n ian Point
' . 1 s
- I .. .
\
/
3 \ I om t
'S f
Y II NYC 7 I , II 5 ; E
,/ ( 884
'I II 18 '! -
, 927 SCALE
' 1957 0 R5
,- g km L OC ATION PL A 88 Figure 2. A map indicating the location of the largest events near the Indian Point site.
3-119
f(A)
^ F(A) in(A, Br) d
+ 1.0 -- -
2
+j I^g !!:J (corresponds to !!!!
frequency of ,j failure) jy F(Ag ) i!!! a A ;A
^9 ^g Density Function Fragility Curve (a) Capacity Frequency Density Function and Fragility Curve v
p(A) area is probaL:!ity p
?
in(A, 8 ) 9
- i:K:i
; y
> A A (corresponds to probability p)
(b) Probability Density Function for A figure 3 Probability and Frequency Functions for Fragility Analysis 3-120 . - ^
,,,,,,u, um,
/,,, 1, , , , ,i, 1 = 10-s ,,,,,,,,,
Tornado (Fastest Quarter-Mile) } Isto. , i
/ / / i
/ I (
) -
f i / )b / i 1 : 1o..
/ h I y . .:.
5 n. g , , g- 5 e/ .
; / gr/ g/
,y
- . . .y g
5
,,30 4 5 -:#
3 Z_ h Approximate Analysis e " n .
/ .
[ _ j : E isio-3 l
- 0
,,w 2 110'3 ' '
400 50 70 100 150 200 250 300 Windspeed (mph)
- Figure III-7. Tornado Windspeed Exceedance Probabilities at 33 ft. Elevation
- IPPAA Report, Section 7.9.5 Figure 4 Comparison or Approximate Tornado Analysis (without Origin Area) with IPPSS Results 3-121
_ m
talo.s ,,,,,,,,, ,,,,,u,, ,,, , ,, ,,,, ,,,u Tornado (Fastest Quarter-Mile) } [
,3 ,,- , i / / / i I J l 1 10..
i / j / i
/ // /
t ~
, , g- 5 e)
$ Y $/ >>
$ _ l d' _
/ '
E yf e : :- g 1 10-d p-j% A k Approximate Analysis
- u. _
g _ _ q _ _ s - 3: 1: 10-3 3 , g-2 [ 1:10~3 ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' " " ' " ' ' ' ' " "" 50 70 100 150 200 250 300 400 Windspeed (mph) Figure 111 7. Tornado Windspeed Exceedance Probabilities at 33 ft. Elevation 1 Figure 5 Comparison of Approximate Tornado Analysis (with Origin Area) with IPPSS Results 3-122 n . .
4 SEISMIC HAZARD ANALYSIS ' In an effort to more fully understand the impact of various deficiencies that were pointed out in our review of the seismicity analyses conducted for l the Indian Point Site, a study was undertaken to evaluate the sensitivity of l the results to variations in key parameters and assumptions. The ob.jectives of this study are the following: to evaluate the sensitivity of the seismic hazard analysis to variation in key parameters; to check results presented in the seismicity analyses; to investigate alternative hypotheses not considered in the study; and to evaluate the implication of these alternatives relative to the mean frequency of release category 2RW. The intent is not to conduct another independent seismicity study for the Indian Point site. The references used in this study are listed at the end of the chapter. In recent years considerable scientific study has led to a hypothesis that a Ramapo f ault zone is an alternative hypothesis that should be considered in a hazard analysis of the southeastern New York area (Ref.1, 2).* Neither the D&M or the WCC study explicitly considered a Ramapo source. We note that both t seismicity studies have attributed seismicity to the Ramapo f ault zone as part of larger source areas. The issue of whether a Ramapo source should be included as an alternative hypothesis is reviewed on the following basis; first from a geologic and seismologic point of view, assessing whether the f ault is in f act a source of earthquakes; and second in terms of the IPPSS what is the impact on plant risk of including a Ramapo source. We have concluded f rom results of recent studies (Ref. 3, 4), that scientific evidence to support a hypothesis that the Ramapo f ault is a source of earthquakes in the southeastern New York region cannot be strongly supported. These studies contradict previous results (Ref.1, 2) that support such a contention. In this chapter we investigate the impact of a Ramapo source on plant risk.
- References for Chapter 4 are given at end of the Chapter.
4-1
^
SEISMIC HAZARD MODEL AND ANALYSIS The seismic hazard model used in this study is similar to the ones used in the IPPSS. The model was originally proposed by Cornell (Ref. 5), and described with various improvements in References 6, 7, and 8. A standard computer program was used to conduct the analysis and is described in Reference 9. The steps in the seismic hazard analysis are: e Identification of seismic source zones based on historic seismicity and tectonic evidence.
- Estimation of seismicity parameters including upper bounds on event size.
e Selection of an attenuation model appropriate for the region of , interest. 2 In the analysis it is assumed that the seismicity is distributed uniformly in a source zone. The distribution of earthquakes is described by the Gutenburg-Richter recurrence relationship, and their random occurrence is assumed to be spatially and temporarily independent. The uncertainty about the attenuation curves is assumed to be described by a lognormal distribu-tion. These aspects of the analysis are consistent with the methods used in the IPPSS. i Check of the Dames and Moore - Woodward Clyde Seismicity Curves On the basis of information provided in the IPPSS seismicity studies on seismicity parameters, source zone geometry, and attenuation models, a check of a few of the seismicity curves was made. Our intent was to verify the accuracy of the analyses performed. 4-2
For the Dames and Moore study, the Piedmont zone was selected. The seismicity curves for two alternative hypotheses were checked; these were the
=5.70, and the case of b=0.76 and best estimate case for b=0.90 and Mb max Our results in the acceleration range 0.10 to 0.70g are within 30 Mb max =6.0.
percent of those calculated by Oames and Moore. For the Woodward-Clyde seismicity study, results for Source 1 were checked for two maximum event sizes, intensity VII and VIII, and their preferred attenuation model. Our results were within 50 percent in each case in the acceleration range 0.10 to 0.80g. Sensitivity Analysis In each of the two seismicity studies for the Indian Point site, a sensi-tivity analysis was conducted to demonstrate the effect on the seismicity curves to variations in key parameters or model selections. For those However, as noted parameters investigated, the impact was well demonstrated. in our review comments in Section 7.2, the variability in ground motion The total predictions is a function of the path taken to make the estimate. uncertainty in ground motion predictions can, as demonstrated in Reference 10, increase as a result of transformations made to reach the final variable of interest. This is a source of modeling uncertainty not considered in the l IPPSS. We consider the effect on the seismicity curves for variations in the j logarithmic standard deviation of the distribution about the attenuation This curve. Recall that in the IPPSS a value of 0.60 was used for in a. No variability in this value is typical of the scatter in strong motion data. The variation parameter was considered in either of the seismicity studies. in seismirity curves is considered for three values of in a, 0.60, 0.70, and 0.80, which correspond to f actors of 1.80, 2.01, 2.23 uncertainty ir ground motion at the one standard deviation level. Figure 1 presents the results for The source used in this particular example is the three values of in a. similar to the Ramapo f ault zone that will be considered later in this chapter. The results indicate that variation in the frequency of exceedance qurves is less than a f actor of 3 for sustained accelerations in the range 0.10 to 0.70g. 4-3
In the WCC study and in Section 7.2, the seismicity curves have been truncated to reflect the belief that the accelerations are limited. This truncation was made outside the hazard calculation, by simply limiting the range of the derived hazard curves developed with no truncation. It was suggested at the PLG meeting that this truncation should have been performed within the analysis. Although generally agreed that this was the correct way to carry out the truncation, the procedure of truncating the distribution aposteriori is conservative in that the frequencies of exceedance for acceler-ations below the truncation point will be higher than if the truncation had ' been performed in the probabilistic analysis by properly truncating the distribution and normalizing to give unit area. This was verified for a simple example. To quantify this effect for the IPPSS in general, each seismicity curve would have to be recomputed. This has not been done. Investigation of Alternative Modeling Hypotheses In the Dames and Moore and Woodward Clyde seismicity studies a Ramapo source was not accounted for (i.e., it was given a zero probability weight). However, considerable scientific investigation has focused on the Ramapo fault in recent years (References 1, 2, 3, and 4). Conclusions on the subject of the Ramapo f ault as an earthquake generating source vary. These efforts to understand the source of seismic activity in and around the Ramapo fault zone are clouded with considerable uncertainty, making attempts to define the geometry and seismicity parameters of a Ramapo source difficult. Geologic investigations further tell us that the geologic framework of this region is very complex. The deployment of a dense array of seismic stations in recent years has yielded a pattern of low magnitude events (M bs 3.0) around the Ramapo fault. Recent seismological studies of these data (Ref. 1 and 2) have led to a hypothesis that the Ramapo is reactivated and is currently generating low magnitude events on a well defined surface. In this chapter we will consider various hypotheses that have been proposed for a Ramapo source. Our objective is to determine the seismicity curves for each hypothesis and to assess the implication of these alternatives, on the mean frequency of release category 2RW. Recall that an objective of a i probabilistic risk assessment is to consider the full range of reasonable 4-4
hypotheses, in a manner consistent with the state of information and our degree of belief. In this section we consider a Ramapo f ault zone and evaluate seismicity curves for various parameter alternatives. Our analysis utilizes the work in References 1 and 11 to develop seismicity parameters and source geometry models. As part of our analysis, we did not assign a probability weight to a set of seismicity curves corresponding to a Ramapo f ault zone. We did, however, consider the effect of a Ramapo source as a function of an assigned probability weight. This is be addressed in the next section. Figure 2 shows the Ramapo f ault and the region near the Indian Point site. Also shown on the map is the location of a number of the largest events (MMI 2 VI) that have occurred in the area. As mentioned previously, considerable uncertainty exists about the geometry of a f ault zone to be utilized in a hazard analysis, and in values for the seismicity parameters. We choose in this analysis to take Reference 1 and Reference 8 as a guide to our parameter selection. The following variables are considered in a sensitivity analysis: e source geometry e activity rate e b-values e upper-bound magnitudes I The attenuation model used in this study is Nuttli's relation for sus-l tained acceleration. The logarithmic standard deviation for the lognormal distribution about the attenuation curve is taken as 0.60. A cutoff is applied to this distribution at the 5 in a level. This corresponds to a factor of 20 times the median. We consider the Ramapo f ault zone suggested by Aggarwal and Sykes (Ref.1) and their recurrence relationship for events greater than M b=4 and a b-value of 0.73. This source is taken 15 km either side of the fault and is approximately 140 km long. This rather small source area represents a dense concentration of seismicity around the site. In these calculations no background seismicity was used. In Figure 3 the seismicity curve with an M = S.25 is shown with the curve developed by Dames 2.nd Moore for the b max 4-5
Piedmont-Cape Ann zone. Differences in the two curves are within a factor of ; 3 out to about 0.709. Also shown on the same figure are the seismicity curves for M b max values of 5.50 and 5.75. The figure reveals that a Ramapo f ault
)
zone does not significantly increase the hazard over results previously obtained for other source zones. In Figure 4 we investigate the effect of varying the Richter b-value. Two cases are considered, b=0.73 and 0.90. The seismic activity rate is held the same, thus the effect is to considerably lower the occurrence rate of large events. As a result, the seismicity for a b=0.90 is considerably less (by an order of magnitude) for the case of b=0.73. Variations in the seismic activity were considered; however, the effect is relatively small, as the frequency of exceedance is approximately linearly dependent on this variable. For this reason, we do not present specific results for variations in this parameter. In Reference 11 Fischer presents different alternatives for the size and recurrence relations of a Ramapo source. We consider the case of a Ramapo zone which is approximately 100 km square. A b-value approximately the same as the Aggarwal and Sykes value is used, and an activity rate based on a time period of 350 years is used. The result for an M b max of 6.25 is compared to I the results for the Aggarwal and Sykes source in Figure 5. The impact of a larger source area, and longer time period for the data base has been to reduce the seismicity per year per unit area, resulting in considerably lower frequencies of exceedance. The above sensitivity analysis has not been an exhaustive survey of the full range of alternatives that might be considered to model a Ramapo fault zone. We have instead presented a range of possibilities suggested in the literature that we feel reasonably represents the range on the seismicity curves associated with a Ramapo source. In order to understand the potential impact of considering a Ramapo fault zone in the risk analysis, we present a comparison of the mean frequency of release category 2RW due to seismic events to the frequencies computed in the IPPSS. The comparison is made in terms of the ratio of results calculated here for the Ramapo f ault to the values we calculated using the original family of seismicity curves. Thus the rates are directly applicable to the results given in the IPPSS report. The comparison is made for Indian Point 4-6
Units 2 and 3. The hazard curves used in the analysis were taken from IPPSS report Tables 7.2-4 and 7.2-8 for Unit 2 and 3, respectively. The results of the comparison are given in Table 1. The implication of these results and the manner in which they should be viewed is discussed in the next section. IMPLICATION OF A RAMAPO FAULT ZONE The increase in the mean frequency of release category 2RW due to diff erent representations of a Ramapo f ault zone are presented in the previous 4 section. The results given there show t( 3 increase due to the Ramapo source The next step in comparison to mean frequency values obtained in the IPPSS. is to postulate, in a Bayesian sense, a subjective weight for the Ramapo source and then combine the effect with the other postulated sources. Based on the information we have to date, we are unable to make a formal assignment for the Ramapo source. However, we have investigated the implication of various weights which could be assigned. At one limit is the probability assigment of 0. This implies that the Ramapo source is incapable and thus cannot possibly occur. At the other extreme is the probability assignment of 1.0 which says that the Ramapo source, plus a reasonable background seimicity which was added, replaces the other source zones considered in the IPPSS. This is obviously a very conservative scenario since it is highly unlikely that the only possibility is the Ramapo zone. For purposes of this sensi-tivity analysis, the D&M Piedmont zone with a M5.7 maximum magnitude is selected to be the background seismicity. This is also conservative. Because there is a difference in integration procedures used by PLG and us, we have normalized the increase in mean frequency of consequences to correspond to the values given in the IPPSS report. In this section we have not included any other differences which we found in our review. Thus, the results presented here are given in addition to changes we noted elsewhere in this report. Figure 6 shows the effect of the Ramapo f ault zone and its assumed back-ground seismicity on the mean frequency of core melt or release categories for subjective probability values between 0 and 1. The curves were developed for release category 2RW. However, we expect the trend to be similar for other 4-7 f
i release categories and for core melt as well. Curves given for both Unit 2 and Unit 3 represent the ratio of the total seismicity-caused mean frequency l (including the weighted contribution from the Ramapo source and ba kground seismicity) to the seismically-caused mean frequency values corresponding to the IPPSS report (i.e., 1.4 x 10-4 per year for Unit 2 and 2.4 x 10-6 per year for Un.it 3). Thus the results shown in Figure 6 pertain only to seimically-caused consequences. The two curves for each plant shown represent lower and upper bound possible Ramapo f ault zones. These correspond to hazard curves 3 and 1 given in Table 1, respectively, which are discussed in the previous report section. Figures 7 and 8 show similar plots for total mean frequency of release category 2RW and core melt, respectively. In these plots the mean frequency values given in IPPSS report Tables 8.3-2 and 8.3-3 were used as the base values for Unit 2 and Unit 3, repectively. Thus the effect of the Ramapo j f ault zone on higher level consequences as function of the subjective probability for the zone can be seen. By comparing Figures 6, 7, and 8, it is seen that the effect of the Ramapo Fault zone decreases monotonically from seismic-caused release categories, to total release category 2RW, and finally to total core melt. The reason the effect of the Ramapo decreases is because other events such as fire, hurricane, tornado, and internal accidents dilute the contribution made by the Ramapo source. References
- 1. Aggarwal, Y. P. and L. R. Sykes, " Earthquakes, Faults, and Nuclear Power Plants in Southern New York and Northern New Jersey," Science, vol. 200, pp. 425-429, April 28, 1978.
