ML20097E965

Notice of Svc of Pr Clark Transmitting Delian Corp 840827 Document on Risks to Operation of TMI-1 Due to TMI-2 Cleanup,To HR Denton.Certificate of Svc Encl.Related Correspondence

ML20097E965
Person / Time
Site:	Three Mile Island
Issue date:	09/14/1984
From:	Blake E METROPOLITAN EDISON CO., SHAW, PITTMAN, POTTS & TROWBRIDGE
To:
References
SP, NUDOCS 8409180329
Download: ML20097E965 (124)

Text

. a '33%-

REL Ji:r t 2. ..::M, a

UNITED STATES OF AMERICA jjj,[.'l* ?>

NUCLEAR REGULATORY COMMISSION BEFORE THE COMMISSION In the Matter of )  :(ilc.y

) Docket No.

METROPOLITAN EDISON COMPANY )

50-289 (Restart)

Lf (Three Mile Island Nuclear )

Station, Unit No. 1) )

NOTICE TO COMMISSION, BOARDS AND PARTIES Enclosed for Commission, Boards and Parties is copy of letter to Harold R. Denton, Director, NRR, from P. R. Clark, President, GPU Nuclear, forwarding a Delian Corporation document on risks to operation of TMI-l due to TMI-2 and its cleanup as well as the Delian document.

Respectfully submitted, SHAW, PITTMAN, POTTS & TROWBRIDGE hp, , ' 's '. // (ed ,N, Ernest L. Blake, Jr., P.C.

Counsel for Licensee DATED: September 14, 1984 8409180329 840914 gDRADOCK 05000289 PDR 3Soa

6 t

e UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE COMMISSION In the Matter of )

) Docket No. 50-289 METROPOLITAN EDISON COMPANY ) (Restart-Management Phase)

(Three Mile Island Nuclear )

Station, Unit No. 1) )

CERTIFICATE OF SERVICE I hereby certify that copies of " Notice to Commission, Boards and Parties", dated September 14, 1984, were served to all those on the attached Service List by deposit l' the United States mail, postage prepaid this 14th day of September, 1984.

Qu, , i

< al ti ,

Ernest L. Blake, Jr., P.C.

DATED: September 14, 1984

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION Before the Commission In the Matter of )

)

METROPOLITAN EDISON COMPANY ) Docket No. 50-289 SP

)

(Three Mile Island Nuclear ) , Restart - Management Phase)

Station, Unit No. 1) )

SERVICE LIST Nunzio J. Palladino, Chairman Administrative Judge U.S. Nuclear Regulatory Commission John H. Buck Washington, D.C. 20555 Atomic Safety & Licensing Appeal Board Thomas M. Roberts, Commissioner U.S. Nuclear Regulatory Commissio$

U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Washington, D.C. 20555 Administrative Judge James K. Asselscine, Commissioner Christine N. Kohl U.S. Nuclear Regulatory Commission Atomic Safety & Licensing Appeal Washington, D.C. 20555 Board U.S. Nuclear Regulatory Commissic?

Frederick Bernthal, Commissioner Washington, D.C. 20555 U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Administrative Judge Ivan W. Smith, Chairman Lando W. Zeck, Jr., Commissioner Atomic Safety & Licensing Board U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commissio9 Washington, D.C. 20555 Washington, D.C. 20555 Administrative Judge Administrative Judge Gary J. Edles, Chairman Sheldon J. Wolfe Atomic Safety & Licensing Appeal Atomic Safety & Licensing Board Board U.S. Nuclear Regulatory Commissio3 U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Washington, D.C. 20555 E

o Administrative Judge Mr. Henry D. Hukill Gustave A. Linenberger, Jr. Vice President Atomic Safety & Licensing Board GPU Nuclear Corporation U.S. Nuclear Regulatory Commission P.O. Box 480 Washington, D.C. 20555 Middletown, PA 17057 Docketing and Service Section (3) Mr. and Mrs. Norman Aamodt Office of the Secretary R.D. 5 U.S. Nuclear Regulatory Commissio,n Coatesville, PA 19320 Washington, D.C. 20555 Ms. Louise Bradford Atomic Safety & Licensing Board TMI ALERT Panel 1011 Green Street U.S. Nuclear Regulatory Commission Harrisburg, PA 17102 washington, D.C. 20555 Joanne Doroshow, Esquire Atomic Safety & Licensing Appeal The Cnristic Institute Board Panel 1324 North Capitol Street U.S. Nuclear Regulatory Commission Washington, D.C. 20002 Washington, D.C. 20555 Lynne Bernabei, Esq.

• " ^ "

Jack R. Goldberg, Esq. (4) Pr c Office of the Executive Legal 1555 Connecticut Avenue Washington, D.C. 20009 U.S uc ar Regulatory Commission Washington, D.C. 20555 Ellyn R. Weiss, Esq.

Marmon, Weiss & Jordan Thomas Y. Au, Esq. 2001 S Street, N.W., Suite 430 Office of Chief Counsel Washington, D.C. 20009 Department of Environmental Resources Michael F. McBride, Esq.

505 Executive House LeBoeuf, Lamb, Leiby & MacRae P.O. Box 2357 1333 New Hampshire Avenue, N.W.

Harrisburg, PA 17120 Suite 1100 Washington, D.C. 20036 Michael W. Maupin, Esq.

