ML20095B990

a Review of the Limerick Generating Station Severe Accident Risk Assessment.Review of Core Melt Frequency

ML20095B990
Person / Time
Site:	Limerick
Issue date:	07/31/1984
From:	Azarm M, Bari R, Boccio J, Hanan N, Kafka A, Mccann M, Papazoglou I, Jeffrey Reed, Ruger C, Shiu K BROOKHAVEN NATIONAL LABORATORY
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-A-3393 BNL-NUREG-51711, NUREG-CR-3493, NUDOCS 8408220333
Download: ML20095B990 (192)

Text

,

! NUREG/CR-3493 l BNL-NUREG-51711 l

A Review of the Limerick Generating Station Severe Accident Risk Assessment Review of Core-Melt Frequency l Prepared by M. A. Azarm, R. A. Bari, J. L. Boccio, N. Hanan,

l. A. Papazoglou, C. Ruger, K. Shiu, J. Reed, M. McCann, A. Kafka Brookhaven National Laboratory Prspared for U.S. Nuclear Regulatory Commission l

1 l

[$0*EE8SRo!!8?% PDR

s t .

NOT!CE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liability of re-sponsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not infringe privately owned rights.

NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission, Washington, DC 20555

3. The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Docu-ment Room include NRC correspondence and internal NRC memoranda NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and investigation notices; Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the NRC/GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of federal Regulations, and Nuclear Regulatory Commission issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and s"scial technical libraries include all open literature items, such as books, journal and periodical er ucles. and transactions. federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draf t reports are available free, to the extent of supply, upon written request to the Division of Technical Information and document Control, U.S. Nuclear Regulatory Com-mission. Washington, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards institute,1430 Broadway, New York, NY 10018.

GPO Ponted copy once: jfLJO

l l

NUREG/CR-3493 BNL-NUREG-51711 )

I A Review of the i Limerick Generating Station Severe Accident Risk Assessment Review of Core-Melt Frequency Manuscript Completed: July 1984 Date Published: July 1984 Prepared by M. A. Azarm, R. A. Bari, J. L. Boccio, N. Hanan,

l. A. Papazoglou, C. Ruger, K. Shiu, J. Reed *, M. McCann*, A. Kafka **

Department of Nuclear Energy

, Brookhaven National Laboratory Upton, NY 11973

' Jack R. Benjamin Associates, Inc.

• • Boston College Prepared for Division of Safety Technology Office of Nuclear Reactor Regulation l U.S. Nuclear Regulatory Commission l Washington, D.C. 20555 NRC FIN A3393

-i i i-ARSTRACT A linited review is perforned of the Severe Accident Risk Assessment for the Linerick Generating Station. The review considers the inpact on the core-nelt frequency of seismic- and, fire-initiating events. An evaluation is performed of nethodologies used for determining the event frequencies and their impacts on the plant components and structures. Particular attention is given to uncertainties and critical assumptions. Limited requantification is per-forned for selected core-nelt accident sequences in order to illustrate sensi-tivities of the results to the underlying assumptions.

h 4

-, en-- m,.,,,---- ,,---- , - - - - - --e,- - - - e , , , ---. , .,

-iv-ACKNOWLEDGEMENT The authors wish to thank their colleagues in the Department of Nuclear

Energy at Brookhaven National Laboratory for many enlightening discussions and f

comments throughout this project.

The work was performed for the Reliability and Risk Assessment Branch l'

(RRAB)' of the U. S. Nuclear Regulatory Comisison. Mr. Erulappa Chelliah of RRAB was the technical monitor of the project. The authors wish to acknowledge Ashok Thadani, Chief, RRAB, and Erulappa Chelliah (RRAB) for many constructive comments on the preliminary and the final drafts of this report.

Finally, we would like to express our appreciation to Denise Miesell, Susan Monteleone, and Nancy Nelson for an excellent job in typing this document.

l i

l f

1

-v-TABLE OF CONTENTS Page ABSTRACT ................................................................ iii ACXN0WLEDGEMENT.......................................................... iv LIST OF FIGURES ......................................................... viii LIST OF TABLES .......................................................... ix

SUMMARY

................................................................. x

1.0 INTRODUCTION

....................................................... 1-1 1.1 Background .................................................... 1-1 1.2 Objective, Scope, and Approach to Review ...................... 1-1 1.3 Organization of Report ........................................ 1-2 2.0 EXTERNAL INITIATING-EVENT CONTRIBUTORS ............................. 2-1 2.1 Review of the Seismic Hazard and Tragility Analyses ........... 2-1 2.1.1 Introduction ........................................... 2-1 2.1.1.1 Sensitivity Analysis for Seismic Effects ...... 2-4 2.1.1.2 Seismic Section Organization .................. 2-7 2.1.2 Seismic Hazard ......................................... 2-7 2.1.2.1 Review Approach ............................... 2-7 2.1.2.2 Seismic Hazard Methodology ............ ....... 2-8 2.1.2.3 Seismogenic Zones ............................. 2-10 2.1.2.4 Seismicity Parameters ......................... 2-15 2.1.2.5 Ground Motion Attenuation ..................... 2-17 2.1.2.6 Comparison of the LGS Hazard Analysis with Hi stori c Sei smi ci ty . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-18 2.1.2.7 S u mma ry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-21 2.1.3 Seismic Fragility ...................................... 2-23 2.1.3.1 Damage Factor ................................. 2-24 2.1.3.2 Upper Bound Accelerations ..................... 2-29 2.1.3.3 Reactor Enclosure and Control Structure ....... 2-30 2.1.3.4 Reactor Pressure Vessel Capacities ............ 3-31 2.1.3.5 Potential Impact Between Reactor Building and Containment ................................... 2-32 2.1.3.6 El ect ri c a nd Control Equipment . . . . . . . . . . . . . . . . 2-34 2.1.3.7 Review of Significant Components .............. 2-36 2.1.3.8 General Fragili ty-Related Comments . . . . . . . . . . . . 2-43 2.1.3.9 Closure ....................................... 2-46 2.1.4 References to Section 2.1 .............................. 2-47 2.2 Fire ...........................................;.............. 2-55 2.2.1 Determi ni sti c Fi re Growth Modeli ng . . . . . . . . . . . . . . . . . . . . . 2-55 2.2.1.1 Introduction .................................. 2-55 2.2.1.2 Summary Evaluation of Deterministic Fire Growth Modeling ............................... 2-57 2.2.1.3 Detailed Evaluation of Deterministic Fire Gr o wt h Mo d e l i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-59

-vi-TABLE OF CONTENTS (Cont.)

Page 2.2.1.3.1 Fuel Burning Rate .................. 2-59 2.2.1.3.2 Fuel Element Ignition .............. 2-62 2.2.1.3.3 Fire Near Enclosure Walls or Corners ............................ 2-66 2.2.1.3.4 Stratified Ceiling Layer ........... 2-66 2.2.1.4 Reconmendations for Improving Fire Growth Modeling...................................... 2-67 2.2.2 Probabili stic Fi re Analysi s Review . . . . . . . . . . . . . . . . . . . . . 2-68 2.2.2.1 Evaluation of Significant Fire Frequencies in General Locati ons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-70 2.2.2.1.1 Sel f-Ignited Cabl e Fi res . . . . . . . . . . . 2-70 2.2.2.1.2 Transient-Combustibl e Fi res . . . . . . . . 2-71 2.2.2.1.3 Power Distribution Panel Fires ..... 2-71 2.2.2.2 Screening Analysis ............................ 2-72 2.2.2.3 Probabilistic Modeling of Detection and Suppression ................................... 2-72 2.2.2.4 Probabilistic Modeling of Plant Damage State .. 2-74 2.2.2.4.1 Zone-Specific Comments ............. 2-77 2.2.3 References to Section 2.2 .............................. 2-78 3.0 ACCIDENT SEQUENCE ANALYSIS ......................................... 3-1 3.1 Seismic ....................................................... 3-1 3.1.1 Pl ant Frontl i ne Sy stems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1 3.1.1.1 Overview of the LGS-SARA Approach in Frontline System Modeling ............................... 3-1 3.1.1.2 BNL Revision and Review of Frontline System F a ul t T re e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 3.1.2 Accident Sequence Analysis ............................. 3-13 3.1.2.1 Overview of LGS-SARA Accident Sequence Analysis ...................................... 3-13 3.1.2.2 BNL Review of Accident Sequence Quantifica-tion .......................................... 3-15 3.2 Fire.......................................................... 3-34 3.2.1 Overview of the LG3-SARA Accident Sequence Quantifica-tion ................................................... 3-34 3.2.2 BNL Revisions in Quantification of Accident Sequences .. 3-35 l 3.2.2.1 Fire Zone 2: 13 kV Switchgear Room .......... 3-36

3.2.2.2 Fire Zone 25: Auxiliary Equipment Room ....... 3-39 3.2.2.3 Fire Growth Event Trees for Fire Zones 20, 22, 24, 44, 45, and 47 ............................ 3-41

3.2.3 Review Results ......................................... 3-42 3.3 References to Section 3 ....................................... 3-44 l

-vii-TABLE OF CONTENTS (Cont.)

Page 4.0 SOME GENERAL ISSUES AND SPECIFIC RECOMMENDATIONS ................... 4-1 4.1 Seisnic Hazard and Fragility Recommendations .................. 4-1 4.1.1 Introduction ........................................... 4-1 4.1.2 Seismic Hazard ......................................... 4-1 4.1.3 Se i smi c Fra g i l i ty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 4.2 Fire .......................................................... 4-7 4.3 References to Section 4.2...................................... 4-10 APPENDIX A: Detailed Review of the Quantification of the Fire Growth Event Trees ................................................ A-1 APPENDIX B: Report of Professor Alan L. Kafka: A Critique of " Seismic Ground Motion at Limerick Generating Station," by ERTEC Rocky Mountain, Inc. ....................................... B-1

I

-viii-LIST OF FIGURES Figure No. Title Page 2.1.1 Crust Block source zone used in the LGS-SARA (taken from Appendix A, Figure 5 of LGS-SARA)............................................ 2-50 2.1.2 Comparison of various historical seismicity curves and the LGS-SARA seismicity curves from Appendix A for sustained-based peak acceleration for the Decollement and Crustal Block , M=5.5 sei smogenic zones. . . . . . . . . . . . . . . 2-51 2.2.1 Piloted ignition of EPR/Hypalon cable under va rious external heat fl ux . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-82 2.2.2 Fi re su ppres si on mode 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-83 3.1.1 Reduced faul t tree for the HPCI system. . . . . . . . . . . . . . . 3-24 3.1.2 Reduced fault tree for failure to scram.. . . . . .. . .. .. . 3-25 3.1.3 Th e s e i smi c e v e nt t re e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-26 3.1.4 Seismic event tree for loss of offsite power with reactor scram................................... 3-27 3.1.5 Seismic event tree for los of offsite power without scram........................................ 3-28 3.2.1 Fire-growth event tree for fire zone 2............... 3-45 A.1 Fi re-growth event tree for fi re zone 20. . . . . . . . . . . . . . A-17 A.2 Fire-growth event tree for fire zone 22. . . . . . . . . . . . . . A-18 A.3 Fire-growth event tree for fire zone 24.............. A-19 A.4 Fire-growth event tree for fire zone 44.............. A-20 A.5 Fi re-growth event tree for fire zone 45. . . . . . . . . . . . . . A-21 A.6 Fi re-growth event tree for fire zone 47. . . . . . . . . . . . . . A-22 l

l 1

l

-ix-LIST OF TABLES Table No. Title Page 2.1.1 Comparison of Mean Frequency of Core Melt Values..... 2-52 2.1.2 Hazard Curve Contribution to Mean Frequency of Core Melt..'......................................... 2-53 2.1.3 Hypothetical Mean Frequency of Core Malt (Based on Individual Hazard Curves)......................... 2-54 Suppression Data and Calculations Performed for Suppression Success Probability Self-Ignited 2.2.1 Cable-Raceway Fires.................................. 2-84 3.1.1 Signi ficant Earthquake-Induced Failures. . . . . . . . . . . . . . 3-29 3.1.2 Mean Values for Random System or Function Failures Used in Transient Events.................... 3-30 3.1.3 ATWS Mean Random Failure Values...................... 3-31 3.1.4 Domi nant Sei smic Core Damage Sequences. . . . . . . . . . . . . . . 3-32 3.1.5 Dominant Seismic Sequences With BNL Changes.......... 3-33 3.2.1 Summa ry of Fi re- Analysi s Resul ts. . . . . . . . . . . . . . . . . . . . . 3-46 3.2.2 Critical Locations of Transient Combustible Materials in the Auxiliary Equipment Room................................................. 3-47 3.2.3 Evaluation of Sequence Frequencies of Oil Fi re s (Tra nti ent Combusti bl es. . . . . . . . . . . . . . . . . . . . . . . . 3-48 3.2.4 Summary of Fire-Analysis Results BNL Review.......... 3-49 l'

l i

a e

p ,

1

-X-

SUMMARY

]

Overall, the Severe Accident Risk Assessment (SARA) for the Limerick Gen-erating Station appears to use state-of-the-art methodologies for evaluation of the core melt frequency due to seismic- and fire-initiating events. These re-sults are useful in a relative sense and should not be viewed as absolute numbers. The authors of SARA are well aware of the uncertainties associated with analyses of these events and provide discussions of the major contributors to uncertainties.

The procedure used to quantify seismic risk is based on simple probabil-istic models which use some data, but which carrently rely heavily on engineering judgment. The analysis does not include a comprehensive consideration of design and construction errors and, hence, may be (conservatively or nonconservatively) biased.

The method used for estimating the probability distribution on frequency of exceedance for the seismic hazard is a well-established, straightforward approach and is considered appropriate. With regard to the application of this l

method, it is not well defined by the coarse sampling of parameter hypotheses used in SARA. In addition, specific concerns are raised with regard to the definition and selection of seismogenic zones and to the assignment of seis-micity parameters. It was judged that the various issues raised with regard to i the seismic hazard analysis would individually have a small impact (less than a i

factor of 2) on the mean value of the seismic-induced core-nelt frequency, but l that the total impact could be moderate (less than a factor of 10).

l l The seismic fragility analysis also was found to be reasonably within the state of the art, but specific questions are raised with regard to the justi-fication for the fragility values of various components and structures.

l Simple audit calculations were performed in an attempt to replicate the results given in the SARA for the mean frequency of seismic-induced core melt from dominant accident sequences. The simple calculations were generally in good agreement with the SARA results.

, -xi-In the analysis of the core-melt frequency due to plant fires, the SARA

• employs state of the art technology for the determination of fire growth, de-tection, and suppression. In addition, the impact of fires on plant systems is within the current state of the art. It was found that the analysis was con-servative in many aspects, but tl)is is in keeping with current methodol-ogies in this difficult area which is fraught with large uncertainties. Addi-tionally, it was found that part of the analysis, in particular, the de-terministic fire growth modeling, has nonphysical aspects which may be either conservative or nonconservative. From the foregoing, the reviewers believe that it would be difficult to quantify the effect of these uncertainties, particularly as they relate to probabilistic analyses.

The approach taken on the fire analysis to the identification of critical plant areas is sound and all these areas appear to have been identified. How-ever, in some cases, critical components, cabling, and layout of panels were not properly identified. The data base adopted for estimating the fire frequ-ency is appropriate, but some of the specific estimates appear to be incorrect.

The cumulative fire suppression distribution function generated in the SARA does not seem to agree with available data. BNL obtained a distribution fit (Weibull) to the appropriate data base and thereby generated a cumulative dis-tribution which, for any given time, yields a lower probability of fire sup-pression than the corresponding SARA results.

On the basis of the review of probabilistic aspects of fire initiation, growth, and suppression, a limited requantification was performed of the fire-induced core-melt frequency. An estimated increase in the fire-induced core-melt frequency by overall factor of 2 is attributed to differences 1) in the probability of fire suppression at'any given time and 2) in the frequency of self-ignited cable-raceway fires. A major contribution to the core-melt frequ-ency comes'from the stage of fire growth in which all safe-shutdown

• This document provides a review of the impact of fire risk, as analyzed by the licensee in their April 1983 submittal. The fire analysis presented therein reflect the fire protection measures described in Revision 1 of the LGS Fire Protection Evaluation Report (FPER) (PECo, 1981). Impact of current plant de-sign changes (Revision 4 of FPER, PECo, 1983) which the licensee _ addressed by letter, dated July 15, 1983, has not been assessed in this document.

-xii-systems are assumed to be damaged and faulted by the fire. Each of these )

contributors was examined separately in sensitivity studies, and they were found to be equally important. Sensitivity studies were performed with regard to operator error and it was found that the fire-induced core-melt frequency was not very sensitive to (one order of magnitude) changes in 1) the failure of the operator to depressurize the reactor in a required, timely fashion or 2) the failure of the operator to initiate required systems from a remote shutdown panel.

In the main text, this report contains recommendations for further work and information requirements in the seismic and fire areas which wauld be helpful In assessing these risks at the Limerick plant.

1-1

1.0 INTRODUCTION

1.1 Background

In February 1983, Brookhaven National Laboratory (BNL) issued a re-port (l) (NUREG/CR-3028) on its review of the probabilistic risk assess-ment (2) for the Limerick Generating Station (LGS-PRA). The LGS-PRA excluded seismic events, fires, tornadoes, hurricanes, floods, and sabotage from the set of initiating events (internal events) that it considered. In April 1983, Philadelphia Electric Company (PECo) completed a study which included the evaluation of risk due to seismic-initiating events and to fires that might be initiated within the plant. This study, the Severe Accident Risk Assessment for the Limerick Generating Station (LGS-SARA), also included a revised an-alysis of the offsite consequence analysis with the CRAC2 computer code.

In June 1983, NRC requested that BNL undertake a preliminary, short-tenn review of the LGS-SARA. Results for a portion of this review are given here.

The present document covers the review of seismic and fire methodologies as they relate to the determination of the core-melt

• frequency. At a later date, results will be presented for the balance of the review, which will cover the analysis of the core-melt phenomenology, fission product behavior, and offsite conseq ue nces.

1.2 Objective, Scope, and Approach to Review The objective of this work is to perform a preliminary review of the LGS-SARA including consideration of the core-melt frequency. This includes Si evaluation of the appropriateness of the overall methodology used to identify structures and components damaged and faulted as the result of seismic events and fires and a comparison of PECo's methodology with current state-of-the-art approaches. In particular, this work reviews PECo's estimates of the occurrence frequency of ground motion acceleration and the fragility analysis of-structures and components damaged during

• seismic events; and the frequency

• The concept of core-melt frequency used here and in the LGS-SARA is equivalent to the concept of core-damage frequency used in NUREG/CR-3028 (and in some places in the present report).

I

1-2 of significant fires and the conditional failure probabilities of mitigating systems damaged and f aulted during the fire. Finally, a detennination is made of the influence of th,e findings of this review on the prediction of the core-melt frequency as calculated in the LGS-SARA.

It is noted at this point, that the determination of the impact of the findings on the core-melt frequency is qualitative in some places and, at best, 1 semiqualitative in others. In general, major uncertainties in the analysis are highlighted, subjective notions are identified, and limited recalculations are done to focus concerns and indicate sensitivities. A more detailed, quantitative. reevaluation of the core-melt frequency due to seismic events and to fires would be a more time-consuming, resource-intensive enterprise.

This preliminary review of the seismic portions of the report was conducted over a two-month period by BNL with the assistance of Jack R.

Benjamin Associates, Inc. (JBA). The BNL reviewers included J. L. Boccio (overall fire hazard and vulnerability review), M. A. Azarm (probabilistic fire modeling), C. Ruger (detenninistic fire modeling), I. A. Papazoglou (overall systems / core melt review), N. Hanan (fire / core melt review), and K. Shiu (seismic / core melt review). The JBA reviewers included J. Reed (overall I seismic hazard and fragility review) and M. McCann (seismic hazard review).

Finally, JBA subcontracted with Professor A.- Kafka of Boston College for a review of the seismic hazard analysis from a seismologist's viewpoint. The overall review contained in Volumes I and II was coordinated by R. A. Bari of

! BNL.

1 The review process was facilitated by several discussions and meetings held between BNL, NRC, and PECo and its consultants (notably NUS Corporation and Structural Mechanics Associates). BNL and JBA reviewers visited the Limerick site on July 15, 1983, to obtain ' direct plant configuration infonnation for the seismic and fire reviews.

i 1.3 Organization of Report i

Section 2.1 contains a review of the seismic hazard and fragility analy-ses. Section 2.2 contains a review of both the deterministic and probabilistic

!~ aspects of fire growth and suppression analyses. Section 3.1 contains a review I

l

=

1-3 of the core-melt sequence analysis related to seismic events. Similarly, Sec-tion 3.2 contains a review of the core melt sequence analysis relating to fire events. Sections 3.1 and 3.2 rely on information developed in Sections 2.1 and 2.2, respectively. Section 4 contains a discussion of general issues and specific recommendations based on this review.

i Note that all references are provided locally in the corresponding sections or subsections.

I 4

0 t

, ,.. - . ,_ . _ . , ~ , _ - . , - . ._

__m.. .. ,,,..-c, .-,

2-1 2.0 EXTERNAL INITIATING-EVENT CONTRIBUTORS 2.1 Review of the Seismic Hazard and Fragility Analyses 2.1.1 Introduction Jack R. Benjamin and Associates, Inc. (JBA) was retained by BNL to perform a preliminary review of the LGS-SARA for the effects of seismic events. The following sections of the LGS-SARA were the principal focus of the review by JBA:

Appendix A: Seismic Ground Motion Hazard at Limerick Generating Station Appendix B: Conditional Probabilities of Seismic-Induced Failure for Structures and Components for the Limerick Gener-ating Station.

Also included in JBA's review was applicable information in Chapter 3 and Appendix C.

Jack R. Benjamin and Associates, Inc...has performed similar reviews of the Indian Point Probabilistic Safety Study (IPPSS)(1) and the Zion Probabilistic Safety Study (ZPSS).(2) (See Reference 3 for the Indian Point review. The Zion review has not been published.) The review of the LGS-SARA focused on the critical issues which may significantly impact the results.

Based on the experience gained from the IPPSS and ZPSS reviews, a preliminary review of the LGS-SARA was conducted in a short time period in order to discover the critical issues and to make recommendations to address those issues which remain unresolved. In contrast to the previous reviews which consisted of an in-depth evaluation of each section and subsection of the PRA reports, this review focused primarily on critical areas which may impact the results. Since both the hazard and fragility calculations for the LGS-SARA were performed by the same engineers and were based on the identical method-t i

l l

2-2 ologies used for the IPPSS and ZPSS, many of the issues and concerns generic to all sites and plants already have been discussed and evaluated.(3) This review documents the important concerns applicable to the Limerick plant. The reader is directed to Reference 3 which provides a general point-by-point discus W e of the seismic risk methodologies used in PRA studies submitted to the NRC t o n.ite. Differences oetween the current study for Limerick and the IPPSS and ZPSS reports are discussed in this report.

In the review of the LGS-SARA, dBA assumed that the Boolean equations for the sequencies leading to core melt are correct. The review performed by the BNL reviewers addressed the adequacy of the event and fault trees, random equipment failures, operator errors, and resulting Boolean equations. The discussion concerning potential discrepancies for these issues is given in Section 3.1.2.

As part of the review a meeting was held at the Structural Mechanics Associates (SMA) office in Newport Beach, California, on 8 July 1983. Dr.

Robin McGuire of Dames and Moore, who performed the seismic hazard analysis while employed by Ertec Rocky Mountain, Inc. ; SMA, who conducted the fragility analysis; and NUS met with Dr. John W. Reed and Dr. Martin W. McCann of JBA along with representatives from the NRC. The purpose of the meeting was to discuss issues raised to date concerning the LGS-SARA and to focus the review effort on the critical components and issues. Subsequent to this meeting a tour of the Limerick plant was conducted on 15 July 1983. Toward the end of the review, responses from questions the NRC submitted to Philadelphia Electric Company (PECo) were provided to JBA.(25, 26) In addition, a meeting was held in Washington, D.C., on September 26, 1983, which included representatives from NRC, BNL, and PECo (including their consultants). JBA did not attend that meeting; however, the transparancies prepared by PECo were transmitted to JBA. Based on these events, review of the LGS-SARA, and discussions with the NRC, Sections 2.1 and 4.1 of this report were prepared by I JBA. Note that the information received toward the end of the project (i.e.,

i References 25 and 26 and transparencies from the September 26, 1983, meeting)

I 1

2-3 s

was incorporated where the responses clearly resolved the outstanding issues; otherwise, the concerns raised during the course of the review are documented in Sections 2.1 and 4.1.

In the review, an attempt is made to look for both conservative and unconservative assumptions which could signficantly impact the results. In order to help the reader, an effort is made to indicate, where possible, the ultimate impact of the issues which have been raised. Comments are primarily directed to the mean frequency of core melt or to the individual sequences which contribute significantly' to core melt. Where possible, the impact of the j issues raised on the median frequency of core melt is indicated. The following scale has been adopted to quantify comments made in the review of the LGS-SARA:

Effect on Mean Frequency Comment of Core Melt Small Factor < 2 Moderate 2 < Factor 7 10 Large Factor i 10 The methodology used in the LGS-SARA for seismic effects is appropriate and adequate to obtain a rationai 4 msure of the probability distribution of the frequency of core melt. The .esults from the LGS-SARA are useful in a relative sense and should not be viewed as absolute numbers. The procedure used to quantify seismic risk is based on simple probabilistic models which use some data, but currently rely heavily on engineering judgment. The analysis does not include a comprehensive consideration of design and construction discrepancies and, hence, may be biased (note that discrepancies may be either conservative or unconservative). Because of the newness of these types of analyses and the limitations pointed out above, the results are useful only in making relative comparisons. Although more sophisticated analytical models exist, the limitation of available data dictates that the simple rodels used in the LGS-SARA are in a practical sense at the level of the state-of-the-art.

l

i

! 2-5 e

2.1.1.1 Sensitivity Analysis for Seismic Effects

The approach used by NUS to combine the hazard and fragility curves is different from the method used by Pickard, Lowe, and Garrick (PLG) for the IPPSS and ZPSS. In the PLG method a discrete probability distribution (DPD)

I approach was used to systematically account for the variability (i.e., '

4 randomness and uncertainty) in the hazard and fragility parameters. Sequences

were combined to form the final Boolean equations for core melt and the various release categories. System fragility data for core melt or the release categories were obtained and provided in the PLG reports for Zion and Indian Point. - The combination of the system fragility curves and the hazard curves were performed directly using numerical integration.

t

In contrast, the NUS approach-differs from the PLG methodology in two respects.. First, NUS included the potential for random equipment failures and j- operator errors in the seismic event / fault trees. Second, they used Monte Carlo simulation instead of the DPD approach adopted by PLG. It appears, I based on a preliminary review, that random equipment failure and operator errors have a small effect on the mean frequency of core melt, but may have a moderate effect on the median frequency of core melt relative to the case

!. where only seismic contributions are included.

- As part of the preliminary review, an attempt was made to replicate the results given by NUS for the mean frequency of core melt as contributed by the-

- significant sequences. This exercise also provided a basis for detennining the possible changes which differences of opinion could produce on the mean l '

, - frequency _ of core melt. The-procedure used was based on the component i' fragility curves represented by their median values and combined variabilities L (i.e., the randomness and uncertainty logarithmic standard deviations were

!. combined). In addition, mean values for the random equipment failure and

- operator error events were assumed. This approach is approximate,-but gives +

reasonable results for mean frequency values. ,

I c

I 4

V -

• y ~ -.e-,--,---- ev, -ww--=,w.- ,,w, =v e wmeym.m-p n-----,em---=r,e *ry--yr-.e---,-e-e-++-tm,.r - y---yr

o 2-6 The fragilities for the components in each of the sequences which were j considered to contribute significantly to the mean frequency of core melt, were combined according to the Boolean equations and integrated with the hazard curves. Table 2.1.1 gives the comparison between the approximate

' values calculated as described above and the values reported in the LGS-SARA.

In general, the approximate results compare reasonably well with the values gTven in the LGS-SARA. The calculated mean frequency' of core melt is 5.3-6 (6.5-6=6.5x10-6) and is _within 10 percent of the LGS-SARA value of 5.7-6.

The maximum ratio for individual sequences is a factor of 2.5, which is a moderate effect. However, the difference for sequence TsRPV, which consists

'of a single component (i.e. , the RPV), is approdn'ately 50 percent. It was surprising that the calculated value was relatively different as compared to the LGS-SARA reported value (i.e., 4.4-7 compared to 8.0-7).

Table _2.1.2 gives the breakdown of the mean ffequency of core melt contributed by the various hazard curves. Over 83 percent is contributed by the Decollement and the Piedmont, Mmax = 6.3 hazard curves, with the Decollement contributing slightly less. The Northeast Tectonic hypotheses, which is' weighted by a probability of 0.3 in the LGS-SARA, contributes only about 5 percent. , ,.

Table 2.1.3 considers the hypothetical case that only one hazard curve

~

exists and gives the value for mean frequency of core melt assuming that only one hazard curve is possible (i.e., probability weight is 1.0). This assumption is made independently for each of the six hazard hypotheses and the corresponding mean frequency of core melt values'are given in Table 2.1.3 along.with the ratios of values compared to the case where the curves are l weighted as assumed in the LGS-SARA. It is interesting to note that if the l Decollement is the only hazard curve, the mean frequency of core melt will only increase by a factor of 4.0, which is a moderate effect. On the other hand, if the Crustal Block, Mmax = 5.5 is the only hazard curve, the mean frequency of core melt will decrease by a factor of about 50, which is a large i effect.

2-7 The comparisons given in Tables 2.1.1, 2.1.2 and 2.1.3 give an indication of the potential sensitivity of the mean frequency of core melt to changes in the contributions from the different sequences and hazard curves.

2.1.1.2 Seismic Section Organization Section 2.1.2 presents the results of the review of the seismic hazard analysis,~while Section 2.1.3 gives the review of the fragility analysis.

Recommendations for actions to address the significant unresolved issues are presented in Section 4.1 of Chapter 4.

2.1.2 Seismic Hazard 2.1.2.1 Review Approach A critical review of Appendix A of the LGS-SARA, which describes the methodology and analysis of the earthquake ground motion hazard at the Limerick site, was conducted. Section 3.3.1 of the LGS-SARA summarizes the methodology and the results of the probabilistic seismic hazard analysis which is provided in Appendix A. To assist in the review, the services of a consultant, Professor Alan L. Kafka, were retained by JBA to review Appendix A from the seismologist's viewpoint. Professor Kafka's report is provided in Appendix B to this review, while important points are incorporated in this body of this report.

The review of the seismic hazard analysis in the LGS-SAT,A has c~

concentrated on a number of issues. To begin, the adequacy and appropriateness of the overall probabilistic methodology to estimate the frequency cf ground motion is considered in Section 2.1.2.2. Individual elements of the seismic hazard analysis: seismogenic zones, seismicity

. parameters, and the ground motion attenuation are reviewed in Sections 2.1.2.3 to 5, in that order.

In Section 2.1.2.6, a preliminary assessment of overall reasonableness and accuracy of the LGS-SARA hazard curves is made through a comparison with

2-8 results derived from the historic site intensity data. A qualitative summary of the preliminary review of the seismic hazard analysis is given in Section 2.1.2.7.

As discussed previously in Section 2.1.1, the impact of comments on the mean frequency of core melt is assessed in a qualitative manner. In the same manner, the impact that comments on the seismic hazard analysis have on the results are indicated where possible.

2.1.2.2 Seismic Hazard Methodology The approach used in the LGS-SARA seismic hazard analysis is well established and considered appropriate to estimate the frequency of ground shaking levels.(4,5) The analysis consists of two basic elements. The first step involves establishing hypotheses to model the seismicity in the tectonic vicinity of the site and the ground motion associated with seismic events. Hypotheses are established to consider reasonable models of seismogenic zones, estimates of seismicity parameters (i.e., maximum magnitudes, b-values, etc.) and ground motion attenuation. For the most part, expert opinion is the principal basis for establishing the hypotheses used in the LGS-SARA. Associated with each hypothesis is a probability value that expresses the degree-of-belief that a given set of parameters is the "true" representation of the site seismicity.

The second step in the analysis involves the calculation of the annual frequency that levels.of ground motion will be exceeded at the site. This step is performed for each seismogenic zone hypothesis and the suite of likely parameter values (i.e., activity rates, b-values, maximum magnitudes, etc.).

The final product of this analysis is a family of seismicity curves, each having a discrete probability value associated with it. The discrete probability values sum to one, implying that a complete probability distribution on the annual frequency of exceedance has been derived.

4 s ,

2-9 The application of this approach in the LGS-SARA is appropriate to

. estimate the seismic hazard at the plant site. With regard to adequacy, the ,

application does not insure that the probability distribution on frequency'has been completely defined. In the LGS-SARA study, an implicit decision was made only to consider those hypotheses for seismogenic zones, source parameters,

etc., that had a major influence on the estimate of the frequency of occurrence. That is, of the many reasonable hypotheses that could be considered to estimate the ground motion hazard at Limerick, a relatively small sample was selected. In a sense, a filtering of the various parameter j- sets that could be included in the analysis was made. The consequences of this approach depend on the random process being considered. However, the result is that the probability distribution on frequency is defined by a coarse set of discrete probability values. Further, depending on the manner in which the hypotheses are selected, the tails of the probability distribution on the annual frequency of exceedance may be poorly defined. .

i=

The approach used in the LGS-SARA presupposes that the analyst, in-

~

consultation with a seismologist, can adequately sample the space of alternate -

hypotheses, such that the probability distribution on frequency is adequately I defined. Although the influence of individual parameters can be reasonably

estimated prior to performing the analysis, it is generally not true that the

. analyst can select a set of hypotheses that will adequately define-the probability distribution on frequency over its entire range.

! In the LGS-SARA, six discrete probability values are used. to define the -

distribution on frequency, which generally ranges over one or more orders of

. magnitude. This is not'to suggest that a discrete representation of such a wide' distribution by 6-10 points is not . adequate. 'Certainly, if the entire distribution were known and the points were: selected in a prudent manner,-this may be reasonable. However, in the LGS-SARA, six hypotheses and their discrete probability values were selected beforehand without knowledge of their counterpart result on the probability distribution on frequency. - The

+

solution to this issue is-simple;'a more complete sampling of the possible model hypotheses and distributions of individual parameters is needed.

=

. , , , , , . , . - , , . , - - _ , ..,.- - _ z. , ,. -. . . - - - - , . - , _. .- - - .

2-10 Specific examples where this could be achieved in the LGS-SARA are discussed in the sections which follow.