- 2. Yang, J. P. and Y. P. Aggarwal, "Seismotectonics of Northeastern United States and Adjacent Canada," J. Geophys. Res. vol. 86, pp.
4981-4998, 1981.
- 3. Ratcliffe, N., " Brittle Faults (Ramapo Fault) and Phyllonitic Ductile Shear Zone in the Basement Rocks of the Ramapo Seismic Zone," Nev York and New Jersey, and their relationship to current seismicity, in:
4-8
Manspeizer, W. editor, Field Studies of New Jersey Geology and Guide to Field Trips: 52nd Annual Meeting of the New York State Geological Association, p. 278-312, 1980.
- 4. Statton, C. T., R. Quittmeyer, M. Houlday, " Contemporary Stress and Fault Plane Solutions Inferred from Recent Seismicity in New York and New Jersey," presented at 54th Annual Meeting of the Eastern Section SSA, abstract to appear in Earthquake Notes,1982.
- 5. Cornell, C. A., " Engineering Seismic Risk Analysis," Bulletin of the Seismological Society of America, vol. 58, pp.1583-1606,1968.
- 6. Der Kiureghian, A. and A. H-S Ang, "A Fault Rupture Model for Seismic Risk Analysis," Bulletin of the Seismological Society of America, vol.
56, pp. 1173-1194, 1977.
- 7. McGuire, R. K., " Fortran Computer Program for Seismic Risk Analysis,"
U.S. Geological Survey, Open-File Report 76-67, 1976.
- 8. Mortgat, C. P., et al., "A Study of Seismic Risk for Costa Rica,"
Technical Report 25, The John A. Blume Earthquake Enaineering Center, Department of Civil Engineering, Stanford University, Stanford, Calif orni a,1977.
- 9. Guido, G., " Computer Programs for Seismic Hazard Analysis," Technical Report 36, The John A. Blume Earthquake Engineering Center, Stanford University, 1979.
- 10. Cornell, C. A., H. Banon and A. F. Shakal, " Seismic Motion and Response Prediction Alternatives," Earthquake Engineering and Structural Dynamics, vol. 7, p. 295-315,1979.
- 11. Fischer, J. A., " Capability of the Ramapo Fault System," Proceedings of Earthquakes and Earthquake Engineering: the Eastern United States, September 14-16, 1981, Knoxville, Tennessee, i
4-9
TABLE 1. RATIOS OF MEAN FREQUENCY OF RELEASE CATEGORY 2RW Source Zone IP-2 IP-3 Aggarwal & Sykes (Ref. 7) 1 b=0.73. Mb max = 6.25 10.8 34
- 2. b=0.73, Mb max = 5.75 6.4 10
- 3. b=0.73, Mb max = 5.50 4.5 5.5 4
b=0.90, Mb max = 6.25 1.5 4.1 Fischer (Ret. 8)
- 5. b=0.70, Mb max = 6.25 2.51 6.25 1
4-10 __ _ - . _ . ~ _ __ - . _ . _ . _ _ . . _ . - _ . -- . _ _ _ _. -
l 1E-lM2 _ 1E-883 :- o=0.70 W - 0 a=0.80 g 1E-EM4 7 o W - W - o=0.60 0 - X _ L11 4 1E-dM5 -- 0 : A 0 _ C W - 3 T 1E- W 8 7 W L : L1_ 1E-987 :-
' ' I ' I ' ' ' ' ' ' ' ' ' ' '
IE-dMB s .I ' .I2 1 .3 .4 .5 .6 .7 .8 .9 1 Sustained Accelerabian (g's) Figure 1. Sensitivity of seismicity curves to variations in the logarithmic standard deviation in the distri-bution about the attenuation curve. Results for three values of a I" are ;hown, 0.60, 0.70, and 0.80. 4-11
i i l 1 sq** Wo o, %
$j
$ /
4 y an Point 1 3 . NY VII NJ ,- 1737 s' B I 'oa
=
,' 5 $ \ NYC 7 '
/ i
,i '
* - 884
/s s /
'I II 18 j --
., 927
'O I SCALE
' 1957 0 5 R5
- g km O L OC ATIO N PLAN 9,
Figure 2. The Ramapo Fault and the region surrounding the Indian Point site 4-12
1E-932 _
~
1E-983 -- W _ O h1E-984 -- T - W : W - 0 - 1 X ~ LLI 4- 1E-995 -- O : 4 A "_ 2 0 _ C W - 3 3 1E6 1 - Aggarwal & Sykes, M b, max = 6.25 L _ k ~_ 2 - Aggarwal & Sykes, M b, max = 5.75 _ 3 - Aggamal & Sykes, M b, max = 5.50 4 - D&M Piedmont - Cape Ann zone 1EM r
' I ' I ' I ' I ' I ' I ' I ' I ' I '
1E-998 8 .1 .2 .3 .4 .5 .8 .7 .8 .9 1 Sustained Acceleration (g's) Figure 3. A seismicity curve for the Ramapo fault for Mb , max values of 6.25, 5.75, and 5.50 and the recurrence relation suggested by Aggamal & Sykes shown with the Piedmont-Cape Ann seismicity curve in the Dames and Moore Study. 4-13
l
)
1E-882 _ 1E-MB3 :- W - O g 1E-MB4 ::- - y b=0.73 W _ W - i O - ! X ~ L11 4 1E-Ef5 ::- 0 : p
~
~
b=0.90 C W - 3 T W 1E-66 L : LL - l l 1E-887 ::-
' I I ' I I I ' I '
1E-818 ' ' ' I ' I ' 8 .1 ' .I2 .3 .4 .5 .6 .7 .9 .9 1 Sustained Accelerabion (g's) Figure 4. The effect of b-values on the seismicity curves for the Aggarwal and Sykes Ramapo fault zone. 4-14
1E-852 _ 1E-853 -- W - O Aggarwal & Sykes g 0 1E-884 -- ~U _ W _ W - 0 - X _ LL) Fischer 4_ 1E-985 -- 0 _ A : 0 _ C W - 3 T W 1E-9BS L : LL _- 1E-SE7 :-
' I ' I ' I ' I ' ' ' I ' ' ' ' '
IE-858 8 .1 ' .I2 .3 .4 .5 .6 .7 .8 .9 1 Sustained Acceleration (g ' s) Figure 5. A comparison between the Aggarwal and Sykes (Ref.1) source zone and a larger source area considered by Fischer (Ref.11). 4-15
I 4 m.- . 3
't .
3 ms - I tl
- u. g b
13.1
*t 15. g Upper Bound o -
6.8
-- , Lower Bound ,
,,L e .5 1.s Ramsy. Faulk Zone Subjoetive Probability (a) Unit 2 48.8 -
l
't 1 .
34.9 3 ms -
, Upper Bound i m. _
J J6 : g m. _ Lower Bound -
- - - 6.8 bb gy . .
R. 5 .5 1. 9 Reespe Fault Zone Subjective Probability (b) Unit 3 Figure 6 Effect of Including a Ramapo Fault Zone on Seismic-Caused Consequences 4-16
- 7. 9 -
- 8. 9- 6.1 I 5. 9-
- 4. 9 , Upper Bound 3.5
- 3. 9-Jly
.o. a:
- 2. 9 -
Lower Bound
- 1. 9 b% ' '
- 9. 2
- 9. 9 .5 1. 9 Ramapo Fault Zone S e jse6sve W s1167 (a) Unit 2
- 7. 9 -
- 6. 9 -
3 5. 9 -
- 4. 9 -
- 3. 9 -
2*3
- 2. 9- Upper Bound
)1 "" 15 $[ 2: O Lower Bound E:
- 9. 9 .5 1. 9 Ramapo Fault Zone 54 jnehave W ility (b) Unit 3 Figure 7 Effect of Including a Ramapo Fault Zone on Total Release Category 2RW 4-17
- 7. C-
- 8. 9 -
3 5. 9-l 4. 9-4.6 g g Upper Bound
- 3. 9 -
- 2. 9-
"I o
a 3, g Lower Bound b% ' '
- 9. 9
- 9. 9 .5 1. 9 Ramape Fault Zone Subjective Probability (a) Unit 2
- 7. 9 -
- 8. 9-3 5. 9- '
- 4. 9 -
- 3. 9- l JeE 2. 0-
% Upper Bound 1.6 3u 1 ;; 1.1 jg Lower Bound EB
- 9. 9 .5 1. 9 Ramapa Fault Zone Subjective Probability (b) Unit 3 Figure 8 Effect of Including a Ramapo Fault Zone on Total Core Melt 4-18
l
- 5. CONCLUSIONS AND RECOPMENDATIONS Based on our review of the IPPSS, we believe that certain results may be unconservative. This chFpter gives conclusions concerning the frequency of core melt and the various release categories and identifies various conservatisms and unconservatisms that exist. We also give recommendations to resolve the most significant issues which we have raised in the review.
Table 1 gives a rrcised list of mean frequencies for Indian Point Unit 2 based on our review. Table 2 gives a similar list for Unit 3. Below each of the mean frequencies for seismic, hurricane, and tornado is the ratio of the revised value to the value given in the IPPSS report (see Tables 8.3-2 and 8.3-3 for the IPPSS report values for Units 2 and 3, respectively; except that the values for seismic for Unit 2 are based on the values given for the revised analysis, which eliminated the problem of impact between the control rooms). The following sections summarize our basis for the revised frequency values given in Tables 1 and 2. INDIAN POINT UNIT 2 The basis for the reviseo frequency values for seismic, hurricane, and tornado for Indiar. Point Unit 2 are given below. Seismic In the revised analysis of Unit 2, the capacity for item 2 (the control room) was increased by eliminating the problem of impact between the control rooms. However, because of potential f ailure of the control room ceiling, we feel the mean frequency values ara low. In addition, we believe that the D&M and WCC mean hazard curves should be weighted 80 percent and 20 percent, re-spectively. Combining these two considerations increases the mean frequency of core melt. 5-1
Hurricane Two f actors produce an estimated increase in release category 2RW. Due to a higher estimated hazard curve, the frequency of 2RW and core melt are judged to increase by a f actor of 10. Also because offsite power probably will be lost at wind speeds below 140 mph, the frequency of 2RW release and core melt increase by a f actor of 2. The total f actor for both these effects is a 20-fold increase in mean frequency for 2RW and core melt. Tornado Similar to the hurricane analysis, we believe that the capacity of offsite power has been assumed too high. We estimate that the frequency of release category 2RW increases by a f actor 2. However, we judge that the hazard curves are on the conservative side; thus, we believe that the IPPSS mean frequency values for 2RW and core melt are reasonable. INDIAN POINT UNIT 3 The basis for the revised frequency values for seismic, and discussion for hurricane and tornado effects for Indian Point Unit 3 are given below. Seismic We believe that the capacity of the hung ceiling in the control room may be lower than the equivalent median capacity value of 0.8g, implicitly used in the IPPSS. We estimate that the mean frequency for release category 2RW, which has a dominant contribution from the control building, increases the l mean frequency. Similar to the revised values for Unit 2 for the increase in the hazard function, we increase the mean frequencies of all categories by an additional f actor to produce a total f actor equal to 10 for release category 2RW and a factor of less than 2 for other categories. Core melt due to seismic increases by a factor of almost 8. Hurricane This is not a significant event for Unit 3. 5-2
Tornado Since the frequency of release depends on tornado missile impact, we judge the IPPSS results to be reasonable. CONSERVATISMS AND UNCONSERVATISMS i Based on our review, including discussions held subsequent to our draft report of 19 July 1982, responses from PLG, and the final meeting held on 13 October 1982 in Albuquerque, New Mexico, we have identified potential conservatisms and unconservatisms which exist. The following is a sunnary for each of the external hazards. Seismic The following comments reflect on the revised analysis for Unit 2, which eliminated the impact between the control room roofs, and the original analysis in the IPPSS report for Unit 3.
- Conservatisms:
- 1. The method of combining the seismicity curves shown in Figure 7.2-4 of the IPPSS report as obtained from the curves given in Sections 7.9.1 (D&M) and 7.9.2 (WCC) may be conservative by a f actor of approximately 2.
- 2. In regards to the control room ceiling f ailure mode, considering all three operators to be present in the control room during an event is conservative.
In addition, the Transite panels may have been cut wider than the distance between the angle supports (preventing them from f alling if they slide to one side).
- 3. The median capacity value of 1.lg for the failure of the Unit 2 containment may be conservative.
5-3
Unconservati sms:
- 1. Weighting the WCC hazard curves by a factor of 0.5 is unconserva-ti ve. We believe that the D&M and WCC mean hazard curves should be weighted 80 percent and 20 pecent, respectively.
- 2. Neglecting design and construction errors and aging effects is unconservative.
- 3. In regards to the control room ceiling f ailure mode, considering only one-degree of freedom corresponding to one axis of the Transite panel is unconservative. Degrees of freedom for both axes should be included in the analysis. In addition, a glancing impact from a Transite panel (or piece of a panel) may affect an operator's ability to perform the necessary tasks following a severe seismic event.
Wind Conservatisms:
- 1. The tornado hazard curves are on the conservative side.
- 2. A lead warning time exists for hurricane, which could be utilized to shut down the plant.
Unconservatisms:
- 1. The hurricane hazard curves used in the IPPSS are unconservative.
- 2. Using 140 mph as the median capacity for offsite power is unconservtive.
- 3. Tne fragility curves for the tornado and hurricane wind effects may be unconservative.
5-4
Flood Conservatisms:
- 1. The river discharge computed for* the Probable Maximum Flood (PMF) may be conservative.
- 2. Locating the Probable Maximum Precipitation in the worst position over the Hudson River Basin is conservative.
Unconservatisms:
- 1. The runoff assumed for the PMF may be unconservative.
- 2. The point frequency estimate approach to evaluate flood elevations is unconservative.
- 3. The assumption that the internal flood analysis, which was conducted for Unit 2, also applies to Unit 3 is unconservative.
RECOMMENDATIONS In order to resolve the most significant issues which have been raised in the review, we recommend the following be done. (It is our understanding that new analyses to address some of these recommendations are currently beirig performed by PLG.) Seismic
- 1. For Units 2 and 3, the capacity of the hung ceiling in the control rooms should be reanalyzed to con-ider more realistic assumptions (see discussion for Section 7.2.5.1). In addition, the possibility of f ailure of control room equipment due to f alling Transite panels should be included in the analysis.
5-5
- 2. For Unit 3, the capacity for the diesel generator fuel oil tank, which is a significant contributor, should be based on a specific analysis for this component. Generic-based values were used in the IPPSS.
- 3. Since the problem of the control room impact has been eliminated for Unit 2, a seismic fragility curve should be developed for the Unit 2 1
diesel generator building since its generic median capacity is 1.4g. Flooding
- 1. A probabilistic analysis should be conducted to consider the variability in important parameters of the flood process that determine the flood profile, and which also takes into account the j
uncertainty in the frequency of flooding.
- 2. A more detailed and systematic presentation of the method used to evaluate the impact of internal flooding should be included in the IPPSS.
t
- 3. It should be verified that important f actors related to internal flood passages, etc., in Unit 3 are consistent with the IPPSS assumption that Units 2 and 3 are the same.
I Wind
- 1. A fragility curve for offsite power should be developed which considers various possible f ailure mechanisms (i.e., in addition to the failure of the transmission towers).
