Text

Revised Pages to Chapter 7 of Severe Accident Risk Assessment
	ML20076L237
Person / Time
Site:	Limerick
Issue date:	07/15/1983
From:	; PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC
To:	;
Shared Package
ML20076L214	List: ML20076L213; ML20076L237; ML20076L246;
References
	NUDOCS 8307190092
	Download: ML20076L237 (136)
	v • d • e

_ _ . _ ._ . . . . . . _ . _. _ __ .. . . _ _ . _ . . . ~ ._ . _ . _ . . _ _ . _

i i

List of Revised Pages 6

Volume I 1 Replace pages iv-xvii with pages iv-xxv pages 4-24 j -- 4-29 12-27

+

12-28 i

figures 4-1 4-3 4-5 i 4-6

{. 4-7 Volume II l Replace pages iv-viii with pages iv-xii i

! pages D-13

!- D-14 i D-16

D-17 i D-18 j D-21 D-26

. D-28 i D-32

! figures D-9 D-10 D-ll D-13 D-14 i

{

i l

t

[

11 8307190092 830715 PDR ADOCK 03000352 pyg

.-. .- . ,.....-- _ .. --. -.,.-----. . . - . , , . ~ . . . . . . . . - . - . - _ - - . , - - .-.;_.-...-...-

CONTENTS (Continued)

..Q O. Page

4.4.4.2.2 Self-Ignited Cable Fires in Raised Floor Sections and Overhead Cable Raceways 4-24 4.4.4.3 Transient--Combustible Fires 4-24 4.4.4.3.1 Frequency and Nature of Transient-Combustible Fires 4-25 4.4.4.3.2 Effect on Equipment in Cabinets 4-25 4.4.4.3.3 Effects on Cables in Aluminum Gutters 4-26 4.4.4.3.4 Critical Location of Transient--Com- ;

bustible Fires 4-27 4.4.4.3.5 Evaluation of Core-Melt Frequency 4-28 4.5 Results 4-28 4.6 Uncertainties in the Fire Analysis 4-29 4.6.1 Fire Frequencies 4-29 >

4.6.2 Fire-Propagation Modeling 4-30

, -4.6.3 Fire-Suppression Model 4-30 4.6.4 Conclusion 4-30 REFERENCES 4-31 5 ANALYSIS OF ACCIDENTS RESULTING FROM FLOODING 5-1 5.1 Introduction 5-1 5.2 External Flooding 5-1 O' 5.3 Internal Floods 5.3.1 Introduction 5-4 5-4 5.3.2 ' Summary of Protection Measures Against Internal ,

' Flooding at LGS .

5-4 5.3.3 Method of Analysis for Evaluation of Flood-Induced Accident Sequences 5-5 +

5.3.3.1 General Method of Analysis 5 3 5.3.3.2 Independence of Plant Areas with Respect to Flooding 5-7 5.3.3.3 Evaluation of Flood Frequencies 5-7 t 5.3.3.4 Screening Criteria 5-8 5.3.3.5 General Assumptions Made Throughout Analysis 5-9 5.3.4 Analysis.of Flooding-Induced Accident Sequences 5-10 5.3.4.1 Introduction 5-10 5.3.4.2 Analysis of Turbine Enclosure- 5-10

'5.3.4.2.1 Independence 5-11 5.3.4.2.2. First-Level Analysis of Turbine-

_ Enclosure Flooding 5-12 5.3.4.3 Diesel-Generator Enclosure 5-12 5.3.4.3.1 Independence from other Structures - 5-13 4

5.3.4.3.2 First-Level Analysis of Diesel-Enclosure Flooding 5-13 5.3.4.4 Reactor Enclosure- 14 5.3.4.4.1 Independence- 5-14 iv 07/15/83 p

t

m. _

. . =- - . - ~ . - - _ -- _ . ,_.

CONTENTS (Continued)

/

Page 5.3.4.4.2 First-Level Analysis Reactor-Enclosure Flooding 5-15 ;

5.3.4.4.3 Second-Level Analysis of Reactor-Enclosure Flooding 5-15 5.3.4.4.4 Third-Level Analysis of Reactor-Enclosure Flood Area RB-FL15 (Elevation 283 Feet) 5-21 5.3.4.4.5 Third-Level Analysis of Reactor Enclosure Flood Area RBFLll (Elevation 217 Feet) 5-24 5.3.4.4.6 Third-Level Analysis of Reactor Enclosure Flood Area RBFLl4 (Elevation 253 feet) 5-25 5.3.4.5 Control Structure 5-26 5.3.4.5.1 Independence of Control Enclosure 5-27 5.3.4.5.2 First- and Second-Level Analyse 4 5-27 5.3.4.5.3 Third-Level Analysis of the Control Structure 5-27 5.3.4.6 Spray Pond Pump Structure 5-31 5.3.4.6.1 Independence from other Structures 5-31 5.3.4.6.2 First Level Analysis 5-31 5.3.4.6.3 Second Level Analysis 5-32 5.3.5 Special Concerns 5-32 7-~s 5.3.5.1 Introduction 5-32 5.3.5.2 Failure of Scram-System-Pipework Integrity 5-33 5.3.5.3 Large Water-Storage Facilities 5-34 5.3.5.3.1 Suppression Pool 5-34 5.3.5.3.2 Spent Fuel Pool 5-34 5.3.6 Conclusions 5-35 References 5-36 6 ANALYSIS OF ACCIDENTS RESULTING FROM TORNADOES 6-1 6.1 Introduction- 6-1 6.2 Design Features that Protect the LGS Plant From the Effects of 'Ibenadoes 6-2 '

6.3 Effects on the Plant and Categorization of Tornadoes 6-3 6.3.1 Introduction 6-3 6.3.2 Tornadoes with Severity Less Than the Design Basis 6-3 6.3.3 Tornadoes at or Above the Design Basis 6-4 6.3.4 Tornado Missiles 6-4 6.4 Tornado Frequencies 6-5 6.4.1 Introduction 6-5 6.4.2 Tornado Characteristics and Risk Models 6-6 6.4.3 Frequencies of the Tornado Categories 6-8 6.5 The Contribution of Tornadoes to Core-Melt Frequency and the Effects on Risk- 6-10 l /

O y l . 07/15/83 l

CONTENTS (Continued)

O Page 6.5.1 Tornadoes Below the Design Basis 6-10 6.5.2 Tornadoes Above the Design Basis 6-12 6.5.3 Conclusions 6-12 References 6-13 7 PUBLIC RISK DUE TO TRANSPORTATION AND RELATED ACCIDENTS IN DIE VICINITY OF THE SITE 7-1 7.1 Toxic-Vapor Clouds 7-1 7.1.1 Current Arrangements for the Detection of Toxic Vapors and Preventative Countermeasures 7-2 7.1.1.1 Vapors Requiring Automatic Detection and Automatic Isolation 7-2 7.1.1.2 Vapors Requiring Automatic Detection 7-2 7.1.1.3 Vapors Detected by Smell 7-2 7.1.2 Calculation of Public Risk--General Considerations 7-3 ,

7.1.3 On-Site Chlorine 7-4 7.1.3.1 Spontaneous Failure of Chlorine Tank Cars 7-5 7.1.3.2 Earthquakes Leading to Chlorine Release 7-5 7.1.3.3 Chlorine Leaks Caused by Shunting Accidents 7-6 7.1.3.4 Leakage of Chlorine While Car is Being Connected or Discharged 7-6 7.1.3.5 Size of Leaks 7-7 7.1.3.6 Dispersion of Chlorine 7-7 7-8 ON 7.1.3.7 7.1.3.8 Detection and Isolation capability Effect on Operators 7-11 7.1.4 Railroad 7-11 7.1.4.1 Frequency of Crash Leading to Toxic Release 7-12 7.1.4.2 Automatic Detection and Isolation 7-13 7.1.4.3 Automatic Detection and No Automatic Isolation 7-14 i 7.1.4.3.1 Frequency of Excessive Concentra- l tions at Control Room Air Intake 7-14 7.1.4.3.2 Probability of Detector Failure 7-15 7.1.4.3.3 Probability of Failure to Don Masks 7-17 7.1.4.3.4 Overall Frequency of Core Melt 7-l' 7.1.4.4 Detection by Smell 7-1; 7.1.4.4.1 Failure to Detect by Smell and Don Breathing Masks 7-18 7.1.4.4.2 Overall Frequency of Core Melt 7-18 7.1.4.5 Other Toxic Vapors Transported on the Railroad 7-19 7.1.5 Hooker Chemical Plant 7-19 7.1.5.1 Vinyl Chloride and Phosgene 7-19 7.1.5.1.1 Predicted Frequency of Release 7-19 7.1.5.1.2 Wind Direction 7-20 O vi 07/15/83

_ _ _ __ - - . - . . _ ____.__________.___m-. -

CONTENTS (Continued)

Pagg 7.1.5.1.3 Failure Probability of Automatic Detectors 7-20 7.1.5.1.4 Failure to Don Breathing Masks 7-20 7.1.5.1.5 Probability of Core Melt Condi-tional on Operator Incapacitation 7-20 '

7.1.5.1.6 Overall Frequency of Core Melt 7-20 8

7.1.5.2 Vinyl Acetate 7-20 7.1.5.3 Other Chemicals at the Hooker Site 7-21 7.1.6 Highway 7-21 7.1.6.1 Chemicals Detected by Smell 7-21 7.1.6.2 Chlorine Trifluoride 7-22 7.1.6.2.1 Operation of Automatic Detectors 7-22 7.1.6.2.2 Detection by Smell 7-22 7.1.6.3 Other Chemicals in Table 7-12 7-22 7.1.7 Summary - Toxic Vapor Analysis 7-22 7.2 Explosion 7-23 7.2.1 Analytical Models 7-23 7.2.1.1 General 7-23 7.2.1.2 Frequency of Shipment 7-25

7.2.1.3 Size of Region I 7-25 ,

7.2.1.4 Dispersion Model 7-27 i

^

7-30 7.2.1.5 Vapor-cloud Ignition _

Accident Rate and Accident Severity Assessment 7-31 O

7.2.2 ,

7.2.2.1 Pressurised Tank Car Loss-of-Lading Rate 7-31 !

7.2.2.2 Spill Size Distribution 7-31 ,

7.2.2.3 Severity of Loss-of-Lading Accidents 7-31 7.2.3 Meteorology 7-32 7.2.4 Results of the Analysis 7-33 2

7.2.5 Solid Explosives 7-34 .

7.3 Fires 7-34 7.3.1 Fires Considered in the LGS FSAR 7-34 7.3.1.1 ARCO Pipeline Rupture (FSAR Section '

2.2.3.1.1 and 2.2.3.1.2) 7-34 7.3.1.2 Columbia Gas Transmission Company Natural Gas Pipelines (FSAR Section 2.2.3.1.2) 7-35 7.3.1.3 Railroad Fire 7-35

. 7.3.2 Fires Considered in the Present Analysis 7-35 7.3.2.1 Pool Fire on the Railroad 7-36 7.3.2.2 Fireball at the Site of the Crask 7-36 7.3.2.3 Ignition of a Drifting Cloud 7-37 7.4 Aircraft Accidents 7-38 References 7-39 8 ANALYSIS OF ACCIDENTS RESULTING FROM TURBINE MISSILES 8-1

8.l' Introduction 8-1 8.2 Analysis of Frequency of Damage Resulting From Turbine Missiles 8-1 >

References 8-4 O vii 07/15/83

_._.._.__-__-..._._._____._.,_..,...-.-....a.__--_ -

CONTENTS (Continued)

Page 9 ACCIDENT CLASSES AND REPRESENTATIVE SOURCE TERMS 9-1 9.1 Introduction 9-1 9.2 Accident Classes and Radionuclide Source Terms 9-2 9.2.1 Description of Accident Classes 9-2 9.2.2 Containment-Failure Modes 9-3 9.2.3 Calculation of Source-Term Magnitudes 9-4 9.2.3.1 OXRE Source Term 9-4 9.2.3.2 OPREL Source Term 9-5 9.2.3.3 Source Term Involving class IV (ATWS) 9-5 9.2.3.4 C1237" Source Term 9-6 9.2.3.5 LEAK 1 and LEAK 2 Source Terms 9-6 9.2.3.6 RB Source Term (Class IS) 9-7 9.2.3.7 VR and VRH2O Source Terms (Class S) 9-7 9.2.4 Release-Fraction Uncertainties 9-7 9.2.4.1 Uncertainties in the Release Fractions for the OXRE (Steam Explosion) Source Term 9-8 9.2.4.2 Uncertainty in the Release Fractions for the ATWS Source Term 9-9 9.2.4.3 Uncertainty in the Release Fractions for the OPREL Source Term 9-9 9.2.4.4 Uncertainties in Release Fractions for Seismically Induced Sequences and

(N Random Reactor-Vessel Failures 9-9

( 9.3 Frequencies of Source Terms 9-10 10 ANALYSIS OF OFFSITE CONSEQUENCES 10-1 10.1 Data Requirements 10-1 10.1.1 Basic Radionuclide Data 10-1 10.1.2 Specification of the source Term 10-2 10.1.2.1 Frequency 10-2 10.1.2.2 Gource-Term Magnitudes 10-3 10.1.2.3 Times of Release 10-3 10.1.2.4 Duration of Release 10-4 10.1.2.5 Warning Time 10-4 10.1.2.6 Rate of Release of Heat 10-5 10.1.2.7 Dimensions of the Release 10-6 10.1.3 Meteorological Data 10-6

, 10.1.4 Deposition Data 10-6 10.1.5 Population Distribution 10-8 10.1.6 Evacuation and Other Protective Measures That Reduce Radiation Doses 10-8 10.1.6.1 Evacuation 10-8 10.1.6.1.1 Values of Re, R1 and 10-8 10.1.6.1.2 Time Delay Before Evacuation 10-9 10.1.6.1.3 Evacuation Speed 10-10 O

\ )

viii 07/15/83 l

l

l.

i CONTENTS (Continued)

O Page I

10.1.6.1.4 Maximum Distance of Travel While Evacuating 10-11 10.1.6.1.5 Special Sheltering Zone, Radius 2 10-11 10.1.6.2 Shielding 10-11 10.1.6.3 Discussion 10-13 10.1.6.4 Breathing Rates 10-13

10.1.6.5 Evacuation and Sheltering in the Event of an Earthquakes 10-14 10.1.6.6 Summary 10-15 10.1.7 Heath-Physics Data 10-15 10.1.8 Economic Data 10-16 10.2 Point-Estimate Results and Selection of Sequences for Sensitivity Studies 10-17 10.2.1 Point-Estimate Risk of Early Fatalities 10-17 10.2.2 Point-Estimate Risk of Latent-Cancer Fatalities 10-18 10.2.2.1 Latent-Cancer Fatalities Among the Population to 500 Miles (Excluding Thyroid Cancers) 10-18 10.2.2.2 Latent-Cancer Fatalities Among the Population to 50 Miles (Excluding Thyroid Cancers) 10-18 10.2.2.3 Thyroid-Cancer Fatalities 10-18

(-~s) 10.2.3 Point Estimate of the whole-3ody Population Dose 10.2.4 Individual Dose Impacts from Early Exposure--Point 10-19 Estimates of Bone-Marrow Doses of 200 Rem or More 10-19 10.2.5 Offsite Costs 10-19 10.2.6 Individual Risk of Early Fatality 10-19 10.2.7 Summary of Senstivity Studies 10-20 10.3 Treatment of Uncertainties in Consequence Analysis 10-20 10.3.1 Characteristics of the Source Terms 10-21 10.3.1.1 Class (ATWS) Source Terms (C47, C47', C47") 10-21 10.3.1.2 Vessel-Failure Source Terms (VR and VRH2O) 10-22 10.3.1.3 OPREL Source Term 10-23 10.3.1.4 RB (Reactor-Enclosure Failure) Source Term 10-23 10.3.2 Evacuation Assumptions 10-23 10.3.3 Heath-Effects Modeling 10-25 10.3.3.1 Latent-Cancer Fatalities 10-25 10.3.3.2 Early Fatalities 10-26 10.3.4 Discussion 10-26 10.3.4.1 Dry-Deposition Modeling 10-26 10.3.4.2 Rainfall Modeling 10-27 10.3.4.3 Straight-Line, Trajectory, and Multipuff Models 10-27 1 References- 10-29 I I

O ix 07/15/83

CONTENTS (Continued)

} P,a21 11 UNCERTAINTY ANALYSIS 11-1 11.1 Introduction 11-1 11.2 Types and Sources of Uncertainty 11-2 11.2.1 Types of Uncertainty 11-2 11.2.1.1 Parameter Uncertainties 11-2 11.2.1.2 Modeling Uncertainties 11-2 11.2.1.3 Completeness Uncertainties 11-2 11.2.2 Sources of Uncertainty 11-3 11.2.2.1 Accident-Sequence Analysis 11-3 11.2.2.2 Analyses of Containment Responses, In-Plant Accident Processes, Radionuclide Transport, and Offsite Consequences 11-3 11.3 Methodological Framework 11-4 11.3.1 Measures of Uncertainty 11-4 11.3.1.1 Introduction 11-4 11.3.1.2 Uncertainties of the Input Parameters of the System Analysts 11-5 11'.3.1.3 Uncertainties Associated with the Modeling of In-Plant and Offsite Consequences 11-6 11.3.2 Uncertainty-Analysis Framework 11-7 11.4 Uncertainty Analysis 11-8 7- 11.4.1 Core-Melt Frequency 11-8 11.4.2 Risk of Early Fatalities 11-10 11.4.2.1 Probability Distributions on Frequencies of Representative Source Terms 11-10 11.4.2.2 Probability Distributions on Conditional CCDFs 11-11 11.4.2.3 Probability Distributions on CCDFs 11-12 11.5 Other Measures of Risk 11-13 REFERENCES 11-14 12 RESULTS AND CONCLUSIONS 12-1 12.1 Introduction 12-1 12.2 The Analysis 12-2 12.2.1 The Structure of the Study 12-2 12.2.2 Quantification and Uncertainty Analysis 12-2 12.3 Core-Melt and Accident-Sequence Frequencies 12-4 12.3.1 Core-Melt Frequency 12-4 12.3.2 Dominant Contributors to Core Melt 12-5 12.4 Accident-Class Frequencies and Associated Source Terms 12-5 12.4.1 Accident-Class Frequencies 12-5 12.4.2 Source Terms 12-7 12.5 Public Risk 12-8 12.5.1 Representation of Public Risk 12-8 12.5.2 The CCDFS 12-9 12.5.3 Early Fatalities--Interpretation and Perspective- 12-11' 12.5.3.1 Dominant Contributors to Risk 12-11 12.5.3.2 Risk Perspective 12-12 X

07/1S/83 x .

CONTENTS (Continued)

)

J Page 12.5.3.3 Comparison with Other Studies 12-13 12.5.3.3.1 LGS PRA 12-13 12.5.3.3.2 The Reactor Safety Study 12-13 12.5.4 Latent-Cancer Fatalities--Interpretation and Perspective 12-14 12.5.4.1 Dominant Contributors to Risk 12-14 12.5.4.2 Comparison with Other Studies 12-14 12.5.4.3 Other Measures of the Risk of Latent-Cancer Fatality 12-15 12.5.4.4 Risk of Latent-Cancer Fatality in Perspective 12-15 12.5.5 Whole-Body Population Dose 12-15 12.5.6 Individual Dose Impacts 12-16 12.5.6.1 Bone-Marrow Dose of 200 Rem or More from Early Exposure 12-16 12.5.7 offsite Costs (Decontamination, Relocation, etc.) 12-16 12.5.8 Individual Risk of Fatality 12-18 12.5.8.1 Individual Risk of Tiarly Fatality 12-18 12.5.8.2 Individual Risk of Cancer Fatality 12-19 12.5.9 Future Trends 12-19 REFERENCES 12-21 O

O xi 07/15/83

_ _ . ~ . .. - _ _. _. _ _ __. __ _ _ _. _

CONTENTS (Continued)

Page VOLUME II: APPENDIXFS 4

Appendix A SEISMIC GROUND MOTION HAZARD AT LIMERICK GENERATING STATION Appendix B CONDITIONAL PROBABILITIES OF SEISMIC-INDUCED FAILURES FOR STRUCTURES AND COMPONENTS FOR TF'. LIMERICK GEN-ERATING STATION UNIT 1 Appendix C THE ANALYSIS AND QUANTIFICATION OF SEISMIC ACCIDENT I SEQUENCES Appendix D FIRE ANALYSIS AND SUPPORTING DATA Appendix E SOURCE-TERM UNCERTAINTY ANALYSIS 4 -Appendix F DESCRIPTION OF THE CONSEQUENCE MODEL 1

Appendix G DETAILS OF THE UNCERTAINTY ANALYSIS l

l Appendix H SUPPORTING DATA POR FIDODING ANALYSIS I

xii 07/15/83

---,.-v.,- - e,, r ,-vm. -y, , n v ,, .+--v-, - -- . -

% LIST OF TABLES 1 1

Page 2-1 List of LGS PRA initiating events 2-12 2-2 Generic accident-sequence classes 2-13 3-1 Significant earthquake-induced failures 3-16 3-2 Dominant seismic core-melt sequences 3-17 3-3 Description of dominant seismic accident sequences 3-18 4-1 Systems or components associated with shutdown methods 4-32 4-2a Estimated conditional probabilities of fire-induced acc'd?.;t sequences initiated by an MSIV enclosure and frequencies of pertinent accident classes (screening analysis) 4-33 4-2b Estimated conditional probabilities of fire-induced accident sequences initiated by a manual trip and frequencies of pertinent accident classes (screening analysis) 4-34 4-2c Annual frequency of fire-induced accident sequences initiated by an inadvertently opened relief valve 7g (screening analysis) 4-35

( ( }

4-2d Estimated annual frequency of fire-induced accident sequences initiated by a turbine trip (screening analysis) 4-36 4-3 Fire zones in which fires are potential contributors to core-melt frequency 4-37 4-4 Critical locations of transient combustible materials in the auxiliary equipment room 4-37 4-5 Evaluation of sequence frequencies of oil fires (transient combustibles) 4-38 4-6 Summary of fire-analysis results 4-39 5-1 Effect of internal turbine enclosure flooding on risk 5-37 5-2 Effect of diesel enclosure internal flooding on core-melt frequency 5-38 5-3 Flood independent areas within the reactor enclosure which contain equipment for safe plant shutdown 5-39 5-4 Flood-induced accident sequence frequencies for reactor

_s enclosure - level 2 analysis 5-42 V

xiii 07/15/83 1

P LIST OF TABLES (continued)

Page 5-5 Frequency of gross rupture in service-water systems pipework located in flood area RB-FL15 5-45 6-1 Characteristics of selected missiles generated by the design-basis tornado 6-15 6-2 Tornado-protected systems and their tornado-resistant enclosures 6-16 6-3 FPP classification scheme for tornadoes 6-17 6-4 Number of tornadoes as a function of F-scale rating, 1965 and 1971-1975 6-18 7-1 Failure rate for components of tank-car-unloading pipe and connector 7-44 7-2 Distribution of chlorine spill size from stationary railroad tank cars 7-45 7-3 Failure data for chlorine detection and isolation capability 7-46 7-4 Onsite-chlorine-release calculations 7-47 7-5 Conrail survey results

. 7-48 7-6 Summary of chlorine railroad calculations 7-49 7+7 Probabilities of the various blocks on Figure 7-9 7-50 7-8 Frequency of core melt due to railroad accidents:

toxic vapors (other than chlorine) with automatic detection 7-51 7-9 Predicted frequency of core melt due to railroad accidents: toxic vapors detected by smell 7-52 7-10 Chemicals at Hooker Chemical Plant 7-S3 7-11 Summary of calculation of bounding core-melt fre-quencies - Booker Chemical Plant 7-55 7-12 Chemicals carried on highway 7-56 i 7-13 Highway spillages of materials that are detected by l smell--bounding calculations of contributions to core l- O melt 7-57 l NY l xiv 07/15/83-

LIST OF TABLES (continued)

Page 7-14 Toxic-vapor analysis--summary of contributions to bounding estimates of core-melt freuqency 7-58 7-15 Hazardous chemicals of interest 7-59 7-16 Commodity-dependent input parameters 7-60 7-17 Incidents used to compile probability distributions 7-61 7-18 Distribution of explosion yields 7-62 7-19 Rail spills of liquefied flammable gases: correlation of percentage of spills and quantity of spillage 7-63 7-20 Mechanical damage-induced loss-of-lading accident i severity 7-64 7-21 Railroad-tank-car accident data 7-65 7-22 Meteorological data used in analysis of explosive-vapor hazards 7-66 9-1 Radiont;iide release fractions 9-14 9-2 Radionuclide release parameters and release fractions for dominant accident sequences and containment-failure

~

modes listed in Table 3.5.14 of the LGS PRA 9-15 9-3 Range of steam-explosion source terms for uncertainty analyses 9-16 9-4 Range of ATWS source terms for sensitivity studies 9-17 9-5 Range of OPREL source terms for sensitivity studies 9-18 9-6 Range of release fractions for seismically induced

, accident classes 9-19 ,

9-7 Frequencies of source terms in terms of accident-class frequencies and probabilities of containment-failure modes 9-20 9-S Source-term frequencies 9-21 XV 07/15/83

~

LIST OF TABLES (continued)

Page 10-1 Activity in the Limerick reactor core at 3293 MWt 10-31 10-2 Permanent year 2000 resident population for the Limerick site 10-33 10-3 Cumulative permanent-resident population for the Limerick site in the year 2000 10-34 10-4 Representative shielding factors 10-35 10-5 Breakdown of mean frequencies into six acceleration ranges 10-36 10-6 Earthquake effects corresponding to modified Mercalli intensity levels 10-3 10-7 Effect of earthquakes on the effectiveness of evacuation 10-38 10-8 Summary of input values for the CRAC2 evacuation model 10-39 10-9 Summary of input values--sheltering factors 10-40 f- s 10-10 Non-site-specific economic input data 10-41 r

10-11 Limerick-specific economic data 10-42 10-12 Point-estimate contributions to the public risk of early fatalities 10-44 10-13 Point-estimate contributions to the public risk of latent-cancer fatalities (excluding thyroid): population out to 500 miles 10-45 10-14 Point-estimate contributions to the public risk of latent-cancer fatalities (excluding thyroid): population out to 50 miles 10-46 10-15 Point-estimate contributions to the ptblic risk of thyroid-cancer fatalities: population out to 500 miles 10-47 10-16 Point-estimate contributions to the public risk of thyroid-cancer fatalities: population out to 50 miles 10-48 10-17 Point-estimate contributions to the area under the CCDF for the whole-body population dose to 500 miles 10-49 10-18 Point-estimate contributions to the area under the CCDF for the whole-body population' dose to 50 miles 10-50 l O l -(v) i xvi l

07/13/83 o

LIST OF TABLES (continued)

Page 10-19 Point-estimate contributions to the area under the CCDF for the number of people receiving a bone-marrow dose of 200 rem or more from early exposure 10-51 10-20 Point-estimate contributions to offsite economic risk 10-52 10-21 Point-estimate contributions to the individual risk of early fatality at 0.75 miles downwind 10-53 10-22 Summary of source terms chosen for sensitivity studies 10-54 10-23 Sensitivity study for the C47" source term 10-55 10-24 Sensitivity study for the C47 and C47' source terms 10-56 10-25 Sensitivity study for the source terms VR and VRH2O 10-57 10-26 Sensitivity study for the source term OPREL 10-58 10-27 Sensitivity study for source term RB 10-59 10-28 Example of the sensitivity of the distances to which 10-60

( consequences occur for various deposition velocities 11-1 Major sources of uncertainty considered in the analysis of radionuclide source terms 11-15 11-2 Major sources of uncertainty considered in the offsite-consequence analysis 11-16 11-3 Core-melt frequencies 11-17 11-4 The dominant core-melt sequences of the LGS PRA 11-18 11-5 Percentiles of the frequencies of accident classes that contribute to early fatalities 11-19 11-6 Seismic vessel failure with early containment-failure, early fatalities 11-20 11-7 Parameters of the legnormal distributions on conditional CCDFs as 'a function c2 the number of deaths 11-21 12-1 ' Core-melt frequency 12-22 12-2 Contributions of basic functional failures to core-melt frequency based on point estimates 22 xvii 07/15/83

LIST OF TABLES (continued)

Page j 12-3 Dominant contributors to core-melt frequency 12-23 12-4 Generic accident-sequence classes 12-26 12-5 Classification of core-melt sequences 12-27 i 12-6 Accident-clasc frequencies 12-29 !