Hunton & Williams 707 East Main Street '

P.O. Box 1535 Richmond, VA 23212

4{ ,

GPU Nuclear Corporation 3m ads ys 100 Interpace Parkway Mw W5iB u Parsippany. New Jersey 07054 201 263 6500 TELEX 136 482 Writer's Direct Dial Number:

September 11, 1984 (201) 263-6797

" e

',@rqy ~

h v.'-

5 SCP 131984 Mr. Harold R. Denton, Director -

Office of Nuclear Reactor Regulation , S. P. P. & T. j; United States Nuclear Regulatory Commission g Itail Stop P-426 %_gs -d 4 Washington, DC 20555 -,

I

Dear Mr. Denton:

My letter dated August 13, 1984 provided copies of a report entitled, " Assessment of the Risks to Safe Operation of TMI Unit 1 Resulting from TMI Unit 2 and Its Cleanup" which was prepared by a subcommittee of the TMI-2 Safety Advisory Board. As promised in that letter, a copy of the reference document by Delian Associates, which provides the basis for many of the subcommittee's conclusions, is enclosed.

We are providing a copy of the report to Governor Thornburgh and serving it on the parties and Licensing Boards for the TMI-l Restart Proceeding.

Please de not hesitate to contact us if you would like to discuss the report or require any additional infomation.

Very truly yours,

/

P. R. Clark President pfk Enclosure bicc: W. L. Gifford E. E. Kintner R. E. Rogan j F. R. Standerfer R. Blake Esquire f l

l GPU Nuclear Corporahon is a subsidiary of the General Pubhc Utilibes Corporation J

-c

>9 f

M

- J.a- , ,

CORPORATION

?

t T

4 4

4 i

1 i

4 I

?

e l

l 4

I I

I

\

-rw~ .e-,~ ,weee,n,-- we,ew- - , , , ,,,-w.m ..rn m n--, ,,,--s,.

o .t>

1-R-84-03 ASSESSMENT OF THE RISKS TO SAFE OPERATION OF TMI UNIT 1 RESULTING FROM TMI UNIT 2 AND ITS CLEANUP Submitted to:

GPU NUCLEAR CORPORATION 100 Interpace Parkway Parsippany, New Jersey 07054 Submitted by:

DELIAN CORPORATION 296 Duff Road Monroeville, Pennsylvania 15146 (412)856-5700 August 27, 1984

m I

a ,

ABSTRACT A logical approach based on risk and reliability principles has been used to assess the risks to safe operation of Three Mile Island Unit 1, result-ing from Three Mile Island Unit 2 and its cleanup. Both original work and work previously performed were used in support of this assessment.

This report examines the possible impacts of various event categories including fires, explosions, missiles, the release of toxic chemicals, and the release of radioactive materials from Three Mile Island Unit 2 on the integrity of the physical barriers to radioactivity release at Three Mile Island Unit 1.

No Three Mile Island Unit 2-related event that is risk-significant with respect to the maintenance of safe conditions at Three Mile Island Unit I was discovered.

e i

r o a.

TABLE OF CONTENTS Section Page ABSTRACT i TABLE OF CONTENTS ' 11 APPENDICES iii LIST OF TABLES iv LIST OF FIGURES y

1.0 INTRODUCTION

AND

SUMMARY

OF FINDINGS 1-1 1.1 CHARTER 1-1 1.2 APPROACH 1-1 1.3 SCOPE OF WORK 1-3 1.4

SUMMARY

OF FINDINGS 1-4 2.0 ' BACKGROUND AND METHODOLOGY 2-1 2.1 OVERVIEW 0F THE EVALUATION PROCESS 2-1 I

2.2 EXAMINATION OF PLANT CONDITIONS 2-1 i

2.3 EVALUATION OF INTER-UNIT DEPENDENCIES 2-3 2.4 DEFINITION OF SAFE CONDITIONS 2-3 t

2.5 EVENT CATEGORIZATION AND FAULT TREE DEVELOPMENT 2-4 2.6 EFFECTS ANALYSIS AND LIKELIHOOD ASSESSMENT 2-5 3.0 RESULTS 3-1 3.1 EVENTS INVOLVING COMMON PHYSICAL LOCATIONS OF EQUIPMENT 3-1 3.2 EVENTS INVOLVING HAZARD TRANSPORT FROM TMI-1 TO TMI-2 3-4 3.3 EVENTS INVOLVING HUMAN ERROR 3-5 l 3.4

SUMMARY

OF RESULTS 3-6

4.0 REFERENCES

4-1 6

l ii

APPENDICES Appendix A

SUMMARY

OF PLANT CONDITIONS B INTER-UNIT DEPENDENCY NETWORK -

SPECIFICATION AND EVALUATION

, C DEFINITION OF SAFE CONDITIONS FOR TMI-1 RISK ASSESSMENT D FAULT TREE DEVELOPMENT FOR TMI-1

, RISK ASSESSMENT E EF'FECTS ANALYSIS F RADI0 ACTIVITY RELEASE INVESTIGATIONS f

I I

fii

, u LIST OF TABLES Table Pace 1-1 Event Types Considered for 1-2 TMI-1 Risk Assessment 2-1 Evaluation Process Elements for 2-2 TMI-1 Risk Assessment A-1 Characterization of TMI-2 Radionuclide A-3 Activities and Distributions C-1 Critical Safety Functions for TMI-1 C-3 Risk Assessment C-2 Means for Critical Safety Function C-6 Maintenance at TMI-1 C-3 Impact Elements for TMI-1 Risk Assessment: C-10 Physical Barriers to Release of Radioactive Materials C-4 Impact Elements for TMI-1 Risk Assessment: C-13 Equipment Required to Ensure Maintenance of Category I Critical Safety Functions C-5 Impact Elements for TMI-1 Risk Assessment: C-14 Equipment Required to Ensure Maintenance of Category II Critical Safety Functions .

