ML20062H484

Probablistic Analysis to Verify Adequacy of Midland Plant Tornado Missile Protection

ML20062H484
Person / Time
Site:	Midland
Issue date:	06/30/1982
From:	CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
Shared Package
ML20062H477	List: ML20062H475 ML20062H484
References
NUDOCS 8208160067
Download: ML20062H484 (56)

Text

. _ , .

.=. - . - . . . . , - . - . . _...

o ,

i I

L PROBABILISTIC ANALYSIS TO VERIFY THE j r ADEQUACY OF THE MIDLAND PLANT i

TORNADO MISSILE PROTECTION

[

l i

f i

t 1

JUNE 1982  ;.

I ,

l i

l i

! l

[

I e

4 I

i i

1 i

8208160067 820811 i PDR ADOCK 05000329 l-E PDR

.  :: . . - :. .-.=-. .. . _ - . . . . . . . - - - .. _. .-

' - PROBABILISTIC ANALYSIS TO VERIFY THE ADEQUACY OF THE MIDLAND PLANT TORNADO MISSILE PROTECTION TABLE OF CONTENTS

1. INTRODUCTION AND

SUMMARY

l

2. BACKGROUND 2

3. DESCRIPTION OF MIDLAND TORNADO MISSILE 3 BARRIERS

4. PROBABILISTIC ANALYSIS 4

5. DISCUSSION OF CONSERVATISM AND SIGNIFICANCE OF 6 RESULTS

6. CONCLUSIONS 8

7. REFERENCES 8 APPENDIXES

- A Midland Site Tornado Frequency ,

i

! B Onsite Transport of Tornado Missiles C Geometrical Shielding Factor, PG D Borated Water Storage Tank and Chemical Addition System Evaluation ,

l E Component Cooling Water System Evaluation l

F Safcguards Chilled Water System Evaluation l

l G Auxiliary Building Fuel Handling Bridge Evaluation H Damage to Shutdown Equipment from Tornado Missiles Entering Auxiliary Building South Wall Penetrations I Heating, Ventilating, and Air Conditioning Tornado Damper Damage Evaluation I

l 11

(

l

l.. .

l Probabilistic Anclysic '

l

. . Midlend Plcnt Units 1 and 2 l

LIST OF TABLES 1 Geometric shielding Factor Pg for Representative Components 2 Composite Summary of Failure Frequency D-1 Chemical Addition System Missile-Related Failure Modes E-1 Component Cooling Water Missile-Related Failure Modes F-1 Safeguards Chilled Water System Missile-Related Failure Modes L

i D

4 l

\

l 4

l i

iii i

9

---..w--y . _ - >-,.,o_. ,

-.g .,. y- - _ - - __ _ _ __

, , Probabilistic AnalyDis Midland Plant Units 1 and 2 LIST OF FIGURES 1 Auxiliary Building Tornado Missile Protection, Typical Section (Looking East) 2 Auxiliary Building Tornado Missile Protection, Plan Near Roof 3 ' Perspective of Midland Auxiliary Building Missile Protection (Looking South from El 716'-0" Outside) 4 Perspective View of Midland Auxiliary Building Missile Protection (Inside Looking North from El 691')

5 Target Analysis 6 Midland Auxiliary Missile Protection (Showing Crane Supports) 7 Midland Auxiliary Building Missile Protection (Showing Crane Supports, Inside Looking North from El 716')

B-1 Plan View of Safety-Related Structures - EPRI Model B-2 Plan View of EPRI Model and Midland Plant Safety Structures D-1 Chemical Addition System (Simplified for Alternate Shutdown Mode)

D-2 Selected Chemical Addition System Equipment E-1 Component Cooling Water E-2 Selected Component Cooling Water Equipment F-1 Safeguards Chilled Water F-2 Control Room Safeguards Chilled Water Lines G-1 Location of Auxiliary Building Fuel Handling Bridge H-1 Locations of South Wall Electrical Penetrations I-l Location of Auxiliary Building HVAC Tornado Dampers I-2 Location of Control Room Intake HVAC Tornado Dampers (Partial Plan, Elevation 694'-0")

iv

~

._?' .

PROBABILISTIC ANALYSIS TO VERIFY THE 3

ADEQUACY OF THE MIDLAND PLANT TORNADO MISSILE PROTECTION

1. INTRODUCTION AND

SUMMARY

This report presents an evaluation of the adequacy of the tornado missile protection at the Midland plant. Protection is provided against potential tornado missiles for systems and components that are necessary for safe shutdown in the event of a design basis tornado (DBT). These systems and components are discussed in the Midland Final Safety Analysis Report, Section 3.5. There are some components such as sections of piping, cables, and instrumentation that have limited vulnerability to tornado-generated missiles. The probability of damaging critical  ;

equipment by tornado missile impact is quantitied in this report, I supporting the judgment that the Midland structures provide the missile protection required to meet the intent of the design criteria.

Specifically, small portions of each of the following are exposed to tornado missiles:

a. Chemical addition system

b. Component cooling water system

c. Safeguards chilled water system

d. Shutdown-related equipment in the proximity of auxiliary building south wall electrical penetrations In addition, the auxiliary building fuel handling bridge (ABFHB) is analyzed due to its proximity to the spent fuel pool, although heating, ventilation, and air conditioning (HVAC) tornado dampers are provided at the auxiliary building pressure boundary to

,, prevent depressurization during a tornado. The vulnerability of these dampers to tornado missiles istalso, analyzed.

A probabilistic analysis has been performed using a conservative

approach for the loss of safe shutdown-related systems in the l event of a tornado. The frequency for loss of shutdown is l conservatively estimated as 3 x 10 1~ per year. Section 2

l. discusses the basis for an acceptance criterion of exceeding 10 CFR 100 guidelines of a frequency 10'T per year. Based upon >

': this criterion, the frequency of loss of shutdown capability for

'i the Midland plant due to tornado missile related failures is

,, acceptable, and additional tornado missile protection is not i warranted. The analysis also suggests that in order to meet the  ;

167 per year criterion, deterministically designed missile protection for safety related systems is a necessity, and that the probabilistic criterion is consistent with existing design

requirements for the effects of tornados.

1 i

Probabilistic Analysis Midland Plant Units 1 and 2

2. BACKGROUND Several regulatory guides and standard review plans provide guidance for designing nuclear power plants against the effects of tornado missiles. Regulatory Guide 1.117 (Reference 1) identifies the following structures, systems, and components that should be protected from the effects of the DBT:

a. Those necessary to ensure the integrity of the reactor coolant pressure boundary

b. Those necessary to ensure safe shutdown of the reactor and maintain it in safe shutdown condition

c. Those whose failure could lead to radioactive releases resulting in calculated offsite exposures greater than 25% of the guideline exposures of 10 CFR 100.

Regulatory Guide 1.76 (Reference 2) defines design parameters for the DBT for each of three tornado regions on the continental United States; the Midland plant is located in Tornado Region I.

Regulatory Guides 1.117 and 1.76 provide a basis for the deterministic design of walls, roofs, and special barriers to prevent damage from tornado missiles.

The SRP for FSAR Subsection 3.5.1.4 provides additional guidance.

SRP 3.5.1.4 (Reference 3) defines spectra of missiles generated ,

by natural phenomena that need to be considered in designing the above structures, systems, and components, and provides the characteristics of each missile for use in the design calculation for the DBT.

SRP 2.2.3 (Reference 4) provides a probabilistic guideline for  ;

offsite hazards in the plant vicinity having the potential for l

adverse consequences (radioactive release). SRP 2.2.3 states: l l l

. . . the identification of design basis events resulting from the presence of hazardous materials or activities in the vicinity of the plant is acceptable if the design basis events include each postulated typte of accident for which the expected rate of occurrence of potential exposures in excess of the 10 CFR Part 100 guidelines is estimated to exceed the NRC staff objective of approximately 10-7 per year. Further, the  :

expected rate of occurrence of potential exposures in -

excess of 10 CFR 100 guidelines of approximately 10e i

per year is acceptable if, when combined with reasonable l

qualitative arguments, the realistic probability can be shown to be lower . . .

The 16-7 guideline of SRP 2.2.3, if applied to tornado missile design, necessitates missile protection for shutdown-related equipment. It is felt that this criterion i

2

l

\

, . Probabilistic Analysis Midland Plant Units 1 and 2 I

is consistent with the intent of Regulatory Guides 1.117 and l l.76 and SRP 3.5.1.4. The tornado characteristics which constitute the present design basis tornado have been selected to afford protection to vital plant systems from a tornado having a frequency of approximately 177 per year.

Consistent with this philosphy, any unprotected components whose failure can contribute to major offsite releases should be designed sufficient partial protection, redundancy and separation to assure that loss of safety functions due to tornado effects will not be more probable than the design basis tornado. For these reasons, an acceptance criterion of 177 per year of exceeding 10 CFR 100 guidelines is used for the probabilistic analysis contained herein.