12-7 Source-term characteristics--point estimates 12-30 !

i ;

12-8 Frequencies of the source terms given in Table 12-7 12-31 12-9 Areas under CCDFs 12-32 t

=

d xviii 07/15/83

,a-, . , . - , v, , . ~ . ~.. . - - , _ . , , _ _ . . , - . . , . . - . .. .-. -- , ~ . - . . . , , , - - . . . - . .

l p)

\~-

LIST OF FIGURES l

\

l Page 1 Probability distribution on total core-melt frequency 2 CCDFs for early fatalities 3 CCDFs for latent-cancer fatalities 2-1 PRA information flow 2-2 Display of uncertainties in a complementary cumulative distribution function 3-1 Analysis of seismic accident sequences 3-2 Seismicity in the vicinity of the Limerick site 3-3 The Piedmont seismogenic zone 3-4 The steps involved in the evaluation of seismic hazards 3-5 Annual frequency of exceedence versus peak acceleration for n all seismogenic zones i

3-6 Failure probabilities for equipment and structures 3-7 Seismic event tree for Limerick Unit 1 3-8 Seismic event tree for loss of offsite power with reactor scram 3-9 Seismic event tree for loss of offnite power without scram 3-10 Containment event tree for class S(TsRPV) sequences 4-1 Layout of fire zone 44 4-2 Typical cable-raceway arrangement illustrating the fire-growth stages considered in the analysis 3 Unquantified fire-growth event tree 4-4 Fire-suppression model 4-5 Fire-growth event tree for self-ignited cable-raceway fires in fire zone 44 4-6 Fire-growth event tree for transient-combustible fires in fire zone 44 xix 07/15/83 l

l l

LIST OF FIGURES (continued)

Page 4-7 Fire-growth event tree for self-ignited panel fires in fire zone 44 4-8 Arrangement of the auxiliary equipment room 4-9 Arrangement of the auxiliary equipment room 4-10 Heat-flux curves 5-1 Generalized plan of Limerick Generating Station

, 5-2 Transient-event tree for closure of main-steam isolation valve, loss of feedwater, and loss of main condenser resulting from turbine-enclosure flooding 5-3 Event tree for manual shutdown resulting from flooding of diesel-generator rooms 5-4 Cross-sectional view of reactor enclosure at Limerick Generating Station n/ 5-5 Cross-sectional view of control enclosure at Limerick s,, Generating Station 6-1 Plot plan of Limerick Generating Station 6-2 Histogram of number of tornadoes as a function of F-scale rating 6-3 Damage area per path length (DAPPLE) as a function of F-scale rating 6 Definition of boundary of touchdown area for tornado impacting a target 6-5 MSIV closure / loss.of feedwater/ loss of main condenser transient-event-tree 7-1 Fault-tree-like representation of toxic-vapor release 7-2 Event tree illustrating effect of chlorine on operators 7-3 Event tree illustrating effect of toxic vapor on operators in control room--automatic detection but no automatic isolation I

1 Xx 07/15/83 l

( l o ,

. -- _ _ .._ ._ l

I l

LIST OF FIGURES (continued)

Page 7-4 Event tree illustrating effect of toxic vapors on operators in control room--detection by smell 7-5 Isolation-system scehmatic 7-6 Reliability block diagram of detection and isoaltion system 7-7 Fault tree for detection and isolation system 7-8 Failure probability versus time for operators 7-9 Simple reliability diagram of a MIRAN 801 unit 7-10 Simplified event tree for explosions due to accidents on railroad 7-11 Region definitions for analysis of explosions 7-12 Probability of flammable-plume ignition versus plume area at time of ignition l

7-13 Railroad loss-of-lading quantity normalized at maximum

\ car load of 33,000 gallons 7-14 Frequency with which peak incident overpressures are exceeded at the diesel-generator building and reactor-control enclosure 8-1 Turbine-missile ejection zone--plan view 8-2 Turbine-missile ejection zones--elevations 10-1 Point-estimate CCDF for early fatalities--internal and fire-initiated events 10-2 Point-estimate CCDF for early fatalities from seismically initiated events 10-3 Point-estimate CCDF for latent-cancer fatalities among the population out to 500 miles--internal events 10-4 Point-estimate CCDF for latent-cancer fatalities among the population out to 500 miles--fire-initiated events 10-5 Point-estimate CCDF for latent-cancer fatalities among the population out to 500 miles--seismic events O xxi 07/15/83 1

LIST OF FIGURES (continued)

/~

Page 10-6 Point-estimate CCDF for whole-body population dose among the population out to 500 miles--internal events 10-7 Point-estimate CCDF for whole-body population dose among the population out to 500 miles--fire-initiated events.

10-8 Point-estimate CCDF for whole-body population dose among the population out to 500 miles--seismic events i 10-9 Point-estimate CCDF for the number of people receiving a bone-marrow dose of 200 rem or more--internal and fire-initiated events 10-10 Point-estimate CCDF for the number of people receiving a bone-marrow dose of 200 rem or more--seismic events r

10-11 Point-estimate CCDF for offsite costs--internal events 10-12 Point-estimate CCDP for offsite costs--fire-initiated events 10-13 Point-estimate CCDF for offsite costs--seismic events 10-14 Point-estimate individual risk of early fatality as a function of distance--internal and fire-initiated events 10-15 Point-estimate individual risk of early fatality as a function of distance--seismic events 10-16 Effect on conditional CCDF for early fatalities--variations in C47" source term 10-17 Effect on conditional CCDF for early fatalities--variations in C47 and C47' source terms 10-18 Effect on conditional CCDF for latent-cancer fatalities (excluding thyroid)--variations in class IV source terms 10-19' Effect on conditional CCDF for early fatalities--variations in vessel-failure source terms 10-20 Effect on conditional CCDF for latent-cancer fatalities (excluding thyroid)--variations in vessel-failure source terms 10-21 ~Effect on conditional CCDF for latent-cancer fatalities (excluding thyroid)--variations in OPREL source terms l

xxii 07/15/83 l 1

-. . .- .. - - - . - . . - . . - - - - - . , --- -- -,+ - - - - - - - l

LIST OF FIGURES (continued)

Page 10-22 Effect on conditional CCDF for latent-cancer fatalities (excluding thyroid)--variations in RB source term 10-23 Effect on conditional CCDF for early fatalities--variations i in evacuation strategies for class IV source terms 1

10-24 Effect on conditional CCDF for early fatalities--variations in evacuation strategies for OXRE source terms 10-25 Effect on conditional CCDF for early fatalities--variations in evacuation delay time for class IV source terms 10-26 Effect on conditional CCDF for latent-cancer fatalities (excluding thyroid)--variations in dose-response relation-

, ships, VR source term 10-27 Effect on conditional CCDF for early fatalities--variations in dose-response relationship, VR source term 11-1 Representation of uncertainty on the value of a parameter x

( 11-2 Probability distribution on core-melt frequency for internal events 11-3 Probability distribution on core-melt frequency for fires 11-4 Probability distribution on core-melt frequency for seismic events 11-5 Probability distribution on total core-melt frequency 11-6 Construction of percentiles of CCDFs from the distributions on the frequency of exceeding N deaths 11-7 CCDFs for early fatalities from internal and external initiating events 12-1 Structure of a probabilistic risk assessment 12-2 Probability distribution on core-melt frequency for internal events 12-3 Probability distribution on core-melt frequency for fires 12-4 Probability distribution on core-melt frequency for seismic events

/D V

xxiii 07/15/83

l l

LIST OF FIGURES (continued)

O Page 12-5 Probability distribution on total core-melt frequency 12-6 CCDFs for early fatalities from internal and external initiating events 12-7 CCDFs for early fatalities from internal initiating events of LGS-PRA 12-8 CCDFs for early fatalities from internal initiating events j and random reactor-vessel failure !

12-9 CCDFs for early fatalities from seismic initiating events 12-10 CCDFs for latent fatalities from internal, seismic, and fire initiating events 12-11 CCDFs for latent fatalities from internal initiating events 12-12 CCDFs for latent fatalities from fire initiating events 12-13 CCDFs for latent fatalities from seismic initiating events

~

12-14 CCDFs for latent fatalities from seismic and fire initiating events

'12-15 CCDF for latent-cancer fatalities (excluding thyroid cancer), population to 50 miles, all initiating events 12-16 CCDF for thyroid-cancer fatalities, population to 500 miles 12-17 CCDF for thyroid-cancer fatalities, population to 50 miles, all initiating events 12-18 CCDF for whole-body population dose (man-rem), population to 500 miles 12-19 CCDF for whole-body population dose (man-rem), population to 50 miles, all initiating events 12-20 CCDF for the number of people with bone-marrow dose of 200 rem or more from early exposure 12-21 CCDP for offsite costs 12-22 Individual risk of early fatality as a function of distance i -

xxiv 07/15/83

LIST OF FIGURES (continued)

Page 12-23 Median estimate of CCDFs for early fatalities, all causes 4

12-24 Upper estimates of CCDFs for early fatalities, all causes 12-25 CCDFs of early fatalities--comparison of this study with results of LGS PRA 12-26 CCDFs of early fatalities--comparison with the Reactor Safety Study 12-27 Median estimates of CCDFs for latent-cancer fatalities 12-28 Upper estimate of CCDFs for latent-cancer fatalities 12-29 CCDFs for latent-cancer fatalities--comparison with LGS PRA 12-30 CCDFs for latent fatalities--comparison with the Reactor Safety Study D

b i

O XXV 07/15/83 1

_ ~ . .-- _ _ .-- . , . - , - - - . , , - - . ._. ..-,,.. -- - ,, _, . . . . - - . _ . - - _ . . . . - . -

l The failure probability associated with event B is the product of the O conditional probability of a fire occurring in a particular panel (given a fire in the fire zone) and the conditional probability of core melt given a loss of equipment in that particular panel, summed over all panel fires that are potential contributors to risk. i l

I Conditional probability Conditional probability Panel of fire in panel (X) of core melt (Y) (X) (Y)

LOD 201 1/6 (QUX) 2.8 x 10-6 4.8 x 10-7 10D203 1/6 (QUX) 2.6 x 10-6 4.3 x 10-7 Event B fa'ilure probability 9.0 x 10-7 Event C: Fire Suppressed Before Damaging Unprotected Raceways Event C determines the conditional probability of the fire progressing to the second fire-growth stage defined in Section 4.4.3.3.1.

Fires that are sufficiently severe to propagate beyond the confinement of the panel-in which they start are considered unlikely to be suppressed before damaging adjacent cable raceways. The conditional probability of a panel fire propagating in this manner is therefore assessed as being the probability ass-i ociated with failing to prevent the fire's growing to the second stage.

In order to estimate this probability, it was necessary to apply judg-ment, since none of the reported panel fires did propagate. An upper bound would be to assume that one of the five reported fires did so.

O because flame-retardant cable insulation, which passes the IEEE 383 flame test, is used-almost without exception at Limerick (aee Section 4.2), this However, would be overly conservative. A fivefold reduction in this upper-bound value was judged to be more realistic. Event C was therefore assigned a failure ,

probability of 1/25 (0.04).

Events D, E, and F 1

Once the fire has propagated to cable raceways, the analysis proceeds in exactly the same manner as described for self-ignited cable fires in Section 4.4.3.3.3.

2 1

4.4.4 ANALYSIS OF THE AUXILIARY EQUIPMENT ROOM (FIRE ZONE 25) l

4.4.4.1 Description of the Fire Zone and Its Contents -

Fire zone 25 occupies a floor of the control structure and is located l above the control room at an elevation of 269 feet. It contains signal-con- '

ditioning components, housed in steel cabinets, and associated cabling re- l quired for the control of all safety-related and balance-of-plant equipment. !

In addition, the remote-shutdown panel, discussed in Section 4.2, is located l

-here. The arrangement of the auxiliary equipment room is shown in Figure 4-8, i O'"

4-21

-07/15/83 i

.J. - . - , - ~ , ~ - , . . . - _ _ - , - _ ..m . - . . , _ _ . . . . ~ .-. _ , ,-e - - , . , , - , , -

-. . ~ - - -. . .. - . ~ . _- - . __ -

induced core-melt frequency. The relative contributions from each type of initiating fire are as follows:

Self-ignited cable fires 57%

Self-ignited panel fires 304 Transient-combustible fires 13%

4.6 UNCERTAINTIES IN THE FIRE ANALYSIS l The frequencies of accident sequences initiated by internal events and seismic events can be quantified by evaluating an algebraic expression of parameters related to component failures, human-error probabilities, and ini-I tiating-event frequencies. A significant body of literature is available on the estimates of these parameters, and it can be used to derive generally acceptable characterizations of the uncertainty in those parameters. The propagation of these uncertainties through the above-mentioned algebraic ex-l pressions is then straightforward. In the case of the fire analysis, the methods used are less well established, and consequently the state of know-ledge about the parameters is also less well established. The details of the-fire-propagation modeling vary from room to room, depending on the layout, and involve extensive judgment. Furtheracre, it is sometimes essential to make conservative assumptions in modeling the effects of fires. For these reasons the uncertainty analysis is more difficult. In order to try to highlight the i important uncertainties, it was decided to base the uncertainty analysis on an j assessment of the-conservatisms involved in different parts of the analysis and on sensitivity analyses with respect to the different assumptions and !

parameter values.

i

. The key uncertainties in the quantification of the frequency of fire-initiated accident sequences are assessed in the sections that follow.

4.6.1 FIRE FREQUENCIES The fire frequencies are based on historical data from U.S. LWR exper-ience with some judgmental modifications to the frequencies derivable from such data. The data were used to produce overall average fire frequencies.

It is considered that, for cable fires and panel fires there are improvements in the design, materials, and construction of Limerick that warrant a reduc -

tion in frequency. The reduction in frequency was-judged to be fivefold.

!: This a potential source of nonconservatism. However, removing ' this factor is I

felt to be too pessimistic. Variations in core-melt frequency due to the sta-tistical uncertainty in the overall average fire frequencies are smaller than those given by this factor of 5.

-The frequency of transient-combustible fires is felt to be conservative if administrative controls on the use and movement of such materials are to be strictly enforced.

l 4-29 07/15/83

Table 4-6. Summary of fire-analysis results Annual contribution to core-melt frequencya Self-ignited Self-ignited Transient-Fire zone cable raceway panel combustibles Total fire fire fire 2 13-kV switchgear room 2.4-6b 3. 2 (-6) 5.9-7 6.2-6 l 20 Static inverter room 5.0-8 3.8-8 1.5-8 1.0-7 22 Cable-spreading room 6.1-8 NAc 1.9-7 2.5-7 24 Control room Negligible 1.6-7 1.0-7 2.6-7 25 Auxiliary equip-ment room Negligible 1.0-7 2.6-7 3.6-7 4 44 Safeguard access area 6.0-6 4.1-6 1.5-6 4.1-7 45 CRD hydraulic equipment area 4.7-6 1.0-6 6.6-7 6.4-6 47 General equip-ment area 1.2-6 5.2-7 1.8-7 1.9-6 l 1.3-5 6.5-6 2.4-6 2.2-5 Contribution from all other fire zones 1.0-6 Total annual core-melt frequency from fires 2.3-5

't aPoint estimates.

b 2 .4-6 = 2.4 x 10-6, CNot applicable.

I i

4-39 07/15/83

. V 4

, MCC 3 Shutdown method A (alternative)

[ raceways (protected) l " i

___3 a I 8

w________.J ,

I 4

MCC -

MCC , HPCI RCIC ,

, . racks racks (Div.II) (Div. 3)

) >

d 125'-0" Generally shutdown MCC Generally shutdown method B 4

method A raceways are routed

] '

raceways are routed on west side of on east side of fire zone -

fire zone (Divisions I and III) (Divisions II and N )

p ____ ,

f 8 44 d__- J , . i u (S/D shutdown method a MCC (alternative)

(raceways protected) Safeguard

150*0" O access area I Figure 4-1. Layout of fire zone 44.

t 07/15/83 i

i

w A B C D E F Fire suppressed Fire suppressed Undamaged before dynaging Undamaged before damaging Undamaged Fire in protected raceways systems mitigate cable raceway systems mitigate unprotected raceway systems mitigate accident given (Failure gives accident given (Failure gives accident given g FGS1 FGS1 FGS2 FGS3) FGS3 l i FGS2)

Annual-Core sequence status frequency OK OK

' OK i CM CM i

CM FGS = fire-growth stage Total core-melt frequency Figure 4-3. Unquantified fire-growth event tree.

07/15/83

m O

C D E F A B i Fire suppressed Fire suppressed Undamaged before damaging Undamaged Undamaged before damaging Fire in systems mitigate protected raceways systems mitigate cable raceway systems mitigate unprntected raceway accident given accident given (Failure gives accident given (Failure gives FGS2 FGS3) FGS3 l FGS1 FGS1 FGS2)

Annual Core sequence status frequency OK OK 4

h )

OK

.- 'i 1

2.0 x 10-2 i

9 ^ 1.0 3.4 x 104 1

4.0 x 10-1 CM ij

- / .

r, 1.7 x 10 4 i

(see note)

<* < t'g, s, l

'} .

<- (0 x 10-2 - CM 6.8 x 10-y l l

r* '

)3- -rf <

i 2.1 x 10 CM 3.6 x 10~8 1 e

$ Note:' Because o't te evaluat;on of event E, the probability of event C is not included in the evaluction of the sequence frequency. Total core-melt frequency 4.1 x 10-6

' i jl,' ,/ ,

5 FGS = fire-growth stage s

Fire-growth event tree for self-ignited cable-raceway fires in fire zone 44.

Figure 4-5.

e 07/15/83

- - O C D E F A B Fire suppressed Fire suppressed Undamaged before damaging Undamaged Sipificant Undamaged before damaging transient-combustible systems mitigate unprotected raceway systems mitigate protected raceways systems mitigate fire accident given (Failure gives accident given (Failure gives accident given FGS1 FGS1 FGS2 FGS3) FGS3 l FGS2)

Annual Core sequence status frequency OK OK OK 2.0 x 10~2 1.0 1.7 x 10-5 4.0 x 10-1 CM 3.4 x 10-7 (see note) 1.0 x 10-2 CM 6.8 x 10-8 l 2.1 x 10-4 g ,

Note: Because of the evaluation of event E, the probability of event C is not included in the evaluation of the sequence frequency. Total core-melt frequency 4.1 x 10-7 FGS = Fire-growth stage

]

Figure 4-6. Fire-growth event tree for transient-combustible fires in fire zone 44.

1 07/15/83

F

- r "

3 l

l 0 ]

l C D E F l A B l

Fire suppressed Fire suppressed Undamaged before damaging Undamaged before damaging Undamaged systems mitigate unprotected raceway systems mitigate protected raceways systems mitigate Panel fire accident given (Failure gives accident given accident gi<en (Failure gives FGS1 FGS1 FGS2 FGS3) FGS3 l l FGS2)

A.wal Core sequenu status frequency OK OK OK 2.0 x 10-2 1.0 1.3 x 10-3 4.0 x 10-2 CM 1.0 x 10-6 1.0 x 10-2 CM 5.2 x 10-7 l 9.0 x 10~7 CM t FGS = fire-growth stage Figure 4-7. Fire-growth event tree for self-ignited panel fires in fire zone 44.

T 07/15/83

- 4 - am m e-- -,, -.-u, a 4 Table 12-5. Classification of core-melt sequences Initiating- Annual frequency event type Sequence (point estimate)

CLASS I Internal TyUV 5.9-68 TyQUX 3.6-6 T TQUX 7.7-7 TEUX 6.9-7 T IUX 6.8-7 TMQUX 2.2-7 TyQUX 1.4-7 l

Seismic TsEsUX 3.15-6 Fire TyUV 2.3-5 l

CLASS II Internal TTPW(P) 3.9-7 TyQW(Q) 1.5-7 TyPW(P) 1.4-7 Seismic TsE SW 5.0-8 CLASS III Internal TkPU 2.7-7 TkUR U 2.3-7 ThM PU l.6-7 ThM12 W 1.4-7 ThgC 2 8.0-8 Seismic TSRPV EBE E 3.9-7 S

esc CM2 4.3-7 CLASS IV Internal TggW12 3.6-8 ThMC2 7.0-8 TkCR E 1.0-8 Seismic TsEsC CM2 1.1-7 12-27 07/15/83

I 2 Table 12-5. Classification of core-melt sequences (continued) k Initiating- Annual frequency event type Sequence (point estimate)

CLASS IS Seismic TRSB 9.6-7 TgR CBM 1*4~7 TgEgw 5.1-8 CLASS S Internal R 2.7-8 Seismicb TSRPVRB TSRPV[IE_ -

l T SRPVR HBE Total 4.10-7 ;

a5.9-6 = 5.9 x 10-6.

bFor description of sequences see Figure 3-10.

4 i

12-28 07/15/83

- r- --m,--,- sw- r,- - - --..m, e,m-,-,~.-m-e-w,r- - -

---p m- m - - an,.. - -- -----*-w-

_. _ . _ ~ . _ __ _ _ _

k

-, CONTENTS (Continued)

Page 4.4.4.2.2 Self-Ignited Cable Fires in Raised Floor Sections and Overhead Cable Raceways 4-24 4.4.4.3 Transient--Combustible Fires 4-24 4.4.4.3.1 Frequency and Nature of Transient-Combustible Fires 4-25 4.4.4.3.2 Effect on Equipment in Cabinets 4-25 4.4.4.3.3 Effects on Cables in Aluminum Gutters 4-26 4 4.4.4.3.4 Critical Location of Transient--Com-bustible Fires 4-27 4.4.4.3.5 Evaluation of Core-Melt Frequency 4-28 4.5 Results 4-28 4.6 Uncertainties in the Fire Analysis 4-29 4.6.1 Fire Frequencies 4-29 4.6.2 Fire-Propt.gation Modeling 4-30 4.6.3 Fire-Suppression Model 4-30 4.6.4 Conclusion 4-30 REFERENCES- 4-31 5 ANALYSIS OF ACCIDENTS RESULTING FROM FLOODING 5-1 5.1 Introduction 5-1

(

s 5.2 External Flooding 5.3 Internal Floods 5-1 5-4 5.3.1 Introduction 5-4 5.3.2 Summary of Protection Measures Against Internal Flooding at LGS 5-4 5.3.3 Method of Analysis for Evaluation of Flood-Induced Accident Sequences 5-5 5.3.3.1 General Method of Analysis 5-5 5.3.3.2 Independence of Plant Areas with Respect to Flooding 5-7 5.3.3.3 Evaluation of Flood Frequencies 5-7 5.3.3.4 Screening Criteria 5-8 5.3.3.5 General Assumptions Made Throughout Analysis 5-9 5.3.4 Analysis of Flooding-Induced Accident Sequences 5-10 5.3.4.1 Introduction 5-10 1

5.3.4.2 Analysis of Turbine Enclosure 5-10

! 5.3.4.2.1 Independence 5-11 5.3.4.2.2 First-Level Analysis of Turbine-Enclosure Flooding 5-12 5.3.4.3 Diesel-Generator Enclosure 5-12 5.3.4.3.1 Independence from Other Structures 5-13 5.3.4.3.2 Firat-Level Analysis of Diesel-Enclosure Flooding 5-13

(. 5.3.4.4 Reactor Enclosure 5-14 l 5.3.4.4.1 Independence 5-14 iv 07/15/83 L

, -. -- +, , - - - - - -. , , , - - ,

t i

.- CONTENTS (Continued) 1 Page 5.3.4.4.2 First-Level Analysis Reactor-Enclosure Flooding 5-15 5.3.4.4.3 Second-Level Analysis of Reactor-Enclosure Flooding 5-15 5.3.4.4.4 Third-Level Analysis of Reactor-l Enclosure Flood Area RB-FL15 (Elevation 283 Feet) 5-21 i 5.3.4.4.5 Third-Level Analysis of Reactor Enclosure Flood Area RBFLil

(Elevation 217 Feet) 5-24 5.3.4.4.6 Third-Level Analysis of Reactor Enclosure Flood Area RBFLl4 4

(Elevation 253 feet) 5-25 5.3.4.5 Control Structure 5-26 5.3.4.5.1 Independence of Control Enclosure 5-27 5.3.4.5.2 First- and Second-Level Analyses 5-27 5.3.4.5.3 Third-Level Analysis of the Control Structure 5-27 5.3.4.6 Spray Pond Pump Structure 5-31

! 5.3.4.6.1 Independence from other Structures 5-31 5.3.4.6.2 First-Level Analysis 5-31 5.3.4.6.3 Second Level Analysis 5-32 5.3.5 Special Concerns 5-32 i 5.3.5.1 Introduction 5-32 5.3.5.2 Failure of Scram-System-Pipework Integrity 5-33 4 5.3.5.3 Large Water-Storage Facilities 5-34 5.3.5.3.1 Suppression Pool 5-34 5.3.5.3.2 Spent Fuel Pool 5-34 5.3.6 Conclusions 5-35 References 5-36 6 ANALYSIS OF ACCIDENTS RESULTING FROM TORNADOES 1 6.1 Introduction 6-1

. 6.2 Design Features that Protect the LGS Plant From the Effects of Tornadoes 6 i -6.3. Effects on the Plant and Categorization of Tornadoes 6-3

'6.3.1 Introduction 6-3 l 6.3.2 Tornadoes with Severity Less Than the Design Basis 6-3

! 6.3.3 Tornadoes at or Above the Design Basis - 6 6.3.4 Tornado Missiles 6-4

-6.4 Tornado Frequencies 6-5 6.4.1 Introduction 6-5 6.4.2 -Tornado Characteristics and Risk Models 6-6 6.4.3 Frequencies of the Tornado Categories 6-8 e 6.5- The Contribution of Tornadoes to Core-Melt Frequency and the Effects on Risk- 6-10 LO

!- V 07/15/83 l

V

. __ _ . , . . . ~ . . . . _.. ..- _; . .. _ . . - _ ~ . . _ - . - - _ _ . _ _ . - . ,_ . . . . _ . .

t l

l i

CONTENTS (Continued)

O Page 6.5.1 Tornadoes Below the Design Basis 6-10 6.5.2 Tornadoes Above the Design Basis ,

6-12 6.5.3 Conclusions 6-12 References 6-13 7 PUBLIC RISK DUE TO TRANSPORTATION AND RELATED ACCIDENTS IN THE VICINITY OF THE SITE 7-1 7.1 Toxic-Vapor Clouds 7-1 7.1.1 Current Arrangements for the Detection of Toxic Vapors and Preventative Countccmeasures 7-2 7.1.1.1 Vapors Requiring Automatic Detection and Automatic Isolation 7-2 7.1.1.2 Vapors Requiring Automatic Detection 7-2 ;

7.1.1.3 Vapors Detected by Smell 7-2 7.1.2 Calculation of Public Risk--General Considerations 7-3 7.1.3 On-Site Chlorine 7-4 7.1.3.1 Spontaneous Failure of Chlorine Tank Cars 7-5 7.1.3.2 Earthquakes Leading to Chlorine Release 7-5 7.1.3.3 Chlorine Leaks Caused by Shunting Accidents 7-6 7.1.3.4 Leakage of Chlorine While Car is Being Connected or Discharged 7-6 7.1.3.5 Size of Leaks 7-7 7-7

(< ~) 7.1.3.6 Dispersion of Chlorine 7.1.3.7 Detection and Isolation capability 7-8 7.1.3.8 Effect on Operators 7-11 7.1.4 Railroad 7-11 7.1.4.1 Frequency of Crash Leading to Toxic Release 7-12 7.1.4.2 Automatic Detection and Isolation 7-13 7.1.4.3 Automatic Detection and No Automatic Isolation 7-14 7.1.4.3.1 Frequency of Excessive Concentra-tions at Control Room Air Intake 7-14 7.1.4.3.2 Probability of Detector Failure 7-15 7.1.4.3.3 Probability of Failure to Don Masks 7-17 7.1.4.3.4 Overall Frequency of Core Melt 7-17

- 7.1.4.4 Detection by Smell 7-17 7.1.4.4.1 Failure to Detect by Smell and Don Breathing Masks 7-18 7.1.4.4.2 Overall Frequency of Core Melt 7-18 7.1.4.5 Other Toxic Vapors Transported on the Railroad 7-19 7.1.5 Hooker Chemical Plant 7-19 7.1.5.1 Vinyl Chloride and Phosgene 7-19 7.1.5.1.1 Predicted Frequency of Release 7-19 7.1.5.1.2 Wind Direction 7-20

)

vi 07/15/83 i 1

. . . .. - . . - . .. . . .. _- - . = - - .