, 2. Wind fragility curves should be rationally developed for the Unit 2 control building and the diesel generator building. They should explicitly consider the structure shapes and the effects of adjacent structures. Possible local failure of siding and roofing should be considered in determining the structure capacities. Also, the fragility of the Unit 1 turbine and superheater buildings (or pieces of these buildings) should be calculated for wind. The possibi?ity 4 5-6 i
., ., - ------,,--,----e- i
of these buildings f ailing and f alling on safety-related structures (i.e., Unit 2 control building, diesel generator building, and condensate storage tank) should be included in the plant analysis.
- 3. A hurricane hazard analysis which includes careful evaluation of the surf ace roughness boundary layer effects and wind channelization by the local hills and river valley should be performed.
4 A systematic comparison between the hurricane hazard curves given in the IPPSS and the results in NBS Building Science Series 124 report should be made to provide the basis for the large differences that exist and justification of the reasonehleness of the IPPSS results. 5-7
l l TABLE 1. REVISED MEA.N RELEASE FRE00ENCIES - UNIT 2 l Mean Frequency (Ratio to IPPSS Report Value) i 1 Release Category Seismic Hurricane Tornado Z-1Q 1.1 x 10-6 0 0 (1.6) Z-1 2.6 x 10~8 small small (2) 2RW 4.7 x 10-5 5.4 x 10-4 1.6 x 10-5 (6.8*) (20) (1) 8A 5.5 x 10-9 O small (1.3) 88 3.4 x 10-10 0 0 (1.3) Core Melt 4.8 x 10-5 5.4 x 10-4 1.6 x 10-5 (6.1**) (20) (1)
- Relative to the value of 6.9 x 10-6 obtained in the revised analysis.
** Relative to the value of 7.9 x 10-6 obtained in the revised analysis, i
j 5-8
TABLE 2. REVISED MEAN RELEASE FREQUENCIES UNIT 3 Mean Frequency (Ratio to IPPSS Report Value) Release Category Seismic Hurricane Tornado 5.9 x 10-8 0 0 Z-1Q (1.6) Z-1 5.0 x 10-9 0 small (2) 2RW 2.4 x 10-5 0 9.2 x 10-7 (10) (1) 8A 9.2 x 10-7 0 4.1 x 10-7 (1.3) (1) 88 2.9 x 10-7 0 0 (1.3) Core Melt 2.5 x 10-5 0 1.3 x 10-6 (7.6) (1) 5-9
l APPENDIX A 1,E\'l Eh 01- i'ii i :,' 1 C \.'s l'O 1 N1 SEISMIC liA;Al,D STU!W prepared by li . Street July 09, 1982 i
.. n .. .-.
TABLE OF CONTE.N1S Page
]
PART I . . . . . . . . . . . . . . . . . .. .. . . . . . . . . 2 Evaluation of Overall Methodology. . . . . . . . . 3 PART II. . . . . . . . . . . . . . . . . . . .. .. .. ... .. .. .. . 4 Influence of Findings on Final Results 5 PAR 1 III . . . . . . . . . . . . . . . . . . . . . . . . . . Evaluation and Comments on the 11ames 6 .'focre and 6 Woodward-Clyde Reports. . . . . . . . . . . . . . . 7 PART IV. . . . . . . . . . . . . . . . . . .. .. .. .. . .. .. .. .. . Comments on the Regional Seismicity. S iii
s 4 3 I i 1 i i i i l i i t ! PART 1 Y 4 EVALUATION OF OVERALL METHODOLOGY 1 d. i i l l i r 1
d 2 1 1 i l Evaluation of Overall Methodology The methodology used in determining the frequency of the 4 various levels of ground motions that might be experienced at a the site is, in my opinion. fairly comprehensive. There is, however, one omission in the study that I feel needs to be j addressed. That omission is the failure to do a background i j study of the more significant earthquakes within the general region of the site; i.e., the epicentral intensity VI and VII events in southeastern New York and northeastern New Jersey. , I Such a study would have (1) suggested the possibility of i low magnitude, high intensity, shallow events, (2) the likeli-hood that the August 10, 1884 carthquake is a 5 1/2 to 5 3/4 l m bLg v nt, and (3) would have corrected any errors with respect to the published reports about the earlier events. With respect specifically to the many seismogenic zones considered in this study, my personel preferences are the . ones labeled Sounce Area 1 and Source Area 5 in the Woodward-Clyde report. As for the proposed Ramapo fault zone, and after reviewing the paper by Aggarwal and Sykes (1978) and the larger events that they suggest might be associated with tha-fault zone (see Table IV-1) , it is my opinion that the proposed zone is speculative and should according he assigned a low i l 1evel of probability. ! Re fe rence l Aggarwal, Y. p. and L. R. Sykes (1978) . " Earthquakes, faults, and nuclear power plants in southern New York and northern New Jersey", Science, 200, 425-4.'9. i
PART II INFLUENCE OF FINDINGS ON FINAL RESULTS 3
4 Influence of Findings on Final Results In Part IV, Section B, the results of a cursory review of six events within the general region of the site are tabulated. One important result with respect to this study is the 5 1/2
-5 3/4 m bLg m gnitude estimated for the August 10, 1884 event.
Depending upon where one chooses to place the epicenter of the event, the maximum magnitude. event in the Northeast Tectonic Zones listed in Table 1 of the Dames and Moore report would need to be raised. Given the difficulty to make a definitive state-ment about the epicentral location of a non-instrumental event, I recommend that the mean m b, max f the liighlands and Conestoga Valley Tectonic Zones be raised to 5.7. With respect to the low-magnitude, high intensity earth-quakes that are noted elsewhere in this review, both the Dam s and Moore (I g+mb + ) nd Woodward-Clyde (1 g +I +a) technique for s estimating ground motion, tends to overestimate the motion in l the far-field. ! Ilowever, there does remain a question in my l mind, as to what is the character of the ground motion of a 3.0 magnitude event that can cause intensity VI MM effects (event 06 October, 1971 in Table 1 of the Woodward-Clyde re-i port) in the epicentral region. 1 I l
PART III EVALUATION AND C0hB!ENTS ON Tile DAMES 4 MOORE AND WOODWARD-CLYDE REPORTS l 5
6 Evaluation and Comments on the Dames 6 Moore and Woodward-Clyde Reports I have reviewed both the Dames 6 Moore and Woodward-Clyde reports with respect to the techniques they used to estimate the acceleration as a function of earthquake magnitude / epicentral intensity and distance in detail. And while the two approaches differ, both reports rely heavily upon current and generally ac-cepted scaling techniques. The conclusions of both studies, however, are based on the acceptance of the single parameter -epicentral intensity- to characterize the regional seismic activity. It is with this portion of both studies that I disapree. As discussed in Part IV, clearly there are carthquakes c f appreciably different magnitudes and extent of areal damage, but which are considered equal if judged on the basis of their epicentral intensities. It is my opinion that this approach too simplistic, and that the report would be greatly strengthened if the more significant events in the area were defined in greater detail. s
PART IV COMMENTS ON Tile REGIONAL SEISMICITY 7
8 1 1 1 ! Comments on the Regional Seismicity i Due to the lack of instrumental data, the frequency of j the various IcVels of ground motions at the site considered in i this study were derived by converting the catalogued epicentral intensities to mb(Lg) m gnitudes, or by the derivation of a l site in'ensity by means of a spatial attenuation-of-int'ensity i relationship. Both approaches make the assumption that the regional scismicity can be characterized by a single parameter, i the maximum epicentral intensity. Yet, there are several in-stances in both the historical and instrumental data base when earthquakes of appreciably different magnitudes and extent of areal damage are catalogued as having the same epicentral intensity; i.e., the August 10, 1884 and the June 01, 1927 events described in Table IV-1. Yet, by the methodology used 4 i in this study, such events are considered with equal weight. l In my opinion, therefore, a weakness in the seismicity section of the seismic risk analysis done for this study is the lack of a detailed review of the more significant events l in the region. By detailed review, it is meant the documenta- l tion of the ef fects of the earthquakes via published reports; newspapers, etc., and the use of instrumental records where available. If a definitive study had been done on the more i significant events, it is quite likely that several of the assumptions utilized in this study could have been tested against the observations. For example, a definitive study of
9 the August 10, 1884 event would have resulted in data base by which to test the spatial attenuation of intensity relationships referred to in the study. A definitive study of the 1884 event, would also most likely have suggested an earthquake in the range of a 5 1/2 to 5 3/4 mbtg magnitude event, rather than the 5 1/4 m bLg m gnitude estimated by the relationship: m b
= 0.5 (I g + 3.5)
A review of the scismograms of the March 23, 1957 event, interpreted in accordance with the mbLg magnitude formula developed by Nuttli (1973A), would have indicated a magnitude more on the order of a 3.3 event, rather than the 4 3/4 ab derived by the above formula. And a review of the intensity data published in the 1957 edition of United States Earthquakes, would have demonstrated the inadequacy of the attenuation of intensity relationship used in this study. Table IV-1 gives the results of a cursory review of six of the more significant events in the general region as part of a background study I undertook as part of this review. The results listed in this table are not meant to be definitive, which is beyond the scope of this review, but rather as an indication of the type of information that is availabic and which in my opinion should have been incorporated in the study.
TABLE IV-1 RESULTS OF A CURSORY REVIEliS OF Tile EARTilQUAKES OF: December 19, 1737 November 30, 1783 August 10, 1884 September 01, 1895 June 01, .1927 March 23, 1957 l , 1 l 10 l
11 1 December 19, 1737 Based on the description of this event in Coffman and von Hake (1973) as being felt from Boston, MA to New Castle, DE, , it is estimated that the felt radius of this event was on the order of 260 km. Using this radius to estimate the felt area (this includes a hypothetical offshore area), and Formula (5) in Street and Lacroix (1979), the mbLg m gnitude for this event is calculated to be 4.8 (+0.30). I i
12 i i November 30, 1783 The m bLg magnitude estimated for this event was obtained by comparing the newspaper reports for this event at Boston (MA), Hartford (CT) , New Brunswick (NJ) , New Haven (CT), New London (CT), philadelphia (PA) , and h' ores ter (MA) , to the newspaper reports for the August 10, 1884 earthquake. In gen-eral, the newspaper reports indicated that the 1783 event was experienced at about one intensity unit less that experienced during the 1884 event. The m bLg w s then calculated by adjusting the falloff-of-intensity curve obtained fer the 1884 event downwards one intensity unit. This resulted in a m bLg magnitude of 5.2 Sources of Information: Boston Gazette Connecticut Courant Connecticut Journal New London Gazette Pennsylvania Packet I l l l
13 August 10, 1884 The m bLg magnitude of the August 10, 1884 event was esti-mated on the basis of the felt area, the area within the inten-sity IV isoseism, and the falloff-of-intensity technique develop-ed by Nuttli (1973B). Based on a felt area estimate of 557,000 sq km (includes a hypothetical offshore area), a 187,000 sq km area within the intensity IV isoseism, and a falloff-of-intensity m b stimate of 5.7, the m bLg magnitude of the 1884 event is estimated to be 5.6 (+0.15) on the basis of Formula (7) of Street and Lacroix (1979). Sources of Information: Rockwood (1885) New York Times Albany Evening Journal The Plattsburg Sentinel Albany Evening Unica Rochester Democrat and Chronicle The Albany Times Rochester Union and Advertiser Amsterdam Daily Democrat Rome Daily Sentinel The Baltimore Morning Sun Sunday Morning Tidings Elmire Weekly Advertiser Troy Times The Globe and Mail Utica Morning Herald New York Herald (and Daily Gazette) Washington Post
14 i September 01, 1895 I I The m bLg magnitude for the September 01, 1895 event is estimated on the basis of a 45,000 sq. km felt area, which by l Formula (5) of Street and Lacroix (1979) yields a 4.3 m bLg magnitude. 4 A problem with this event, are the conflicting reports ' as to the extent of the felt area. Coffman and von Hake (1973) indicate that the event was felt from Virginia to Maine, but newspaper accounts indicate that the event was felt no further north than Sing Sing, New York, and no further south than j Wilmington, DE. In this review, I have chosen to use the newspaper accounts
! as a basis for calculating the magnitude.
Sources of Information: The Baltimore Morning Sun New York licrald New York Times i i l l l l
. . _ _ . - . __ - .= _ _ _ _ - _ . .
i k 15 ~ June 01, 1927 The 3.9 m bLg magnitude for the June 01, 1927 event is estimated on the basis of 16,000 sq. km felt area (includes a hypothetical offshore felt area) and Formula (5) of Street i and Lacroix (1979).
- A 4.2 upper bound on the magnitude can be estimated on the basis of the fact that the earthquake was not recorded on the Galitzin (Cambridge Type) seismometers located at George-
! town University, 4300 km to the south. The magnification of the vertical Galitzin is known to have been %360 at 1 Hz. Sources of Information: i New York Times Washington Post ' l l I I
March 23, 1957 OT(UT) : 19-02-31 40 3/4*N/74 3/4*W DE m STATION IS1A CE MAGNIFICATION by IN TRUMEh'T WES BENIOFF 338 1.4 0.6 30K 3.1 OTT BENIOFF 521 2.5 0.4 65K 3.4* MNT BENIOFF 535 2.5 0.3 63K 3.6* SFA WILLMORE 779 0. 5 0.7 27K 3.I Felt area is estimated to be % 2,000 km. 2 Using Formula (5).in Street and Lacroix magnitude of . . . . . . . . . . . . . . . . . . . . 3.4 (1979), felt area suggests a mby Average mby = 3.3
- Note: the 3.4 and 3.6 mby m gnitudes from the records at OTT and MNT are probably inflated due to the use of the 0.4 and 0.3 second periods.
** Felt Area based on information in United State Earthquakes (1957) .
5
17 REFERENCES FOR PART IV Coffman, J. L., and C. A. von Hake, Editors (1973). Earthquakes History af the United States (revised edition through 1970), Publication 41-1, Environmental Data Service, NOAA, U.S. Dept. of Commerce, Boulder, Colorado, 208 p. Nuttli, O. W. (1973A). " Seismic Wave Attenuation and Magnitude Relations for Eastern North America", J. Geophys. Res., 78, 876-885. Nuttli, O. W. "The Mississippi Valley Earthquakes of (1973B). Intensities, 1811 and 1812: Ground Motion and Magnitudes," Bull. Seism. Soc. Am., 63, 227-248. Rockwood, C. G. (1885). "American Earthquakes", Am. Jour. Sci.,
- v. 29, 429-432.