3. DESCRIPTION OF MIDLAND TORNADO MISSILE BARRIERS Deterministically designed tornado missile barriers have been provided at the Midland plant to limit safety system vulnerability to tornado missiles. These designs have been implemented on the reactor buildings, auxiliary building, service water pump structure, and diesel generator building. The structures and barriers relating to the vulnerable systems in the auxiliary building are illustrated in Figures 1, 2, 3, and 4.

Figure 1 shows a section at the auxiliary building centerline looking east. As can be seen in the figure, a concrete missile barrier extends from grade level (el 634'-6") to el 665'-0" on the north perimeter of the building. In addition, a steel missile shield extends above the roof from column line H northward to column line D. The steel plate thickness is 1 inch, which will preclude perforation by tornado missiles and prevent damage to equipment from shield denting caused by tornado missiles. The concrete walls extending from grade level to el 665'-0" have a minimum thickness of 24 inches and a minimum concrete compressive strength of 5,000 psi, also precluding design basis missile penetration. Figure 2 shows the steel plate (diagonal shading) and the north wall which extends to el 665'-0" (dotted exterior Wall) in a plan view. Two concrete slab roofs of 21-inch thick, 4,000 psi strength concrete (indicated by l crosshatching on Figure 2) are also missile-resistant. The exterior walls indicated by solid shading support the concrete slabs, and are of missi-resistant design up to roof elevation 687'-0". The ection of the roof at el 704' is not missile-resistant.

The south vall of the auxiliary building adjacent to the turbine building has a minimum thickness of 23-inch, 5,000-psi strength concrete. Missiles can penetrate the south wall only through the penetrations to the turbine building structure. The auxiliary building roof south of column line H is also of missile resistant design.

3

I l AUXILIARY BUILDING TORNADO MISSILE PROTECTION TYPICAL SECTION (looking east)

~

l STEEL PLATE - I EL 735'-0"

! EL 714'-0" M '

I STEEL PLATE c _ . _ _ , , , ___ , ._ , _ _ _ , . ._. _ em ROOF EL 704'-0" r

l . .

l

\

I l

l j OPERATING  ! EL 665'-0" I

FL EL 659'-0" 1 l _,

h f__

f SP NT FL EL 634'-6" u ,

_ pUE

- POOL I ' '-

_ FL EL 614'-0" g

l \

sc

=

I ,

F: 568'-0" -

l FIGURE 1 7 # 4 fo L"*a s "w % m e2 a2s27m

[ -

AUXILIARY BUILDING TORNADO MISSILE PROTECTION PLAN NEAR ROOF r:% 9 .

l i/l -@ N  !

EL 687 -0 (E 70 0"

-EL 687 -0" TOP OF STEEL

.p. .

7 t EL 714'-0" fn -- ~

s.

E EACTOR X O

\i EL 707'-0" l TO EL 730'-0" TOP OF STEEL g SPEN UE

(,

• ~

~--[

i -

l i L 730'-0" ' 5(BE .

g

\ kREACTOR , , i i j

/

~

UN T . TbP OF 2" oI E'*W-r '/ (PLATE EL 704'-0" t #

TOC ._ TOC EL 695'-6"-<

I EL 704'-0" N O

O O O FIGURE 2 6/25'82 G252742 s

. , Probabilistic Analysis l Midland Plant Units 1 and 2  ;

i s

The reactor buildings are of missile-resistant design. The location of the reactor buildings affords missile shielding to portions of the auxiliary building.

The Midland tornado missile protection can also be seen in Figure 3, a perspective view of the auxiliary building looking .

south from the outside showing missile protection above the el 659' floor level. Walls and structures designed as missile  :

barriers are illustrated as opaque objects. The central part of the auxiliary buidling roof at 704'-0" is not a missile barrier.

Figure 4 shows a similar perspective view of the auxiliary building from the inside looking north. The minimum heights of the walls are identified with respect to grade level on the figure, the lowest barrier being at least 30 feet above grade. i More detailed information concerning the design detail of tornado missile protection is given in Chapter 3 of the Midland Final Safety Analysis Report.

4. PROBABILISTIC ANALYSIS A probabilistic analysis has been performed to substantiate the limited nature of shutdown system vulnerability to missile caused failures. The probability of a tornado generated missile impacting or damaging critical components of systems of concern is calculated. The unavailability of each system is calculated based on the probability of component failure due to missile impacts in combination with other random failures, e.g., other components or emergency power trains. The loss of the safety system is assumed to result directly in loss of shutdown capability, which is conservatively assumed to result in a release exceeding the 10 CFR 100 guidelines. In this manner, the tornado damage probability can be conservatively related to a ,

criterion which is defined in terms of the 10 CFR 100 guidelines l and the need for mechanistic simulation of the plant transients is eliminated. -

4.1 METHOD OF CALCULATION To calculate the probability of impacting a specific object within the plant, information and models concerning tornado occurrence frequency, missile transport, site layout, and geometrical arrangement of missile barriers must be considered.

Figure 5 shows how this information is used in a target analysis to obtain the damage probability for a specific target.

The simulation of tornado missile impacts and damage typically makes use of Monte Carlo techniques, whereby missile transport and tornado strike distributions, site-specific building layouts, missile sources, meteorological data, and trajectory aerodynamics are simulated for a large number of tornado histories. The approach taken in this study is to utilize existing analyses to the extent possible. Reference 5, an EPRI report which performed such a detailed tornado missile risk analysis for hypothetical 4

1I

+m --- - -

) PERSPECTIVE OF MIDLAND AUXILIARY BUILDING MISSILE PROTECTION (looking south from el 716' outside) ,

STEEL PLATE ROOF O -

f; STEEL PLATE @h CONTAINMENT BUILDING CONTAINMENT BUILDING UNIT 2 - N UNIT 1

, / # N w

ROOF EL 687'-0" FLOOR EL 659' 0"

_f TOC EL 665'-0" FIGURE 3 YEssG11% sm2 aasnm

- , - - - - . - - - - -.. ,.... -. - -,-...- -.,.- ., - .c. - . . . , - - -

l -

, PERSPECTIVE VIEW OF MIDLAND l AUXILIARY BUILDING MISSILE PROTECTION l

l (inside looking north from el 691')

,[

l I LSTEEL PLATE ROOF EL 714'-0" STEEL PLATE @h L

N /

' - O @ - [ TocABOVE a sarGRADE o'-

( ~

toc a ser-o.. -

a 52' ABOVE GRADE ,

l' TOC E 665' o" 30' ABOVE GRADE q .

, )

FIGURE 4 0 2527 04 Of4N E DE 5/25/82 T. . .

i

, TARGET ANALYSIS MID AND T NADO MIS". ..d. SOU RCES

• PLANT LAYOUT

• g gUENCy '

MISSILE TRAJECTORY TARGET AREA FACTORS TORNADO BEHAVIOR + MISSILE HISTORY

. STATISTICS

• AN ALYSIS

• 1 r ,

1 r p TARGET STRIKE $ T + TARGET DAMAGE FREQUENCY PROBABILITY MISSILE IMPACTS

( YEAR - FT2 j

• Based on EPRI report results (Ref. 5)

FIGURE 5 T R ADO M S LE DESIGN 5/25/82 G-252745

- - . - - . - . , , . _ . , . . , . . , . . , - - . , . - , . - _ _ - , . - . . -,_,. _.-._ --,- - , , . , - ...-, .-. _ _ _ , - - . . - - -_ . _ - ___ - c . _ - _ _

Probabilistic Antlysis

. . Midltnd Plant Unito 1 cnd 2 TABLE 1 GEOMETRIC SHIELDING FACTOR PG OR EPESMATIW CONOMS Component / System P Chemical addition system

1. BWST 1 (unprotected)

Component cooling water system i

1. Cable 0.11

2. Level transmitters 0.19 Safeguards chilled water 0.068 system piping Auxiliary building fuel 0.24 handling bridge I

t i

Probabilistic Annlycia

, , Midland Plcnt Unita 1 (21d 2 TABLE 2 COMPOSITE

SUMMARY

OF FAILURE FREQUENCY Target Failure Frequency (yr~' )

Chemical addition and BWST 1 x 1010 4 x 10'

~

Component cooling water Safeguards chilled water 1 x 16' 4 x 10'

~

Shutdown equipment at south wall

~

Tornado dampers 1 x 10"

~

Auxiliary building fuel 1 x 10*

handling bridge ,

a ,

TOTAL 3 x 10 1

l

- . Probabilistic Analysis ,

Midland Plant Units 1 and 2 single-unit and two-unit nuclear power plants located in each of the NRC tordado zones, provides data which can be used for the Midland site. The blocks designated by an asterisk in Figure 5 ,

indicate the data which are applied to the Midland site from the EPRI study. Because the safety structure strike frequency for a given NRC tornado region and plant is proportional to the tornado frequency, the EPRI data are adjusted to reflect the tornado frequency for the Midland site. Appendix A discusses the data used for the Midland site tornado frequency. Appendix B r discusses the bases for utilizing the EPRI two-unit plant as being conservatively representative of the Midland site.