C-6 Impact Elements for TMI-1 Risk Assessment: C-15 Equipment Required to Ensure Mainter.ance of Category III Critical Safety Functions E-1 Shared Systems and Components for TMI-1 E-t and TMI-2 E-2 TMI-1 General Plant Areas and Externally ' E-8 Situated Components: Location and Design Features Relevant to Effects Analysis E-3 Locations of Equipment Required to Maintain E-25 Category I Critical Safety Functions at TMI-1 E-4 Potentially Significant Events for TMI-1 Risk Assessment E-28 F-1 Baron Dilution Monitoring at TMI-2 F-15 F-2 Comparison of Isotopes for Potential TMI-2 F-26 Core Releases F-3 . Postulated Core Inventory Releases and F-27 Resulting Concentrations iv

~

LIST OF FIGURES l- Figure 1.1 . Fault Tree Defining Event Categories For 1-5 TMI-1 Risk Assessment 4

Figure B.1 General Dependencies Between TMI Unit-1 B-2 and TMI Unit 2 i

i 4

e e

V

1.0 INTRODUCTION

AND

SUMMARY

OF FINDINGS 1.1 CHARTER A Special Subcomittee of the Safety Advisory Board for Three Mile Island Unit 2 (TMI-2) was requested by Mr. P. R. Clark, President of GPU Nuclear Corporation to " undertake for GPU Nuclear an independent technical assessment of the risks to safe operation of the TMI-1 plant which results frcm the TMI-2 plant and its cleanup." This document contains supporting technical information for the Subcommittee's report.

1.2 APPROACH A logical approach based on risk and reliability principles was used in the assessment. The approach can be- broadly characteri:ed as being ccm-prised of the following three steps:

1. Identification of events that would preclude maintaining TMI-1 in a safe condition;

2. Determination of the possibility for these events to be caused by TMI-2 and its cleanup;

3. Assessment of the likelihood that any events identified in Item 2 can preclude maintenance of safe conditions at THI-1.

Figure 1.1 provides a fault tree depiction of TMI-2 event types (or categories) that could preclude maintaining TMI-1,in a safe condition. This figure served as the starting point for the assessment and can be considered as the representation of the first step ,in the process. Events at TMI-2 may have direct effects on safety at TMI-1 (immediately resulting in release of radio-active materials beyond acceptable limits from TMI-1) or indirect consequential effects on safety at TMI-1 (impacting equipment or personnel required to control releases of radioactive materials from TMI-1). The event types con-sidered in this study are also listed in Table 1-1, 1-1

Table 1-1 EVENT TYPES CONSIDERED FOR TMI-1 RISK ASSESSMEllT

1. Location Commonality--Systems Inter-Ties

2. Location Commonality--Proximity Only

3. Solid Material Hazard Transport--Missiles

4. Solid Material Hazard Transport--Fire Propagation

5. Liquid Hazard Transport--Radioactivity

6. Liquid Hazard Transport--Chemicals

7. Liquid Hazard Transport--Onsite--Induced Flooding

8. Liquid Hazard Transport--Ccmbustible Liquids

9. Atmospheric Hazard Transport--Smoke

, 10. Atmospheric Hazard Transport--Radioactivity

11. Atmospheric Hazard Transport--Toxic Gases

12. Atmospheric Hazard Transport--Explosion (Shock)

13. Atmospheric Hazard Transport - Fire

14. Human Error I

1-2

In order to determine if events categorized in Table 1-1 could be caused by TM1-2 and its cleanup operations, the assessment team relied upon their personal knowledge of the TMI plants, existing documentation, and the assurances of GPU personnel with detailed knowledge of critical plant design features or analyses used to support study conclusions.

For events which were determined to be possible, estimates of their likelihood were obtained from previous work, or developed specifically as part of this effort. Generally, such estimates were qualitative rather than quantitative.

1.3 SCOPEOFSTdDY The scope of this study was essentially limited to a rapid assessment of readily available documentation, supplemented by information provided orally by GPU Nuclear personnel in response to questions posed by members of the review team. For certain event categories, quick quantitative evaluations of consequences were performed. The bulk of the information supporting the assessment was derived from pre-existing risk or consequence analyses, design basis analyses, safety evaluation reports, or other data sources which have been developed to support TMI-2 cleanup operations or the TMI-1 restart.

An overall quantitative statement of risk could not be developed within the time period allowen for the assessment. As the results of this assessment demonstrate, such a detailed approach is not necessary to understand and characterize the importance of salient ovent categories at TMI-2 to the overall risk of TMI-1 operation.

The review team made every attempt to identify all TMI-2 events which might have a significant impact on the safe operation of TMI-1. The appli-cation of 'the systematic assessment approach described combined with the considerable experience of the review team members minimizes the likelihood that a serious emission has been made.

s 1-3 s

d r 1.4

SUMMARY

OF FINDINGS No TMI-2 related event that was risk-significant with respect to the maintenance of safe conditions at TMI-1 was discovered in this assessment.

The basis for this conclusion is' fully described in the body and appendices of the report.