Street, R. and A. Lacroix (1979). "An Empirical Study of New England Seismicity: 1727-1977", Bull. Seism. Soc. Am., 69, 159-175. United States Earthquakes (1928-present). Annual publication of U.S. Dept. of Commerce, Washington,-D.C. l
APPENDIX B CRITICAL REVIEW of the , INDIAN POINT PROBABILISTIC SAFETY STUW (SEISMICITY AND SEISMIC RISK) by Erik H. Vanmarcke Submitted to J. R. Benjamin & Associates Mountain View, California - July 9, 1982
TABLE OF CONTENTS Page Evaluati on of Overall Methodolo gy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 6 De t a i l e d Re v i ew Co mme n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Section 7.2.2 (5eismicity)............................... (Dames and Moore Seismicity Study) . . . . . . . . . 6 Section 7.9.1 (Woodward-Clyde Sei smic i ty Study) . . . . . . . . . . 8 Section 7.9.2 Section 7.9.4 (Structural Mechanics Associates, Inc...... 9 Damage Effective Ground Acceleration) 9 Section 7.2.3 ( Fr a g i l i ty ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Eva l uati on of Fi nal Re su l ts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Re f ere nc e s a nd Sou rc e s Us ed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii
EVALUATION OF OVERALL METHODOLOGY The overall analysis format involving consecutive matrix operations on the vector (s) of initiating event probabilities is simple and attractive, and it is quite appropriate for seismic risk evaluation. Seismicity Studies In the seismicity study, the basic format of generating a family of seismicity curves to which subjective weights are assigned is sound, and the assignments of equal weights to the two studies (Dames & Moore and Woodward-Clyde) is reasonable. The two studies are based on similar methodology and yield quite comparable site seismicity estimates. The seismicity analysis output is expressed in terms of a simple ground motion parameter (acceleration). In this format, other ground motion para-meters which may have a significant effect on system response and performance are ignored: strong-motion duration, parameters of the frequency content (e.g., dominant frequency or the ratio of peak velocity to peak accelera-tion). Ideally, the output of a site seismicity analysis would be the multi-dimensional distribution of a vector of ground motion parameters. The Cornell (1968) seismic hazard model used in the Indian Point study integrates statistical and tectonic information about earthquake occurrence. Contrasted to an approach based directly on historical epicentral locations and magnitudes, the method permits (in f act, necessitates) an expression of judgment about the location and geometry of seismogenic zones (zones where earthquake occurrence is believed to be of similar tectonic origin). The method is most potent in regions where tectonic evidence is strong, e.g., where the presence of sources (usually faults) is undisputable. In the Northeastern U.S., where there is much cnntroversy about the causes and mech-anisms of earthquakes, there is great diversity of (relatively sof t) expert opinion about seismic zonation. Therefore, when the seismic risk results based on the different interpretations of the historical seismicity (i .e., 1
\
different assumptions about seismic zonations) are eventually weighed, the composite seismic risk is bound to be close to that obtained from an approach based purely on historical seismicity. The process of selecting seismogenic zones is tantamount to assigning a specific spatial distribution to the historical seismicity in the area surrounding the site. When a new seismogenic zone is introduced, the mean seismicity activity (number of quakes per year) assigned to it will be taken away from the other seismic zones already included in the model, as the aggregate seismic activity (the sum over all zones) tends to remain close to the historical value. It is in this light that one can exaaine the question as to whether the Ramapo Fault (described by Aggarwal and Sykes,1978) should have been included as a seismogenic zone. If one sees as the main effect introducing a new source, th9 diversion of some of the seismicity away from the other seismogen-ic zones, no significant differences in predicted site seismic risks should be exp ected. For the same reason, it is reasonable to ignore the uncertainty about the activity rates of individual sources. Individual source contributions,to site , seismic risk are approximately linearly dependent on the source activity rate. Hence, the effect of varying source activity is easy to assess, and the variability of this parameter does not have much impact on overall uncertainty , in site seismicity. A variety of attenuation relationships are considered which reasonably represent available information about site motion intensity in function of magnitude and distance. The lognormal distribution is the standard model for the " error factor," and the assumed value for the log-standard deviation ( o = 0.6) is also reasonable. The Indian Point plant is founded on bedrock. This fact is not accounted for in the Dames & Moore study. In the Woodward-Clyde analysis, the preferred attenuation relationship (proposed by Cornell and Merz) has the advanta;;a of being specifically applicable to ground motion on bedrock. The most controversial aspect of the seismicity study is the imposition of an upper bound on effective ground acceleration. Although there is merit 2
to the arguments advanced in the report (Section 7.9.4) by Structural Mechan-ics Associates, Inc. (which form the basis for the upper bounding of effective acceleration), they really constitute one expert's opinion. Other experts would likely disagree with the proposition that such bounds exist. In effect, in what is somewhat a matter of professional judgment, the full weight is assigned to a single expert opinion (expressed in Section 7.9.4). The relative frequency of occurrence of earthquakes is represented by a truncated exponential distribution. A better model might be one in which the frequency-versus-magnitude law decays more gradually with magnitude. This would certainly lessen the impact of the imposition of an upper bound magni-tude (Dames & Moore) or an upper bound Modified Mercally Intensity (Woodward-Clyde). The key question is not whether the Ramapo fault is included or not, but if there are perhaps reasons to assign different (unf avorable) values to its seismicity parameters, in particular, the upper bound magnitude Mb, max. It is doubtful that there is evidence that would support unusual values for the seismicity parameters of the Ramapo fault. Treatment of Fragility in Seismic Safety Analysis In reference to the five main steps in the seismic safety analysis (as outlined in Section 7.2.1), I would argue that there is a missing step. In between Step 1 (Seismicity) and Step 2 (Fragility), there should be a step labeled " Seismic Response" or " Seismic Load Effect." When an earthquake occurs, a ground motion characterized by peak accel-eration a (whether " instrumental," " effective," or " sustained" does not matter at this point) is experienced at the base of the structure. The dynamic seismic input causes many simultaneous response accelerations aj at points j (locations of structural components or equipment support points) throughout the structure. These response motions have frequency content quite different from that of the input motion. The output-to-input acceleration ratios aj/a may be seen as random variables whose marginal statistics depend on the 3
seismic response, the randomness of the ground motion, the (uncertain) dynamic properties, etc. Seismic design is based on the predicted response accelerations aj to which an appropriate safety factor is applied. This yields the mean or median capacity (or resistance) of component j expressed in terms of acceleration. The actual capacity of component j is of course a random variable. In the format of the seismic safety part of the Indian Point study, the uncertainty represented by the fragility curves originates from both the loading and the resistance, and the uncertainty about the (response related) ratio aj/a is incorporated in the fragility curves. The introduction of an intermediate step (Seismic Response or Seismic Load Effect) in the seismic safety assessment would help clarify and resolve many issues related to model-ing, interpretation and processing of component fragility curves, in partic-ular: (a) Variabili ty: The components of uncertainty related to seismic input (owing to complexity of accelerograms) and response could be separated from those related to capacity or resistance (measurable by component testing). (b) Probability Models: Much is known about probability density func-tions of seismic load effects. It would no longer be necessary to adopt the sweeping assumption that all random variables involved have a lognormal dis-tribu tion . (c) Failure Criteria: It would become unnecessary to express all frag-ility curves in terms of peak acceleration (a definite drawback of the present format). Depending on the function (or rather, malfunction) of each component, the fragility curve might be in terms of maximum (response) ac-celeration, sustained peak acceleration, relative displacement, or even energy absorption capacity. (d) Correlation : Patterns of correlation (different for random load and resistance f actors) are not adequately accounted for in the present format of 4
l converting component fragility curves into system fragility curves by using plant logic diagrams. The component-to-system conversion is now accomplished (quite artificially) in the " resistance domain" by assuming statistical inde-pendence between the random variables that control the width of component fragility curves. In reality, for a given input acceleration, the response accelerations aj are fairly strongly correlated, while the associated compon-ent resistances are perhaps more nearly independent. Depending on the rela-tive variability of load effects and resistances, the real system condition would be closer to one or another of the two extreme conditions of perfect dependence and perfect independence. 5
DETAILED REVIEW COMMENTS SECTION 7.2.2 (Seismicity) Most of the detailed review comments about the seismicity study are presented as part of the review of Sections 7.9.1 and 7.9.2. My main concern with the summary in Section 7.2.2 is that it does not clearly indicate how the final family of seismicity curves was obtained. Nowhere in the Dames & Moore report are rigid bounds imposed on effective peak acceleration; this asympto-tic behavior at low risk levels is, however, the single most striking feature of seismicity curves in Figure 7.2-4 The last paragraph in Section 7.2.2.1 does not adequately explain the logic which led to the final seismicity curves. The terminology used to refer to the various measures of acceleration (peak, sustained, sustained-based and effective) is quite confusing. Note, for example, the final three paragraphs in Section 7.2.2.1. The presence of these different acceleration measures and correction f actors points to the urgent need to implement improved earthquake ground motion descriptions that explicitly account for duration (in addition to a measure of intensity such as peak acceleration) and to apply analysis procedures which predict seismic response measures more directly correlated with performance and damage. Much of this is within the state-of-knowledge of earthquake engineering. l SECTION 7.9.1 (Dames & Moore Seismicity Study) Page 2, Seismic Hazard Model, Item 1: I question the statement: "The average predicted rates of occurrence in these zones are accurately estimated by historical occurrence in these zones." The words " predicted" and "accur-ately" should be dropped. The conynent (on page 5 end of 2nd paragraph) "even if peak accelerations are high" is revealing. It implies recognition that accelerations are indeed highly variable. Many seismologists and earthquake engineers would say that 6
this is equally true at high as well as at low values of mb (or Mercalli Intensity), and that any rigid upper bound on peak acceleration is unrealistic. Uncertainty about the "b-value" for Northeast tectonic zones and for the Piedmont zone (on page 6): Tne three-valued discretization (mean and mean + one standard deviation) may be inadequate as it obviously does not cover the tails of the distribution. No variation is assumed for the b-value associated with the Piedmont-Capa Ann zone, Discretization of mb, max (on page 6): The double-triangular distribution has an upper bound of 6.2; it is then converted into a three-valued probabil-ity mass function whose largest value is mb, max = 6. If the rigid bound on effective acceleration were to be relaxed, the resulting error in seismic risk calculations may not be negligible in the very low probability range. It is stated on page 7 (paragraph 2) that "It was felt that there is some negative correlation between b-values and values of mb, max. This is the justification for assuming complete probabilistic dependence between b and
*b, max.
It would be interesting to see some results based on the assumption that b and mb, max vary independently. Also, it might have been preferable to quantify the seismological consultant's judgment in terms of 3 (discretized) joint probability distribution implying partial correlation. Treatment of Peak Acceleration (page 8): Nuttli's data indicate that the 1.37 value for the ratio of sustained to p::ak acceleration applies to the magnitude range mb i 6.0. The 1.37 value is in fact adopted for all magni-tudes. Note, however, that the upper magnitude bound adopted in the study equals mb, max = 6.0 (with probability 0.28), while the mb magnitude follows a truncated exponential distribution; it follows that the condition mb i 6.0 (to which the 1.37 value corresponds) is, in fact, assigned zero probability of occu rrence. The 1.37 value is therefore subject to question. The influence of the choice of a max is understated, for example on page 12 in Section 7.9.1: "The variation in hazard resulting from the use of alternate estimates of peak acceleration is qenerally within the variation resulting from different b-values and mb, max va;ues and from hypotheses on seismogenic zones." It is quite obvious from the final seismicity curves that 7
calculated probabilities are more sensitive to amax than to these ather as-sumtions in the critical "high acceleration-low probability" range of the seismicity curves. The assignment of uncertainty to the attenuation laws (alna = 0.6) is reasonable. Alternate assumptions could have been tested (with appropriate weights attached), but I expect this would not have had much impact on the final results. The same may be said about the choice of the lower limit on magnitude (mb
- 4)*
SECTION 7.9.2 (Woodward-Clyde Seismicity Study) The Woodward-Clyde study carefully considers a range of choices for the models and equations to describe source location and geometry, activity rates, upper bound magnitude (epicentral intensity) and attenuation laws. Preferred choices are identified in each instance (except for upper bound intensity), leading to a " base case" site seismicity output. The latter constitutes the recommended input into the plant seismic safety analysis. The sensitivity analysis is limited to single changes in each one of the assumptions made'in " base case." Although there is a very common way of doing sensitivity analysis, it is obviously limited and oversimplified. The different seismicity parameters of each seismogenic zone (e.g., size, , activity, b-value upper bound magnitude) are strongly interdependent. Hence, varying one parameter (or making it more variable) in principle necessitates re-examination of all related parameters. It is stated on page 8: "The composite value is, not an accurate representation of our uncertainty regarding upper bound." Should it be h? The most critical parameter is the upper bound intensity, selected to be either VII or VIII with likelihoods of 80 percent and 20 percent, re spectively. This cogosite bound is used in the " base case" seismicity analysis. It would be nice to see results based on different sets of intensities and associated likelihoods. In particular, small weights could be assigned to intensities VI and IX. 8
The Cornell-Merz attenuation relationship has the advantage of being applicable to the Northeastern U.S. as well as to rock sites. This is consistent with the location and site conditica of the Indian Point plant. Ground motion attenuation is evaluated in two steps. Site intensity is first predicted as a function of epicentral intensity and distance, and is then converted to peak ground acceleration. Bounds on peak acceleration are introduced (forthrightly and explicitly, as an integral part of the seismicity analysis) in the second step. Nuttli's sustained acceleration is adopted as an appropriate representation of " effective peak acceleration." The report offers a thoughtful discussion of the rationale behind this choice. The very crude discretization of acceleration (see Table on page 21) is questionable. It would hava been preferable to consider an array of at least four or five accalerations for each intensity. SECTION 7.9.4 (Structural Mechanics Associates, Inc., Damage-Effective Ground Accelerations) While I agree with SMA's assessment of the inadequacy of peak accelera-tion to represent damage or damage potential (because f actors such as ground motion duration and inelastic behavior are unaccountad for), I feel that the proposed acceleration reduction f actors, and especially the upper bounds on ' acceleration, are introduced incorrectly at the end of the seismicity anal-ysis. Such bounds (with probabilities attached) should perhaps appear in the attenuation laws, as part of the input to the seismic hazard analysis. As it is, they appear as an af ter-the-fact adjustment of the output. SECTION 7.2.3 Fragility The choice of the lognormal distribution is expedient but not necessarily consistent with available information. Seismic response itself is more nearly normal than lognormal. [ Seismic excitations are approximately normal (with mean zero), and any linear system preserves this normality; hence, the re-sponse time histories are normal.] The absolute maximum of the random re-sponse of a linear system follows an extreme value distribution about which 9
much is known. Hence, the sweeping assumptian of lognormality is justified mainly on account of analytical convenience (i .e., it f acilitates analysis of products of independent random variables). Section 7.2.3.1 on " Definition of Failure" makes it clear that accelera-tion is not necessarily the best response parameter in terms of which to : define fragility curves; for example, relative displacement or energy absorp- ! tion capability may be preferable in some cases. The evaluation of fragility is in many cases judgmental. For the criti-cal components, it would be desirable to validate judgment through appropriate ' (nonlinear) dynamic analyses using as input time histories of ground (floor) motion. 1 i 10
-- - - _ _ _ _ _ _ _ . ' ^ ^ ^ ^ ^ ^ ^ ^ --_ _ l EVALUATION OF FINAL RESULTS In the detailed comments, I have tried to identify all the main assump-Whenever pos-tions made in the seismicity portion of the Indian Point PRA. sible, I have expressed my judgment about the appropriateness of each assump-tion ano about its likely impr.ct on the final results. Both seismicity studies adopt the "seismogenic zone" approach rather than
- alternative methodology based purely on historical seismicity. In view of the range of assumptions about source locations and shapes represented in the two studies, I judge that the range of probabilities adequately covers what would be predicted by alternate methodologies. Taken together, the two seismicity studies produce a representative family of seismicity curves.
A reasonable set of weights has been assigned to the different seismicity curves (13 from the Dames & Moore study and 4 from the Woodward-Clyde study). The better treatment of ground motion attenuation and the more log-ical introduction of upper bounds on acceleration offset the more limited sensitivity analysis in the Woodward-Clyde study, and justify the assignment of equal weights to the two studies. Overall, I believe that the results expressed in terms of mean annual risk of core damage (or mean risk to pub'.ic health and safety) are quite insensitive to reasonable variations in the assumpticns about seismic zona-While these assump-tion, seismicity parameters and discretization intervals. tions are unlikely to have much impact on 'ean risk rates, they will affect (in ways hard to predict) the shape and the spread of the final " frequency-of-probability" curves. The most critical assumption is that there is an upper bound on effective peak acceleration. Such bounds are seldom encountered in conventional seismic risk work. If this asumption were to be relaxed it will prooably lead to moderate increases in final mean seismic risk estimates, and to a broader spread in the high acceleration end of the family of seismicity curves. 11
\
REFERENCES AND SOURCES USED ! Sources My report is based on my general experience in structural safety and 1 earthquake engineering. Among the documents on which I relied are the tech-nical reports of an NSF project on Evaluation of Seismic Safety of Buildings which ran from 1974 to 1978 and for which I served as principal investigator. References
- 1. Cornell, C. A., Engineering Seismic Risk Analysis, Bull.