In regards to the importance of having an adequate representation of the probability distribution on the frequency of exceedance, one point should be considered. A reliable representatior, of the probability distribution on

. seismic risk (i.e., core melt), is determined for the most part by the hazard analysis. That is, both the order of magnitude of the results and the uncertainty are dominated by the probability distribution on the frequency of ground motion. For new plants such as Limerick, this issue becomes more important-because the tails of the seismic hazard curves, which are even more uncertain, determine the estimate of seismic risk. If the seismic hazard analysis does not adequately represent the probability distribution on frequency, results based on it may be jeopardized.

It should also be pointed out that in terms of estimating the mean frequency of core melt, the LGS-SARA results may not be influenced by the above comments. However, if the entire distribution on the frequency of core melt is of concern, then these comments are more important.

2.1.2.3 Seismogenic Zones To model the seismic hazard at the LGS site, four hypotheses on the tectonic origin of earthquakes in the plant vicinity were defined. The definition of the different seismogenic zones is based in part on geologic, geophysical, and seismic data and expert opinion. Seismicity parameters are then estimated for each zone. On the basis of expert opinion, the Piedmont, Northeast Tectonic, and Crustal Block zones were assigned probability weights of 0.30, and the Decollement hypothesis was assigned a 0.10 weight. Major concerns with the zonation used in the LGS-SARA are discussed below.

As described in the LGS-SARA, the Crustal Block hypothesis attempts to account for the occurrence of earthquakes in the northeast by the movement along the boundaries of large blocks of the earth's crust. It is assumed that earthquakes occur along block boundaries while the interior areas are relatively quiet. In the LGS-SARA, eight zones make up the Crustal Block j l

l

2-11 hypothesis (see Figure 2.1). Of these, Zone 8 is the dominant contributor to the hazard at the site. This hypothesis is questioned on two accounts.

First, while the principle that large blocks of the earth's crust may control the seismicity in the region along their boundaries is reasonable, such a theory should correlate reasonably well with historic and instrumentally located seismicity. In general, this is not the case (see Figure 2.1).

As stated previously, Zone 8 is reported to have the greatest contribution to the site hazard. A review of Figure 2.1.1 indicates that the closest proximity of Zone 8 to the LGS-SARA site is approximately 30-40 miles.

This fact alone explains to a large extent why the hazard curves derived for the Crustal Block hypothesis produced the lowest frequencies. It is further noted in Figure 2.1.1, which also shows the distribution of seismicity to 1980, that the northwest boundary of Zone 8 appears to be inconsistent with the pattern of earthquake occurrences in southern New York, New Jersey, and eastern Pennsylvania. At the meeting at SMA, it was learned that Zone 8 was modeled to represent the Triassic Basin. The inconsistent delineation of Zone 8, with respect to local seismicity patterns, may be attributed to two factors. The LGS-FSAR(6) reports that Limerick is in the Triassic Lowlands, suggesting that the northwest boundary of Zone 8 should be moved toward the plant. This would also be consistent with the distribution of seismic events in the region (see Figure 2.1.1).

l Secondly, it is not apparent that the boundaries of seismogenic zones should be coincident with the perimeter of a large geologic structure. If in fact these boundaries generate seismic events, it may not be realistic to restrict their occurrence to the boundary itself. Instead, events should be modeled as occurring in a volume of crust, defining a zone of weakness. In ,

one sense, this has been done for Zone 8 towards the southeast.

A redefinition of Zone 8 in the Crustal Block hypothesis that places the

~

LGS site within its boundaries is judged to have a moderate impact on the estimated hazard curves (i.e., at least a factor of 2). The consequences of this change on the mean frequency of core melt is estimated to be small-(i.e.,

a factor of 2 or less). However, a moderate increase in the median core melt '

frequency is considered possible.

I

._. -_, . - - ._ - - .-_ - . _ - ]

2-12 To consider the possibility that large magnitude events could occur in the northeast, the Decollement source zone was defined. A maximum magnitude of 6.8 was assumed, and a probability weight of 0.10 was assigned to this hypothesis. The selection of maximum event size is discussed in Section 2.1.2.4. The Decollement hypothesis is one of a number of theori'es being considered by seismological experts to explain the possible occurrence of large magnitude events in the eastern U.S. The physical basis of this hypothesis is the identification of a shallow-dipping reflector beneath and along the east coast that has been interpreted as a seismically distinct block of.the earth's crust.(7,8)

A major concern with the Decollemer., hypothesis is the fact that patterns of instrumentally located seismicity do not correlate well with it. That is, fault plane solutions and source depths do not suggest that earthquakes in the

. region of Charleston, South Carolina, or anywhere else along the eastern seaboard occur on a decollement surface. In addition, since the evidence that a major decollement may exist generally applies to the southern Appalacians, it is not clear that a decollement seismogenic zone should extend to the northeast in the vicinity of the Limerick site.

At the SMA meeting, discussions with Dr. McGuire revealed that the Decollement hypothesis was not selected solely on the basis of physical arguments that it explains the seismicity in the east. A principal motivation was its use as an all-inclusive hypothesis, in a probabilitistic sense, in that it allows the possible occurrence of events as large as M6.8. That is, an assumption is made in the LGS-SARA that all reasonable hypotheses which would consider the possibility that large-magnitude events could occur in the vicinity of the plant site are fully represented by the Decollement hypothesi s. Although such an approach may provide a best estimate of the ground shaking hazard at the LGS site, it is not clear that it is appropriate or adequate for use in the LGS-SARA. No basis is provided to support the belief that the Decollement hypothesis in fact adequately represents, even in l a best estimate sense, the hypothesis that large events can occur. Also, the variability in key parameters was not considered in the Decollement hypothesis j (i.e., b-values and Mmax). Neither is it clear that the Decollement source i

2-13 zone is the most appropriate way to model the occ .rrence of large magnitude events in the eastern seaboard.

The use of decollement tectonics to explain the occurrence of large magnitude events in the east is one of many theories based in part on scientific evidence and expert speculation. Although experts differ as to the validity of any theory to explain the 1886 Charleston, South Carolina, earthquake or the occurrence of future large events, the Decollement source zone is certainly one that could be used. However, in the LGS-SARA the Decollement zone serves as a single physical characterization of the process that generates large-magnitude events as well as a summary of a multitude of hypotheses that define other physical processes. It is with this expanded role that a concern is raised.

A number of alternatives exist to model the occurrence of large-magnitude events in the east. Among the possibilities is to allow the occurrence of M6.8 events in the other source zones defined in the LGS-SARA.

That is, an M max =6.8 would be considered as one hypothesis on maximum magnitude for each source zone. The basis for this approach is straightforward. The occurrence of large-magnitude events in the east is considered possible on pre-existing zones of weakness in the earth's crust.

What defines these zones as earthquake generators vary. In part a variety of such theories are the basis of the seismogenic zone and hypotheses in the LGS-SARA (i.e. , Piedmont, Northeast Tectonic, and Crustal Block). The concept of pre-existing zones of weakness is consistent with the thinking expressed by the four experts in Appendix B to the LGS seismic hazard analysis.

Furthennore, a preference was given in the hazard analysis to the Piedmont, Northeast Tectonic, and Crustal Block hypotheses. A combined probability weight of 0.90 was assigned to them. A 0.10 probability was given to the Decollement hypothesis. Consistent with this degree-of-belief and the consensus in Appendix B that large earthquakes can be expected on pre-existing zones of weakness, the possibility of large-magnitude events in source hypotheses that define such zones, should be considered. This approach was discussed at the SMA meeting with Dr. McGuire, and recognized by him to be a reasonable alternative to model the occurrence of large magnitude earthquakes.

~ . . - - . . . . . .-

- .-~ - .-

2-14 p

However, it is the opinion of Dr. McGuire (and but not necessarily the consensus.of all the consultants) that the total' probability weight assigned

[

-to any and all hypotheses is 0.10.

i, i The question as to whether 0.10 probability is a reasonable value to be l- assigned to the hypothesis that large magnitude events (i.e., M6.8) can occur

! in the vicinity of the Limerick site is a difficult question and one that must

• be answered on the basis of expert opinion. In Appendix B to the LGS seismic hazard analysis,- the four experts interviewed agreed universally that 'such events could occur- at the LGS. The degree-of-belief assigned to such a

[ hypothesis varied from zero to twenty-five or thirty-percent. Presumably the value of zero is actually a very small number, otherwise there could not have

been the aforementioned universal agreement. At this point in the preliminary review of the seismic hazard analysis, the value of 0.10 is not accepted by I JBA nor all the experts retained in the LGS-SARA. Qualitatively, this value should be considered a lower bound.

i

The alternative ap. sach suggested to model large-magnitude events would produce at least one additional hazard curve for each source zone. By virtue of the arguments on maximum acceleration, these additional hazard curves would i be unbounded as is the curve for the Decollement zone. Depending on the

! source considered, the impact on the frequency of ground motion varies.

[ However, it is felt that in most cases the hazard curve associated with a j large-magnitude event will be higher by a factor of 2 or less, compared to the

! existing hazard curves. At higher accelerations, these new curves will be unbounded and thus have nonzero occurrence frequencies, unlike the previous hypotheses.

l- With respect to their impact, the fact that these additional curves are unbounded means that they will have a greater contribution to the mean frequency of core melt than their counterparts for each source zone.

j Previously, the-Piedmont, Mmax=6.3 and Decollement hypotheses contributed 83

{ percent of the mean core melt frequency, since '. hey only allowed accelerations I

greater than 0.80g to occur. All zones will have some contribution to the 4

e

2-15 mean frequency of core melt. The overall influence of these additional curves is , judged to result in a small increase in the mean core melt frequency.

2.1.2.4 Seismicity Parameters For a prescribed zone of seismicity, the random occurrence of earthquakes is defined by the seismic activity rate, the Richter b-value, and the maximum magnitude that can be generated by the source. Estimates of seismic activity are based on the historic record. However, the statement that seismic activity rates are well determined in the eastern U.S. is in some ways an overstatement or at least easily misinterpreted. For a prescribed area in the east, the catalog of earthquake occurrences is generally believed to be long enough and sufficiently complete that estimates of activity rates are reasonably well determined. That is, their uncertainty is low enough that its impact on the frequency of exceedance of ground motion can be ignored.

However, from the point of view of the rate of seismic activity per unit area (i.e., say 104 km2 ) the variation can be large. From Table 2 in the LGS-SARA hazard analysis, the rate of seismicity for the four source hypotheses varies from 4.33 to 38.0x10-3 events per-year, per-104 km2 ,

This effect is taken into account in the LGS-SARA, however this variation per se is not recognized as such.

In the LGS-SARA, the estimate of Richter b-values was based solely on expert opinion as reported in Reference 9. A best estimate of 0.90 was used for all source zones, and no uncertainty was considered. In Reference 9, the experts came to a consensus that 0.90 was a realistic, albeit default value that can be used for all seismogenic zones in the eastern U.S. However, it was further stated by many of the experts that it is believed that b-values for different seismogenic zones may vary from 0.90 as a best estimate. This notion suggests that variability in the mea,n value of b exists. That is, a difference exists between the 0.90 global estimate, and the true best estimate for a given source zone. In fact, some experts indicated a preference for a regional dependence for b-values. Furthemore, there is the contribution of statistical variability in b-value estimates derived from the data, which

=. - - .-. . . .

I 2-16 depends on the number of data points. Thus, as a minimum, two sources of variability exist in the estimate of Richter b-values:(1) a possible bias in the use of the 0.90 best estimate value recommended by experts for all source zones, regardless of the actual distribution of the data and (2) the statistical variability due to limited sample size. The failure to account for the variability in b-values is an example of the inadequate degree to which parameter hypotheses have been sampled in the LGS-SARA. It should be noted that the LGS-SARA did not directly estimate Richter b-values from the catalog of earthquake occurrences. In considering the estimate of b-values, PECo should consider the results obtained using the historic data.

The impact of a complete characterization of the variability in b-values on the mean core melt frequency is judged to be small.

The final seismicity parameter defined for a seismogenic zone is the maximum magnitude. In the previous section, the manner in which large magnitude events were modeled in the LGS-SARA was considered. Here, the matter of what the size of the largest events should be is addressed.

The estimate of maximum magnitudes for the Piedmont source zone reflected the issue of the 1982 New Brunswick, Canada event and the Cape Ann earthquakes. The magnitude 5.7 New Brunswick event is used as the basis for establishing the distribution on Mmax, while it was stated that the Cape Ann earthquakes do not belong in the Piedmont zone. The basis for limiting the occurrence of the Cape Ann events to New England is presumably related to the theory that a Boston-Ottawa seismic belt exists as discussed in References 10, 11 and 12. However, the existence of such a trend does not correlate very well with results of recent studies questioning the existence of such a trend.(12) Thus, no definitive basis exists to support the hypothesis of a Boston-Ottawa seismic belt and therefore no reason exists to exclude earthquakes near Cape Ann, from the Piedmont region. This is further supported by the arguments provided in the LGS-SARA that suggest the 1982 New  !

Brunswick, Canada, earthquake belongs in this seismic province.

2-17 If the 1755 Cape. Ann earthquake is considered to be a 6.0 event,(14) the distribution on Mmax would be modified to reflect the fact that the largest observed event had a magnitude of 6.0 as opposed to 5.7. If it is assumed that the two point distribution on M max was changed from 5.8 and 6.3 to 6.0 and 6.5, it is estimated that the effect on the frequency of exceedance curves and the mean core melt frequency would be small.

The hypothesis that a large-magnitude event, the size of the 1886 Charleston, South Carolina, event could occur on the eastern seaboard was considered in the Decollement source zone. A magnitude of 6.8 was assigned to this Modified Mercalli Intensity (MMI) X event. No basis is provided in the LGS-SARA to support the implicit assumption that the observed magnitude of the Charleston event is the maximum event that could occur. Should it for example be considered a lower bound on Mmax? This question and the uncertainty in Mmax should be addressed by PECo.

2.1.2.5 Ground Motion Attenuation _

To describe the attenuation of ground motion with magnitude and distance, Nuttli's relationship for sustained acceleration was used.(IS) The uncertainty in ground motion predictions is described by a lognormal distribution with a standard deviation of 0.60. This value corresponds to a factor of 1.8 times the median value at the one standard deviation level.

The attenuation relationship was modified in the hazard analysis to predict sustained-based peak acceleration and to account for the random orientation of ground motion. This factor is magnitude dependent. Above magnitude 6.0, sustained-based peak acceleration is 1.23 times the sustained acceleration. The attenuation model used in the LGS-SARA is appropriate and adequate to describe the ground motion at the plant site.

The prediction of ground motion in the easter U.S. is a difficult task due to the limited strong motion data available for that region. However, a number of relationships have been developed and used in probabilistic hazard analyses.(l>9) Results of sensitivity studies are available to compare the

2-18 impact of various functions on the estimated hazard curves. A preliminary I review of these studies suggests the attenuation for sustain-based peak accelerations used in the LGS-SARA is generally on the conservative side (i.e., it gives higher accelerations at a given frequency of exceedance >

level) (9) It is noted however that there can be considerable variation in the hazard analysis results for various attenuation relationships. This suggests that a more compre hensive sampling of attenuation functions is appropriate, since it is generally believed that the capability to predict ground motion in the castern U.S. is not well established. The impact of including alternative attenuation hypotheses on the mean core melt frequency is considered to be small.

2.1.2.6 Comparison of the LGS Hazard Analysis with the Historic Seismicity The accuracy of the LGS-SARA seismic hazard analysis might be compared with the historic distribution of earthquake ground motion experienced at the plant site. However, since a record of the ground shaking intensity at the LGS site is not available, another approach must be taken. I'n the Limerick FSAR(6) the earthquakes that have occurred since 1737 within 200 miles of the site (Table 2.5-2, Reference 6) are reported. These data provide a basis to estimate the distribution of historic ground motion. The approach used to do this is summarized below.

The catalog of earthquake occurrences provided in the FSAR describes event size in terms of Modified Mercalli Intensity. To establish a distribution of the MM intensities experienced at the LGS, the reported epicentral intensities are attenuated to the plant. This is done using the intensity attenuation relation in Reference 16 for rock sites given by the following equation, is"lo + 2.6 - 1.39 InR (2.1) where: I s = site intensity lo = epicentral intensity R = distance (miles)

2-19 For each event and distance reported in the FSAR, a site intensity was estimated using Equation 2.1. In establishing a record of the MMI level experienced at the LGS site, no attempt was made to verify the catalog reported in the FSAR or to correct the record for inconsistencies. Also, no uncertainty in the estimate of site intensities was considered. Intensities above MMI equal to IV were considered.

To define the distribution of seismic intensities at the site, the Gutenburg-Richter relation that describes the number of events versus intensity is given as follows:

log 10N (I ) = a + bl s 3 (2.2) where a and b are parametcrs fit to the data. The b term is known as the Richter b-value. The b-value on intensity is estimated to be -0.72. The seismic activity rate for events of MMI > IV is 0.0266 events per year based on a 226 year record.

An estimate of the historic ground motion in terms of ground acceleration can be obtained by a transformation of intensity to peak ground acceleration using an appropriate relation. To do this, the following equation was used:(17) log 10A = 0.014 + 0.30!s (2.3) where A is peak ground acceleration in cm/sec2 . To account for the uncertainty in estimating A in Equation 2.3 and the uncertainty in attenuating intensity in Equation 2.1, a lognormal distribution on peak acceleration is assumed, with a logarithmic standard deviation of 0.28 (base 10), which corresponds to a factor of 1.9 at the one ' sigma level.

i-

c 2-20 The distribution on acceleration at the LGS is estimated according to v(A>a)=orf(I) alp (A>alI) (2.4) where v(A>a) = annual frequency of peak acceleration A, greater than the value a.

v = seismic activity rate for intensities greater than or equal to IV.

f(I) al = doubly truncated exponential distribution on intensity I with parameter b in 10 where t.I is the increment on intensity.

P(A>alI) = probability of peak acceleration A greater than a, given an intensity I. This is described by a lognormal distribution whose median is defined by equation 2.3 with a logarithmic standard deviation, of 0.28 (base 10).

The result of this computation, using I max of VI, is shown in Figure 2.1.2 with selected curves from the LGS hazard analysis. The historic seismicity curve compares to accelerations around 0.109 from the results obtained from the Decollement and Piedmont zones to the lower frequencies estimated by the Crustal Block zone. These observations suggest that the overall frequency of events producing accelerations of 0.10g is reasonably well described by the Decollement and Piedmont zones and the Crustal Block zone, M=6.0, to within a factor of 2. Since the assumed maximum intensity felt at the site is MMI VI, the historic frequency curve falls off sharply.

Equation 2.4 can also be used as a prediction tool by allowing the possibility of site intensities greater than VI to occur. To do this, an estimate of the maximum site intensity that can occur must be made. This is 1

2-21 the same step that was taken in the probabilistic seismic hazard analysis. A o maximum intensity of X_was assumed, which corresponds to a large-magnitude

(::M7.0) event occurring very near the site. The result of estimating f(I) in equation 2.4 and calculating v(A>a) for a maximum intensity of X, is also ,

shown in Figure 2.1.2. This assumption allows the possibility of high accelerations associated with large events to occur. In general, the site intensity curve tracks the trend of the Piedmont and Decollement seismicity curves quite well.

As a final estimate based on the historic distribution of ground motion at the LGS, a seismicity curve is estimated assuming a Richter b-value of 0.45 which corresponds to the 0.90 value used for earthquake magnitude in the LGS-SARA. Again, a maximum intensity MMI X is assumed. The hazard curve for this case is shown in Figure 2.2. The effect of assuming a b-value of 0.45 (equivalent to 0.90 for the magnitude scale) results in a factor of four increase in the hazard.

The results based on the historic-site intensity distribution agree reasonably well with the seismicity curves derived in the LGS-SARA. From the point of view of prediction, if a maximum site intensity of X is postulated, the Piedmont and Decollement zones agree most closely with the historically derived curve. The same could be said for the Northeast Tectonic zone, expect that the truncation on peak acceleration produces a sharp fall-off at 0.309 2.1.2.7 Summary The previous sections provide the,results of a preliminary review of the LGS-SARA seismic hazard analysis. The adequacy and appropriateness of the analysis approach were considered. The appropriateness of individual technical aspects of the analysis were also reviewed.

l The methodology used to estimate the probability distribution on l frequency of exceedance is considered appropriate to estimate the seismic risk due to nuclear facilities. The method used in the LGS-SARA is a well established straightforward approach to estimate the ground shaking hazard.

l

2-22 With regard to the adequacy of the way the methoa was applied, it is felt that in principle the estimation of the probability distribution on frequency is not well defined by the coarse sampling of parameter hypotheses used in the LGS-SARA. The approach used in the LGS-SARA was to select six hypotheses, each with an assigned ~ probability weight. It was then assumed that the six hazard curves generated, fully define the probability distribution on frequency.

Although a best estimate can be obtained in such a manner, this approach does not insure that the probability distribution on frequency will be adequately represented.

With regard to seismogenic zones, two major concerns were raised. First, delineation of the boundaries of the Crustal Block hypothesis was questioned.

In particular, Zone 8 in this model was considered inappropriately defined to be approximately 30 miles from the LGS at its closest point. The impact of redefining Zone 8 on the mean frequency of core melt was considered to be small. Secondly, the Decollement source was used as an all-inclusive model to consider the general hypothesis that large-magnitude events can occur in the east. This approach was not considered to be the most reasonable means of evaluating the hazard due to such hypotheses. An alternative was recommended that allows the possible occurrence of large-magnitude events to occur on the other source zones as well. The impact of this alternative on the trean core melt frequency was considered to be small.

With regard to seismicity parameters, two issues were raised. The first deals with the assignment of Richter b-values. The LGS-SARA uses a single b-value for all source zones. The basis for this was expert opinion. No uncertainty in b-values was considered. This approach was not considered appropriate, rather, a distribution on b-values should be used ince there exists a source of bias in the best estimate of the b-value for'each source zone, as well as statistical uncertainty. The impact of not considering the uncertainty in this parameter is considered to be small.

Particular concern was expressed with regard to the estimate of maximum magnitudes. For the Piedmont source, evidence was presented that questioned

2-23 the basis for establishing the distribution on maximum magnitude.

Specifically, the Cape Ann events should be included in the Piedmont province and considered in the estimate of Mmax. The overall impact on the mean core melt frequency is considered to be small.

The possible occurrence of large-magnitude events (~M7.0) was considered i

in the Decollement source hypothesis. The 1886 Charleston, South Carolina event was estimated to have a magnitude of M6.8 in the LGS-SARA and was used as the basis to estimate the largest event that could occur. No uncertainty in this estimate was considered, neither was there any physical basis for this hypothesis.

In a preliminary assessment of the hazard analysis results, the frequency distribution of ground motion due to historic earthquakes was computed.

Generally, the results from the analysis of the historical data suggest that LGS-SARA study results are reasonable. Hazard curves that include the possibility of an MM intensity X event are consistent with the hazard curves estimated for the Piedmont, Decollement, and Northeast Tectonic zones at low accelerations.

The recommendations given in Section 4.1.2 are directed towards resolving the issues summarized above. Although the effect of the individual issues on the mean frequency of core melt is judged to be small, their total effect could be moderate.

2.1.3 Seismic Fragility The preliminary review of the seismic fragility parameter values focused on Appendix B of the LGS-SARA and included a review of those portions of

-Chapter 3 and Appendix C pertinent to the seismic risk analysis. As described in Section 2.1.1, the results of the meeting with SMA and the. plant tour helped direct the review effort to the critical components and issues. In addition, the calculations for the significant contributors in Table 3-1 of the LGS-SARA were obtained and studied. The fragilities for other components were

l l

2-24 considered in relationship to their potential impact on the mean frequency of core melt. For example, the median capacity of the batteries and racks is reported to be 2.56g and, thus, was not included in the sequences. This component was inspected during the plant tour, and its capacity value is judged to be reasonable.

The comments concerning the seismic fragility analysis are organized in a manner to highlight the concerns, which were either most potentially critical or which were the most controversial during the review. Sections 2.1.3.1 through 2.1.3.6 discuss this category of concerns. Section 2.1.3.7 presents the results of the review of the calculations for the significant components.

Many of the concerns found during the review of the calculations are also discussed in detail in Sections 2.1.3.1 through 2.1.3.6. Section 2.1.3.8 addresses general fragility-related issues which should not be overlooked, but which are philosophical in nature (i.e. , do not have an immediate resolution) or which are unlikely to have a major impact on the results. Finally, Section 2.1.3.9 gives final closing comments on the preliminary review of the seismic fragility analysis in the LGS-SARA.

Throughout the discussion recommendations are made for additional information. Section 4.1.3 summarizes the recommendations for additional actions required to resolve the fragility-related issues which have been raised but not answered or completely resolved.

2.1.3.1 Damage Factor Three adjustment factors are used in the LGS-SARA to estimate capacity to resist earthquakes. The hazard analysis documented in Appendix A of the LGS-SARA presents the frequency of exceedance for seismic huard in tenns of a sustained-based peak acceleration parameter. As explained in Section 3.3.1 of the LGS-SARA, the accelerations from the Appendix A hazard curves were scaled by a factor of 0.81 (i.e.,1/1.23) to convert the sustained-based peak accelerations to effective peak accelerstions to reflect the less damaging 1 characteristics of low magnitude earthquakes. This adjustment is identical to the adjustments made in the IPPSS and the ZPSS. As explained in Reference 18 (Reference 18 was provided to the reviewers by PECo to support the LGS-SARA),

this factor was conservatively selected to account for smaller nonlinear i

2-25 response and, hence, damage caused by lower magnitude events. It is implied in Reference 18 that the adjustment factor should be 0.5 for magnitudes less than M5 and distances less than 20 km. For magnitudes greater than M7 and distances greater than 40 km, the adjustment factor is unity.

A second factor was introduced in the LGS-SARA'which is discussed in Section 4.1.3 of Appendix B of that report. This factor is called an

~

earthquake duration factor, which is used to increase the median capacity of structures by a factor of 1.4. The justification for this factor as discussed in Section 4.1.3 is very similar to the justification for the hazard reduction factor (i.e.,1/1.23) described above; thus, it is concluded that these factors account for the same phenomena and only one factor should be used. Note that the duration factor of 1.4 was not included in the IPPSS and the ZPSS.

This apparent discrepancy was discussed at the meeting held at SoA, and it was explained by SMA that for future PRAs only the 1.4 factor will be used and no adjustment will be made to the seismic hazard curves. In defense of the LGS-SARA analysis, SMA explained that very low ductility values had been used in the development of the ductility factors for Limerick (i.e., 2.0 for shear and 2.5 for flexural failure of concrete walls). The ductility factor is the third adjustment factor used in the LGS-SARA. More realistic values of 3 to 4 for the ductility ratio should have been. used. The use of low ductility values compensated for the extra 1/1.23 factor used to adjust the hazard curves for structures. The 1.4 factor was not used for equipment which generally had realistic ductility values. In conclusion, if only the 1.4 duration factor and realistic concrete ductility values had been used for the structures, the results would have been essentially the same. The reviewers concur with this explanation.

The justification for the duration factor of 1.4 was also reviewed. The underlying basis for the duration factor is recent work reported in Reference

19. As documented in this report, a series of analyses were conducted to investigate the response of single-degree-of-freedom (S00F) nonlinear oscillators to real earthquake motions. Earthquakes which varied in magnitude from M4.3 to M7.7 were used. It was explained at the meeting at SMA that a duration factor is required to correct the capacity of SD0F systems when subjected to earthquakes less than M6 to obtain the same level of damage.

2-26 The ductility factor based on the approach developed by Riddell and New-mark,(20) which was used in the LGS-SARA, assumes earthquakes larger than M6.

Since this method is used to develop the ductility factors for structures, a duration factor was applied for events with magnitudes less than M6. An an-alysis was conducted by SMA using the data from Reference 19, where the re-sponse of the nonlinear SDOF oscillators to earthquakes less than M6 to events greater than or equal to M6, were compared. By fitting a lognormal dis-tribution to the ratios of the response factors for these two groups of events, the median adjustment factor of 1.4 was determined. In the LGS-SARA this factor was applied for all hazard curves, which implicitly assumes all earth-quakes have magnitude less than M6.

11 an effort to verify the earthquake duration factor used in the LGS-SARA fragi'ity analysis, the data contained in Reference 19 was reviewed. As de-scribed above, arguments which support the use of an earthquake duration factor are based on the assumption that seismic events of magnitude smaller than M6 contribute less to the likelihood of failure than predicted by the Rid-dell /Newmark model. It was on this basis that the median value of 1.4 was de-rived for use in the LGS-SARA. As a check, the data as reported in Table 4-1(a) for p=4.27 in Reference 19 were considered in two groups: M<6 and M>6. The artificial time history was included in the M 6 group. From the histogram for each group the median response factor and logarithmic standard deviation were derived. Then, the ratio of the response factors was determined and compared to the LGS-SARA values. A summary of the estimates made are given below.

Response Factor Data Group F S M<6 2.65 0.25 M)6 2.15 0.26 FED " FM<6 /f M)6 1.23 0.36 LGS-SARA 1.40 0.20 Sc 0.12 B r 0.08 s u

2-27 From this comparison, it appears that the median factor used in the LGS-SARA is over estimated by 14 percent (i.e., 1.23 compared to 1.40). It should be noted that including the artificially generated time history in the M)6 group has a negligible effect on the median.

A second look at the scale factor data was taken by dividing the data in short and long duration (TD) groups. The data were divided according to whether durations were less or greater than 2.5 seconds, as defined in Reference 19.

In this case the artificial time history is in the T >2.5 D second group.

Basically all the records in the M 6 group were in the T >2.5 D second data set with one exception. The UCSB Goleta recording of the M5.1 (Ms 5.6) 1978 Santa Barbara earthquake had a duration of 3.0 seconds, and thus was included in the long duration subgroup. The results for these data sets is given below.

Response Factor Data Group F 8 TD 12.5 sec. 2.85 0.51 TD >2.5 sec. 2.05 0.26 FED = FT0h.5/fTD>2.5 1.39 0.57 LGS-SARA 1.40 0.20 s c 0.12 Br 0.08 s u From this comparison, it would seem that in deriving the duration factor, that a duratior, rather than a magnitude criteria was used. This is

inconsistent with the application in the LGS-SARA. Possibly of greater significance is the fact that a single earthquake record produced a variation in the estimated median duration factor from 1.4 to 1.23. This would seem to point out, that although Reference 19 provides a clear indication of the l duration effect of strong motion on structural damage, results reported are

.v _ . . ,_,...,.,m. ,. , ,, .

2-28

-limited in their application because of the relatively small data base. As discussed at the meeting with SMA, the use of the M6 cutoff to establish the duration factor is a gross characterization of a process that is continuous over magnitude and/or duration. Thus, a median duration factor should preferably be a function of magnitude. Data to establish such a function are not available. Furthermore, Reference 17 also suggests that the duration factor has a frequency dependence. This was not taken into account in the LGS-SARA.

The estimate of the logarithmic standard deviation of the duration factor in the LGS-SARA appears low. In particular, due to the uncertainty in estimating FED and the limited data base, su =0.08 is low, and in any case should not be lower then the randomness component. Direct estimates of the variability in FED ranged from 0.36 to 0.57. Values of S c of this size are considered more appropriate.

In principle, incorporating the effects of duration in the estimate of seismic capacities is appropriate. And although the results reported in Reference 19 are consistent with engineering judgment and observed earthquake damage, the approach used in the LGS-SARA is a simplification of a complicated issue.

The arguments leading te the 1.4 duration factor, when included with the ductility adjustment factor based on Reference 20, are generally reasonable for earthquakes with magnitudes less than M6; however, as discussed above, the 1.4 factor may be slightly high and the uncertainty estimate low. For events greater than M7 it was agreed by SMA that the duration factor should be unity.

Between magnitude M6 and M7 events the data in Reference 19 do not support a duration factor of 1.4 in the opinion of the reviewers. If the duration factor of 1.4 is changed to 1.0 for structures and equivalently the hazard curve adjustment of 1/1.23 for equipment is also changed to 1.0, for the region of peak-sustained accelerations corresponding to average magnitudes greater than l M6.0, the frequency of core melt distribution will be affected. Note that the i ductility values used for equipment are generally realistic, hence the 1/1.23 hazard curve factor is analagous to the 1.4 duration factor used for l structures.

I l

2-29 Based on Reference 21, the hazard curve for the Decollement seismogenic zone is the only curve which has average magnitudes equal to or greater than M6.0. For sustained-based peak accelerations equal to or greater than 0.40g, the average magnitudes equal or exceed M6.0. It is estimated that if the duration factor is changed to unity for this region of the Decollement hazard curve the mean frequency of core melt will increase by a factor of approximately 1.4. The effect of this adjustment will not significantly affect the median core melt frequency.

2.1.3.2 Upper Bound Accelerations All the hazard curves, except the Decollement case, are truncated to reflect the belief that maximum accelerations are associated with each seismic hazard hypothesis. The argument leading to the limiting acceleration values is documented in Reference 18, which was provided to the reviewers by PECo to support the LGS-SARA. This is the same argument which is given in the IPPSS and ZPSS . reports (1,2) for limiting accelerations. The explanation for limiting upper-bound accelerations consists of two steps. The first step is the assumption that there is a maximum intensity associated with each source zone corresponding to the maximum magnitude for that zone. This is assumed to be true by seismologist. The second step related the predicted accelerations for masonry structures with the qualitative descriptions of the MMI scale.

The basis for the argument leading to maximum acceleration values in the second step is as follows. Masonry structures are selected since they are the only engineered components for which damage is systematically described in the

~

MMI scale. If the accelerations are higher than predicted, then a higher MMI value (corresponding to more damage) would occur. However, since the-maximum MMI values are limited by the seismologist, a higher acceleration is not possible. Ths problem with limiting accelerations for the Decollement hazard curve is the assigned maximum magnitude value of M6.8 which corresponds to a maximum intensity of approximately MMI X. This intensity is associated with failure of most masonry structures; thus, the argument cannot be used since all

2-30 higher MMI values also include failure of most (if not all) masonry structures.

As explained at the meeting at SMA, it was conservatively decided not to truncate the Decollement hazard curve.

It also follows directly that if upper bounds on intensity exist then upper bounds on damage exist since intensity is a scale which measures damage.

Although it is believed by the reviewers that.it is more appropriate not to truncate the hazard curves but to reflect a limit on damageability in the fragility curves, the effect of modifying the hazard curves produces the same result. Thus if upper bounds exist for lower intensity values, similar limits should apply for higher intensity values for engineered concrete structures.

i However, it is difficult to quantify this belief at this time. In conclusion, the assumption not to truncate the Decollement hazard curve is on the conservative side.

Based on the approximate analysis described in Section 2.1.1, the effects of truncating the Decollement hazard curve were investigated. It was.found that when truncating the curve at 1.0g (which represents a reasonable lower bound) the mean frequency of core melt will' change by a factor of approximately 0.85. The effect on the median frequency of core melt is expected to be very small. Thus, it is concluded that truncating or not truncating the Decollement hazard curve has a small effect on the results of the LGS-SARA.