7 t

f l

CONTENTS (Continued)

Pagg 7.1.5.1.3 Failure Probability of Automatic Detectors 7-20 7.1.5.1.4 Failure to Don Breathing Masks 7-20 7.1.5.1.5 Probability of Core Melt Condi-tional on Operator Incapacitation 7-20 7.1.5.1.6 Overall Frequency of Core Melt 7-20 7.1.5.2 Vinyl Acetate 7-20 7.1.5.3 Other Chemicals at the Hooker Site 7 7.1.6 Highway 7-21 7.1.6.1 Chemicals Deucctu.2 by Smell 7-21 7.1.6.2 Chlorine Trifluoride 7-22 7.1.6.2.1 Cperation of Automatic Detectors 7-22 7-22 7.1.6.2.2 uetection by Smell ,

7.1.6.3 Other Chemicals in Table 7-12 7-22 P

7.1.7 Summary - Toxic Vapor Analysis 7-22 7.2 Explosion 7-23

7.2.1 Analytical Models 7-23 7.2.1.1 General 7-23

- 7.2.1.2 Frequency of Shipment 7-25 7.2.1.3 Size of Region I 7-25 7.2.1.4 Dispersion Model 7-27 7-30

~

7.2.1.5 Vapor-Cloud Ignition

, 7.2.2 Accident Rate and Accident Severity Assessment 7-31 7.2.2.1 Pressurized Tank Car Loss-of-Lading Rate 7-31 7.2.2.2 Spill Size Distribution 7-31 7.2.2.3 Severity of Loss-of-Lading Accidents 7-31 7.2.3. Meteorology 7-32

. . 7.2.4 Results of the Analysis 7-33 7.2.5 Solid Explosives 7-34 7.3 Fires 34 7.3.1 Fires Considered in the LGS FSAR 7-34 7.3.1.1 ARCO Pipeline Rupture (FSAR Section i

2.2.3.1.1 and 2.2.3.1.2) 7-34 7.3.1.2 Columbia Gas Transmission Company Natural

Gas Pipelines (FSAR Section 2.2.3.1.2) 7-35 7.3.1.3 Railroad Fire 7-35 7.3.2 Fires Considered in the Present Analysis 7-35 7.3.2.1 Pool Fire on the Railroad 7-36 7.3.2.2 Fireball at the Site of the Crask 7-36 7.3.2.3 Ignition of a Drifting Cloud 7-37

- 7.4 Aircraft Accidents 7-38 References 7 39 8' ' ANALYSIS OF ACCIDENTS RESULTING FROM TURBINE MISSILES 8-1 8.1' Introduction 8-1 8.2. Analysis of Frequency of Damage Resulting From Turbine Missiles 8-1 References. 8-4 a

vii

,' 07/15/83 i

, -3 + .- #--- .,,--%-..- -,A,, ,,em .w.v. , - . , - , s-. -',, - , , ,,,.,,,,. .,w-- - , , ..-,m-.e ,. <_,g,o, ,, ,p-,e g

-CONTENTS (Continued)

L Paea 9' ACCIDENT CLASSES AND REPRESENTATIVE SOURCE TERMS 9-1 :

9.1 Introduction 9-1 9.2 Accident Classes and Radionuclide Source Terms 9-2 9.2.1 Description of Accident Classes 9-2 9.2.2 Containment-Failure Modes 9-3 9.2.3 Calculation of Source-Term Magnitudes 9-4

9.2.3.1 OXRE Source Tera 9-4 9.2.3.2 OPREL Source Term 9-5 9.2.3.3 Source Term Involving Class IV (ATWS) 9-5 9.2.3.4 C1237" Source Term 9-6 i

9.2.3.5 LEAK 1 and LEAK 2 Source Terms 9-6 9.2.3.6 RB Source Term (Class IS) 9-7 9.2.3.7 VR and VRH2O Source Terms (Class S) 9-7 9.2.4 Release-Fracti<'. Uncertainties 9-7

9.2.4.1 Uncertainties in the Release Fractions for the OXRE (Steam Explosion) Source Term 9-8 9.2.4.2 Uncertainty in the Release Fractions for-the ATWS Source Tera 9-9

, 9.2.4.3 Uncertainty in the Release Fractions for the OPREL Source Term 9-9 j 9.2.4.4 Uncertainties in Release Fractions for l Seismically Induced Sequences and

Random Reactor-Vessel Failures 9-9 4 9.3 Frequencies of Source Terms 9-10 10 ANALYSIS OF OFFSITE CONSEQUENCES 10-1 10.1 Data Requirements 10-1 10.1.1 Basic Radionuclide Data 10-1 10.1.2 Specification of the Source Term 10-2 10.1.2.1 Frequency 10-2 10.1.2.2 Source-Term Magnitudes 10-3 10.1.2.3: Times of Release 10-3 10.1.2.4 Duration of Release 10-4 10.1.2.5 Warning Time 10-4

, 10.1.2.6 Rate of Release of Heat 10-5 10.1.2.7 Dimensions of the Release 10-6 l 10.1.3 Meteorological Data 10-6 l 10.1.4 Deposition Data 10-6 ,

10.1.5 Population Distributior 10-8 '

10.1.6 Evacuation and Other Protective Measures- That Reduce l

' Radiation Doses 8

- 10.1.6.1 Evacuation 10-8 l 10.1.6.1.1 values of R , R1 and 10-8 10.1.6.1.2 Time Delay Before Evacuation 10-9 10.1.6.1.3 Evacuation Speed 10-10 i

sl -

viii~ -1 07/15/83 i' l

._._._ _ . _ _ _ . .._.-_.~._.. _ , _.. . - _ . _ . . - . . - _ _ _ _ _ _ _ ~ _ - . . _ - . _ ,

l CONTENTS (Continued)

Page 10.1.6.1.4 Maximum Distance of Travel while Evacuating 10-11 10.1.6.1.5 Special Sheltering zone, Radius 2 10-11 10.1.6.2 Shielding 10-11 10.1.6.3 Discussion 10-13 10.1.6.4 Breathing Rates 10-13 10.1.6.5 Evacuation and Sheltering in the Event of an Earthquakes 10-14 i

10.1.6.6 Summary 10-15 10.1.7 Heath-Physics Data 10-15 10.1.8 Economic Data 10-16 10.2 Point-Estimate Results and Selection of Sequences for Sensitivity Studies 10-17 10.2.1 Point-Estimate Risk of Early Fatalities 10-17 10.2.2 Point-Estimate Risk of Latent-Cancer Fatalities 10-18 10.2.2.1 Latent-Cancer Fatalities Among the Population to 500 Miles (Excluding Thyroid Cancers)

10-18 10.2.2.2 a

' atent-Cancer Fatalities Among the Population to 50 Miles (Excluding Thyroid Cancers) 10-18 10.2.2.3 Thyroid-Cancer Fatalities 10-18 O( )

10.2.3 Point Estimate of the Whole-Body Population Dose 10.2.4 Individual Dose Impacts from Early Exposure--Point 10-19 Estimates of Bone-Marrow Doses of 200 Rem or More 10-19 10.2.5 offsite costs 10-19 10.2.6 Individual Risk of Early Fatality 10-19 10.2.7 Summary of Senstivity Studies 10-20 10.3 Treatmen; of Uncertainties in Consequence Analysis- 10-20 10.3.1 Characteristics of the Source Terms 10-21 10.3.1.1 Class (ATWS) Source Terms (C47, C47', C47") 10-21 10.3.1.2 Vessel-Failure Source Terms (VR and VRH2O) 22

., 10.3.1.3 OPREL Source Term 10-23 10.3.1.4 RB (Reactor-Enclosure tailure) Source Term 10-23 10.3.2 Evacuation Assumptions 10-23 10.3.3 Heath-Effects Modeling 10-25 10.3.3.1 Latent-Cancer Fatalities 10-25 10.3.3.2 Early Fatalities 10-26 10.3.4 Discussion 10-26 10.3.4.1 Dry-Deposition Modeling 10-26 10.3.4.2 Rainfall Modeling 10-27

'10.3.4.3 Straight-Line, Trajectory, and Multipuff Models 10-27 References 10-29

(

ix 07/15/83

4 CONTENTS (Continued)

O Page ,

1 11 UNCERTAINTY ANALYSIS 11-1 l l

11.1 Introduction 11-1 11.2 Types and Sources of Uncertainty 11-2 11.2.1 Types of Uncertainty 11-2 11.2.1.1 Parameter Uncertainties 11-2 11.2.1.2 Modeling Uncertainties 11-2 11.2.1.3 Completeness Uncertainties 11-2 11.2.2 Sources of Uncertainty 11-3 11.2.2.1 Accident-Sequence Analysis 11-3 11.2.2.2 Analyses of Containment Responses, In-Plant Accident Processes, Radionuclide Transport, and Offsite Consequences 11-3 11.3 Methodological Framework '

11-4 11.3.1 Measures of Uncertainty 11-4 11.3.1.1 Introduction 11-4 11.3.1.2 Uncertainties of the Input Parameters of the System Analysis 11-5 11.3.1.3 Uncertainties Associated with the Modeling of In-Plant and Offsite Consequences 11-6 11.3.2 Uncertainty-Analysis Framework 11-7 11.4 Uncertainty Analysis 11-8 11.4.1 Core-Melt Frequency 11-8 11.4.2 Risk of Early Fatalities 11-10 11.4.2.1 Probability Distributions on Frequencies of Representative Source Terms 11-10 11.4.2.2 Probability Distributions on Conditional CCDFs 11-11 11.4.2.3 Probability Distributions on CCDFs 11-12 11.5 other Measures of Risk 11-13 REFERENCES 11-14 12 RESULTS AND CONCLUSIONS 12-1 12.1 Introduction 12-1 12.2 The Analysis 12-2

-12.2.1 The Structure of the Study 12-2 12.2.2 Quantification and Uncertainty Analysis 12-2 12.3 Core-Melt and Accident-Sequence Frequencies 12-4 12.3.1 Core-Melt Frequency 12-4 12.3.2 Dominant Contributors to Core Melt 12-5 12.4 Accident-Class Frequencies and Associated Source Terms 12-5 12.4.1 Accident-Class Frequencies 12-5 12.4.2 Source Terms 12-7 12.5 Public Risk 12-8 12.5.1 Representation of Public Risk 12-8 12.5.2 The CCDFS 12-9 12.5.3 Early Fatalities--Interpretation and Perspective 12-11 12.5.3.1 Dominant Contributors to Risk ~ 12-11 12.5.3.2 Risk Perspective 12 l\["')N u

07/15/83

l CONTENTS (Continued)

P.El*.

12.5.3.3 Comparison with other Studies 12-13 12.5.3.3.1 LGS PRA 12-13 12.5.3.3.2 The Reactor Safety Study 12-13 12.5.4 Latent-Cancer Fatalities--Interpretation and 1 Perspective 12-14 12.5.4.1 Dominant Contributors to Risk 12-14 12.5.4.2 Comparisoy. with other Studies 12-14 12.5.4.3' Other Measures of the Risk of Latent-i Cancer Fatality 12-15 12.5.4.4 Risk of Latent-Cancer Fatality in Perspective 12-15 4 12.5.5 Whole-Body Population Dose 12-15 12.5.6 Individual Dose Impacts 12-16 12.5.6.1 Bone-Marrow Dose of 200 Rem or More from Early Exposure 12-16 12.5.7 offsite Costs (Decontamination, Relocation, etc.) 12-16 12.5.8 Individual Risk of Fatality 12-18 12.5.8.1 Individual Risk of Early Fatality 12-18 12.5.8.2 Individual Risk of Cancer Fatality 12-19 12.5.9 Future Trends 12-19 REFERENCES 12-21

O f

I l

l f

O xi

, 07/15/83

[-

l

1

, CONTENTS (Continued)

.L 1

VOLUME II: APPENDIXES Appendix A SEISMIC GROUND MOTION HAZARD AT LIMERICK GENERATING STATION Appendix B CONDITIONAL PROBABILITIES OF SEISMIC-INDUCED FAILURES FOR STRUCTURES AND COMPONENTS FOR THE LIMERICK GEN-ERATING STATION UNIT 1 Appendix C THE ANALYSIS AND QUANTIFICATION OF SEISMIC ACCIDENT SEQUENCES Appendix D FIRE ANALYSIS AND SUPPORTING DATA Appendix E SOURCE-TERM UNCERTAINTY ANALYSIS Appendix F DESCRIPTION OF THE CONSEQUENCE MODEL Appendix G DETAILS OF THE UNCERTAINTY ANALYSIS Appendix H SUPPORTING DATA FOR FIDODING ANALYSIS I

~l xit 07/15/83 l

l

Event C: Fire Suppressed Before Damaging Unprotected Raceways Although all safety-related cabling is routed in conduit in this fire zone, in many instances there is minimal separation between conduits asso-ciated with redundant divisions and cable trays serving balance-of-plant equipment.- It is therefore unlikely that a cable-tray fire would be sup-pressed before damaging cables in conduits that are not protected by a ceramic-fiber blanket. A failure probability of 1.0 was assigned to event C in this case. This assumption influences approximately 10 percent of the estimated core-melt frequencies resulting from fires in the 13-kV switchgear room.

Event D: Undamaged Systems Mitigate Accident Given Fire-Growth Stage 2 This second stage represents damage to all safety-related equipment except that served by cables routed in conduits that are protected by ceramic-fiber blankets. Since cables necessary for supplying power to the PCS, RER, RHR-SW, and ESWS pumps are located in this area, no credit can be taken for recovering their operability for long-term heat removal (unlike situations where only the remote-control capability of pumps or the associated valves is affected).

Given that equipment associated with shutdown methods A and B, which are served by protected cabling, remains undamaged, the conditional probabilities of dominant core-melt sequences are as follows:

Dominant sequence Conditional probability QW 4.5 x 10-3 QUW 2.2 x 10-5 QUV 4.0 x 10-5 PQW 4.5 x 10-5 Total conditional core- 4.5 x 10-3 melt probability Event E Fire Suppressed Before Damaging Protected Raceways This event is concerned with the probability of failing to suppress the fire before protected cables serving shutdown methods A and B are damaged.

Using the methods described in Section 4.4.3.3.3, a rigid steel conduit en-closed in a 1-inch' ceramic-fiber blanket is shown to provide the cables with I hour of protection before the contained cables will exceed the failure temperature criterion. In this period, the probability of failing to suppress the fire is shown to be 0.04, which is the failure probability assigned to event E.

Event F: Undamaged Systems Mitigate Accident Given Fire-Growth Stage 3 Fire-growth stage 3 represents damage to all safe-shutdown systems served by equipment in the fire zone. From Section D5.1.1, which describes the contents of the fire zone, it is clear that such dangae would result in a loss of all systems required for safe shutdown, and the resulting conditional probability of core melt is thus 1.0.

D-13 07/15/83

. .- -- . ~ _ . - - - -. . - .

i D5.1.3 Quantification of Fire-Growth Event Tree for Equipment-Panel Fires

( The fire-growth event tree for equipment-panel fires in fire zone 2 is shown in Figure D-9.

I

)

Event As Frequency of Panel Fires

, The frequency of panel fires is calculated by multiplying the number of panels (eight) in the 13-kV switchgear room by the frequency of cable fires

.per panel-year. Thus, 8 (2.2 x 10-4) = 1.8 x 10-3 per year The basis for this analysis is given in Section 4.4.3.2.

Event B: Undamaged Systems Mitigate Accident Given Fire-Growth Stage 1 l This represents damage that is confined to the panel in which the fire starts. Since the panels in this fire zone serve balance-of-plant equipment, the only effect can be loss of the power-conversion system. The quan-tification of this event is thus identical with that described for event B in j Section D5.1.2; the resulting conditional core-melt probability is 1.9 x 10-5, i

Event C: Fire Suppressed Before Damaging Unprotected Raceways The quanti. ication of this event is identical for all fire zones and is discussed in Section 4.4.3.3.5. The probability of failure to suppress the fire before it camages unprotected raceways is 0.04.

Events D, E, and F Given a fire that has propagated from the panel in which it originated to

, adjacent cable raceways, the quantification of the conditional probabilities i associated with events D, E, and F is identical with that described for self-ignited cable-raceway fires in Section D5.1.2.

1 D5.1.4 Quantification of Fire-Growth Event Tree for Transient-Combustible Fires The fire-growth cvent tree for transient-combustible fires in fire zone 2 is shown in Figure D-9.

Event A i

Using COMPBRN to predict the heat transferred from postulated transient-I combustible fires, which occur at floor level, it is shown that 4

1. None of the fires is capable of causing damage directly to safety-related cabling, which is entirely routed in rigid steel conduits.

2. Only the most severe of the three transient-combustible fires, the oil fire, can ignite a secondary fire in exposed balance-of-plant D-14 07/15/83 ,

i

DS.2.2 Quantification of Fire-Growth Event Tree for Self-Ignited Cable-Raceway Fires The fire-growth event tree for self-ignited cable-raceway fires is shown in Figure D-10.

Event As Frequency of Self-Ignited Cable-Raceway Fires The frequency of self-ignited cable-raceway fires is computed by multi-plying two quantities: (1) the ratio of the weight of cable insulation in fire zone 20 (9558 pounds) to the total weight of cable insulation in the reactor enclosure and control structure (172,799 pounds) and (2) the frequency of self-ignited cable fires per reactor-year. Thus the frequency is 9 8m 172,799 lb (1.1 x 10-3) = 6.0 x 10-5 per year The basis for this step in the analysis is given in Section 4.4.3.2.

Event B Undamaged Systems Mitigate Accident Given Fire-Growth Stage 1 This event is concerned with damage to components or cables in the im-mediate locality of the initial fire, which in this case is one particular raceway. Assuming that damage is thereby sustained in one division of safety-related equipment and that the initiating event is a turbine-trip transient, l the conditional probabilities of dominant core-melt sequences are as follows:

Dominant sequence Conditional probability QUV 1.1 x 10-5 QUX 2.8 x 10-6 PW l.1 x 10-6 Total conditional core- 1.5 x 10-5 melt probability Event C: Fire Suppressed Before Damaging Unprotected Raceways The probability of this event is evaluated on the assumption that the separation between safety-related cable raceways is generally no greater than that specified as the minimum-separation criterion (i.e., 5 feet vertically, 3 feet horizontally). In this case, the time available to suppress the fire before it damages redundant safety-related raceways is estimated to be 10 minutes (aee Section 4.4.3.3.3 of the main report), and the corresponding probability of failing to suppress the fire within this time period is 0.4, which is therefore the failure probability assigned to event C.

Event D: Undamaged Systems Mitigate Accident Given Fire-Growth Stage 2 Fire-growth stage 2 represents damage to all safety-related equipment except that served by cable raceways protected with ceramic-fiber fire blankets. Shutdown equipment remaining undamaged at this stage is therefore (3

D-16 07/15/83

associated with shutdown method A; also unaffected is equipment associated with'the power-conversion-system, which is not served by cabling or components in this fire zone. Given that this equipment remains undamaged and the transi-i ent initiating event is a reactor trip, the dominant core-melt sequences and their conditional probabilities are as follows:

Dominant sequence Conditional probability QUV 2.8 x 10-5 QUX 2.8 x 10-6

- PW 6.0 x 10-5 PQW l.2 x 10-6 Total conditional core- 9.2 x 10-5 melt probability Event E Fire Suppressed Before Damaging Protected Raceways

?

This event is concerned with the probability of failing to suppress the fire before the protected cable raceways, which serve shutdown method A, are

, . damaged. The raceways are cable trays protected by a 2-inch-thick ceramic-fiber blanket, which has a 1-hour fire rating. The probability of failing to suppress the fire within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is shown to be 0.04, which is the failure prob-ability assigned to event E.

Event F Undamaged Systems Mitigate Accident Given Fire-Growth Stage 3 4

This stage represents damage to safe-shutdown-systems served by equipment within the fire zone. From Section D5.2.1, which describes the contents of ss ,, the fire zone, it is clear that all safety-related shutdown equipment may fail and only the power-conversion system would remain undamaged to mitigate the accident. The initiating event is a transient with a turbine trip. The domi-nant sequence is QUV, and its conditional probability is 0.02.

4 i

! D5.2.3 Quantification of the Fire-Growth Event Tree 'for Panel Fires The fire-growth event tree for self-ignited panel fires is shown in Fig-ure D-10.

Event At Frequency of Panel Fires f

The frequency of panel fires is obtained by multiplying two quantities:

4 (1) the number of panels (two) in the static inverter room and (2) the fre-quency of fires per year. It is therefore 2(2.2 x 10-4) .= 4.4 x 10-4 per year The basis for this step in the analysis is given in Section 4.4.3.2.

!' Event B: Undamaged Systems Mitigate Accident Given Fire-Growth Stage l' I This stage of fire growth represents damage that is confined to-the panel in which the fire starts. The panels in this room are 125-V de distribution i

D-17 l 07/15/83

!f

= ,, .,,--r r.--ev. ., --, ,, - ,. .s, .,e. v.,,-ww--w, , , . ,,- , , , , - ,.- . , . , - , . , , - , ,.w, , .,w,. n-..,, , ,m, , -,-g,-- -

t panels 1BD102 and 1DD102. If fire damages the contents of either panel, the following safety-related equipment is assumed to have failed:

( )

1. Division II or IV 4-kV switchgear.

2. The HPCI system.

3. Trains B and D of the RHR system.

4. Train B of the core-spray system.

i Given that the transient initiating event is a reactor trip, the dominant core-melt sequences are QUX and PW, and their conditional probabilities are Dominant sequence Conditional probability QUX 2.8 x 10-6 j PW 4.5 x 10-5 QUV 1.3 x 10-6 Total conditional core- 5.0 x 10-5 I melt probability 1

Event C: Fire Suppressed Before Damaging Unprotected Raceways In the case of panel fires, this event represents the propagation of such fires beyond the confinemants of the panel. The quantification of the event

, is identical for all fire zones and is discussed in Section 4.3.4.4.

Events D, E, and F i

Nd Given a fire that has propagated from the panel in which it originated to adjacent cable raceways, the quantification of the conditional probabilities e

associated with events D, E, and F is identical with that described for self-

ignited cable-raceway fires in Section D5.2.2.

4 DS.2.4 Qpantification of Fire-Growth Event Tree for Transient-Combustible

, Fires The fire-growth event tree for transient-combustible fires is included in

Figure D-10.

Event A The heat transfer from postulated transient-combustible fires, which

[ would occur at floor level, was calculated with the COMPBRN code. The results show that

1. None of the fires is capable of causing damage directly to safety-related cables, all of which are routed in rigid steel conduit.

2. Only the most severe of the three transient combustible fires, an oil fire, can ignite a secondary fire in exposed balance-of-plant cable trays, which would then be capable of damaging safety-related b

V cabling.

D-18 07/15/83

Since there is no damage to pawer sources supplying RER or PCS pumps, credit was taken-for locally operating these systems in order to achieve long-('s term heat removal within 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months into the accident. Event D was therefore assigned a probability of 5.6 x 10-5, Event E Fire Suppressed Before Damaging Protected Raceways Here we are assessing the probability of failing to suppress the fire before protected cable raceways supplying components associated with shutdown methods A and B are damaged. These raceways consist of cable trays protected

by a 1-inch-thick ceramic-fiber blanket, which is reported in the FPER as having a 1/2-hour fire rating. The probability of failing to suppress the fire within 1/2 hour is estimated to be 0.15. Event E was therefore assigned a failure probability of 0.15.

1 Event F: Undamaged Systems Mitigate Accident Given Fire-Growth Stage 3 This damage state represents damage to all safe-shutdown equipment depen-dent on cabling within the fire zone. The only equipment that 10 potentially operable is served by the remote-shutdown panel, as described in Section 4.2.

Assuming that the initiating event is a transient with isolation from the power-conversion system, the dominant core-melt sequences are as follows:

Dominant sequence Conditional probability i

QUV 1.3 x 10-3 QUX 1.3 x 10-4 Total conditional core- 1.4 x 10-5 l

, ( melt probability Event F was therefore assigned a failure probability of 1.4 x 10-3, D5.3.3 Quantification of Fire-Growth Event Tree for Transient-Combustible Fires t

The fire-growth event tree for transient-combustible fires in fire zone 20 is included in Figure D-ll.

Event A In the cable-spreading room, cable trays are located close to the floor level (where transient-combustible fires are considered to occur) and are densely packed in comparison with other plant areas. We conservatively took no credit for location-dependent factors used in other fire zones and assumed 4

that all transient-combustible fires result in the ignition of cable insulation in adjacent cable trays. The overall frequency of such fires in the cable-spreading room was estimated to be 7.2 x 10-4 per year.

i l ( p.21 07/15/83

Event At Frequency of Self-Ignited Cable-Raceway Fires

[ The frequency of self-ignited cable-raceway fires is calculated by finding the ratio between the weight of cable insulation in this fire zone (18,637 pounds) and the total weight of cable insulation in the control structure and the reactor enclosure (172,799 pounds) by the frequency of self-ignited cable fires per reactor-year. This quantity is then multiplied by the frequency of self-ignited cable fires per reactor-years 8,63 y b (1.1 x 10-3) = 1.2 x 10-4 (See Section 4.4.3.1 of the main report for an explanation of the analysis.)

Event B: Undamaged Systems Mitigate Accident Given Fire-Growth Stage 1 The first state considered is damage to components in the immediate locality of the initial fire, which .in this case is the particular cable race-way. Assuming that damage is thereby sustained by one division of safety-related equipment and that the initiating event is a transient with MSIV closure, the dominant sequences and the conditional probability of core melt were estimated to be as follows:

Dominant sequence Conditional probability QUV 5.7 x 10-5 QUX 1.4 x 10-4 s QW 1.0 x 10-5 Total conditional core- 2.1 x 10-4 melt probability A value of 2.4 x 10-4 was therefore assigned as the failure probability of event B.

Event C: Fire Suppressed Before It Damages Unprotected Raceways In evaluating the probability of suppressing the fire before it damages unprotected raceways, it was assumed that the separation between mutually re-dundant safety-related raceways is generally no greater than the minimum spec-ified separation criteria (5 feet vertically, 3 feet horizontally). Using the

. fire growth and suppression models described in Section 4.4.4.2 of the main report, the failure probability associated with event C was found to be 0.4.

Event D: Undamaged Systems Mitigate Accident Given Fire-Growth Stage 2 This second state represents damage to all safety-related equipment ex-cept that served by cable raceways or components protected by horizontal separation or ceramic-fiber fire blankets.

Shutdown equipment associated with shutdown method A E B (but not both) therefore remains undamaged in this state (see Section D5.5.1) . Assuming the D-26 07/15/83

)

_ _ -_ J

. . - . . - - ,_. ~ . - . . . .. .. .- .-

o

+

4

.The frequency of panel fires is calculated by multiplying the number of

[ . panels in fire zone 45 by the frequency of fires per panel-years 3(2.2 x 10-4) = 6.6 x 10-4 per year The basis for this step of the-analysis is given in Section 4.4.3.2.