Se i sm. Soc . Am . , 58, 1583-1606, 1968.
- 2. Aggarwal, Y. P., and L. R. Sykes, Earthquakes, Faults and >
Nuclear Power Plants in Southern New York and Northern New Jersey, Science, Vol. 200, p. 425-429,1978.
- 3. Pickard, Lowe and Garrick, personal communication on Weight Assigned to Seismicity Curves,1982.
12
l APPENDIX C REVIEW OF INDIAN POINT PRA, CHAPTER 4 AND APPENDIX C by: Larry R. Russell November 8, 1982
SUMMARY
AND CONCLUSIONS The median and upper bound hurricane wind probabilities estimated for the Indian Point location in the PRA appear to be low for the rarer events (recur-rence intervals greater than about 20 years). This evaluation is based upon comparisons with results of independent simulations. This apparent underestima-tion arises in part from treating all wind source directions in the same way, withcet allowing for more severe conditions from certain directions. Better estimationc of these probabilities will require careful evaluation of complex site roughness boundary layer effects and wind channelization by the local hills and river valley. A second source of underestimation of the site winds is from use of a "K factor" in gradient wind estimation averaged from earlier study results and not reflecting current knowledge. By coupling appropriate wind adjustments by direction with the generally satisfactory existing model, more accurate wind estimates can be produced. Results of a "best estimate" wind directional analysis indicate significantly reduced risk from several directions. DISCUSSION ADEQUACY OF APPROACli The basic simulation approach utilized in the PRA is an adaptation of the standard method utilized to estimate hurricane wind probabilities in regions of insufficient data. The PRA simulation approach is sufficiently accurate, with appropriate data and wind formulas, to estimate wind recurrence probabilities for critical structures. The adequacy of the PRA analytical method was estab-lished by running a completely independent analysis using substantially the same input data. Reasonably equivalent results (generally within 4 to 12 mph) were obtained from the two computer programs, considering the different wind-field treatments and other relatively minor differences. The input data selection for the PRA was realistic or somewhat conserva-tive (i.e., tending to produce higher estimates than the raw data would yield.) The storm decay rate when moving inland and the storm occurrence rates were fairly conservative. These overestimates tend to offset any underestimation errors in the windfield estimates due to lack of allowances for the local wind intensifications from rairl ands. The primary deterrinints of the wind, given a hurricane occurrence, are the central pressure drop of the storm, its size and forward speed, and the
. - _ _ _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . ' - - - - - - - - - ~ _ _ - _ . _ , _ _ __
2 influence of the site topography and boundary layer roughness. The treatments of the central pressure drop, storm size and forward speed were accurate and conservative. The primary questions of accuracy relate to:a) the treatment of site topographic conditions, and b) the windfield model used to convert hurricane pressures and the like to gradient winds. INFLUENCE OF LOCAL TOPOGRAPHY AND GEOGRAPHY The Indian Point Plant is in an unusual location where it is very difficult to evaluate site conditions without model studies or field data. The broad Hudson River Valley to the southeast of the site, along with the adjacent-hills, will tend to channel winds up the river. Such winds will be higher than those elsewhere in the area due to both reduced friction overwater and channelization effects. Winds from the southeast, southwest and south will tend to blow past the waterfront area from the southwest. Some lesser wind accentuation can also be expected from the northeast. For other wind directions, the wind values will likely be less or no more than would be expected in flat country. Field verification and quantification of the site friction and channelization effects 1 is generally difficult due to lack of appropriate storm conditions. If possible, ! the Indian Foint directional Plant anemometer records should be used to estimate these effects. Table I gives the estimated site frictional properties for each of sixteen l directions. A power law model for the boundary layer has been used in the analyses performed for this review. The site is considered as having the equiva-lent of overwater exposure for winds from the NNE, NE, SSE, and S, with open country exposure from the SE, SSW, and N. The other directions are more or less restricted by the hills and woods in the area. The general location of the site is in a rather sheltered region, where most storms travel parallel to or somewhat away from the coast. Storm proximity to the coast or passage inland for extended periods tends to appreciably weaken a storm. Between 1871 and 1980, only one storm (in 1903) has entered New Jersey or New York on a heading (west of north) where storm decay would be minimal and maximum storm winds would come overwater to the site. Most of the area' storms which are not weakened by moving ashore on a northerly or northeasterly heading over New Jersey will move ashore over Long Island or farther east. In such cases,
- the site will experience either a weakened storm or will be on the weak side of an unweakened storm. When the site is on the weak side of a hurricane passing over Long Island, the site winds from the northeast will probably be increased over those predicted by the PRA model, due to channelization and reduced frictional effects. The simulations, discussed later, indicate that the NNE and NE are the worst wind directions for the site.
If a north-to-northeasterly heading storm is relatively undecayed during its passage over New Jersey, then strong SE winds in excess of the PRA model predictions are also possible. These situations of either a relatively undecayed storm passing over New Jersey or a storm heading NW or NNW or N very near the site are rare, based on the historical data. However, the fairly large simulated " data set permits directly estimating the influence of these relatively rare events upon the wind risk. Normally, the adiabatic cooling induced in hurricanes
3 passing over ranges of hills weakens the storms appreciably, nowever, for this site, most of the hurricane winds experienced will have an offshore set, so such attenuation may not occur. WIND PROBABILITY ESTIMATES FROM OTHER SOURCES Before any independent simulations were run, other estimates of the winds at the location were made by using PRA Reference {30] NBS Bldg. Science Series 124:
" Hurricane Wind Speeds in the United States." This report [30] is a general study which provides only a rough estimate of local winds. Figure 1 indicates the windspeeds simulated for an open-country location 50 miles inland from the coast at New York City by the NBS. Given the general path trend for storms in 4 the vicinity, the speeds simulated should be applied to sites to the NNE and NE of New York City. Somewhat reduced (by above 10 to 15%) winds would typically be expected at the Indian Point site if it were in open country. It is felt by this reviewer that essentially open country wind estimates are representative for Indian Point si'c winds for the " average" direction. Even with adjustments for the proportion of storm wind maxima comibg from more, reduced wind directions, the resultant curve is still likely to exceed the PRA upper bound curve (PRA Figure IV-8) for the rarer events because of the directions with full exposure. When rare,relatively undecayed strong storms pass over the length of New Jersey or a rare strong storm crosses the coast more directly and passes to the west of the site, the winds at the site will probably exceed 110 mph. While such storms are uncommon, they are likely enough to cause the actual hurricane wind risk curve to exceed that of the PRA upper bound. The median curve of the PRA appears considerably below the PRA upper bound curve.
Emil Simiu summarized [A-1] observationr taken from various sources in the Ncw York-New Jersey area for hurricanes. New York City expericaced 100 mph winds in 1944, while Brookhaven on Long Island measured 95 mph winds in 1954 and 115 mph gusts in 1960. The elevations and exposures are not specified, but these coastal winds are still fairly high. More significantly, Trenton, New The Jersey experienced 57 mph from Hazel in 1957 and SC mph from Donna in 1960. measurement location is in the city, so these observatiens would correspond to about 70 mph in open country. Trenton is about 50 miles inland and experienccs essentially the same hurricane exposure, decay, and risk as the Indian Point site. The open exposure of the Indian Point site for NE and SE-SW winds could be expected to result in higher winds than for Trenton. The Trenton measurements tend to suppcrt the validity of the Batts, et al. [30] estimates for Indian Point. Use of NOAA Technical Report NWS 23 [n-2] yields upper bound estimates for winds at Indian Point of about 146 mph fastest mile from the SE. This estimate is based on a very extreme central pressure drcp of 3.35 inch Ug, which has never been approached in the New York area. This model storm would move north-This west, with the strongest portion of the windfield passing over the site. highly improbable event is combined with more reasonable storm speed and size parameters and credible reduction of the site winds (open country basis) to 90% of those experienced at the coast. The " Standard Project Hurricane" (SPH) from the same reference would yield about 103 mph fastest mile for a storm giving winds from an open country exposure at the site. The probability of a SPH is likely about 0.003/ year.
4 H.C.S. Thom prepared estimates of wind recurrences for several stations in the U. S. (A-3,A-4]. His estimates are based on observations at metaoro-logical stations. Figure 2 shows his estimates for the Long Island seaward coast. These curves include phenomena other than hurricanes and serve as general indicators of conditions up to recurrence intervals of about 500 years. The values found by Thom should roughly approximate or exceed somewhat condi-tions at Indian Point for the severe directions if they are valid. However, Thom's results are known to be biased toward low values in some locations due to data censoring. In general, it was felt, before any other analyses were made, that the estimates made in the study by Batts, et al. [30] provide a better estimate of Indian Point hurricane winds than does that of the PRA. The reasons for this are that 1) the site exposure is more nearly described by Reference [30] . (Away from the river, it is felt that the PRA results are conservative), and 4
- 2) the windfield model used by Batts, et al. better describes hurricane condi-tions than does that used in the PRA.
SIMULATION RESULTS Three different hurricane simulations were done using the computer model developed for the Batts, et al. [30] study. This computer model is organi:Ed in a different way than that used for the PRA work, but overall the two models are roughly equivalent. One simulation used the input data described in the PRn, in an attempt to establish rough equivalence of the two programs. Figure 3, which is adapted from PRA Figure IV-8, indicates fairly good agreemeat between the two models (using the seme data) around occurrence probabilities of 10-1 to 2 10-3/ year. The second simulction involved using data estimated directly from maps of historic hurricane tracks and other hi ^.oric hurricane property data. The windfield model of Ho, et al. [ A-2] , which is the same as used by Batts, et al. l [30} , was used, but open country boundary layer conditions were assumed. These results, shown also in Figure 3 as "Open Country, Best Estimate," should be interpreted as a site-specific equivalent of the Batts, et al. study. The data used is an improvement over the NWS-15 [43] data used in the Batts, et al. study, and the open country assumption is a reasonable approximation for an average of all site directions. This result is higher than the PRA median curve by about 15 to 20 mph; it closely approximates the PRA " upper bound" curve. The final simulation used the same data as the "Open Country-Best Estimate," but the directional boundary layer properties of Table 1 were used instead of the open country assumptions. These results, shown in Figure 3 as " Russell's Best Estimate," are site specific results incorporating the best data available and including the site topographic effects. The result is substantially above the PRA median curve, and also about 10 mph above the PRA upper bound curve. The simulations developed for the comparison use a sanple size of 999 storms, so there is some numerical uncertainty in the resultant estimates for rarer events. Simiu, in working with the model, felt that this uncertainty amounted to about
5 4 to 5 mph for 0.01 annual occurrence probabilities. This uncertainty increases for rarer events, and caution should be used with any extrapolations beyond 0.001/ year. The results of the three simulations are plotted together in Figure 4. Figures 5-8 give the "Ecst Estimate" probabilities of hurricane winds by sixteen compass points. It can be seen that the worst directions are NNE, NE, and SSE , while ENE , E , ESE , WSW , W , vnni, NW , and NNW are relatively mild, due mainly i to site conditions. The most common storm wind directions are from the northern quadrant. The relative frequencies of wind directions differ slightly for the PRA recreation simulation and the "Best Estimate," but the agreement is enough to warrant confidence in the different data sets. In the absence of detailed data on the directional dependence of the boundary layer, some variance is to be expected between the estimates of the ef fect by different parties. However, such differences are not likely to have as significant an impact as the choice of the "K factor" for converting central pressure differences to gradient winds. It appears advisable, given the variability of hurricanes, to use the empirical windfield data in Reference (A-2] to treat the windfield, rather than using the more idealized model of the PRA. If this were done, it is expected that the agreement between the "Best Estimate" and the PRA results will be better. CHAPTER IV REVIEW A.
Introduction:
Adequate. B. Methodology:
- 1. Hurricane Risk Model:
Equation (2) derived from Eqn. (1) , is reasonable and conservative. The general approach of this section is reasonable and adequate. Equa-tions (5) , (6), and (7) provide a satisfactory treatment.
- 2. Cyclonic Windfield Model:
The approach described in Equations (8) - (28) is acceptable for storms which are well behaved and smoothly varying, in the sense of not having any localized zones of relatively more intense convection. Any such localized zones of intensified convection will produce devia-tions from this windfield model. Hurricanes are noted for their non-smooth variations, which occur in "rainbands". These bands are readily observed both visually and on radar as regions of heavier cloud density which have associated higher winds. While the peak winds of the storm may not be influenced much by such rainbands, the peak winds observed away from the radius of maximum winds likely will typically be higher than indicated by this model by 5-10 mph. Reference (A-2) , pp. 243-256, indicates empirical results of windfield studies for hurricanes. It appears advisable to use an empirical windfield model to describe hurricanes, given their departure from idealized behavior. - _ _ - _ _ _ _ . _ _ . - - - - - - - - ---_s_. _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
6
- 2. Cyclonic Windfield Model (continued)
Development of 6p distributions directly from existing data is fea-sible, and probably more desirable, but use of a fixed po value is accep-table. c. Use of an average value of K in Equation (28) is not reasonable. The values of K given in PRA References [30] and Kraft [35, 40] are rela-tively high because the hurricane wir.dfields used to estimate K have l been found to justify such higher numbers. The study by Russell [26] uses an old the data set.windfield determination formula and should be excluded from K must be adjusted to be a function of wind direction for this complex site, d. The formula for open country fastest 1-minute average winds used in Batts et al. [30] (with K=10.8) yields a higher wind estimate than that resulting frcn the average K=9.59. This higher value of K has been found to occasionally underestimate storm winds on the Texas coast. [A-5]. e. Decay: The rate of decay of the central pressure difference will be quite rande:r. in nature, but the source data sample is so limited that determination of an average value is difficult. The value used by Batts, et al. [30] was specifically chosen for a flood-prone flat coastal plain with very large bays. This value is unrealistically low for the Hudson Valley region, where large hills, lack of appreciable open water, and predominantly dry continental air sources would generally produce a faster than normal decay. The decay numbers used in the PRA will tend to under-estimate the reduction of the hurricane strength as it moves inland. That is, the storm decay function tends to be conservative, j
- f. !
Maximum Windspeed During Storm Passage: The numerical procedure used to select a maximum is satisfactory.
- 3. Simulation Technique:
The simulation technique follows logically from the analytical model selected. However, the development of the confidence limits for the simu-lation should not be taken as including all possible sources of bias or scatter. A more thorough discussion of possible biases is included in the main portion of this review. C. Development of Input Data: Review of older records can possibly improve the estimates of storm recur-rence rates. Cry, George W., " Tropical Cyclones of the North Atlantic Ocean," Weather Bureau Tech. Paper No. 55, U. S. Department of Commerce, Washington, D.C., 1965 [ A-6] covers storms from 1871 to 1963, for instance.
- 1. Sites and Coast Segments: The coast segments chosen describe the area well and will suffice for determining the risk of hurricane strength winds at the site.
7 C. Development of Input Date (Cont a nut:di
- 2. Occurrence Rates : The estimated tropical storm and hurricane recur-rence rates are consistent with other available sources of data. The PRA evidently treats all storms as full hurricanes in the rate estimation.
The occurrence rate for hurricanes indicated by ?RA Reference [43} is about 0.14/ year crossing the shore, which is much less than 0.253/ year assumed in the PRA. The short record for the area could be extended by search of the historical records, but the result is not likely to cause more than a 4 mph change in the estimates for the rarer probabilities. Use of the Bayesian rate estimates is not unconservative.