The general equation for calculating the frequency of tornado damage to any given target is the following:

• target = O safety x ^ target x Pb (1) structures Asafety structures where

• target = frequency of impacting a specific target (probability /

year) 4 safety = frequency of impacting a plant safety structure structures (probability / year)

^ target = target surface area A

safety = safety structure surface area exposed to missiles structures Pf = probability that missile barrier will not block a tra]ectory ,

The equation was used in the above form to utilize existing data to the extent possible. The first term, the frequency of hitting a safety structure, is a parameter which can be taken from

! results of the EPRI study for a two-unit plant in NRC Tornado l

Region I, in which the Midland plant is located. This term l accounts for tornado frequency, number and location of available missiles, probability that the missile will become airborne, spectrum of tornado intensities, and site geometry. The value used in the Midland analysis for this parameter is 1.5 x 10 per j

year based upon a mean tornado frequency of 8.5 x 10 per year for the one-degree sector surrounding the Midland site.

Appendixes A and B discuss the manner in which the numerical value was determined.

The probability of hitting a given object at the plant is assumed

( to be proportional to its exposed surface area. This i relationship can be expressed as a dimensionless quantity by using the ratio of a given target's surface area to the total 5

l

. . Probabilistic Analycic Midland Plant Units 1 and 2 safety structure surface area. Normalizing to the safety structure area is done consistent with the first term, the frequency of impacting a safety structur'e by a tornado missile.

This ratio is shown as the second term in Equation 1. The product of the first two terms represents the probability per year that an unprotected object at the plant location, having a characteristic target area will be impacted by a tornado missile.

The area of the safety structures, to be consistent with using the EPRI missile strike frequency, would be based on the area of the structures used in the EPRI reference report. The safety structure area used in the Midland analysis, however, is 40 percent as large as the EPRI safety structure area. This results in a factor of conservatism of 2.5 in the missile density, and supports the explicit use of the Monte Carlo results without further justification of differences between the plants.

This is a conservative assumption also because the Midland area is much smaller than the EPRI two-unit plant safety structures.

The final term, P, g the probability that a missile barrier will not block the trajectory to the target, allows credit in the analysis for the steel and concrete structures blocking missiles from reaching the critical targets. Derivation of the equations used to calculate this factor is based on the barrier geometry and is included as Appendix C. Table 1 shows barrier reduction factors for some representative components and equipment analyzed in the study. Because the BWST is located outside, no barriers protect it from missiles, hence the value of PG is unity. The safeguards chilled water piping, located adjacent to the reactor buildings, is protected by the steel roof and reactor buildings, resulting in over 93% reduction in missile strike probability.

The relationship between component damage and system failure was considered next for each system. The combination of component failures considered for each system is explained in detail in Appendixes D through I. The possibility of nonmissile failures was probabilistically included. One such failure assumes loss of offsite power and the random failure of one emergency power train in conjunction with missile-related damage. This conservatively estimates the conditional probability of loss of shutdown due to tornado missile-related failures, given a missile impact within the safety structure. This is then converted to frequency by multiplying by the frequency of safety structure impact previously discussed. The frequencies of shutdown failure for each system due to tornado missile impacts are summarized in Table 2. The total is 3 x 10-8 /yr, which is less than the 10-7 criterion discussed in Section 2 and therefore acceptable.

l 5. DISCUSSION OF CONSERVATISM AND SIGNIFICANCE OF RESULTS l

The probability model described in Section 4 is applied to each system. The following conservative assumptions are common to all l six targets analyzed in Table 2:

l 6

l_ __ _

. . Probabilictic Analysic Midland Plant Units 1 and 2

a. Any impact to a component is assumed to cause loss of function.

b. A conservatively high missile impact density is used.

All of the tornado mi:ssile impacts calculated in the EPRI study were assumed to be concentrated in an area smaller than the Midland surface area.

c. Targets on or above the auxiliary building 659' floor elevation require trajectories greater than 30-feet high, where missile density is expected to be less than that assumed.

d. The factor Pb is conservatively approximated in cases where spherical geometry would not permit exact calculations.

e. Credit is not taken for many structural members in the auxiliary building or turbine building such as structural steel beams and concrete slabs. Also, credit is not taken for the large components in the turbine building. Figures 6 and 7 show that an additional reduction of approximately 50% may be achieved for certain auxiliary building equipment due to shielding from auxiliary building crane supports, which are of missile-resistant design.

f. For targets having complex shapes, conservative approximations are made of the surface area.

g. Probabilities used for the loss of emergency power trains assume that loss of offsite power had occurred, thus conservatively estimating the power failure probabilities. Restoration of offsite power is not considered.

h. Credit is not taken for operator action in restoring the use of equipment which is assumed to randomly fail.

i. Loss of shutdown is assumed to result in a release exceeding 10 CFR 100 guidelines.

l

j. The expected decrease in missile density at elevations

! greater than 30 feet above grade is not considered.

1 i

7 7

1 MIDLAND AUXILIARY MISSILE PROTECTION SHOWING CRANE SUPPORTS e s ,

m STEEL PLATE ROOF STEEL PLATE (/7 -STEEL PLATE @h CONTAINMENT BUILDING CONTAINMENT BUILDING UNIT 2 ,e mammeness!*mlll;;..LN_, UNIT 1 f

l h

- I l -

/ .e g N

\

~

L -

l I

, [a h A ROOF EL 687'-0" FLOOR EL 659'-0"

e , .N

/ l4 , ,0 c .. .. .\

g FIGURE 6 "m*E'" d M"msua a2seroe i

MIDLAND AUXILIARY BUILDING

MISSILE PROTECTION i , SHOWING CRANE SUPPORTS ,

]l ,

(inside looking north from el 716')

l[

, ~ -~

f

)

l> r, , h '

I r< ,,

~ -

a l

[ l  %

TOC EL 665'-O' u a FLOOR EL 659'-0"

, ) \t .

FIGURE 7 L__ _J Ytxwoo$?N$an tass 2 omver

- Probabilistic Analy=ic

. . Midland Plant Units 1 cnd 2

6. CONCLUSIONS The total frequency of loss of shutdown does not exceed our acceptance criterion of 10IT per year. A sensitivity study shows that even using an upper bound tornado frequency for the Midland site meets the same criterion.

Therefore, it is concluded that the degree of vulnerability of Midland safety systems to tornado missiles does not warrant additional protection.

7. REFERENCES

1. Regulatory Guide 1.117, Rev 1, April 1978

2. Regulatory Guide 1.76, April 1974

3. Standard Review Plan, 3.5.1.4, NUREG-0800, Rev 2, July 1981

4. Standard Review Plan 2.2.3, NUREG-0800, Rev 2, July 1981

5. Tornado Missile Risk Analysis, EPRI NP-768, Project 616, Final Report, May 1978

6. Thom, H.C.S., " Tornado Probability," Monthly Weather Review, No. 91 (1963) ,

i i

l l

8 l

t - . - - . . . - - . ~

Probabilistic Analysic Midlcnd Plant Units 1 cnd 2 APPENDIX A MIDLAND SITE TORNADO FREQUENCY f CALCULATION OF MIDLAND TORNADO FREQUENCY To assess the applicability of the generic analysis performed in Reference 5, the tornado frequency at the Midland site must be calculated. Because several such evaluations are already available, an independent calculation was not performed for this study. ,

rt Subsecticn 2.3.1.2.6 of the Midland Final Safety Analysis Report '

(FSAR), gives a tornado sita strike frequency at the Midland site o f 6. 5 x 10-* /yr. 'This is based on the methodology of Thom (Reference 6) using 1951 through 1977 climatological data for the l'r x l' sectoriat the Midland site. A statement in the same section' quotes a value of 5.8 x 10-* /yr based on the same method, I this time using 1953 through 1962 data for the same geographical region. Both of ,these values are point estimates based on local meay values of tornado path width and tornado occurrence rates.

An independent tornado data analysis was recently performed by l Pickard, Lowe, and Garrick, Inc. for the Midland plant. The i tornado strike frequency for the l' x 1" sector surrounding the L Midland site was assessed to be 6.2 x 10-4 /yr based again on the '

method of Thom and using climatalogical data from 1953 through .

1978. A 95th percentile value of 2.3 x 10-3/yr was also obtained using statewide data for the same time period. Assuming a '

lognormal distribution, a mean value of 8.5 x 1T*/yr was obtained for the Midland site using *the Midland area frequency as ,

the median. This value of 8.5 x 10 /yr is used for calculations '

performed in this study to determine the frequency of missile impact to specific components.

USE OF MIDLAND TORNADO FREQUENCY IN CALCULATIONS I The analysis performed by EPRI in Reference 5 was done for two different plant types in each of the three NRC tornado intensity r regions as defined by Regulatory Guide 1.76. Based on the  !

I Midland tornado frequenr:y and plant layout, a decision must be made concerning which of the cases performed in the EPRI analysis, if any, are applicable. The analyses in Reference 5 for intensity Aegion I tornadoes are used as the basis for this analysis.