This risk assessment was based on currently-available information.

The exact details of certain TMI-2 recovery processes have yet to be defined.

Therefore, the possibility remains that materials or activities related to TMI-2 recovery can pase a future hazard to the safe operation of TMI-1, if not fully evaluated prior to their application.

The personnel involved in planning and executing recovery operations at TMI-2 are cognizant of their responsibility to assess the impact of any decision on the continued safety of TMI-1 operations. They are supported in their fulfillment of this responsibility by members of governmental and regulatory bodies. Activities have been and will continue to be fully evaluated as. to their impact on the continued safety of TMI-1. This provides additional assurance that TMI-2 recovery operations will not preclude the safe operation of TMI-1.

1-4

4 i

pas a

j, L

j $~

E

,[ O sO $

il  :

.. Il O ri s ,i f

-ll IQ l!!f! e r,,

a Ef i ap l El f 25 U

I l ;!f! ljil! 3 rpiis_t I

!lI1jl'l! alll :  ;

'ljr 8lI!!!' 4e ge.

e ll bl'

.F

=

m A

4!IIIO al x e

ultill # =a 1;1111g 1;liir 6 tf g i*

g,I -

c I k~

iills #

1l;i F Ai ,d, i ri lii fq5 jjP 3,y

- i i i i

s 2.0 BACXGROUND AND METHODOLOGY To perform the assessment in an efficient manner, yet assure its effectiveness, it was necessary to structure the review of TMI-2 events and their effects on TMI-1 in a systematic fashion, using an evaluation process based on classical risk assessment methods.

2.1 OVERVIEW OF THE EVALUATION PROCESS The specific evaluation process, although based on the three funda-mental steps discussed in Section 1.2, was substantially more detailed. This portion of the report 'is intended to delineate the salient aspects of the evaluation _ process, and will serve as a directory to the parts of the report which fully document particular elements of the process.

Table 2-1 lists in order of their performance, the essential elements of the evaluation process. They . are summarily described in the following subsections.

2.2 EXAMINATION OF PLANT CONDITIONS It was important for all review team mem:;ers to become familiar with existing conditions at both TMI-1 and TMI-2. It was also necessary for team members to' review existing recovery plans for TMI-2, in order to assess risks to safe operation of TMI-1 throughout the entire recovery process from the present time to its completion. The condition of each plant and the possible future operating can'ditions for each plant detemine the range of potential events (hence consequences) which must be considered during the assessment process. '

s

- Several review team members were already cognizant of plant condi-tions and recovery plans through their previous involvement with the TMI-2 Safety . Advisory Board. The remaining reviewers utilized existing design,

}* analysis, and licensing documentation and personal discussions with GPU Nuclear personnel and members of the Safety Advisory Board to familiarize themselves with both plants. Visits to the TMI site also added to the reviewer's knowl-edge base.

2-1

~ . - - -_ -.__._._ _ _ _ . _

Table 2-1 EVALUATION PROCESS ELEMENTS FOR TMI-1 RISK ASSESSMENT

1. Examination.of Plant Conditions Present Future

2. Evaluation of Inter-Unit Dependencies

3. Definition of Top-Level Event for Fault Tree (definition of term " safe conditions")

4. Event Categorization and Fault Tree Development

5. Effects Analysis

- Identification of "significant events"

6. Likelihood Assessment for all Identified Significant Events

7. Final Relative Risk Judgement l

i 2-2

Details of plant conditions used as the basis for assessment purposes are documented in Appendix A. These can be summarized as follows:

TMI-1: Presently shut down; undamaged with requirement equipment and systmes maintained according to plant Technical Specifications. Can operate in any mode from refueling to full power conditions. ,

iMI-2: Presently the core is in a stable shutdown condition with a very low residual decay heat level. The Reactor Vessel head has been removed in preparation for defueling. Radioactive material distribution around the plant is unusual. when compared to a "typ-ical" plant, although the present inventory of radio-nuclides is much reduced compared to a typical op-erating plant. The general process for defueling is well-defined. Details for each specific activity in the process are now being defined, and a safety evaluation is being performed where hazard potential is identified.

2.3 EVALUATION OF INTER-UNIT DEPENDENCIES To support the assessment, it was necessary to develop a systematic approach to the identification and consideration of potential interactions between units at the TMI site. A general dependency logic for interactions was investigated, since in concept the study to be complete had to consider not only primary events (TMI-2 events with direct effects on TMI-1) but also higher-order event sequences (e.g., TMI-1 events affecting TMI-2 in such a way that a consequential effect was seen at TMI-1.) As a result of the inter-unit dependency evaluation performed and documented in Appendix B, it was determined that realistically complete coverage for this assessment could be provided by limiting the event sequence definition solely to TiiI-2 primary events.

2.4 DEFINITION OF SAFE CONDITIONS .

After identifying the scope of the event sequence analysis for the assessment, it was possible to develop a fault tree to link events at TMI-2 directly to effects at TMI-1. The fault tree approach (described further in Section 2.5 and Appendix D) provided structure for the assessment, and ensured that coverage of important event categories was obtained. The develcoment 2-3

the fault tree also required the development of a definition of" safe con-ditions" for TMI-1. The specific description of the top-level event for the fault tree provided a rigorous basis for deciding upon the acceptability or unacceptability of the consequences of TMI-2 events which can affect TMI-1.