- 3. Coast Crossing Position: She data used is reasonable and agrees with the other sources.
- 4. Storm Heading: The data used is reasonable and agrees with other sources.
- 5. Translational Speed: The data used is reasonable and agrees with other sources.
- 6. Central Pressure and Radius of Maximum Winds: The probability distri-bution for the central pressure in the PRA appears reasonably conservative.
The joint distribution for the radius of maximum winds is also reasonable. The influence of any R-dp correlation is not of great significance to the results, but is treated in an appropriate manner. D. Hurricane Wind Risk at Indian Point: The large number of simulations made defines the computed results quite well, with sample size influences being reduced to a negligible level. Essentially, the uncertainty lies in the wind computation procedure and the input distributions. Because of the conservative choices for occur-rence rates, where tropical storms of less than hurricane strength are included, as well as the reasonable or conservative choices for other para-meters, the main potential for non-conservatism is in: 1) the windfield and maximum wind computations, and 2) the site direction-dependent boundary layer adjustments. APPENDIX C of the IpDSS These plots are associated with IV-C. They are discussed in the review of IV-C.
8 REFERENCES A-1. Simiu, Emil. Personal Communication, 3-18-80 A-2. Schwerdt, R. W., Ho, F. P., and Watkins, R. R.
" Meteorological Criteria for Standard Project Hurricane and Probable Maximum Windfields, Gulf and East Coasts of the United States. NOAA Tech. Report NWS 23," U. S. Dept.
] of Commerce, NOAA, Washington, D. C., Sept. 1979. I + A-3. Thom, H.C.S. " Distributions of Extreme Winds in the United States," J. of Struct. Div. ASCE, Paper 3191, 1960. A-4. Thom, H.C.S. "New Distributions of Extreme Winds in the United States," J. of Struct. Div. ASCE, Paper 6038, 1968. A-5. Russell, Larry R. " Probability Distributions of Hurricane Wind Speeds," Report to National Bureau of Standards Center for Building Technology, Houston, Texas. April, 1979 pp. 64-68 A-6. Cry, G. W. " Tropical Cyclones of the North Atlantic Ocean," Tech. Paper 55, Weather Bureau, U.'S. Dept. of Commerce, Washington, D. C., 1965. i i t t
. _ - - _ _ -- . . _ .._. . _ . . _- ~_ _
9 TABLE I ESTIMATED SITE BOUNDARY LAYER PROPERTIES BY DIRECTION - INDIAN POINT, NEW YORK
- where Power-Law Assumption: ,
Vo ho Vx = Wind Speed at Elevation x Vo = Gradient Wind Speed (at Elevation ho) ho = Elevation of Gradient Layer 0 6 x e h. Correction Factor = (Estimated 30-ft. Elev. Fastest Minute Wind)/ (Open Country 30-ft. Elev. Fastest Minute Wind) Direction n Ho Correction Factor NNE O.100 700 ft. 1.1864 NE 0.100 700 ft. 1.1864 ENE 0.190 1100 ft. 0.8200 E 0.222 1200 ft. 0.7161 ESE 0.222 1200 ft. 0.7161 SE 0.143 900 ft. 1.0000 SSE 0.100 700 ft. 1.1864 5 0.100 700 ft. 1.1864 SSW 0.143 900 ft. 1.0000 SW 0.150 1000 ft. 0.9607 WSW 0.222 1200 ft. 0.7161 W 0.333 1500 ft. 0.4413 WNW 0.333 1500 ft. 0.4413 NW 0.333 1500 ft. 0.4413 NNW 0.222 1200 ft. 0.7161 N 0.143 900 ft. 1.0000
- Developed by Larry Russel
E l3VEC.{ -
- Nio CIMhb - 7 f
- __ Renee 12 / s2. . _ .
~7 e & u m
9 of 9 p. t
~
d 1
- l. .
'. i i - i ,II l, I l i
- I i
A
- t. ', 1 ' I +
;- 1
' ; : !. i 4.. ' ! !. .i ',. l Yl1- l .' l'-l'.iI I,..'.! -
..,l.i. , ..g i. . . . : P. . . I r r q..d 2.L. ! ; . . p .._l!._
l e m;ill ICu S *- .A *" I"' by ' ' ' ' .. _
.l n g:.1 M.
!: [' * ; .c1 -1. __L_...__.;.-_.-_....._.__I f J .* l. [-
.::4u_i._:w _ _N} _ .i! c l . i : l. ! T +
. .d h . . . .s W .i _ ,'-.s' '
. :: : 1.
L
.Iol l1t...,.. j
, j l
=
. 3 ..( &,
' ' . i } f L;_ ! l I i .l !
l ;_ .. l 1 !r ,
.. ,i. .h. .%. s) . w.
,1 +
1 ! t i t I
. .q _.- -l _.. _.;. .. _ _ _ .
q .y . . . . l . ' . 7,.,..m... y . . . . . . . . . . ,. -.
, .7.. . . , ,
7 ,
.g..]la:q I ... l1:. .l' lJ- l -
- t-l 'i j. a! .: i-i __ _ _._..
3
- j. !. ' !
. ~
%- O ; :J ;' ip' - 1.i .
- . . l:;%y. am
;g ;: :r t:- ..: A- \\ bl.
l'l e l.
. :. - -m _J : 'i1
- ti . 'l .
i
! b .h. i -k. h C
].
. . f. .; .
.!{f . l. j
.g .....u -l . l. 2- .+ ,
a.: 6
.. + .. . ..l. ..
i ;
..{.........s l _ ... ._ . . _..- 4 . 7r.s _.. . : ..... ... y o
- c. ..a. ....o.. . m_.. g. . . i- i...q. ' .q . ! i x
. . . ..i.. .
. _.6 p. .. . .. , 6
.l.., l.( . .I. i a
;',.. .l:. l. ' ' .
.}.. '
. _l- '} ':, l '. i ! a "
[. :!!:':dd:. . ! , ' ". m N . i
- ( : ry,p- q -t- :j- { ,
j :h'; i #-Qs % 7, :[ h , {' ~- -
,9, :- - " !'9 ----j-i_ f i I- 2-i p... iu .,d) s ~ * ~ ~ ~ - , .
.l4 .;_-l! .
c . .
,l:' :l l
[. l.'{ fi!. l
.!. I i.
I' .i 0
- ' i
! . L ::: -
! t i .
_ _ _ _ .: p
.I . ' .j.l.l. i ', . l -.
'{. .{ " .1t l- l 3{-.,
l- ; i. {
- r! - '
a' o N lr
- - ~
- .1 - ^
e oo l , . '(- -f_,4 ,
, 4 "'
_lhll:~ _;a .___, fl _, .!. l' ,. ;l. _ __.,.:_._. .! ! l
. ._..__. l.. _ _ _ _ _ . .9_ .a. .
i N _ _[ . i ( i ', j . l .J l' " i N. l . l. I i
]1 :..;
' l .! I
, , 6.-l .
l 1 l, - - - - - -
- ~
, , l - 4 2
.x -
}'li i-
.g,,',..l.
.'-i , i; i :'.
..I- ..;
t i: . -l -' j ' ,j . '; l O ; o g i 1
. 3 , , 1 - .
1 ' ' I'l. [; I ,l i' l !, l !, .. } .} l l4 , i
,o
' li . ;.l ._- ol I j- ' ' ' ' ' ;
. _ _ . _ _ _ 3,
{.6 i .,i. j. .. .i..
, q l i i !
\..___.-- _.li. ]_ 4 i. l 6
.a g , i. 1 ;
I . t s
.ma as 0 ,. _1I.. .! . .
1
.1. -
I. ! I _ . . .e u i'.; _ l- f-I T ? I !
'I
, . l i i I r
a w i i i.
.l. ,
~
'.. b O [n . ..
l._;..;' ' *
)C. - l
.I 1. e 0 -n - .;i, l . . , .it, . . _ . , j . !' ! 4 3
1i ga i. L p r$a I
; - l i
l t t- ._ a; J _ L. , . . i 6 i J. - ._ .. ; . _ _ . . . _ _ . _ . j
- W"j ce 1i;
_m : ' cy.
~ m co t E %E .(g $2 g.
; I
~.....i_._.._.!7 .
-l l~ - ._.
l
.._.4 r--
i
}- ll1 m - [ _1 .1' ,i ; ,_i..
M' t ; e
, d 4
.- . i.'.. ._i. -.'
. ~
l .
- 7. . . '.
L .. I o x ,3-y n [- k, l l
. l t-["';,-
.: J cc
. .. Ij . ! -] .j.....i l i I
[ . l. .> p g Hg. [' ,
.. . e . . > _ . .. .
e: :; , I i , . I # ;
.i
<g e ;,
,_. 9 4.._ _
+-. - - . _ __v._..._. _
..___7-_ o
' I . -
, I aa ..
i ,. ,
._.+..
! , : , t t q
; j.- f i . . i ..J .. . . _ , , ,
> *i :I l ! ! t i
- 1; ' ; ; o i .1 .
; l ...
i i
, i
' 7
_j , l -l I l 1 1 < l ! i l 1- 1 i I
' "P
' ~ ~
C Oi- ~a - c 0 i1 3 l- . m N N .-e e.
li vre.12 0 h dian k t 1 R A _ / U h.~_ 7M 82 9 Ao b !!$ I I &h. i m .,,.. !" bl! IIf IlII !. k[ . I t ' 1.f.[:j[ .E 1 l ..
, .j, .'.
1.11 .4 ! ' :O! ; ilk
- l,aj. -a ~
ha}; e 4{ A* i a .,
. b.
- LL - k '.l... . . !. o
.g{- :.. "";.p.Q
*'~_ m
... i!
-H t: - --
- '- ':L:1 . w .._' :_t-
. c at4: +
- ~.1 ,
@ im fg , . .r: r 1 [1. +
f; {b!! (Ll.Lh @ 'lji
!Ol. I' '
- L. ~.p~w!!i .LLj. .j_. . _ I't g.- .l..
. 4 - +
t - a . _' _.Li .i!t *
.k. m
- i. + 7' 6 -
j. i!!I i '
,; - l!3
't . ! I ..egf '.;! }'. 4l!.t }1,. l- .l.
, , .,y' _l. $
s. 4... l' eh _ 'l!
- T-i. p-h.
P
.j -1 - ,- "" ~'--*-
}
M;+ 7T :.7
~ ^ - - -
.. 7.h. ' '
.l" ;] ? ;.
6 '
,i.
l q[
;j -
- - * " .~ ,
...m.,. . . . . ; : m.. . .... r . . . . . .... 4 .... . . . . . ...,
o T lI;It ! t *bb N
'l YU tp!h lj i l l'll Q .We S
't I
ll
,;1 :~~ l:
. !$:i ! .b +- ' ' k ' f =. -[' fi: m g, } lt m]c tr F l M 't-W.[4 t; !l l Jl - ll-l , ;
I,
" j~ ' {" ' l-
. ,i g, l . -
$. , te.,hl ' } },. {ll ,+-+], r s . , '; ' m '
+, + 't i' JT g
. , - r.
~.n_ p. g. -
a
.. r. 1 . i.i :-
", " q.--
. . . _ . _. _.r. . .o , o a
i..1 it.. p. . t J. , ,1,
;i lt-l :- ...,_1. L .
.4 ... . g ......} ..k;
. 4._.
.L L -. . - i 4.l
.. ; . .m _t . ..t. .!
..}.. ,t J . i .1.i
11 6.. 7..,. . 'i gg
- 4dg : !,m i , b.; ad. n : ..-
.t.. i.
.ic 6 m. g
. .h. .1 n :.L M .. 4i !.: 1! ' .r a c-O
- i
!T!,' w yn j f.. . . '
-r ; i-*. ' ' ,j.: .
..T .!E .
i;h l...
;:l.},.
-t..:
*j. ..l !
, )
.n --
y --+ ,. i i _. _ .f . . i i n,i -1
,. \
. m 1
i m --: .- ;.7
>m i.
._! _ _ , r.
m - 1 h T : .l i . ; i 1 .i' j.i .: 1 4! .. t :i '
! ? ' .- :.U.
' -- . op E, l l:
g a , k.. .. l. -
~1, ' . l .
. .* p l o
.;. TJ
,- 7.
qg y %
.. : e :
'.- .4..- er r NW% 1.? 7 k; E,. .l. ' .; d .
^ ~ '
*N.p-
-b o
c. sy ..
.i.. .l.
n s-4 e, pc A k.- * .l. i !
... , .T .
._ L._ _ . O.r.c;
.I
!g =y i 1HF ' , d ' M. :
i' 1
-l hA d
'* h4 .
O
.i..
Hb
.I, ,...
i M j .
- v. ' . J. 6 . 6 I '
.p. *
. 7, F>
I.i- l.. , 2
. . l. ,f* . -l .
4O [ '
-'" '7 '.
. _pl, I '
p_ ,,,_ _. , , , _ , , _ . _ _ _ q o
.i ,e,y .s -e . .
__ ..t ...,i. -r - --
--- rti - - - I - - -- - - - - - . . !
- I.Q Q e i - '
,I E --.t- I- -!-
i
! i I- .i*-
~ H Ed
. W. m g 9 E .m .s - '(^.l l .: -! l- l l a 1 F. i W th l- 'g i OM l
I O. M d gd i l
' I H >
t t- 1 i ) w o.
.. C Q ] . ..
, i._. 7 . . . R__ . i L __.._M .l . .
l .. ..s_ . .. o
'$5 Ja f'% l- l . Il i '
I~
$a jH l'
~ a. 4' 2 *nu M '
. i
' l, -
Uu w --4,- l?
- - - - - - - ei
..^ d y i i
{ M i k g* _k .a e J.g -
-g. .-j,-
_i._ i I 1 ,. I
. --- m'. . . . . . . .
v *g I - a M g N. . l
.. --..'.- -~ ,.'. @
, t .. L .. .,..
. .p _ .
l Qn
.' C -3 G h I- .'-. , 4, ,j f*.- e.t .,
. Oe O=
i w i
.I .1 .i.. t-P=
g h .O m % g ,
-_.9.. .,
4 i
. _ s. .. - . . . . .
.!l
. Li .i ., .
1 4.. i. en M Sq ,.
- g. r .i .
- 4. p ,, [-
4 ..i I ei .- t i .a { * . . I o
, L ..f . . - . . . . . ~ -
' y "O"=
-. L. NL =-
.. 3 2 9G
+. ._ -
> > 4 1,. . . 3-i.
p i
- . .I ...
. l .- n. ,
1
, O
' l!ltillll i l l l 1 ! ' .,
- l;i l, .
' l t ,
i IIl i !! e - I i i. I i l : ' g
-; O O OOO C O O O O .
O u*' O O -- *
,O rn N on m O O x t' : s." -~
m te e= en
,, n , ,,, ,,,, ,,,, ,,,, ,,u 1810-8 , , , , , , , , ,
Hurricane I I I I I E (Fastestf1ile) g j l _ I : ! -
- I I 7
1 s 10 I I I l I I - I I _ s a. _ I I 1 10-6 I
- I n N
l I _ r, - t i
- c. _
I r = 1x10-5
- 5,
!2
/ 87
.j-%ncet$ i _
a . Estimate. _ j f o ; E8 yam d E :
,f ,f ./f, I/
- / - AnaYsisko y && =
E 3,39-4 ;
* / J 0
E I _ w v l I ' i - g f 1 l'
/
- . /
n FJ . l 5 1:10-3
- 3l, ,
l .'l .: / , I %ssell's Best Estimate, I
! I c l ! $ ,I #
ll j F 4 / I .