Referring to. Table 3-4 of Reference 5, the data analysis of Region I tornadoes shows a mean frequency of 2.3 x 10-3 /yr for tornados.of Fujita scale 1 or greater, which essentially ,

represents total tornado frequency. This is nearly a factor of 3 l larger than the Midland local mean and approximately 3.5 times ,

larger than the local median value. The safety structure missile '

A-1 I

( ,

1 7 -

__5 _- -

r - ,- - _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ __ --

3 Probabilistic Analysis Midland Plant Units 1 and 2

[\

!' impact frequency obtained in the EPRI analysis is adjusted by the i ratio of the Midland mean (8.5 x*10/yr) to the NRC Region I mean from Reference 5 (2.3 x 10- /yr) for the purpose of calculating impact frequencies for specific Midland components.

This ratio has a value of 0.37. This adjustment will have the effect of reducing the overall frequency of tornados at the Midland site while retaining the NRC Region I tornado intensity distribution.

A comparison of the Midland site characteristics relative to the EPRI double unit is included in Appendix B. This appendix also identifies a number of additional conservative assumptions which are made implicitly through direct application of the EPRI calculations, adjusted for the Midland site-specific tornado frequency.

l

{

l r

A-2

Prebabiliotic Analysic ,

. . . Mid1cnd Plant Units 1 cnd 2 1

l APPENDIX B [

t ONSITE TRANSPORT OF TORNADO MISSILES f SELECTION OF REFERENCE SITE MODEL  ;

Section 4.1 introduced the method for calculating the frequency of impacting a given target. The assumption has been made that  ;

for a target located at a safety structure, the probability of l hitting that target, given a safety structure impact, is the i ratio of the target surface area to the safety structure surface area. The results of the EPRI missile impact analyses performed t

in Reference 5 give frequency of impact to individual or groups of safety structures, based on detailed Monte Carlo missile  :

transport and impact simulation. The simulation considers the l location and number of missiles, size and location of structures, '

and tornado characteristics such as wind speed, path width, path length, and intensity. The calculations were performed for two  ;

different plants, a single-unit plant and a two-unit plant.

To more easily evaluate the EPRI plants and the Midland plant, e the concept of missile strike density is introduced. Equation 1  ;

from Section 4.1 is reproduced here for ease of discussion.

• target = # safety x A target xP g (1) structures Asafety i structures t l

If the safety structure impact frequency is divided by the area of the safety structures, the resulting term represents the )

frequency per year of hitting a unit area with a tornado missile.

The frequency of safety structure impact is directly obtainable from the EPRI report for both a single-Unit plant and a two-unit plant for NRC tornado Region I. The safety structure. area used in the equation is obtained by conservatively underestimating the safety structure areas from the EPRI reference plants. Once these two parameters are selected based on a comparison of the Midland plant to the reference plant, calculating the impact probabilities for specific targets at the Midland plant can l proceed using only Midland-specific data for target size and  :

location relative to missile barriers. The quotient of safety structure impact frequency and surface area can be thought of as l a missile impact density at the safety structure surface. The missiles are assumed to be impacting the surface equally from all i directions originating exterior to the safety structure surface.

l The selection of the proper safety structure impact frequency has I been done by comparing the Midland plant to the two-unit plant [

from Reference 5. Figure B-1 shows the building layout used for the EPRI two-unit plant analysis. The figure shows that the units do not share any of the facilities in the fuel handling, i diesel generator, auxiliary, or turbine buildings, and that the P

B-1

\ . - _ _ - -

l . - . . -- ._. _ - _ - .- - - - _ _ _ --

_ . _ _ _ ~ _ . _

[

Probabilistic Anolycio

. . Midland Plant Unita 1 and 2 l

! buildings are separated, allowing tornado missiles to impact all sides of both units. A single tornado can generate missiles i which could impact safety structures from all directions because of its translation and rotational wind directions. Separation of buildings which increases exposed surface area is expected to

result in a larger tornado missile impact frequency.

! A comparison of the EPRI two-unit plant safety structure surface area with that of Midland shows the Midland and two-unit reference areas to be approximately 250,000 and 500,000 sq ft,

) respectively. The tighter clustering and sharing of Midland safety structures is responsible for this factor of 2 difference.

Figure B-2 shows the Midland sar.ty structures superimposed to

scale on the structures pictured in Figure B-1, illustrating the i

compactness of the Midland structures. This comparison of area and qualitative comparison of geometry support the assumption that the safety structure impact frequency of the two-unit EPRI analysis is higher than what would be expected for the Midland plant exposed to the same tornado histories.

In defining the tornado missile density per unit area, it would i be consistent to use the area of the safety structures simulated

in the EPRI analysis for the two unit plant, or 500,000 sq ft. A

! value of 200,000 sq ft was used in the Midland analysis, a value 40 percent of the EPRI structures area and smaller than the estimated safety structure area for Midland (255,000 sq ft).

This results in a factor of approximately 2.5 in the conservatism of the missile density. The physical significance of this i assumption is that all of the missiles predicted to hit the EPRI

! two unit plant in NRC tornado intensity Region I were assumed to impact an area smaller than that of the Midland structures.

A further consideration in the selection of the two-unit reference plant from the EPRI study is the treatment of construction over. lap and startup phasing. The two-unit impact frequency contains the assumption that following the startup of

, the first unit, there will be a 3-year period of major construction activities until the second unit commences operation. During this time, 5,000 potential missiles are available to become airborne within the critical trajectory range. Following that period, 1,000 missiles are assumed while both units operate. The missile spectrum used in the two-unit EPRI analysis is expanded to 26 missiles, selected on the basis of both aerodynamic properties and damage potential, the missiles being representative of natural and construction-related i materials.

l '

Multiple missile impacts and tumbling prior to hitting safety structures are implicitly included in the safety structure impact frequency. Once missiles reach the safety structure surface, they are assumed to strike the surface with a uniform density and direction distribution. Missiles which enter safety structures through unprotected portions or penetrations are assumed to take B-2

~

L - - - -. . _ _ ~ _ _ _

.I Probabiliati: Analycic Midland Plant Units 1 and 2 straight line trajectories for the purpose of calculating the impact probabj%ty ,fgr a specific component withia the structure.

A detailed dMcAW$bd of this model is contained in the report text and Appendix C.

SELECTION OF DAMAGE MODEL The EPRI (Reference 5) analysis incorporates damage models into the calculations. For each missile impact, probabilities are calculated for the missile damaging the barrier (backface scabbing for reinforced concrete walls). Because the Midland analysis is concerned with damage to unprotected components, use of the damage models or results is not necessary. For the Midland calculations, missiles which impact missile barriers (e.g., 20 inch thick, 4,000 psi strength concrete walls) are assumed to be stopped, and those which impact the targets under study are assumed to cause loss of function to the component.

CONSIDERATION OF MISSILE HEIGHT DISTRIBUTION Most of the targets considered in this study are located between 30 and 60 feet above grade. In some cases, the trajectories would require missile injection from even higher elevations to impact critical components. No credit was taken for the decrease in missile density as height above grade increases, although a benefit would be expected. This effect was neglected in the interest of analytical simplicity.

9

.)  ;

B-3

^ - - - -'

~

PLAN VIEW OF SAFETY RELATED STRUCTURES -EPRI MODEL l

YINI " - ~1 CONTAINMENT 500- s j \ N 2 AUXILIARY BUILDING

/ N 3 FUEL HANDLING BUILDING 5 N 4 DIESEL GENERATOR BUILDING ,l I

/

/ \ 5 WASTE TREATMENT BUILDING 7 j 6 SERVICE WATER INTAKE ll f

/ g i

g7 TANKS l

't

/

[ 3 \

\

g 3 ' '1 1

! I

\

i

/

/ 1 -

_, g

\

1 2 g t

8

' I 1,500 4  % l 4 3,200 x(ft) 7 2 /t 1

s w\PLANT SAFETYI .

\

gENVELOPE, I g's g N UNIT 1 g

s' *s g s% s g N g- PLANT SAFETY ENVELOPE, s,' \ BOTH UNITS

\

! s'*%s g

'wJ 6'4 6

-500--

FIGURE B-1 ,

ORNA M LE N 4/16/82 G-2527-08

~

PLAN VIEW OF EPRI MODEL AND MIDLAND PLANT SAFETY STRUCTURES l

l y(ft)' ~~

l 500- j s N N

/ s l

/ 'N \

/ s'

/

/ .. .:.::s:- m 8

l

/ tiNR., 1 i

/

/ "!!!)gs

+:::gi:!!

I

%..: 5 jij'

$5 g f ---

,f -.s:!: ggpq -  :+.4;: g 1,500 3,200 x(ft) 7 g l ,

\ "illu.. "*g

$ '~ ,'s;sssi: \

s

% ~4ll*.  !!-

• \

=1 s' % \ l s s \ n g

'%s \, I

'~J '4 I

-500 -- ....