2.1.3.3 Reactor Enclosure and Control Structure The median capacity of the reactor enclosure and control structure is reported in the LGS-SARA to be 1.05g (see Table 3-1 in the LGS-SARA). The structural calculations for this component were reviewed. The reviewers believe that the capacity of the walls is rationally represented by 0.90g, which is based on the total capacity of the walls in the north-south direction i between elevation 177 feet and 217 feet. This capacity is based on the capability of the floor diaphragm at elevation 217 feet to redistribute forces.

At the meeting with SMA, it was stated that the diaphragm capacity for the Susquehanna plant was checked in detail and since the Limerick plant is

structurally the same, the diaphragm capacity is adequate to redistribute forces as the various wall sections yield.

l i

2-31 Based on a median capacity of 0.909, it is estimated that the mean frequency of core melt would increase by a factor of approximately 1.2.

2.1.3.4 Reactor Pressure Vessel Capacities Three of the significant earthquake-induced failure components If sted in Table 3-1 of the LGS-SARA are associated with the reactor pressure vessel (RPV) which is located in the containment structure. In the development of the median capacity values for the reactor internals, RPV, and the CRD guide tubes, it was assumed that the containment structure had an effective damping value of 10 percent. Since the original analysis of the combined containment /NSSS was based on 5 percent damping for the concrete structure, a 1.3 factor, which increased the capacity of the RPV components, was developed from the ground spectral accelerations by SMA.

, It is not obvious from the LGS-SARA or the calculations that the 1.3 factor is appropriate since the stresses in the containment structure may not be sufficiently high to warrant the assumed 10 percent damping value. The median capacities of the three RPV components range between 0.67 and 1.379, while the limiting median capacities of the supporting containment structure components are as follows:

Sacrificial shield wall 1.6g Containment wall (shear failure) 3.4g RPV pedestal (flexural failure) 2.8g The upper portion of the RPV is resisted by a ring at the top of the shield wall which, in turn, is anchored to the containment wall by steel lateral braces. The relative stiffness of the lateral supports versus.the stiffness of the sacrificial shield wall is not known. If a major portion of the resistance comes from the shield wall, then 10 percent damping is probably appropriate. On the other hand, if the input to the RPV is dominated by the support at the top of the shield wall,10 percent damping may be too large.

r 2-32 If the 1.3 damping response factor is changed to unity, which is the most conservative assumption for this factor, it is estimated that the mean frequency of core melt would increase by a factor of approximately 1.10, which is a small effect.

In the original analysis conducted for the design of the contain ment and RPV components, a coupled model was used with a single input time history. An additional uncertainty for variation in response due to time history analysis should be included for the RPV-related component capacities. Also, the model used to develop the capacity of the RPV lateral support is approximate and, hence, additional uncertainty is present. It is believed that due to the SRSS operation for combining uncertainties, the effect of these additional uncertainties would have a small effect on the mean frequency of core melt.

2.1.3.5 Potential Imoact Between Reactor Building and Containment The reactor bui Ming and containment are constructed on different foundations and are separated by a gap filled with crushable material. The gap reportedly varies between one inch at the foundation level to three inches at the top of the structures. It is stated in Appendix B of the LGS-SARA that at 0.19, the containment begins to uplift, and at 0.45g the two structures begin to impact at elevation 289 feet (it is believed that elevation 283 feet is the correctlevel). It is also stated that since the reactor building shear walls are expected to fail between 0.74g and 1.0g no signficant additional damage due to impact is expected to occur.

This assumption was questioned during the review. Three possible effects were considered. First, the impact between the structures might causa high frequency motions which could affect electrical and control equipment. Based on inspection of the plant, the gap between the reactor building and the containment appears to be irregular; thus, the transfer of energy during impact would occur over some finite period of time which would sof ten the impact. The suddenness of impact would also be cushioned by local crushing of the concrete.

Because of the large size of the walls and floor slabs, gross structural failure due to impact is rot expected. As a minimum, the chatter and trip of

2-33 relays would increase; however, NUS states that this is not a problem whether caused by either impact or just due to dynamic motions.

It is not clear whether the chance of failure of the electrical equipment located in the reactor building will be increased by impact between the two structures. The capacity of the electrical components located in the reactor building (some of which are located at elevation 283 feet within 30 feet of the seismic joint) range between 1.46g and 1.56g. This is considerably higher than the motion level at which impact may occur; hence, these capacities may, in reality, be less.

The second potential problem is spalling of concrete which could fall and impact safety-related equipment. It was learned during the tour of the plant that all electrical and control equipment are located away from the seismic joint. Thus, these types of components will not be affected. Various safety-related pipe lines cross between the two buildings. It is expected that the size of any spalled concrete pieces will be small since the reinforcing steel will tend to hold any fractured concrete pieces in place. In addition, the slope of the contain ment wall will break the fall of spalled concrete pieces. The risk of a major rupture of a pipe or valve due to impact from spalled concrete is believed to be relatively small; however, small lines may be damaged by falling concrete pieces.

The final concern is the relative displacements caused by the movement of the two buildings and their effects on safety-related piping. It was stated at the meeting with SMA that all piping which contains hot water has sufficient flexibility to accommodate temperature changes to resist the potential relative displacements between the two structures due to earthquakes. Subsequent to the meeting at SMA, the question arose concerning whether piping with lower temperature require ments could resist the potential relative displacements.

During the tour of the Limerick plant, an 18-inch diameter line was identified and inspected. The line number was obtained (GBB119) and the locations of lateral supports were found on the isometric plans in the plant engineering office. It was confirmed that this line belongs to the RHR system and is a low tenperature line. The first critical support was located approximately 10 feet

-- ~ - - . - -- _

-__y

1 2-34 l

horizontally and 12 feet vertically from the containment wall in the reactor building. The flexibility of this pipe was checked approximately and it appears to. have sufficient flexibility to resist two-to-three inches of relative movement'. A stress of approximately 10,000 psi would be caused by a three-inch relative displacement which, when added to other stresses, probably would not significantly affect the core melt frequency distribution.

Several:small lines (probably control-related).were attached to a valve close to the containment wall. These lines were also attached to the reactor

. building close to the valve. It is possible that these lines might fail during large relative motions; however, it was stated by NOS that small leakage in small lines is acceptable. This should be systematically confirmed for all small lines.

The concerns raised regarding impact between the containment and reactor

' building have not been entirely resolved. The effect of impact on the capacity of electrical and control equipment should be addressed by PECo. In addition, all the safety-related piping which connects both buildings should be systematically reviewed to verify that sufficient flexibility is provided to accommodate relative displacement between the two structures.

2.1.3.6 Electrical and Control Equipment The mean frequencv of core melt reported in the LGS-SARA is 5.7x10-6 per year. About 60 percent of this value is contributed by sequence T E ssVX, which includes the following five electrical or coritcor components which are in series:

o

. 440-V bus /SG breakers

. 440-V bus transformer breaker

. 125/250-V de bus.

. 4-KV bus /SG

. Diesel-generator circuit breakers

\

C

2-35 These components have median effective peak acceleration capacities which reportedly range from 1.46g to 1.56g (see LGS-SARA Table 3-1), and which contribute most of the mean frequency of core melt value of 3.15x10-6 reported in the LGS-SARA for sequence T ss E VX. A concern raised in the review is the actual number of units which exist for each one of these five components. For an increase of one additional independent unit (e.g., if there are tuo independent switchgear breakers instead of only one), the mean frequency of core melt will increase by approximately 0.4x10-6 per year.

Several issues should be considered in determining whether additional units should be added in series. First, the fragility values for these components are based primarily on generic data obtained from equipment tests for the Susquehanna nuclear power plant. It is not apparent from the documentation in Appendix B nor the. LGS-SARA whether the test specimens used in the Susquehanna tests were for single or multiple units (i.e, was one switch gear breaker tested at a time, or were multiple units tested simultaneously?).

Also, how similar are the components in the two plants?

The second consideration is the question of independence between components. It can be argued that identical units have high capacity deoendence (i.e., if two units of the same component are subjected to the same dynamic motion either they both will survive or they both will fail). If two components are located next to each other and receive the same dynamic input, they also may have high response dependence. This is true even though they may be different types of components.

If multiple units of a particular component exist in series (e.g., 440-V bus /SG breakers) but they are identical units located next to each other, they may be in a practical sense perfectly dependent, and the frequency of failure would be equal to the frequency of failure of one unit. On the other hand, if the units are constructed differently and/or placed at different locations, they may approach being independent which in the extreme case implies that the frequency of failure is approximately equal to the sum of the individual failure frequencies.

i 2-36 In order to evaluate the impact of this concern PECo should determine the number, location, and characteristics of the electrical and control equipment which are part of sequence T ssE VX, and compare the components to the generic test specimens from the Susquehanna tests. As suggested in Section 2.1.3.7, component-specific calculations should be performed to develop the fragility values for these components since they are significant contributors to the frequency of core melt.

2.1.3.7 Review of Significant Components A copy of. the calculations performed by SMA for the signficant components listed in Table 3-1 of the LGS-SARA were obtained and reviewed. Although the capacities of other components were considered in the review, the effort focused on the significant components which affect the dominant sequences leading to core melt. As an aid in this phase of the review, equipment fragility values developed in the Seismic Safety Margins Research Program (SSMRP) were used as a guide.(22, 23) The following comments are given for the 17 significant components.

Offsite Power (500/230-KV Switchyard)1 (S ) - The fragility for offsite power is based on the failure of porcelain ceramic insulators. No specific calculations were given for this component. The capacity is based on historic data and is reasonable.

Condensate Storage Tank 2(S ) - This component is not a major contributor to the mean frequency of core melt. The capacity of the tank is based on the weakest failure mode which is shell buckling. A small ductility value of 1.3 was assumed. This is probably reasonable but may not be conservative since a buckle could cause a leak in the tank. This assumption is also inconsistent with the analysis performed for the SLC tank where buckling also controlled.

For this case, no ductility was assumed.

No adjustment for soil-structure interaction was made which assumes that the tank is on rock. It was not apparent from the tour of the Limerick site

l l

2-37 that the tank base is founded on rock; however, based on the fundamental frequency of the tank given in the calculations, the effect of fill would increase the capacity. In summary, the fragility parameters for the condensate storage tank appear to be reasonable.

Reactor Internals (S3 ) - The capacity of this component is limited by the strength of the shroud support. The exact failure location was not given in the calculations. The capacity factor was derived based on the calculated stresses obtained from the original design analysis. As discussed in Section 2.1.3.4, only one time history was used in the analysis. Although a randomness logarithmic standard deviation of 0.05 was used, tnis value is low for the amount of variability which could occur, if multiple time history analyses had been used. The total effect of increasing the logarithmic standard deviation for time history variability is small.

As discussed in Section 2.1.3.4, the factor of 1.3 which increases the capacity of the reactor internals to reflect 10 percent damping expected for the containment (as opposed to 5 percent damping in the original design analysis) may be high. It is estimated that the maximum impact, if this factor were 1.0, would be an increase in the mean frequency of core melt by a factor of approximately 1.10.

Reactor Enclosure and Control Structure (S 4 ) - The capacity of this component is controllad by the failure of the lowest story shear walls and is based on adjusting the forces obtained from the original design analysis to median-centered values. As discussed in Section 2.1.3.3, the median capacity is better represented by 0.90g (as compared to 1.05g given in the LGS-SARA).

This change would increase the mean frequency of core melt by approximately 20 percent. ,

It was noted that the uncertainty value for modeling was only 0.10.

Because of the approximate nature of the analysis which was conducted, a value of at least 0.20 is more appropriate. In comparison, a modeling uncertainty

2-38 value of 0.17 was used for testing in developing the fragility for equipment, which gives an indication of a value for this factor that is more reasorable.

As discussed in Section 2.1.3.1, a ductility value of 2.5 assumed for the case of shear wall flexural failure is low. However, the effect of this value is balanced by the extra factor assumed for earthquake size effects used to adjust the hazard curves from sustained-based peak accelerationto an effective peak acceleration parameter.

CRD Guide Tube S(S ) - The capacity of a CRD guide tube is controlled by functional binding of the control rod due to bending. The fragility parameters are based on test results coupled with the response of the guide tube calculated during the plant design. The test capacity was increased about 20 percent based on judgment since failure was not observed in the tests. This is probably on the conservative side.

Since the CRD guide tubes are attached to the reactor pressure vessel (RPV) the comments above for the reactor internals, pertaining to use of a one-time analysis history and containment damping, also apply to the CRD guide tube analysis.

Reactor Pressure Vessel (S 6

) - The capacity of the RPV is due to the potential failure in the weld between the connections of the top supports for the RPV and the top of the shield wall. An approximate analysis was used to determine the median capacity factor, wherein the total capacity was assumed to be equal to the sum of the capacities from the support skirt and failure in the l weld at the top support. A 0.10 uncertainty value was included for modeling,

! which, in the opinion of the reviewers, is small. Similar to the comments made for the reactor enclosure and control structure above, a value of at least 0.20 is appropriate for this type of approximate analysis. The effect of this size l of increase in variability would have a small effect on the mean frequency of core melt.

l The comments given for the reactor internals, pertaining to one-time history and containment damping, also apply to the RPV capacity.

l

2-39 Hydraulic Control Unit (S 7) - The components of the hydraulic control unit consist of valves, tanks, piping, and electrical controls. The fragility parameters are based on tests and fragility calculations performed for the Susquehanna nuclear power plant. In essence, the median capacity from Susquehanna was scaled by the ratio of the two SSE peak ground acceleration values (i.e., 0.10/0.15). It is not apparent from the documentation in either the LGS-SARA nor the supporting calculations for this component whether the SSE scaling from Susquehanna is appropriate. The concerns include possible differences in the foundation condition and, hence, the response of the reactor enclosure, locations of the hydraulic control units in the two plants (i.e., is one unit higher, therefore it has a higher response?) and, finally, con struction and, hence, similarity of the two units. These issues should be addressed by PECo.

The uncertainty for the spectral shape factor for this component appears to be conservative. The logarithmic standard deviation values are based on the range of ratios between the test response spectrum (TRS) and the required response spectrum (RRS) at different frequencies. The total range of values for different frequencies and for the two horizontal directions were used to calculate the uncertainty value. If the components have similar dynamic characteristics and capacities in the two horizontal directions, the range should be based on the minimum of the largest ratio in the two horizontal directions and the maximum of the largest ratio. If this approach is used, the uncertainty value is approximately one-third (i.e., 0.09 compared to 0.29).

Even if the revised value is doubled for modeling uncertainty, the value used in the LGS-SARA will still be conservative.

The median capacity value also appears to be conservative, but was developed using considerable judgment. The minimum ratio of the TRS and RRS values at the frequencies considered in the analysis was used. This value was assumed to represent the 95 percent level of survival (i.e., 5 percent would fail above this level) along with a 0.40 logarithmic standard deviation value.

These two assumptions lead to doubling the minimum ratio to produce the median

2-40 value. The final median value is essentially equal to the average of all ratios of the TRS to RRS values. Since there was no failure, the median value is on the conservative side.

It should be noted that the total uncertainty logarithmic standard deviation value for the hydraulic control unit is 0.52 which is the highest value for any of the significant components. Although the uncertainty value for the spectral shape factor may be high, the total uncertai.nty appears to be reasonable considering other uncertainties due to modeling which have not been included.

SLC Test Tank (S 8 ) - The capacity for the SLC test tank is based on generic calculations for rigid equipment. This tank is supported on four columns and is not rigid. Based on inspection of this component during the plant tour, it appears to be very strong; however, the analysis performed for this tank is not applicable to the actual component.

The capacity of the anchor bolts which attach the base of the four columns to the concrete floor should be analyzed. The response factor should be recalculated taking into account the flexbility of the tank and the actual charactertistic of the four columns. Because analyses assumed the tank to be rigid, the capacity may be overly conservative for this effect.

If the tension force in the columns'or anchor bolts control the capacity, the earthquake component factor may be as low as 0.71 (as compared to 1.04 which was assumed in the generic component analysis). Since the capacity may be controlled by a ductile element, a ductility value greater than 1.0 may be appropriate. In summary, a component-specific analysis should be conducted for the SLC test tank.

Nitrogen Accumulator (Sg) - The nitrogen accumulator is described in the calculations as an 18-inch diameter by 48-inch high tank which is anchored to 1

the floor with six bolts. After visiting the Limerick plant, the reviewers are 1

uncertain if the nitrogen accumulator which they saw fits this description. I Since the capacity of this component is based on extrapolating an analysis from ,

l l

2-41 Susquehanna to the Limerick site, the similarity between the nitrogen accumulators at the two plants should be verified.

SLC Tank (S10) - The capacity for this tank is based on the buckling of the shell, which was the weakest mode of the various modes of failure which were checked. One other possible failure mode is tearing of the base plate flange through which the anchor bolts penetrate. This failure mode apparently was not checked. There are no stiffening elements in the vicinity of the anchor bolts, which may mean that tearing of the base plate flange is the weakest capacity. The possibility that this potential failure mode was overlooked in the original design calculations should be checked.

The uncertainty value for modeling error was assumed to be 0.10 which is small. A value equal to 0.20 would be more appropriate; however, this change would have a small effect on the frequency of core melt.

440-V Bus /SG Breakers (Sti) - The capacity of this component was developed in a similar manner to the capacity for the hydraulic control unit, which also was based on test data from the Susquehanna nuclear power plant.

The calculations, which were based on the ratios of the TRS to the RRS at different frequency values, are not clearly stated. The minimum ratio was assumed to represent the 95 percent level of survival along with a 0.40 logarithmic standard deviation value. These two assumptions led to doubling the minimum ratio. The final value:is close to the average ratio (however, calculations of the average ratio are not apparent). It is interesting to note that the uncertainty value for the_ spectral shape factor is only 0.08 which is much less than the value of 0.29 obtained for the hydraulic control unit _ (see comments above for the hydraulic control unit).

In summary, the fragility parameter values for this component appear reasonable, but it was not possible to check all the calculations. Since this component is a significant contributor to the mean frequency of core melt, a specific analysis should be conducted for this component.

i

-4 ~ .

2-42 440-V Bus Transformer Breaker (S12), 125/250-V DC Bus (S13)>4-KV Bus /SG (S14) - The capacities for these three components are the same and are based on the fragility analysis of the diesel generator circuit breakers. The only difference between the capacities of these three components and the diesel generator circuit breaker capacity is that the former components are in the reactor enclosure, while the later component is in the diesel generator building. Comments concerning these three components are the same as given below for the diesel generator circuit breakers.

Because these three components contribute signficiantly to the mean frequency of core melt, a specific component analysis should be conducted for each.

Diesel Generator Circuit Breakers (S15) -The capacity of the diesel generator circuit breakers is based on an analysis of test data for the Susquehanna plant. The approach used to develop the capacity factor is identical to the approach used for the hydraulic control unit (see comments above). The same issues for that component also apply to the diesel generator circuit breakers (and also the three components above, i.e., S12 > 313, and S14).

Since this component is a significant contributor to the mean frequency of core melt, a specific analysis should be conducted for this component.

Diesel Generator Heat and Vent (S16) - The capacity of the diesel generator heat and vent is supposedly based on the fragility of the exhaust fan supports which are assumed to be the critical link. However, the actual fragility parameters are based on generic passive flexible equipment. The calculations for this class of equipment were specifically formulated for tanks and heat exchangers. It is stated in the calculations that shock test data indicate the capacity is 9.5g for the handling units; thus, the values used are conservative. However, since this component is a cignificant contributor to the mean frequency of core melt, a specific analysis should be conducted.

l L

2-43 RHR Heat Exchangers (S17) - The capacity of the RHR heat exchanger was obtained by scaling the capacity factor for the same component at the Susquehanna nuclear power plant. It is assumed in the calculations that the response factors for Susquehanna and Limerick are the same. The controlling element is the lower support bolts.

The earthquake combination factor is 0.93, appears to be high since the columns supporting the RHR heat exchanger are located at the four corners of a square pattern. Since tension in the bolts is significant, the factor will be somewhere between 0.71 and 0.93.

This component does not appear to be a significant contributor to the mean f requency of core melt ; hence, small changes in the values of the capacity factors for the RHR heat exchanger do not appear to be critical.

2.1.3.8 General Fragility-Related Comments The following comments are made in order to inform the reader of potential issues which because of their philosophical nature may not be resolved in the near future. Also, minor issues and' errors which were found during the review are documented for completeness. The reader is directed to Reference 3 which gives a more detailed discussion of some of these general issues.

As discussed in the previous sections, there are cases where the uncertainty values seem to be low. In particular, modeling errors appear many times to be smaller than what was expected. In Section 5.3.1.4 of the LGS-SARA, it is stated that the coefficient of variation for equipment response factors is about 0.15. Since this factor is very sensitive to the relationship between the equipment fundamental frequency and the frequency corresponding to the peak of the floor response spectrum, it is easy to visualize cases where a slight shift in frequency could mean a factor of 2 or 3 (or even more) in the value of the spectral ordinate. Thus the logarithmic standard deviation for response should be developed on a case-by-case basis.

2-44 ,

I In general, the uncertainty in some of the parameters has been understated. In particular, there is uncertainty in using a simplistic analysis to obtain the capacity of a component which was not recognized in the LGS-SARA. On the other hand, the median capacity values are probably on the low side. These two effects likely are self-compensating.

No uncertainty was assigned to the ground response spectrum factor used in the analysis. By definition this implies that this is the absolute best (within the context of the aralytical model) that can be achieved; hence, there is no motivation ever to conduct site-specific studies to improve the estimate of the frequency content of the seismic input. Although Limerick is a rock site, there is still uncertainty in the ground response spectrum which should be included in the analysis. It is believed that a reasonable value for uncertainty, if included, would have a small effect on the frequency of core melt.

The documentation of the basis for the fragility values does not carefully distinguish between the categories of information which were used. The use of subjective or data-based information (either analysis or testing) should be specifically noted to inform the reader. In addition, sensitivity analyses should be performed to indicate the robustness of the assumptions. This is particularly applicable to Chapter 3 where the fragility, hazard, and systems information is combined to produce the core melt frequency distribution.

The issue rf dependency and its affect on the core melt frequency distribution was considered in the review of the LGS-SARA. Except for sequence Tss E VX, it appears that any additional capacity or response-related dependency effects would not have a significant impact on the mean frequency of core melt. For the case of T s3 E UX, Section 2.1.3.6 discusses the implications if additional components were added to the series expression. For the-current Boolean expression for the Tss E 0X sequence, if any additional dependency exists, the frequency of core melt would decrease. As discussed in

2-45 Reference 3, there are potential dependency effects which could effect the fragility values for cable trays and piping systems, although it is likely that the current capacity values account for these effects.(3)

Another important issue is the use of ductility factors for one degree of freedom (SD0F) models to represent multidegree of freedom (M00F) structures or equipment.(3) Research is required to resolve this issue. At the present, not enough uncertainty is generally assigned for this situation.

As discussed Section 2.1.1, design and construction discrepancies are not systematically recognized and quantified in the LGS-SARA. This is a particularly important consideration for components in series which could lead to a major failure if only one of the components fails. At best, the results of a seismic PRA can only be used to make relative comparisons.

One. concern which was raised is potential leakage through internal components caused by seismic motion, thus bypassing a closed valve barrier.

This probably is not a major problem but should be formally verified by PECo.

The MSIV and purge and vent valves are important examples. Also, the type of SRV used at Limerick has a history of sticking randomly in the opened position (i.e., failing to close after the signal is received). The possibility that seismic motions could increase the likelihood of this type of failure should be addressed.

The potential for seconda creponents failing, falling, and impacting primary safety-related components apparently has not been systematically addressed since the plant is still under construction. The potential effects of block walls failing has been considered, Other components could also be a potential hazard. At the completion of construction, secondary components should be reviewed and their capacities incorporated into the LGS-SARA if they are weaker than the primary components already considered.

On page 5-15 of Appendix B of the LGS-SARA, the value 648 K in. should be 648,000 K-in. This is believed to be a typographical error.

2-46 On page 5-60, the damping factor for valves appears to have been included twice (once for the piping and once for the valves). It was explained by SMA that only one factor was used for both piping and for valves and is based on adjusting the damping used in the original design analysis (i.e, 0.5 percent) to a median-centered value (i.e. , 5 percent). (24)

Toward the completion of the preliminary review, Section 10.1.6.5 was brought to the attention of JBA (other parts of Chapter 10 were not reviewed by JBA). In this section, the effect of earthquakes on the effectiveness of evacuation was quantified for the various accident classes. The argument for limiting upper-bound accelerations on the hazard curves given in Reference 18 was incorrectly used to establish that below 0.61g effective peak acceleration evacuation will not be impeded. This value was then used to develop the percent of occurrence when evacuation would be affected by earthquake.

Although the arguments in Reference 18 are appropriate for establishing upper-bound acceleration limits for the hazard curves, the rationale was incorrectly reversed. The result cf this error means that the percentages of affected evacuations are much higher than given in Table 10-7. PECo should reexamine the percentages and establish more realistic values and incorporate them in the offsite consequence analysis.

Because of the concern for potential failure of the control room ceiling at the Indian Point Nuclear Power Plant (Ref.3), the control room ceiling at Limerick was inspected during the plant tour. The ceiling at Limerick was found to consist of a light weight " egg-crate" structure which is supported by wires and braced between walls. There is no transite reflector panels located above the ceiling as found at the Indian Point Power Plant. Therefore, it is concluded that the ceiling at Limerick does not pose an undue hazard during a seismic event.

2.1.3.9 Closure The LGS-SARA differs from the IPPSS and ZPSS in that the mean frequency of core melt is dominated primarily by five electrical components in series, which have nearly the same median capacities. In contrast, nonelectrical components and structures controlled the results of the IPPSS and ZPSS.

2-47 The capacities for the LGS-SARA electrical components are based on generic tests and are not component specific. This approach is reasonable as long as the components do not control the final results. Based on the response given by PECo at the September 26, 1983, meeting, it appears that scaling the capacity values by the ratio of the SSE accelerations for the Susquehanna and Limerick (i.e., 0.10/0.15) may be overly conservative by a factor of 2 for the electrical components. Since the electrical components are significant con-tributors, a more detailed analysis should be conducted. The recommendations given in Section 4.1.3 are directed to this goal.

2.1.4 References to Section 2.1

1. Pickard, Lowe, and Garrick, " Indian Point Probabilistic Safety Study,"

Prepared for Consolidated Edison Company of New York, Inc., and Power Authority of the State of New York, Copyright 1982.

2. Pickard, Lowe, and Garrick, " Zion Probabilistic Safety Study," Prepared for Consolidated Edison, Co.. not dated.

3. Kolb, G. J., et al., " Review and Evaluation of the Indian Point Probabilistic Safety Study," Prepared for U. S. Nuclear Regulatory Com-mission, NUREG/CR-2934, December, 1982.

4. American Nuclear Society and the Institute of Electrical and Electronics Engineers, "PRA Procedures Guide," Vol. I dnd 2, U.S. Nuclear Regulatory Commission, NUREG/CR-2300, 1983.

5. Cornell, C. A., "Probabilistic Seismic Hazard Analysis: A 1980 As-sessment," Proceedings of the Joint U.S.-Yugoslavia Conference on Earth-quake Engineering, Skopje, Yugoslavia,1980.

6. Philadelphia Electric Company, Limerick Generating Station Final Safety Analysis Report, 1983.

7. Cook, F. A. , D. Albaugh, L. Brown, S. Kaufman, J. Oliver, and R. datcher,

" Thin-Skinned Tectonics in the Crystalline Southern Appalachians: C0 CORP Seismic Reflection Profiling of the Blue Ridge and Piedmont," Geology, Vol . 7, pp. 563-567,1979.

2-48 1

8. Seeber, L. , and J.G. Armbruster, "The 1886 Charleston, South Carolina Earthquake and the Appalachian Detachment," Journ. Geophys. Res. , Vol. 86, No. B9, pp. 7874-7894, 1981.

9. Tera Corporation, " Seismic Hazard Analysis," Prepared for U.S. Nuclear Re-gulatory Commission, NUREG/CR-1582, Vols. 2-5,1980.

10. Diment, W. G. , T. C. Urban, and F. A. Revetta, "Some Geophysical Anomalies in the Eastern United States," in The Nature of the Solid Earth, Ed., E.

C. Robertson, pp. 544-572, 1972.

11. Sbar, M. L., and L. R. Sykes, " Contemporary Compressive Stress and Seismicity in Eastern North America: An Example of Intraplate Tectonics,"

Geol . Soc. Am. Bull . , Vol . 84, pp.1861-1882,1973.

12. Fletcher, J. B. , M. L. Sbar, and L. R. Sykes, " Seismic Trends and Travel-Time Residuals in Eastern North America and Their Tectonic Implications,"

Geol . Soc. Am. Bull . , Vol . 89, pp. 1656-1976,1978

13. Yang, J. P. and Y. P. Aggarwal, "Seismotectonics of the Northeastern Uni-ted States and Adjacent Canada," Journ. Geophys. Res. , Vol. 86, No. B6, pp. 4981-4988, 1981.

14. Street, R. L. , A. Lacroix, "An Empirical Study of New England Seismicity:

1727-1977," Bull . Seis. Soc. Am. , Vol . 69, pp.159-175,1979.

15. Nuttli, 0. W. , "The Relation of Sustained Maximum Ground Acceleration and Velocity to Earthquake Intensity and Magnitude," Report 16, Misc. Paper S-7-1, U.S. Army Engineer Waterways Experiment Station, Vicksburg, Miss.,

1979.

16. Cornell, C. A. and H. Merz, " Seismic Risk Analysis of Boston," Journal of the Structural Division, American Society of Civil Engineers, ST10,1975.

17. Trifunac, M. D. and A. G. Brady, "On the Correlation of Seismic Intensity Scales with the Peaks of Recorded Strong Ground Motion," Bull. Seis. Soc. l Am., Vol. 65, pp. 139-162, 1975.

2-49

18. Kennedy, R. P., " Comments on Effective Ground Acceleration Estimates," SMA Report 12901.04R, February,1981.

19. R. P. Kennedy, et al. , " Engineering Characterization of Ground Motion Ef-fects of Charateristics of Free-Field Motion on Structural Response," SMA 12702.01, prepared for Woodward-Clyde Consultants,1983.

20. Riddell, R. , and N. M. Newmark, " Statistical Analysis of the Response of Nonlinear Systems Subjected to Earthquakes," Department of Civil En-gineering, Report VILU 79-2016, Urbana, Illinois, August,1979.

21. McGuire, R. K. , " Transmittal to Mr. Howard Hansell of Philadelphia Elec-tric Company," July 12, 1983.

22. Kennedy, R. P. , et al . , " Subsystem Fragility," Lawrence Livermore National Laboratory Report prepared for the U. S. Nuclear Regulatory Commission, NUREG/CR-2405, October,1981.

23. Bohn, M. P., " Interim Recommendations for a Simplified Seismic Probabilistic Risk Assessment Based on the Results of the Seismic Safety Margins Research Program," Lawrence Livermore National Laboratory, Draft, April 15, 1983.

24. Letter from R. D. Campbell to J. W. Reed, dated July 11, 1983.

25. Letter from J. S. Kaufman to A. Schwencer,- dated August 24, 1983.

26. Letter from J. S. Kaufman to A. Schwencer, dated August 29, 1983.

l l

l l

f l-

1 l

1 2-50 l

l C=

t/:

e

~2 - gi u e z 4 %

g a W N 8 m onsv 1

rN aagt o

41!

,A A G 8 0000000.. A L

=

c-

~~ g y

' ?\ b.

~

s

% ~~~

n= ** J_

' 5 S

, & i .. * i K O , '

w *de g g o

(}

i t i i 5 n o*, T. o .

O j g I g o f" 0g T 2 c

i -

'h,____ i <

c.

.'o@O 1

4 p.4,N, 19

y. A g , _'O .

m E

kI o O p

. t W E

,Y v . Ig' . g M) O Z  %

. .h'2 94 *G*

O, g v*

l

• o N c c- - . . O. t ._ c 4G l.