Event'B: Undamaged Systems Mitigate Accident Given Fire-Growth stage 1 b This stage represents damage that is confined to the panel in which the j fire starts. For panel-confined fires to be significant contributors to core

melt, they must be capable of causing both an initiating event and degrading l mitigating systems. Fires in two motor control centers, 10B223 and 10B224,

t. may have such an effect by causing an RCP trip (resulting in a turbine-trip

, transient) and disabling one high-pressure injection system (HPCI or RCIC) and i one RHR train. The resulting conditional probability of core melt is ,

L. l Dominant sequence Conditional probability l

QUV 1.1 x 10-6 4 QUX 2.8 x 10-6 i PW 2.0 x 10-7 j QW 2.0 x 10-7

! Total conditional core- 4.3 x 10-6 j melt probability f, O since only two of the three panels in the fire zone are significant contribu-tors to core-melt frequency, this conditional probability of core melt can be 3 V reduced oy 2/3, and event B was therefore assigned a failure probability of i

l 2/3 (4.3 x 10-6) = 2.9 x 10-6 i

i Event D

[' In the case of panel fires, this event represents the propagation of such j fires beyond the confinement of the panel in which they start. The quantifi-l cation of this event is identical for all fire zones and is discussed in Section 4.4.3.3.5 of the main report.

[ Eventa D, E, and F i

Given a fire that has propagated from the panel in which it originated to adjacent cable raceways, the quantification of the conditional probabilities ,

associated with events D, E, and'F is identical.with that. described for self- !

ignited cable-raceway fires-in Section D5.5.2.

l l

D5.5.4~ Quantification of the Fire-Growth Event Tree for Transient-Combustible Fires

.The fire-growth event tree for transient-combustible fires in fire zone 45'is included in Figure D-13.

. O D-28 07/15/83

l l-l Event At Frequency of Panel Fires C The frequency of self-ignited panel fires in fire zone 47 was obtained by multiplying the number of panels in the fire zone (five) by the frequency of fires per panel-year. Thus, 5(2.2 x 10-4) = 1.1 x 10-2 per year Event B Undamaged Systems Mitigate Accident Given Fire-Growth Stage 1 This stage represents damage that is confined to the panel in which the fire starts. For panel-confined fires to be significant contributors to core-melt frequency, they must be capable of causing both an initiating event and degrading mitigating systems. Fires in three panels,10B204,10B213,10B214, may have such an effect. Conservatively assuming that the fire causes a transi-ent with MSIV closure coupled with the dissblement of one RER train and one core-spray train the conditional core-melt probability was found to be as follows:

Dominant sequence Conditional probability QW l.0 x 10-5 QUV 4.0 x 10-6 QUX 9.8 x 10-6 Total conditional core- 2.4 x 10-5

' melt probability Since only three of five panels in the fire zone are significant contribu-i tors to core-melt frequency, the conditional probability of core melt was reduced

( ) by a factor of 3/5. Event B was therefore assigned a failure probability of 3/5 (2.4 x 10-5) = 1.4 x 10-5 g Event C f

In the case of panel fires, this event represents the propagation of such fires beyond the confinement of the panel in which they start. The quantifi-cation of this event is identical for all fire zones and is discussed in Section 4.4.3.3.5 of the main report.

l Events D, E, and F Given a fire that has propagated from the panel in which it originated to adjacent cable raceways, the quantification of the conditional probabilities associated with events D, E, and F is identical with that described for self-ignited cable-raceway fires in Section D5.6.2.

D5.6.4 Quantification of the Fire-Growth Event Tree for Transient Combustible I Fires )

The fire-growth event tree for transient-combustible fires in fire zone 47

'is included in Figure D-14.

- D-32 07/15/83

O O O A B C D E F Undarnaged Fire suppressed Undamaged Fire suppressed Undamaged Fire in systems before damaging systems systems before damaging cable /TC/ panel mitigate unprotected mitigate protected mitigate accident given raceway accident given raceways accidents given FGS1 FGS1 (Failure gives FGS2) FGS2 (Failure gives FGS3) FGS3 l

Core Annual sequence g frequency cable TC panel OK OK 4.0-2 1.0/1.0/4.0(-2) 1.0 CM 2.2(-6) 5.2(-7) 2.9(-6)

(see note) (See

/1.8(-3) note)

~

CM 2.4(-7) 5.7(-8) 3.0(-7) 1.05 CM e e e FGS = Fire growth stage 2.4(-6) 5.9(- 71 3.2(-6)

TC = Transient combustible Total CMF = 6.2(-6) per year Note: Because of the evaluation of event E, the probability of event C is not included in the evaluation of the sequence frequency.

Figure D-9. Fire-growth event tree for fire zone 1 07/15/83

1

' J fxv)

A B C D E F Undamaged Fire suppressed Undamaged Fire suppressed Undamaged h.re in systems systems before damaging systems before damaging cableUC/ panel mitigate unprotected mitigate protected mitigate accident given raceway accident given raceways accident given FGS1 FGS1 (Failure gives FGS2) FGS2 (Failure gives FGS3) FGS3 !

Core Annual sequence I

k frequency panet cable TC OK OK OK 0.04

0.4/0.4/0.04 0.M 6.0(-5)/1.7(-5) CM 4.8(-8) 1.4(-8) 1.4 (-8) l

/4.4 (-4) (see note) (see note) 9.2(-5) .

CM 2.2(~9) 6.3 (-9) 1.6(-9) l.

1.5(--5)/1.5(-5)/5.0(-5) -

CM e e 2.2(-8)

FGS = Fire growth stage TC = Transient combustible 5.0(- 81 1.5(- 81 ~3.8(-8)

Note: Because of the evaluation of event E, the probability of event C Total annual core-n. alt frequency = 1.0(-7) is not included in the evaluation of the sequence frequency.

Figure D-10. Fire-growth event tree for fire zone 20.

07/15/83

p f*) *\

\

A B C D E F Undamaged Fire suppressed Undamaged Fire suppressed Undamaged pg g Systen:s systems systems before damaging before damaging cable /TC/ panel mitigate unprotected mitigate protected mitigate accident given raceway accident given raceways accident given (Failure gives FGS2) FGS2 (Failure gives FGS3) FGS3 l FGS1 FGS1 Core Annual sequence g frequency cable TC panet OK OK OK 0.15 1.0 W -3) 2.3(-4)/7.2(-4) CM 4.8 (-8) 1.5(-7)

(see note) (see note)

-I CM 1.3(-8) 4.0(-8)

Not applicable CM 6.1(-8) 1.g t-7 ),

FGS = Fire growth stage Total annual core-melt frequency = 2.5(-7)

TC = Transient combustible Note: Because of the evaluation of event E, the probability of event C is not included in the evaluation of the sequence frequency.

Figure D-11. Fire-growth event tree for fire zone 22.

07/15/83

A B C D E F Undamaged Fire suppressed Undamaged Fire suppressed Undamaged Fire in systems before damaging systems before damaging systems cable /TC/ panel mitigate unprotected mitigate protected mitigate accident given raceway accident given raceways accident given FGS2 (Failure gives FGS3) FGS3 I FGS1 FGSI (Failure gives FGS2)

Core Annual sequence g frequency cable TC panel

- OK OK 3.8(-2) 0.4/0.4/0.04 1.0 1.2(-4)/1.7(-5) CM 4.6(-6) 6.5(-7; 1.0(-6)

(see note) (see

/6.6(-4) note) 1.5(-3) CM 7.2(-8) 1.0(-8)4.0(-8) 2.1(-4)/2.1(-4)/2.9(-6) CM 2.5(-8) e l FGS = Fire growth stage 1 TC = Transient combustible 4.7(-61 6.6(-71 1.0(-6)

Note: Because of the evaluation of event E, the probability of event C Total annual core-melt frequency = 6.4(-6) per year is not included in the evaluation of the sequence frequency.

Figure D-13. Fire-powth event tree for fire zone 45.

07/15/83

(

V \) Q A B C D E F Undamaged Fire suppressed Undarnaged Fire suppressed Undamaged Fire in systems before damaging systems before damaging systems cable /TC/ panel mitigate unprotected mitigate protected mitigate accident given raceway accident given raceways accident given FGS1 FGS1 (Failure gives FGS2) FGS2 (Failure gives FGS3) FGS3 l Core Annual sequence D frequency cable TC panel OK OK J

4 OK 1.0(-2) 0.4/0.4/0.04 1.0 1.1(-4)/1.7(-5) CM 1.1 (--6) 1.7(-7) 4.4 (-7)

/1.1(-3) (see note) (see note)

~' CM 1.0(-8: 6.6(-8) 6.6(-8) 2.0(-4)/2.0(-4)/1.4(-5)

CM 2.2(-8) e 1.5(-8)

FGS = Fire growth stage 1.2(-6) 1.8(-7). 5.2(~7)

TC = Transient combustible Total annual core-melt frequency = 1.9(-6)

Note: Because of the evaluation of event E, the probability of event C is not included in the evaluation of the sequence frequency.

Figure D-14. Fire-growth event tree for fire zone 47.

1 07/15/83 i

-. ~.

.( . -

-( -

Y ' ,

V . i ;

fC .. ,, *-

y*

\% I

,* \ \ '

_ Q 's s s\ N' y,, * -

l qs

J ~ -

\

- s C'h apter.7 *

, - , \

% s . ,,

PUBLIC RISit DUE TO TPANGF0FTATION AbD !! ELATED '

ACCIDENTS IN,N2HE'VICIN12T OF THE SITE i

-"" 1, w s -

9' < g t

'] [" ( .- ,

% \' \. -A .

This chapter 7td krosses:the'qu3s't}cIn of whether accidents external to, but in the vicinity of,; the Limerick Generating Station (LGS), such as the release of chesically toxict or flammable vapors, might set in motion a cyain of events that wocid ultiskately lead to en escape of radioactive material -

into the environment. 'This question is "cdsidered in the cont 2itt of public risk; that is, do accidents;tbyt are initiated external to the plant contri ' u bute significantly to public. risk from the plant. This problem can

conveniently be divided into 'the following four elements: E-4, s

~

1. How likely is it that;an accidenul release of chemically toxic )

vapors fran the railrost'J,. the highway, or a fixed installation . ,

such as the nearby Hooker Chemical F/ ant will adversely affect' 121e

operators in such a waf'as to

319d'to,a,J91 ease of radioactive \

material to th's ' environment 7# ~h s s.

. g ,

e

%\ W . ,

2. How likely is it that an accip.Qntal re34sse of flammakle vapor , y,i ,

- from the railroad, the highwayppr e, nectby, fixted insta3{stion / \

will deflagrate or detonste^1n Ah a way as to damage 'delfsty , [' ~ ,

related structures and thereby [les.$ to a release of radioactiva

material to the environment?

N 's g(s,\ v' s

- - e

~

\\ A,w- *

3. .How liNeJy is it that thh't*1 Ming ',of f}eaeqle-vapor clouds wil1} , ,

lead to heat Acada *

that would ' dame.9,e'safethrelated' e g- (

structures 7 Ns g

\ ,

4 How likelh is it that AJi '

I al. c' raft

crash wi 1 damage safety-fe Eed,

~

structures? .

. t i , i ,

e *\" s o% .

Sections 7.1 to 7.4, contain detailed disqqslyss, of each of thode elehents. '

s, , d. ( ~.

, .* s . % %

)- .

4 ,-p s

gO 7 .1 TOXIC-VAPOR CLOUDS - / ,.,

w y A , =,x The accidental ralease of a chemic[ thy toxir** vapor' cloud from the rail-road, the highway, or fi;ted insta11gtton]t 'in th[ vicinity of the Rector 4 I

will lead. to an cccidental release Ucf rtdioactive material to the(atmos-phere, and hence to a contribution h t'he predihd pu'blic, risk,.,only if the operators of the plant are affected +in such c. way that ?,: hey carinot respond ,

to an emergency if required to do so, or if they an affected in such a ,vay

! as to set' in action a series of even't'rs that le'ad t damage of the plaatl This section will show, by madns of,g 'cynservative'f' bounding analydds.rthat.l the predicted frequency of occurrence 'of thir jfveAL 'is so low that 'th'd~' cont +

tribution to public risk is ver'y smal145mper'ed to other contribatipna that *

%, s %,

, \ \ {* [ +- , ,

s - -

. s. %

/ -

g ,1**

i w

. 4j v

, lp'd ,

s, f .

\ ", , + = .

._ c, , . ' sJ. L x

.. 1, s g sc

, .y ", g # p ,

l Nl' u m

I 4

p ars considered elsewhere in this report. This analysis will be performed

! using information that has already been generated during the writing of the j FSAR.

7.1.1 ARRANGEMENTS FOR THE GZTECTION OF TOXIC VAPORS AND PREVENTIVE COUNTERMEASURES j The arrangements for detecting toxic chemicals and for implementing i

' suitable protective countermeasures distinguish between three groups of chemicals as described below.

i l 7.1.1.1 Vapors Requiring Automatic Detection and Automatic Isolation

, Chlorine is the only vapor for which automatic detection and isolation i are required. There are four independent safety-grade chlorine detectors,

) each consisting of a cassette of impregnated paper that changes color on ex-i posure to chlorine and sensors to detect this change and an alarm in the j control room. Pairs of these detectors are linked to two independent isola-

} tion valves, which will close automatically on receipt of a signal from the j detectors. The operators will then put on their breathing masks. Analyses

{ indicate that the operators will have adequate time for this assuming the design-basis control room inleakage rate on isolation of 0.25 air change per hour (Bechtel, 1980-1983).

i i

I 7.1.1.2 Vapors Requiring Automatic Detection Ammonia, ethylene oxide, formaldehyde, vinyl chloride, and phosgene are l vapors that require automatic detection. They will be detected by two re-l .dundant infrared spectrometers, which will activate an alarm in the control

! room. The operators will den their breathing masks and then isolate the control room manually.

I

( 7.1.1.3 vapors Detected by Smell The Philadelphia Electric Company (PECo) will implement a program to train operators to detect the following chemicals by smell: acetaldehyde ,

chlorine trifluoride,

ethyl mercaptan, fluorine, hydrogen chloride, hydro-gen cyanide, hydrogen fluoride, hydrogen sulfide, and vinyl acetate. The training program will stress that if any unusual odors that cannot be l

Chlorine trifluoride decomposes in moist air. One of the products of decomposition is chlorine; hence, this chemical will probably be detected by

( the chlorine monitors.

7-2

N readily identified are detected, the operators will don their breathing masks and then manually isolate the control room.

7.1.2 CALCULATION OF PUBLIC RISK--GENERAL CONSIDERATIONS l In order to show that the contribution to public risk is small, it is necessary to consider a large number of issues. To understand these issues, it is first helpful to focus on the simple observation that the operators, and hence the plant, cannot be affected unless harmful concentrations of toxic vapor first reach the control-room intake. The ways in which this might be possible at the Limerick site are given in Figure 7-1,* which presents a simple fault-tree-like diagram in which the top event is the arrival of toxic vapor in excessive concentrationst at the control-room air intake.

The next line on Figure 7-1 indicates that this is possible only if (1) there is a release of toxic vapor; and (2) the wind blows from the site of the release toward the plant; and (3) there is insufficient dilution by the action of atmospheric turbulence; that is, as the plume travels toward the plant, it remains above the level of concentration that has been defined as excessive.

The four possible places at which an accidental release of toxic vapor might take place are on the site (chlorine storage), at the nearby Hooker Chemical Plant, on the railroad, or on the highway. First, there is the onsite chlorine storage. The chlorine is stored in railroad cars, which discharge their contents to the pumphouse over a 1-week period. In prin-ciple, it is possible to envisage four causes of an accidental release of chlorinet (1) spontaneous failure of the railroad car, (2) an earthquake, (3) an accident during shunting operations, or (4 ) failure of pipework or couplings.

Second, several chemicals are stored or manufactured at the nearby Hooker Chemical Plant, and it is possible to envisage five causes of an accidental release of toxic vapor: (1) spontaneous or fire-induced failure of a storage tank, (2) an earthquake, (3) movement of road tankers or rail-road cars, (4) failure of pipework or couplings, or (5) an accident in the manufacturing process, such as the runaway polymerization of vinyl chloride.

Third, a railroad runs close to the site and a number of toxic chemi- l I

cals are transported along it; therefore, the possibility of a railroad crash leading to the release of a toxic vapor must be considered.

Note that Figure 7-1 is not a true fault cree. For example, the

probability that the wind blows toward the plant is conditional on the loca-tion of the release, and this conditionality is not usual in fault trees.

l i An excessive concentration at control-room intakes is such that, if

.p the control room is not isolated and/or the operators do not put on their

( breathing masks, they will be exposed to incapacitating concentrations.

l

! 7-3 l

l l

1

i

! i Fourth, chemicals are transported along highways in the neighborhood of .

the site and there is a possibility that toxic vapor could be released as !

the result of a road accident.

I Given a release of toxic vapor in one of these ways, there will be a ,

potential problem at the control-room air intake only if the wind carries the vapor toward the reactor and the atmospheric turbulence fails to dilute

, the vapor below excessive levels by the time it arrives. Hence, it is necessary to consider the atmospheric dispersion of various vapors. This is ;

not a trivial task. Many of the vapors in question are denser than air; the atmospheric dispersion of heavier-than-air vapors over terrain character-istic of that around the sita (i.e., uphill from the railroad to the reactor) or among buildings is not well understood.

Given the arrival of toxic gas in excessive concentrations at the

., control-room air intake, there are several possible effects that toxic

+ I vapors could have on operators. These possibilities are displayed in the foris of event trees as Figures 7-2, 7-3, and 7-4.

) Figure 7-2 illustrates the effect of chlorine on the operators . The

first branch on the tree asks whether the detection and isolation capability :

I functions as intended. If not, calculations show that the operators will be ;

incapacitated within 1 minute af ter the TLV is reached in the control room. ;

If the control room in successfully isolated, the operators have about 10 i minutes to put on their breathing masks before the inleaking chlorine ince-pacitates them. Finally, even if the operators are incapacitated, core melt does not necessarily follow; the most probable consequence is that the reac-tor will continue to run unattended until relief operators arrive; or, if there is a transient, the reactor will nost likely shut itself down safely.

i Figure 7-3 illustrates the effect on the operators of toxic vapors l requiring automatic detection. If the detectors fail to operate, calcula-tions indicate that the operators will not have time to put on their breath- .

ing masks af ter detection by smell (Bechtel, 1980-1983). The lower branch i of the event tree, therefore, assumes that the operators will be incapac-itated. Apart from the first branch, this tree is the same as that in Figure 7-2.

Finally, Figure 7-4 illustrates the effect on operators of toxic vapors that are detected by smell. The tree is similar to that of Figures 7-2 and

, 7-3. The quantification of the branches on the event trees and of the fault-tree-like diagram in Figure 7-1 is discussed in detail below.

7.1.3 ON-SITE CHLORINE Chlorine is required for water purification and will be used at a maxi-aum rate of about 20,000 pounds per day. It will be provided from a rail-road tank car, which will stand on a spur adjacent to the pumphouse and will be connected to the pumphouse by aboveground piping. The average weight of

,i 7-4

+

.w - ___ _ _- _ ~ -,<e ._ , , _ . - - . - - . . .-.--c. -,,---,w s ..-,-.,.,-.-m- * - . _ - - . , - - - , . . - . _ , , . , . -

.,,o.,. --------v. .-- -,e<,..--w---,--,,,-g.,,. , _ . -----4

_ _ _ _ _ _ __ _ - . _ _ _ _ _ _ _ _ . ~ _ . . . _ _ _ _ _ . . _ . _ . . . -___ _ _ _ _ . _ _

1 4

i

[

a loaded chlorine tank car is 74 tons, which provides chlorine for 8 to 9 days. Hence, there will be a need to bring a new tank car to the site approximately every week, and there is provision for two cars to stand side by side. These cars will be about 300 feet from the turbine building. The I control-room air intake is above and to the rear of the turbine building, i 136 feet above grade.

As previously mentioned, there are four potential modes of release of chlorine free the chlorine railroad carst (1) spontaneous failure. (2) an

earthquake, (3) shunting operations, and (4) the failure of pipework or l l couplings during discharge to the pumphouse.

i 1

I :

L 7.1.3.1 Spontaneous Failure of Chlorine Tank Cars '

a l Several studies of pressure-vessel reliability have been ande in the United Kingdom, the United States, and Germany. These studies have been surveyed in a review by the U.K. Atomic Energy Authority (Harsha11,1976) ,

and in the Canvey Island Report (HMSO, 1978). Appendix 7 of the convey t report states that "none of the surveys...have a common data base and all have amassed data against different selective guidelines. Hence, the 99- '

percent confidence upper bound for catastrophic or disruptive failure ranges from 2.7 x 10-6 to 4.6 x 10-4 failures per vessel year."

! Essentially, the conclusion of Appendix 7 of the canvey report in l that for all vessel types, the catastrophic failure rate is approximately 10~4,per year. It is increasingly accepted that very thorough inservice inspection programs and sophisticated inspection techniques should be capable of detecting defects that could lead to catastrophic failure. Ior vessels subjected to this kind of inspection, a catastrophic-failure rate of 10-5 per vessel year is frequently used.

1 Railroad tank cars are subject to a thorough inspection program and ,

thus it seems reasonable to assume a spontaneous failure rate of 10" per ;

year. Because there will sometimes be two chlorine tank cars on the rail-road spur, the predicted frequency of spontaneous failure of chlorine tank cars on the Limerick site is 2 x 104 per year. It is assumed that such a failure would lead to the rapid release of the whole contents of the tank

{ car.

l i

4 7.1.3.2 Earthquakes Leading to Chlorine Release I

The characteristics of earthquakes in the vicinity of the Limerick site i are discussed in Section 3.3.1 and Appendix A. In order to try to estimate I

the likelihood of a chlorine release, it is necessary to recapitulate some of the descriptions of the effects of earthquakes.

f The earthquake effects corresponding to various modified Mercalli intensity levels are shown in Table 10-6. Approximate frequencies of 7-5

.. _ . _ . . - _ ~ ~ _ ._ . _ _ _ _ . _ _ . _ _ _ - _ _ _ _ _ _ _ _ _ _ _ . . -. . _ _ . _ . , ,_-

. - . . . . . -. - . - . . . . _. -- . - _ - . ~. .

l l exceedance for earthquakes of intensity VI. VII, or VIII (which correspond i to peak ground-motion accelerations of 0.25g, 0.37g and 0.62g, respectively) are 1.6 x 10-4 per year, 3.6 x 10-5 per year, and 7 x 10-6 per year, i respectively, based on a study by ERTEC for the Limerick area. i It seems unlikely that gross rupture of a railroad tanker would be l caused by an earthquake of less than intensity level VIII, and probably not even then. The judgment is ande because, as een be seen from Table 10-6, an earthquake of intensity VIII would probably not be violent enough to over-turn the tank car; the table speaks only of the fall of elevated tanks.

Hence, the predicted frequency of gross rupture, assuming that two tank cars are always present, is not more than 1.4 x 10-5 per year. For failure of connecting pipework, level VI is judged to be the lower limit of intensity for which such a failure is plausible since the next lowest category, V, does not lead to any breakage. Assuming that only one tank car is connected to the pumphouse at any one time, the predicted fr pipeline break caused by an earthquake is 1.6 x 10yency of a connecting per year.

1 7.1.3.3 chlorine Leaks caused by shunting Accidents For this case, it is ccnservatively assumed that while a tank car is being moved around the Limerick site, it accidentally collides with an ob-i ject and ruptures or loses an appendage, leading to the rapid loss of most of its contents.

j The predicted frequency of such a release is calculated as follows.

Some 50 cars will be brought onto the site each year, and the length of the railroad spur over which they will travel is 0.5 mile; hence, there will be 25 car-miles per year. From the Federal Railroad Association (FRA)

Accident / Incident Bulletin for 1979-1980, it can be deduced that, for all cars containing hazardous material, the rate oz. failure per car-mile during switching is 3.8 x 10-7 Hence, the predicted frequency of occurrence of i such a release is 25 x 3.8 x 10-7, approximately 10-5 per year. [

7.1.3.4 Leakage of chlorine while car is Being connected or Discharged ,

4 The probability P(leak) of a leakage during use or hookup actions is made up of two parts l

P(leak) = P(pipe break or leak) + P(pipe misconnection)

, where P(pipe break or leak) = rate of failure per foot per hour x number of feet x time, and P(pipe misconnection) = P(human error per connection causing a leak) x number of connections per year.

The predicted frequency of failure of the tank-car-unloading pipe and

, connector is 6.43 x 10-7 failures per hour, or 5.6 x 10-3 failures per year. This frequency was calculated in terms of the separate failure fre-j quencies for the components of the connection between the tank car and the 7-6

_- -. _ . . . . . . . . ~ _ . , _ _ _ _ _ . _ . _ . . _ . . . ._. . . ~ . . . . .__ _ . . _ _ _

1

}

pumphouse building. The frequencies for these components-three pipe sec-tions, four valves, and two flanges--are presented in Table 7-1.

! The contribution of human error to the frequency of leakage is esti-mated as follows. According to data provided by the U.S. Nuclear Regulatory Commission (USNRC, 1975) the rate of human error for a repetitive action lies in the range of 10" to 10-4 per action. The lower bound is for cases in which the system has been designed to make error difficult; it is assumed that the lower bound applies. Since there are an estimated 50 ship-ments of chlorine per year, the rate of chlorine spille due to human error is 5 x 10"3 por year. Hence, the total probability of chlorine leakage while the car is being connected or discharged is 10-2 per year.

7.1.3.5 Size of Leaks As previously discussed, it is assumed that spontaneous tank failures, (

, seismically induced failures, and failures during shunting operations all lead to large releases of chlorine. This is certainly a conservative as-sumption, but since the total predicted frequency of such events is only ap-j proximately 2 x 10"4 per year, the contribution to public risk (when taken together with the predicted probability that the detection and isolation system will fail to work and that the operators will be incapacitated, as discussed below) is very man 11.

The predicted probability of failure of connections or pipework of 10-2 per year includes releases of a wide range of magnitudes. Hence, an analy-j sis of 59 accidental releases from chlorine railroad tank cars has been made from reports covering the years 1975 to 1982 in a hasardous-materials com-puter printout issued by the U.S. Department of Transportation (1982).

l Table 7-2 gives the spill-size distribution of 37 of these releases that oc-curred while the car was stationary. As can be seen, all of these accidents led to small releases of chlorine (the average tank car contains about 17,000 gallons), and there is a 90-percent chance that the spill size will not exceed 100 gallons.

7.1.3.6 Dispersion of Chlorine Sections 7.1.3.1 to 7.1.3.5 are concerned with the bottom lef t-hand corner of Figure 7-1-the ways in which chlorine can be released, how fre-quently this happens, and how large a quantity of chlorine is released. The i next step is to consider the wind direction and the atmospheric dispersion.

In the cose of the onsite chlorine, the following two factors will dominate the dispersion:

i 1. The fact that chlorine is denser than air.

I

2. The fact that it is released among various structures (i.e.,

reactor building and the pumphouse) . It is the turbulence induced by these structures that dominates the local-turbulence intensity.

7-7 r

. . - . . . _ _ .. , -,.-.._.m-__. . , . _ . . _ _ , _ - . _ _ _ _ _ . . _ - . _ _ , . - . . _ , . , . . . - _ _ _

- __ m _. _ . . . . . . -

- ._. .m.-_ _.__ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ ,

i t

i The significance of the second point is that the wind direction is of secondary importance. For release of a passive gas (i.e., one of neutral

buoyancy), thorough mixing would occur throughout the turbulent wake of the various structures, and, as a first approximation, the gas would be swept up to the control-room air intakes independently of the wind direction. The density of chlorine complicates matters, however. If there were no wind, it would flow such like a liquid and would not reach the control-room air I intakes, which are 40 meters above ground. It is not clear what would happen to the chlorine if there were wind, and hence turbulence in the wake of the structures. The dilution of heavy vapors in turbulent building wakes has received little attention in the literature, and there are no reliable predictive techniques (Britter,1982; Britter and Griffiths, 1982); hence, it has been decided to treat the chlorine as if it were passive. This is certainly conservative, since the chlorine is more likely to remain near

' ground level.