Maintenance of safe conditions at TMI-1 was defined in termst of preventing the excessive release of radioactive materials as a result of the effects of TMI-2 events on three specific " impact elements" in TMI-1: physical barriers to radiation release; equipment required to maintain Critical Safety Functions; and operating personnel. Appendix C documents the process and reasoning used to define " safe conditions at TMI-1" for this risk assessment.

2.5 EVENT CATEGORIZATION AND FAULT TREE DEVELOPMENT The fault tree resulting from the application of the previously-described work was shown earlier as Figure 1.1. The fault tree itself system-atically defines the basic categories of events at TMI-2 that could preclude maintenance of safe conditions at TMI-1.

The major event categories considered for the assessment were TMI-2 events that could affect TMI-1 because:

1. They occurred at a location common to both units;

2. They resulted in a hazard at TMI-1 because a potential transport mechanism between units could be postulated for the hazard.

Another category was also considered for' completeness. This was the event which could create a hazard at TMI-1 because of human error in mistaking TMI-1 systems, components, or equipment for similar items at TMI-2 when performing operational, maintenance, repair, or replacement activities.

Details of fault tree development for this risk assessment may be found in Appendix D.

24

. ~

2.6 EFFECTS ANALYSIS AND LIKELIHOOD ASSESSMENT Appendix E to this report documents the assessment of the effects of TNI-2 events on the capability to maintain TMI-1 in a safe condition. If any event had the potential to result in radioactive material releases from TMI-1 beyond acceptable limits, it was designated a potentially significant event.

Where potentially significant events were identified as a result of the effects analysis, an estimate of their likelihood was made using existing information for similar types of events at similar nuclear plants, and specific information for TMI-1 and TMI-2. These likelihood assessments for potentially significant events are documented as part of this section.

When taken in the aggregate, the result of ccmbining the consequences of potentially significant events with their likelihood defines the level of risk attendant in the operation of TMI-1 during . the TMI-2 recovery phase.

Performing a similar assessment with an " operating TMI-2" assumed would provide information sufficient to judge the relative risk inherent in the future operation of TMI-1, when compared to the now . hypothetical (but previously acceptable) case where both TMI units were operating normally.

l l

l '

2-5 l

3.0 RESULTS This section documents, by fault tree event category, the results of the effects analysis performed for the risk assessment. Where the ultimate (potential) consequence predicted for a TMI-2 event was excessive release of radioactive material frcm TMI-1, the event was investigated further to estiinate its likelihood for causing TMI-1 radiation relea'se. This assessment of radiation release likelihood included a judgement on both the likelihood of occurrence for the primary event, and the likelihood that TMI-1 would be in an operating mode or plant condition where a release could occur as a result of the primary event.

Three potentially significant events were identified as the result of the effects analysis (Appendix E).

These were as follows:

1. Fire in the shared Fuel Handling Building truck bay area which destroys control and instrumentation circuits for TMI-1.

2. Fuel cask drop over the truck bay shipping area which penetrates the floor and severs redundant power cables to the Decay Heat River Water Pumps.

3. Fuel removal canister or SDS resin canister drop over the truck bay which penetrates the floor, and ruptures inside a TMI-1 piping penetration room, releasing radioactive material to TMI-1 Auxiliary and Fuel Handling Building ventilation system.

Each potentially significant event is evaluated in greater detail in this section of the report.

3.1 EVE?lTS INVOLVIrlG COMM0ft PHYSICAL LOCATIONS OF EQUIPME.'IT As indicated on the fault tree diagram (Figure 1.1) and described further in Appendix D, the event statement pertaining to this category is" Event in Location Ccmmon to Both Units Creates a Hazard That Precludes Maintenance of Safe Conditions at TMI-1."

3-1

m-o .

Lower-level categories of events identified were plant interactions through THI-1-to-TMI-2 system inter-ties and plant interactions through phys-ical proximity of equipment only. Reference to Table E-4 (Potential Signi-ficant Events) indicates that all three of the identified events can clearly be placed in the " proximity" category - although each, just at well., can also be placed in at least one other category. -

This result is not unanticipated, in that the possibility of physical damage to TMI-1 plant equipment or structures is most likely for situations where the plants adjoin.

Both heavy l'oad drop events (one damaging power supply cables to the Decay Heat River Water Pumps, one resulting in airborne radioactive material release to TMI-1 structures) will be assessed further in this subsection.

3.1.1 TMI-2 Fuel Cask Droo Resulting in Damage to TMI-1 Eauioment During removal of the TMI-2 core, it is anticipated that approx-imately 250 core materials canisters, each canister inside a transfer cask, each a lift of 15 tons, will be needed to fully remove the remaining solid material. The lifts which hazard TMI-1 will occur over the truck bay floor.

Dropping the canister / cask combination over certain areas could cause floor damage and possible severing of power cables to the TMI-1 Decay Heat River Water Pumps, as noted.in Appendix E.

The likelihood of the fuel handling crane carrying heavy loads over the critical areas of the truck bay is extremely small. The crane 15-ton interlock will be activated at 3,000 pounds, lines for safe travel areas are painted on the Fuel Handling Building floor, and administrative controls will be applied to all lifts. These precautions are intended to ensure that in the case of a load drop, only one Decay Heat River Water Pump power cable could be severed.

To further reduce the likelihood of this type of event damaging the truck bay floor, lifts will be kept very low until they are taken over the shipping cask on the railroad car. The design of the Fuel Handling Crane 3-2

P r

lifting and braking systems provides several means for load braking and limiting acceleration, including cases where crane power is lost. Thus, the likelihood that the cask will penetrate the concrete floor is further reduced, if it is dropped.