-o j 81 -

3,e

.n - . O '

&l 2 u

e* . o 6, -

~~~~

. _- .-4 g

. ' ? _ _ _ _ ,,- - - -- 8 e o 7, .o .

• 0,  ;

y~

a 0 e i

o O 8 G C g r ,o J

@ t f o E

_____a4,._ 0 e - -- ----- ____i_

, e i ao e --- d[ p "

.. e m .

@ . h . $ -I "

8 ' I

% v 0, 'I .1 o e

. ], \ s t* . l i

o

', __- e s

- O-- ,

c O

i =k o g I ,v i I o

,=0 0 ,

0 t . e I

' *o o i 5

e i O 8 O

, _i_ i a

' , 7, _- ____u o f

i . o, ,

e ' o o t a l e i

= i L

U

. .e l

N GP b l 3 i

.[

u- l

2-51 10-?'

Historic Seis-icity Opvos

1. Imin = IV, b = X, b = 0.45 2- Imin = IV, b = X, b = 0.72

3. Imin = IV, b = VI, b = 0.72 10-3_

LGS-SMA Seis-icity Osves

\

4 Decollenef.

N

5. Crustal Block, M = 5.5 c, \

E

\ N

$ \ N 8 10 g N

\ 1

\ N o

\ N x \

E \ N c

\ s h N 4 i 10-5_ \

2 5 \

5 \

\

\

10-6_ \5 3

10-7 ' ' '

0 O.20 0,'40 O.60 0.80 Peak Ground Acceleration (g)

Figure 2.1.2 Comparison of various historical seismicity curves and the LGS-SARA seismicity curves from Appendix A for sustained-based peak acceleration for the Decollement and Crustal Block, M=5.5 seismogenic zones.

1 2-52 4

I Table 2.1.1 Comparison of Mean Frequency of Core Melt Values Contribution to Mean Frequency of Core Melt Sequence Approximate Analysis LGS-SARA Values Ts3 E UX 2.8-6* 3.1-6 TsRB- 9.5-7 9.6-7 TsRPV 4.4-7 8.0-7 TECCssm2 6.0-7 5.4-7 TsRBCm 3.5-7 1.4-7 TEW ss 1.1-7 1.1-7 Total 5.3-6 5.7-6

• 4.0-6=4.0x10 ,

2-53 t

Table 2.1.2 Hazard Curve Contribution to Mean Frequency of Core Melt Contribution to Hazard Curve Mean Frequency af Core Melt Percentage Decollement 2.1-6 39.9 Piedmont,Mmax=6.3 2.3-6 43.7 Pi.edmont,Nmax=5.8 5.4-7 10.3 Northeast Tectonic 2.4-7 4.6 Crustal Block, Mmax=6.0 6.2-8 1.2 Crustal Block, M max =5.5 1.5-8 0.3 Total 5.3-6 100.0

2 l

-Table 2.1.3 Hypothetical Mean Frequency of Core Melt (Based on Individual Hazard Curves)

Individual Mean Frequency Ratio to

. Hazard Curve of Core Melt 5.3-6 Value Decollement i 2.1-5 4.0 Piedmont, Mmax=6.3 1.5-5 2.9 Piedmont, Mmax=5.8 3.6-6 0.68 Northeast Tectonic 8.0-7 0.15 Crustal Block, Mmax=6.0 4.1-7 -0.08  :

Crustal Block, Mmax=5.5 1.0-7 0.02 i

i l

l

)

l l

I l

2-55 2.2 FIRE 2.2.1 Deterministic Fire Growth Modeling 2.2.1.1 Introduction _

A deterministic fire growth model is used in the Limerick SARA to provide fire growth times. These times then serve as input to the probabilistic mooel from which the likelihood of a particular fire growth stage is determined, given an initial size fire. The deterministic model contains the methodology which explicitly incorporates the physics of enclosure fire development.

The Limerick SARA uses the computer code COMPBRN(1,2) as its determinis-tic fire growth model. Briefly, this code is a synthesis of simplified, quasi-steady unit models resulting in what is commonly called a zone approach model. A detailed evaluation of this code and its application in the Limerick SARA appears later in this review. There are many other computer codes (3-7) which use the unit-model approach to model compartment fire development. Of particular interest is the DACFIR Code (8) developed at the University of Dayton Research Institute, which models the fire growth in an aircraft cabin as it progresses from seat to seat. This is analogous to the problem of fire spreading from cable tray to cable tray as analyzed in COMPBRN.

At this point some general thoughts are deemed warranted on the complexity of fire phenomena and the state of fire science with regard to enclosure fire development. Computer models of enclosure fire development appear capable of predicting quantities of practical importance to fire safety, provided the model is supplied with the fire-initiating item's empirical rate of fire growth and the effect of external radiation on this rate. As a science, how-ever, we cannot predict the initiating item's growth rate because basic combustion mechanisms are not well understood. There are even questions and

' doubts regarding the ability to predict the burning rate of a non-spreading, hazardous scale fire in terms of basic measurable fuel properties. However, until meaningful standard flammability tests and/or more sound scientific

2-56 predictions are developed, realistic " standardized" fire test procedures should continue to be formulated for enpirical measurements of the rate of growth of isolated initiating items, the attendant fire plume, its development within an~ enclosure, and the convective and radiative heat loads to " target" combustibles. Thus, in lieu of large-scale computer codes to assess the fire hazard in an enclosure, the unit-problem approach (as used in COMPBRN) is about the best that can be taken at the present time.

However, because fire modeling is still in a state of infancy, many judgmental assumptions must be made in both modeling and physical data in order to model fire development in the complex enclosures existing in nuclear power plants. Additional complexity is introduced when one considers electrical cable insulation as the fuel rather than the more commonly considered fuels such as wood or plastic slabs, which may have a more uniform

^

composition than cable insulation.

In fact, as discussed later, some of the models used in COMPBRN are non-physical . That is, although these models usually lead to highly conservative results, they do not adequately reflect the dependence on the physical parameters which are evidenced in experimental data. Other models, assumptions, and omissions in the application of COMPDRN to the Limerick SARA are either conservative or nonconservative.

This combination of nonphysical models and conservative as well as non-conservative assumptions leads to very large uncertainties in the determinis-tic modeling process. It is therefore also difficult to quantify the effects of these uncertainties on the probabilistic analysis, since the latter uses the results of the deterministic analysis as input. Indeed, as a general com-ment, one wonders whether more is gained by making gross judgmental assump-tions, using them in an uncertain deterministic methodology and " cranking" the results through a probabilistic analysis, than would be gained by making direct judgments on the risk of fire. In any case, we will evaluate the modeling and assumptions of the COMPBRN code and its application in the Limerick SARA in the following sections. Section 2.2.1.2 briefly summarizes our concerns with the deterministic modeling, while Section 2.2.1.3 gives a

.m.-- - - -

2-57 more detailed discussion of each item. Some suggestions for reducing the uncertainties are given in Section 2.2.1.4.

2.2.1.2 Summary Evaluation of Deterministic Fire Growth Modeling The deterministic methodo. logy contained in the computer code COMPBRN(1:2) is used in the Limerick SARA to evaluate the thermal hazards of postulated fires in terms of heat flux, temperature, and fire growth. This code employs a unit-model approach which is acceptable given the current state of the art in enclosure fire modeling as discussed in the previous section.

However, we find some of the submodels contained in the code to be nonphysical and some assumptions overconservative, while other assumptions and applications yield nonconservative results. The uncertainties arising from the combination of these counterbalancing models and assumptions are difficult to quantify, but if forced to draw a conclusion we feel the deterministic analysis as applied to the Limerick plant is generally on the conservative side. However, we also wish to restate that we do not feel that the counterbalancing of a nonphysical, nonconservative model or assumption with another non-physical model or assumption, no matter how conservative, leads to a quantitatively useful result.

On the basis of our initial review of the deterministic fire modeling in the Limerick SARA, we have identified the following items of concern, which will be discussed in more detail in the next section.

The burning rate model is probably the most important source of uncer-tainty in the COMPBRN code. The methodology employed is not realistic and can lead to results which are dependent on the arbitrary choice of the size of

" fuel elements" into which the fuel bed is discretized. Instead, the fuel burning rate should be dependent on the instantaneous size of the fire. Also, use has not been made of existing cable flammability data.(9,10) It is difficult to determine if the cable insulation burning rates obtained by this method are conservative or nonconservative. For the postulated transient-combustible oil fire, the burning rate considered appears overconservative with respect to that reported in the literature.(ll)

I l

2-58 l l

Another example of nonphysical modeling is the fuel element ignition time relationship. This model yields a finite fuel ignition time even if the inci-dent heat flux is considerably below the critical value of 20 kW/m2 found necessary to initiate cable insulation damage in experiments.(12) The model assumes a constant input heat flux even when cables in a convective plume are considered. Convective heat flux must be a function of the difference between the plume and target temperatures, and must therefore decrease as the target fuel heats up. Cable damageability criteria based on a critical heat flux and an accumulated energy, as discussed later and in Ref.12, would be more appropriate. The model used in COMPBRN leads to highly conservative cable ignition times.

The model used to calculate the radiative heat transfer from the flame to a target object is also overly conservative. The radiative heat flux obtained from this model is much greater than that obtained from a classical Stefan-Boltzmann model, wherein the heat flux is a function of the flame gas tempera-ture to the fourth power. The COMPBRN model also neglected the attenuation of the heat flux with distance due to intervening hot gas or smoke. The model neglects, too, the partial reflection of the impinging radiative heat flux from a target fuel element, as well as reradiation, convection, and other losses.

Additional conservatism is introduced by assumptions made concerning the three stages of fire growth. The second stage considers fire growth to adjacent cable raceways once an initial raceway is ignited. The analysis assumes that adjacent cable raceways are separated from the initial fire by the minimum-separation criteria specified for redundant safety-related cable raceways (5 feet _ vertically and 3 feet horizontally). In other words, only one calculation of fire spread time is made for this configuration, and the results are applied to all plant areas considered. This will yield a highly conservative upper bound calculation. Growth stage three assumes damage to redundant cables separated by 20 feet and up to 40 feet and those protected by fire barriers. Redundant raceways separated from the initial fire by more )

than 20 feet were assumed to be damaged in a time interval equivalent to the j l

2-59 damage time of a fire barrier taken as a 1-inch-thick ceramic-fiber blanket.

This appears conservative since raceways separated by this distance would usually be damaged by convection in a stratified ceiling layer, and therefore there should be some dependence on the height of the raceway from the ceiling, those closer to the ceiling failing earlier than those below. Intermediate growth stages between stages two and three might be appropriate.

Another area of uncertainty concerns the quantity and size of the assumed transient-combustible fires. The Limerick SARA assumes three possible transient-combustible configurations ; 2 pounds of paper 1 foot in diameter,1 quart of solvent 0.5 foot in diameter, and 1 gallon of oil 1 foot in diameter.

No rationale is given for this selection. It is certainly possible for larger quantities or combinations of these fuels to exist in nuclear power plants. A distribution of varying quantities would be more appropriate. Also, it is not clear that, given 1 gallon of oil, a 1-foot-diameter pool represents the most severe hazard. A larger-diameter pool will give a larger heat release, al-though for a shorter duration. The damage sustained by the target cable may be a function of this combination of heat flux level and duration of imposi-tion.

Some considerations omitted from the Limerick SARA would tend to make the analysis nonconservative. These include the effects that enclosure walls and corners, in close proximity to the initiating fire, have on the convected heat flux and the possibility of cable damage due to convection in a stratified ceiling layer.

2.2.1.3 Detailed Evaluation of Deterministic Fire Growth Modeling 2.2.1.3.1 Fuel Burning Rate The COMPBRN code (l) models the specific burning rate, m*, of the fuel, which is equivalent to the mass loss rate in combustion, for fuel surface con-trolled fires as m

" "$ + s 9" ext

• I2*I)

l l

2-60 1

s The term m"o is defined as a specific burning rate constant, and the s'ecand term represents the effects of external radiation on the burning rate.

Th'e. specific burning rate constant is assumed to represent the effects of flame' radiative heat flux to the surface, q"fj ,, and surface reradia-tion, q" loss' >

k = (h"fl,r ~

loss) A , (.2)

.where L is the heat required to generate a unit mass of vapor. Note that the use of HF , the heat of combustion of the fuel, in Eq. (4.4) of Ref.1, is

' incorrect. The correct formulation is given by Eq. (3) of Ref.13.

Note that if the externally applied heat flux, q" ext, is zero, the object will burn at a constant rate given by in"=h"o. The consideration of m"o as a constant for an element of fuel burning during the early growth stages of a fire is questionable. For noncharring combustibles, such as PMMA or Plexiglas, experimental data indicate that m"o is indeed a constant.

However, for complex solid fuels such as electrical cables, this may not be the case. Also, the burning rate is a function of the size of the fire through q"fj,7 and q" loss. The mass loss rate of a small sample of PE/PVC cable, subjected to a constant external heat flux, is shown in Figure 4.4 of Ref.10. The mass loss rate is certainly not constant with time as would be indicated by Eq. (2.1) with m"o and q" ext constant by definition.

In COMPBRN, Eq. (2.1) is applied to each small square " fuel element" into which the individual cable trays (super modules) have been discretized. The fire is assumed to initiate in one element and spread to adjacent elements when their ignition criteria are reached owing to the incident radiation from the initial fire.- A constant value of in"o y 0.002 kg/m 2-sec is chosen for each element. This methodology has a nonphysical result when the complete cable t' ray is considered, since the specific burning rate becomes a function of the arbitrary number of elements into which the tray is divided.

4 1

I

2-61 For instance, if a fuel element was burning in infinite space with no externally applied heat flux, then according to Eq. (2.1) its burning rate would be h" tot"b"o. However, if this fuel element is divided into two contiguous subelelements (1) and (2) with equal areas A/2 and with the flame of subelement (1) supplying the external heat flux to subelement (2) and vice versa, then, according to Eq. (2.1),

m"tottm"o=[m"o+Cs 9" ext] , (2.3) where we have tacitly assumed that 9" ext,1 = 4" ext,2 " 9" ext -

Likewise, if the element were divided into n subelements with each j-th element supplying an external heat flux to every other element, by definition the progressive total burning rate when each of the j-subelements become involved will not be equivalent to the total burning rate if all the subelements had been involved initially. This indicates that care must be exercised in using Eq. (2.1) to predict the ensuing development of a fire along an individual cable tray.

Intermediate scale data for the EPR/Hypalon cable used at Limerick is given in Fig. D-18 of Ref. 9. The cable weight loss for the twelve trays considered increases with time and a steady burning rate of 6.7 kg/ min was reached after about 37 minutes. This translates into a specific steady state burning rate of 0.008 kg/m2-sec. Use of such data and those of Ref.10 could remove some of the uncertainty of the present model.

For transient combustibles, the fuel is not discretized and the specific burning rate is assumed to be the constant steady state value, m"o. Table D-4 of the Limerick SARA gives m"o value for paper and oil of about 0.061 kg/m2-sec. It is believed that the value for paper is a misprint and should be 0.0062 kg/m2 -sec. The value for oil seems somewhat conservative since Ref.11 gives a value of 0.04 kg/m2-sec.

-p 2-62 s t

> 2.2.1.3.2 Fuel Element Ignition s In the COMPBRN code, a fuel el,ement is considered ignited simply if its surface temperature exceeds a critical ignition temperature, T*. Addition-ally, the' fuel elements are modeled as semi-infinite slabs and the losses from the fuel to the environment due to reradiation and convection are neglected.

An expression for the ignitio,n - s time, t*, is obtained by solving the heat conduction equation, following page 75, Ref. 14, for the condition of a constant imposed surface heat flux, q"o.

t*=(w/45)[k(T*-T)/h"o]2o . (2.4)

This expression is physically incorrect since it implies that an ,ig-nition time will be reached no matter how small a value of heat flux is applied. . Cable flammability test data (12) show that cables are generally not damaged unless the heat flux is above a critical value of about 20 kW/m 2 owing.to heat losses at the surface, l'

Also, the assumption of constant i'mposed' heat flux is overly conserva-tive since the heat flux received by an object is a function of the object surface temperature, Ts , which increases with time as the object is exposed to the external flux.

For instance, in the case of an oil fire 10 feet beneath a cable tray considered in the Limerick-SARA, the convective heat flux at the cable surf ace will be e , q"o = h[Tp j Ts ] , (2.5)

'where Tp1 is the plume temperature at the ' cable height, T3 is the cable surface' temperature, and h is the surface heat transfer coefficient.

j Therepre, the surface heat flux will decrease substantially as the Y

2-63 temperature of the cable surface appruches the plume temperature. The COMPBRN code assumes that the surface temperature remains at its initial value for the duration of the fire.

For the 1-foot-diameter oil pool fire considered in the Limerick SARA, we estimated the plume temperature at 10 feet above the fire using three methods.

These include two correlations of convective heat flux by Alpert,(15,16)

[one of which was used in COMPBRN(1)] and a more recent plume correlation by Stavrianidis.(17) The plume temperatures thus obtained range between 370 K and 450*K. These low values indicate that cables within the convective plume and located 10 feet above the fire would never reach their designated critical ignition temperature of 840 K. This indicates the overconservativeness of Limerick SARA which predicts cable ignition in 4 minutes for this target / fire source configuration.

Of course, one must also consider the radiative heat transfer from the flame to the target (the electrical cables) in order to predict the time required for the cables to achieve this critical ignition temperature. In this regard, audit calculations, using the method described in Ref.18, yield a radiative heat flux, q"r, of 0.42 kW/m2 . This is based upon use of the following equation:

q"7 = (aTf14 /w) (Ap /t 2) e ,

(2.6) where a is the Stefan-Boltzmann constant; Tfj is the flame temperature (1255'K)(17); t is the distance of the target from the radiating body (with a flame height of 5 ft(16) and a cable height of 10 ft: 1 is equal to 5 ft; and Ap is the flames projected surface area. The emissivity, , was assumed to be 0.3 (the sum of a gaseous value of 0.2 and a luminous soot value of 0.1). This value of radiative heat flux, when added to the previously calculated convective heat flux, then yields a value of ignition time, t*,

(via Eq. 2.4) markedly higher than the 4 minutes stated in the Limerick SARA.

2-64 l

l Even the radiative heat flux model, as described in COMPBRN, yields a value of radiative heat flux lower than that required to achieve the critical ignition temperature of 840*K within 4 minutes. In COMPBRN, the radiative flux is given by 9"r " fo -fl r/Af1 , (2.7) where Fo .f1 is the shape factor between the object and the flame, Af1 is the flame surface area, and Qp is the heat radiated by the fire which is expressed as Qp = 7 Q . (2.8)

In the above expression, Y reflects the radiant output fraction (T=0.4 as assumed in Ref.1) and h represents the total heat release rate of the fire.

To reconcile this wide disparity between ignition times reported and those calculated by the methods' described above, "back" calculations were made using Eq. 2.4 which indicated that an imposed surface heat flux, q"o, of approximately 12 kW/m 2 is required to achieve a t* of roughly 4 minutes.

This value is obtainable using the COMPBRN model, if Af1 in Eq. 2.7 represents the projected flame area (or pool area in this case) and not the flame surface area. This is clearly inconsistent with the methodology used to derive Eq. 2.7.

These audit calculations clearly point out that the results of the Limerick SARA are based upon an overconservative estimate of critical times to reach cable ignition.

Even in the event that the radiative heat flux dominates the convective heat flux, the target will not absorb the total flux since significant amounts will be convected away. If a proper model for convective heat transfer. Eq.  !

l 1

l l

.- z 2-65 (2.5), is used, once the surface temperature increases above the plume temperature, heat will be convected away from the target reducing the effects of radiation.

The selection of 840 K as the spontaneous ignition temperature for EPR/Hypalon cable is also somewhat conservative since Table 3-1 of Ref. 9 pre-sents experimental data showing that the critical temperature at or below which ignition cannot be achieved is 893 K for piloted ignition and is con-siderably higher for spontaneous ignition. Actually, as stated by Siu,(1) the concept of a threshold ignition temperature is somewhat imprecise. Ex-perimental data generally exhibit significant variations with further uncer-tainties arising if ill-defined cable insulation compositions are involved.

The crucial issue is not whether the fuel surface reaches a certain tempera-ture level, but whether the heat gains by the pyrolyzing gases are great enough to overcome the losses and trigger the combustion reactions, and the resulting heat of gaseous combustion is great enough to sustain the reaction.

Lee (12) has developed a set of cable damageability criteria along these lines. For an applied heat flux, the time for spontaneous ignition is defined in terms of a critical heat flux, q"cr, at or below which ignition cannot be initiated and an accumulated energy, E, required for sustaining ignition.

t = E/(q" ext - "cr) . (2.9)

Figure 2.2.1 (attached) shows test data (12) for the inverse of time to piloted ignition plotted vs external heat flux for EPR/Hypalon cable. The slope of the straight line is 1/E. Also plotted is the ignition time model, Eq. (2.4), using a critical spontaneous ignition temperature of 840 K. The COMPBRN model is more conservative than even the piloted ignition data, especially for low levels of external heat flux, i.e., a given external heat flux will give an earlier time to ignition than the data. Also, while.the data show no ignition below a heat flux of about 20 kW/m2, the model pre-dicts an ignition time for all values of heat flux. The 10-minute ignition time for -stage-two self-ignited cable raceway fires is indicated for reference.

2-66 2.2.1.3.3 Fires Near Enclosure Walls or Corners The COMPBRN code does not consider the effects that the close proximity of walls or corners of an enclosure can have on the temperature distribution in the convective plume of fires. The presence of walls will increase the gas temperature at an elevation above the fire by a magnitude that can be theoretically estimated by considering initiating fires having " equivalent" heat release rates 2 and 4 times the actual heat release rate for walls and corners, respectively. The neglect of this effect will have a nonconservative effect on fire growth calculations, especially in Fire Zone 2 where cable trays are stacked against the "J" wall.

Evidence of the increased gas temperatures at a given elevation above a fire is available in the literature. In Ref. 16, Eqs. (3) and (4) illustrate the concept of equivalent heat release rates mentioned above. Figure 6 of the same reference shows test data of the fire positioning effects on ceiling temperature. On page 119 of Ref. 19, the average plume temperature rise is

-found to increase by factors of 1.75 and 2.5 for fires adjacent to walls or corners, respectively. Finally, Table A-1 of Ref. 20 shows the upper-layer gas temperature is likewise affected by burner locations near walls and corners.

The increased gas temperatures in the presence of walls are due to the effects of reduced cool air entrainment, which results in higher flames due to the additional distance needed for fuel vapor / air mixing. We are concerned with the distribution of energy, not just the maximizing of the overall energy. Even though the code considers complete combustion, which maximizes the heat release rate and the temperatures near the fire, the wall effect causes local temperature increases which must be considered to yield a conservative result.

2.2.1.3.4 Stratified Ceiling Layer  !

1 The application of the COMPBRN code in the Limerick SARA failed to con-sider the stratified hot gas layer near the ceiling of enclosures even though  ;

2-67 such a model is included in the code. This assumption that enclosure effects are minimal may be valid since the fires considered are small with respect to the size of the enclosure. However, in small fire zones, such as the static inverter room, the hot gas layer near the ceiling could preheat the nonburning fuel elements and reduce their time to ignition. Some substantiation of the neglect of this effect should be included in the analysis.

The consideration of thermal stratification might also affect the defini-tion of fire growth stages in the Limerick SARA. It is conceivable that unprotected cables near the ceiling, although horizontally separated by more than 20 feet from an initiating fire, could ignite more quickly than a cable closer than 20 feet but considerably below the ceiling. This would tend to nave portions of fire growth stage 3 ahead of fire growth stage 2.

The ceiling gas layer model in COMPBRN is based on a simplified steady gross heat balance. A uniform gas temperature is assumed throughout the upper hot layer. Alpert(15) indicates that the ceiling gas temperature decreases with distance from the ceiling, as well as with radial distance from the plume axis. More recently, Newman and Hill (21) have developed a transient cor-relation for the heat flux below the ceiling of an enclosure containing a pool fire, which includes the effects of forced ventilation. This correlation shows a decrease in heat flux with distance below the ceiling, but contrary to Alpert, it indicates very little dependence on lateral separation. These works indicate that consideration in the Limerick SARA of all unprotected trays with greater than 20 feet horizontal separation as equivalent in damage rating to a. fire barrier as being an oversimplification.

2.2.1.4 Recommendations for Improving Fire Growth Modeling The previous sections have detailed some of our concerns. regarding the sometimes nonphysical, usually overconservative, deterministic fire growth modeling in the Limerick SARA. There are four major areas where we feel the modeling can be made more realistic: the cable burning rate model, the fuel

2-68

' element ignition time model, the flame radiant heat transfer model, and the surface temperature dependence of the convective heat transfer model.

Incorporation of recent test data (9,10) on cable flammability into the determination of the burning rate of the EPR/Hypalon cables should give a more realistic representation of fire growth. Similarly, the use of cable ignition /damageability criteria,(12) based on a critical heat flux and an accumulated energy, would yield cable ignition times more consistent with test data. Improvement of the model for calculating the radiated heat flux re-ceived by a fuel element, by using an appropriate flame area and by con-sidering attenuation due to hot gam and soot, will result in more realistic fire growth scenarios and establish a more accurate proportionality between convective and radiative heating. Finally, the convective heat transfer model should take into account the instantaneous temperature of the surface of the object being heated. This will reduce the convective heat absorbed as the object heats up ana will allow for convective cooling if its temperature exceeds that of the local fire plume.

2.2.2 Probabilistic Fire Analysis Review For the Limerick Generating Station (LGS) Unit 1, the Severe Accident Risk Assessment (SARA) study reports that fire accident sequences constitute a sig-nificuat portion of the overall public risk. In our review of the document, we found no evidence contradicting this conclusion. However, our understanding of the state of the art in fire PRA, as well as the existing inadequacies in both physical and probabilistic modeling in this area, precludes any judgment based on the quantitative results presented in the LGS report. Further, the expected large uncertainties associated with the quantitative results would suggest that less importance be given to the numbers. Hence, the scope of our review is twofold: first, to identify the existing inadequacies in physical and probabilistic modeling in fire PRAs in general; and, second, to review and comment on the existing LGS report for the  !

fire risk assessment.

1

2-69 The generic comments associated with the physical modeling of fire growth have been discussed in Section 2.2.1. The level of conservatism used in the deterministic analysis has also been discussed. In addition, fire growth modeling during the suppression phase will be described in the following sections which basically indicate that the LGS approach is again highly conservative. Concerning the specific approach and data implemented in LGS fire risk assessment, we have concluded that:

1. The approach taken for systematic identification of critical plant areas is sound, and the LGS fire hazards analysis appears to have identified all these areas.

2. The LGS fire analysis has adopted an appropriate data base for es-timating the frequency of fire in Nuclear Power Plants (NPPs).

3. The LGS analysis has generated plant-specific fire frequencies using the data base and has taken into account the specific features of the plant. In a few cases these estimates are nonconservative.

4. The LGS analysis appears to have identified all important safety com-ponents and cabling which are located in the critical fire areas, ex-cept for Zones 44 and 47.

5. The event trees for panel fires generated by the LGS analysis should be modified to take into account the layout of the panels with respect to the critical portion of the zone.

6. The cumulative suppression distribution function generated in the LGS report does not seem to agree with available data.

7. Suppression probabilistic modeling seems to be very conservative and is not representative of the actual case.

8. The LGS analysis does not quantify the uncertainty of the final re-sults. The uncertainty bounds generated are merely judgmental.

i

I i

l 2-70 Consistent with these conclusions, the following section discusses each item in detail.

2.2.2.1 Evaluation of Significant Fire Frequencies in General Locations In this part of the LGS analysis, the estimated frequencies of fires in general locations were based on historical fire occurrence data in NPPs. The general locations for LGS were identified from the Fire Protection and Evaluation Report (FPER). The data base adopted appears to be suitable for estimating the frequencies of fires in NPPs. The point estimate frequencies calculated for the general locations seem to be reasonable, but the uncertainty bounds were not determined. The frequency of fires for the individual fire zones was ther. calculated using the ratio of the weight of

, combustible material contained within a zone to the total weight of combustible material in the general location. There is no justification for using this ratio for estimating the specific zone fire frequency. However, the results of these estimations were used for the systematic identification of critical fire zones through screening analysis, rather than the detailed fire risk assessment.

For the detailed fire risk assessment, the estimated fire occurrence frequency within each zone was based on three different mechanisms of fire initiation: self-ignited cable fires, transient combustible fires, and distribution panel fires. Following are comments regarding each type of fire occurrence frequency estimation.

2.2.2.1.1 Self-Ignited Cable Fires Three incidents of cable-raceway fires have been reported in the data base for NPPs. Two of them spread beyond one cable tray and were estimated to burn for 30 minutes before being extinguished. The LGS report indicates that all these cable fires were attributable to bad cable splices and underrated cables. A review of the LGS data given in Tables D-1 and D-2 of their

2-71 submittal suggest that incident 43 (Table 0-1) was not caused by underrated cables or bad splices. Hence, we cannot agree with the fivefold reduction of self-ignited cable-raceway fire frequencies as indicated in the LGS report based on the Limerick protection measures and flame retardant cables. It appears to us that a threefold reduction should have been implemented for cable-raceway, self-ignited fire frequencies in the Limerick plant.

In order to estimate the frequency of fires within the individual fire zones, the frequency per reactor year was weighted according to the fraction of cable insulation weight in that zone to the total cable insulation weight in the control structure and reactor building. We cannot follow the logic behind this fractional weighting factor. In our view, the number of conductors and splices, the voltage / power ratings, the geometric factors, etc.

may be more suitable for weighting the frequency of fire in each fire zor.e, rather than simply the insulation weight. This indicates that large uncertainties are present in the fire frequency estimates of various zones.

2.2.2.1.2 Transient-Combustible Fires Three types of transient-combustible fires were included in the analysis.

The quantity and the area of each type of transient combustible were con-sidered to be fixed. The state of the art for fire risk analysis is to con-sider various quantities of transient combustibles each with an assigned probability distribution. Hence, the effective damageability area and the critical propagation time for transient- combustible fires are expected to be in the form of a distribution. Considering that no data are available, the frequency of fires for transient combustibles estimated in the LGS report seems to be reasonable.

2.2.2.1.3 Power Distribution Panel Fires The. estimated frequency of fires occurring in power distribution panels was based on five reported fires that occurred during 564 years of reviewed U.S.. LWR experience. The point estimate of fire frequency within a power distribution panel was derived from these data and seems reasonable.

2-72 2.2.2.2 Screening Analysis A systematic approach is used in the LGS report to identify the critical fire areas. In this approach it is assumed that upon the occurrence of a fire in a zone, all the equipment and cables in that zone will be disabled. The core-melt probability was then recalculated and multiplied by the frequency of fire occurrence in that zone to provide a measure for screening analysis.

With this approach, the LGS fire analysis appears to have identified all the critical areas in the plant. The quantitative reassessment of their results are beyond the scope of this review. From our review of the FPER and the use of engineering judgment, the critical fire areas identified by the LGS report seem to be reasonable.

2.2.2.3 Probabilistic Modeling of Detection and Suppression The probabilistic suppression / detection model used in the LGS study in the form of a cumulative probability distribution to predict the probability of failure to extinguish the fire within a specified time interval is based on actual plant data for automatic detection and manual suppression. It is indicated that the data base for cable insulation fires reported by Fleming et al.(22) was used to construct the suppression probability distribution.

This document was reviewed and the cumulative suppression / detection was reconstructed according to our interpretation of the data. A comparison of the curve constructed by BNL with the curve given in the LGS report is made in Figure 2.2.2. Table 2.2.1 presents the data used by BNL. It is our understanding that in the LGS estimate of the suppression success probability, the self-extinguished cabinet fire incidents were included. In our opinion, the LGS report should not take credit for the data on self-extinguished cabinet fires when estimating the suppression success probability for the cable-raceway fires. In addition, the LGS report constructed the cumulative suppression probability distribution with the assumption that the longest suppression period is 1.3 hr (based on the longest suppression period observed in the data base). We feel it is more appropriate to obtain a distribution

2-73 fit to the data rather than the " eyeball fitting" used by the LGS report. In our analysis, the lognormal, exponential, and Weibull PDFs were considered as the likely candidates. The chi-squared goodness of fit for both the BNL and the LGS data. indicates that the parametric Weibull distribution is the best choice. A cumulative Weibull distribution F(x) can be defined by two parameters, n and a , and is given by Ffx) = 1 - exp (-x/a)'. (2.10)

The estimated (a,n) val'ues for the BNL and the LGS data are (0.615,13.5) and