1 A simple presentation of the behavior of possive releases in turbulent [

building wakes has been given by Hunt (1978) in an unpublished reference, which has been summarized by Griffiths and Kaiser (1982) . Based on this de-scription, it is conservatively estimated that a release of at least 60 kilograms would be required to give average air-intake concentrations in ex-cess of 40 parts per aillion (ppa) (1.2 x 10-4 kilograms per cubic seter) for 2 to 3 minutes and 10 ppa (2.9 x 10-5 kilograms per cubic meter) for 1 0.5 to I hour. These concentrations are similar to those at which the oper-ators would be adversely affected (Dicken, 1974). Approximately one-fifth of the releases in Table 7-2 are larger than 60 kilograms. Hence, the pre-dicted frequency with which the pipework connecting the railroad tank car to the pumphouse might leak and, given the absence of a detection and isolation capability, might cause distress to the operators is 10-2/5 - 2 x 10-3 ,

per year. In the work below, such leaks are conservatively modeled as if they were large releases.

7.1.3.7 Detection and Isolation Capability In this discussion of chlorine, it has been conservatively predicted

, that the frequency with which chlorine might enter the control room in concentrations sufficient to disable the operators is approximately 2 x 10-3

, per year, if there were no detection and isolation capability. The next step is to evaluate the probability that the system will fail on demand.

The control-roce " environmental envelope" dur' ng an accidental chlorine ,

release at the LGS consists of the following facilities: the control room, shift superintendent's office, general office, instrument shop and labora- -

tory, bathroom, ar.d utility roca, all at an elevation of 269 feet. The rate of control-roce inleakage, when the room is isolated is 0.25 air change per hour. The design is intended to prevent an accidental release of chlorine, l

7-8 ,

l l l i

- . _ - , __ . . . _ . . . , . . - _ . _ . . _ , . _ _ . . . .., _ . , . _ _ _ _ . . _ , . . . _ _ . _ _ . , _ . - ___...._I

f i

either on or off the site, from affecting the habitability of the control room. The automatic detection and isolation system is discussed below.

There are four chlorine detectors located in the control-room fresh-air intake plenua,* two redundant isolation valves, and associated instrumenta-l tion and controls. The detectors are located at an elevation of 352 feet, directly above the control room ventilation supply plenus. These detectors are safety-grade, Seismic Category I instruments with a response time, in-cluding automatic isolation, of 8 seconds; a sensitivity threshold of 0.03 ,

, ppe of chlorine; and a continuous-operation time of 168 hours0.00194 days 0.0467 hours 2.777778e-4 weeks 6.3924e-5 months before a re- .

placement is required for the cassette tape. Each detector has local audio i and visual alaras and will sound an alare in the control roca and automati-cally initiate the isolation of the control room. '

The two redundant isolation valves, HV021 A and HV021B, are air-operated butterfly valves located in series, each receiving isolation signals from a i pair of chlorine detectors. Only the signal from a single detector is re-quired to close an isolation valve. These two isolation valves are normally

open but will fail closed. A simplified schematic of the isolation system is presented as Figure 7-5, and a reliability block diagram as Figure 7-6.

, A logic model (i.e., a fault tree) has been constructed to delineate ;

plausible modes of failure and/or unavailability of components that can lead >

to failure of the system, as shown in Figure 7-7. System failure is defined 1 as the failure to automatically isolate the control room when the chlorine i

concentration at the control-room air intake exceeds 0.5 ppe, the level at which the detectors will be set.

Within the fault tree, isolation valve 1 denotes the totality of the butterfly valve HV021A, the solenoid valves SV021 A1 and SV021 A2, and their associated air-supply system. A similar definition applies to isolation 4 valve 2. Detector A denotes the chlorine detector A at the control-roce air

[ intake as well as its associated signal channel A.

l l Three ways in whic; the system might fail are as follows:

1

1. Failure of isolation valves 1 and 2 to close for independent reasons. The nonclosure of an isolation valve can be caused by the random failure of the isolation valve (failure to operate on de-mand) or the failure of both detectors associated with the isola-

tion valve to detect chlorine (detectors A and C for isolation valve 1, B and D for isolation valve 2). The failure of a detector l ( A or C for isolation valve 1) to detect chlorine can be caused by the random failure of the detector or the unavailability of the

, detector during maintenance. The maintenance specifically refers j to the replacement of the cassette tape of a detector every 168 ;

1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

i

An additional chlorine detector is located at the chlorination facil-O ity. This gives an alara locally and in the main control room.

7-9 .

t

. _ . -_ . _ . - . .~ . . _= - . . .- . - . . . _ . . - - - - _ - - - - - - - - -

l l l l

2. Common-cause failure of both isolation valves. ,

3. Common-cause failure of all four detectors.

[ These common-cause failures can occur as a result of a commonality of j defective parts; common human errors associated with test and maintenance; potential effects of temperature, corrosion, and grit; or potential errors in design, manufacturing, quality assurance, or installation.

The failure-on-demand probability for an air-operated valve is 2 x 10~3, according to data from Hubble and Miller, 1980. The probability of the random hardware failure of a detector is estimated to be 10-2 per demand, using an asmised 1 x 10~4

< interval; 1 x 10"4 x 168/2 2.per Thishour10-4 failure per rate hourandfailure a weekly rate test is judged to be a reasonable estimate for the type of detector considered.

The random hardware failure may occur in the photometric sensors, the output signal channels, or in the continuously operated tape cassette subsystem.

The unavailability of a detector due to replacement of the cassette tape every 168 hours0.00194 days 0.0467 hours 2.777778e-4 weeks 6.3924e-5 months is a roximately 1 x 10-2 using a 1-hour replacement time (1/168 = 0.0061 ) . These data are tat.ulated in Table 7-3.

The common-cause failure probability of both isolation valves is assumed valve, thattois,be0.110xpercent 2 x 13"3of=the 2 x failure 10" . The grobability of a single common-cause failure isolation of all four detectors is, very conservatively, assumed to be again 10 reent of the failure probability of a single detector = 10-3 for common-cause hardware failure and 0.1 x 10-E =that 10-3 for common-cause is. 0.1 x 10" maintenance unavailability. Tape-cassette replacement will be conducted, by procedural requirements, in a staggered fashion.

Using these estimated probability values for failure and unavailabil-ity, the system-failure probability is approximately 2 x 10-3, with a breakdown of contributions as follows:

1. Common-cause failure of all four detectors: 2 x 10-3

a. Hardware contribution: 1 x 10-3

b. Maintenance contribution: 1 x 10~3

2. Common-cause failure of both redundant isolation valves: 2 x 10-4

3. Independent failures: 6 x 10-6 As is obvious from these results, the model for common-cause failure of the four detectors has the most significant impact on the estimated prob-ability of system failure. The assumptions on which this is based are clearly conservative; hence, the result is an upper bound on the true failure rate.

7-10

i j 7.1.3.8 Effect on Operators

^

As indicated in Figure 7-2, the operators may become incapacitated for i one of two reasons. First, if the deteetion and isolation system fails to

- work, the operators will be incapacitated within about 1 minute. Second, even if isolation works, if the operators do not put on their breathing masks, _ they will be incapacitated within about 10 minutes, assuming an in-leakage rate of 0.25 air change per hour. According to the method of Opera- l

tor Action Trees developed at NUS (Wreathall,1982) to model human behavior in the control room, the probability that a team of operators will actually perform an action for which they have been trained varies with time as shown in Figure 7-8. The probability of failure to act within 10 minutes is 2 x 10-2; this is taken to be the probability of branch Ba presented in Figure 7-2.

Since chlorine is not hallucinogenic, it is assumed that the operators, even if incapacitated, will not act in such a way as to deliberately cause core melt. Ra ther , they simply will not be able to respond positively if required to do so. Essen tially, this means that they will not be able to respond to a train of events set in action by a transient. For Limerick, it is predicted that there are an average of six transients per year (PECo,

1981). In addition, discussions with the operators at a BWR similar to the LGS indicate that operators take action to prevent such occurrences an ad-ditional 6 to 12 times a year. Assuming that the operators are out of ac- ,

tion for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months ,* the probability that they will be asked to respond to a transient is 4 x 18/8760 - 0.01.

Even if the operators fail to respond to a transient, core melt and the release of radioactive material to the environment may still not occur.

2 Evaluation of the LGS isolation transient event trees with an assumed 100-percent chance of failure for operator actions shows that, providing relief operators are able to reenter the control room in no more than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , the conditional probability of core melt is 10-2 Hence, the pre eted prob-l ability of core nelt given operator incapacitation is 1 x 10-Combining all of the analysis in Sections 7.1.3.1 through 7.1.3.8, the predicted frequency with which core melt any result from an onsite release of chlorine, is 5 x 10-9 per year. (see Table 7-4). Such events would con-tribute either to Class I or Class II sequences, as defined for interns 1 ini tia tors. Since the predicted frequency of occurrence of Classes I and II due to internal initiators is 1.3 x 10-5 per year, accidental releases of !

j chlorine on the site contribute negligibly to public risk.

l t

7.1.4~ RAILROAD l The nearby Conrail line runs through the site on the eas t bank of the I Schuylkill River. At its point of closest approach, the railroad is approx-instely 800 feet (250 meters) from the control-room air intakes. Table 7-5

This figure was chosen because it is half the length of a shif t.

11 1

d-- a...._---_,--

contains the results of a survey of toxic chemicals on this railroad (Bechtel, 1980-1983).

t There is also a Conrail line running North to South, passing alcag the western boundary of the site on the far bank of the Schuylkill River. This is a relatively unimportant railroad due to low traffic and is not con-sidered further in this analysis.

j 7.1.4.1 Frequency of Crash Leading to Toxic Release The basic statistic required for the analysis of public risk resulting from accidents to railroad cars carrying toxic vapors, or material that could produce toxic vapors, is the rate of accidents leading to spillage per car-mile. This includes both direct punctures and fire-induced ruptures.

For pressurized tank cars, a loaded tank-car loss-of-lading rate is de-termined in an Association of American Pailroads report to be 1.5 x 10-7 loss of ladings per tank car-mile (Association of American Railroads and Railway Progress Institute, 1972c). This spill rate is based on data avail-able from 1965 to 1970 in which a total of 49 loss-of-lading accidents was ,

observed. During this period, the average loaded pressurized tank car traf- l fic (flammable gases) was 5.38 x 107 miles per year (from "1% Waybill

. s ta tis tics") . Hence, the nationwide loss of lading rate for liquefied com-pressed flammable gases is as follows:

= 1.5 x 10-7 accidents per car-mile 5.38 x 10 car-miles x 6 years year In order to check whether this number is valid for later years as well as for toxic materials such as chlorine, data on chlorine spills were ex-tracted from the U.S. Department of Transportation Hazardous Materials In-formation System, 1975-1981. During this period, there were nine vehicle accidents. According to "1% Weybill Statistics," there were 7.6 x 107 car-miles. Hence, the loss-of-lading rate per chlorine car-mile is 9/(7.6 x 107 ) - 1.2 x 10-7 This is close to the 1965-1970 figures for pressurized cars containing flammable materials.

Within the last 3 years, several improvements have been made to pressurised tank cars. Shelf couplers have been installed in all cars as of l January.1, 1979. Since January 1,1979, the standard pre-1979 pressurized l tank cars (Type A) have gradually been modified as follows: S-cars are those equipped with head shields, and T and J cars are those equipped with head shields and thermal shields. Detailed inforn.ation on these modifications may be found in a report on the Railroad Tank Car Safety Research and Test

, Project ( Association of American Railroads and Railway Progress Institute, 1981). The abstract of this report says:

The Class DOT 112(114) tank -cars retrofitted with shelf couplers, head shields and thermal shields under HM-144 have now had sufficient service experience to permit an assessment of their J

i 7-12

. . _ _ _ . . ~ _ _ . _ , , _ _ _ - - , , .-.,m ,.,_..,-...-._.v.,. -

.. . , _ - , , , .,_ - - - , _ ,-m-,

l P

T

, effectiveness. Specifically, the fleet of 112(114) cars has had i about 2-3/4 fleet-years experience with shelf couplers and 1-3/4 fleet-years experience with head shields and thermal shields.

Accident data for the last 2-1/4 years (average fleet-years the i cars have been equipped) are compared to accident data for the previous 14 years. It is found that the frequency of head punc-tures has been reduced . to about one-seventh the previous rate, and the frequency of fire induced ruptures has been reduced to about .cne-third the previous rate. Shell punctures have de-creased, but the limited number of cases precludes quantifying the amount. Considering all cases of punctures and ruptures combined, and normalizing on the basis of car population, the frequency has dropped to about one-fourth of the previous rate.

_ Finally, some of the hasardous materials listed in Table 7-5 are not j carried in pressurized tank cars. Data available in FRA Accident / Incident i

Bulletina have been used to derive a rate of release for all hazardous mate-rials of 1.3 x 10-7 per car-mile (main line) .

In summary, the following failure rates have been chosen:

1

1. Releases from pressurized tank cars: 4 x 10-8 per car-mile.

2. Releases of other hasardous materials: 1.3 x 10-7 per car-mile.

i i

l 7.1.4.2 Automatic Detection and Isolation Automatic detection and automatic isolation is provided for chlorine. !

} According to Table 7-5, there are up to 1000 chlorine shipments per year past the site. Given a crash-and-spill rate of 4 x 10-8 per mile, the predicted frequency of chlorine spills on a 1-mile stretch of track is 4 x 10-5 per year. Making a highly conservative assumption that spills anywhere along a 10-mile stretch of track could lead to excessive concen-trations of chlorine at the control-room air intake leads to a spill rate of 4 x 10-4 per year.

Next, the probability that the wind will blow toward the plant must be considered. Chlorine is denser than air and would form characteristically l

I broad " pancake" clouds if the contents of a railroad car were suddenly re- '

- leased. Typical widths of such clouds, for large releases of railroad car-sised quantities, range from 500 to 1000 meters. At distances of 1 mile or more, the width of a 22.5* sector is 650 meters, or more. Hence, if the plume centerline is directed between 122.5* of the _ control-room air intake, toxic vapor might enter those intakes. According to the FSAR, the two adjacent sectors from which the wind is most likely to blow lie in the di-rection of the Hooker Chemical Plant (i.e. , across the railroad and river) .

The probability in question is .25. Applying this, conservatively,_to the l assumed 10-mile stretch of track, less the 2 miles located adjacent to the plant, .for which a factor of .5 is assumed, gives a factor of .3, which re-

' duces - the above frequency of 4 x 10-4 per year to 1.2 x 10~4 per year.

. 7-13

_=- - - _- - - _ . _ _ - - _ _ - . . - . . - - . . - . - . . - . . - - - . . . - - - . _ . . . - . - , - - - . , - - . . . - -

This is the predicted frequency of event Ex on the event tree in Figure 7-2 The probabilities of the branches Ai (probability of failure of automatic ,

detection and isolation) and C, (probability of core melt given operator I incapacitation) in Figure 7-2 have already been quantified 2 x 10-3 and 1 x 10-4, respectively (see Table 7-4). The probability of branch B, (probability o' failure to don breathing masks) is not the same as in Table 7-4, however, since a spillage of chlorine on the railroad leads to a different rate of buildup of chlorine in the control room than does an onsite spillage. The available time at an assumed inleakage rate of 0.25 air change per hour is 4.3 minutes (Bechtel, 1980-1983), and according to Figure 7-8, the probability of the operators failing to put on their masks is .1.

Overall, the predicted frequency of core melt caused by an offsite ;

chlorine release is 1.2 x 10-9 per year (see Table 7-6). This is a very !

. small frequency, in spite of the conservatisms in the calculations (e.g.,

the use of a 10-mile stretch of track) . i 7.1.4.3 Automatic Detection and No Automatic Isolation There are five chemicals for which automatic detection will be pro-vided: anhydrous ammonia; ethylene oxide; vinyl chloride; phosgene (which is a product of combustion of vinyl chloride); and formaldehyde. Of these, only formaldehyde is not carried as a liquefied gas under pressure.

7.1.4.3.1 Frequency of Excessive Concentrations at Control-Room Air Intake Using the crash-and-spill rates given in Section 7.1.4.1 (4 x 10-8

, per car-mile for pressurized cars, 1.3 x 10-7 per car-mile for other mate-rials), together with (1) the number of shipments per year of each material given in Table 7-5 (1000 each for anhydrous ammonia, ethylene oxide, and vinyl chloride and 99 for formaldehyde); (2) the conservative assumption that a 10-mile stretch of track is appropriate (Section 7.1.4.2); and (3) a probability of .3 that the wind blows toward the plant (Section 7.1.4.2),

the predicted frequency of excessive concentrations at the air intake is as follows: i Anhydrous ammonia 1.2 x 10-4 per year Ethylene oxide 1.2 x 10-4 per year Vinyl chloride and/or phosgene 1.2 x 10-4 per year each

+

Formaldehyde 3.7 x 10-5 per year Total 5.2 x 10-4 per year This total conservatively assumes that vinyl chloride and phosgene are each effectively shipped at a rate of 1000 shipments per year. The frequencies given above are the frequencies of event Ex on the event tree presented as Figure 7-3.

7-14 l

7.1.4.3.2 Probability of Detector Failure The automatic detection system will consist of two redundant infrared spectrometers, each of which will provide a signal to an alarm in the con-trol room if the concentrations of any of the above chemicals rise above the l set points presented in FSAR Table 2.2-6.

Each detector is a MIRIN-801 Air Monitoring System, manufactured by the Foxboro Analytical Company. This is a central air-monitoring system con-sisting of a microcomputer built around the Intel 8080A microprocessor and integrated with an infrared spectrometer and a sultipoint sampling manifold.

The 7.w11 ability of the system was quantified as follows. First, it is I pertinent to note that no comparable system failure probability could be found in the data sources which were reviewed: WASH-1400, IEEE-STD 500, the Zion PRA (Ceco, 1981), and information from the manufacturer. Second, reliability data are generally not available at the detailed level of the individual components of the MIRAN-801 system. For these reasons, a fault-tree analysis could not be justified, and a simplified block-diagram ap-proach was adopted (see Figure 7-9). The basic input data used to quantify Figure 7-9 are summarized in Table 7-7.

The quantification of the conditional probability of failure on demand of the air-monitoring system was carried out using the following Boolean equation:

Air Both Monitoring MIRAN Support Common System units Alarm System Cause P, = P, +P + P, +P (7~1}

F F The basic failure probabilities (Py) were calculated to include a demand-failure probability due to hardware failures and an unavailability due to testing or scheduled maintenance. Failures during the short mission time for the system are negligibly small.

Unavailability of the MIRAN-801 i

i First, using the symbols from the reliability diagram (Figure 7-9), the probability of random hardware failure of a MIRAN detector is given by con- !

sidering the failure probabilities oC A + B + C(3) + D + E + F + G, which !

constitute the basic elements of a MIRAN. Overall, using the probabilitier for- A through G in Table 7-7 and a test interval of 30 minutes (the MIRAN is selftesting within this interval), the random probability of failure on demand for a MIRAN unit is 6.5 x 10-6, Second, it is assumed that each MIRAN detection system will be unavail-able - for 1 shif t per year for maintenanco and 1 shif t per year for testing.

That is, the probability that the system will be unavailable on demand due to testing or maintenance is 16 hours1.851852e-4 days 0.00444 hours 2.645503e-5 weeks 6.088e-6 months per year - 2 x 10-3

~

Maintenance and testing will be arranged so that, at most, one of the two redundant systems is unavailable at any time. Thus, the overall probability that a MIRAN-801 system will be unavailable en demand is 6.5 x 10-6 + 2 x 10-3 7-15

The probability that both systems will be unavailable on demand is 2 x (probability that one system is unavailable for any reason) x (probability that the other s

- 2 x (2 x 10-3)ystem x (6.5 is unavailable x 10-6 ) - 3 xdue to random 10-8 This is hardware failure) the probability.

Both MIRAN p Units The alarm system was calculated as P =H +I (7-2)

From Table 7-7, the probability of random hardware failure of the output relay is 1.2 x 10-4 per demand, giving an independent failure probability of the redundant relays of 1.5 x 10-8 It is assumed that the testing and raintenance time for the relay is negligible. Table 7-7 also shows that the probability of an alarm failing is 8.4 x 10-5 per hour. Assuming that the alarm is tested once each shif t, the probability of failure on demand is 8.4 x 10-5 x 8/2 - 3.4 x 10-4 The overall value of pP Alarm is there-fore 3.4 x 10-4 per demand.

Support Systems The probability of failure of the air-monitoring system due to failure of the support systems is 1.2 x 10-5 per hour, from Table 7-7 It is assumed that, on average, the systems are lost for no more than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ; Support P

F

= 1.2 x 10-5 per demand f

Common-Cause Failure There may be a common-cause failure of the MIRAN-801 system or a common-cause failure of the relays. As in the case of the chlorine monitor, a common-cause failure probability of 10 percent of the probability of failure of an individual detector or relay is assumed. Hence 1

Common P, = 2 x 10-4 + 1.2 x 10-5 = 2.1 x 10-4 (7-3)

In summary Air Monitoring P, I" *" - 3 x 10-8 + 3.4 x 10-4 + 1.2 x 10-5 + 2.1 x 10-4

- 6 x 10 per demand. (7-4) 10 i

7-16 i

~ , -. , .--n

. ._ . __. _ ~. _ _- _ _. __ _ __ . ___ _ _ . _

7.1.4.3.3 Probability of Failure To Don Breathing Mosks The following times are available for the operators to don their

, breathing masks (calculated from the moment at which the control-room con-centration first reaches the TLV): anhydrous ammonia, 2.2 minutss; ethylene 4

oxide, 2.2 minutes; formaldehyde, 7.6 minutes; vinyl chloride, 24 minutes; phosgene, 2.4 minutes. Using Figure 7-8, the probabilities of event B a (failure to don breathing masks) presented in Figure 7-3 are as follows:

- Anhydrous ammonia .5 Ethylene oxide 5 Formaldehyde 3 x 10-2 Vinyl chloride 2 x 10-3 Phragene .5 :

j Regarding the value of .5 for chemicals for which the operators have only about 2 minutes to act, Wreathall (1982) indicates that the extrapola-tion of the curve in Figure 7-8 to such small times is of doubtful validity.

However, it is judged that the value of .5 is reasonable for those cases i where the operators respond to a clearly annunciated alarm and have previ-ously been informed of the response expected of them but have not undergone 4 any repeated training in the drill. The value represents the likelihood l that at least two (one per reactor) of the five licensed operating staff present in the control room are successful in donning the breathing sets that are located in the control room.

Discussions with PECo's operations staff suggest that this probability 4

could be reduced to no greater than .1 by a training program that reinforces the need for a prompt response by operators to protect their own health and the periodic holding of drills to practice and reintorce the actions.' For this analysis, it is assumed that such a training program will be adopted, and the probability of event B, in Figure 7-3 is .1 for phosgene, anhydrous ansonia, and ethylene oxide.

I-d 7.1.4.3.4 Overall Frequency of Core Melt l The calculation of the overal) fiequency of core melt for these five chemicals is summarized in Table 7-8. None of the chemicals is narcotic, or will cause irrational behavior in the operators. Therefore, the same probability of core melt, given operator incapacitation, is used as chlo-

rine: 1.0' x 10-4 The total predicted frequency of core melt, caused by the spillage of anhydrous ammonia, ethylene oxide, formaldehyde, or vinyl chloride (with phosgene) is 3.7 x 10-9 per year, which is again asall compared with the frequencies of Classes I and II for internal initiators (1.3 x 10-5 ) ,

7.1.4.4 Detection by Smell (Chemicals on Railroad Only)

The list of chemicals which the operators will be trained to detect by smell is given in Section 7.1.1.3. Of these, only two are corried on the railroad: acetaldehyde, 500 shipments per year, and hydrogen cyanide, 500 7-17

. c- . - __ __ __ - _ . _ . _ - _ . _ _ - - _ - - . . , . _ - _ _ _ _ . _ . . . - - _-_ _

l shipments per year. (The remaining chemicals are shipped by road or stored ,

1 on the Hooker site; see below.) According to Section 7.1,4.1, the ability of spillage per car-mile for these materials is 1.3 x 10-7. prob- Mak-ing the usual conservative assumptions about a 10-mile atre tch of track and ,

a wind-direction probability of .3, the predicted frequency of occurrence of po ten x 10 pally per hazardous year for each concentrationschemical. at the control-room air intake is 1.95 Failure To Detect by Smell and Den Breathing Masks 7.1.4.4.1 The operators will be trained to detect by smell and don breathing masks as part of a single operation. Thu's, the B, branch in Figure 7-3 is redundant, and its probability is included in the probability of Sa (fail-ure to de tec t by smell) . Either the operators detect by small and don their i masks, or they are incapacitated. The operators have 48 minutes before incapacitation by hydrogen cyanide and 33 minutes before incapacitation by j acetaldehyde, af ter concentrations reach the TLV in the control room (Bech tel, 1980-1983). It should be noted that these values represent the times from when the various concentrations in the control room reach the TLV. In mos t cases, the TLV concentration is subs tantially above the thres-hold of smell. For example, in the case of hydrogen cyanide, the TLV is 3

10 times the concentration representing the threshold of smell. There-fore, the times available to detect the characteris tic small can be expected

! to be greater than those above, and there is little uncertainty about the deteetability of the smell.

If the operator-response relationship of Figure 7-8 is used for the combined operation of detection by smell and the donning of breathing masks, the failure probability is 5 x 10-4 for hydrogen cyanide and 10-3 for

, ace taldehyde. However, a lower bound should be introduced on the probabil-i ty to take into account that the agplication of Figure 7-8 to detection by smell is new. A lower bound of 10- has been conservatively chosen; hence, the failure probability for hydrogen cyanide has been increased to 10-3

- 7.1.4.4.2 Overall Frequency of Core Melt Hydrogen cyanide is not a hallucinogenic, but acute involuntary expo-sure to high levels of acetaldehyde could lead to " excitement" and narcosis

( Si t tig, 1981). For hydrogen cyanide the probability of core melt, given operator incapacitation, is 1 x 10-4,,as discussed in Section 7.1.3.8. If exposed to acetaldehyde, it is possible that an operator would behave irra-3 tionally. This is hard to quantify, but it is very unlikely that randon, irrational actions by an operator or operators would lead to core melt; thus l a probability of .01 is assigned - to branch C, (core melt given operstor.

incapacitation) in Figure 7-3. This is judged to be highly conservative.

Table 7-9 calculates the predicted frequency of core melt caused by the spillage of toxic vapors on the railroad, requiring detection by smell, to be '2 x 10-9 per year. This again'is a small percentage of the frequency of Classes I and Il source terms for internal initiators 1.3 x 10-5 per l . year.

l-7-18 l

I

7.1.4.5 other Toxic Chemicals Transported on the Railroad The remaining materials presented on Table 7-5 were eliminated because deterministic calculations show that none reached incapacitating levels in the control room (Bechtel, 1980-1983). Additional probabilistic analyses have shown that the probability that incapacitating concentrations will be reached in the control room is very small.

7.1.5 HOOKER CHEMICAL PLANT The chemicals that are stored on the site of the Hooker Chemical Plant

are listed in Table 7-10. Analyses indicate that only two of these chemi-cals, vinyl chloride and vinyl acetate, could lead to potentially incapaci-tating concentrations in the control room; phosgene must also be considered, since it is a product of combustion of vinyl chloride.