-e f-/ _
i; 1 :10 ) ' '
' i f -
- ,d.'
j- , -
- f ;: -
,,,, ,,,, ,,,, n,,
j ,jo-1 3 eC 9,' , , , , ,,,,,,,,e , , n nin 50 70 100 150 200 250 300 400 Windspeed (mph) Figure 3. Hurricane Wincsceed Exceedance Probabilities at 33 ft. Elevation
figa 4 : G=Perissa of blwi*a._ . _ _ . __ _
/ 17
%ults ,
y t v U t,, 89 f2 W 1 *U c,a
} >v P b a I l l II lc , ', V j, E ka g.
ltp j- .Ie .o ai
' i! I i j- ~ S'
',1 t. ,i 0 . I i
t r}p.}
~ --
', ..t. _** .. i.
i_.
!m r
9a -,
.. .m .
- p. .,4 y9 .
. . - . ' .7. L.t. r 3 . m..
" ;..t._#_ .
IF jy! -M MV\\ QF 7M:W ii!! ;jy ,y pm
=
- 2, ; -T @ Jpi, $ i Qi - : g
~.__pi p. Mh
.q.t ',g q @ :iu LLLt u _.1_.
. .j. ;L : 1.
mm_ 4 m
.g. p [
Iq _.__h 1 :i . ,y i,it ' t i '_ .u1L
! 1 ... ._ ._
?
u,. ]I1 < .; g a m_ L,
.. .i, ~ ... ,.
^ ^3
. -i .;. .:: .1.,
l L",-'-'. hp( k, h ~ Y'
, p.t, i ' .,t f. c. ' t. - J t.'-
@e W. . ;I 1 +r t
. 4,.
T'.::q o i .: ' {. ' ' _
.i . . .
- 0! qk:- 1,
,at-f ._ -
1jit.;;-. t:r ct -M y.. !:1
. 't-~-Tir':!.Q
;!r! N. Tft::'" :+
.. . J .:.M::: :::t it'j ttttrtti -
"* ltt
- ttti ith, t tt '. _ i_ L.1- " * *"
+
'lt t.! .h; C U. ; * * +-
- t. *-
e_c
.__h. '. I ,.4.!;h hh ]f. -
.h ' ' ' '
l_ 4.p _-.;.. .q. .' ;I I ! 4 .g' .' y M 4 . t..t-
- h. __ . .
I*.' Q'.g.p.;;. ggg :
, y- __
. ..; p.p , 'g" i
*,p- - . +.-.r-,-.
i- : ; :
.p.;. ; .47 .%...
& y
} t
,.. g t 4- . .
; jm 4,
.41 a +44;g .i
..y h, . . -L . . . ... .t. g 1
w .. ..{
.a N
a g . I. .. m, u ... l... a. q@p.4-
.i 1 1. .. $ ..
. . l. .
4 . i . $. g i [I U .~C . 7: If. N '.}!I._ x k (dIIi!.IAII _q!'I:7I ._
, l'. _11 -- ' '
I' d'" "j.]
'.j i'~ i" o D. !
w
- r .r e
>I:u t. r! t. 4 ::~x .d :t.. ', * -- Dr ti.: U::.
,4-
..: i:i! :r utn -
- t! r.
4r-g I?:! 1-' -
.:I- ;-
't 1. -. . l . 8
*[{j
~~-*
[f f*'{. . II - ( m E ., . t ~
/
. .. h[
3l-f~' ..^ n m U*' ?, I I_ '
-.l^ .' I' ! J
.c' . M 3jt.{T j e4 M: .! . . ; , :. l :' .I- oE
% . , . . . . . . . .N g g' * -
t- <ti O . '"*i .. :^.' :: : ;^ O m C.' - . . '..
. '. i.;l
. . ::1'
.. y%_ _1 Z ..[.;.},., ...{ f ' l *:. 'l- , . O o
g i -
,p.
. .};,, , 7 - *-q .) .' _ j o.
, I.,
o
; .: 1.' M >
^
, . l ,'
14 . :.1 ' . ,! h; -. j .' !. . u q; . . . . e o p E 4
' j. , y 4 o e e . !' -
. L.: :.: ...i, . t. .
...} .
t. i g
'* l8a O
- l. ..._.. .._- .
, o
.,s. f^
. . . . ..i
;, K
'2 o
. I' 4.
'I .
i ']' .l.. [ io. i a+ i i i' Tj 7 b - -
.. . _ . L._ _..; .
- m o wg .o. .i.. ..r. .. .
a.
}N i ...
; g.
a l'
- 4. . ...l--- O }l gg = ..a..
.7 i . i.
. 1, .
[
.'gg ag ' '
.f
'y( n.
L ; .,
.} _.- h.. .4.~
. g .. .
y .i. _ . 7 .
#W *"* n g t L F
[ m t: -
,- tl 'I ,Q I.f y __
l . I W ' _. ._ _ L -
...___.f__._. Ll .,
e$ -f w
- d
]"$
- l i
I' h-l g , M I' '
~! ! m
.O u .,. - . _ . . - + ..g..
,.. ... j.e.. .
. . i -.
o C1 . .;. ,. I, y
}
00 .~I
, .,.t g.
. ' 7' .. ; . i . o
). il l ;
N y 9
-e+
g 94 M
. e i
.+.. ...' .. . - ..%__.
ie _...4 i .. l
,i .i4_L
. *i t2 ga j 9 <- 6 e',. o
, x +!
81 ao s. e i tj/ ' r ' '
.l .
- . o
._4. .:. . _ _ .___p._.....o > a 4 :: ! ! , .__. %.- . .I . . ... .
g
!dlll!I ll'ill1 l l l
.a
~1 i
i 1 1 l*
.4
'lI . i fI t i
. n -a o
O u' O to O :* I r .- *^ - -
-i m N N ea -*
-o M F__l.3ure 5..__:_E_ en E.sthew br_e_c_ti_me_l Distributions Or Nurr1Icant Winds
! Y . db $
b_
! !ll ll I. 1 l! $
d .d l } A C hl! 'lf! M fji'I f _ .-. M
;$ h'l pf ..l ~
'. J.; J . al i 1jjjtL g:_?.
..L '.. .a.
u!; - Ria.;L !T.b[1:.I lL 1. bo li.. I t. *
^ m f. !' t. '" @ -'
* ; +' - ~' tyL !" -t + +-
- z y " " - -
lut. :)L{ r et t t J -*- ~ g .lij i!y @^ ++ ^ ti--@ _
.\L $ 7.' " y: ' ifi Eki $ L ,
QE ':% 7li l ': ' ] J [e yJ .UIL_LL LL. m q.;!l! '2 : Ji-Q f. \l. :
- 4. .4 14i ..; j i i; j L O_b . 3. K .L _l. u. .. L'
-1 3!II $
!!; U , t. II !
\ UI- I'l lII' d I l ~
' 'I
..j I -' i : ! _ t. _ .
.o
..u ...
. !i.
U[d
.i . q_' '.. .
iN. p
-._. i . - , 1!,: I: 4' I b...
t.L'._L-il . -
.c .il -3 l- .._
_ _ -. . .g Q $ i ,i ~ {Qi T. I(h 'li'; $ :g. Gli , i*
+
l -l "
,': ::. - ;:t ::--l ;-tmdin ph~N:.- _ . As;n . * : .. :y:. upb-t h-a :; ':n m.; .. t;; 'm ,.. .:2 r t' rht u t:: : &t _ ~
- 1. ..].. : '~ --
o y; " tt t r. -.- ...-- . . . .
*g
..r sN .:.N'N
.1i, m. :.6 ll. i. !: .' .i. [M i
j o . . ml i lm I I hi o .., a.
>l lii q;ij
- !I .'L i L3N 'l.. ... . a i .
y - _._ _ .
.... .a ..
.g! I m ,.p 7 79, 7
-4 ..'. g. k., .N. . $.g- J l: 1. .!
._ .:..J. . .q. 41 . : .- .. .1.'.;
) ! 'i 'W l :.}.l. ,m yg l1 LL a. . -
.'7,.
. - . . g
;..3,_k . i . . .a _ ._
wdm,' ;
.;,- q. ..a - .4 .J... . . ..
i.
...I.....,
., }e
.t.. 4.j . l ,4 * .. .
5 1 o, 1.. .J .
,6
. n ;.. p.
.v o.a..
. . p.
LJ .a-w
.l....:. . ....aN.o 3 +-1. _.t. r_ ..,..t...i. .. l . o ,,
. .i ,. 6 5 u.. Q. %%.w. i .L_4_ .. a ....l. . ..
.. ! g. . . . g. .
j. y : %tw:.- r: ': Ng : c .- I -tr
.t. '
"b w
.E: .::
..t 5
~n -
1 _.-L_,;
. J.
M ..
. _ . . . -5%g %
'^ O
.h' "T-~_,. .
W"'w-c "
; ) . ,
r1- ' ' - *
~
' ' . i. . ,' r.
TI , m 5
~
W w .h .a .. 2 i- :1 ; , o
. . . .1#-
i .
# oo . .. .
. .. -. I *.
g t* T ::. ;;; ... : J..b. : $- :::
. . f...].. . : 4. .
. T. . .-
- - f m.- .._.
. . ..].~-
g ;:;, c --
.1 .
c z.g' l.
;. ., y x.. ,; ., ,
D I- -e i.- , g
. i
.l .
, o a in p y .... .. . . . . . . . .
.. .g '*
.i l w
3
. '.g:. .g .
.,' -t y
i
- - -{- t- os
- g. g 7 4 o ad a,J l---
!$ .[g . ..f5 i f[l $' : .
'li l' b-[
. .] m y w -44 o
., 4... .i... .!L l_
..a..
.I
.l. l.. . 4 .
t,y
.g.
y 3 .J .-. a. o _y J ..i ; t. . 4 5 . g rI t 1 m.e L. .i. .. ~ I:,. 4,
,! '_.. t' " .
* [. _ _'. . ,i_.... 'T d. ..:. m
)O .j _ .._ -.._ .. _- _ .
.. q
+
. o. y,
.',4. '
.y nm dd a, j ' :.
1
~l i
'3 TI 1' ,'
l.
.- . .se. a ,
.l :.r,. . i >
y>
. _ . ... ,m +.
[. _ . . .i .. . ..
. .. . ; _.u _w_ . ,. . .s. .
.. n Q a - . . . .
J
.an .A r- ,
i
- i ,
. . ;. i i
.l
.i .
$2 gn d= ' I f
^
l,i
- l. ' ' l'm_. _ . _ _ _ _ _ .
1_L ! . . ,
- c. a.x y4 eF i .. I es d
=k .'.Hsg i ,
-d l l
{w ] p' . , .g } . . ~
,ii h- -- - : +._
a, u ~c m _ .. _ _ l _. _ l p.. _, _!_ 1. _ - . i . ._ . _ ._ .._ . e. o a. oa c, .
- i. a.
- s
. .. i. ; !
.l :.I .. .
00 .a { Q) w
,l l l f* $
E I a ,
$J p gg
*A s.6
- - .. .+
i
.w_-. <
l
- 3
.s ,
t
..g..-
..p._._.n.
; - O gp C1 j
! -+- d k[
h% aa m 3
- t_. -
_ ~
. _q _ _ _!_
. o O
C . .
> 3 .
[ ! .
, 6 .
4 i . . d c , 4 . l,. ' ' I 1 l 'l l l l4 i I i l I l i l .I I t ! l O e C ; .' : ~ rl _C O O C C :.: O. . O. 3 O. O. . ,Q C. O. . o e a c _ e N a r. _ - - _ ._ ___ , __1
_npure._6_: &__s_t_Es_ tim. ate bim. tional _ _. ___ ./ I .- Distrilweiens Gr Hursmne Wre.6 / 1 l M, ,,, N u 3 . _
. }J 'd l dL $
Ul! % .[ ; L[.yL L d-l> .nl u!i ii! L J J 'r! {. i_- ,. d. _[... .L
- S .E g
4,y h{i, ,g t;
. + pe
_3. j.
!:- m J i' ' ' 'gt.,.y i _ L-4_ _
=gn,.37,,7(g
. . A. aLle. 1 Il!
d
;3
!. e yp pH :: q-y'
- 4; Qi 7:
=
yk ~4 4s - , - 7 : p. 3r . g L.. tuu .. u .a
.L
; ,[_.._. u 4..
_.4.._ .g g : h
! .L L . p.
.u= : u u. _L Ult
!U; :d. ,N i
=.
uti .. 'Im.' . '. .I.
..p
- i; ::- .itt u. .L .. .2 s !
'..,...;c. ;; ifLL 1.
L t .1. 8 vq y .. ; . 9. . T*tm; i4 }. . . .. iy L' '- '
; t'~' l' - ?' M s .
. I.
--*r' I '
-t ttt:
- t. ' r.
- w. l- * - ' >- -
?. 1' . - ' -
- t. - t
- ti !!; : .'.
- U 'j., .?.. he ' ."'^ 3
!!* ;* l' ! t '!ti!. * -1 i1'. Pi -1 :U . 1:: "
i h' c. ". lMl!.;;
%N.. ;; *,, *M d '
.1I'-
"i d:
(; ..
. ,rt
~.* A i
i:o (
.b
<ff., f= ,k. ---_--_--.: x Il
.L . k. .' i
...,I ',
$3 N4p. b.p ..l -Lj.,.
[y.ln\... . - - --kla
^
.g } g,i .f jl t, 3 i
J4_ L..
. i Ll 1,.
ii
.,. . .N .
.[. . .p. .
4
,i,.,_-
l. o, i . m.ut-m e .u.
.. .. ,M 1i ... a...p...
a Ta .m m... - o
..j . u sin flia 44 ,i . +, 4 , 4.. :a.: a. .m. 4. ...u ._. . . .... - -- w-
. d. . .i 1. ' ._._.a. .
.... 4. 1_..
i .~ .
.w ,. 4:
..{ . 6 .
- a. .. a a r . 4 +- m aq. _g . . . . . - , .
- 4. p,a. ,.4
_ . _ C y
.. p. 3 .. q 9 4
i -.p i s. .2
.. i A
6
.t. ..'
.- .'...- . . P, . ' '
o ffkf !'*! f ~h .' q i[L ..a ,
. .- . 1 .
6
; ;, .a_ .'____.. .A.;
. ...1 l.h.
..;.j .
k* _' .; - - t '
.4 ; ._ L . __ _.
ie r 1 ". 1' .! $ o $ i
.p. e _
.ej, l- r .. . . . r .
,[., p +. t
[ .- 4 g l 1 g 6. . .. .. .6 . _.6.. l ., . ., , o g3 b #
~
I_ T .l .' : .
** i. +'
. } .'
4 .
.i u g ':.J '
l L' e6
' y'. ; -l; ,
..L- ; M1 '
- c l i' ^I.. i '!' ; .
+ * ' - + ~..
4
, . ;" o, !"3 2,g
..f:'
,'l
.'. j :,.
i
'. ' .j .- .
- f ;. .
C o g
,:g M
;. .t..
3 . ' :,:.
'o i t'=
y O e j' '
- -l *
'Tf::..l~, E r:
"$7; 1..' C Lf,.'; *l:
l: .i l i 4 odF 7 E ' i
...g
- ' .g . . ". j . . ^
i . M O j .'". 6' -I' l' ' l .'..
-8
- e. l y 4
g Q f!-
..; '_... O,
,{ ... . " .
.a .! !
l {. .; . ; , '
...g I: , ,.
-w --
- l: l. 5 ,: tF m 3#3 ap n. .