'*58,6.83),respectively. A comparison of the original LGS curve with the invoified LGS and the BNL curves is given in Figure 2.2. In the time interval of 30 to 75 minutes, Curve I obtained by the Weibull fit to the LGS data is essentially the same as Curve II, obtained by the " eyeball fit" in the LGS report. Outside the above interval, the difference observed is not expected to result in any significant change in the final fire PRA results. However, comparison of Curve III obtained by the Weibull fit to the BNL data shows that the LGS estimate of suppression success probabilities is higher at all times.

As in other conventional probabilistic risk assessments, the LGS report assumes that fire growth and suppression are two independent processes, and they are treated separately. This is one of the most important deficiencies of existing fire risk analyses which usually results in very conservative values for fire-induced risk. The interaction between the fire growth and suppression will be discussed qualitatively in Section 2.2.2.4.

The probability calculated by the LGS report for fire propagation out of a distribution panel was considered to be 1/25 = 0.04. This estimation was based on the data base which indicates that all five reported distribution panel fires were self-extinguished and none of them propagated out of the panel. It was conservatively assumed that one of these fires had the poten-tial to propagate. In addition, a fivefold reduction was considered, based on

1 2-74 engineering judgment, to give credit to the IEEE 383 qualified flame-retardant cable insulations. This reduction may not be justified. The com-bustibility of cable insulation can best be described through the sensitivity of the cables to various thermal environments, expressed as the change in generation rate of combustible vapor per unit change in the flux received by the combustible. This value, usually denoted by "S", is 0.17(g/kJ ) for EP-R/Hypalon and 0.22 (g/kg ) for PE/PVC cable insulation.(23,10) Hence, a maximum factor of 2 may be credited because of flame-retardant cable insulations.

Additionally, during a visit to the plant, it was noted that some of the panels are airtight. For these panels, we feel the probability of fire propagation is negligible and, therefore, the value used in the LGS report is conservative. For panels with louvers or openings, the value used in the LGS report may be nonconservative. In general, we do not expect the impact of panel fires to change appreciably if more detailed analyses were performed.

2.2.2.4 Probabilistic Modeling of Plant Damage State Generally, three stages of fire growth and corresponding states of shut-down equipment damage were evaluated in the analysis. The first stage con-sidered is damage to components in the immediate vicinity of the source of fire. The second stage is fire growth to adjacent unprotected cable raceways separated from the initial fire by minimum separation criteria (5 ft vertical-ly and 3 f t horizontally). The third stage of fire growth represents fire of sufficient severity and duration to damage the mutually redundant shutdown methods which may have cabling with a separation distance of at least 20 feet or protected by fire barriers. Certain inherent assumptions in the analysis are as follows:

1. The rate of fire growth is not dependent on the suppression.

2. A 20-ft separation is considered to be equivalent to a 1/2-hour fire barrier (1-in- thick ceramic blanket).

2-75

3. Cable raceways separated from the fire source by 40 ft or more were considered undamaged by the fire.

4. It was assumed that long-term heat removal systems not required until 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> into the fire-induced transient could be recovered by oper-ating valves manually and operating pumps locally. The probability of failure by the operator to perform these recovery actions was con-sidered to be 10 times greater than human errors ascribed to inter.nal events.

Given these assumptions, the LGS report analyzed the impact of fire in various critical zones as identified through the screening analysis. Iden-tification of various equipment damaged in different fire growth stages could not be verified by the BNL review group owing to lack of information and time limitations. However, on the basis of a limited identification of various critical components and systems in different fire zones by means of the information gathered from LGS-FPER and the plant visit, we concluded that in most cases the LGS report identified the components properly. There are two exceptions as follows:

1. In Zone 44, BNL has identified seven distribution panels and motor control centers. These are distribution panels 10D201,10D202,10D203 and motor control centers 10B211, 10B212, 10BV215 and 10B216. We have also concluded that a fire in distribution panels 10D202 and 100203 would affect the operation of the HPCIS, and a fire in distribution panel 10D201 would affect the operation of the RCICS. Hence, there-are three critical panels in this area. The LGS report indicates that there are six distribution panels and only two of them are critical (100201 and 10D203).

2. During the plant visit, a booster fuel pool cooling pump was noted in Zone 47, General Equip-ment Area, pump in the vicinity of the northeast corner, which is the critical area in this zone. This pump

I 2-76 l

was not identified in the LGS report. Therefore, its potential for intitiation and progression of fire adversely affecting the cables in this area was not considered.

Before presenting our comments on each critical fire zone, a-further discussion of the inherent assumptions used in the LGS report mentioned earlier in this section is appropriate, more specifically, the nature of the interaction between fire growth and suppression activities. In the LGS report, it was assumed that a fire can progress regardless of suppression initiation, but terminates with some probability after an expected time which is required for successful suppression. The lack of physical modeling for the suppression phase of a fire scenario appears to be one of the weakest links in the analysis. We are aware of this deficiency in other fire PRAs and it seems to be a conventional practice, usually resulting in very conservative estimates for fire impact on equipment and cabling. While reevaluation of the results given in the LGS report, taking into account proper detection and suppression modeling, is beyond the scope of this review, it seems necessary to discuss the basis for such analysis.

In the analysis of a fire scenario, initiation time for detection and sup-pression is of great importance. Detection and suppression can be achieved either manually or automatically. In a detailed fire PRA, both detection time and suppression initiation time should be expressed in the form of probability distribution function (pdf). For the automatic suppression and detection response, some design charts are available which graphically, or through some equations, detennine the response time vs the spacing, ceiling height, and heat release rate.(24-26) If detailed fire growth modeling, with the associated uncertainties of various fire parameters, is available for a specific scenario, the detection and suppression response may be directly estimated in the form of pdfs. If detailed fire growth modeling is not I

available, a generic response can be considered by assuming the two extreme I fire growths (slow, fast) as defined in Ref. (24). In this case, the lower and upper bounds for response time may be determined assuming fast or slow fire growth, respectively. These bounds may be used to define a pdf for the l response. The response time for the inititiation of the manual suppression l 2

l

2-77 may be estimated by means of available data on response time during fire drills and some engineering judgment. The modeling of a fire growth during the suppression phase can be very complicated depending on the governing mechanism of the process (heat removal, chemical reaction, oxygen removal.)

However, for the purpose of fire PRAs, a combination of simplistic models, coupled with empirical correlations, may be used. For example, the effect of sprinkler systems on fire growth may simply be modeled in the form of global energy balance.(27)

In conclusion, the time in which fire can reach various stages of growth is dependent on suppression initiation time. There is a strong belief that

-fire cannot grow significantly once the suppression has begun. In the LGS re-port, it is conservatively assumed that probabilities of various stages of growth can be determined using the time period for the completion of success-ful suppression, rather than the initiation of suppression. This is a very conservative assumption and at present the effect of this conservatism on the final results cannot be evaluated.

2.2.2.4.1 Zone-Specific Comments In addition to the generic comments made in previous sections, there are additional zone-specific comments that may affect the results of the fire PRAs given in the LGS report. These comments, mostly concerning the layout of different components in various critical zones, are based on the review of the FPER and the plant visit.

a. Zone 44, Safeguard Access Area (CH=36 ft, A=8930 ft 2, ASD=357.2, S=M).* In this zone, there are a total of seven motor control centers (MCC) and distribution panels. Four of these panels are located close to the critical corners. These are distribution panels 10D202 in SW, 100203 in NE,10D201 in SW, and MCC-108211 in SW (Drawing M118, Rev.).

The event tree associated with the panel fires should be modified.

• CH is the ceiling height, A is the floor area, and ASD is the area per smoke detector. The "S=M" represents manual suppression, where "S=A" represents automatic suppression.

I

_ _ - _ .- . - - - . _ - - . .- .----\

2-78

b. Zone 45, CRD Hydraulic Equipment Area (CH=25 ft, A=12860 ft2 ,

ASD=676.8 ft, S=M/A). The only critical panel which is located in the NE corner is the MCC-10B224. The other panels are not located in the vicinity of the NE corner (Drawing M119, Rev.19). The event tree as-sociated with the panel fires should be modified.

c. Zone 47, General Equipment Area (CH=not available, A=9800 ft2, ASD=490 ft, S=M/A). According to the drawing M120, Rev. 18, none of the distribution panels, load centers, or motor control centers are located in the vicinity of the critical NE corner. Therefore, the ev-ent tree associated with panel fires in this zone should be modified.

The only component located in the NE corner of this zone that may re-sult in a fire hazard is a booster fuel pool cooling pump.

2.2.3 References to Section 2.2

1. Siu, N.0. , "Probabilistic Models for the Behavior of Compartment Fires,"

School of Engineering and Applied Science, University of California, Los Angeles, Ch. , NUREG/CR-2269, August 1981.

2. Siu, N.0. , "COMPBRN - A Computer Code for Modeling Compartment Fires,"

School of Engineering and Applied Science, University of California, Los Angeles, Ca. , UCUi-ENG-8257, August 1982.

3. Mitler, Henri E. and Emmons, Howard W. , " Documentation for CFCV, the Fifth Harvard Computer Fire Code," Harvard University, Cambridge, Ma. ,

October 1981.

4. Quintiere, J.G. , " Growth of Fire in Building Compartments," ASTM Special Technical Pub. 614, 1977.

5. Tatem, P. A. , et al , " Liquid Pool Fires in a Complete Enclosure," 1982 Technical Meeting, the Eastern Section of the Combustion Institute, Atlantic City, N.J., December 14-16, 1982. l l

l l

2-79

6. Zukowski, E.E. and Kubota, T., "Two layer Modeling of Smoke Movement in Building Fires," Fire and Material, 4, 17, 1980.

7. Delichat sios, M.A., et al., " Computer Modeling of Aircraft Cabin Fire Phenomera," FMRC J.I. 0G0N1.BU, Factory Mutual Research Corp. , Norwood, Ma., Dev.mber 1982.

8 MacArthur, C.D. , " Dayton Aircraft Cabin Fire Model Version 3," Vols. I and II, University of Dayton Research Institute, 1981.

9. Sumitra, P.S. , " Categorization of Cable Flammability, Intermediate-Scale Fire Tests of Cable Tray Installations," EPRI NP-1881, Electric Power Re-search Institute, Palo Alto, Ca., August 1982.

10. Tewarson, A. , Lee, J.L, and Pion, R.F. , " Categorization of Cable-Flammability, Part 1: Laboratory Evaluation of Cable Flammability Para-meters," EPRI NP-1200, Electric Power Research Institute, Pclo Alto, Ca. ,

October 1979.

11. Tewarson, A., " Fire Behavior of Transformer Dielectric Insulating Fluids," 00T-TSG-1703, prepared for U.S. Dept. of Transportation, Trans-portation Systems Center, by Factory Mutual Research Corp., Norwood, Ma.,

September 1979.

12. Lee, J.L. , "A Study of Damageability of Electrical Cables in Simulated Fire Environments," EPRI NP-1767, Electric Power Research Institute, Palo Alto, Ca., March 1981.

13. Tewarson, A., "Physico-Chemical and Combustion / Pyrolysis of Polymeric Materials," NBS-GCR-80-295, prepared for U.S. Dept. of Commerce, National Bureau of Standards, Center for Fire Research by Factory Mutual Research Corp. , Norwood, Ma. , November 1980.

14. Carslaw, H.S. and Jaeger, J.C. , " Conduction of Heat in Solids, 2nd Ed.,"

0xford Clarendon Press, 1959.

2-80

15. Alpert, R.L., " Calculation of Response Time of Ceiling-Mounted Fire De-tectors," Fire Technology, Vol . 8,1972, pp.181-195.

16. Alpert, R.L. and Ward, E.J. , " Evaluating Unsprinklered Fire Hazards,"

FMRC J.I. No. 01836.20, Factory Mutual Research Corp. , Norwood, Ma. ,

August 1982.

17. Stavrianidis, P., "The Behavior of Plumes Above Pool Fires," a thesis presented to the Faculty of the Department of Mechanical Engineering of Northeastern University, Boston, Ma. , August 1980.

18. . Orloff, L.,. " Simplified Radiation Modeling of Pool Fires," FMRC J.I. No.

OE1E0.BU-1, Factory Mutual Research Corp. , Norwood, Ma. , April 1980.

19. Zukoski, E.E. , Kubata, T. , and Cetegen, B. , "Entrainment in Fire Plumes,"

Fire Safety Journal, Vol. 3, 1980/81, pp. 107-121.

20. Steckler, K.D. , Quintiere, J.G. , and Rinkinen, W.J. , " Flow Induced by Fire in a Compartment," National Bureau of Standards, NBSIR 82-2520, September 1982.

21. Newman, J.S. and Hill, J.P. , " Assessment of Exposure Fire Hazards to Cable Trays," EPRI-NP-1675, Electric Power Research Institute, Palo Alto, Ca., January 1981.

22. Fleming, K., Houghton, W.J., and Scaletta, F.P., "A Methodology for Risk Assessment of Major Fires and its Application to an HTGR Plant,"

GA-A15402, General Atomic Company, San Diego, Ca. ,1979.

23. Tewarson, A., "Damageability and Combustibility of Electrical Cables,"

paper presented at FMRC/EPRI Seminar, Factory Mutual Conference Center, Norwood, Ma., December 1981.

24. Benjamin, I., et al, "An Analysis of the Report on Environments of Fire Detectors," Ad Hoc Committee of the Fire Detection Institute, 1979. 1 1

l l

1

2-81

25. Newnan, J.S. , " Fire Tests in Ventilated Rooms - Detection of Cable Tray and Exposure Fires," EPRI NP-2751, February 1983.

26. Hill, J.P. , " Fire Tests in Ventilated Rooms - Extinguishment of Fire in Grouped Cable Trays," EPRI NP-2660, December 1982.

27. Levinson, S.H., " Methods and Criteria for Evaluation of Nuclear Fire Protection Alternatives and Modifications," Ph.D. thesis, Rensselaer Polytechnic Institute, Troy, N.Y., December 1982. '

9

2-82 l

13 i i i i i i 12 -

~

II ~

COMPBRN AUTO-lGNITION m iO -

Ts* = 8 4 0

• K \ -

I 9 -

x 9 -

8 -

z 9 - -

t7 z-E 6 - -

O tu o 5 -

a Q.

$4 -

to 2

P 3 - -

h 2 -

l t =10 min.

0 O 10 20 30 40 50 60 70 80 EXTERNAL HEAT FLUX (kW/m 2)

Figure 2.2.1 Piloted ignition of EPR/Hypalon cable under various external j heat flux.  !

i i

)

1 i

2-83 W

E I I I I I l e

f 1.0 g-m

-) -

e 3 -

X W

7 _

o E g _

E O .5 d

I: WEIBULL FIT TO LGS DATA -

$ H: LGS ORIGIN AL CURVE E HI: WElBULL FIT TO BNL DATA w -

2 t

_i 3 O' I I I I I I 2 15 30 45 80 75 90 l 5 TIME AVAILABLE TO SUPPRESS FIRE ( minutes )

Figure 2.2.2 Fire suppression model.

l i

2-84 f

Table 2.2.1 Suppression Data and Calculations Performed for Suppression Success Probability Self-Ignited Cable-Raceway Fires Index* Plant Name Time to Bring Fire Type of Type of Under Control (hr) Detection Suppression 58** Browns Ferry 7.0 Automatic Manual 23 Zion 2 1.3 Manual / Automatic Manual / Automatic 25 San Onofre 1 0.7 Manual Manual 24 San Onofre 1 0.5 Manual Manual 8 Kewaunee 0.5 Automatic / Manual Automatic / Manual 28 Three Mile Is. 2 0.5 Manual Manual 37 Vermont Yankee 0.5 Automatic Manual 42 Nine Mile Pt.1 0.05 Manual Manual 46 Oyster Creek 0.05 Manual Manual 27 Trojan 0.05 Manual Manual

• Indices are the same as those in Fleming's report.(22)

• • The fire occurrences during the construction phase or those that were self-extinguished and confined to a cabinet were not included. In addition, the Browns Ferry fire indicated above is not included in our analysis.

3-1 3.0 ACCIDENT SEQUENCE ANALYSIS 3.1 Seismic The objectives of this section are to provide (i) a brief description of the methodology and assumptions adopted in the LGS-SARA (1) report in the quantification of seismic accident sequences, and (ii) a BNL review comments of particular critical areas of the LGS-SARA document. Results based on BNL modifications are also presented whenever simplified estimations can be made to illustrate the effects of the modifications. This section is divided into two parts. Section 3.1.1 addresses those plant frontline systems which are identified in the LGS-SARA report and the method of quantification by which system unavailabilities, including the seismic contributions, are evaluated.

Section 3.1.2 sunnarizes the seismic event tree approach and the seismic accident sequence analysis.

3.1.1 Plant Frontline Systems This section comprises two subsections. Subsection 3.1.1.1 presents an overview of the LGS-SARA approach in modeling frontline systems. It also summarizes the assumptions made pertaining to systems and components of the systems in the evaluation of the seismic contribution to the system un-availability. Subsection 3.1.1.2 provides the BNL revisions to the frontline system models ard the results thereof. A discussion of the assumptions and the LGS-SARA approach to system fault trees is also included.

3.1.1.1 Overview of the SARA Approach in Frontline System Modeling The system analysis part of the LGS-SARA effort is based extensively on the structure and contents of the LGS-PRA.(2) This includes use of the LGS-PRA frontline system fault trees in the description of the random failure of the various systems. In addition, these fault trees also provide the basis for the development of the seismic-related failures. Finally, the components that appear in the LGS-PRA system fault trees constitute, in part, the group of components for which fragility evaluations were conducted.

3-2 i

l LGS-SARA purported to have examined the fragility of two groups of com-ponents: those contained in the LGS-PRA system fault trees and those identified as having the potential of significantly influencing the likelihood of core damage from seismic events, such as the reactor vessel and other related structures. A detailed discussion of component fragility is presented l in Chapter 2.1. These components are then ranked according.to the acceleration capacity of each item; those with a median ground acceleration capacity greater than 1.56 g were not considered,since they are deemed to have a far higher ground acceleration capacity than those predicted for the reactor site. On the basis of this criterion, a final list of 17 components are selected for use in the LGS-SARA evaluation, Table 3.1.1.

Each seismic frontline system fault tree developed in the LGS-SARA an-alysis is made up of two parts: the first part, which leads to the failure of the system, consists of the random independent failures evaluated in the l

LGS-PRA; the second part includes all the pertinent seismic-related failures as determined using a specified criterion. This criterion for inclusion as a seismic-related failure requires that the component appears in Table 3.1.1.

! The random independent failures for each system, as calculated in the LGS-PRA, are treated as a basic event in the seismic system fault tree. For both the l

HPCI and the RCIC system, failure of the condensate storage tank (CST) neces-sitates the transfer of the water source from the CST to the suppression pool i and is included in the fault trees. A total of eight seismic fault trees were

! developed for the LGS-SARA study and they include the following: high pressure l

coolant injection (HPCI), reactor core isolation cooling (RCIC), low pressure l coolant injection (LPCI), low pressure core spray (LPCS), residual heat re-l moval (RHR), standby liquid control (SLC), automatic depressurization system (ADS), and emergency power. An example of HPCI seismic system f ault tree is given in Figure 3.1.1.

(

l l

t

3-3 3.1.1.2 BNL Revision and Review of Frontline System Fault Trees Fault Tree Approach The inclusion of random independent failures into the seismic fault trees represents a more realistic approach than those focusing solely on seismic-related failure events. In some circumstances, these random independent failures when coupled with a substantial reduction in the operator's ability to follow procedures due to high stress conditions resulting from an earthquake may contribute significantly to core damage.

BNL reviewed the LGS-SARA modularized system fault trees developed for the seismic analysis. These fault trees were based on the list of 17 components identified as more susceptible to seismic-event-related failure. On

p. 3-1 of the LGS-SARA, it is stated that the internal system fault trees provide, in part, the list of components for which fragility functions were developed and that additional items were included when they were deemed to have the potential for significantly influencing the likelihood of core damage from seismic events. BNL agrees that consideration of only those components identified in the internal event system fault trees does not ensure inclusion of all important seismic-sensitive components, since in the construction of the internal event system fault trees, depending on the level of detail in the development of the trees, approximations may have been made to reduce the complexity of the trees. For instance, in modeling the faults of an injection train, the piping faults could have been excluded in the fault tree.

Consequently, when it is used in the seismic assessment, dependence on piping failure would not have been properly evaluated. It is not clear from the report that a systematic search was conducted to identify and select components for fragility evaluation to ensure that all components sensitve to seismic events are included in the analysis.

In the modularized system fault tree approach, intersystem and support system dependences are not explicitly modeled. LGS-SARA did include the com-mon mode failure of the diesel generators as a means of failing the systems.

I 3-4

[ -

l .

5 f Preliminary review of the fault trees appears to indicate that common mode diesel failure is one of the dominant scenarios leading to core damage. The

! BNL review of the Limerick internal event report (7) assessed that contributions from inclusion of the support system dependence constitutes a 60% increase. It is judged in the context of a seismic event that these dependence contributions will be quite insignificant.

In addition to those dependences discussed earlier, one dependence involves failure to transfer water source from CST to suppression pool. This operation is required for both the HPCI and the RCIC systems whenever there is a low CST level. An operator failure to transfer, given a low CST level, is

! likely to affect both high pressure systems. This dependence should be included to properly reflect its impact on the final results.

Electric Power' _

The failure of the electric power system is modeled with the failures of seven components; namely, two faults leading to tha loss of the 440-V power supply, three faults resulting in the loss of the d'1esel generators, one lea-l ding to losing the 4-kV bus, and one to loss of de power.

For both the HPCI and RCIC systems, loss of control power due to failure of the dc bus is assumed to disable the systems. In principle, it is pos-

! sible to operate the two high pressure systems in a total blackout condition for an extended period of time with the operator manually providing the con-trols necessary. Nevertheless, in the event of an earthquake, BNL concurs that the LGA-SARA assumption may be more realistic.

In the LGS-SARA Appendix B, it is estimated that at 1.0 g no significant damage to the diesel generator fuel oil tanks is expected, and at ac-celerations somewhat in excess of 1.0 g, failure of attachments would be likely.

It was identified in the Indian Point external event PRA review (3) (p, j 2.7.1-15) that the diesel generator fuel oil tanks are major contributors to l

i

3-5 core-damage frequency. The data reported in the Indian Point Safety Study 4 for the diesel generator oil tank are of a generic nature and the median ground acceleration capacity is estimated to 1.15 g. In light of this information, it is pertinent that the LGS-SARA report includes a more detailed analysis on the diesel generator fuel oil tank to show that they have the capacity much greater than 1.0 g to justify their exclusion from the system fault trees.

Human Error In the seismic part of LGS-SARA, it was reported that in estimating the error rates for operator actions required during seismic accident sequences, the probability of failure within a given time scale was increased by a factor of 10 limited to a maximum probability of 1.0. The factor of 10 is based on the fact that an earthquake sufficiently intense to damage reactor systems will initially disturb the performance of the operators and raise doubts in their minds about the performance of instrumentation and controls. The earthquake may also lead to component failures not nonnally encountered in plant operations and, therefore, may require innovative actions on the part of the operators.

It is BNL's judgment that during and subsequent to an earthquake, the operators' ability to follow procedures, to diagnose problems, or to take cor-rective actions depends on the intensity of the earthquake. Given the liraited information available in this area, it ic often difficult to quantify the j likelihood of failure under these unusual circumstances. However, one would expect that an :ncrease in the human failure probability is warranted.

Moreover, there are three factors which are also important in determining the human failure probability. One of them is the availablity of reliable instrumentation. Subsequent to an earthquake, with alarms and an-nunciators sounding, it may be difficult for an operator to adequately assess the plants true condition, since some instrumentation may give erroneous information. This is a much more challenging situation which significantly

3-6 I

increases the complexities confronting the operator. Two types of human failure may result, in addition to those normally considered in the LGS-PRA:

1) the operator may be misled by false instrument readings, and follow the wrong procedure in securing the plant; or 2) the operator may be misled by wrong and confusing information into an error of commission.

The second contribution to human failure that was not addressed in LGS-SARA is the effect of aftershcck upon the ability of the operator to discharge his responsibility. On the basis of seismic data, the probability of occurrence of aftershock decreases following an exponential type of pattern; in other words, the aftershock is mast likely to occur right after the first quake and that likelihood decreases as a function of time in an exponential-type manner. If an aftershock occurs within the time frame when operator action is critical, it may further impair his ability to respond to the demands of the plant.

The third area entails the subject of display instrumentation, which is intended to provide the operator with pertinent information to help him to understand the status of the plant. Display instrumentation could be in the form of lights, chart recorder, annunciators, alanns, etc. In the event of an earthquake or an aftershock, the failure modes of the display instrumentation could be: 1) display information inconsistent with other indicators, 2) loss of display function. LGS-SARA should furnish a discussion on this subject to

ensure that failure of display instrumentation has been investigated and is deemed to have no significant impact on final results.

BNL concludes that the increase in the human failure probability by a factor of 10 may be reasonable in some instances, whereas it may be conservative or nonconservative in others depending on the situation. An example of how the absence of readily available and reliable information can l

affect the operator's ability to pursue the proper actions is given for the CST. The CST is calculated to have a median ground acceleration capacity of 0.24 g, which is comparatively low in light of the other component values. It constitutes one of the two water sources from which the HPCI and the RCIC take l

1

3-7 suction. Failure of the CST would necessitate a transfer of the suction from the CST to the suppression pool. As for the HPCI, this transfer process is '

automatic, i.e. , given that there is a low CST tank level, an automatic switchover will be initiated; however, for the RCIC, this transfer is a manual operation. The failure mode of the CST water level sensors, given that the CST is failed, was not addressed in LGS-SARA. Nevertheless, one could postulate the following: 1) that despite the failure of the CST, whether it be ruptured or toppled over, the level sensors give a low level reading; 2) that in the failure of the CST, the level sensors are damaged and erroneous or misleading information results. Preclusion of one or the other would require a more detailed investigation of the failure modes of both the CST and the level sensors.

The occurrance of scenario 2 implies that the information given to the operator is misleading, and hence the failure probability for the operator to respond properly should be close to unity rather than based on an arbitrary rule of thumb - a factor of 10. It so happens that when this factor of 10 is applied to the HPCI and the RCIC transfer from CST to suppression pool, the human failure probability is unity. But there are other human operations within these system fault trees as well as other system fault trees which should be examined on a case-by-case basis to determine the respective human failure probability, for instance, manual failure to restart system, failure to transfer service water, etc. A detailed discussion of this impact upon system unavailabilities is deferred to the next section.

Finally, it is important to note that LGS-SARA did not convey to the re-viewers that the increase in human error was applied consistently to all the pertinent basic human events. BNL reviewed the LGS-PRA system fault trees and identified a number of manual operatior.s which are omitted in the seismic sys-tem fault tree consideration, for instance, the manual failure to initiate HPCI, failure to manually initiate the LPCS, and others. A more detailed investigation of the system fault trees is needed, and ' pertinent findings on manual errors should be included in the modularized system fault trees.

3-8 Relay Chatter It is reported in LGS-SARA that low accelerations cause a momentary inter-ruption of control circuits and power supplies (typically from relay-contact chatter); however, relay chatter is dismissed as a means of leading to system failure since the operator can intervene and reset the circuit, and hence restore the system to its initial state.

It appears that the question here is not whether the relays will chatter or at what acceleration they will begin to chatter, but what credit should be given to the operator to reset them if relay chatter occurs. If in one part of LGS-SARA, it is maintained that in the event of an earthquake, human error should be modified by a factor of 10 to reflect increased stress, it seems only consistent that these human responses to reset relays be treated similarly in assessing their failures. BNL is of the opinion that if there is relay chatter, failure on the part of the operator to reset would result in the equivalent of a relay failure.

If one wants to quantify the impact of relay chatter upon the system f ailure, then one would have to ascertain relay fragility information for the various kinds of relays. The Indian Point study (4) states that relay chatter occurs at 1.2 g and presents no major difficulty. The SSMRP data (5) show that chatter occurs at as low as 0.75 g (spectral acceleration).

Moreover, for certain relay chattar which results in a breaker trip, reset of the system may be readily possible at the control room; however, some relay trips may require resetting at local panels which substantially increases the failure probability of human to reset. It is important that LGS-SARA provides additional analysis on the fragility of relay chatter and its impact upon various systems. Failure of human action required to reset relay, which leads to relay failure, should also be considered.

Finally, there is the underlying question that, in view of the different relay trips, the operator is presented with a scenario for which he has not

3-9 been trained and for which no procedure has been written, what is the probabil-ity that he will perform adequately to reset the relays. Attempts to answer this question should be furnisned in LGS-SARA to support the premise that the operator can indeed reset the relays in a reasonable time and restore the system.

An example to illustrate these points can be fcund in the SLC fault tree.

There are two relays per SLC pump, for example, K4A and KSA for train A, K4B and K5B for train B, etc. If chatter causes these relays to terminate the operation of the three SLC pumps, this will lead to a direct failure of the SLC system. Furthermore, in the redundant reactivity control system, relay chatter may cause all APRM channels to fail, which in turn will result in failure to initiate the SLC explosive valves and the SLC pumps. In an ATWS accident event, the time available to an operator to respond to these challenges is also significantly reduced to the order of minutes. In light of this information, the impact of relay chatter upon the SLC system should be evaluated in more detail.

Transients A list of the LGS-SARA mean random failure values and the nomenclature is given in Table 3.1.2; the first column of values are those given in the LGS-SARA report. The second column tabulates the values used in the internal ev-ent risk assessment study, LGS-PRA. The third column denoted by NUREG/CR-3028 enumerates those values generated by BNL in the review of the LGS-PRA. The last column represents values that BNL believes should be used in the LGS-SARA study. Differences between the first and second columns are quite obvious.

Despite the fact that few explanations are furnished in LGS-SARA to address the differences for both high pressure systems, these differences are miniscule. But for the low pressure system (V) and the manual depressurization (X) function, a more detailed discussion is warranted.

As stated repeatedly in LGS-SARA, the seismic evaluation was based extensively on the LGS-PRA; therefore, it is reasonable to assume, unless

3-10 noted otherwise, that the nomenclature used would also correspond to that of LGS-PRA. The manual depressurization function, X, denotes the failure on the part of the operator to depressurize the reactor in a timely manner using the Automatic Depressurization System (ADS). The low pressure injection function (V) represents either the failure of the ADS hardware or a simultaneous failure of the LPCI and the LPCS systems. In the LGS-PRA, the X function unavailability is calculated to be 2 x 10-3; the V function value estimated by BNL is based on the LGS-PRA unavailability of the LPCI and LPCS systems given that there is a loss of offsite power and a failure to recover offsite power to be 2.65 x 10-4 According to the information provided on p. C-15 of Table C-6 of the LGS-SARA, it appears that the V function defined in the report consists only of the LPCI and the LPCS systems; this notion is further confirmed in the Boalean expression of X = X R+A shown on p. C-14 of Table C-5. XR is defined in the report as the random failure of X and A, as the loss of electric control and motive power. Since the manual action to depres-surize the reactor does not require electric control or motive power, it is possible to argue that the hardware failure of the ADS is lumped with the X function without much impact on the function unavailability. However, this is not consistent with what has been presented in the LGS-PRA, and may result in misleading conclusions of dominant sequences. The impact of properly including the ADS hardware failure within the V function for various accident sequences will be addressed in Section 3.1.2.

Quantification of the RHR system with the loss of offsite power and no recovery was not performed by BNL nor by PECo and hence no value is reported in LGS-PRA and NUREG/CR-3028. The most substantial increase between the LGS-SARA and NUREG/CR-3028 internal event values occurs with the V function -

a factor of 3.7 followed by a factor of 3.0 increase for the X function.

The common mode diesel generator failure probability of 1.88x10-3 was )

reported in earlier revisions of the LGS-PRA, and that this value was used in the NUREG/CR-3028. Subsequent revisions to LGS-PRA modified the l unavailability to 1.08x10-3, claiming that the earlier version was a typographical error. In LGS-SARA, a diesel generator common mode failure mean

3-11 value of 1.25x10-3 was reported. BNL agreed that the 1.88x10-3 value is overly conservative. Recently, studies (6) to better evaluate the diesel common mode unavailability have suggested values below 1.0x10-3 In this review, BNL will use the 1.25x10-3 for comparison purposes.

The increase in numerical values for the HINIA and RIN3 is due to the following: HINIA and RIN3 represent failure to provide flow from the suppression pool, given that the CST water is unavailable. The major difference between the two events lies in the manual action required to perform the operation for the RCIC system, FSAR, p. 7.48. Consequently, if a factor of 10 increase is assumed, the manual error for failure to transfer becomes unity and dominates the failure of the RCIC system. Because of the automatic transfer function in the HPCI, a similar increase in the manual error results only in minimal increase in the system unavailability. If, instead, a human factor of 7.5 is used, the RIN3 will be 0.75, whereas, HINIA would remain unchanged.