! sis MIDLANDSAFETYSTRUCTURES 2 MIDLAND TURBINE BUILDING FIGURE B-2 EJ E",fds"4 msm a2s m s

Probabilistic Analysic

. Midicnd Plcnt Unita 1 cnd 2 APPENDIX C GEOMETRICAL SHIELDING FACTOR, P G

1. BACKGROUND If a uniform field of randomly directed missiles is assumed to engulf the plant during a tornado, and the missile flux (missiles '

per square foot per unit time) at some surface around a potential target is known, the probability of the target being struck can be calculated.

Pg represents the probability that a straight line missile '

trajectory which passes through the safety structure boundary will pass through the target. This probability can be estimated by the fraction of an imaginary hemispherical surface drawn  :

around the target through which missiles can enter and strike the target.

The calculations for Pg which follow conservatively approximate these surface ratios in spherical geometry assuming the target at the center and locating " windows" through which missiles can j enter. These windows are defined in terms of an upper horizon angle, lower horizon angle, and radial angle, 9.in , 9,, and 9, respectively. All such windows contributions are summed to obtain the total solid fraction from which the target is vulnerable. This is called PG*

For the coordinate system chosen, 9 is measured from horizontal up or down, having a range of -90 to +90 (corresponding to straight down to straight up). 9 is measured by sweeping through the horizontal plane, a maximum of 360 degrees.

The mathematical formula which relates 9,,,

9,,,follows:

, , and 9 to the fraction of a hemispherical surface is as F =

$' (sin 0 -

sin Omin} (1) 360*

Pg will be the sum of all such fractions for all (nonoverlapping) windows which will allow missiles to enter the safety structure and strike the target, the theoretical maximum being 1.0 for a target resting on a missile-proof floor.

2. DERIVATION OF FORMULA FOR CALCULATING Pc ,

Pg is mathematically defined as fraction of hemisphere from which missile source is visible from the target. The area of the infinitesimal sector is calculated as shown below.

, C-1

Probabilictic Analymio

, , Midland Plcnt Units 1 and 2 l

. e 8

e O

max l

}

• l D[-M,j:::! , / .i The area of the infinitesimal sector is r de r cos O d$ = r cos O de dQ (2)

The area of the sector can be obtained by integrating the above expression between the limita03, and0 , and 9 , and 9 2

Thus l the integral l O Q2 2 max -

l r cos O de dQ (3) l e J min 91 simplifies to r2 (9 -#) (sine,,,- sine ) after integration.

The fractional area with respect to a hemisphere is 2

r Q (sin 0 -

max sin Omin) (4) 2 2 Tr r I O

$ (sin 0 -

sin O min) (5)

~

360* l This equation is checked for a hemispherical sector. In this case, 1

l 9 = 360', G ,, = 90, and 9 min = 0. Hence, P = 360* (sin 90 -

sin 0) = 1 g

360* ----

C-2 I

i

Prebabiliotic Annlyaic

. . Midlcnd Plcnt Unita 1 and 2 This agrees with the intuitive answer for a target positioned on a missile-resistant floor with no other shields above or radially around it. __

O C-3

Probabilistic Annlysin

. . Midland Plcnt Units 1 and 2 i

APPENDIX D BORATED WATER STORAGE TANK AND CHEMICAL ADDITION SYSTEM EVALUATION

1. CHEMICAL ADDITION SYSTEM The chemical addition system (CAS) supplements the makeup and purification system to provide a backup water supply to the  !

primary source of borated makeup water for plant shutdown. '

Because it is not normally used for an emergency shutdown, it is ,

not required to be an automatic function, but rather a planned  !

action. Figure D-1 shows a simplified schematic drawing of the  !

Unit 2 CAS, aligned as an alternative shutdown system. The Unit 1 configuration is the same. The borated water storage tank  ;

(BWST) is the primary source of boric acid for emergency reactor shutdown in conjunction with operation of the makeup pumps.

The BWST is outside and is not missile-protected. In the event  !

of tornado-related damage to the BWST, the primary source of ~

borated water would be unavailable and therefore it is necessary to investigate the adequacy of the CAS to achieve safe shutdown.

Most of the CAS components such as the pumps, tanks, and 1 associated equipment are housed in missile-resistant enclosures; however, sections of power cables to both boric acid addition  :

pumps (2P70A and 2P70B) and two associated solenoid-operated feed  !

valves (2SV-0418 and 2SV-0471) are exposed to potential missiles. i The location of the exposed sections of these cables are shown in Figure D-2 on a plan view. The exposed cable includes cable runs >

through the turbine building, as shown on the figure. These .

cables are included in the analysis in addition to the partially  !

protected cables above the auxiliary building operating floor,  !

l and are simulated as unprotected cables in the probabilistic i analysis. The trains are separated by entire floors in.the turbine building and by elevation in the auxiliary building; a single missile impact resulting in loss of both trains is not j assumed. The cables pass from the turbine building to the  ;

auxiliary building through electrical penetrations in the i auxiliary buidling south wall. Because failure of these cables l are simulated explicitly in the chemical addition system, they I are not addressed in the electrical penetrations (Appendix H).  !

The remaining components of the CAS are completely protected from I tornado missiles. Loss of function of the CAS due to tornado- i generated missiles can occur under the following conditions

a. The BWST must be functionally inoperable (as the result of a r missile strike) for CAS to be required for safe shutdown. ,

t

b. Damage to both trains of CAS is required for the CAS to fail  ;

to provide shutdown. Because the cables are routed l l

D-1 f

Probabilistic Analysis

. . Midland Plant Units 1 cnd 2 separately, multiple-component damage is required to cause CAS failure.

2. CHEMICAL ADDITION SYSTEM FAILURE FREQUENCY The combination of failures which causes failure of the CAS was obtained using conventional reliability techniques. The failure modes considered in the probabilistic analysis are tabulated in Table D-1. As the table indicates, failure of the CAS is only considered when the BWST suffers a missile-related failure.

Furthermore, nonmissile-related failures in one CAS train are considered with missile-related failures in the other train, e.g., Train A power in conjunction with the Train B solenoid valve cable. Failures which can cause failure of the CAS without  !

missile damage are not considered, e.g., loss of power to both trains. The failures in Table D-1 resulting from tornado missile damage are identified with an' asterisk which directly relates them to the vulnerable equipment shown in Figure D-1.

3. RESULTS OF THE ANALYSIS The probability of losing the chemical addition system and the i BWST in the event of a tornado-generated missile impact is 1 x 16'O /yr.

?

l t

4

• D-2

Probabilistic Analysic

. . Midltnd Pltnt Units 1 and 2 TABLE D-1 CHEMICAL ADDITION SYSTEM MISSILE-RELATED FAILURE MODES i

i

1. BWST* + Train A power + Train B cables *

2. BWST* + Train A power + Train B BA pump

3. BWST* + Train A power + Train B SOV

4. BWST* + Train A BA pump + Train B cables *

5. BWST* + Train A BA pump + Train B BA pump

6. BWST* + Train A cables * + Train B BA pump

7. BWST* + Train A cables * + Train B cables *

8. BWST* + Train A cables * + Train B SOV

9. BWST* + Train A SOV + Train B cables *

10. BWST* + Train A SOV + Train B SOV Plus all complementary cases with trains switched

• Missile-related failure r D-3

CHEMICAL ADDITION SYSTEM SIMPLIFIED FOR ALTERNATE SHUTDOWN MODE BORIC ACID ADDITION TANKS EXPOSED TO MISSILES L_

. M BORATED 2T 70A 2T 70B 2T 70C STO E TANK i g g g EXPOSED TO s MISSILES f p_________________________

' ~

b 2SV 0418 MAKE 2P 70A

" - ~

BORIC ACID TANK ADDITION PUMPS 2SV 0471 2T 58 2P 70B "

EXPOSED TO h I i s MISSILES /

/ x 2P 58A MAKEUP PUMPS 2P 58B FIGURE D-1 2P 58C ]

rsv == - amr.w

_ _ . _ . _ _ - _ . _ ~ . _ _ _ . . . _ _ _ . . . _ _ _ . - - _ _ . . _ _ _ . - _ . , - _ - _ , _ . . _ _ _ _ _ _ . - - . _ . . _ - - - - _ - _ . . . - - - , . - . . . . . _ - - . _ _ . ~ . _ . _ _ _ . . . - , . . . . _ _ _ . - _ _ - - - . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ -

l SELECTED CHEMICAL .

l t ADDITION SYSTEM +g EQUIPMENT h"7[jpj j q

+

~4 1 p @.1._. ) E

• y 9 i

e -.

' I  !! 1 ]ly} L .

I R

..j.

=f l.* U

• lb s../.,;

l p-  :

f I l EL 659 l d,-h. [d. /

.g  ; , ---..o -

1,5 f I bs. I . 1;.:,, Jrm-lh.) -

. 1 [ ,f

<$) l[*l h, * -

' /

. r l=}

+ p ', 4 (f-- , * *-

. s.,

~*=*

i g '

~ .'

%?"  %

-l _

CHEMICAL h i r)/h.1. hI~ Ef ADDITION SYSTEM

-2, r

t 7,1 _ . -

.<.7 b L[.e

~ %E g(~j

• r r

?