7.1.5.1 Vinyl Chloride and Phosgene For these materials, automatic detection will be provided. The pre-dicted frequency of core melt resulting from the accidental escape of vinyl chloride from the Hooker Chemical Plant is made up of the factors discussed below.

l

7.1.5.1.1 Predicted Frequency of Release i

In principle, there are five possible ways in which toxic vapors could

, be released from the Hooker plant:

1. Failure of a pressure vessel, either spontaneously or induced by fire.

I

2. Release during shunting operations or road tanker movements.

3. Accidental rupture of pipework.

4. Earthquake.

5. Loss of control of the polymerization process.

As a highly conservative upper bound on the frequency of release, a value of 0.1 per year is taken for a najor release of each chemical. This takes into account that the Hooker Chemical Plant has been operating for many years without the occurrence of a release that would have threatened the health of the operators at the LGS, had the LGS been operating over that period. It is arbitrarily assumed that the vinyJ chloride burns to form phosgene 50 percent of the time.

O 7-19

i i

7.1.5.1.2 Wind Direction l

The Hooker Chemical Plant is about 6000 feet west of the LGS. At this l dis tance, the 22.5* sector centered due west is about 2600 feet across.

Conceivably, a large slumping cloud could achieve a width comparable to this. Conservatively, the probability that the wind would carry such a cloud toward the plant may equal that of the wind blowing into two sectors from the west or west-north-west, which is .25 (see Table 2.3.2-26 of the FSAR); these are the prevailing wind directions.

7.1.5.1.3 Failure Probability of Automatic Detectors This has been determined in Section 7.1.4.3.2 to be 6 x 10-4 per demand.

7.1.5.1.4 Failure To Don Breathing Masks Operators have 14 minutes to don their breathing masks in the event of an accidental release of vinyl chloride from the Hooker Chemical Plant or 11 minutes if the cloud burns to form phosgene. Figure 7-8 shows that the probability of branch B, in the event tree presented as Figure 7-3 is l

t 2 in each case.

7.1.5.1.5 Probability of Core-Melt Conditional on Operator Incapacitation This has already been determined to be 1.0 x 10~4 1

7.1.5.1.6 Overall Frequency of Core Melt The product of the above factors is summarized in Table 7-11, leading to a conservative bound on the predicted frequency of core melt due to the accidental release of vinyl chloride of 2 x 10-8 per yeer.

'7.1.5.2 Vinyl Acetate The calculation of the predicted frequency of core melt due to the accidental release of vinyl acetate from the Hooker. Chemical Plant is sus-marized in Table 7-11. Many of the factors are the same as for vinyl chlo-ride.- Vinyl acetate is one of the chemicals that will be detected by smell.

l In the event of an accidental release of vinyl acetate, operators should have 15 minutes to don their breathing masks. The probability of failure is i 10-2 as shown in Figure 7-8. The overall frequency of core melt due to an l

accidental release of vinyl acetate from the Hooker site is 2 x 10-8 per year.

7-20

\

7.1.5.3 Other Chemicals at the Hooker Site Other chemicals at the Hooker site were eliminated because none of them reached incapacitating levels in the control room.

. 7.1.6 HIGHWAYS Three major highways pass within 5 miles of the site:

1. U.S. Route 422, an east-to-west highway passing approximately 1.5 miles north of the site.

2. Pennsylvania Route 724, a southeast-to-northwest highway passing approximately 1 mile southwest of the site.

3. Pennsylvania Route 100, a north-to-south highway passing approximately 4 miles west of the site.

Table 7-12 lists those chemicals that are carried on the highway; how-ever, no information is available on the frequency of shipment. Hence, a simplified bounding analysis of the contribution to risk of the highway accidents is required.

The Pennsylvania Department of Transportation has provided statewide information for highway accidents. For the years 1977-81, there were an O' average of 30 accidents per year with loss of cargo. This was for all cargoes, so the figure 30 is an upper bound on the number of accidents per year involving spills of hazardous materials. Assuming that the number of accidents within a 5-mile radius of the LGS can be obtained by multiplying the statewide totals by the ratio of the area of a circle with a radius of 5 miles (-75 square miles) to that of Pennsylvania (*44,000 square miles),

the number of spills of hazardous materials in the neighborhood of the LGS has an upper bound of 1 in 20 years. There are 30 chemicals listed in Table 7-12; hence, the average rate of crash and spillage within 5 miles of the LGS for each chemical is 1/(20 x 30) = 2 x 10-3 per year. Of the chemi-cals listed in Table 7-12, only six (hydrochloric acid, hydrogen sulfide, fluorine,' hydrogen fluoride, ethyl mercaptan, and chlorine trifluoride) are predicted to reach incapacitating concentrations in the control room (Bechtel, 1980-1983).

l 7.1.6.1 Chemicals Detected by Smell (Hit 'way Only) of the chemicals listed in Table 7-12, five (hydrochloric acid, hydro-

, gen sulfide, fluorine, hydrogen fluoride, and ethyl mercaptan) will be de-tected by smell. Using the methods described above for relating the avail-able time to the probability of failure to detect by smell gives failure probabilities of 10-3 (hydrochloric acid), 10-1 (hydrogen sulfide), 10-2 (fluorine), 2 x 10-3 (hydrogen fluoride), and 10'1 (ethyl mercaptan) . None l of the materials in question is hallucinogen

! 21 I

p calculates the contribution to core-melt frequency given a spillage on the highway within 5 miles of the IGS, to be 1.1 x 10- per year.

7.1.6.2 Chlorine Trifluoride chlorine trifluoride is a highly reactive gas that is unstable in moist air. It decomposes, producing C1F, C102, C10F, C102 F, C103 F, C12* and HF.

It is expected that this gas will be detected by the chlorine monitor or by odor.

Several elements of the calculation of the contribution of this mate-rial to core-melt frequency are the same as those given for the other chemi-cals spilled on the highway: 2 x 10-3 per year for the rate of spillage within 5 miles of the I4S, .25 for the probability that the wind blows toward the plant, and 1.5 x 10-4 for the probability of core melt given operator incapacitation.

7.1.6.2.1 Operation of Automatic Detector If the automatic detector operates and isolates the control room, the operators have 53 minutes to don their breathing masks. As shown in Figure 7-8, the probability of failing to do this (B a) is 10-3 Hence, the p predicted frequency of core melt (event E xB in Figure 7-2) is (y 7 x 10-3 x 0.25 x 10-3 x 1 x 10 2 x 10-(mper year.

7.1.6.2.2 Detection by Smell Even if the chlorine detector fails to operate (event Ag, probability 2 x 10-3 ) , the operators should detect chlorine trifluoride by smell.

According to Table 7-14, the probability that they will fail to do this is 10-2 per demand. Hence, the freguency of core melt is predicted to be 2 x 10-3 x 0.25 x 2 x 10-3 x 10- x 1 x 10-4 = 1.7 x 10-12 per year.

7.1.6.3 Other Chemicals in Table 7-12 Other chemicals that might be spilled on the highway were eliminated because none reached incapacitating levels in the control room.

7.1.7

SUMMARY

- TOXIC-VAPOR ANALYSIS The bounding estimate of the total predicted frequency of core melt resulting from an accidental release of toxic vapors in the neighborhood of p the LGS is 6.3 x 10-8 per year. This estimate is summarized in Tabin 7-14.

To determine the significance of this estimate, it should be compared with 7-22

___ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ _ _ _ _ _ - _ _ __a

4 4

t

, the predicted core-melt frequency of the IGS Class I and II source terms, 1.5 x 10-5 per year. It is apparent that the release of toxic vapors is a i samil contributor to risk.

1 I EXPLOSIONS 7.2 As noted in Section 7.1.2, the Conrail railroad runs through the site on the East Bank of the Schuylkill River. At its closest point of approach it is approximately 600 feet (180 meters) from the nearest safety-related structure, the diesel-generator structure; 750 feet (230 meters) from the centor of the reactor enclosure; 900 feet (275 meters) from the control enclosure; and 1280 feet (400 meters) from the spray-pond pumphouse. These l are the safety-related structures considered in this study. According to Section 2.2.3.2 of the FSAR, safety-related structures are designed to withstand the blast from 56 tons of TNT--5.1 poi for the diesel-generator structure, 4.8 psi for the reactor enclosure (including the control enclo-sure), and 3 psi for all other safety-related structures. These are peak

" incident" overpressores.

I In this study, a probabilistic analysis has been carried out to deter-mine the frequency with which the overpressure capability of the safety-related structures will be exceeded for shipments of flammable vapors on the railroad; this is described below. Solid explosives are briefly discussed in Section 7.2.5. Explosions on the highway are not considered because it

, is smach further away (at least 1 mile), and because asaller quantities are carried by road.

7.2.1 ANALYTICAL MODELS 7.2.1.1 General Figure 7-10 displays an event tree for transportation hazards. The

first branch on the tree asks whether there will be an accident. The symbol P(A/M) stands for the conditional probability per rail tanker mile that there will be an accident. Given an accident, the next branch of the tree

, addresses the pos ;bility that there will be spills involving various frac-tions of the contchts of the rail tank car, tS , S2*83*84, in order of decreasing magnitude, with conditional probabilities P(Sj/A), P(S /A), 2 etc.

Once a spill has occurred, there are three possibilities: one is that there is a fire at the site of the crash, the second is that there is an explosion at the site of the crash, and the third is that a drifting cloud might be formed.

If there is a fire at the site of the crash, there is no hasard to the plant because the predicted heat loads on the structures are small. This is demonstrated in Section 7.3. If there is an explosion at the site of the crash, with probability P(E/St), it will not harm safety-related structures unless it is close enough to yield an overpressure in excess of the design-basis values at safety-related structures. This implies that the site of the crash must be within a certain distance, R, of the safety-related 7-23

structure, where R depends on the size of the spill as well as the parti-cular overpressure being considered. Figure 7-11 definess a circle og of radius R within which the explosion naast occur for there to be a hazard at the plant; that is, an explosion on the railroad must take place on the stretch of track Li shown in Figure 7-11 (i = 1, 2, 3, 4, depending on the size of the spill).

If a drif ting vapor cloud is formed within 01 , it may drift out of og or drift within O z, or, if formed outside 0 1, it may drif t into 0g. In any event, there may be an explosion within o g , and this would be potentially hazardous to the plant. There may also be a fire within og; but, as discussed in Section 7.3, this will not prove to be hazardous to the plant. Finally, the cloud may drif t into the smaller circle Ogg, where it may explode or may be ingested as a flammable mixture by the air intake of a safety-related structure and then explode.

Taking into account the sequence of events shown in Figure 7-10, the frequency with which the plant is predicted to be exposed to an overpressure greater than a certain value is the sum of the contributions from accident-site explosions plus drifting-cloud explosions. The former is P'E = NSH[P(A/M)] [P(S /A)][P(E/S )](L ) (7-5) where the symbols are defined above.

f

\

For drifting-cloud explosions, the predicted frequency with which the plant is exposed to an overpressure greater than a certain value is P

E" i

~

i

~

i f[P (Ignition O ll(P(E/I) AL ] (7-6) i=1 where NSH = number of shipments per year P(F/S i ) = conditional probability of a fire at the site of the accident given a spill of magnitude St P(E/S i ) = conditional probability of an explosion at the site of the accident, given a spill of magnitude St Pj(Ignition Oy ) = probability of ignition (fire or explosion) in Region I given a spill at accident-site j l

i lO r

1 l' 7-24

P(E/I) = conditional probability of an explosion given an ignition af ter the cloud has drif ted some way AL) = incremental length of route located a given distance and direction from the plant The probability of ignition in Region I is a function of where the ac-cident occurs (inside Region I, outside Region I, and distance away), the wind direction, and a probability of ignition as a function of cloud travel distance. The first summation in Equation 7-6 allows for varying spill sizes, while the second summation allows for different accident sites. The various steps in the analysis that is summarized on the event tree of Figure 7-10 are discussed below.

7.2.1.2 Frequency of Shipment The frequency of shipment of flammable chemicals and their properties are shown in Tables 7-15 and 7-16, respectively.

The following potentially hazardous explosive vapors were omitted from the analysis because of their high boiling points and the expected slow rate of evaporation. For these chemicals, it is expected that at any one time only a small fraction of the contents of the railcar would lie within explo-sive limits.

t 1. Acetone, boiling point 138'F

2. Methanol, boiling point 149*F

3. Acylonitrile, boiling point 170*F 4 Benzene, boiling point 176*F

5. Ethyl other, boiling point 94*F*

6. Xylene, boiling point 284*F

7. Ethylene dichloride, boiling point 182 *F In addition, anhydrous ammonia was not included in the analysis because Lewis (1980) classifies ammonia as a "sub-normal aerial explosion risk."

This class of vapors includes methane, which is generally thought to be a material that does not give unconfined vapor-cloud explosions (USNRC, 1976).

7.2.1.3 Size of Region I The size of Region I and the length Li of railway covered by the re-gion is obtained from geometrical considerations and an explosion over-pressure range relationship.

This is a marginal case, but since there are fewer than 100 shipments per year, it can only have a small influence on the outcome of the

( calculations.

7-25

l l

l The distance R from an exploding charge to a specified pressure is cal-O' culated by the following equation (Departments of the Army, Navy, and Air Force, 1969):

)

l R = K(W)1/3 ft (7-7) where K = constant determined by the allowable pressure, obtained from Figure 4-12 of the above reference.

W = pounds of TNT For vapor-cloud explosions, it is common practice to use a TNT equivalent calculated as follows (Geiger, 1974; Strehlow, 1973; Strehlow and Baker, 1975; Eichler and Napadensky, 1977):

" ~

S gQD W = F AH E 500 Kcal/lb of TNT (7-8) where F = fraction of spill quantity involved in vapor cloud S gQp ps = gm-mole of combustible chemicals spilled

'\,, Si = spill fraction Q = quantity of shipment p = density of liquid A = molecular weight AHe = heat of combustion (Kcal/gm-mole)

E = yield of explosion To obtain the equivalent TNT yield, E, the range of explosion yields reported in the literature were surveyed and Table 7-17 compiled, relying mainly on work by Eichler and Napadensky (1977), Lannoy and Gobert (1975),

and Gugan (1978).

The incidents in Table 7-17 were chosen by using the following criteria:

1. Only releases of 5000 kilograms or greater are considered as typical of rail accidents.

s-_-

7-26

i l

I

2. The fuels involved should belong to the " normal" class as defined by Lewis (1980).

3. In the event of conflict between the three references, Eichler and Napadensky (1977) are favored because their analysis appears to be the most thorough.

In Table 7-18, the yields of Table 7-17 are combined to give an approximata probability distribution. The given values of the yield are applied to the total quantity of material released from the rail tanker, rather than the flash fraction. This is consistent with the way that the yield has been defined in the above references. That is, the quantity F in Equation 7-8 is unity.

The distribution of explosion yields given in Table 7-18 is applied to all of the materials in Table 7-16, except ethylene oxide. According to Lewis, ethylene oxide does not belong to the class of " normal aerial explo-sion risks" but to a more severe class of "autodecomposible monopropellant materials." Furthermore, Gugan (1978) describes an accident in which an un-confined vapor-cloud explosion of ethylene oxide apparently occurred with a yield of about 20 percent. In the present work, a yield of 0.2 was conserv-atively assigned to all ethylene oxide explosior.s to take this observation into account.

Equations 7-7 and 7-8 give the maximum distance, R, from any structure at which the explosion involving a particular commodity could yield the specified overpressure. It is then a simple matter to ca.lculate the length L i, knowing R and the perpendicular distance from the railroad to the plant.

7.2.1.4 Dispersion Model The dispersion model is used to determine the downwind and the cross-2 wind distance that the vapor cloud has to travel to reach the lower flam-mable limit. The downwind distance is used to determine the maximum length of transportation route which must be considered. The crosswind distance is effectively added to the boundary of Region II to determine the probability of a flammable cloud intersecting Region II and being swept into a plant air intake.

An instantaneous puff dispersion model modified to account for initial gravity slumping of heavier-than-air vapors is used. The diffusion equation for an instantaneous (puff) ground-level release with a finite initial i volume is (Slade, 1968)

X(d) 2 2

'! I 2

'! ~

= 7.87 +a l a +a 2 93 Y ZY \z Iz)l _

exp

[ 2

+

2 h~

(7-9)

-1/2I 2 2 2 2 I (y #

Iy z

Iz /_

s 7-27

{

l

-- - - ,,------1

m where X (d)

- unit concentration at coordinates y,z from the center QI of the puff (m-3) ay(d), a z(d) = standard deviation of the puff in the horizontal and vertical directions, respectively (m) d = distance from the origin of the puff release, a c ry, oIz = initial standard deviation of the puff in the horizontal and vertical directions, respectively (m); for heavier-than-air gas, cry # oIz; for neutral or lighter-than-air gas, ogy =OIz y, z = distance from the puff center in the horizontal and vertical directions, respectively (m)

For those gases heavier than air, oxy and oIz are determined from the Van Ulden (1974) gravity-spreading model. The initial cloud formed at the accident site is assumed to be cylindrical with the axis perpendicular to the ground and to spread according to the density difference between the cloud and the air. It is assumed that during the gravity-spreading phase, the flammable vapor concentration in the cloud remains unchanged. The cloud spreads until the turbulent energy of the spreading equals the potential energy difference between the heavy-gas layer and the surrounding air.

According to Van Ulden (1974) , the gravity-spreading model is as follows: i 2 9(N o ~P a )Vo R =R2 o

+ 2t up (7-10)

IR I2 H=H (7-11) 9 where R = cloud radius Ro-Ho = initial radius or height of the cloud, assumed to be l cylindrical (m) 1 g = gravitational constant: 9.8 m/sec 2 po = initial density of the mixture (kg/m 3) l p, = density of the air (kg/m 3)

V o= initial volume of the mixture (m 3)

! \ H = cloud height (m) d 7-28

g, . .

.t

, .A g.

'3, , ,

e

'\ , ,,

(,

L Asa 5 s i

The gravity spreading ends at time tz, which satisfies {the'@3uttion N . -

t 2u* = uf -

s .

? (7-12)

, s where g(p - p*)V -

u f =K (7-13) wp, N' i',

uk N (7-14) u* = in(z/z ,) .', '

s .

w

~

where ,

,~

u - a fixed wind velocity at a s specified height z k = Von Karmaa's cons tan t 0.4 z, = roughness length: 0.05 mL -

If this criterion leads to a final cloud height of less than 1 me ter,

~

then slumping is arbitrarily stopped when the 1-meter height is reached.

The dis tance tha t the cloud travels during the spreading period is as follows:

t N

d, =j( s u* i fH/2) p nl , j de (7-15) o (o) which is derived assuming that the cloud travels with the velocity of the wind at its half-height.

At the end of the gravity spreading, the concentration of the cloud is assumed to have a Gaussian distribution with the center point concentration being unity (or pure vapor). The o ry and ogy are obtained from oyt = yR; ogy = yH (7-16) where R = radius of the cloud at the end of the spreading i H = height of the cloud at the end of the spreading y =l

( C flI (7-17) l Os V

7-29 ,

i l

1 where C, = assunsed initial puff concentration CL = Gaussian cloud center-point concentration: 1.0 (or pure vapor)

The equation for y comes from equating the amount of vapor in the cylindrical cloud to that in the Gaussian cloud.

An initial puff concentration of 0.25 was assumed to account for dilu-tion due to turbulent mixing at the release point. Several analyses and tests (Griffiths and Kaiser, 1982) have shown that, if there is a sudden failure of a tank containing a gas liquefied under pressure, the rapid ex-pension of the cloud generates vigorous turbulence, which induces consider-able mixing.

The Gaussian cloud disperses in accordance with Equation 7-5, starting at distance d, from the spill site.

7.2.1.5 Vapor-cloud Ignition Most spills of flammsble vapor are ignited essentially at the accident site. For example, statistics from the Association of American Railroads quoted by James (1947-1948) show that, for 81 vapor-cloud ignitions, 58 per-cent occurred from a few feet up to 50 feet, 18 percent between 50 and 100 s feet, and 24 percent from 100 to 300 feet.

A curve of integrated ignition probability as a function of distance from historical data of LPG spill accidents was published by Simmons (1974). The curve is shown in Figure 7-12 and is represented as a line:

log A - 1. 02 0 10 P

1

= 1/2 1 + erf( 2.45318 )

A = 0.175 r2 (7_19) where r is the distance from the spill site in meters. This formula expresses the observation that the further the cloud travels, the more likely it is to ignite.

The information given by James agrees reasonably well with this curve.

The data of Simmons also indicate that 10.5 percent of the drif ting-cloud ignitions resulted in an explosion while 89.5 percent resulted in a fire.

This agrees well with the data discussed in Section 7.2.2 i

l l

! 7-30 l

i .

i f

7.2.2 ACCIDENT-RATE AND ACCIDENT-SEVERITY ASSESSMENT 7.2.2.1 Pressurised Tank Car Loss-of-Lading Rate This has already been discussed in Section 7.1.2.1. From information .

provided by the Association of American Railroads and Railway Progress Institute (1972a) for the years 1965 to 1970, there were 1.5 x 10-7 acci- ,

dents per car-mile leading to loss of lading. Furthermore, since January 1, 1979, shelf-couplers have been installed in all cars; some cars have been j fitted with head shields and some with both thermal and head shields, lead-ing to an improvement by a factor of 4 in the above accident rate, reducing the rate to 4 x 10-8 per car-mile. This loss-of-lading rate is an input parameter to the analytical model.

7.2.2.2 Spill-Size Distribution The quantity of lading spilled as a result of an accident is determined for railroad tank cars free Hazardous Materials Incident Report forms sub- [

mitted to the Office of Hazardous Materials Operation, U.S. Department of Transportation (DOT). The data-base period for this analysis is mid-1973 i through 1977. All spills in this assessment are from DOT specification 112A 7

or 114A tank cars loaded with flammable compressed gases. Tank-car volume

! is normalized to a nominal maximum load capacity of 33,000 gallons. A distribution of spill quantity is generated from 76 tank-car spills. The results are shown in Figure 7-13. Table 7-19 presents the distribution of values used in the analysis. It can be seen that the bulk of the spills (about 75 percent) release all or most of the railcar contents.

i

7.2.2.3 Severity of Loss-of-Lading Accidents This section presents definitions for categorizing the severity of loss-of-lading accidents and uses these definitions to analyze accident data and to develop a probability density function. In an evaluation of the risks of propane railcar shipments Jones et al. (1973) have defined five i severity categories for loss-of-lading accidents involving propane. The same five categories are applied to all compressed flammable gases and are as follows

Type I: This type of incident could be caused by a major rupture of !

the containment vessel resulting in a gross spill without ignition.

The result would be that a very large vapor cloud would be formed. If l

this cloud were ignited after an explosive fuel-air mixture had been I formed, a maximum incident ' explosion would result. This type of inci-t dont is characterized by an unconfined fuel / air detonation.

Type II: This type of incident would be ' caused by a separate fire or a tank puncture resulting in a fire that would overheat the punctured propane tank or ancther propane tank nearby. The result would be an' 7-31 j.

i J

, explosive pressure rupture of the heated tank, cousing nearby over-9 pressure damage and possible shrapnel damage from the ruptured tank.

This type of incident is characterized by a propane tank explosion.

Type III: This type of incident would result from a leak or a tank puncture resulting in a large spill with ignition occurring immediately or shortly after the incident. The propane would burn uncontrollably in a large, intense fireball. No tank explosion would occur since the tank ptneture would be large enough to relieve the pressure. This type i of incident is characterized by a large uncontrollable fireball with no explosion.

Type IV: This type of incident would be caused by a leak, a tank punc-ture, a released safety valve, or a burst transfer line or valve re- .

sulting in a controllable fire. The fire may last for a considerable time and does not result in tank rupture because of either fire-control measures or protective insulation. This type of incident is charac-terized by a controllable fire with no explosion.

Type V: This type of incident would involve a leak or a puncture, either small or large, in a propane tank or loading lines, which does a not result in fire. If no source of ignition occurs, the propane will i

be dispersed in the atmosphere in a relatively short time. This type i of incident is characterized by loss of lading, but no fire.

Tank car accident data from the period 1965 through 1977 are catego-rized into one of the five severity types and presented in Table 7-20. For this analysis, the differentiation between Type III and Type IV severity is not important and where the size of fire was not quickly determined, a worst-case classification of Type III was assigned. To avoid misinterpret-ation, these two types are combined in the probability density function given in Table 7-21.

From Tables 7-20 and 7-21, it can be seen that the probability of ex-plosion given a spill is .018, and the probability of fire given a spill is 473 (sum of Types II, III, and IV). These are input parameters to the 4 analytical modal and are used both in this section and in Section 7.3 on fires.

4 7.2.3 METEOROLOGY The atmospheric dispersion parameters used in this analysis of explo-sive vapor hasards conservatively correspond to the 5-percentile worst-case i

conditions. These are used for all accidents even though they occur infre-quently. The wind-direction frequency distributions are obtained from Chap-ter 2 of the LGS FSAR. This frequency distribution is from the onsite i Weather Station No. 1 for the period of April 1972 to March 1973. The 3C-l foot data were used. A summary of the meteorological input is presented in Table 7-22.

l M _

f.

7-32 i

. . _ _ _ _ _ __. _. _ __ _ m__ _ ._ _ . _ _ _ _ . . . - - _ __

7.2.4 RESULTF OF THE ANALYSIS The models and parameters discussed in Sections 7.2.1 through 7.2.3 have been incorporated into a computer code, which predicts the frequency with which a given overpressure is exceeded at a given point as a result of a railroad or highway crash, followed by an explosion. The results of the

! present work. are shown in Figure 7-L* 3 which give the predicted frequency of q exceeding various overpressures at the diesel-generator structure, the re-I actor and control enclosures, or the spray-pond pumphouse. It can be seen i that the drifting cloud is the most important contributor over the whole range of overpressures and that, beyond about 5 pai, the drif ting cloud is the only contribution. At the point of closest approach, the railroad runs at the foot of a bluff that shields the plant from view. From any part of the railroad, the cloud would have to travel uphill to the plant. The ex-plosive vapors in question are denser than air and would very likely not travel uphill at all, especially in conditions of low windspeed. It is therefore believed that the results are highly conservative.

As noted previously, the design basis for the control enclosure and re-actor enclosure is 4.8 poi peak incident overpressure and 5.1 psi for the

, diesel-generator building. In practice, the buildings should be able to stand more than this. Structural Mechanics Associates estimates the LGS overpressure margin to be 1.9. This estimate was based on:

1. The design-basis pressures quoted in the FSAR were peak incident overpressures.

2. External explosions did not, in fact, control the design of safet)=

related structures, except for a few panels around vents which were l not supported. Instead, the structures were analyzed to determine their response to an assumed explosion of 56 tons of TNT (see the response to LGS FSAR Question 311.14).

3. In the FSAR, the pressures on the various safety-related structures i were treated as a time-history of side-on pressure, calculated as in the Army Technical Manual, with reflected pressure added in, using a multiplier that is also given in the Army Technical Manual.

4. In the design analysis, the wall subject to the assumed over-pressure did not remain plastic. It went into the elasto-plastic I range with an average ductility factor of 2.1.

Given an overpressure margin of 1.9, if the design-basis overpressure is 4.8 pei, the overpressure that the structure will . withstand is 9.1 psi.

From-Figure 7-14, the predicted frequency of exceeding this overph esure is 1.1 x 10-7 per year.

l l Another possible outcome that must be considered is that the drif ting cloud arrives on the site while still within flammable limits. It may then be ingested by the air intakes of a structure, ignite, and explode. Part of the output of - the RISK code is the predicted frequency with which the drifting cloud arrives at the intakes of safety-related structures while still within flammable limits.. In this study, this frequency is .

- 3 x 10-7 yr"1 This figure is thought ' to be highly conservative because I- . 33 f

I I'

- , , . . . - - - . _ _ _ _ . - _-. _ ,.-~.,_ _._ _ _ , . _ _ _ .. _ _ . ~ _..__ _ -_

the denser-than-air drif ting cloud may not be able to travel uphill from the

, ' railroad toward the structures.