Another major change that is evident if the factor of 10 increase is used in the manual depressurization function. This increase results merely from applying the human error factor of 10 to the NUREG/CR-3028 value of 6x10-3, It appears that for HIPIA, RIN3 and X, the increase due to the human error factor was not included in their values as it should be.

Anticipated Transients Without Scram In the event of an earthquake resulting in an ATWS, LGS-SARA analyzed the sequence using a loss of offsite power ATWS event tree. A set of mean failure values that was used in the LGS-SARA analysis is shown on Table 3.1.3. The first three columns in the table present v.11ues used in the LGS-SARA study, the LGS-PRA, and the BNL internal event review, NUREG/CR-3028, respectively.

The-last column represents values which BNL believes should be used in the LGS-SARA analysis. It should be pointed out that these values are representative numbers; one should refer to the reports indicated for more detailed information.

I 3-12 I

LGS-SARA values for both the HPCI and RCIC failure values are in general lower than those of the LGS-PRA and NUREG/CR-3028. The increase for RCIC, RR , is about a factor of 6.6 times. As for the ADS inhibit function, the LGS-SARA value is 8.0x10-3 vs 2.0x10-2 from NUREG/CR-3028; another factor of 10 increase due P.o the intense stress level for the operator brings the final value (last t.olumn) to 2.0x10-1 There is no disagreement on the values of UH as assessed by BNL and LGS-SARA. Little increase is noted between the LGS-SARA and BNL values for the SLC system; however, the LGS-SARA value is about a factor of 10 larger than the LGS-PRA value. W2 was reported in LGS-SARA to be 0.1 rather than the 0.14 used in the LGS-PRA. The diesel generator common mode failure, HINIA, and RIN3 failure values are described in the previous paragraphs.

The value selected for the mechanical failure of the scram system increased to 1.5x10-5 The variable PCR is defined in the text of LGS-SARA to have a value of 0.2, but no description of PCR is provided. Failure to scram is defined in LGS-SARA as CM = (1-PCR ) CR + PCR (S3+S5+S) 7 A telephone conversation with PECo revealed that the PCR is a judgmental factor applied to the seismic failure of the reactor internals and CRD guide tubes (see Figure 3.1.2). PECo stated that failure of the CRD guide tubes or the reactor internals due to an earthquake would cause a failure to scram only 20 % of the time. Since information on how this PCR value is obtained is incomplete, it is difficult for BNL to judge its validity.

Another area of concern is in the treatment of random failure to scram; BNL believes that, if there is a challenge to the scram system, the failure to scram probability should not be weighted by a factor of (1-PCR )= 0.8. Also in the telephone conversation with PECo, it was explained that they attempted to preserve the scram f ailure probability from the 0.8 reduction by increasing the scram failure probability from 1.0x10-5 to 1.5x10-5 It is suggested that a more detailed documentation of these points by PECo be provided in LGS-SARA.

3-13 For the purposes of sequence quantification to be presented in the next section, failure to sf. ram is defined by BNL as follows:

Cg = CR+S3+SS+S* 7 Finally, it is suggested that a detailed discussion be provided in LGS-SARA to identify and reconcile differences in the random failure values used in LGS-SARA and LGS-PRA.

3.1.2 Accident Sequence Analysis This section addresses the definition of accident sequences and the quantification of core damage probability in the event of an earthquake.

Section 3.1.2.1 briefly describes the approach and methodology used in LGS-SARA for accident sequence definition and core-damage quantification.

Section 3.1.2.2 contains results of the BNL review.

3.1.2.1 Overview of LGS-SARA Accident Sequence Analysis LGS-SARA examined various fragility estimates (provided in Appendix B) and concluded that the offsite pcwer system was most susceptible to an earthquake which, when failed, would result in an initiating event. Failure of pipes and valves causing an initiating event is dismissed as highly improb-able in light of the significantly greater capacitics of these components.

For this reason LGS-SARA maintains that the f equency of a seismically induced LOCA (large, medium, or small) is insignificant. The simultaneous occurrence of an earthquake and a random LOCA event is also estimated to be smaller by a few orders of magnitude than the loss-of-offsite power event. Therefore, only the seismic-induced loss of offsite power was investigated as a credible initiating event.

The event tree method was used to define the accident sequences. A total of three event trees were developed: the first event tree depicts the suc-cess or failure of a number of critical functions whose operation or inopera-

3-14 tion greatly affects the analysis to be followed (see Figure 3.1.3). This tree is made up of five functions, namely, the seismic-event-initiating frequency, reactor pressure vessel, reactor and control building, and reactor scram. Failure of the reactor pressure vessel due to an earthquake leads directly to core damage. The failure was identified to be initially the failure of the vessel supports which, in turn, results in of all four steam pipes being severed. To mitigate such a breach of the reactor coolant boundary is far beyond the capability of the ECCS.

If the reactor pressure vessel stays intact, failure of the reactor and control building will result in core damage regardless of whether there is a successful reactor scram or not (Sequences 4 and 5). If, however, the reactor building does not fail, then failure of offsite power coupled with either successful or unsuccessful scram would lead to transfers to Figures 3.1.4 and 3.1.5, respectively.

The event tree presented in Figure 3.1.4 is identical in structure to that of the internal loss-of-offsite power event. Systems which are re-quired to mitigate the event are assessed and accident sequences are defined.

In Figure 3.1.5, the mitigation of an ATWS event is presented. Its structure is again identical tc the one given in the LGS-PRA for loss uf offsite power.

Inputs to these event trees for individual systems are based upon the modularized system fault trees, and a discussion of these trees is provided in Section 3.1.1. Quantification of these event trees was performed using the computer code SEISMIC. The Monte Carlo method is used in the code to simulate the failure probability of seismic and random failure of components and accident sequence frequency is then calculated on the basis of the Boolean expression inputed for that particular sequence. Median and mean values, and confidence levels of the sequences are also evaluated and those for the dominant sequences are reported.

3-15 3.1.2.2 BNL Review of Accident Sequence Quantification BNL reviewed the event trees and assumptions which enter into the de-velopment of these trees. Review comments are presented in this section. A number of areas were identified which warrant further discussions, and they are also presented in this section. As a result of the revisions made to the modularized system fault trees, estimates of their impacts on respective accident sequence core-damage frequencies are described.

Methodology The event tree - fault tree methodology employed in the LGS-SARA represents a widely practiced approach used within the nuclear industry today to assess accioent sequences and core-damage frequencies. BNL agrees that it is adequate in evaluating risk indices within the context and requirements of today's risk assessment studies.

The LGS SARA analysis is based extensively on the approach and results of the LGS-PRA. Two event trees from the LGS-PRA were adopted to analyze the seismic-initiating event. They are the transient and ATWS loss-of-offsite power trees. While BNL agrees that these trees will model the loss-of-offsite power event adequately if caution is exercised in addressing the dependent failure of components due to an earthquake, additional information should be included in LGS-SARA to establish why the seismic event evaluation can be based extensively on the internal event analysis. In other words, it should be shown that external event accidents do not warrant separate event trees to model the different scenarios. The rationale on why the LGS-PRA event trees were used should reflect these concerns.

Initiating Events As described in Section 3.1.2.1 of this review and in Chapter 3 of LGS-SARA, the loss of offsite power due to failure of the switchyard ceramic insulators (median ground acceleration capacity of 0.20 g) was identified to

3-16 1

be the major initiating event contributor. Failure of the reactor and control building and of the reactor pressure vessel has also been included in the consideration of initiating an accident event. BNL agrees that these are

- important initiating scenarios that should be investigated.

Nonetheless, it is not clear from what is reported in LGS-SARA that the search for initiating events went beyond those components and some structural members. In particular, it is not obvious that effort was devoted to ex-amining the non-safety-related equipment or equipment not important for a safe shutdown of the plant to determine if they could become initiating-event contributors in an earthquake. These two types of equipment are not subjected to the same rigorous seismic qualification standards as other seismically qualified components. Depending on the capacities of these non-safety components, an earthquake with low ground accelerations might cause a reactor trip without failing the switchyard ceramic insulators. Such an event will initiate a transient which should be evaluated by event trees similar to those presented in Figures 3.1.4 and 3.1.5. The difference between the event trees is that there is offsite power in this case. In the event that a transient does not occur given an earthquake, then the sequence is a success event.

For example, the feedwater system is not required for a safe shutdown of the plant nor is it safety related; however, if an earthquake occurs, control, relays, and other components of the feedwater system may generate a trip of the system which will result in a reactor transient.

In Figure 3.1.3, the event T , Ssequence number 1, was treated as an OK sequence. A note at the bottom of the figure states that a seismic event that does not lead to the loss of offsite power is considered to be benign and is adequately accounted for in the turbine-trip-initiating event.

If, in an earthquake, offsite power is still available, the event tree presented in Figure 3.1.3 does not model the plant response beyond that point.

In principle, according to the event tree, the reactor is not even scrammed and, therefore, there is no need for it to be transferred to the turbine-trip

3-17 event tree. However, if there is failure of non-safety equipment or tripping of the equipment offline which results in a plant transient, such as the loss of feedwater, then the event tree should be further developed to define the accident sequences. The internal event turbine-trip event tree is not appropriate since the mitigation system considered will not include the necessary seismic failures. The new event tree will be similar to the one in Figure 3.1.4 with certain random failure values modified to reflect the availability of offsite power. BNL estimated that by transferring T3 to this new event tree, the only sequence which may contribute to the overall core damage would be ST UX. The core-damage probability is estimated to be in the order of 10-7 to 10-8, If, in the reactor transient, there is a failure to scram, an event tree similar to Figure 3.1.5 should be developed. It is conceivable that the contribution to risk due to Class V sequences may not be negligible. It is recommended that these considerations of additional accident sequences should be addressed in the LGS-SARA.

Not Event Quantification LGS-SARA stated that non-failure states are included in the Boolean expression of the accident sequences and therefore in the quantification process. BNL performed some preliminary estimates of the core-damage probability for the six dominant sequences as identified in Table 3.1.4, and the results are also provided in the table. The values under the LGS-SARA column come directly from Table 3.2 of the LGS-SARA report. In an earlier draft of this report (August 15,1983), a question was raised as to the appropriateness of the LGS-SARA NOT event quantification. As a result of discussions with PECo and its consultants, NUS, and of a re-examination of BNL's preliminary estimates, it appears that there is a reasonable agreement (see Tables 3.1.4 and 2.1.1).

3-18 ADS Seismic Failure A discussion of how LGS-SARA modeled the ADS in the seismic system fault tree is given in Section 3.1.1. It is inferred that the failure of the ADS hardware is included in the definition of X which is the manual depressuriza-tion function, X=A+X-R XR represents the random failure of the manual depressurization function; A comprises seven different types of electric failures, including the loss of the 440-V power supply, the 4 kV supply, the diesel generators, and the dc power. LGS-SARA conservatively assumed that the failure of all these events would lead to a failure of the ADS hardware. In essence, only the failure of the de power supply would lead directly to an ADS failure. It is, of course, obvious that the availability of ac power provides added assurance of the reliability of the de power supply; however, failure of the 440-V bus does not result in failure of the ADS. It is for this reason that LGS-SARA is conservative when it assumed that X = A + XR -

Since NOT events are considered important in sequence quantification, they should be included in the sequence evaluation. However, a conservative definition of X, may lead to nonconservatism in other sequences, which although not necessarily manifesting itself in the change of the core-damage

! frequency, may substantially affect the risk evaluation.

Fcr instance, if accident sequence T E 3SUX (sequence No. 6 in Figure j 3.1.4), is calculated by assuming either the 440-V, the 4 kV, the diesels or the de power will fail the function, then a NOT-X event will imply that these

!- various types of power supplies are available. This represents a l nonconservative departure from the system modeling, since the operation of ADS can only imply that de power is available. This will tend to underestimate sequences T33 E U, T 33 E UW, and T 3S E UV. The impact may reside in underestimating the contribution to accident Class IS, whereas the change in l

l l

3-19 core-damage probability may be inconsequential. Other risk indices, such as latent and acute fatalities, may be affected differently.

One of the approaches to addressing this concern is to integrate the ADS hardware witn the low pressure injection function, V, consistent with the LGS-PRA definitions.

Sequence Quantification The focus of this discussion will be primarily on the six dominant sequences identified by LGS-SARA and on other sequences which BNL believes will reflect some impact on the risk indices.

(I) Dominant Sequences If the modifications in Section 3.1.1.2 and this section are included in the sequence quantification, only three of the six dominant sequences are significantly affected. Table 3.1.5 enumerates the changes in core-damage frequency given a modification in system unavailability for each of the dominant accident sequences. The core-damage frequencies tabulated on Table 3.1.5 are preliminary estimates only. The first column identifies the six dominant accicent sequences. Two of them are ATWS events: TECC 33gg and T3BM R C . The value in parentheses following each sequence name is the core-damage frequency as calculated in LGS-SARA. The second column depicts the system which is modified when the sequence is requantified. The value in parentheses denotes the revised system unavailability. The last column is the core-damage frequency as a result of the requantification. The sequence T33 E 0X is calculated in LGS-SARA to have a core-damage frequency of 3.1x10-6 and if the manual depressurization function andom failure is modified to the new BNL value of 6.0x10-2, BNL estimated that the core damage will increase to about 4.0x10-6 It is assumed in the calculation that beside X, all other components retain their values as suggested in LGS-SARA. Similarly, if only the U function is modified, an increase from 3.1 to 3.8x10-6 is observed. Increases in the failure to transfer from the CST to the suppression pool produce similar results, 3.8x10-6 If all these modifications are integrated into the accident sequence T 33 E UX, the

3-20 total core-damage frequency is about 5.2 x 10-6, an increase by approximately a factor of 1.7.

If one assumes that both the HINIA and the RIN3 become unity and the other system values are those of.the LGS-SARA, then the core-damage frequency for the accident sequence T E 33UX becomes 4.0 x 10-6 In other words, if 4

there is a total failure to tri.nsfer from the CST to the suppression pool, because of human dependence failure or failure of all CST level sensors, the core-damage frequency increases by a factor of about 1.3.

The other two affected sequences affected are the ATWS sequences. BNL revised the definition of CM to reflect a more prudent approach in view of the lack of information in LGS-SARA on the definition of mechanical failure to scram. The BNL definition, Cg=CR+S3+35+S7 .

leads to an increase of about a factor of 5 for both the T E C C3 3 g 2 and the T 3B R Cg accident sequences.

There is no impact for the remaining three dominant sequences as a re-sult of the modifications in Table 3.1.2. The total core-damage frequency is increased by slightly less than a factor of 2. This increase does not include the contribution from considering the NOT events.

(II) T33 E 0V Accident Sequence The core-damage frequency of the accident sequence TS3 E 0V is calculated in LGS-SARA to be 5.9 x 10-9 The Boolean expression of this se-quence can be written as follows:

T33 E UV = T 3RPW B3 E GUYV ,

= T3641M T 5 S E XUV .

i l

3-21 If one uses the definitions of V and X provided in LGS-SARA, the following expression will result:

T33E 0V = T364M T 5 5 YRIS S 3I 2 17 + E R IS V H R1RRR (3.1)

+ YRIS IS17 HR R R + IRIS I2R SVG .

where Sj, i = 1,2,.. 17 are the seismic-induced component failures; a de-tailed listing is given in Table 3.1.1. The bar above each variable denotes a NOT event. Cg is the mechanical failure to scram; A is seismic failure of the electric power system; the subscript R denotes random failures. H and R represent the HPCI and the RCIC systems, respectively. G denotes the combina-tion of transfer and high pressure system failures, and is defined as follows:

G = HINIA

• RIN3 + HINIA *-RR + RIN3

• HR

• However, if one uses the BNL definitions of X and V, namely, X = XR and V =

LPCI

• LPCS + ADS, where LPCS and LPCI are the same as those defined in LGS-SARA, and where the added tenn ADS is the sum of the ADS hardware random failure AR and the electric power A, the following Boolean expression is ob-tained:

T33 E UV = T T 5 5R1 364M I S A + Y RS 132S17

+YSRHVR1gRR+ISRHSR 1 R R 17 (3.2)

+YSRHAgigRR+IS3R12 GVR

+YS3 R12 GAR -

VR represents the random failure of the LPCS and LPCI systems. Compari son of the two expressions in Eqs. '3.1 and 3.2 indicates that except for NOT-A, Eq. 3.2 contains all the terms of Eq. 3.1 and three more terms besides. These terms contain a failure of the electric power system and failure of the ADS hardware given the loss of high pressure injection. BNL did not estimate the contribution of this sequence as a result of the modifications made. It is suggested that a more detailed analysis be provided in LGS-SARA to better identify the contribution of T E330V to core damage and to the final risk.

1 l

l l

3-22 (III) Other ATWS Sequences BNL reviewed the LGS-SARA ATWS event tree and found that, in addition to those two dominant ATWS sequences, T E C C33g2 nd T R C , the contribution to SBM core damage from other ATWS sequences defined in Figure 3.1.5 is relatively small. However, with the BNL definition of gC , there will be about a factor of 5 increase for all the ATWS sequences in Figure 3.1.5. The total ATWS core-damage frequency reported in LGS-SARA is 8.1 x 10-7; by eliminating the PCR and using the BNL CM definition, the total ATWS core damage becomes approximately 4.0 x 10-6 This does indicate that the ATWS results are quite sensitive to the parameters used to define the failure of scram. PECo believed that it is conservative in assuming that those failure modes defined for the reactor internals and the CRD guide tubes will directly cause a failure to scram. BNL tends to agree that the definition of failure modes of these components may be conservate and would encourage additional analysis to support the LGS-SARA assumptions. A refined analysis in this area is needed since it will have significant impact on the acute and latent fatalities.

Examination of ATWS function unavailabilities provided in Table 3.1.3, reveals a number of major increases in the random failure probabilities: a factor of about 1.6 for the HPCI; a factor of approximately 6.6 for the RCIC; a factor of 25 for the ADS inhibit function; and a factor of 1.4 for the W2 functions. BNL did not reassess those accident sequences affected by these modifications; however, because of the change in magnitudes of some of these functions, and the fact that significant contribution to risks comes from the Class IV events, it will be prudent to evaluate the effects of these changes upon the results on core damage as well as the final risks. Sensitivity analysis would also provide helpful insight in the evaluation of these accident scenarios.

(IV) Summary l l

BNL did not reassess the final core-damage frequency as a result of all the proposed changes. A few of the areas identified require more detailed 1 1

l 3-23 analysis, whereas others need additional information to substantiate the as-sumptions. Requantification of some changes was made wherever possible, and results are discussed earlier in this section. It appears that for these modifications investigated, at most a factor of 2 changes to the core-damage frequency is observed. In view of the large uncertainty associated with the seismic accident sequences, these changes in magnitude do not constitute any significant impact on the core-damage frequency, but their effects on the acute and latent fatalities may be significant.

s N , M.-qi-er ryw y_-, ., , . __,

- - . , g

1 l l- 3-24 FAILURE TO PROVIDE ADEQUATE FLtN FRCM HPCI l HNI I I i -l' RANDCM KIXTURE CF SEISMIC RANDOM AND LNDEPDDEM SEISMIC FAILLPES FAILURES FARURES I we lI i I O n A I I

' FAILURE TO SEISMIC SUPPLY WATE.9 CST FRCM SUPPRESSICN PCCL RUPTLRC c"6' SUPPR S C.N POOL DUE TO SEISMIC TRANSFER CN FAILURE VATER LCSS CF RHR H/E I 1I

• a i I Figure 3.1.1 Reduced fault tree for the HPCI system.

4 i

, - - - - - - - - > _ , . - - - - . - . _ . . wr, - - , , - - - - - , - - , ,--,--,----r ,-g- r -

3-25 FAILURE f3 SCRAM I I N

l $

ORE' E T ChE SIG L RE ENT SCRAN MECH. SEFCRC SCRAM FAIL "ECH. FAIL RANOCM FAILURE SEISMIC Cr SCRAn

,5YSTEM FAILURES I I I I i

l i I SEISMIC FAILURE SEISMIC SEISMIC Cr REACTCR FAILURE CF FAILURE CF INTERNALS CRD GUIDE MYCRAL1.IC (SHROUD SUPPCRT) TUBES CCNTRCL UNIT I II II I Figure 3.1.2 Reduced fault tree for failure to scram.

wbcn d

e s d as s I r

a ol a S S ]

g gc c I I j t

e D S y

ec r 8 9 na l c n e 7 7 7 a u ne f - -

e n e uq u ona r s K 3 3 - - -

0 0 0 Mn4e O .

6 4 4

r ig a c S f r t 9 1 8

F g y C Cg V le

• 3 S D P t

3 R R t

" o T E E i c S 3 3 S 3 T T T T T

"' o.l 1 3 4 5 G f

1

'"d f

C S

C II e

e

- r t

. t

... n e

.. v

" ' le e

t a

S c

" t i

a E .

i a

v .

. m s

. i e

. s e

. L, h

I.

T r g _

, W o lon 9 tc dnt r d i B , 3 f

a a nl R ,

e i R oW c ,o ,si 1.

, n oi3

. p

. e

.f r eug r

h t

r i

,o ,u F t

f r

ore 1

. d.

i

. T u V t .

s s s s P .. , ,U me R, p e

v A .. o, d.

_. no,u

. C

,. C.

.. s, y

. l.

E.

J

. q cc t . r, d.

f n , ,

, .e ime s u S ,

ie q T ,

. d s

S re f 1 A.

1. 8 t e.ety Teenster 1.wn Luw Mean annua 8 D.w ane4

$/M Vs L'R Vs w ,,, Lorpienn 5,g  %,,. . c .

F. wee 3- 7 wn escime HCIC ,,,,,g ,,,.,g, he et eemad g cm

.. s.u. te.p.n dem Ii ss M P U M V W 1 TE3$ OK 2 TEw g5 107-7 U/IS 3 TEU S$ OK 4 T$SE U" '

5 T3gE uv 535 9 as e

N N

6 T33E ux 315 6 I 7 13E.P OK 8 I E PN 107 9 11L15 S3 g ig3E PO OK 10 TE7Uw gg e 11 T$$

E PUV 8 1 12 Tg3 E Pux 31$.3 I 13 TEM

$3 8

Figure'3.1.4 Seismic event tree for loss of offsite power with reactor scram.

wCD

• l I

NE - - - M Y

I - M* - - - -

Z D

L L

U E L E D

• e 3 m 8 8 l

- 0 9 8 e '

0

• Wc.

K

• K K 0 0 2-5 0 E E n n e e s 4 W'

p w ,, O O '4 1 6 OO e e e 0 O iP e e o*O O S

t e e e e b e e g 3

y

, , s,, O u 3

2 l 2 a g *g ng u, o, u,j #

2 r, p / f, =2 2 3 3, g l

3, 3

" 2 Wtwu uuw0tusutu 'u "u* uruD C, Cs C C.

C,, C,, f6uC u u u uu w3 I

u , C C

• ' **** u C, "u uu Dg uu f C C C n 4

s s P

u P

u "u C C u fu u C.

s gC u

C3 g g s g gyC cg gCg sC C C C g s g g b S g [ C., C g C., g C., C c., t g #1 f. f. fg

( s fC t t h is f g Ig 6., i is Is s E E

T g

i I

g gE s tg g g I

f i i i I t t T

g t f

t f

i I

I I

I t

h i

I g

f I$

L.,

f i

I g

t Ig R t$

t t

y l

I g r$ tg I I t

2 3 4 6 6 I e 8 0 3 2 3 o S 6 7 1

e t 1 a 0

2 1

2 2

2 3

2 4

2 nJ a, 3 2 n2 . 03

% ,,* 3 8 3 9 3 t I 8 es g

c y

Ma. e 6 l se 8 a= m e H n 7 e

• r1 0 ,e l y3 0

= e.

e n v .

e H

e m

Mr. s y

a r

2 see c m

gi s

[ ,I t

u C

s Cs *ea

~ h o

u, t

• s H e n'*' a C ' . i

• • P n " w

• l 11 r

8 e

e w s.

o

• "8 sea. p k $m'ba i

t a

• a e u

e t

i s

f f

C o

e n

. C u f w M

h. o s

e. s e s o

w l C s C

u r de o f

e e

r e t

**i

• a o 9

• m t

'e s n n O O e v

e

• 's c

• ' e i

• 'm '

u m

" "' m

• 4 s

"'a , -g i n ,

e S _

m C p

5 M 1 e  :

n e

p 3

e n

'er e e o 3 p

u r

wpe y

g L i 2C F t

S

=n -

• = e. ,

sn s Cg a e e c i a

opa E g

Cs

3-29 Table 3.1.1 Significant Earthquake-induced Failures Median ground Failure cause acceleration No. Component or mode capacity S O R U 9

Si Offsite power (500/230-kV Ceramic insulator 0.20 0.20 0.25 switchyard) breakage S2 Condensate storage tank Tank-wall rupture 0.24 0.23 0.31 S3 Reactor internals Loss of shroud support 0.67 0.28 0.32 S4 Reactor enclosure and control structura Shear-wall collapse 1.05 0.31 0.25 SS CRD guide tube Excess bending 1.37 0.28 0.35 S6 Reactor pressure vessel Loss of upper support 1.25 0.28 0.22 bracket 57 Hydraulic control unit Loss of function 1.24 0.36 0.52 S8 SLC test tank Loss of support 0.71 0.27 0.37 S9 Nitrogen accumulator (SLC) Anchor-bolt shearing 0.80 0.27 0.20 S10 SLC tank Wall buckle 1.33 0.27 0.19 Sil 440-V bus /SG breakers Power circuit 1.46 0.38 0.44 S12 440-Y bus transformer Loss of function 1.49 0.36 0.43 breaker S3 1 125/250-V dc bus Loss of function '.49 0.36 0.43 S14 4-kV bus /SG Breaker trip 1.49 0.36 0.43 S15 Diesel-generator circuit Loss of function 1.56 0.32 0.41 l S16 Diesel-generator heat and Structural 1.55 0.28 0.43 vent S17 RHR heat exchangers Loss of lower support 1.09 0.32 0.34 (anchor bolts) i

- 3-30 ,

l Table 3.1.2 Mean Values for Random System or Function Failures Used in Transient Events LGS-SARA LGS-PRA NUREG/CR-3028 BNL (this review)

HPCI 8.8X10-2 0.07 0.1157 0.1157 RCIC 7.6x10-2 0.07 0.07 0.07 V 1.0x10-4*** 2.7x10-4 3.7x10-4* 3.7x10-4*

W 2.6x10-4 -- --

2.6x10-4**

HINIA 1.0x10-2 1.0x10-2 1.0x10-2 1,0x10-2 RIN3 7.0x10-3 7.0x10-3 7.0x10-3 1.0 1.25x10-3 1.08x10-3 1.88x10-3 1.25x10-3 DGC X 2.0x10-3 2.0x10-3 6.0x10-3 6.0x10-2

• With ADS hardware and no offsite power.

• • With no offsite power and only RHR.

• • • With LPCI and LPCS only.

HPCI - High Pressure Coolant Injection RCIC - Reactor Core Isolation Cooling V - Low Pressure Injection Function W - Containment Heat Removal Function HINIA - Failure to Transfer From CST to Suppression Pool in HPCI RIN3 - Failure to Transfer From CST to Suppression Pool in RCIC DGC- - Diesel Generator Common Mode Failure X - Manual Depressurization.

3-31 Table 3.1.3 ATWS Mean Random Failure Values SARA LGS-PRA NUREG/CR-3028 BNL (this review)

HR 8.8x10-2 0,1 0,14 0,14 RR 7.6x10-2 0.5 0.5 0.5 0 8.0x10-3 2.0x10-4 2x10-2 2x10-1 UH 2.0x10-3 20x10-4 2.0x104 2.0x10-3 C12 1.6x10-2 1.5x10-3 1,4xio-2 1,4x10-2 CM 1.5x10-5 1.0x10-5 1.0x10-5 1.0x10-5 HINIA 1.0x10-2 1.0x10-2 1,0x10-2 1.0x10-2 RIN3 7.0x10-3 7.0x10-3 7.0x10-3 1.0 W2 0.1 0.14 0.14 0.14 PCR 0.2 -- --

1.0 OGC 1.25x10-3 1.08x10-3 1.88x10-3 1.25x10-3 HR HPCI random failure RR RCIC random failure D ADS inhibit failure Ug Failure to control reactor vessel level 8 C12 Failure of two or three SLC pumps CM Scram failure-mechanical W2 Failure of both RHR PCR Fraction of events that lead to scram failure *

• Definition not given in LGS-SARA, inferred from modularized system fault tree.

i

+ - , , . - . ,

3-32 Table 3.1.4 Dominant Seismic Core Damage Sequences Sequence Class LGS-SARA BNL Estimates T33E UX I 3.1x10-6 2.8x10-6 IS 9.6x10-7 9.5x10-7 TRSB 4,4x10-7 T 3?.PV S/III 8.0x10-7 TECC33g2 III/IV 5.4x10-7 6.0x10-7 TRC IS 1.4x10-7 3.5x10-7 3BM TEW II/IS 1.1x10-7 1.1x10-7 33 Total 5.7x10-6 5.3x10-6

3-33 Table 3.1.5 Dominant Seismic Sequences With BNL Changes Sequence (Core System Modified Core Damage

• Damage Probability) (Unavailability) Frequency T33 E UX (3.1x10-6) X (6x10-2) 4.0x10-6 U (8.1x10-3) 3.8x10-6 HINIA, RIN3 (1x10-2,1.0) 3.8x10-6 All combined 5.2x10-6 TECC3 3 M 2 (5.4x10-7) CM 3.0x10-6 T3B R Cg (1.4x10-7) CM 1.8x10-6 T3PRV (8.0x10-7) --

8.0x10-7 T33 E W (1.1x10-7) --

1.1x10-7 TR3 B (9.6x10-7) --

9.6x10-7 Total 5.7x10-6 1.2x10-5**

• Based on LGS-SARA sequence values.

• • Sum total of T 33 E UX (combined) and the other 5 sequences.

• l

3-34 3.2 Fire The objectives of this section are to give a brief presentation of the LGS-SARA approach to quantification of the accident sequences generated as a consequence of fires in the different critical zones along with the cor-responding results, to describe the BNL modifications to the quantifica-tion, and to present the revised results. This section is organized as fol-lows.

Section 3.2.1 summarizes the LGS-SARA approach to quantification of ac-cident sequences and presents the mean values for the frequency of core damage for the different fire zones. Section 3.2.2 presents the detailed BNL review of the different fire types for two fire zones: Fire Zone 2, whose fire growth event tree is similar in structure to all other fire zones except for the second fire zone described here; i.e., Fire Zone 25. In this section the fire growth event trees for all other fire zones are also presented, but the details are given in Appendix A. In Section 3.2.3 a summary of the review results is presented.

3.2.1 Overview of the LGS-SARA Accident Sequence Quantification For each critical zone the LGS-SARA (1) report identified the following steps used in the quantification of accident sequences:

1. Identification of potential initiating fires within the fire zone; the following types of' fire were considered:

a. self-ignited cable raceway fires,

b. self-ignited fires in power distribution panels, and

c. transient combustible fires.

2. Evaluation of the frequency of each of the above types of fires within the fire zone.

3. Subdivision of the growth of fires into several intermediate stages between ignition and damage to all safe shutdown systems served by ca-bling or components located within the fire zone.

3-35

4. Evaluation of each fire growth stage in terms of (a) the probability of failing to suppress the fire before reaching each stage, and (b) the shutdown systems that remain undamaged at each stage.

5. Evaluation of the conditional probability of core melt at each stage of fire growth, taking credit only for the reliability of systems not already damaged by the fire. This was achieved by modifying the fault and event trees developed in the LGS-PRA.(2)

6. Evaluation of the core-damage frequency associated with individual fire growth stages by combining the frequency of failure to suppress the fire at each stage of growth and the associated probabilities of core damage from random failures of the undamaged systems.

7. Summation of the core-damage frequencies associated with each damage stage for all types of fires to obtain the overall fire-induced core-damage frequency for the fire zone.

Following the above described steps a fire-induced core-melt frequency of 2.3x10-5/yr was obtained in the LGS-SARA report; the breakdown of the con-tribution of the different fire types for each fire zone is given in Table 3.2.1 (LGS-SARA Table 4.6, modified to correct some typographical errors).

3.2.2 BNL Revisions in Quantification of Accident Sequences The BNL review of the LGS accident quantification considered each of the steps identified in Section 3.2.1. Review of steps 1 through 4 is described in detail in Section 2.2, and the main disagreements found in this review are summarized below,

a. A reduction factor of 5 in the frequency of self-ignited cable raceway fires was used in the LGS-SARA report. As described in Subsection 2.2.2.1.1, the BNL review indicates that a reduction factor of 3 is more appropriate, if we use the existing data base.

b. It is the BNL judgment that the probability of fire suppression suc-cess-is overestimated in the LGS-SARA report. On the basis of the discussions in Section 2.2.2.3, the following probabilities of failure I to extinguish a fire in t minutes, P(t), are used in the BNL review:

i 3-36 P(10) = 0.43 P(30) = 0.195 P(60) = 0.08 The following values were used in the LGS-SARA report: 0.40, 0.15, and 0.04, respectively.

Review of step 5, evaluation of conditional probability of core melt at each stage'of fire growth, is based on the BNL review of the LGS-PRA(7)

(NUREG/CR-3028). It is noted that a computer reevaluation of system unavailability or core-damage fault trees was not made; only hand calculations were performed.

The approach used in the reevaluation of steps 6 and 7 is essentially the same as used in the LGS-SARA report; the results of the review of steps 1-through 5 are used in the BNL review.

In thc t ::bwing sections, a detailed review of accident sequences for Fire Zones Z u.J 25 is described, along with the respective fire growth event trees for the other zones. In this review, the following will be presented for each-fire type: frequency of fire, fire-induced transient, undamaged mitigating systems, and dominant sequences for each fire growth stage.

3.2.2.1 Fire Zone 2: 13-kV Switchgear Room a .' Quantification of Fire Growth Event Tree for Self-Ignited Cable-Raceway Fires.

The fire growth event tree for Fire Zone 2 is shown in Figure 3.2.1, and the evaluation of the branch point probabilities is discussed below.

Event A: Frequency of Cable-Raceway Fires The frequency of cable-raceway fires is computed by multiplying two quantities: (1) the ratio between the weight of cable insulation in thit Zone (8736 pounds) and the total weight of cable in the reactor enclosure and control structure (172,799 pounds) and (2) the frequency of cable fires per reactor year:

3-37 8,736(lb) 5.3x10-3 172,799(1b)x (- 3 ) = 8.9x10-5/yr, where the frequency of cable fires per reactor year is 5.3x10-3, and the reduction factor of 3 is based on the BNL analysis of the data base as discussed above.

Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1 Since most of the cabling in this fire zone is associated with balance-of-plant (B0P) equipment, loss of the power-conversion system for inventory makeup and long-term heat removal was assumed. At this stage all safety-related equipment is undamaged, and the dominant accident sequences and their conditional probabilities, based on the BNL review of the LGS-PRA (NUREG/CR-3028), are as follows:

. Class I QUX = 4.9x10-5 QUV = 1.5x10-6

. Class II QW = 9.4x10-6 Total (Event B) = 6.0x10-5 Event C: Fire Suppressed Before Damaging Unprotected Raceways It is considered unlikely that a cable-tray fire would be suppressed before damaging cables in conduits that are not protected by a ceramic-fiber blanket. A failure probability of 1.0 is assigned to this event (the same as in the LGS-SARA report).

Event D: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2 This stage represents damage to all safety-related equipment except that associated with shutdown methods A and B (Table 4.1 of LGS-SARA), which are served by protected cabling. The dominant accident sequences and their conditional probabilities are as follows:

I 3-38

. Class I QUX = 4.9x10-5 QUV = 6.6x10-6

. Class II QW.= 4.5x10-3 PQW = 4.5x10-5

. Total 4.7x10-3 Event E: Fire Suppressed Before Damaging Protected Raceways This event is concerned with the probability of failing to suppress this fire before protected cables serving shutdown methods A and B are damaged.

This is equivalent to failure to suppress the fire within one hour after the fire. This probability is equal to 8.0x10-2, using the BNL curve given in Section 2.2.2.3; the LGS-SARA uses a value of 0.04.

Event F: Undamaged Systems Mitigate Accident Given Fire Growth Stage 3 Fire growth stage 3 represents damage to all safe-shutdown systems served by the equipment in the fire zone. From the description of this zone, it is clear that such damage would result in a loss of all systems required for safe shutdown and the resulting conditional probability of core melt is thus 1.0.

b. Quantification of the Fire Growth Event Tree for Equipment-Panel Fires.

The fire growth event tree for panel fires is also shown in Figure 3.2.1, and the evaluation of the branch probabilities follows.

Event A: Frequency of Panel Fires j The BNL review agrees with the frequency of panel fires as calculated in l LGS-SARA, i.e., 1.8x10-3/yr.

Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1 Since the panels in this zone serve B0P equipment, the initiating event is loss of the power-conversion system and the quantification of this event is j identical with that described for Event B in Section a.

l

3-39 Event C: Fire Suppressed Before Damaging Unprotected Raceways The probability for fire propagation out of a distribution panel was considered to be equal to 0.04 in the LGS-SARA report. In Section 2.2.2.3 of this report, there are some qualitative comments about how this value was obtained. However, the BNL review does not change this value.