7[7 CABLES EL 672' TO 679' t =0 .

4 ig-,,fh [t' AUXILIARY BUILDINGS PLAN  :-'

l AT EL 659'-0" J

~

i

\

. ~+ h .. -

~ h .

Y'm; g /.:.=_ ,' ,E3. . .

~._ .G.,0,r'

. 6. g . ,

Nb

. s h-[fY .

w. ra w

@ @ e.L 'I_ I?Mi-5,iM3]fP--f- h-FIGURE D-2 MIDLAND UMTS 1 AND 2 TORNADOMISSILEDESIGN 5/25/82 G2527-11

Probabiliotic Analysis  ;

Midland Plant Units 1 cnd 2  ;

APPENDIX E ,

?

COMPONENT COOLING WATER SYSTEM EVALUATION i

1. COMPONENT COOLING WATER SYSTEM j The function of the component cooling water (CCW) system is to remove heat from many safety- and nonsafety-related plant systems i and components and transfer this heat to the service water '

! system, and as such is one of the systems designated in Regulatory Guide 1.117 (Reference 1) to be tornado-missile  !

protected. Relevant portions of the Unit 2 CCW system of concern  ;

are shown in Figure E-1, i.e., two redundant surge tanks and associated level transmitters. The Unit 1 configuration is identical. The level transmitters protect the pumps from operating without suction and serve as a loop protection device, tripping and/or interlocking the associated CCW train pump and i tripping several related flow control valves to remove the CCW i train from service at a low-low level setpoint. Only an I emergency core cooling actuation system (ECCAS) signal can  !

override the interlock. A second level transmitter which  ;

provides a level control signal for surge tank level shares

impulse lines with the interlock circuit transmitter impulse  ;

lines via a commonly used "T-tap" arrangement. The exposed i portions of the instrumentation are shown in Figure E-1. In the event of a tornado, a missile damaging the impulse lines could trip the online pump and the CCW system would be unavailable

! until the operator starts the standby pump or aligns the swing pump. The locations of associated power cables to the level instrumentation are shown in Figure E-2 , limited segments of ,

l which are also vulnerable to missiles not blocked by safety i structures. The impulse lines and level transmitters are located l at el 659', approximately. For the CCW to fail, damage to both l l trains is required. Because there is train separation a single  !

! missile hitting both cables is not probable. Additionally, due I to the shielding from the structures (see Figures 1, 2, 3, and '

4), critical trajectories for missiles to approach vulnerable sections are improbable. Further, in the event of a demand for  !

ECCAS, the pump would start independent of surge tank level pump [

trip / block.  !

3

2. COMPONENT COOLING WATER FAILURE FREQUENCY ,

The failure frequency for the CCW system to perform its safe ,

shutdown-related function following a tornado occurrence is  !

! evaluated. The following assumptions were made to arrive at the  !

failures which may result in complete loss of the CCW system due i to tornado missiles: l l

i i

I i

E-1 f

-"'N"-T-- -

3-wre .-m -

Probabilistic Analycia

. . Midland Plant Unita 1 and 2

a. The cable trays for the redundant level instrumentation cables are assumed to be vulnerable to a single missile. i

b. The impulse lines and level transmitters are close enough together to be considered a single target.

c. If a missile impacts a level transmitter, level will fail low, resulting in train failure.

d. If a missile hits the impulse lines, the lines will break.

e. If a missile hits a cable tray which holds the A or B train level cables, the cable will fail.

f. Non-missile related random failures will be considered, including the failure of one emergency power train. l Random failures which result in system failure without l missile damage (e.g., both trains of emergency power) are not considered.

l

g. The emergency power system is not vulnerable to tornado  ;

damage, as ascertained by a review of the system for i vulnerability to tornado missiles and wind loads. '

The failure combinations which cause failure of the CCW were obtained using qualitative reliability techniques. These combinations are shown in Table E-1. -

Quantification of the cable failure probability was performed by dividing the cable into segments for the purpose of considering  ;

missile shielding, then combining the segments to obtain the l

probability of cable failure. The probability of an emergency power train assumed that offsite power is not available l maximizing the probability of failure. The probability of system failure was calculated by hand, using Boolean representation of the failure sets in Table E-1. ~

3. RESULTS OF THE ANALYSIS Considering the failure modes in Table E-1, the frequency of a tornado-generated missile failing the CCW system is calculated to be 2 x 10-8/yr.

E-2

w. ._._ m -

,.T -r --

ProbaDilictic AnSlycic

, , Midland Pltnt Unita 1 cnd 2 TABLE E-1 COMPONENT COOLIh3 WATER MISSILE-RELATED FAILURE MODES

1. Train A power + Train B level transmitter *

2. Train A power + Train B cable *

3. Train B power + Train A level transmitter *

4. Train B power + Train A cable *

5. Train A level transmitter * + Train B cable *

6. Train A level transmitter * + Train B level transmitter *

7. Train B level transmitter * + Train A cable *

8. Train A cable * + Train B cable *

• Missile-related failure E-3 t

( ~

COMPONENT COOLING WATER COMPONENT COOLING PUMPS WATER [

l-- ~ ~ -- ECCAS I

i 2T-173A LL 2LT -

' '. 1727A.

EXPOSED TO CCW SURGE MISSILES TANKS

' 2LT -

1727B 2T-1738 LT LL J

-[

m------- ECCAS V

FIGURE E-1 MIDLAND UNITS I AND 2 TORNADOMISSILEDES8GN 5/25/82 G2527-12

I i

SELECTED C@MP@NENT .

COOL NG WATER EQUIPMENT ~..

.. a 9 k-= -.y :9 --pe~_. ._;.se-@

l 1I . MI Il l .: .

~

'y

n. CCW SURGE

'c--

[Ull 3 i

- - -}'54,.- f'8

, TANK LEVEL

v. o ~-

1] INDICATORS

%l;( l ..-- l I. .Iq.ll l ,

9,

' ' ' I EL 673'

. L .c LA, I fhl. :1 s. Q'E

}'-(_ . !

g .m

3i c,0 i-* T ~,.4.,M ,

! 4 p [;y., t y=e:~

h="

i 0l% get% n f[y' ^ Nt ===:N jb.Q@!' E.?ig% I p$.;

w[M[1]Y];,;I i Fril . ! , .!

3 F IFWT ,

j 7(fRN N a

. ~ 1_ 'p ;; L4,y..g ty g.

' _. .vs t g, n .n.;... ey. .

2 4 egy2: p j# _"'=#-

y hyN.==*.* L ._. '.__

h e _

- '8 .

CCW SURGE TANK d

c- M' pf LEVEL CABLES

. I I i F. (j.[;

I fir'%

, M.. "3. __ - ,s

'w; 4+. s-- j

(.fi EL APPROX 685'

',$ (db [{ g

, ,m __ . .

S N l_ UIh AUXILIARY BUILDINGS PLAN ,#

, r ~f ,__ ,. g fp > 8,s AT EL 659'-0" -

q g'- y,.

p.4y -_ -

'f

-n-m _/

=. s.= vq Ing =h p-4=e. wp

_'l :w .

JiNgse p-

.n.

j v

"~

s.A L'ct e . a %~F 4 # *EM OIm R n*. g v

.. w

..i. i h 4) U. (s) ,,_'-

Y ~~"_ _ . . @

m. _, ..

-e FIGURE E-2 O

MIDLAND UNITS 1 AND 2 TORNADO MISSILE DESIGN 5/25/82 G-252T-13

Prob bilictic Annlyaic

. , Mid1cnd Pltnt Units 1 cnd 2 APPENDIX F .

SAFEGUARDS CHILLED WATER SYSTEM EVALUATION

1. SAFEGUARDS CHILLED WATER SYSTEM The scfeguards chilled water (SCW) system maintains the air l

temperature of the control room, switchgear rooms, battery rooms, l and engineered safety features equipment rooms during plant ,

operation (including accident conditions). Figure F-1 shows a i

schematic representation of the system. The chiller units and most of the piping are in tornado-protected areas. However, a section of pipes carrying the chilled water into and from the l control room chiller units passes outside the barriers and is I

exposed to potential missiles from the central northern portion above el 665'. Figure F-2 shows the safeguards chilled water lines on a plan view. The missile-proof roof up to Line D and the two containments shield the chilled water piping from any missiles from the south. Thus, critical trajectories allowing missiles to strike the lines are improbable.

To cause SCW system failure, damage to both trains is required.

This is probabilistically low because exposed piping for opposite trains is on opposite sides of the auxiliary building (Figure F-2). Also, the pipes are only 3 inches in diameter, which further decreases the probability of impact.

2. CALCULATION OF THE SCW SYSTEM FAILURE PROBABILITY FOR TORNADO CAUSES For the normally aligned chilled water lines, the analysis indicated that a train will be lost if the piping in one tendon service shaft is broken.

i The following additional assumptions were made in the calculation  ;

of probability of complete functional loss of SCW system due to a tornado missile.

a. The four clustered pipes in each tendon shaft area are considered a single target for the analysis. The pipes are assumed to be at 677' for the calculation of Pg.

b. The SCW system must lose both trains to functionally fail to provide its shutdown-related support functions.

l

c. If a missile hits the piping, the piping is assumed to I fail.