.i 1
-l t. ._
o u
- i[; .-
*g-' ;,,
'I
* */.1 U) C. l, .
l' l i O E
"{ i, w
c
%..._g..., .9 . ..b.. .-_. . a_ i
. 4-_. l. ..g J . . 4
, S' T .Mf pd ' [l I [' ' s'l', ! ;
r. QM -l , , gj'J { . p144 vz 1i
- dr-l'E' w *!a O 7 "U '
e: - Y; { I i r I q
*.*.bL y . .- ._ . _4 .... . . . ,
..o.
l
--e__
s .
.r 1
_.4....i.,. ,
. . . . . ..- ._. . "i g a .
C 'J ia 4 .*a
- e. . . . . _ =
Ww 4e M I t CO
-ea l. .
i
.l. .l.
3
.el l* . . 4 .
i
).
^l 1. ' -l * !
6 1 O
...t..
ng 4 j y gg 4 e .. _ i
. .[ p & w!..
6.
..'4 .
4..... . .
- . . ..l. ..a,_, ._[ 4 .i e.1
}
j d,y ao y# ( a:
! _.1. -- -- .-. __
-j.
}. o 1-a i. _.. _
i
- 4. .
_ .._.___ _ .__. - ._.. . . . __. _c.t i_.. . . . _.._. _ __ e
> 3 , i t ..
.t. o.
g 6 .
\ ..
! i > a ! ,6lll! ' l'If lIl!I 1
' .}.i l l
'l
.' l!l. . I 9. . >
, = -
! I e 7
O C O O OOO C C C C Q C O + O O O O O F I I ~
'~ r' .- ~
.. O e n m .4
l 1
/ %
figure 7 : he Emmate biredienal Distributions Or NDrricane Winds 3 w I I 2 o 1 ? M " l j(
'..!l[
i _
~ i. - I '. < ~.
k[j f**[ ii l .j , i, ;)
! t *
[, IL
.!l Ilri 6 L . l'l- .4 . 1I1 J, 1.. '
.l.. ...I..
eh}; wr i' I ,I ! L. . . t. [ .. . b ..g.
. ..h-Aj . -. a .- .i.J._.. .
m e m . .a e. .r... .... .... ,
... ...g
.f. . 7 ,'
..>. ...a
.,. . .... T. . e
- {- g g... p- 6-
. {t; ;i!- ; -g : . .} - , .
-( :{-..
;.' i k'
' . . + m_.h .
- l. I
_f.hI ;. . !,;. ; };j l I .
.h1 .
' ,d L.;I .. . ' ...1 .
.l
[$ 2 e!. i!!i! ij . ... j '
.h. . . .
..;.j ..'..k,W..',7 ii !i p.
l..
- 1. !'i!i 5 i.LL 11 l ,.
1.11 ..._l f .j . l. m...f_f.. \ '
'1 .'! I l..
.-l .
.Al 3. 3 -,- . .ll'. !! jl, .d. l l
ww
.i
--n -
i lj i . m
.'l 4.1 r. -
. _ . - - r k' > ' $, . $
' 'n, 4 '
- t;r ; ;-t p
.1 32m .
1: . --.4-2
..! N g t +t kN @' * - !i;b -- -N 4~ h --
*Iii ,M tN
'. '_M' . ' -l., *l=t:
!J*1 j'I -
. 4 -+- -
i
? j," g+- w, * ?*h t t-4 6-
,tt t
-m- [. - ,-
-. ___.,w--
l , , t e e
!,I
--I t
'.i. '. I
{ ll.' . k). I ' ll .t.. . .a . I
.l.. ..4 Ii
'. n I j.1} i m
' I I. ..l..'
,, 3ga i..
l !'{I. ' 4 . '{}d; '6 ,fl1, ;4 _ .. ._ .. .. . ..
.lf . . r._
m
.-.j - ..j .. ,.
] *l[l liya} l!l l ...a~
{ [!_!. .~~"7 y.p-Q t .- -. L.m. g 4.._
- o
; .' , . .. j ..
1.; . .;.., ..l.. ..j.. ., . . 4 {. g
, 4. i . 9414._ ..,i.i.,'
. . l ..i... ...{..; 4 aa
; p. . . 4._ g
, .46. .v.. . s . 9{ ..l.. .l.
.4
.}... .,.9.... m. .
.4.L_
.... ...!,. ;g.
.i.. .
o ,g
.g, .. ,... +
,...i .
_y. L _. p. . . .-. i { ..
. .. . ....i. . .. .. .
- t. .
- y: 'n i' '
- t r
-I j-.
_. , .. _ .l- -. . - [. .
. . ' h.. _ ._. 4 .
W
.I ! i j _q{...
I o 9 7
.,, . g, ., .. , , , ~.. . ,
' l7 '
..!. i ..-l 0 0 I eJ ./ l ' : 1. ' , .
L- r- 2 e oc , , , . . . . _ . ,. ; : : 1 i 1
& o- '
.t,
.].... t. :* * '
.)- '
O o
. m -+ 1 l. : - i- -
x
=
E l .-
}
.l o h1 . l.. .f. I. t-2 .
o a 51 : 1 -. ' t " >'* t M I ; l- 'l ..l- -
- I O g
* +
- c:
.o y
- e s
e
!. r
.'{,. .
{
.. .L
, ~
, I o
r s g
*W g o j F
l$ qj .Ii ! !. i. f: [ . .! ' .!
- - - - - - o,
- i 1s .t fas i , 6 !
,eat-
.. L . ..
l . . . _ . .. .i.
- t a 1
3 .G. 't
- o
. + -
(. aw -e gn ,
~
;b') 2"c::: i .l ;i. l.t- .. . . , ! ,
, d i ; ~'l.- o r i z
... 3 w
' .4. _ ... _ L ... .] 1 . . L . . a 1 ',
. .I. . .'L . , {
.. O @ yA . ... ._
'.r
,w~ - ,J l' l
>n A l' r~. , ! l .
,. ., i i n w e y, u i' i'
r ? c t-N d- . l .__._ ! I d-__ _ . . , Sk .b ; lt ., l . b df fp
-w ..
l
.l . .. q. .
l{ i. ,
.i,..
li . . . . 9 -. l- t g Po i 85 a ' L, .i. . 1. : : i. _ . ,_ 1 .l : i y w
- :n a
m . _ _ . p... ..Iai '. - c h. ee g *; - t- I
! __ q-]- i p ,t_ _ ' . ,
}
, 4 . ;- i I. l .l. ..
e c3 q
.J a
-J C i z . tt . *
>3 I .. h' ...
- l. l, I. i. _
g l , ,, . .. i m. 1 i. . l'l:! 'l t i , i l I l ! !l , I l I i ii . I i i l- i ; c o e o e oroc c o' o o c c . i - o e o e oe r- - b & &
.Fi ure 5 : Best. EstwateDirectional . . - . -.
/ / .
g Distrikotions Mr Hurricane Wind:
- 3 2
i hV 4? Wi. s y . L d'. jkg{. W e 4.,4 : 21 e h!.
--.-}j.. . t.;..p.. yi }. .: /
[!j4..
, I!
Qf.L_ O 4 .. I . j ,9 f , 6. .f i - ., 1 - . - ... l ' : I I e, , p..,. 4.h. .
,f t [.
4 ..... . 4. .q 49, _
. ,4 j -. - .,- .. b .e .
.4* ...
lljl ;;ij [ MTK %. 1; $ tEMQ m: pg -
- rt+ -t-p. .. ..
4 :' t ..p n l E. .
'ih i ,. . ~ . [
. k f- -._ . . .. 95 V Ui f.;'f Ikj! il k k .? k .- . - 4 .. ; ... .'. I.! '! !5 k f.l Q m
.< .4 .t :m-- e e- *- O.
*-.-+-4----t - * ':
-++
Il }
". . ,,.}y. . . _ ed b .':; '
. !O I! .I lI .i ! ! L :d I T. . .In .. I.: .' :l;.
.i* '! ' ,l j l 1. L .$
..i f
.h. . . .
.9 . . .. I 'n. ^
l jI 44 ,.,_' i s I .
. M 6 W.
--] -
~
!t. --pMtt
'.* m '. .. . ~ . . fyt- ~~-I-~~
!.4[ }
t ., .
. t. : t. . . ff,. ,.
k..' :: ; -. . . . I.
'... [. ' '. -"" "
. 7.
j .. 'lh. 7
..,.. . . [ ".
I. - @ fh - bl 5' !! .$ -h -'h L;;a : -:j:,j ..N!!' !b* . i '
.[n. . [} . 41 ;; } .
. __._- .. _. . ,_ . .. s N I i, .
.' m i ! - '
. , ..,"'1
.4. y. _4._ gl.e
.g . , .. i
. et , {.
g ;, + .,..: 1 ,.e. l.i.l [. I
.' .s . .. . 4., 1.= y . -
.gj w Q. qI . y ,,
p 1 o
..?.'.9.s...-
y ,,. isi L N m a. p] 6+
. 2..........
.. u ...
.a
. . . o m.44 p.
,. 1} l a . p.a .. %%
s
. . 5 ..
m. s i s .I a e s { gy, w {J:
- M J;T fp-- : !: 2. :..: C4. ' "*i ti:* k.di..tib C 1
_. . _ . . . . . . . ... . 1*0 $ e l . p! q: . e
..q '. t. I!1 zt t -
a y: 't . x.. r; v ?":q? -' ": x : I. ,. n
. b. ..l.
1 L - ,
.._. 1' l . l:'d , d; .
[;'
' " ^ '
.~
- ii !t .j ; : .
i y
. [. ; j o
.,.. , ,. .,7 g *
.:[
..'*;fN... .::p:f: ' ! .~ .:{::.i.; .
; . *e ::t .- c:t1 r*: .: r.. +t;. ...m.'r:r.: . s- -
- 1 i- - -
j g C br.i::: m
~
f *
- ]::.
- 1. ~ '* t ! !* -
"n ::d*;::- ?'
. . . '.'q:T
'.r :tt :d
; ; i* -*: ..' ' i:
- o O r,
...g.
..y
; .e .. g. .
3, w 3 .g ; g,
], D, , L ' ,', [ ~ b. .: t g..
. .: t :. .. $- * +
. .: r t '
a l I ;:':;;.:: ;. {.a ::!:: r :: '.
- N m -9. _ :L .j 4
. .2 ' " -
;$. ..... Tt . :d: '.:..' . t " ! oy 5
; a. 3 . . -'t; 3.r ;;; :7;' . c+ ; *
!;7' ;:1.. ..p. 7
.. ). j .
lo g, g Eft " at:1 .;I J! M' M" '
'I' : ? 4 ...~~
1U T.: '.m.
. o
....H.
i o m r d'T
- i. k. t
..} .i
.{
=* .I.
*Z a I.*.
e eo g 's. s
. '. is
... t
, i V.
;- U.
1w e o ip og 3 . ..I.i. 'l- 1..
;. , g p
ei e n .3 gE ... . t i
. c3 Q b '
t -l.. .e) 1. .'. . .l t *
.,._.-..L '
.! 0; M lat la2 ~* fr ;.lh up. . . .
fl' . f:
+ a.
.gg ,3_ ,.. . j. -. ..:
.i .
O il
.g d Z en f..
QO
.'I.'.-..~... k'. D.
i
} ,
2 pd aa 4 . _;.._-. ;
. . . . . ' .~
h h.$ e
.4.s- i . , '
-2 -
l , i j i , i 4 r [;)s s. j~% g '.x w
-iJ l
i I .&. i ,
}
j i i
._h.. 6 {
jc .
.[ t
{ [ '.a) g U. L
$ [
~1 . . .
...6_'.
j i
~. C.
m... .. .: ~. ..2.... o, W g
,, g
[ g
'q*
,i l;. '
. , - l . ..
,4 o
,*: "' l - , ,f
, ,a
. + . . . . ...
l J '_,_. .g . .. (
.j.
y g eg 6 , l.. , ..,. _ . . . _ . ..i . . . a ou - i- ? i . L 1 . '
- O
- b. Q I oe
.4 O :D N .
i i a f-l 1 .!.. . 1. .. I C O
. l.. . ,I
>3 ...l.'.. .
... .;. C .
.5 N,i
. }' :. .
.l . . f ..,.
.g.. ..h . q 3. . i. '
i il!- IfI .tIhlI l
. 4 !
. Ll l l. lt l l. I i'I '
ll l *-* C > O O O O 00O O O O O O G o c c O O O O O&m b 2 i.' ~ - r 4
-s s G e N *a e.e va
- 1. REPORT NUMBER (Asssenedbv DOCl NRC toRu 335 u.s. NUCLEAR Recut 4 Tony couuissio" o,,,, NUREG/CR-2934 BIBLIOGRAPHIC DATA SHEET SAND 82-2929 4 Tn TLE AND SUBTSTLE LAdd Voturne No. of appecornere) 2. llenve blanki Review and Evaluation of the Indian Point Probabilistic Safety Study _i ReclPIENT'S ACCESSION NO.
i Auf soRiSi G. J. Kolb, D. L. Berry, R. G. Easterling, et al. 5. DATE REPORT COMPLETED J . W. Reed, M W McCann/JRBAI U. M. Kunsman/SAI SNL Te'c' ember I382 9 PF HF ORMING ORGANIZAT'ON N AME AND 4* AILING ADDRESS (include lep Codel DATE REPORT ISSUED Sandia National Laboratories wo~rs l YEAR Albuquerque, NM 87185 December 1982 Subcontractor: Jack R. Benjamin & Associates, Inc. 6 'L'a' *'*a*' 444 Castro Street - Suite 50i 8 (te v. et.ani Mountain View: CA 94041 12 SPONSOHING OHG ANIZ ATION N AME AND M AILING ADDRESS (lactude lip Codel Reliability & Risk Assessment Branch ~ Division of Safety Technology n nN No. Office of Nuclear Reactor Regulation U. S. Nuclear Regulatory Commission A-1125-0 Usch4nn+nn nP OACCC 13 TUE bbd hf PE RIOD COV E RF D (trictusive damsl Technical Evaluation Report 15 $UPPt EVEN T AHY NO TE S 14 (Leave utent It> ABS TH ACT (200 words or tesO This report summarizes the review of the internal and external event portions of the Indian Point Probabilistic Safety Study (IPPSS). The review was conducted by Sandia National Laboratories and Sandia contractors over approximately a 6-month period. The purpose of the review was to search for areas in the IPPSS wht e omissions and critical judgments were made which could impact the quantitative results. The review identified several of these areas. This report also evaluated, in a preliminary way, some proposed Indian Point plant modifications which were based on the insights of the IPPSS but were not included in the IPPSS resul ts. A comparison of the quantitative results in this report, which assumes the plant modifications are in place, with the IPPSS results yields less than a factor of two difference on the overall plant core melt frequency. 11 AE Y WOHOS AND DOC'JYE NT AN ALYSIS 17a DESCRtPTORS Indian Point Unit - 2 Indian Point Unit - 3 Consolidated Edison Company (CON ED) Power Authority of the State of New York (PASNY) Probabilistic Risk Analysis 1 71- IDt N TIF IE RS OPE N E N DE D TE HM 13 SE CUH t TY C L ASS ITNs reporff 21 NO OF P A GE S 18 AV All ABillT) ST ATE ME NT Unclassified 20 sEaRin CL ASS es o,e 22 ;Ree Un1imited soc .onv 33s -,.o
UNITED STATES 0" NUCLEAR REGULATORY COMMISSION ,'93r",'j C',",5,s g ua\t
,, 9 WASHINGTON. D C 20555 usmac ansa o c Piavit g g OFilC6 At BUSINE SS PEN AL TV FOR PRiy ATE USE S YJG 120555078877 1 ANXdAP9A989T US ARC AOM DIV GF T10C PLLILY 6 PUBLILATIGNS MGT da PDH AUREG COPY LA 2LZ hASHlf4GTCh DC 205S5 l
- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .}}