It is expected that explosions will, at worst, result in fission prod-uct releases in Classes I or II of the I4S PRA (PEco, 1981), which have a combined core-selt frequency of 1.3 x 10-5 yr*l . Hence, the conservative bounding analysis of the predicted frequency with which core melt could result from vapor-cloud explosions due to railroad accidents shows that such

events are very small contributors to public risk.

7.2.5 SOLID EXPLOSIVES According to the response to Question 311.14 of the LGS FSAR, there are 44 boxcars per year carrying explosives past the IGS. An evaluation of box-car explosions was carried out using an assumed 56 tons of TNT. Using the standard formula for the distance R from an exploding charge to a specified overpressure (R = K(W)l/3 ft, Equation 7-7), The FSAR analysis shows that peak reflected overpressures at, for example, the diesel-generator structure would be 12.5 psi; the structure is designed to withstand the effects of this design-basis explosion. Similar results were obtained for other safety-related structures.

NUS has reviewed the answer to FSAR Question 311.14 and agrees that the explosion of 56 tons of TNT is an adequate representation of the maximum consequences of- a boxcar explosion and that such an explosion would not generate overpressures that would exceed the capabilities of safety-related structures.

i 7.3 FIRES 7.3.1 FIRES CONSIDERED IN THE LGS FSAR The various fires considered in the LGS FSAR are discussed in Section 7.3.1.1 exactly as presented in the FSAR.

7.3.1.1 ARCO Pipeline Rupture (FSAR Sectione 2.2.3.1.1 and 2.2.3.1.2)

In the FSAR, the worst-case rupture is assumed to occur at the point where the pipeline crosses Possum Hollow Run. The pip 311ne carries refined petroleum products. For the purposes of the FSAR analysis, it is assumed that the line is carrying gasoline, which has the highest volatility of any of the products carried in the line. It is assumed that the gasoline runs down the stream bed and forms a vapor cloud at the point of closest approach to the reactor enclosure (800 feet) .

. O 7-34 i

. . . _ , , . _ . . - - _-, , . - ~ - _ . . . . , . . . . _ , _ - - - , . . . , . . , _ , _ , , - . . - -. . _ . . - - . _ . _ . . . . . - .

r l

l The ARCO pipeline is equipped with pressure sensors that detect a rupture and automatically cause the isolation valves to close and the pumps to stop within 1 minute. This limits the spill to about 5000 gallons. Us-ing methods recommended by the American Petroleum Institute (API, 1969), a fire resulting from the ignition of the vr.por cloud formed by the evapo-rating gasoline under Pasquill "F" conditions and at a windepeed of 1 meter per second would produce a radiant-heat load of 85 Btu per square foot per hour (910 watts per square meter) for a short time at the Unit 2 reactor enclosure. This level would produce a slight warming of the surface con-creta comparable to that due to solar radiation at midday, 50 to 60 Btu per square foot per hour (540 to 650 watts per square aster).

The response to question 311.13 of the FSAR also postulates an unde-

tected pipeline leak on the order of a few gallons per hour and a double-ended rupture with no isolation for several hours. The FSAR argues that the consequences of the ignition of the leaking gasoline in these two cases would be no more severe than those given above.

Finally, the FSAR indicates that the ARCO pipeline will n'at be used to -

transport materials such as propane or LNG withouc a detailed feasibility study and mejor modifications to the line, valves, pump stations, etc.

7.3.1.2 Columbia Gas Transmission Company Natural Gas Pipelines (FSAR Section 2.2.3.1.2)

In analyzing the consequences cf a fire following a rupture of this pipeline, the FSAR assumes that the larger of the two pipelines (20-inch diameter) ruptures at a point where the pipeline passes closest to the Unit 2 reactor (approximately 3000 feet). It is further assumed to be a double-ended rupture. The portion of the vapor cloud downwind within the flammable limits is assumed to ignite and burn under the same conditions as the cloud from the ARCO pipeline. The radiant-heat load at the Unit 2 reactor enclosure is calculated to be about 70 Btu per square foot per hour (750 watts per square meter) for a short time. This level would cause a slight warming of the outer layer of the concrete.

7.3.1.3 Railroad Fire The FSAR assumed that a railroad tank car containing 62 tons of propane ruptures and that a fire at the site of the crash consumes the 62 tons in 20 minutes. The result tng radiant-heat load at the Unit I reactor enclosure is predicted to be 500 stu per cubic foot per hour (-5400 watts per square meter) for 20 minutes, using the methods of the API (1969).

7.3.2 FIRES CONSIDERED IN THE PRESENT ANALYSIS For the present analysis, a fire diae to a railroad crash is considered to be. the worst external fire event as far as the plant is concerned. - The 7-35 j

'l l

. - . _ _ - . _ _ - -.e -- ..m,--.,4 _es.e-- , . -. ,,,-,->..c, , .- %v . , . - - , , - -,,.y, , , , y --,w. ,,% 9%,,, , r .

m. - --

(

(s following factors are considered: (1) a pool fire at the site of the crash and its effect on the plant; (2) a fireball at the site of the railroad crash and its effect un the plant; and (3) the ignition of a drif ting cloud. The radiant-heat loads on safety-related structures are calculated using methods described in Appendix F of Bennett and Finley (1981); the authors of that appendix judge the methods to yield conservative results.

7.3.2.1 Pool Fire on the Railroad A conservatively high value of flame-edge heat flux (F E) of 100 kilowatts per square meter (for turbulent methane) is assumed in order to estimate the mean emissive power of the pool fire. The flux (Fp) arriving at the plant structure will be attenuated by the finite flame size / shape factor y/(Dy/L)2, where Dp is a characteristic flame diameter and L is the distance between the flame edge and the plant structure. (Note that the size / shape factor is only valid if (Dy/L)2 < 1.) Dr is assumed to be 20 meters, as in Bennett and Finley (1981), or about the length of the tank ca r.

The flux (Fp) is also attenuated by the transmissivity (T), which takes account of absorption and scattering along the Latervening path by

-water vapor, carbon dioxide, and dust and aerosol particles. On a clear day, the major contributor to attenuation is water vapor. According to Figure F-1 of Bennett and Finley (1981), the value of T for 20 percent rel-ative humidity and a distance of 180 meters (the closest point of approach of the railroad to the diesel-generator building) is 0.72. Hence D

F p

=F ~

E" or 92 Btu per square foot per hour (991 watts per square meter).

The heat flux of 991 watts per square meter is less than the maximum solar-heat load in some parts of the United States (e .g. , 1000-1250 watts por square meter for Albuquerque, New Mexico) and is therefore not a danger to the safety-related structure no matter how long the fire burns. Hente, a pool fire at the site of the crash does not contribute to public risk.

7.3.2.2 Fireball at the Site of the Crash The fireball analysis is based on the model of Fay and Lewis (1976).

It is assumed that a propane fireball with the flash fraction at 100*F is centered at the site or the crash. The volume of vapor (Vy) used for the fireball calculations is the weight of flashed vapor times its specific volume at atmospheric conditions. The diameter (D) of the cloud when burning has been completed is calculated as follows:

/~'i. ,.D F

= 7.708(V ) ! (7-21)

'%Y 7-36

. . ~ . . . . -- -. . - . - . . _ - - . . .- --. . - . . . . . . .... -

4 f

The heat flux at the edge of the fireball was again taken to be 100 kilo-watts per square meter, as in the case of the pool fire. Similarly, a transmissivity factor (T ) and a shape factor were used to calculate the heat flux at the structure. However; it proved necessary to revise the shape factor (Dy/L)2 for the following reason: using a flash fraction of 0.453 4 for propane, the volume (Vy) is 16550 cubic meters, the fireball diameter (Dy) is 196 meters, and L is 183 .5(196) = 85 meters; hence, (Dy/L)2 is 5.32, which - is unrealistic. Instead, a shape factor for a finite plane radiating to a cylinder (Rohsenow and Hartnett, 1973) was used. For a fire-ball with a diameter of 99 meters centered 183 meters from a plane, the shape factor becomes 0.54. The transmissivity (t ) for a distance of 85 meters is 0.76 - (Bennett and Finley, 1981). Hence, Fp is calculated to be (103)(0.535)(0.76) = 41.9 kilowatts per square meter.

According to Fay and Lewis, the time for which the fireball burns is a

t g

0.28(V )1/6 (7-22) where Vy is in cubic centimeters, using Vy = 16,500 cubic meters

1.655 x 1010 cubic centimeters gives tg = 14.1 seconds. Therefore, the

cumulative energy absorbed by 1 square meter of the structure is

! E = Fp tg = 6 x 105 joules.

The temperature rise of a 0.5-inch thickness of concrete at the surface i of the diesel-generator strrcture is b E (7-23)

Q AT = Cpct where Cp is the volumetric heat capacity of concrete, and te is the thickness actually considered (i.e. , 0.5 inch or 0.01 meters) . C p is 1.9 x 106 joules per cubic meter per *C.

The predicted rise in temperature is calculated to be 6.1*C (= 11*F),

which is small. Thus, a fireball at the site of the railroad crash does not contribute to public risk.

i 7.3.2.3 Ignition of a Drifting Cloud As mentioned previously, it is thought to be very conservative to as-sume that denser-than-air clouds could drift up from the railroad toward the plant. Nonetheless, the following arguments show that, even if such drift-ing occurs, the ignition of the cloud would not significantly affect the plant.

Note that the 100 kilowatts per square meter taken as the rate of emission of heat per unit area of the fireball is an upper bound on the rate at which radiant heat can be delivered per unit area of the structure, since no mechanisms are envisaged whoreby the radiant heat might be focused. The p fireball would burn for the same length of time (-14 seconds) irrespective 7-37

. . _ . - - . . ~ . - . ..

'of its position relative to the plant, so that the total energy absorbed per unit area of the structure can be at most 100/41.9 a 2.5 times that calcu-lated in Section 7.3.2.2. Hence, the temperature rise averaged over a depth of 0.5 inch of concrete could only be 6.1 x 2.5 = 15'C. This would pose no hazard to the structure.

4 7.4 AIRCRAFT ACCIDENTS Section 2.2.2.5 of the MS FSAR describes the air traffic in the vicinity of the site. The Pottstown-Limerick Airport is located 2 miles northeast of the site and is used by single-engine and multiengine aircraft weighing less than 13,500 pounds. The Emery Airport is a private airport, located 2 miles south, that has only a 1300-foot sod (grass) landing strip and thus is severely limited in use. The New Hanover Airport and Sunset Landing Strip are both public-use facilities with sod (grass) runways; they are located 5 miles from the site. Neithe: the Sunset Landing Strip nor the New Hanover Airport has scheduled flights, and because of the sod runways, they are limited to small single-engine and multiengine aircraft. The Pottstown Municipal Airport, located 5 miles northwest of the site, has a hard-surface runway 2700 feet long and is used by privately owned general-aviation aircraft, a charter service, and a flight-training school.

The Federal airways passing near the site, the distance from their centerlines to the plant, and the crash probability at the site per passage from each of these airways are as follows:

\

d Distance Crash to plant probability

Airway (miles) (per square mile)

V29/147 1.3 5.9 x 10-11 Pottstown VOR 1.3 5.9 x 10-11 320' radial 1

i V210 8.0 2.2 x 10-12 V276 10.0 7.1 x 10-13 The licensing analysis of aircraft hazards is described in Section 4 3.5.1.6 of the FSAR. This analysis used generally accepted procedures and data. The results indicated an annual probability of 9.4 x 10-8 that an aircraf t would strike the MS and thus create a potential nuclear-safety l hazard. I From the FSAR analysis it is concluded that the frequency of aircraf t impacts at the LGS that could create a potential nuclear safety hazard is

. less than 10-7'per year. In' addition, the FSAR definition of the target areas of such impacts is such that, even if such an impact did occur, the 4

d ,.

7-38~

l_

- , , . . . , , - --,.._m _ _ m_._,. ~ , , _ . . , , , ,. . . _ . , , , , . , _ . .

i l

I J

\

4

likelihood of a core-melt accident would be maall. It is therefore con-i cluded that aircraft impact is a negligible contributor to core-melt fre-quency. It is further concluded that aircraf t impact would only lead to Class I or II accidents (combined frequency = 1.3 x 10-5 per year) and thus would not contribute to IGS accident risks.

1 f

1 I

7-39

e.g.ya .--egy ,v., --ee--,,,w, ypg'

REFERENCES API (American Petroleum Institute), 1969. Guide for Pressure Relief and Depressuring Systems, API RPS21.

Association of American Railroads and Railway Progress Institute, 1972a.

Final Phase 02 Report on Accident Review, Railroad Tank Car Safety Research and Test Project, RA-02-2-18.

Association of American Railroads and Railway Progress Institute, 1972b. i

.? Phase 02 Report on Dollar Loss Due to Exposure of Loaded Tank Cars to Fire--1965 taru 1970, RA-02-1-10.

Association of American Railroads and Railway Progress Institute, 1972c.

Final Phase 01 Report on Summarv of Ruptured Tank Cars Involved in Past Accidents, RA-01-2-7 l

Association of American Railroads and Railway Progress Institute, 1981.

Phase 02 Report on the Effectiveness of Shelf Couplers, Head Shields and Thermal Shields, RA-02-3-44 Bechtel, 1980-1983. Limerick Generating Station Toxic Chemical Study, 1980; Limerick Generating Station Toxic Chemical Study--Incapacitation Levels Phase 1, 1982; Limerick Generating Station Toxic Chemical Incapacita-I tion Level Study, Phase 2, 1982; Limerick Generating Station Toxic i Chemical Study--Phosgene, 1983 l

f Bennett, D. E., and N. C. Finley, 1981. Hazards to Nuclear Power Plants

! '* from Nearby Accidents Involving Hazardous Material--Preliminary Assessments.

Britter, R. E., 1982. Special Topics on Dispersion of Dense Gases, report on Contract 1200/01.01, Research and Laboratory Services Division.

Health and Safety Executive, Sheffield, England.

, Britter, R. E., and R. F. Griffiths, 1982. "The Role of Dense Gases in j the Assessment of Industrial Hazards," Journal of Hazardous Materials, Vol. 6, pp. 3-12.

CECO (Commonwealth Edison Cospany), 1981. Zion Probabilistic Risk Assess-ment, Chicago, Ill.

f. Departments of the Army, Navy, and Air Force, 1969. Structures To Resist i the Effects of Accidental Explosions, TM5-1300.

Dicken, A. N., 1974. The Quantitative Assessment of Chlorine Emission

Hazards, Imperial Chemical Industries.

I.

l l

7-40 ge-w--,g,+su y < - - ,,ys y w- ----*-*W-* ,- ,--,g, y- -

u-7,mwe-& y , Wyv-+ y

Eichler, T. V., and H. S. Napadensky, 1977. Accidental Vapor Phase Explo-sions on Transportation Routes near Nuclear Plants, J6405, prepared for Argonne National Laboratory.

Fay, J. A., and D. H. Lewis, Jr., 1976. " Unsteady Burning of Unconfined Fuel Vapor Clouds," in Proceedings of the Sixteenth International Symposium on combustion, Massachusetts Institute of Technology, Cambridge, Mass., August 15-20, pp. 1397-1405.

Geiger, W., 1974. " Generation and Propagation of Pressure Waves Due to Unconfined Chemical Explosions and Their Impact on Nuclear Power Plant Structures," Nuclear Engineering and Design, Vol. 27, pp. 189-198.

l Griffiths, R. F., and G. D. Kaiser, 1982. " Production of Dense Gas Mixtures from Asmonia Releases-A Review," Journal of Hazardous Materials, Vol. 6, pp. - 197-212 Gugan, K., 1978. Unconfined vapor Cloud Explosions, Institute of Engineers,

, England.

1 Haddock, S. R., and R. J. Williams, 1978 The Density of an Ammonia Cloud in the Early Stages of Its Atmospheric Dispersion, SRD R103, United Kingdom Atomic Energy Authority.

Hardee, H. C., and D. O. Lee, no date. Expansion of Clouds from Pressti.rized Liquids, SAND 74-5210 Sandia National Laboratories, Albuquerque, N.M.

l HMSO (Her Majesty's Stationery Office), 1978. CANVEY--An Investigation of Potential Hazards fgos Operations in the C .nvey Island /Thurrock Area, London, England.

Hubble, W. H., and C. F. Miller, 1980. Data Survey of Licensee Event Reports of Valves at U.S. Commercial Nuclear Power Plants, NUREG/

CR-1363, prepared for the Nuclear Regulatory Commission, Washington, D.C.

Hunt,'J. C. R., 1978. Dispersion from Non-Buoyant Sources near Buildings,

. review paper for the United Kingdom Atmospheric Dispersion Modeling Working Group.

, International Technical Information Institute, 1980. Toxic and Hazardous i Industrial Chemicals Safety Manual, Japan.

, James, G. B., 1947-1948. " Fire Protection in the Chemical Industry,"

National Fire Protection Association Quarterly, Vol. 41, p. 256.

Jones, G. P., et al., 1973. -Risk Analysis in Hazardous Materials Transpor-

tation, PB-230 810, National Technical Information Service, prepared by

. the University of Southern California Institute of Aerospace Safety and l Management for the U.S. Department of Transportation, Washington, D.C.

i f 7-41 l

i

. t

.= ~ . .. ..,,v. . . . . ~ . - . . . ~ . - - - , - - , . --m_. - . . - - .,.-.c.. , - v-- .~ -

. _ - - . - ~ . - - . -. .- . . - _ _ . _ - _ _

Kaiser, G. D., and R. F. Griffiths, 1982. "The 7.ccidental Release of Anhydrous Ammonia to the Atmosphere; A Systematic Study of the Factors Influencing Cloud Density and Dispersion," Journal of the Air Pollution

-Control Association, Vol. 32, pp. 66-71. l Lannoy, A., and T. Gobert, 1975. Analysis of Accidents in Petroleum Indus-try--Determination of TNT Equivalent for Hydrocarbons, J 10/8.

Lewis, D. J., 1980 " Unconfined Vapor Cloud Explosions-Historical Perspec-tive and Predictive Method Based on Incident Records," Prog. Energy Comb. Sci., Vol. 6, pp. 151-165.

Marshall, W., et al., 1976. An Assessment of the Integrity of PWR Pressure Vessels, United Kingdom Atomic Energy Authority. :

PECo (Philadelphia Electric Company), 1981. Probabilistic Risk Assessment, Limerick Generating Station, Docket Nos. 50-352, 50-353, U.S. Nuclear Regulatory Commission, Washington, D.C.

l Perry, J. H., 1963. Chemical Engineers' Handbook, fourth ed., McGraw-Hill Book Company, New York, N.Y.

Rchsenow, W. M., and J. P. Hartnett, 1973. Handbook of Heat Transfer,

. McGraw-Hill Book Company, New York, N.Y.

I Simmons, J. A., 1974. Risk Assessment of Storage and Transport of Liquefied i g Natural Gas and LP-Gas, PB-247 415, National Technical Information g Service, Springfield, Va.

Sittig, M., 1981. Handbook of Toxic and Hazardous Chemicals, Noyes Data Corporation, Park Ridge, N.J.

Slade, D. H., 1968. Meteorology and Atomic Energy, U.S. Atomic Energy Com-mission, Washington, D.C.

Smith, G. J., and D. E. Bennett, 1980. Models for the Estimation of In-capacitation Times Following Exposures to Toxic Gases and Vapors, NUREG/CR-1741, Sandia National Laboratories, Albuquerque, N.M.

Snell, W. G., and R. W. Jubach, 1980. Technical Basis for Regulatory Guide 1.145, Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants, NUREG/CR-2260. ,

t 7-42

(

Strehlow, R. A., 1973. " Unconfined Vapor-Cloud Explosions-An Overview,"

in Proceedings of the Fourteenth Interna tional Symposium on Com-bustion, The Combustion Institute, Pittsburgh, Pa., pp. 1189-1200 Strehlow, R. A., and W. E. Baker, 1975. The Characterization and Evaluation of Accidental Explosions, MASA CR-134779, prepared by the University of Illinois for the National Aeronautics and Space Administration, Washington, D.C.

USDOT (U.S. Department of Transportation), 1982. Computer Listing Entitled Research and Special Programs Administration. Hazardous Materials Involving Rail Tankcars (1975-April 1982), Information Systems Division, Washington, D.C.

USNRC (U.S. Nuclear Regulatory Commission), 1975. Reactor Safety Study--An l Assessment of Accident Risks in U.S. Commercial Power Plants, WASH-1400 (NUREG-75/014), Washington, D.C.

USNRC (U.S. Nuclear Regulatory Commission), 1976. Safety Evaluation Report.

Hartsville Nuclear Plants, Dockets STN 50-518 through STN 50-521, Washington, D.C.

Van Ulden, A. P., 1974. "On the Spreading of a Heavy Gas Raleased near the Ground," in Proceedings of the Loss Prevention Symposium, C. H. Bushman (ed.), Elsevier, Delft, The Netherlands, pp.21-226 Wreathall, J., 1982. Operator Action Trees. An Approach to Quantifying Op-erator Error Probability During Accident Sequences, NUS 4159, NUS Corporation, Gaithersburg, Md.

9 7-43

J Table 7-1. Failure rate for components of tank-car-unloading pipe and connector a Failure rate i

! Component Failure type (per hour) l Pipe section D Rupture 1 x 10-9 Flange Leak 3 x 10-7 Wald Leak 3 x 10-9 Valve Leak 1 x 10-8 aSource: USNRC (U.S. Nuclear Regulatory Commis-sion), 1975. Reactor Safety Study--An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, j WASH-1400, Washington, D.C.

bDefined as the average length between major dis-

! continuities (e.g. , valves and pumps) of a pipe less than 3 inches in diameter, including welds, elbows, and joints. Pipe sections average 10 to 100 feet in length.

1 1

)

O

[

7-44 .

l l

l-I

+ - , . - - , , , - , , . . . - , . -, -, , - - , - - , - . , - - . , ~ - - - . , ,,. ,,,-.-+n-- -

-. . . . - . - . .- . . - . . .= -.-

b

^

Table 7-2. Distribution of chlorine spill size from stationary railroad tank cars Quantit/ Cumulative Cumulative gal kg Number number probability 1 5.3 24 24 0.63 1 2 10.7 1 25 0.66 5 27 1 26 0.68 10 53 4 30 0.79 20 107 2 32 0.84 50 270 2 34 0.89 100 530 1 35 0.92 170 900 1 36 0.95 i 300 1600 2 37 0.97 l

i I

i r

5 4

t i

, 7-45

-~. ._ _. . .,. _. _ - _ . . . , _ . , _ - _ , . . _ . , _ . . - . . _ . , . _ . - . . . , _ . . . _ . . . . _ . . _ , . . , . . . . . . . - . . . . , _ . , . _ _ . . , , _ . . . - . , . . - - ~ ~ . . - - - - . _

Table 7-3. Failure data for chlorine detection and isolation capability Failure on Failure demand or Component mode unavailability Comments Isolation valve Failure to close 2 x 10-3 NUREG/CR-1363 data 1 or 2 on demand, Air-operated valve without fails to operate on command fault demand, with command fault Detector Aa Random hardware 1 x 10-2 Estimated failure rate failure of 10-4 per hour and test interval of 1 week Detector Aa Unavailable 1 x 10-2 Assumed 1-hour replace-owing to ment time tape-cassette replacement every 168 hoars asame data for detector B, C, or D.

I i

l

\ l 7-46 l !

I

_(*'\

V ( ,

Table 7-4. Onsite-chlorine-release calculations '

Section of Parameter Calculation this report SOURCE OF CHLORINE RELEASE i Frequency of spontaneous failure 2 x 10-5 yr-1 Section 7.1.3.1 Frequency. of seismically induced failure 1.6 x 10-4 yr-1 Section 7.1.3.2 Frequency of failure due to switching accidents 10-5 yr-1 Section 7.1.3.3

,' Frequency of failure of conne-ting pipework 2x 10-3 yr-1 Section 7.1.3.4 through 7.1.3.6 Total (probability of Ex on Figure 7-3) 2.2 x 10-3 yr-1 4

1 RESPONSE TO CHLORINE RELEASE Probability of failure of detection and isolation system (A 1) 2 x 10-3 Section 7.1.3.7 ,

2' Probability of failure to put on treathing masks (Ba) 2 x 10-2 Section 7.1.3.8 Probability of core melt given operator incapacitation (C m) 1 x 10-4 Section 7.1.3.8 I

CORE MELT DUE TO CHLORINE RELEASE Predicted frequency of core melt per year ExBaCm 4.4 x 10-9 Exi A Cm 4.4 x 10-10 Total frequency of core melt per year 4.8 x 10-9 1

F

Table 7-5. Conrail survey results l

Average weight l Chemical (tons per carload) 500-1000 CARLOADS PER YEAR Acetone 59

- Anhydrous ammonia 54 4 Butadiene 80 Chlorine 74 l Ethylene oxide 75 Methanol 85 64 Propane Vinyl chloride 92 100-499 CARLOADS PER YEAR Ace taldehyde 64 Aniline 69 Carbon dioxide 76 Ethyl chloride 41 Hydrogen cyanide 52 30-99 CARLOADS PER YEAR Acrylonitrile 70 Benzene 52 Butane 71 4 Ethyl other 58 l Formaldehyde 87 Xylene 51 e

i I

t i

l b

G 7-48 l

l.. -- . - . - , . - . . . - - , . -- - .-- - - .- -.. - . - --, - - - . . . - , - - , - - - - . - . - - - - , _ _ . .

l

[

Table 7-6. Summary of chlorine railroad calculations l

Parameter Calculation Comment Probability of crash and spill per car-mile 4 x 10-8 Section 7.1.4.1

, Number of shipments per year 1000 Table 7-5 Miles of track affected 10 Conservative judgment, Section 7.1.6.2 Probability that wind blows toward plant 0.3 Section 7.1.4.2 Frequency of event Ex on Figure 7-2 (product of the above) per year 1.2 x 10-4 Probability of failure to detect and isolate (Ag) 2 x 10-3 Section 7.1.3.7 Probability of failure to put on breathing masks (B,) 1 x 10-1 Section 7.1.4.2 Probability of core melt given operator incapacita-tion (C m) 1 x 10-4 Section 7.1.3.8 Predicted frequency of core melt due to chlorine release on railroad ExB,Cm 1.2 x 10-9 per year EACxim 2.4 x 10-11 per year Total 1.2 x 10-9 per year O

7-49 ,

1

l Table 7-7. Probabilities of the various blocks cn Figure 7-9 Failure rate Device point estimate a Data source MAIN SYSTEMS A--Intake pump 4.2 x 10-6 per hour IEEE-STD 500, p. 120 B--Air-intake manifold 2.7 x 10-8 per hour WASH-1400 C--Bypass valve 2.7 x 10-8 per hour -WASH-1400 D--Sensor 1.4 x 10-5 per hour IEEE-STD 500, p. 454 E--Input-signal modifier 2.3 x 10-6 per hour IEEE-STD 500, p. 475 F--Solid-state computer 3.0 x 10-6 per hour WASH-1400 G--Output-signal modifier 2.3 x 10-6 per hour IEEE-STD 500, p. 475 H--Output relay 1.3 x 10-4 per demand WASH-1400 I--Alarm system 8.4 x 10-5 per hour WASH-1400 SUPPORT SYSTEMS O. (1) Non-Class IE 6.1 x 10-6 per hour LGS FSAR frequency of onsite electric- loss of offsite power power system (ii) Zero-gas system 6.1 x 10-6 per hour Judgment; no worse than loss of offsite power (iii) Environmental systema Negligible Judgment aThe WASH-1400 figures are means that have been estimated from the medians and error factors given in WASH-1400. The IEEE figures are best estimates taken directly from IEEE-STD 500.

i 1

O 7-50

O O O l

Table 7-8 Frequency of core melt due to railroad accidents: !

toxic vapors (other than chlorine) with automatic detection Vapor Anhydrous Ethylene Vinyl Section or table )

Parameter ammonia oxide Formaldehyde chloride Phosgene in this report Frequency of spill per car-mile 4 x 10-8 4 x 10-8 1.3 x 10-7 4 x 10-8 4 x 10-8 Section 7.1.4.1 Number of shipments per year 1000 1000 99 1000 1000 Table 7-5 I

Miles of track affected 10 mi. 10 10 10 10 Section 7.1.4.2 !