F-1

Probabilistic AnRlycic Midlcnd Plcnt Units 1 and 2

3. CALCULATION OF SAFEGUARDS CHILLED WATER SYSTEM FAILURE FREQUENCY The combinations of failures which cause failures of the SCWS was obtained using conventional reliability techniques. The missile-related failure modes considered in the probabilistic analysis are listed in Table F-1. ,

4. RESULTS OF THE ANALYSIS The probability of losing the SCW system in the event of tornado-generated missile damage to the piping is 1 x 10- 0 /yr.

i i

l l

i t

F-2 l

s. _ __. _ _ _ _ _ .

Probabiliotic Analysio-Midlcnd Plcnt Units 1 cnd 2 P

TABLE F-1  ;

SCW MISSILE-RELATED FAILURE MODES

1. Train A power + Train B piping *

2. Train B power + Train A piping

• 7

3. Train A piping * + Train B piping *

• Missile-related failure i

i k

t i

i i

t i

l F-3

+

E r

s . - - - - -e'= +-"* ~ "

,- - - - - , . - - _ . , - - , ,, - - - - --- --e .- - - - - - - y -g

\

i SAFEGUARDS CHILLED WATER

• UNIT 1 UNIT 2 TRAIN TRAIN TRAIN TRAIN 3 A B A B 3 e i i i

, . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . __- _ _ _ _ . . . . - j ,

i s.________,___, ,

l , _ _ - - _ . ,

g____________ ~.,  % g g#

k .

f  !! -EXPOSED TO MISSILES i I

/ m Q i ,

s  % "

n_"_____,,J,I, u

ul:i EXPOSED TO MISSILES n ^ s A B l

CONTROL ROOM CHILLERS l

FIGURE F-1 MIDLAND UNITS 1 AND 2 TORNADO MISSILE DESIGN 5/25/82 G-252714 r

49 e P

- _ _ . . _ . _ . . _ _ _ ._ - - . _ _ _. _ _ _ _ _ . . _ _ _ _ _ _ _ _ . _ _ _ . . . . . . _ _ _ _ _ . _ . . _ _ _ _ _ ...... ~ ._ __._. ._ _____..___.______. -

CONTROL ROOM SAFEGUARDS .

CHILLED WATE~R L NES a 6l,

-~~ Y , <9 g2'_- =ig : s l

.\

d ,;, . -- :L=ilIl -

I +' - e 3-;  !

i.

i

![ Lt ]!_' -

.. .. ;) = c.

L' f iI]'r I s,;

Et f

.' J)..sp . L. . . l. b g pt 1 I

ik ;d e:.-h ( f. .i>fl 1~ P MdH2 An##. n.-=" %

, i;  !

r=W. 4p.I'd.;Y .

s.

?^~

l 'l

! Q lI.f:,f i /-

i (u)

N .? 'll8] l j, 4t.; .,rlg jW[ ]1 > Q

. .. n .

l.

1 *T I.

.y

~

b ' ' v+ k ~?

M 'U.._

Y-l i }

hw .

~

_ _ _ --. . q __ g, , , m .

[ j 2. SAFEGUARDS CHILLED WATER LINES

[ f, jjj .l --' 7 d*; ' [') ' l

'--l EL 659' TO APPROX 690' AUXILIARY BUILDINGS PLAN AT EL 659'-0" ..

d[d* ?,ffQ['

[ Cr"' 8 .\

s i q?V, pbb

.{.$.--. $r5il T e

u .--- = -n .q {y j

.i -

!..o

. - ~Ns

.' g

~~

~ ~ . , ,

~"".;2 4, 6 ]h~_~~~- .i a

tyy,:: -

s x/-d e

".{.9 7, [p. w ] /, C- 'T q ---- E g{,y  %.g 20 1 s ,yf.l. u Ty' 4 . x - 57t3

l!IT I i l w,,MYMN_MMD~

E9 @ AJ  : o

.-e FIGURE F-2 l

t MIDt_AND UNITS 1 AND 2 TORNADO MISSILE DESIGN 5/25/82 G-2527 15

l Prcbabilictic Analysie l Midlcnd Plant Unito 1 cnd 2 l

APPENDIX G AUXILIARY BUILDING FUEL HANDLING' BRIDGE EVALUATION

1. AUXILIARY BUILDING FUEL HANDLING BRIDGE The auxiliary building fuel handling bridge (ABFHB) is evaluated because of its proximity to the spent fuel pool. Figure G-1 shows the bridge on the operating floor (el 659') level. The  :

bridge travels along the length of the pool and the piggyback-l mounted trolley moves across its width. The bridge is protected from missiles striking from the south by the protective steel  ;

plate up to column line D. The only missiles that can enter are i from the central northern part above el 665'.  :

The bridge is assumed to be located at the spent fuel cask area.

The bridge is less likely to be struck at any other possible location. Because of its weight, shape, and location within the auxiliary building, it is not expected to become a primary missile. Large missiles like the automobile and the utility pole would not be considered in accordance with Standard Review Plan l 3.5.1.4 (Reference 3), because the missile barriers at the auxiliary building extend to at least el 665', more than 30 feet above grade level.

l 2. AUXILIARY BUILDING FUEL HANDLING BRIDGE IMPACT PROBABILITY The impact probability was calculated based on the following conservative assumptions:

l

a. The bridge is located at the spent fuel cask area, which l

I is the most vulnerable location for missile impact.

b. An impact by a missile is assumed to cause major bridge failure.

I

c. Significant fuel failures are assumed to result from I bridge failure.

l l d. Surface area is conservatively estimated, which results I

in a larger value of target strike probability. l

e. The bridge is not expected to become a primary missile because of its weight, shape, and location within the i auxiliary building.

f. Spent fuel is assumed to be stored in the spent fuel pool.

G-1

m-Probabiliotic Analycio Midland Plcnt Units 1 cnd 2 i

3. RESULTS OF THE ANALYSIS The total frequency of a tornado-generated missile hitting ABFHB is 1.2 x 10-a /yr.

i i

I l

b l

G-2 ,

n

_ _ --m F,

e L@ CATI @N @F AUXIL ARY  :

BUILDING FUEL HANDL NG s,w BR DGE W - - -

, 6 c_T

.2 ..s ! - e)

- e l b,N7; ' C* L~

, }  :

I !ElLdl1L-.1 y,, .j '[-.}):p g T y: p'?

pl- l"bkfrNbfshkl' .,,

.O r k $ f-[k.

i'.P t.2t

=:= =3, Y 3

.h.7. '

~-

+ "'-.

Q >4gj n : .- .h- t*'

0%2mpf 4 l

i 731e ]ip Dj fllL7M,t p/ N m $f3.bdk. s ..

[Y[ti)?]i di fij g  !, ,j[bfSfj5?

f N i

e4 e L'.

(u)

, ka- 'c*go A

"' {s]ti*:M'Y,;jj*i(h.gIngd

[j T1 .

. . _ g "]f ' J ~

a, ,~., '

N :II_ , j e- 7 ' l3 < ..

! ' 'm'# d g'

'_ d s 'yQ' kfQd((j .7

^h,x.'J[ AUXILIARY BUILDING e i i. fj-d..r

'l t -~i i 5 i- .

h FUEL HANDLING BRIDGE evl u!.. d

e. 4 o . -- .

.+

/t i( ll

+

~Ni ug _ _,,

iQ[-

OPERATING FLOOR (659)

LEVEL T DM dr- \

AUXILIARY BUILDINGS PLAN / 11' i AT EL 659'-0" gg d

'.In k-aq , p' i a_

. . __- _ ,:d.ieliil..ys ;

N i . l -

t.D I(

T l

N, . f, i, EIM97iM m.wQi ,j7,"n"! y d

-- "~

br,J~'rl g .

ii w$hn...

sib?,Q.-

-- ..L.<.

l l d> @ $> @,._hkkNk%b" .

. ._ e C

, FIGURE G-1 MIDLAND UNITS 1 AND 2 TORNADO MISSILE DESIGN 5/25/82 G-252716 r

t

I'

_ 'Probabilistic Analysis (

. . Midland Plant Units 1 and V'

.l' 2'. \

1

!' APPENDIX H , S

>) .