Events D, E, and F Given that a fire has propagated from the panel in which it originated to adjacent cable raceways, the quantification of the conditional probabilities associated with events D, E, and F is identical with that described in Section a.

c. Quantification of the Fire Growth Event Tree for Transient-Combustible Fires.

The fire growth event tree for transient-combustible fires is also presented in Figure 3.2.1, and the evaluation of the branch probabilities follows.

Event A The BNL review concludes that the frequency of transient-combustible fires given in the LGS-SARA report seems to be reasonable; this probability is equal to 1.3x10-5/yr.

Events B, C, D, E, and F The evaluation of the conditional probabilities associated with Events B to F is identical with that described in Section a.

3.2.2.2 Fire Zone 25: Auxiliary Equipment Room

a. Self-Ignited Cable Fires.

The frequency of self-ignited cable fires in the raceways of the auxiliary equipment room was determined in the same way as described for Event A in Section 3.2.2.1.a. This frequency is given by

I

+

l 3-40 j i

! 4,400(lb) 3 1

172,799(lb) x 3(5.3x10- ) = 4.5x10-5

/yr 0

In the LGS-SARA report it is argued that on the basis of fire analysis of raised floor sections, a fire. initiated in one section will neither propagate through installed combustible material (cable insulation), nor cause any i damage to cabling in adjacent floor sections. Thus, the maximum fire damage that could result is the loss of one division of safe-shutdown equipment, and ff I assuming the most demanding transient, MSIV closure, the dominant accident 4

sequences and their conditinal probabilities are:

. Class I~

I QUX = 5.6x10-4 QUV = 9.2x10-5

] . Class II QW = 7.8x10 I

. Total = 6.5x10-4 l- Using these conditional probabilities, the resulting frequency of core melt is (4.5x10-5) x (6'.5x10-4) = 2.9x10-8/yr.-

l b .~ Self-Ignited Cable. Fires.

The frequency of cabinet fires in the auxiliary equipment room is i

estimated as'1.75x10-4/ cabinet-year. This auxiliary equipment room has four cabinets where fires may cause significant damage to safe-shutdown systems.

' Assuming that a fire in any of those cabinets would destroy the contents of

~

the cabinet, the following equipment.would still remain undamaged:

1. The RCIC or HPCI System f 2. .Means of Reactor Depressurization

~3. The LPCI System (Two Trains) _

4. The Core Spray System (One Train)

! 5. The RHR System

• , , - - w- p4 -, , , , ,

3-41 Assuming that the initiating event is a transient with isolation from the power conversion system (LGS-SARA assumption), the following are the dominant accident sequences with their conditional core-melt probabilities:

. Class I QUX = 5.6x10 4 QUV = 2.9x10-5

. Total 5.9410-4 The core-melt frequency resulting from self-ignited panel fires is therefore: 4 x (1.75x10-4) x (5.9x10-4) = 4.1x10-7/yr.

c. Transient-Combustible Fires.

The frequency of transient-combustible fires were estimated as follows:

Trash-can Fire = 3.4x10-4/yr Solvent-can Fire = 3.4x10-4/yr Oil Fires = 3.4x10-5/yr Heat transfer analysis was used to evaluate cable temperatures resulting from external-exposure fires, and on the basis of this analysis, locations within the fire zone where fires may be significant contributors to core melt were identified, and the area associated with each location is given in Table ^-

3.2.2 (Table 4.4 of LGS-SARA). Using the results in Table 3.2.2 and the concept of critical location probability (the ratio of the area of the fire location and the total free area of the auxiliary equipment room associated with Unit 1, excluding the area taken up by cabinets), the core-melt frequency is calculated and given in Table 3.2.3. It should be pointed out that the dominant sequences for each fire location are QUX and QUV.

3.2.2.3 Fire Growth Event Trees for Fire Zones 20, 22, 24, 44, 45, and 47 l

The detailed description of each event in the fire growth e. vent trees for

! Zones 20, 22, 24, 44, 45, and 47, as well as their branch probability, is given in Appendix A. In the following section, the review results for core-damge frequency are presented.

l I

1 3-42 3.2.3 Review Results The core-damage frequency for each fire zone and for each type of fire as obtained in this review is presented in Table 3.2.4. The most important re-sults are:

1. The total core damage frequency resulting from fire-induced transients obtained in the BNL review is 5.2x10-5/yr, as compared to 2.3x10-5/yr reported in the LGS-SARA report.

2. The difference between the BNL review and the LGS-SARA core damage frequency can be attributed to two factors: (a) the probability of fire suppression in any given time, and (b) the reduction factor used in the calculation of self-ignited cable-raceway fires (see Section 2.2).

3. Most of the core-damage frequency comes from the fire growth stage 3 (about 85% the both BNL review, and about 81% in LGS-SARA). At this fire growth stage, in almost all zones, all safe-shutdown systems are assumed to be damaged by the fire. .Thus, the core-damage frequency is determined by the initiator frequency and the probability of failing to suppress the fire within a given time interval. This indicates that the changes made by BNL in the accident sequence quantification (relative to the LGS-PRA quantification) have a small impact upon the total fire-induced core-damage frequency.

4. In the BNL review, about 67% of the total core damage frequency comes from the self-ignited cable-raceway fires (about 57% in LGS-SARA).

5. In the BNL review, about 93% of the total core damage frequency comes from Fire Zones 2, 44, 45, and 47 (about 91% in LGS-SARA).

6. In the BNL review, about 97% of core damage is binned in the Class I category (see LGS-PRA); the other 3% is Class II.

The results presented in Items 1, 3, and 4 show that the total core damage frequency is very dependent upon the modification made by BNL (Item 2 above).

3-43 Thus, calculations were performed to show the impact of these two modifica-tions, and the results are as follows:

a. If the LGS-SARA probability of failing to suppress the fire within 60 min. (0.04) is used instead of the BNL value (0.08), the total fire-induced core-damage frequency would be equal to 3.6x10-5/ reactor year.

b. If the LGS-SARA reduction factor (RF=5), used in the calculation of self-ignited cable-raceway fires is used, instead of the BNL value (RF=3), the total fire-induced core-damage frequency would be equal to 3.8x10-5/ reactor year.

Another area where some r 9sitivity study is warranted is in the evalua-tion of human errors in case cc fire-induced transients. Since 97% of the total fire-induced core-damage frequency is due to failure of injection, two cases were analyzed here:

a. Operator fails to depressurize the reactor (X in the accident sequences).

The results presented in Table 3.2.4 are based upon the value of X given in the BNL review of the LGS-PRA(7); i.e. , X=6.0x10-3 If this value is increased by a factor of 10, the total fire-induced core-melt frequency would be equal to 7.6x10-5 (an increase of 45%).

b. Operator fails to initiate required systems from remote shutdown panel (pertinent to Fire Zones 22 and 24).

The results presented _in Table 3.2.4 are calculated using a value of 1.0x10-3 for this error. If a human error probability equal to 1.0x10-2 is used, the total fire-induced core-damage frequency is increased. to 5.6x10-5 (an increase of 7.7%).

l 3-44 3.3 References to Section 3

1. Philadelphia Electric Company, " Limerick Generating Station, Severe Ac-cident Risk Assessment," April 1983.

2. Philadelphia Electric Company, " Limerick Generating Station, Probabilistic Risk Assessment," March 1981.

3. Kolb, D. L. , et al. , " Review and Evaluation of the Indian Point Probabilistic Safety Study," NUREG/CR-2934, SAND 82-2929, December 1982.

4. Pickard, Lowe, and Garrick, " Indian Point Probabilistic Safety Study,"

Prepared for Consolidated Edison Company of New York, Inc., and Power Authority.of the State of New York, 1982.

5. Kennedy, R. P., et al., " Subsystem Fragility," SSMRP-Phase 1, NUREG/CR-2405, UCRL-15407, February 1982.

6. Battel, R. E. and Campbell, D. J. , " Reliability of Emergency AC Power Sys-tems at Nuclear Power Plants," NUREG/CR-2989, ORNL/TM-8545, July 1983.

7. Papazoglou, I. A. , et al ., " Review of the Limerick Generating Station Probabilistic Risk Assessment," NUREG/CR-3028, BNL-NUREG-51600, February 1983.

I l

l

A B C D E F

'Jodamaged Fire suppsessed Undamaged Fire suppressed Undsnaged I8 In systems before d.maging systerns systems cabt r/TC/ panel tactore darna' jing smisgate unprotected mitigate protected nutigate accident given raceway accident given race m ys acculent given FGS1 FGS1 (Fa. lure gives FGS 2) FGS2 (F ailure 9.wes FGSh F GS3 k.*' ' Annual sequence y,',d~ frequency catile TC panel OK OK cd a

OK ui 8.0-2 8.9-5/1.3-5 ,' l.0/l.0/4.0-2 1.0 CM 7.1-6 l.0-6 5.8-6 1.8-3 (see note) (see note) 4.7-3 CM 4.2-7 6.1-8 3.4-7 '

6.0-5 CM 5.3-9 / . 8-I t 1.1-7 7,5-6 1.1-6 6.2-64 FGS = Fire growth stage TC = Transient combustible Total annual core roeit frequency = 1,5-5 Note: Because of the evaluation of event E. the probability of event C is not encluded in Ilie evaluation of the sequence facquency.

Figure 3.2.1 Fire-growth event tree for fire zone 2

c

)

3-46

= Table 3.2.1 Summary of Fire-Analysis Results i

Annual Contribution to Core-Melt Frequency a Self-Ignited Transient-Cable Sel f-Ignited Combustible Fire Zone Raceway Fire Panel Fire Fire Total

2. 12-kV switchgear room 2.4-6b 3.2-6 5.9-7 6. 2-6 20 Static inverter room 5.0-8 3.5-8 1.5-8 1.0-7

! 22 Cable-spreading room 6.1-8 NAc 1.9-7 2.5 ,

24 Control room Negligible 1.6 1.0-7 2.6-7

25 Auxiliary equipment room Negligible 1.0-7 F. 6-7 3.6-7 44 Safeguard access area 4.2-6 1.5-6 4.1-7 6.1-6 45 CRD hydraulic equipment area 4.7-6 1.0-6 6.6-7 6.4-6 47 General equipment area 1.2-6 5.0-7 1.8-7 1.9-6 1.3-5 6.5-6 2.4-6 2.2-5 Contribution from all other-fire zones 1.0-6 Total annual core-melt frequency from fires 2.3-5 i

aPoint estimates b2.4-6 = 2.4x10-6 l cNot applicable l l

I

S 3-47 Table 3.2.2 Critical Locations of Transient Combustible Materials in the Auxiliary Equipment Room

• Area of location (m2)

Systems assumed to be un-Solvent-Can Oil damaged and capable of RPV Fire Location Fire Fire inventory makeup Intersection of floor areas 0 2.4 LPCI train D, means of 10U792 (a) and 10U791 depressurization Intersection of floor (b) areas 7.7 12 LPCI train D, means of 100791 and 100793 depressurization Floor area 10V796 (c) 0.6 2.3 LPCI trains B and C, means of depressurization Floor area 10V789 (d) 0.6 2.3 LPCI trains C and D, means

of depressurization

• Table 4.4 of LGS-SARA.

\

3-48 Table 3.2.3 Evaluation of Sequence Frequencies of 011 Fires (Transient Combustibles)

Probabilityb Criticala of Random.

Annuala Location Equipment Core-Meltb Fire Locationa Frequency Probability Failure Frequency OIL FIRE Location a 3.4-5 0.01 0.022 7.5-9 Location b 3.4-5 0.05 0.022 3.7-8 Location c 3.4-5 0.01 0.014 4.3-9 Location d 3.4-5 0.01 0.014 4.8-9 S0LVENT FIRE Location a 3.4-4 0 0 0 Location b 3.4-4 0.03 0.022 2.2-7 Location c 3.4-4 0.003 0.014 1.4-9 Location d 3.4-4 0.003 0.014 1.4-9 Total 2.8-7c afrom LGS-SARA Table 4.5 bBNL Review cThe corresponding LGS-SARA value is 2.6-7.

3-49 Table 3.2.4 Summary of Fire-Analysis Results BNL Review Annual Contribution to Core-Melt Frequencya Self-Ignited Transient-Cabl e- Sel f-Ignited Combustible Fire Zone Raceway Fire Panel Fire Fire Total l'

2 12-kV switchgear room 7.5-6 6.2-6 1.1-6 1.5-5 20 at "'

99m 2.4-7 7.5-8 4.3-8 3.6-7 22 .C e-spreading 3.7-7 nab 7.4-7 1.1-6 l ~24 Control room nab 4.8-7 2.2-7 7.0-7 25 Auxiliary equipment room 2.9-8 4.1-7 2.8-7 7.2-7  ;

44 Sa eguard access 8 1.7-5 45 ' CRD hydraulic equipment area 9.6-6 1.8-6 8.6-7 1.2-5 47 kneral cquipment 3.9-6 1.7-7 3.7-7 4.4-6 3.5-5 1.2-5 4.4-6 5.1-5 Contribution from all other fire zones 1.0-6 Total annual core-melt frequency from fires 5.2-5 aPoint estimates bNot applicable i

i 4-1 4.0 SOME GENERAL ISSUES AND SPECIFIC RECOMMENDATIONS

• 4.1 Seismic Hazard and Fragility Recommendations 4.1.1 Introduction Many concerns have been raised in Section 2.1 in regard to the seismic hazard and fragility analysis. Recommendations for resolving these concerns are given in this section. These recanmendations are primarily directed to PECo.and are based on discussions already presented in Section 2.1. Rather than repeating the background, each recommendation is presented and followed by the applicable subsection in Section 2.1 which can be referred to for ad-ditional information. Also, recomnendations are made to the NRC to perform ad-ditional review tasks to complete the review of the LGS-SARA.

Section 4.1.2 gives the reconmendations for the hazard analysis and Sec-tion 4.1.3 gives the recommendations for the fragility and associated system analysis concerns.

4.1.2 Seismic Hazard The following recanmendations should be addressed by PECo. The numbers in parentheses at the end of each recanmendation refer to the subsection of Sec-tion 2.1 which gives background information.

1. The delineation of zone boundaries in the Crustal Block hypo thesis should oe reconsidered. Specifically, a redefinition of Zone 8 is re-commended that is better correlated to the pattern of seismicity in the vicinity of Limerick and the geologic structure cf the Triassic Basin (see Section 2.1.2.3).

2. The possible occurrence of large-magnitude events (i.e., M7.0) should be considered as an alternative hypothesis on maximum magnitude for each seismogenic zone. The distribution should be selected in con-sideration of recomnendation 4, below (see Section 2.1.2.3).

T These recommendations to PECo and NRC on how to improve the PRA are provided as a result of our short-term review. They are not intended as necessary con-ditions to be fulfilled in order to assure safety in licensing considerations.

Such considerations are beyond the scope of this study.

i

--- ., , _ .-.. _ - ,,. . ,,.c , - , - ,, -- . - . - - , , ,--n.

4-2

3. The uncertainty in Richter b-values should be considered in the seismic hazard analysis. Consideration should be given to the dis-tribution of earthquake magnitudes based on the historical record in each seismogenic zone and expert opinion (see Section 2.1.2.4).

4. Justification should be provided for the estimate of the large-magnitude (i.e., M = 6.8) events considered in the hazard analysis.

Specifically, the basis for assumming that the magnitude estimated for the 1886 Charlaston, South Carolina earthquake is the largest event that can occur should be provided. Also, the basis for not con-sidering uncertainty in this parameter shoulc be justified (see Sec-tion 2.1.2.4).

5. The implication of including the Cape Ann events in the Piedmont source zone should be addressed. Consideration should include recent work that rejects the notion of a Boston-0ttawa seismic belt and the fact that the 1982 New Brunswick Canada event is included in the Piedmont province (see Section 2.1.2.4).

The following recommendation is addressed to the NRC.

1. An independent analysis should be conducted to verify the hazard an-alysis results. Also, an independent quantitative evaluation of the impact of comments raised in this review should be performed.

4.1.3 Seismic Fragility The following recommendations should be addressed by PECo. The numbers in parentheses at the end of each recommendation refer to the subsection of Sec-tion 2.1 which gives background information.

1. Justification for using the 1.4 duration factor to. increase the capac-ity of structures and the 1.23 factor to shift the hazard curves from a sustained-based peak acceleration to an effective peak acceleration i should be provided. Specifically, the concern is the region of the l Decollement hazard curve at and above 0.40g offective peak ground ac-  !

celeration (i.e., in the region where the average magnitude is M6.0 or larger) (see Section 2.1.3.1). l i

J

4-3

2. Justification should be provided for the median duration factor.

Specifically, the median value of 1.4 and the variability associated with this factor should be addressed. A median value which is mag-nitude dependent (as used in the LGS-SARA) should be developed. Also the uncertainty components of variability of 0.08 should be increased.

3. A median capacity value greater than 0.909 for the reactor enclosure and control structure should be justified (see Section 2.1.3.3).

4. The assumption that the containment building will have an effective damping value of 10 percent at the acceleration levels corresponding to the failure of the reactor internals, CRD guide tube, and reactor pressure vessel should be justified. Both the damping values for the individual containment components (i.e. , containment wall, pedestal, lateral support, and RPV components) and the combined system damping value should be addressed. For the latter concern, either a weighted model damping calculation or a time history reanalysis of the con-tainment/NSSS model should be conducted (see Section 2.1.3.4). Our understanding is that a weighted model damping analysis was performed and a value between 9 and 10 percent was obtained;(26) however, we have not reviewed that analysis. Note that this recommendation has a lower priority since the mean frequency of core melt would increase by only 10 percent for this effect.

5. The implications of impact between the containment building and the re-actor enclosure should be addressed for the following concerns:

a. Failure of safety-related electrical and control equipment located in the reactor enclosure.

b. Failure of safety-related piping which crosses between the two buildings due to relative displacements. In particular, the var-ious lines between the two structures should be systematically re-viewed to verify that relative displacements will not decrease the structural capacities.

i 4-4 In addition, it should be verified that no safety-related components will be damaged by spalled concrete caused by impact of the two structures (see Section 2.1.3.5).

Finally, it should be systematically verified that failure of small lines (due to falling concrete) attached to the safety-related piping near the junction of the two structures and anchored to the reactor enclosure will not contribute to the frequency of core melt.

6. In regard to the safety-related electrical components which significantly affect the frequency of core melt including, but not limited to:

440-V bus /SG breakers (S11) ,

440-V bus transformer breaker (S12) 125/250-V de bus (S13) 4-KV bus /SG (S14)

. Diesel-generator circuit breakers (S15) identify the number of actual components, their locations, and their characteristics relative to the generic tests at Susquehanna which were used to derive thei capacities. Justification should be provided for the number of each component type which should be included in the Boolean equation for sequence T E s3UX. Con-sideration should be given to the possible effects of capacity and re-sponse dependencies which exist (see Section 2.1.3.6).

7. Justification should be provided that the test results for the Sus-quehanna components can be directly scaled by the ratio of the design SSE values for the two plants (i.e. , Limerick and Susquehanna) and used to develop capacity values for the following Limerick com-ponents:

. Hydraulic control unit (S7)

4-5

. Nitrogen Accumulator (59 )

440-V bus /SG breakers (S11) 440-V bus transformer breaker (S12) 125/250-V dc bus (S13) 4-KV bus /SG (S14)

. Diesel-generator circuit breakers (SIS)

Consideration should be given to the location of the components in the two plants, foundation conditions, and construction similarities.

Based on the response given by PECo at the September 26, 1983, meet-ing, it appears that the equipment is located higher in Susquehanna than Limerick and that a factor of 2 conservatism may exist in the median fragility values used for Limerick. It is recommended that fragility parameter values specifically calculated for each of the above components at Limerick be developed (see Sections 2.1.3.6 and 2.1.3.7).

8. The capacity parameters for the SLC test tank should be based on a component-specific analysis which includes the dynamic characteristics of the tank and the actual geometric configuration. The capacity of the anchor bolts should be checked and the earthquake component factors derived based on the actual response and capacity characteristics (see Section 2.1.3.7, Component S8)-

9. The similarity betwe3n the nitrogen accumulators at the Limerick and Susquehanna plants should be verified since the analysis from Sus-qeuhanna was used as the oasis for the capacity of the nitrogen ac-cumulator at Limerick (see Si ction 2.1.3.7, Component Sg ).

10. The possible failure of the SLC tank due to tearing of the base plate flange near the anchor bolts should be checked to verify that it is not the weakest capacity (see Section 2.1.3.7, Component S10)-

4-6

11. A specific analysis should be conducted for the diesel generator heat and vent which is based specifically on the characteristics of this component (see Section 2.1.3.7 Component S16)-

12. After construction of the plant is completed, a systematic review of the plant, including walkthroughs, should be conducted to locate secondary components which could fail, fall, and impact primary safety-related components. Analyses of potential failures should be conducted to determine whether the secondary components are weaker than the primary components already considered (see Section 2.1.3.8).

13. The percentages of occurrences when evacuation would be affected by earthquakes should be recalculated using realistic relationships be-tween damage to civil structures and ground acceleration (see Section 2.1.3.8).

The following recommendations are addressed to the NRC.

1. A followup review should be conducted to independently verify the capacity values used for the electrical components. A coordinated 1.ask between nuclear systems and structural engineers should be performed since these components are major contributors to the mean frequency of core melt.

2. Other significant nonelectrical components are based on generic capacities. Independent, specific calculations should be performed for the following components since they are important to the final ri sk.

. Hydraulic Control Unit (S7 )

. Nitrogen Accumulator (Sg)

. Diesel Generator Heat and Vent (S16)

L______.__ _ _

4-7 4.2 Fire The methods to evaluate the risk due to a fire in a nuclear power plant (NPP) - as described within the Limerick SARA, and as reviewed herein, can be divided into three categories for the development of ignition, detection, suppression, and propagation models: physical models, point probability models, and probabilistic models. The Limerick SARA attempts, and in our judgment rightly so, to use a hybrid of all three. A hybrid approach is indeed warranted. Physical models suffer from the complexity of the large number of' variables and relationships required to calculate a fire history.

Point probability models suffer from small and inadequate data bases. While a completely probabilistic approach also suffers the inadequacy, a more serious deficiency is its inability to accurately model certain phases of fire development.

To put the issues of fire-development modeling in proper perspective, let us consider those components of the fire which are relevant in assessing fire growth : the burning object, the flame, the hot layer, the cold layer, the vents within an enclosure, target objects (other combustibles), and inert surfaces (walls and ceilings). As Friedman (l) points out rather simplisti-cally, 20 interaction vectors involving heat and material flux exist between these seven components. Several of these interactions have multiple elements with positive feedback as a critical part of the fire growth phenomena.

Adequate knowledge of the various feedback loops should suffice, in prin-ciple, to permit description of the growth rate of the fire. However, in order to make safety assessments, it is also mandatory to have additional in-formation, such as carbon monoxide and smoke content, for its impact on plant personnel safety. More important, from a public risk viewpoint, it is necessary to have information on the plant damage states as a function of fire growth.

Indeed, assessing fire risk is a highly coupled, nonlinear, dynamic pro-cess. We at BNL are of the opinion that the state of the art in fire modeling, coupled with such complex issues as systems interaction from

l I

4-8 automatic / manual suppression and human error, is such that probabilistic analyses which purport to quantify the safety of NPPs in the event of a fire have a wide range of uncertainty.

Furthermore, the very conservative assumptions used in the Limerick SARA fire analysis (in most respects) may, if taken out of context, lead to a distorted perspective of fire risk relative to other risks at the plant.

In some respects, assumptions and submodels that are touted to be con-servative are tantamount to gross violations in physical realities. Several cases in point have been discussed in the previous sections - not linking a suppression model directly to the fire growth mo;'el; a mass-loss rate model that does not truly reflect the positive feedback of the various fire growth stages; an ignition-time model that does not adequately reflect the various heat-exchange mechanisms are some of the modeling inadequacies which have been addressed directly.

The Limerick SARA on fire analysis has considered only intrazone fire propagation. A true assessment of fire risk must consider interzone fire propagation and all aspects pertaining thereto, including the debilitating effect of smoke migration, which has no immediate bearing on component reliability, but which should have immediate implications with regard to manual suppression effectiveness. Hence, smoke propagation should have been considered even if its level of sophistication is only on a par with the physical models used in ascertaining the thermal history.

In this connection, the mechanisms by which fire suppression systems (automatic and/or manual) can cause the failure of redundant or diverse safety systems should be considered in the assessment, again to a level of detail commensurate with the probabilistic/ deterministic analysis that is applied to assess fire risk. I I

The foundation on which the fire propagation model, basically a one-room fire model, rests is sound. Various compartment fire models(2) have been  !

developed and COMPMtN can be considered as one which lies within their i

l

l l

4-9 This zonal approach has several important advantages: (1) computational simplicity, (2) ease of decoupling zones for independent investigation, (3) simpler comparison of theory and experiment for individual zones, and (4) easier conceptualization of the' interaction between zones. Field models, however, in the long run should provide the most general, accurate, and detailed prediction of fire development. However, at present, field models (1) are limited by computer capacity, (2) do not yet properly treat action-at-a-distance radiative energy transfers, and (3) are still awaiting a more rigorous treatment of buoyancy driven turbulence. Both the zone and field approach should, in BNL's judgment, be pursued with the field approach used as a basis for " fine-tuning" the unit models that are built into the zone-model approach.

Zone models, like COMPBRN, represent a nearer-term engineering approach -

which is closely tied to experimental observations. However, a basic philo-sophical limitation in zone-model structure is its emphasis on predicting room flashover. For an assessment of nuclear power plant risk, a prediction of the onset of flashover is not as crucial as a prediction of the effects of in-place component vulnerability during the earlier fire-growth stages. Thus, for completeness a larger spectrum of initiating fire sizes must be incorporated into the analysis.

Accordingly, several of the unit-models employed in the zone approach re-quireimprovement.(2) Other aspects of fire growth that are lacking in existing models (like COMPBRN) are needed. For direct application in

. assessing nuclear power plant fire risk, these additional models should reflect the possibility of (1) the effects of walls, corners, and obstacles on fire plume and thermal plume development, (2) the possibility of combustion of excess pyrolyzate within the stratified layer, (3) the effects of turbulence induced buoyancy on plume development, (4) intrazone mass and energy exchange, and (5) implementation of existing knowledge and correlation of fuel-flammability characteristics, specifically, current cable flammability and damageability indices.

4-10 Another keypoint regarding the practical use of a zone model in general, and COMPBRN in particular, is that the structure of the numerical code is not

" user friendly." Before one can use a code employing a series of unit models, one must be aware of the assumptions built into the analysis, the key physical parameters and their sensitivities, and finally a working knowledge of the state of the art in fire phenomena and modeling.

4.3 References to Section 4.2

1. Friedman, Raymond, " Status of Mathematical Modeling of Fires," Factory Mutual Research Corporation, FMRC RC 81-BT-5, April 1981.

2. Jones, Walter J. , "A Review of Compartment Fire Models," NBSIR 83-2684, April 1983.

A-1 APPENDIX A: Detailed Review of the Quantification of the Fire Growth Event Trees In this appendix the detailed review of the fire growth event trees for the following fire zones is described:

1. Fire Zone 20: Static Inverter Room

2. Fire Zone 22: Cable-Spreading Room

3. Fire Zone 24: Control Room

4. Fire Zone 44: Safeguard Access Area

5. Fire Zone 45: CRD Hydraulic Equipment A"ea

6. Fire Zone 47: General Equipment Area A.1 Fire Zone 20: Static Inverter Room The fire growth event tree for all types of fires in Zone 20 is shown in

-Figure A.1.

A.1.a Quantification cf the Fire Growth Event Tree for Self-Ignited Cable-Raceway Fires.

Event A: Frequency of Self-Ignited Cable-Raceway Fires.

This frequency is calculated in the same way as for Event A in Section 3.2.2.1.a, i.e.,

9,558(1b) 5.3x10-3 172,799(1b)' 3 Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1.

On the basis of the locality of the initial fire a reactor-trip transient is assumed, with the loss of one division of safety-related equipment. The dominant seqences and their conditional probabilities are as follows:

. Class I QUX = 8.4x10-6 QUV = 1.1x10-5

A-2

. Class II PW = 4.5x10-5 QW = 5.4x10-6 o

. Total = 7.0x10-5 Event C: Fire Suppressed Before Damaging Unprotected Racewavs.

The probability of this event is given by the probability of failing to suppress the fire within 10 min. (estimated time before damage to unprotected raceways). BNL value for this event is 0.43.

Event D: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

Fire growth stage 2 represents damage to all safety-related equipment except that associated with shutdown method A which is served by cable raceways protected with ceramic-fiber fire blankets; also unaffected is equipment associated with the power-conversion system. The dominant sequences and their conditional probabilities are as follows:

. Class I QUX = 8.4x10-6 QUV = 2.6x10-5

. Class II PW = 6.6x10-5 QW = 7.9x10-6

. Total = 1.1x10 4 Event E: Fire Suppressed Before Damaging Protected Raceways.

The probability of this event is given by the probability of failing to suppress the fire within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (estimated time before damage to protected raceways). BNL value for this probability is 8.0x10-2, Event F: Undamaged Systems Mitigate Accident Given Fire Growth Stage 3.

This stage represents damage to all safe-shutdown systems served by i equipment in this zone. Only the power-conversion system would remain l undamaged to mitigate the accident. The dominant sequences with their l

l o

A-3 conditional probabilities are:

. Class I QUV = 2.0x10-2

. Class II PW = 1.0x10-2

. Total = 3.0x10-2 A.1.b Quantification of the Fire Growth Event Tree for Panel Fires.

Event A: Frequency of Panel Fires.

BNL agrees with the frequency of panel fires given in LGS-SARA, i.e.,

4.4x10-4/yr.

Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1.

On the basis of the panels located in this zone, a reactor-trip transient is assumed, and the following equipment is assumed to have failed: HPCI, RHR Trains B and D and Train B of LPCS. The dominant accident sequences and their conditional probabilities are:

. Class I QUX = 8.4x10-6 QUV = 1.1x10-5

. Class II PW = 4.5x10-5 QW = 5.4x10-6

. Total = 7.0x10-5 Event C: Fire Suppressed Before Damaging Unprotected Raceways.

The quantification of this event is identical with that for Event C in Panel Fires for Fire Zone 2 (see Section 3.2.2.1.b).

j A-4 Events D, E, and F The quantification of the conditional probabilities associated with those events is identical with that described for self-ignited cable-raceway fires in Section A.1.a.

A.1.c Quantification of the Fire Growth Event Tree for Transient-Combustible Fires.

Event A: Frequency of Transient-Combustible Fires.

BNL agrees with the frequency of transient-combustible fires as calculated in LGS-SARA, i.e., 1.7x10-5/yr.

Events B, C, D, E, and F The evaluation of the conditional probability associated with Events B, C, D, E, and F is identical with that described in Section A.1.a.

A.2 Fire Zone 22: Cable-Spreading Room

~ The fire growth event tree for all types of fires in Zone 22 is shown in Figure A.2.

A.2.a Quantification of the Fire Growth Event Tree for Self-Ignited Cable-Raceway Fires. ,

/

Event A: Frequency of Self-Ignited Cable-Raceway Fires.

This frequency is calculated in the same way as for Event A in Section 3.2.2.1.a, i.e.,

35,526(1b) 5.3x10-3

) = 3.6x10-4/yr.

172,799(lb)x ( 3 Events B and C Since all fires are capable of damaging adjacent cable raceways, except those protected by a ceramic-fiber blanket, Event B is effectively omitted and Event C is assigned a probability of 1.0.

A-5 Event D: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

The initiating event is a transient with isolation from the power-conversion system, and the only equipment potentially operable is that associated with shutdown methods A'and B. The dominant accident sequences and their conditional probabilities are:

. Class I QUX = 4.9x10-5 QUV = 6.6x10-5

. Class II ,

QW = 2.7x10-4 PQW = 4.5x10-5

. Total = 4.3x10-4 Event E: Fire Suppressed Before Damaging Protected Raceways.

The protected raceways (serving shutdown methods A and B) consist of cable trays protected by a 1-in thick ceramic-fiber blanket which is equivalent to a 1/2-hr fire rating. Thus, Event E is assigned a probability of 1.95x10-1, which is the probability of failing to suppress a fire within 1/2 hr.

Event F: Undamaged Systems Mitigate Accident Given Fire Growth Stage 3.

At this stage all safe-shutdown equipment dependent on cabling within this zone is considered to be damaged. The only equipment that is potentially operable is that served by the remote shutdown panel. Therefore, the dominant accident sequences and their conditional probabilities are:

. Class I QUX = 4.2x10-4 QUV = 2.2x10-3

. Class II QW = 4.0x1U-4 PQW = 6.6x10-5

. Total = 3.1x10-3

i A-6  ;

A.2.b Quantification of Fire Growth Event Tree for Transient-Combustible Fires.

Event A: Frequency of Transient-Combustible Fires.

BNL agrees with the frequency of transient-combustible fires presented in LGS-SARA, i .e. , 7.2x10-4/yr.

Events B, C, D, E, and F The quantification of all those events is identical with that discussed in the previous section (see Section A.2.a).

A.3 Fire Zone 24: The Control Room Since there is no exposed cable insulation in the control room, the only types of fires analyzed in this section are: Self-Ignited Panel Fires and Transient-Combustible Fires.

A.3.a Quantification of Fire-Growth Event Tree for Self-Ignited Panel Fires.

The fire growth event tree for self-ignited panel fires is shown in Figure A.3.

Event A: Frequency of Self-Ignited Panel Fires.

The frequency of significant panel fires in the control room was estimated to be 1.8x10-3, Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1.

i This stage represents damage that is confined to the cabinet in which the fire starts. There are 17 separate cabinets in the control room. However, only fires in 3 cabinets can cause significant damage. Fires in one of th,se cabinets may disable all systems required for reactor shutdown except for equipment controlled from the remote shutdown panel. Fires in the other two l

cabinets will only disable the power-conversion system. 1 a

l

A-7 The transient resulting from any of these fires is Loss of Feedwater or MSIV Closure and the dominant accident sequences, with their conditional probabilities ?re:

. Class I QUX = 3.1x10-5 QUV = 1.3x10-4

. Class II QW = 2.5x10-5 PQW = 3.9x10-6

. Total = 1.9x10-4 Event C: Fire Suppressed Before Propagating Beyond the Confinement of the Cabinet.

BNL agrees with the evaluation of the probability of a cabinet fire propagating beyond the confinement of the cabinet as given in LGS-SARA, i.e.,

2.5x10-2, Event D: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

In this stage, only the equipment which can be operated from the remote shutdown panel is considered potentially operable. The dominant accident sequences and their conditional probabilities are identical with those calculated for Event F in Section A.2.a, i.e., the total conditional core-damage probability is equal to 3.1x10-3, A.3.b Quantification of Core-Damage Probability for Transient-Combustible Fires.

BNL agrees with the quantification of the frequency of transient-combustible fires which can damage safe-shutdown equipment in the control room. This frequency is equal to 7.2x10-5/yr.

Given the occurrence of a transient-combustible fire, it is assumed that only the equipment that can be operated from the remote shutdown panel is ,

potentially operable. In this case the dominant accident sequences and their v- - , - - - - - .

l A-8 and their conditional probabilities are identical with those calculated for Event F in Section A.2.a; i.e., the total conditional core danage frequency is equal to 3.1x10-3 So, the total contribution of transient-combustible fires to the core-damage frequency is given by:

(7.2x10-5) x (3.1x10-3) = 2.2x10-7/yr.

A.4 Fire Zor,e 44: Safeguard Access Area The fire growth event tree for all types of fires in Zone 44 is shown in Figure A.4.

A.4.a Quantification of the Fire Growth Event Tree for Self-Ignited Cable-Raceway Fires.

Event A: Frequency of Self-Ignited Cable-Raceway Fires.

This frequency is calculated in the same way as for Event A in Section 3.2.2.1.1, i.e.,

28,290(Ib) 5.3x10-3 172,799(LB)* 3 Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1.

The accident-initiating event was taken to be a transient with MSIV closure, and at this stage of the~ fire the following systems would remain potentially operable: RCIC or HPCI system, the ADS, the RHR system (three trains), and the LPCS (one train). The dominant accident sequences and their conditional probabilities are:

. Class I QUX = 5.6x10-4 QUV = 9.2x10-5

. Class II QW = 7.8x10-7

. Total = 6.5x10 4 l

1

A-9 Event C: Fire Suppressed Before Damaging Unprotected Raceways.

The probability of this event is given by the probability of failure to suppress the fire within 10 minutes (estimated time before damage to unprotected raceways). The BNL value for the probability of this. event is 0.43.

Event D: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

Given fire growth stage 2, the following equipment would remain potentially operable: the ADS and the RHR system (2 trains). The dominant accident sequences and their conditional probabilities are as follows:

?

. Class I QUX = 6.0x10-3 QUV = 8.2x10-3

. Total = 1.4x10-2 j Event E: Fire Suppressed Before Damaging Protected Raceways.

The probability of this event is given by the probability of failure to suppress the fire within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (estimated time before damage to protected raceways). However, since only fires in two quadrants can grow to this stage, the probability of Event E is given by:

P(Event E) = 0.5 x Probability of Failing to Suppress the Fire Within 1 hr.

I = 0.5 x 8.0 x 10-2 , 4.0 x 10-2 ,

Event F: Undamaged Systems Mitigate Accident Fire Growth Stage 3.

In this zone, fire growth stage 3 represents damage to all shutdown l methods, and consequently the conditional failure probability of Event F is <

1.0. ,

A.4.b Quantification of the Fire Growth Event Tree for Fires in Power-Distribution Panels.

Event A: Frequency of Fires.

The frequency of panel fires is determined from the number of panels 1

'j

.-r . -- , - , - - , . . _ _ _ _ . _ _ _ _ , . _ _ _ _ . _ , _ _ . .. . . _ _ . . , _ , _ , . _. , _,,,,_y.-, ,

A-10 j multiplied by the frequency of fires for panel-year. As described in Section 2.2.4.1, seven panels are located in this zone. Thus, the frequency of panel fires is:

7 x (2.2x10-4) = 1.5x10-3/yr.

Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1.

In this zone only fires in three panels are capable of causing initiating events (turbine-trip transient) and damaging mitigating systems. Such fires cause, at this stage, the loss of either the RCIC of the HPCI system. The dominant accident sequences are:

. Class I QVX = 5.2x10-6

. Class II QW = 1.1x10~0 PW = 9.4x10-8

. Total = 5.3x10-6 Event C: Fire Suppressed Before Damaging Unprotected Raceways.

The evaluation of the probability of this event is identical with that for Event C in Section 3.2.2.1.b.

Events D, E, and F Once the fire has propagated to cable raceways, the quantification of Events D, E, and F is identical with that given in Section A.4.a for self-ignited cable-raceway fires.

A.4.c Quantification of the Fire Growth Event Tree for Transient-Combustible Fires Event A: Frequency of Fires.

BNL agrees with the frequency of fires calculated in LGS-SARA, i.e.,

i 1.7x10-5/yr.

1 I

A-11 Events B, C, D, E, and F

, The quantification of these events is identical with that given in Section A.4.a for self-ignited cable-raceway fires.

A.5 Fire Zone 45: CRD Hydraulic Equipment Area The fire-growth event tree for all types of fires in Zone 45 is shown in Figure A.5.

A.5.a Quantification of the Fire Growth Event Tree for Self-Ignited Cable-Raceway Fires.

Event A: Frequency of Self-Ignited Cable-Raceway Fires.

This frequency is calculated in the same way as for Event A in Section 3.2.2.1.a. i.e.,

18,637(1b) x (5.3x10-3) = 1.9x10-4/yr.

172,799(lb) 3 Events B and C _

The quantification of these events is identical with that for the same events in Section A.4.a.

Event D: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

This stage represents damage to all safety-related equipment except that served by cable raceways or components protected by horizontal separation or ceramic-fiber fire blankets. The only equipment potentially operable is tha*

served by shutdown method A or B (but not both). The dominant accident sequences and their conditional probabilities are:

. Class I QUX = 5.6x10-4 QUV = 1.9x10-3

. Class II QW = 4.0x10-4 QUW = 3.7x10-5

, PW = 6.6x10-5

. . Total = 3.0x10-3

- . - - - ~ . . . . ,,, ,, - ,g,

, .n, - , , - _ .,,.,,w-e-, n. .-_ . . ,_ , , _ ,-.

A-12 Event E: T' e Suppressed Before Damaging Protected Raceways.

The probability of this event would be given by the probability of failure to suppress the fire within 30 minutes (time to damage to protected raceways).

However, only fires in one quadrant (northeastern) are capable of damaging equipment associated with both shutdown methods. So, the probability of Event E is given by: 1.95x10-1/4=4.875x10-2 Event F: Undamaged Systems Mitigate Accident Given Fire Growth Stage 3.

This third stage of fire growth represents damage to all safe-shutdown equipment, and the failure probability associated with the event is 1.0.

A.5.b Quantification of the Fire Growth Event Tree for Self-Ignited Panel Fires.

Event A: Frequency of Panel Fires.

BNL agrees with LGS-SARA evaluation of panel fires in this zone, i.e.,

3 x (2.2x10-4) = 6.6x10-4/yr.

Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

This stage represents damage that is confined to the panel in which the fire starts. Fires in two of the three panels can cause a turbine-trip transient and at the same time disable one high pressure injection system .

(HPCI or RCIC) and one RHR train. The dominant accident sequences and their conditional probabilities are as follows:

. Class I QUX = 1.1x10-5 ,

QUV = 1.8x10-6 I

. Class II PW = 1.3x10-7

(

QW = 1.6x10-8

. Total = 1.3x10-5

. - - - ...., - . ._ ,_ , ~,. ,- . .. _ , ,. _._ --. _.-_ ,.-._-. . . . . ,, - - -

A-13 Since only two of the three panels can contribute to the accident sequences, the probability of Event B is: 1.3x10-5 x 2/3 = 9.0x10-6, Event C: Fire Suppressed Before Damaging Unprotected Raceways.

The probability of this event is identical with that for the same event in Section 3.2.2.1.b.

I Event 0: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

The quantification of this event is identical with that of Event D in

Section A.5.a.

Event E: Fire Suppressed Before Damaging Protected Raceways.

i Only fires in one of the three panels are capable of damaging protected 4

raceways. So, the probability of this event is given by:

1

-- x Probability of failing to suppress the fire within 30 minutes 3 (time to damage to protected raceways) 1

= x 1.95x10-1 = 6.5x10-2, 3

Event F: Undamaged Systems Mitigate Accident Given Fire Growth Stage 3.

This stage represents damage to all safe-shutdown equipment, and the failure probability associated with this event in 1.0.

A.S.c Quantification of the Fire Growth Event Tree for Transient-Combustible Fires.

Event A: Frequency of Transient-Combustible Fires.

BNL agrees with the frequency given in LGS-SARA, i.e., 1.7x10-5/yr .

Events B, C, D, E, and F Given a transient-combustible fire that causes the ignition of cable i

r eer --. -- --~_-r_.. --__,w-.,--,e..,., , , - . . - - - - - - - ~ , -

--- -- , - - - - -.--y r .. , . - - - - --,..----m,-o, - - , ,2-r

A-14 i

\

trays, the evaluation of all these events is identical with that for the same events in Section A.5.c.

A.6 Fire Zone 47: General Equipment Area The fire growth event tree for all types of fires in Zone 47 is shown in

Figure A.6. ,

A.6.a Quantification of the Fire Growth Event Tree for Self-Ignited Cable Raceways.

Event A

Frequency of Self-Ignited Cable Raceway Fires.

This frequency is calculated in the same way as for Event A in Section 3.2.2.1.a, i.e.,

$ 17,791(lb) 5.3x10-3 i ) = 1.8x10-4/yr.

l 172,799(lb) x ( 3 I

Events B, C, and D The quantification of these events is identical with that for the same events in Section A.5.a.

Events E: Fi*e Suppressed Before Damaging Protected Raceways.

The probability of this event would be given by the probability of failing to suppress the fire within 1 ho'ur (time to damage to protected raceways).

However, only fires in one quadrant (NE) are capable of damaging equipment associated with both shutdown methods. So, the probability of Event E is given by: 8.0x10-274 = 2.0x10-2, Event F: Undamaged Systems Mitigate Accident Given Fire Growth Stage 3.

This stage of fire represents damage to all safe-shutdown equipment, and the probability associated with this event is 1.0.

A.6.b Quantification of the Fire Growth Event Tree for Self-Ignited Panel Fires.

Event A: Frequency of Self-Ignited Panel Fires.

A-15 BNL agrees with the frequency of panel fires given in LGS-SARA, i.e.,

5 x (2.2x10-4) = 1.1x10-3/yr.

Event B: Undamaged Systems Mitigate Accident Given Fire Growth Stage 1.

Fires in three of the five panels in this zone may be capable of cousing an initiating event and disable one RHR train and one core spray train. The initiating transient was assumed to be an MSIV closure, and the dominant accident sequences and their conditional probabilities are

. Class I QUX = 4.9x10-5 QUV = 8.1x10-6

. Total = 5.7x10-5 Since only fires in three of the five panels are contributors to those sequences, the probability of Event B is given by x 5.7x10-5 3.4x10-5 ,

5 Event C: Fire Suppressed Before Damaging Unprotected Raceways.

i

, The quantification of this event is identical with that for Event C in panel fires for Zone 2 (Section 3.2.2.1.a).

Event D: Undamaged Systems Mitigate Accident Given Fire Growth Stage 2.

Given that a fire has propagated from the panel in which it originated to adjacent raceways, the quantification of this event is identical to Event 0 in Section A.6.a.

Events E and F It is BNL judgment that, since none of the existing panels are located in the NE quadrant, the progression of the fire to fire growth stage 3 is not possible in this zone.

A-16 A.6.c Quantification of the Fire Growth Event Tree for Transient-Combustible Fires.

Event A: Frequency of Transient-Combustible Fires.

BNL agrees with the frequency of transient-combustible fires given in LGS-SARA, i.e., 1.7x10-5, Events B, C, D, E, and F Given a transient-combustible fire that ignites cable trays, the quantification of these events is identical with that in Section A.6.a.

A B C D E F Un jamayd Fne supp,essed Undamaged Fire suppressed undamaged g,, g soiems 1,cture d n ,geng systems ticiose damaging systems caue/TC/panet mit. gate unprotected mis.g.ie proicceed nutigate accident given , ,c e. ,, acc. dent g,,en ,xe.,ys acc. dent given FGS1 FGS1 (Failure gives FGS 2) "GS2 (Fa+tuse gives FGS3) FGS3 Core Annual sequence

{',' tretperewy calde TC panel OK OK OK [

S.0-2

- - - - 3.0-2 e.8 s/1.7-5/ CM 2.3-7 4.1-8 4.2-8

. 4 - .,. (see (see .

note) note' l.1-4 OM 4.6-9 8.0-1 t f 1.9-5 7.0-5 CM 7.0-9 1.2-9 3.1-8

?_4-7 4.3-8 73 $3" , ,{*'[ ] ,,g, S Tot. annual cose mett frequency =

3.6-7 PJote; Because of the evalu. tion of event E me prob.b.t.tv of ev<nt C is not included in the evaluaten of the sequerge fascheency.

Figure A.1 Fire-growth event tree for fire zone 20

- ~ - - - - ~ - - - ' -~

T-A B C D E F Undamaged Fue suppressed Und.maged Fire suppressed Undanaged I".'h systems tactore denaging systems tafore damaging systems caue/TC/ panel massate wip,oiected mit gate protected merigate accedent given exeway accedcnt geven raceways accedent given FGSI FGS1 IFa*Iure goes FGS 2) FGS2 (Fa.luse gives FGS31 FGS3 Core Annual serguence trecpaency

{38~

carde TC panel OK OK Y

OK CD 1.95-I

3. 6-4 /7. 2-4 Cu 2.2-7 4.3-7 4.3-4 CM 1.5-7 3.1-7

, CM 3,7-7 7.4-7 FGS = Fire groath stage TC = Transient com. mast.bte Tot.: annual core melt frequency =1.1-6 Note; Because of the evabation of event E, the probatal tv of event C is not encLded in the evaluataon of the sequence fasquency.

Figure A.2 Fire-powth event tree for fire zone 22

-l A B C o Undamaged Fire suppressed systems Undena<rd tefore spreadmg systems mitegate beyond confmement Fire n P.ncs accujant g..en ni.e 94:e of catanet accukot given FGS1 FGS1 (f.wiure gives FGS2) IGS2 Core 3,,,,,,,,,,,,,

f frequency paies 1

e f.8-3 2.5-2 3.1-3 CM 3,4_7 1.9-4 CM 3.4-7 FGS = Fue groatti starp - __

TC = Tsans=nt condustele L R .,.1 Contribution to CF.1 from T/C fires 2.2-7 Total core mets frequency 7,o_7 Figure A.3 - Fire-powth event tree for fire zone 24.

A B C D E F Undamaged Fue suppressed Und.maged Fire suppressed Undarnaged fi I4 systems 3,elore daaging systems tactore damaging systems cable /TC/ panel mit. sate wprotected mitigate protected nuti98te accident geven v aceway accalent geven raceways accidens given FGS FGS (Failure gives FGS 2) FGS2 If

• lure g ves FGS3) FGS3 Core Annual sequence

{t,'~ tr erpsesry cattle TC panel OK OK 3=

OK 4.0-2 2.9-4 /1. 7-s CM 1.1-5 b.7-7 2.4-6 1.5-3 (see (see note) aote) 1.4-2 CM 1.7-6 1.0-7 B.5-7 6.5-4/6.5-4/5.3-6 CM i.9-7 1.1-8 1.9-9 1.3-5 1.8-7 1.3-6 FGS = Fire growth stage Total annual core mett frequency = g ,7-5 TC = Transient combustible Note: Because of me evaluation of event E. me prob.twi.tv of evsnt C is not included in ne evaluation of the setauence frequency.

Figure A.4 Fire-yowth event tree for fire zone 44

~ . ']

A B C D E F Undamaged Fue suppressed Undamaged Fire suppressed Undamaged E8 I8 systems before damaging cable /TC/ panel systerns before damaging systems enitesare unp,otected mategate protected mitigate accident given saceway accident yven exeways accident given FGS1 FGSt I?mture gives FGS 2) FGS2 (Fa. lure gives FGS3) F GS3 Core Annual serauence 8,*' trecyseery cabra Tc panes OK OK Y

ro OK

'.875-2/4.875-2/6.50-2

.9-M I . 7-5 /

0.43/o.43/0.04 i o CM 1.7-6 9.2-6 d.3-7

. 6-4 (see (see note) note) 3.0-3 OM 2.4-7 2.2-8 7.9-8 4

6.5 I./6.5-4/9.0-6 CM 1.2-7 1.1-8 5.9-9 i

9.6-6 B.6-7 1.8-6, hC = s c tiue Total annua core melt frequency =

1.2-5 Note: Because of the evaluation of event E. me probat>I.ty of event C is not encluded in the evaluation of the secauence fascpency.

Figure A.S. Fire-growth event tree for fire zone 45

A C D E F B

Undamaged Fire suppressed Und.maged Fire suppressed undamaged 8 systems g,ciore damaging systems belose drnaging systems cade/TC/ panel matagate unprotected metegate protected nutigate accedent given ,3ce.,y accident given raceways accident given IFa48ure gives FGS 2) FGS2 (Fd*3" 9'ves FGS3) FGS3 FGS1 FGS1 Core Annual sequence trecreency

8d~

catale TC panel OK OK Y

N OK N 2.0-2/2.0-2/NA 0.43/0.43/0.04 1.0 f , y_5 ,

(sec (see 1.1-3 note) note) 3.0-3 -

'M 2.3-7 2.2-8 1.3-7 6.5-4/6.5-4/3.4-5 CM l.2-7 1.1-8 1.8-8 3.9-6 ,3.7-7 1.7-7 FGS = Fire growth stage '

Toter annue core melt frequency =

4.4-6 TC = Tsansient combustible F4cte: Because of the evaluation of event E. the probatalay of ewnt C is not incLeed us the evaluation of the sequence frsquency.

Figure A.6 Fire growth event tree for fire zone 47

B-1 APPENDIX B: A Critique of " Seismic Ground Motion at Limerick ,

Generating Station." by ERTEC Rocky Mountain, Inc.

December 8,1983 Professor Alan L. Kafka Weston Observatory

. Dept. of Geology and Geophysics Boston College Weston, MA 02193

l i

l B-2

! INTRODUCTION

( Although no theory has yet been develped that explains the cause of earth-j quakes in the Eastern United States, seismologists and engineers are still

( called upon to assess earthquake hazards in this region. As the trends of urbanization and industrialization spread throughout the East, the number of requests for earthquake hazards assessments increases. Seismologists must, therefore, respond to the need for a technical evaluation of the current state of knowledge of earthquake processes at a given site, while also tempering their hazard assessments with clearly expressed admissions of their inherent limitations. Thus, in the assessment of earthquake hazards at sites located in the East, two key issues emerge:

l (1) A realistic assessment must emphasize that there is no deterministic

! model that describes the cause of earthquakes in the Eastern United l

States in general, or (certainly in most cases) at the site in particular.

(2) It is nevertheless incumbent upon seismologists to provide a practi-cal guide for siting critical facilities that incorporates the pres-l ent state of knowledge in the field.

" Seismic Ground Motion at Limerick Generating Station," a report prepared by ERTEC Rocky Mountain, Inc., is evaluated here in the light of these two is-l sues. On the one hand, the report fails to state explicitly that very little is known about the cause of earthquakes in the East in general or at the l

Limerick site in particular. On the other hand, despite this significant om-I ission plus a number of technical problems, the results contained within the report can still be of practical value in the assessment of the seismic hazard f at the Limerick Generating Station.

l In particular, the results shown in Figure 9 of the ERTEC report for the

" Decollement" hypothesis probably yield a reasonable estimate of seismic ground motion at the site. This conclusion is fronic, since " Deco 11ement" l

l l

L

B-3 is possibly the most speculative of the four hypotheses considered.

Nonetheless, the practical application of " Decollement" is ultimately useful, since its essential feature (as far as the calculated seismic hazard is concerned) is that it treats the entire Eastern seaboard as one seismogenic zone. This allows for the possiblity that large earthquakes (M=7) could occur anywhere in that area.

The inclusion of calculations of seismic hazard resulting from the other three hypotheses on seismogenic zonation (Piedmont, Northeast Tectonic Zones, and Crustal Blocks) also provides insight into the seismic hazard at the Limerick site. The peak ground acceleration curves shown in Figure 9 for all four zonation models illustrate that a very wide range of hazard assessments results from the lack of knowledge of the cause of earthquakes in this region.

Nonetheless, it is useful from a practical point of view, to know how sensitive the resulting hazard evaluation is to changes in the geometry of seismogenic zones.

• While these practical results can be gleaned from the ERTEC report, Section 3 (Seisom'ogenic Zones) and Secion 4 (Seismicity Parameters) contain a nu.aber of technical problems. Also, there is insufficient information in the report regarding the earthquake catalogues used in the study. These issues are discussed below.

SEIS0M0 GENIC ZONES Section 3 of the ERTEC report describes the seismogenic zones used in the hazard analysis. In this section, seismogenic zone is defined as "[a zone]...within which earthquakes are considered to be of similar tectonic origin so that future seismic events can be modelled by a single function describing earthquake occurrences in time, space, and size." It is important to note that since the tectonic origin of all earthquakes along the entire eastern seaboard is at present unknown, all of the hypothesized seismogenic zones discussed in the ERTEC report are highly speculative. The report does not mention this fact. Some fundamental problems with the two more recently proposed hypotheses are discussed below.

B-4 Decollement:

This hypothesis is based on an analysis of intensities reported for the 1886 earthquake in Charleston, SC (Seeber and Armbruster,1981) coupled with results of seismic reflection studies of the deep crustal structure of the southern Appalachians (Cook et al. ,1979). The seismic reflection profiles have revealed a continuous shallow-dipping reflector beneath the southern Appalachians that has been interpreted to be a major decollement. The inferred decollement has been proposed as the boundary of a seismically distinct block of the earth's crust, i.e. the " Appalachian Detachment" (Seeber and Armbruster, 1981).

Historical earthquake catalogues for the Eastern United States (e.g.,

l Barstow et al.,1980) show a rather low level of seismicity in the Charleston area, and the recent monitoring of the area with a dense seismograph network has also revealed a relatively low level of activity. Thus, studies of microearthquake distribution, fault-plane solutions, and earthquake depth have not been very abundant in this region (Hamilton, 1981). The hypothesis that the current seismicity in the vicinity of Charleston, SC is occurring along a major decollement surface is, therefore, not well supported by quantitative seismological studies. The existence of an " Appalachian Detachment" should thus be considered as interesting speculation, but speculation nonetheless.

Furthermore, although preliminary results from deep seismic reflection profiles in the northern Appalachians (e.g., Ando et al.,1981; Brown et al.,

1982) have also revealed shallow-dipping reflectors, the lateral extent of these surfaces in the Northeast does not appear to be as great as in the southern Appalachians. Thus, even if " decollement tectonics" were applicable

to earthquakes in the sourthern Appalachians, I have seen no convincing evidence to suggest that this hypothesis should be applicable in the northern l Appalachians in general or in the vicinity of the Limerick site in particular.

l l

B-5 i

Figure 6 of the ERTEC report shows the northern boundary of the i Deco 11ement zone at about 41'N. No reason for choosing this boundary was given in the report.

Crustal Blocks:

According to this hypothesis, the occurrence of earthquakes in the Eastern l United States is controlled by large crustal blocks. Supposedly, the boundaries of these blocks are seismically active and the interiors are relatively inactive. While this hypothesis seems reasonable in principle, and may eventually predict the locations of future large earthquakes, none of the crustalblockmodelsthathavebeenproposed(e.g.,Dimentetal.,1979) i correlate very well with historical or instrumentally located seismicity.  !

l.acking any definitive correlation with the only existing tecords of actual earthquakes, this hypothesis should be considered as interesting geophysical specuiation worthy of further investigation, but - like the " Deco 11ement" hypothesis - speculation nonetheless.

l SEISMICITY PARAMETERS ,

Seismic Activity Rate

l l

The ERTEC report overstates to some extent the conclusions found in l McGuire(1977). This is an example of how the report implies (at least in [

l style,ifnotinfact)thatmoreisknownabouteasternearthquakesthan

! really is,known. My interpretation of the results of McGuire (1977) and the f further studies on this topic by McGuire (1979) and McGuire and Barnhard f

(1981) is not that the historical rate of activity is well determined. j Rather, the value of these studies is that they show that even though the l l

I rates of activity in the East are poorly determined, a reasonable approach to hazard analysis for exposure times of about 50 years in this region is to i assume a stationary model of the rate of seismic activity. This approach is [

useful only in light of the current lack of knowledge of the cause of f l

t i

l

B-6

)

earthquakes in this region. Perhaps this approach should be referred to as being " reasonable" rather than " realistic" (see Table 1 of ERTEC report).

The ultimate test of such an approach to hazard assessment is, simply, an accurate deterministic model of the causative mechanism of earthquakes in the j Eastern United States. At the present time, such a model is not available.

Thus, the assumptions used in the ERTEC report regarding rates of activity are just that, assumptions.

Perhaps the historical earthquake activity in China studied by McGuire (1979), for comparison with the Eastern United States, was anomalously stationary due to a process that is at present unknown. Future investigators may discover that the rate of activity in the Eastern United States during the past two centuries was anomalously low or high by an order of magnitude or perhaps even more. If, for example, seismic gap theory (proposed for seismic hazard studies in the vicinity of plate boundaries; e.g., McCann et al.,1979) is found to be applicable to intraplate earthquakes, then there might be long periods of seismic quiesence premonitory to impending large earthquakes in this region.

Does the rate of activity observed for the past 200 years in the East represent an intraplate variation of a seismic gap, or is this rate a result of many years of aftershocks of a large earthquake such as the New Madrid event of 18117 Such questions can not be answered without an accurate deterministic mooc1 of the cause of earthquakes in the East.

Maximum Magnitude:

It is not clear which hypotheses are being referred to in the ERTEC report that restrict the recurrence of Cape Ann, Massachusetts type earthquakes to areas in New England; the author should have cited some references.  !

4 suspect, however, that the author is referring to an apparent association between the northwest southeast trend of seismicity in this region, and a landward extension of the New England seamounts that was discussed by Olment

B-7 et al. (1972),- Sbar and Sykes (1973), and Fletcher et al. (1973). This trend crosses the Ottawa-Bonnechere graben and Mesozoic intrusions that postdate the initial separation of North America from Africa (Sykes,1978). The association between the trend of seismicity (the so-called " Boston-Ottawa seismic belt") and these tectonic features (possible candidates for ancient zones of weakness reactivated by the present-day stress field) has been analyzed in_ detail by Sykes (1978), Further analysis of the correlation by Yang and Aggarwal (1981) showed that there are a number of reasons tn question the existence of such a seismic belt.

The monitoring of carthquakes by a dense microearthquake network in the Northeastern United States reveals a gap in the Boston-Ottawa trend that goes through Verment (Yang and Aggarwal,1981). This gap (although not as distinct) can also be seen in the historical record of seismicity (e.g.,

Chiburis,1981). In addition, the pattern of crustal stress in this region appears to be different to the southeast of Vermont than to the northwest (e.g. , Yang and Aggarwal,1981). This observation suggests that earthquake processes may be different in the cluster of seismicity that lies to the southeast of Vermont than it is in the northwestern part of the Boston-Ottawa trend.

There.is, therefore, no convincing geophysical evidence to support the existence of a Boston-Ottawa seismic belt within which earthquakes are of similar tectonic origin. Hence, I see no reason to exclude earthquakes near Cape Ann, Massachusetts from the Piedmont region. If the 1982. earthquake in New Brunswick, Canada is to be included in this province, as stated in the ERTEC report, then certainly earthquakes that occurred near Cape Ann should be.

LARGE' EARTHQUAKES NEAR THE LIMERICK SITE ,

Appendix B of the ERTEC report discusses the credibility of hypotheses

'that allow an' earthquake of the size of the 1886 Charleston event to occur in s

T..

B-8 the vicinity of the Limerick Generating Station. As stated in Appendix B, calculations of the hazard at the site are sensitive to the subjective probability assigned to such hypotheses. In the main report a subjective probability of ten percent was assigned to the " Decollement" hypothesis, and this hypothesis can be considered to be representative of any hypothesis that treats the entire eastern seaboard as one seismogenic zone, thus allowing for an earthquake the size of the Charleston event to occur at the Limerick site.

Since no explanation has been found for the cause of the 1886 Charleston earthquake, there is no particular reason to exclude such an event from anywhere along the eastern seaboard. Thus, a probability of ten percent may be an underestimate for the credibility of tectonic hypotheses which would allow a large earthquake (M=7) in eastern Pennsylvania. Perhaps the twenty-five to thirty percent probability for the scientific credibility of such an hypothesis (as suggested by at least one of the experts consulted in Appendix B) is not unreasonable. Also, in evaluating Appendix B, it would be useful to know the distribution of responses on this issue: 1.e., how many of the experts assigned a high probability (25-30%), and how many a low probability (0%) to the credibility of such an hypothesis?

EARTHOUAKE CATALOGUES There is no mention in the ERTEC report of the fact that there may be a bias in tiie distribution of seismicity shown in Figure.1 due to incomplete reporting and/or recording of events. While the lower bound of mb=4.5 (MM intensity V-VI) that was used for the part of the study estimating seismic ground motion seems appropriate, it is not clear to what extent the incompleteness of catalogues for smaller events could affect other parts of the study.

Incomplete reporting could, for example, have an effect on the various studies of determination of seismogenic zones. The report states that, i 1

consistent with the level of effort available for this study, it relies  !

heavily on the work of others (p.1). This approach is justified, and a t

i L. .__

B-9 serious evaluation of the completeness of the catalogues used is justifiably beyond the scope of the study. Nonetheless, the report should state that com-pleteness of catalogues could be a problem. This omission, again, creates an impression that the phenomenon of Eastern United States earthquak'es is better understood than it really is.

SUMMARY

AND CONCLUSIONS The general writing style of " Seismic Ground Motion at the Limerick Generating Station," a report prepared by ERTEC Rock Mountain, Inc., gives an unrealistic impression that more is known about earthquakes in the Eastern United States than really is,known. For example, the report relies heavily on the concept of seismogenic zones "within which earthquakes are considered to be a similar tectonic origin," but fails to state explicitly that the

" tectonic origin" of all earthquakes along the entire eastern seaboard remains a mystery. Also, the following technical problems have been found with the report:

• The conclusion derived from studies by McGuire (1977), McGuire (1979),

and McGuire and Barnhard (1981) that the rate of seismic activity in the Eastern United States is well determined is, at least to some ex-tent, overstated.

• Earthquakes near Cape Ann, Massachusetts are assumed to be excluded from the " Piedmont" seismogenic zone, and there is no convincing geophysical evidence to support this assumption.

• A subjective probability of ten percent was assigned to the credibility of any and all hypothesis that allows an earthquake the size of the 1886 Charleston event to occur in eastern Pennsylvania. This probabil-ity, suggested by at least one of the experts consulted in Appendix B, is not unreasonable.

B-10 1 1

There is so mention in the report of the fact that there may be a bias in the distribution of seismicity shown in Figure 1 due to incomplete reporting and/or recording of earthquakes.

Despite these significant problems, the results contained in the ERTEC re-port can still be of practical value. The peak ground motion curves (shown in Figure 9 of the report) for all seismogenic zonation models are of practical value since they illustrate the very wide range of hazard assessments that re-sult from the lack of knowledge of the cause of earthquakes in the East. In assessing the seismic hazard it is useful to know how sensitive the resulting hazard evaluation is to changes in the geometry of seismogenic zones. This is particularly true in cases like the East, where all zonation models are very speculative.

The results shown in Figure 9 for the " Decollement" hypothesis probably yeild a reasonable estimate of the maximum seismic ground motion to be ex-pected at the Limerick site. This conclusion is ironic, since " Decollement" is possibly the most speculative of the four hypotheses considered. None-theless, the practical application of " Deco 11ement" is ultimately useful, since its essential feature (as far as calculated seismic hazard is concerned) is that it treats the entire eastern seaboard as one seismogenic zone. This allows for the possibility that large earthquakes, such as the 1886 event near Charleston, SC, could occur anywhere in that area, thus resulting in a reasonable estimate of the seismic hazard at the Limerick Generating Station.

REFERENCES Ando, C. J. , Cook , F. A. , Oliver, J. E. , Brown , L. S. , Kaufman, S. , Klemperer, S., Czuchra, B., and Walsh, T., C0 CORP seismic reflection profiling in the New England Appalachians and implications for crustal geometry of the Appalachian Orogen, EOS, Trans.. Am. Geophysical Union, 62, No.45, p.1046, 1981.

j B-11 Barstow, N. L. , Brill , K. G. , Nuttli , 0. W. , and Pomeroy, P. W. , An approach to seismic zonation for siting nuclear electric power generating facilities in the eastern U.S., USNRC, NUREG/CR-1577, 1980.

Brown, L., Ando, C. , Klemperer, S. , Oliver, J. E. , Kaufman, S. , Czuchra , B. ,

Walsh, T., and Isachsen, Y., Adirondack-Appalachien crustal structure:

The C0 CORP Northeast Traverse, EOS, Trans., Am. Geophys. Union, 63, No.

18, p.433, 1982.

Chiburis, E., Seismicity, recurrence rates, and regionalization of the northeastern United Stater and adjacent southeastern Canada, USNRC, NUREG/CR-2309, 76 pp., 1981.

Cook, F. A., Albaugh, D., Brown, L. , Kaufman, S. , Oliver, J. , and Hatcher, R., Thin-skinned tectonics in the crystalline southern Appalachians:

C0 CORP seismic reflection profiling of the Blue Ridge and Piedmont, Geo-logy, 7, p.563-567, 1979.

Diment, W. H., Muller, O. G., and Lavin, P. M., Basement tectonics of New York and Pennsylvania as revealed by gravity and magnetic studies, in Caledonides on the USA, published by Virginia Poly. Inst. and State Univ. , Blacksburg , VA,1979.

Diment, W. G., Urban, T. C., and Revetta, F. A., Some geophysical anomalies in the eastern United States, in The Nature of the Solid Earth, Ed. E. C.

Robertson, P.544-572, 1972.

Fletcher, J. B., Sbar, M. L., and Sykes, L. R., Seismic trends and travel-time residuals in eastern North America and their tectonic implications, Geol. Soc. Am. Bull.: 89, p.1656-1676, 1978.

Hamilton, R., Geological origin of eastern U. S. seismicity, in Earthquakes and Earthquake Engineering, Eastern United States, Vol .1, Ed. J. E. Be-avers, p.3-24, 1981.

B-12 McCann, W. R., Nishenko, S. P., Sykes, L. R., and Krause, J., Seismic gaps and plate tectonics: Seismic potential for major plate boundaries, Pure and Appl. Geophys., Vol.117, p.1083-1147, 1979.

McGuire, R. K., Effects of uncertainty in seismicity on estimates of seismic hazard for the east coast of the United States, Bull. Seis. Soc, Am.,

Vol .67, No.3, p.827-848,1977.

McGuire, R. K., Adequacy of simple probability models for calculating felt-shaking hazard using the Chinese earthquake catalog, Bull. Seis.

Soc. fm., Vol.69, p.877-892, 1979.

McGuire, R. K., and Barnhard, T. P., Effects cf temporal variation in seismicity on seismic hazard, Bull . Seis. Soc. Am., Vol .71, p.321-334, 1981.

Sbar, M. L., and Sykes, L. R., Contemporary compressive stress and seismicity in eastern North America: An example of intraplate tectonics, Geol. Soc.

Am. Bull . , Vol .84, p.1861-1882,1973.

Seeber, L., and Armbruster, J. G., The 1886 Charleston, South Carolina earthquake and the Appalachian detachment, Journ. Geophys. Res., Vol.86, No.B9, p.7874-7894,1981.

Sykes, L. R., Intraplate seismicity, reactivation for preexisting zones of weakness, alkaline magmatism, and other tectonism postdating continental fragmentation, Rev. Geophys, and Space Phys., Vol.16, p.621-688, 1978.

Yang, J. P., and Aggarwal, Y. P., Seimotectonics of the northeastern United States and adjacent Canada, Journ. Geophys. Res., Vol.86, No.B6, p.4981-4988, 1981.

U S. NUCLEL4 kEGULATC4WY COMMIS$ toss 1 F Et05Y NUM.En 4Assvaed er T10C. add For 43, etpyl 8eRC PORM 335 G S48

%Tyd2'- BIBLIOGRAPHIC DATA SHEET NUREG/CR- 3493 su .~sT UCT,cks o= T-E in East BNL-NUREG-51711 2 TsTLE AND suti LE 3 LE AVE BLANK A Rev w of the Limerick Generating Station f

/

Severe ccident Risk Assessment 4 OATE a[ PORT COUPLETED Review f Core-Melt Frequency oc~T- j j

,EA.

• ^"'"" arm, R.A. Bari, J.L. Boccio, N. Hanan, July / 1984 M.A.

I.A. Pa zoglou, C. Ruger, K. Shid, J. Reed, '#^" a"oa' '55u'o M. McCan A. Ka f ka .

Jul v /

" / l 1984

7. . E .oa ,~o onsA,i2 Ai .O A.E A~ iu=G Aoo.Ess ,,..i. C , . .oacrY won u~,T ,,u..E.

Brookhaven Nationa - Laboratory , , , , , , , ,,,,,,,,,,

Upton, NY 11973 A 393 .

10. sPON$QR,NG ORGANi2ATsON NAME AND MAeLING ADDREs . . Nr l Cool lla Y EO, REPORT Division of Safety Technolo Office of Nuclear Reactor Reg ation U.S. Nuclear Regulatory Commiss n, [,,,,,,,,,,,,,,,,_,

Washington, D.C. 20555 (

12 sutPLEMENT ARY NOTES Pertains to Docket N6. 50-352 and 5 53.

....sT_A _ _ _ s A li.nited review is performed of e Severe Accident Risk Assessment for the Limerick Generating Station. Th .revie considers the impact on the core-melt frequency of seismic- and fire-hiti ing events. An evaluation is performed of methodologies used for deterp' ing the event frquencies and their impacts on the plant components an structures. Particular attention is given to uncertainties and crit 1 assumptions. Limited requantification is performed for selected r ~ melt accident sequences in order to illustrate sensitivities of th resu ts to the underlying assumptions.

t

i. oocuue=T A%ALysis - . nE vnoaos,otscairYoas is Av, AgiL;T v Limerick Generating Station Core-melt frequency Severe Accident Risk Assessment ( Unlimited Seismic- and Fire-Initiating Events ,,, ,

. ioE~Ti. Eas o,E~ E~of o TE ..s -

Unclassified Iine reportl Unclassified 17 NuveEm O* PAGEs i$ PRILE

r ,

I UNITE] STATES sounTWCLA$$ CDL NUCLEAR RE~ULATO1Y COMMISSIEN Postast & Fits Paio WASHINGTON, D.C. 205S5 ,vgnoc tenuiT Ne 111 OFFICIAL BUSINESS FENALTY FOR PRIVATE USE. 4300 T

- 1ANtGF 1

1/Os55070BII fgyUD V _ll 3 MOR WM 20sss Niv ' fgfIh,T oc w ssh1NGTOM

"