A final consideration in assessing the overall likelihood of excessive radiation release from TMI-1 as a result of severing both Decay Heat River Water Pump power cables is the likelihood that the pumps are required to ensure continued maintenance of Critical Safety Functions. The required time is limited to a fraction of the total opera +,ing time of the plant; it covers only -those modes of operation where steam generators are drained or otherwise ineffective for decay heat removal purposes, and the Decay Heat Removal System is the heat sink for the core.

The " accident rate" for the heavy load drop event was estimated to be no higher than 6 x 10-7/yr using a typical value for crane failure rate. and very conservative assuptions on the probability of operator drror, which is required to invalidate existing administrative strictures against moving the load over the area where both cables may be severed if a drop occurred.

The Decay Heat Removal System would generally be required to operate to remove core decay heat for no more than 15% of the total operating time of the unit. Therefore, an upper bound for the likelihood that then type of event can cause' excessive radiation releases from TMI-1 is certainly no more than 10-7/yr.

From a consequence standpoint, the limit'ing event scenario. would be the LOCA occurring coincidentally with the damaging load drop. The frequency of the combined event is estimated to be much less than 10-8/yr.

These consequences are bounded by the PWR-6 release category of WASH-1400 (loss of core cooling and containment spray system). Containment heat removal would still be possible because of the availability of Reactor Building fan-coolers. Considering both the maximum consequence of the event sequence and its extremely low likelihood, this event will not be a significant contributor to the overall risk of operation at TMI-1.

3-3

s .

3.1.2 TMI-2 Fuel Removal Canister or SDS Resin Canister Droo Resulting in Release of Radioactivity to TMI-1 Ventilation System The discussion of the previous sectwn regarding the operation of the Fuel ' Handling Crane, and the provisions made in design and procedures to ,

minimize the potential for damaging evants resulting from a heavy load drop also apply in-this case.

The likelihood that a fuel transfer canister or SDS zeolite resin canister will be dropped, will rupture, and will release a fraction of its I

contents to the surroundings after a drop that penetrates the concrete truck bay floor is also quite small. Coupled with the likelihood that personnel would be required to enter a TMI-1 plant area in the Auxiliary or Fuel Handling Buildings where mar.ual equipment operation is required to maintain Critical Safety Functions, the overall likelihood of this event is extremely small (approaching 10-7). Even if all activity released from the exposed fuel debris or resin were swept into the area where local action was required, an entry with several minutes stay would be supportable, using appropriate anti-contamination clothing and self-contained respiratory equipment. The results of consequence evaluations for these types of events were summarized in Section F.5.4.2. Considering both the estimated consequences and the likelihood that it can occur, this particular event sequence is, therefore, not a significant contributor to the o.verall risk of operation at TMI-1.

3.2 EVENTS INVOLVIflG HAZARD TRANSPORT FROM TMI-2 TO TMI-1 The event statement for this cate' gory on the fault tree is

~

" Event at TMI-2 Creates a Hazard at TMI-1 That Precludes Maintenance of Safe Conditions at TMI-1". ,

Lower-level hazard transport mechanisms identified were solid

material hazard transport, liquid material hazard transport, and atmospheric hazard transport.

3-4 L

. s The single significant event identified in this category is the total burnout of TMI-1 Fuel Handling Building Fire Zone FH-FZ-5 the communicating portions of the TMI-1 and TMI-2 Fuel Handling Buildings. While the environmental barrier installed after the TMI-2 event is ratable against fire, it has not been used in fire protection evaluations as a fire barrier.

The redundant TMI-1 equipment expected to be lost as a result of the total burnout of Fire Zone 5 is Control Building Emergency Ventilation Fan control circuits

- Pressurizer heater group 8/9 circuits

- BWST leyel indicator circuits.

These circuits are located in cable runs in the TMI-1 Fuel Handling Building patio area and will be protected by fire barriers in the future.

. These are scheduled for installation during the first refuelling outage after restart.

The consequences of losing these circuits .are relatively minor for most TMI-1 operating modes. Only in the event of a LOCA would the loss of BWST level pose a hazard, since switchover from injection to recirculation modes of ECCS operation must be performed on low level in the BWST. The probability of a simultaneous. fire affecting these circuits and a LOCA is so small as te result in a negligible overall contribution to TMI-1 risk. Furthermore, a fire-which could progress through the entire Fire Zone is hardly possible, given the amount of combustible material available in the area. An automatic fire suppression (sprinkler) system installed in the area between TMI-2 and TMI-1 provides additional protection against this type of fire.

This event sequence cannot significantly contribute to the risk of safe operation of TMI-1.

-3.3 EVENTS INVOLVING HUMAN ERROR This event category is described on the fault tree as " Human Error at TMI-2 Creates a Hazard That Precludes Maintenance of Safe Conditions at TMI-1."

3-5

i s .

For this assessment, the human error category was interpreted to be just human substitution errors made while intending to operate, repair, replace, or otherwise maintain TMI-2 equipment. The substitution error results when the TMI-2 activity is performed on TMI-1 equipment.

Other types of _ human error at TMI-2 which have the potential to affect TMI-1 are conceivable. However, these other types, of error are those

-which result in some plant event al TMI-2, which can be considered to be

' covered by the remaining event categories on the fault tree (direct interaction or hazard transport). The restriction of this category to human substitution error does not therefore result in a loss of general coverage for the effects of TMI-2 events on TMI-1.