. N ,

DAMAGE "f> ,SIIUTDOWN EQUIPMENT g>+

[ /

FROM TORNADC! MISSILES ENTERING /5

, l AUXILIARY BUILDING SOUTH WALL PENETRATIONS , 4

, s < M.

t i g 1 s \ - .,

1. sSOUTE WALL ELECTRICAL PENETRATIONS '\i,

, g ,

u,-

/There age a number of electrical penetrations on the auxiliary building s'uth o wall which are not provided with . local missile ,. ,

bar:Lers. The concern is potential damage to shutdown equipment- ,

,i located behind the penetration.>' Missiles can enter only froc.=the south if the presence of turbine building structure is ignored. ,

The penetration areas are'f121ed with non-shutdown-related- 4 cables, cable trays, and sea]snt because they are at the

, auxiliary building pressure houndary. The single exception is the chemi. cal addition' cables */hich have already been considered

> in Appendi,x D. s

2. DAMAGE TO SHUTDOWN EQUIPMEKT FROM SOUTH WALL PENETRATIONS Figure H-1 shows the south wall penetrations of the auxiliary building. In,estinating the frequency of damage to shutdown equipment, the following conservative assumptions are made:

a. The turbinei butilding structuresj and components do not q provide anyn:hiylding for those penetrations.

7 /

1\

c

b. The cables, ,tra's; i 'or sealunt provide no resistance to

. missiles. , )

'.) a . ': )

+

c. '

'If .there is cri tical'; equipment behind the penetration, .

5

, itisassumedtoJ;edamaged.

d. Loss of shutdown occurs for any combination of opposite train equipment loss.

I J

e. 'All penetrations are considered equally vulnerable. >The s value of the geometrical reduction factor PG is assum^ed .

, ' equal to one, for all penetrations.

./

f. The equipment located in rooms.which contain i penetrations are assumed to be vulnerable regardless ofr

. their location with respect to penetration. 4 j

v

. t

g. The analysis is performed for both units. The results fo~r the limiting unit are reportect. *

/

< i .

/

/ , ,

i i '

H-1 l L i l

> l

-\ .>

\

g ;

i Probabilistic Analyaic

. . Midlr.nd Plcnt Units 1 cnd 2 -

t

3. RESULTS OF THE ANALYSIS I

. The probability of losing both trains of shutdown equipment is ,

calculated. The limiting case is for Unit 2, and is equal to 4 x  ;.

., 10-9 per year.

F

/#

1 t

[

i e

r

[

a w

4 i

I e

. i

)

i t

t

\ f I

I i

s I *+

1 i

i e

i H-2 U-t i  :

. - . , - - . . ~ . - - - - - . . _ - . . - . - . - - . - - -. ..- . - -

LOCATIONS OF SOUTH WALL h,.

ELECTR CAL PENETRAT ONS

\, l . - : .t- _ .L -:w N

.p._ _ . . _ . 9 _ _ , -

.---j_ _ _ i

!. y.,y y99 i lf i, ,!*

l EQUIPMENT LOCATION - i; } i l AUXILIARY BUILDING l ;j l l  ! ,

j SECTION E-E ji _ __e -

_ i l j i pNg I (M-11 sh 1, Rev 6) I_ I

{

~T h!t h i

1  : -

i y l V.1l

i j i 1 79k,.urds;$wNEjtE&idrwf"

=

d$D _ . _

t r .

i A,'

p=-ce did J *f,ijyyqdfffbin1.hfT}_fi+t,f.e - h - _

~

!  ;- 4 a.pr$yrg_s Fi?f2-f?03 !w 2;4F g;;.. i

-r .=J=a*. T_7q = jR l%fr T. j a'

• 6 _ -_V2, 01--

i == - - ~ _ .P'=- ' 'i 'A =.-.

y. .

m+' -

~ m k=} [if[

, pf. - I;hu.'. f{Ap mt'~tLk

-e

___ .-}. hk. q

.f_:hmhp[m]...

fp a .= i F=- --

(EJiE fuTu Ad j ---Us.t:e.=0m'~f m.h; q +!JTtil b ;j tL tillbilin

-f %ae.lf];titiM]Th.]rlHM i>- h ;k { r - =

) "

w l

}.L .y :i. - x W.; .=a R r--- 9 t.'5'D - +:."c 7..npL lb,,,

si g _

5 N: MIfYiliIf FlkN fli .

.j. 7 7 ..

FIGURE H-1 I MIDLAND UNITS 1 AND 2 TORNADO MISSILE DESIGN 5/25/82 G-252717

Probabilistic AnElysis

• =

Midland Plant Units 1 cnd 2 l E

APPENDIX I L

HEATING, VENTILATING, AND AIR CONDITIONING TORNADO DAdPERS DAMAGE EVALUATION

1. AUXILIARY BUILDING TORNADO DAMPERS Figure I-1 shows the auxiliary building tornado dampers. The dampers have limited vulnerability because of the missile barriers described in Section 3. In the event of a tornado, a missile strike could damage the damper and depressurize the auxiliary building, which could potentially result in damage to shutdown equipment. Except for the control room intake dampers (see Figure I-2), the missiles cannot penetrate from the south, because of the missile-proof roof. Due to the spatial arrangement of the dampers, it is considered improbable for a j single missile to strike more than one damper. '

2. AUXILIARY BUILDING TORNADO DAMPER IMPACT PROBABILITY The probability of a missile impacting the damper is based on the following assumptions:

a. A missile impact causes the damper to fail.

I

b. The damper failure results in unacceptable consequences, i.e., failure to shut down safely.

c. The presence of heating, ventilating, and air  !

conditioning ducts is neglected for blocking or ,

deflecting missiles.

3. RESULTS OF THE ANALYSIS .

The impact frequency for each damper is calculated based on l individual barrier reduction factors and the areas of the dampers exposed to missiles. The probability of a missile impacting one or more dampers is equal to 1 x 10-s per year.

I i

I-1  ;

[

~

LOCATION OF AUX L ARY .

BUILDING HVAC TORNADO DAMPERS 29 30 31

~~

a e }+ n ln o" ., o- -ke-O/(' @

, i

, . .j 3.s.; .

Hg s 34,35,36,37 C,_..

i

!! lbl 1: .

j.l". ,,'

. t _.

._!. f.1.r 'q-

>S  !

Jfiy .-

i l; }g Pr t-( q ';"(i;7l 7} drq jrtj g .jj q)gry y-gy.;l

{m.y~ih<paj,3 f c ..

,.w . _

~ , .. m .

-jg . . .

s

,1 ,1 01'.116 x / y ' I. l [ I- hl7,,. ti  : [

\

. F[ .; nII lE'i iI (3;7f.,-g,j ej g j, .r-[. b :]na I h l h__

1. -[~v f- h 'Y'

( **

T 7

<p 22 43 ,

)

'l:,[e1 27

~=# 28

! .i I 23'plK}y%.::**'

.r e '*

I g y .hy 44  !

' '~'

.~..

• 24 y

,d -

==

3[j));.;!

2 f

4

'~I~' p _

Ie

{Q g- /j

.1.r-. t.13 l?

TORNADO DAMPERS

• O ;i. .@ E.ll I AUXILIARY BUILDINGS PLAN AT EL 659'-0" d. .= =gJ A g rngqp5gL'~ \,

25,26 . 5~ 30 f 1 ~5

. , . pm l ,,,s\;_F__" Et- ,,y Ke N -

.. _ls a = 'y_ ^.'

'7

/ J F- 13 u gox .- i j 16 x x -._ o,-,/%-i_4,J ,. -.-  : ._ : q _

==r' Pr - - h pH .

{9.PgyT- f,g, g~il. m.l H. $d=%(:p%?.Q

~

o a

,.~_ _. .,,g m, w i.

l e e i

4, e y.491mTg_g=Jm=_E=E.

_g

/g

! umino unuS i tuo 2 FIGURE l-1 G-252718 TORNADO MISSILE DESIGN 5/27/82 l

l

i LOCATION OF CONTROL ROOM t i INTAKE HVAC TORNADO DAMPERS PARTIAL PLAN '

ELEVATION 694'-0" II O .G G @ @

) <-

....t.

,l

,eme-

!<,j gf.m..

,brm: , Ty*.-

. . ., ~ k

=

2 I o\

\

W l

i

%',8s

-w ll \ ;r\s A .

.a, , ,.mQ,

!=4 * '

2

'. f

.. p%:

g;('4[.}[e A - jiyhk \

4 ' , ,-}E ;j -- [.M.

, [e ' -kipF,f. 4. T_ ,..

I 3

~.;am

~

} r-b,;y'I =s u

.n;<[g t _ _ . __.>.

./. ".#i. t :p; I. 4 wh .,l;QC"7 i '

t$ 5 ( W 'h.is. ,j ,c ., ~ ~ ~ B ~ '

_lt 2 '51Milf f$iQ1: d.,Etukh 5 ~ &'

c-- Sf TOC 697'-6"

[.' g',a.- e.:J  ;.$,'35";:. (p;r.J TOC 697'-6" --

?] F...P ,'

r., . - -]l r r I

, _ ,-- _ . t CONTROL ROOM INTAKESIDAMPERS (BOTTOM 697'-0")

FIGURE l-2 MIDLAND UNITS I AND 2 G-2527 19 TOFINADO MISSILE DESIGN 5/25/82

. _ _ . . . . _ . - - _ __ - - . - - - - . . . . . _. -.. . - _ . _ _ _ - . . - _ - _ . - . __ _ _ _ . _ _ - . _ . . - - - . _ . _ . _ _ . - . _ . . . _ . . _ _ _ . . , - . . - . . -