I L Probability that wind blows toward plant 0.3 0.3 0.3 0.3 0.3 Section 7.1.4.2 Frequency of event Ex OR '

i l Figure 7-3 per year. (product of the above) 1.2 x 10-4 1.2 x 10-4 3.7 x 10-5 1.2 x 10-4 1.2 x 10-4 Probability of failure to I detect (Ad ) 6 x 10-4 6 x 10-4 6 x 10-4 6 x 10-4 6 x 10-4 Section 7.1.4.3.2 Probability of failure to put on breathing masks (D,) 0.1 0.1 3 x 10-2 2 x 10-3 0.1 Section 7.1.4.3.3 Probability of core melt given operator incapacitation 1 x 10-4 1 x 10-4 1 x 10-4 1 x 10-4 1 x 10-4 Section 7.1.3.8 Predicted frequency of core melt per year Ex B,C, 1.2 x 10-9 1.2 x 10-9 1.1 x 10-10 2.4 x 10-11 1.2 x 10-9 I

EACxdm 7.2 x 10-12 7.2 x 10-12 2.2 x 10-12 7.2 x 10-12 7.2 x 10-12 Total 1.2 x 10-9 1.2 x 10-9 1.1 x 10-10 3.1 x 10-11 1.2 x 10-9 l

l

Table 7-9. Predicted frequency of core melt due to railroad accidents: toxic vapors detected'by smell Vapor Hydrogen Section or table Parameter- cyanide Acetaldehyde of this report-Frequency of spills per car-mile 1.3 x 10-7 1.3 x 10-7 Section 7.1.4.1

, Number of shipments per. year 500 500 Table 7-5 i Miles of track affected 10 10 Section 7.1.4.2 Probability that wind blows toward plant 0.3 0.3 Section 7.1.4.2 4

Frequency of event Ex on Figure 7-4 1 . per year (product of the above) 1.95 x 10-4 1.95 x 10-4

. Probability of failure to detect a

by smell and to put on breath-ing masks (Sm) 1 x 10-3 1 x 10-3 Section 7.1.4.4.2 y Probability of core melt given

$ operator incapacitation 1 x 10-4 1 x 10-2 Section 7.1.4.4.3 Predicted frequency of core melt (Exmm S C in Figure 7-4) per year 2 x 10-11 2 x 10-9 i

E I

t 4

+

O ~ O Table'7-10. Chemicals at Hooker Chemical Planta Maximum quantity How received Chemical' on the site Mode of storage on the site Vinyl chloride 3,000,000 lb 30 psig, ambient temperature. Railroad cars con-one 600-ton tank above taining 80 tons-ground Butadiene 500,000 lb 20 psig, ambient temper- Railroad cars con-a ture , six to ten 25,000-gal taining 75 tons tanks above ground l Trifluorochloroethylene 2,000 lb- 68 psig, ambient pressure, Truck- 1 l

portable cylinders Trifluoroethylene 1,000 lb In process, ambient temper- Truck Y ature and pressure vi w

. Methanol 10 drums Warehouse, ambient Truck (460 lb par drum)

Nitrogen 139,000 SCF D Refrigerated tanks at Bulk truck

-325*F above' ground Toluene 13,000 gal Above ground, ambient vent Bulk truck 20-ton maximum Gasoline 52,000 gal Underground, ambient, vent Bulk truck 20-ton maximum Styrene 50,000 gal Above ground, ambient vent Truck (20 ton), rail-road car (60 ton) l

! Vinyl acetate 25,000 gal Above ground, ambient vent Truck (20 ton), rail-

! road car (60 ton)

s

~ O Table 7-10. Chemicals at Hooker Chemical Planta (continued)

Maximum quantity How received Chemical on the site Mode of storage on the site Trichloroethylene 25,000 gal Above ground, ambient vent Railroad car Vinyl pyridine 10,000 gal Above ground at 40*F Bulk truck l (20 ton)

Propane 2,500 gal Pressurized, ambient Delivery truck temperature, two 1,000-gal tanks

one 500-gal tank Acetylene 3,000 lb 18 cylinders, pressurized Truck at ambient temperature 4

-4 4 aInformation obtained from FSAR and site visit.

bStandard cubic feet.

f i

f 4

l 1

s

l i

i I

Table 7-11. Summary of calculation of bounding core-melt frequencies - Hooker Chemical Plant Vinyl Vinyl Parame ter chloride Phosgene acetate 1 Frequency of release per year 0.05 0.05 0.1 Probability that wind blows toward LGS 0.25 0.25 0.25 Conservacive estimate of frequency of excessive concentration at control-room air intake (Ex on Figure 7-3 or 7-4) (product of the above) 0.01 0.01 0.02 Probability of failure of automatic detector (Ad) 6 x 10~4 6 x 10-4 --

Failure to don breathing masks (B,) 1 x 10-2 1 x 10-2 __

Failure to detect by smell g (S ) -- -- 10-2 Probability of core melt given operator incapaci-tation (C ,) 1 x 10~4 1 x 10~4 1 x 10-4 Predicted frequency cf core melt (see Figure 7-3 or 7-4) per year ExB,C, 1 x 10-8 1 x 10-8 Ex^d a 6 x 10-10 6 x 10-10 __

ExS,C , -- -- 2 x 10-8 Total per year 1 x 10-8 1 x 10-8 2 x 10-8 O

7-55 f

l i.

{

l

l l

Table 7-12. Chemicals carried on the Highway Chemical Chlorine trifluoride Hydrochloric acid Hydrogen sulfide Fluorine Hydrogen fluoride Arsine Methyl mercaptan Ethyl mercaptan Carbon tetrachloride Hydrazine Phosphorus trichloride Carbon disulfide Butyl mercaptan Isopropyl amine Chloroacetyl chloride ,

Trichlorosilane Diethyl amine Methyl dichlorosilane Trimethylchlorosilane Methyl trichlorosilane Ethyl dichlorosilane O Dimethyl dichlorosilane Vinyl trichlorosilane Isopropyl mercaptan l Propyl mercaptan

Allyl chloride Nitrogen tetroxide Nitrogen dioxide

! Nitrogen peroxide (NO)

Dimethyl hydrazine I

i t

i 7-56

,----w , ne- 4w .,p-- g, ~ . , - -y-,,,-e~ -

ww ,-n v- - - , v-m,e -

-,+~me--rw--we,-s , - - , -~-c...v- - ., e.--,J ~ -m,~~- e-

-- ~ . .

l l

l Table 7-13. Highway spillages of materials that are detected by smell--

bounding calculation of contributions to core melt Material Hydrochloric Hydrogen Hydrogen Ethyl Parametera acid sulfide Fluorine fluoride mercaptan Comment Frequency of release within 5 miles of LGS per year 2x 10-3 2x 10-3 2 x 10-3 2x 10-3 2x 10-3 Section 7.1.6 1

Probability l that wind blows tos'ards LGS 0.25 0.25 0.25 0.25 0.25 Conservative value l l

Y Frequency of event

$ (Ex on Figure 7-4) per year (product of the above) 5 x 10-4 5 x 10-4 5 x 10-4 2 x 10-4 5 x 10-4 l

Probability of failure to detect i 2 x 10-3 by odor (Sm) 1 x 10-3 10-1 1 x 10-2 10-1 Table 7-12 Probability of core melt given operator incapacitation 1 x 10-4 1 x 10-4 1 x 10-4 1 x 10-4 1 x 10-4 Section 7.1.3.8 Total (ExmS C, on Figure 7-4) per year 5 x 10-11 5 x 10-9 5 x 10-10 1 x 10-10 5 x 10-9 aLGS = Limerick Generating Station.

I N g 4 -

e

__ . _ . _ _..__..._m_ _ _ - - _ _ _ . _ _ - . . _ . - - _ _ - _ . . ~ _ . . . _ _ _ _ _

n Table 7-14. Toxic-vapor analysis--summary of contributions to bounding estimates of core-melt frequency

{ Contribution to bounding estimate of core-melt Section or table Description of spillage frequency (per year) of this report Onsite chlorine 4.8 x 10-9 Table 7-4 Railroad Chlorine 1.2 x 10-9 Table 7-6 Automatic detection and no automatic isolation 3.7 x 10-9 Table 7-8 Chemicals detected by smell 2.0 x 10-9 Table 7-9 i

Hooker chemicals

! Vinyl chloride / phosgene 2.0 x 10-8 Table 7-11 Vinyl acetate 2.0 x 10-8 Table 7-11 Highway Chemicals to be detected by smell 1.1 x 10-8 Table 7-13 Chlorine trifluoride 3.0 x 10-10 Section 7.1.6.2 4

Total 6.3 x 10-8 4

i 9

4 4

e i

s i

i l

7-58

c____- - - - - _ . - _ _ _ _ - _ - _ _ _ _ - _ - - _ _ _ _ . - _ - - . _ _ - _ - _ _ . - _ _ _ _ _ -

Table 7-15. Hazardous chemicals of interest Frequency of shipmenta (carloads Average weight Chemical per year) (tons per carload)

Liquefied petroleum gas 1315b 64 Butadiene 500-1000 80 Ethylene oxide 500-1000 75 ,

Vinyl chloride 500-1000 92 Ethyl chloride 100-499 41 Ace taldehyde 100-499 64 Hydrogen cyanide 100-499 52 aFor this analysis, the maximum of the range of frequency of shipment is used. See Table 7-5.

bFrom the response to FSAR question 311.15. Includes propane and butane.

O I

4 7-59

.- _ . _ . . ~ _ . _

o i Table 7-16. Commodity-dependent input parameters I

l Ethylene Vinyl Ethyl Hydrogen Parameter LPGa Butadiene oxide chloride chloride Acetaldehyde cyanide Number of shipments 1315 1000 1000 1000 499 499 499

{.

Pounds of hazardous material 57,984 36,450 8550 33,304 9430 38,400 15,600 released as vapor b i Lower flammable limit .022 .02 .03 .04 .038 .04 .06

Boiling temperature of spilled -43.7 24.1 50.9 7.2 54.1 69.4 78.3 chemical, 'F

Heat capacity of vapor, Btu /(1b)(*F) .3983 .3513 .2595 .2054 .2325 .3 .3169 j Heat of combustion, kcal/(g)(mole) 530.6 607.49 302.1 290 316.7 278.77 300 Molecular weight, g/ mole 44.1 54.1 44.1 62.5 64.5 44.05 27.03

Flash fraction at 100*F .453 .228 .057 .181 .115 .3 .15 i Density of vapor,1b/f t 3 .151 .161 .11 .145 .171 .11 .07 q

A M aLiquefied petroleum gas.

4 o

bAverage weight per carload multiplied by flash fraction. ,

1 a

1 i

i I

1 .

I 1

O O O .

Table 7-17. Incidents used to compile probability distributions j Quantity Estimated released Material Source of energy yield (tonnes) releaseda release Place Date (percent) Reference 5.5 Propylene Process plant Beek, Holland Nov. 1975 4.0 Gugan 6.9 Hydrogen Dirigible Hull, U.K. Aug. 1921 0.25 Gugan 7 7.6 Pentane Process plant Texas 1974 2.0 Gugan 9.1 Isobutylene Process plant Lake Chester, La. Aug. 1967 12.0 Gugan 17.3 Ethyl chloride Process plant Baton Rouge, La. 1965 0.25 Gugan

, 36 Cyclohexane Process plant Fleixborough, U.K. June 1974 7.8 Eichler

57 Propane. Pipeline Port Hudson, Mo. Dec. 1970 8.7 Eichler l 63 Propane Railroad car Decatur, Ill. July 1974 7.0 Eichler 68 Isobutane Railroad car Dallas, Tex. Feb. 1977 0.25 Gugan 50-100 Light HCs Storage Pernix, Holland Jan. 1968 6.0 Gugan j y <80 Butadiene Railroad car Houston, Tex. Sept. 1974 5.0 Eichler g 114 Heavy HCs Process plant New Jersey 1970 4.0 Gugan 1 + hydrogen 118 Propylene Railroad car East St. Louis, Ill. Jan. 1972 10.0 Eichler 18 Propane Road St. Amand-les-Eaux, France 1973 3.0 Gobert aHC = hydrocarbon.

1 4

1 t

! Table 7-18. Distribution of explosion yields ii Typical Range of Number of energy i yields a incidents yield

Probability 1

f 10-12 2 10.0 .14 l

~

6-10 4 7.5 .29

2-6 5 L.0 .36 j 0-2 3 0.25 .21 i

j aEnergy equivalence percent of contents of j single container.

l i

)

1 k

?

s i

f i

s i

1 i

i 1

4 l

i w

7-62

t,

, I l

Table 7-19. Rail spills of x liquefied fla==mble gases: 1 i correlation of percentage of spills and quantity of spillage i Percentage Spill quantity of spills (gal) 1 i 0.60 33,000a 0.10 30,000 I

0.05 27,000 l

0.05 10,000 ,

0.20 1,000

aThe nominal load capacity of 2

a tank car.

i I

l i

l 7-63 s m's r y-= e -e er+e--+vea----~wt '

-m<- ww r vn--w--+-9--*----*-- + w e* ---re a se - rw --* %-r+e-***rev &=+w=*+we=w* w ws r sr*f e--- r --m we s== a -tww-*--+-w+te'r v--'v-+*m'-e-s

Table 7-20. Mechanical damage-induced loss-of-lading accident severity 4

Severity by Total Accident category type number data Period I II III IV" V of cars source i 1965-1970 0 2 20 2 26 50 (b), (c), (d) 1971 0 3 4 0 6 13 (e) 1972 1 1 1 0 10 13 (e) 1973 0 5 8 0 8 21 (e) 1974 2 3 10 1 12 28 (e) 1975 0 4 6 1 5 16 (e) 1976 0 0 2 0 5 7 (f) 1977 0 1 3 0 11 15 (f)

Total 3 19 54 4 83 163 aw here accident reports did not give a positive iden-( tification of fire size, a worst-case assignment of Type III was made.

bAssociation of American Railroads and Railway Prog-ress Institute, 1972a. Final Phase 02 Report on Accident i

Review, Railroad Tank Car Safety Research and Test Project, RA-02-2-18.

cAssociation of American Railroads and Railway Prog-ress Institute, 1972b. Phase 02 Report on Dollar Loss Due to Exposure of Loaded Tank Cars to Fire--1965 thru 1970, RA-02-1-10.

dAssociation of American-Railroads and Railway Prog-ress Institute,1972c. Final Phase 01 Report on Summary of Ruptured Tank Cars Involved in Past Accidents, RA-01-2-7.

' Federal Railroad Administration, summary list of tank-car accidents. Hazardous Materials Section, unpublished.

I MTB and U.S. Department of Transportation hazardous-l material. incident reports.

~; f ,

,a O

7-64

, . . . . _ . . . , _ . _ _ _ _ . .. . _ . - _ . . . . _ . _ _ . . _ . _ . . _ _ - , . - . _ _ . _ _ _ . _ . . _ _ . . . - ~ . _ _ __.

l Table 7-21. Railroad-tank-car accident I data: liquefied-flammable-gas loss-of-lading l events caused by mechanical damage l

l Category of accident Number of Probability

, severity Accident type ,

eventa a of eventb i

I Explosion (detonation) 3 .018 l II Heated-tank violent rupture 19 .117 4 III, IV Uncontrollable or controllable fire C 58 .356 i

, V Spill 83 .509 Total 163 1.000 aFor period 1965-1977.

bValues constitute a probability density function.

' CAccident reports did not give a good indication of fire size; therefore, unknown fire sizes were classified as uncontrollable-fire (Type III) events.

1

)

1 i

4 i

i 1

l l

7-65 1 Y$

i

. , - w ,-+,=.-w m, -r...--vsw-----,- ,c y-w,..w-.,,,--- ----ep-y,,-o,+,wwme--+w,,e.ww--e,wm,,-e-wwy,--v-v-,--r,-=e-ww--t >=+yv .,u.v.- .-a,-r-e-,+--p.-, ----o-e*----rer-ww-w

i l l 1

l l

l Table 7-22. Meteorological data used in analysis of explosive-vapor hazards Parameter Measure i i

l Stability claas G i

l Wind speed, m/sec at 10-m height 1.5 Initial dilution, air / gas 3/1 Minimum cloud height, a 1 Ambient temperature. *F 78 Wind direction frequency distribution, t NNE 4.5 NE 3.8 ENE 7.0 E 8.7 ESE 5.1 SE 3.5 SSE 5.0 S 6.8

{' SSW 5.7 SW 3.6

]_

WSW 4.6 4 W 7.6 WNW 13.7 NW 8.4 NNW 6.4 N 5.5 I

1 7-66

, . _ _ . , .: _ . ~. . . _ _ _ . - . _ . _ . _ . . _ _ _ . . _ . . . - . . _ . , , _ . . _ , . . . . _ . . . . . . . _ _ . _ . , ,.. _ ..~_ _., _ . . _ _ . . . . . , . . , . - . . . _ .

O O O

< EXCESSIVE 1 CONCENTRATIONS AT CONTROL ROOH AIR INTAKE b

i l l WIND RELEASE OF DISPERSION DIRECTION T0XIC VAPOR AND DILUTION Q ^ Q P

I I I I RAILROAD HIGHWAY CHLORINE CHEMICALS r

O Q l l l SPONTANEOUS SHUNTING SPONTANEOUS SEISMIC PROCESS

FAILURE OPERATIONS FAILURE O Q Q Q Q SEISHIC PIPEWORK PIPEWORK OPERATIONS O O Q Q i Figure 7-1. Fault-tree-like representation of toxic-vapor release.

t i

4 7

i 4

e I i

l Automatic Adverse irnpact on

- detection Breathing operator leadmg to

{ .' l i and isolation masks core melt j

d i 8a E

x A. Cm 4

OK i

a 4 4 I

l OK Excessive chlorine Ba 4

concentration at I air intake E,B,C, i i

4 t

4 OK 4

A*.

1

m E, A,C, Figure 7-2. Event tree illustrating effect of chlorine on operators.

t 4

l l

! ll )ll 1l

(

m ,

C, C d

K K B

K A x x O O E O E m

o o

r n

ogn l

o r

i t t

cd e at n

fe lel f

e o s m c

eoe r i

n s t r r

e a r o v e c

s r .

d po m C o n Aot C t a i o

r t e

p lao o s n c i o it r a o

p m a

v ot g u in ic a ht s x o ak s , t o n e

r a , B f t B m8 o u t b

- c n fe o f it e

g e c

t i

t n e d

a r c i

t s t a

u H m i

e t o

e u t

r a t

n c e in t v a o E mi oc t

d .

t e u t d A 3 Ade A 7 e

r u

g i

F x

, E E

O Il Ii\lll'!1ltl ll j ,

.- - - - . - - .. - ~ _=. -. -_ .- _ . . . . . - .. . - _ . --

O

.a Adverse etfect on Detection Breathing operators leading by smell masks to core melt t

E x

S m B, Cm l OK OK ,

Sa 1

i Cm E,SmB,Cm 4

! Excessive

- concentration j in Control Room J

! OK t

1 S

i m d

l C E,Sm C, l

i .

Figure 7-4. Event tree illustrating effect of toxic vapors on i

j operators in control room-detection by smell.

I I

t i

t 4

4 l

l p '

U l

l 4

Detector Detector Detector Detector C A D B 8 _

h 8 8 I Control Roorn ! Control Room Control Room Control Room Chlorine isolation Chlorine isolation Chlorine Isolation Chlorine isolation Signal Channel C Siral Channet A Signal Channel D Signal Channel B I l 3 l

1 l

-l l t i l l Boundary g l For Detector C I I

__J l

i

_ r_J r_____; !

l A/S ! NS I I I I NE l l NE l

S -+ 3 S -+

1 I 1 1

l l I W l w

l 021A1 g 02181

-r --

4 i /r sr l

l N I I'- l f .

I l l

1 1 I I l L__ -- + L __ +

l SV J SV 02182 d '-

System Boundary 021A2 J -'

For isolatum sr j ;

a " d=

Valve 1 I I l

[ [ System Boundary For Isolation F Valve 2 11 11 gy NOFC gy WC 021A 021B 1 I _ l _

l Figure 7-5. Isolation-system schematic.

l O O O i

DETECTOR ._

SYSTEM A ISOLATION I VALVE 1 l DETECTOR ._

SYSTEM C 1

j SUCCESSFUL 1

C12 0.03 PPM ISOLATION i

h I

DETECTOR i SYSTEM B t

a ISOLATION VALVE 2 i

i DETECTOR i

SYSTEM D Figure 7-6. Reliability block diagram of detection and isolation system.

9 1

O O O V V V FAILURE TO AUTO ISOLATE CONTROL ROOM WHEN Ci2EXCEEDS SETPOINT ,

4

-2xte-3 I I ISOLATION VALVES CotttON CAUSE COMMON CAUSE 1 AND 2 DQ NOT FAILURE OF CLOSE: INDEPEN- 80TH ISOLATION ,

DENT CAUSES 4 DETECTORS VALVES b

exira 2xie-4 -2xis-3 T

I I I ISOLATION ISOLATION HARDWARE NAINTtlai c VALVE I DOES VALVE 2 DOES NOT CLOSE NOT CLOSE CONTRIBUTION CONTRIBUTION 2.4XIe -3 2.4xta-3 3 -gg-3 FAILURE OF DETECTOR A AND FAILURE OF DETECTOR B AND ISOLATION VALVE C DO NOT DETECT ISOLATION VALVE D DO NOT DETECT 1 TO OPERATE CtLORINE 2 TO OPERATE CHLORINE g

2xte-3 4xte-4 2xte-3 4xte-4 I

Figure 7-7. Fault tree for detection and isolation system.

s

O O O .

j .

- DETECTOR A AND C DO NOT DETECT - -y i

i CHLOltINE b

4Xl8-4

! T l DETECTOR A DETECTOR C i DOES NOT DETECT ,

DOES NOT DETECT

! CILORINE , CILORINE 2Xl8-2 2X18-2 i P P HARDWARE UNAVAILABLE HARDWARE Ut4AVAILABLE

! FAILURE OF DUE To FAILURE OF DUE TO DETECTOR A HAINTENANCE DETECTOR C MAINTENANCE l

1 i 18-2 18-2 18-2 18-2 4

Figure 7-7. Fault tree for detection and isolation systenp (continued l.

l l

1 i

I

.1 O O O DETECTOR B AND D DO NOT DETECT CHLORINE b

L 4xiG-4 l

DETECTOR B DETECTOR D DOES NOT DETECT DOES NOT DETECT CHLORINE CHLORINE 2X10-2 .

2Xtg-2 P P HARDWARE UNAVAILABLE HARDWARE UNAVAILABLE I FAILURE OF DUE TO FAILURE OF DUE TO DETECTOR B MAINTENANCE DETECTOR D MAINTENANCE O O O O 10-2 10-2 10-2 10-2 Figure 7-7. Fault tree for detection and isolation system (continued).

l

l 1

--- Cutoff for accidents with frequencies less than 1 per year

==== Cutoff for detection '

by smell 10-1 -

o 10-2 _

-il a

'5 b

.=

.c o 10--3 -

CL 10-4 -

10-5 I I 1 10 100 1000 Minutes Source: Wreathall(1982)

Figure 7-8. Failure probability versus time for operators.

s

~

l Failure of Failure of electric environmental i

. power systems system (3) (3) l b h A B 3xC D E l

Failure of Failure of Failure of input signal S*"S ' +

intake + air intake + 1 of 3 bypass + modifier ;

fads fails

pump manifold valves

I f 1

(6)

F G (2) H I -(7) 3 7 Failure of Output signal Failure of Failure of i solid state 4 modifier t output + alarm i computer fails relay system j (4) (S)

}

4 1

i Failure of

. zero gas system (3) i (1) (2)

[A-G] - components of one MIRAN unit; there are two redundant units (3) - these comprise the support systems 1; (4) - there are two independent output relays (5) - there is one alarm system serving both MIRAN units and both units 1 and 2 of the LGS

I (6) (7)

[H-1] - components of the alarm system

(

j Figure 7-9. Simple reliability diagram of a MIRAN-801 unit.

)

i i

i 1

(_,_---__ -- _._.- - - - - - - - - - - - - - _ _ _ - - - - - - _ - - - - -

J f

X O

= ,,

la o -

~, $-

C $

Q O X O .

t 9

0 h:

C_ 4 n

c -

C O 1 c c j O o -

- e e V C W O 2 :~ C

u. e r O y w ._

X O O 8 o

O~ O t O O O- 3 _

3 c o O- V

'Z c = 0 #

C c

5 E.. .o e _ -

M 4 O C N b : O A

< u O a

< x O w O

t

~

c

- C e

=

-o w t "

U"3 e y} 3 0 s <

N .h xo a o < < "C u u.

g ma

~

> -u x n n x ,x e As e m >

m- e CL CL Q. O t c

'C

_ .--O

- =

N m a .5

= m a e e

W M g .

E O e-O i b

c.,

a 3

E E ~

G D D EN Q

'O 'O <

u G <

o g 2m o N 2 y 3 N o ==c.

o- c e x -

o GW ,

~

o O g @ ** CL Z c n n A

X O s

~

O O O i

t Highway AL; j or railway a t,

I g' Section of track from which I

drifting cloud may originate i

_ ]

l l

4 ll 4

4!

t i Region 1 = Explosive overpressure i

is of concern

)

.' q Region ll = Flammable gas is of 2

concern 1

i Figure 7-11. Region definitions for analysis of explosions.

i i

s i

i

O 104 I I l l l l l l l O = oata Equation of fine:

f LOG A -1.38021 P(A) = % 1 +erf j

' ( 2.45318 j g 103 - _

E l- Q I ei S

c:

9

-5 a

is O E

O E

.5 100 1

1 O

to ' I i i i i i i

.02 0.1 0.2 0.5 0.8 0.9 0.98 Fraction of flammable plumes ignited, P(A)

A = 0.175 r2 i

Figure 7-12. Probability of flammable-plume ignition versus plume area at time of ignition.

i O

\

1000 100K g _1 1 I I I I I I I I l i I I I I I I I I I I I _ 9 8 -

- 8 7 -

- 7 6 -

- 6 5 -

- 5 j 4 - . -

4

~^

3 -

30K i

2 -

- 20K f W '

5 i e '

e i .? ?

E 100 - - ~* - 10K E 9 @

i e - -

8 e E 5 a

7 a

- m - -

6 m

- + -

5 i

- - 4 i -

j 3

1

- - 2 i

10 I I I I I I I I I I I I I I I I I I I I II 1K

. 0.010.050.2 1 2 5 10 20 30 40 50 60 70 80 90 95 98 99 99.8 99.9 1

Percent of spills less than ordinate value

)

i

Figure 7-13. Railroad loss-of-lading quantity normalized at maximum car j load of 33,000 gallons.

i l

l l

O .

)

10-4 - ' ' ' ' 8 ' ' -

l l l I I l i

b* 10-5 _. -

a . _

~

$ Total e . -

N o . .

,E - _

c m

d o 10-6 -- a --

Q - -

u - .

w _ .

C - _

I Q ?o _

y - _

o

? - -

& Explosion Explosion C

e on railroad of drifting h 10-7 7 at site of cloud --

1 :

crash 10-8 ' l ' I ' 'I ' l ' l ' l '

2 4 6 8 10 12 l

Peak incident overpressure (psi)

Figure 7-14. Frequency with which peak incident overpressures are exceeded at the diesel-generator building and reactor-control enclosure.

I l

- - , - - - , - , , , - , - - , - - - - - - , , -n w e - --.-en e-m.-r,,w,- - - ,v- g,, - -- ,.+,, e, - , . - y.,w,,,-y -, - , , m,+-

ML20076L237

Text

SUMMARY

0.28(V )1/6 (7-22) where Vy is in cubic centimeters, using Vy = 16,500 cubic meters

Navigation menu

Search