The screening process carried out for the human error event category, and documented in Appendix E, noted the major physical differences between plants -(including certain unique features of the post-accident TMI-2) and concluded that an important hazard to safe operation of TMI-1 could not be imposed by this type of event.

8 3.4

SUMMARY

OF RESULTS No TMI-2 related event that was a significant contributor to the risk of TMI-1 operation was identified by this . ssessment.

e i

I i

3-6 i

L._

.. s e .

4.0 REFERENCES

This section is intended to document all printed (published or non-published) references used by the reviewers in performing this risk assessment. These printed references were substantially augmented by infonnation provided orally by GPU Nuclear personnel. Telephone mem'os and meeting minutes which comprise the record of these conversations are not listed herein. Footnotiny or other attribution of specific report data used for the text has not been universally performed.

References are given under the major topic for which they provided information. In several cases, investigations in other topics than the one for which a particular reference is listed were supported by that reference.

References once listed are not repeated under another topic.

4-1

. s .

REFERENCES FOR RISK ASSESSMENT TOPIC: GENERAL RISK AND CONSEQUENCE STUDIES

1. A Risk Assessment of a Pressurized Water Reactor for Class 3-8 Accidents, Washington, D.C.: U.S. Nuclear Regulatory Comission,

-October 1979, NUREG/CR-0603.

-2. Reactor Safety Study: An Assessment of Accident Risks in US Comercial Nuclear Power Plants, Washington, D.C.: U.S. Nuclear Regulatory Comission, October 1975, WASH-1400 (NUREG 75/014).

3. Final Programatic Environmental Impact Statement Related to Decontamination and 01soosal of Radioactive Wastes Resulting From tne March 28,1979 Accident--Three Mile Island Nuclear Station, Unit 2, Washington, D.C., U.S. Nuclear Regulatory Comission, Marcn 1981, NUREG-0683.

i l

l l

l l 4-2 L

O %

REFERENCES FOR RISK ASSESSMENT TOPIC: TMI-2 RECRITICALITY AND BORON DILUTION

1. An Evaluation of the Potential for and Consecuences of Recriticality During Cleanuo and Defueling at TMI-2, Argonne, Illinois: Argonne National Laboratory, February 1981, ANL/NRC-RAS 81-1.

2. "TMI-2 Criticality Studies," report to the TMI Safety Advisory Board, W. R. Stratton, February 1984.

3. Technical Plan: Nuclear Reactivity at TMI-2, GPU Nuclear - Bechtel National TP0/TMI-071, Rev. O, January 1984.

4. TMI-2 Post-Accident Criticality Analyses, GPU Technical Data Report TDR-049, Rev. O, Septemoer 1979.

5. " Potential for Boron Dilution of Reactor Coolant System," Draft GPU Hazards Analysis 4430-84-007R, Rev. O, July 1984.

6. Transient Boron Concentration Analysis in TMI-2 Mini Decay Heat Removal System, GPU Technical Data Report TOR-155, Rev. O, May 1980.

4-3

E O REFERENCES FOR RISK ASSESSMENT

' TOPIC: TMI-2 COPE COOLING AND ZIRCALOY FIRES

1. Data- Report: TMI-2 -Pyrophoricity Studies, GPU Nuclhar-Bechtel National TP0/TMI-120, Rev. A, June 1984

2. H. M. Chung and.C. H. Bowers, " Discussion of the Possibility of the Formation of Zirconium Hydrides during the TMI-2 Accident and the Subsequent Possibility of Authorization During Plant Clean-up."

Attachment to Argonne National Laboratory Letter of January 16, 1981.

3. Evaluation of Cooling Contingencies for Incore Instrument Tube Breaks, GPU Technical Data Report IDR-188, Rev. O, Feoruary 1981.

4. TMI-2 Emergency Procedure 2202-10.2, " Changing RCS Water Level Beyond Normal Span for Head Lift Activities." Information Copy of Rev. 4.

April 1984.

9 s

4-4 i-

-O %

REFERENCES FOR RISK ASSESSMENT TOPIC: TMI-2 RADIOLOGICAL RELEASE POTENTIAL

1. -" Risk Assessment Task Force Final Report," GPU Technical Data Report TDR-347.

2. Data Report: Radioactive Waste Management Summary Review, GPU Nuclear - Bechtel National IP0/TMI-043, Rev. 2, January 1984.

3. Planning Study: Location and Characterization of Fuel Debris in TMI-2, GPU Nuclear -

Bechtel National TP0/TMI-051, Rev. O, AprIT 1984.

4. "CRAC2 Runt for TMI-2," NUS Corporation Letter CD-CAs-84-092, (Project 1252.01), August 3, 1984.

5. NUS Corporation Letter CD-CAs-84-073, (Project 1252.01), July 18, 1984, (CCFs for TMI-2 Releases).

6. Submerged Demineralizer System Technical Evaluation Reoort, GPU Nuclear, June 1984, (TER-3527-006 Rev. 2).

7. USNRC Letter of July 17,1984, (Snyder to Kanga), (

Subject:

TMI-2 Containment Penetration Design).

8. ORIGEN Code Outputs, "TMI-2 Decay (Power History from EPRI NP-2722, Table 3-2)."

Activation Products

- Actinides + Daughters I

4-5

.=

q l

REFERENCES FOR RISK ASSESSMENT TOPIC: TMI-1 AND TMI-2 PLANT DESIGN FEATURES

-1. TMI-1 Final Safety Analysis Reoort, Section 1.2.7, " Hypothetical Aircraft Incident Summary,"

Update 1, July 1982.

Section 1.2.8, " Shared Components with Unit 2," Update 1, July 1982.

Section 2.6.4, " Flood Studies," Update 1, July 1982.

Section 5.0, " Containment System and Other Special Structures,"

Update 1, July 1982.

Section 6.0, " Engineered Safeguards," Update 1, July 1982.

Section 7.0 " Instrumentation and Control," Update 1, July 1982.

Section 8.0, " Electrical Systems," Update 2, July 1983.

- Section 9.0, "Auxilia ry and Emergency Systems," ' Update 2, July 1983. '

Section 11.3 " Radiation Shielding", Update 2, July 1983.

2. Evaluation of Design Features to Mitigate Radiological Consecuences of a Fuel Handling Accioent, GPU Tecnnical Data Report TDP-317, Rev. 1, May 1982.

3. GPU Nuclear (TMI-1) Nuclear Safety / Environmental Impact Evaluation Summary for Hittman Radwaste Solidification System, June 1982.

4. GPU TMI-1 General Arrangement Drawings for Auxiliary and Fuel Handling Buildings. ,

Drawing Number IE-154-02-002, Rev. O, (Plan E1.305').

Drawing Number IE-154-02-003, Rev. O, (Flan El.281').

5. GPU TMI-1 General Arrangement Drawings for Turbine Building.

Drawing Number 1E-151-02-001, Rev. O, Plan E1.305')

Drawing ~ Number 1E-151-02-004, Rev. O, Plan El.322')

Orawing Number 1E-151-02-005, Rev. O, Plan El.355')

4-6

.. s REFERENCES (continued)

TOPIC: TMI-1 AND TMI-2 PLANT DESIGN FEATURES

6. GPU Site Plan - Unit No. 1, Drawing Number 1E-120-01-001, Rev. O, (TMI-1 Nuclear Generating Station).

7. " Safety Evaluation - TMI-1 Radwaste Tool Decontamination Facility,"

GPU Nuclear Document SE-412261-001, Rev. O, June 1983.

8. TMI-2 Final Safety Analysis Report.

Section 3.3, " Wind and Tornado Loadings"

- Section 3.5, " Missile Protection Criteria"

9. " Control Building Ventilation System" - TMI-1 System Description -

Gilbert Associates, Inc., March 1970.

10. " Auxiliary and Fuel Handling Building Ventilation System" - TMI-1 System Description - Gilbert Associates, Inc., March 1970.

11. "TMI-1 Fuel Handling Area Engineered Safety Feature Ventilation System," System Design Description TI-845A Rev. 2, GPU Service ,

February 1980.

12. " Safety Evaluation - TMI-1 Fuel Handling Area Engineered Safety Feature Ventilation System," GPU Nuclear Document SE-412336-001, April 1984.

4-7

B REFERENCES FOR RISK ASSESSMENT TOPIC: CHEMICAL AND T0XIC GAS RELEASE HAZARDS l

1. Final Report: TMI-1 Control Room Habitability, Washington, D.C. ,

Pickard, Lowe, and Garrick, Inc., May 1, 1984.

2. Technical Plan: Hazard Identification and Safety Evaluation of Chemicals, GPU Nuclear - Bechtel national TP0/TMI-078, Rev. O, August 1983,

3. Planning Study: Hazard Identification and Safety Evaluation of Chemicals, GPU Nuclear - Bechtel National TP0/TMI-029, Rev. 2, October 1983.

4. GPU Nuclear Letter 5211-84-2099, April 30, 1984, " Control Rocm Habitability," (III.D.3.4, NUREG-0737).

5. TMI-1 Final Safety Analysis Report, Update 1 Section 9.8, " Venti-lation Systems."

6. GPU Nuclear Telephone Conference Memorandum of 6/14/84 (

Subject:

Number of Self-Contained Breathing Apparati in TMI-1 Main Control Room).

i

.e l

4-8

.o s REFERENCES FOR RISK ASSESSMENT TOPIC: FIRE HAZARDS AND FIRE PROTECTION

1. " Safe Shutdown Study for TMI-2 Fires," Attachment 2 to GPU Nuclear Letter 4410-84-L-0124, July 31, 1984.

2. U.S. Nuclear Regulatory Comission, Office of Nuclear Reactor Regulation, Fire Protection Safety Evaluation Reoort for TMI-1, Attachment to USNRC Letter of Septemoer 19, 1978, (Reio to Hercein).

.3. U.S. Nuclear Regulatory Comission, Office of Nuclear Reactor Regulai. ion, Fire Protection Exemotion Safety Evaluation for TMI-1, Attachment to USNRC Letter of June 4, 1984, (Stolz to Hukill).

4. U.S. Nuclear Regulatory Comission, Office of Nuclear Reactor Regulation, Alternate Shutdown Capability Safety Evaluation for TMI-1, Attachment to USNRC Letter of June 4,1984, (Stolz to Hukill).

5. Planning Study: Combustibility and Hazard Evaluation Tests for Chemical anc Nuclear Wastes, GPU Nuclear - Bechtel National TP0/TMI-055, Rev. O, Octooer 1983.

6. TMI-1 Final Safety Analysis Recort, Update 2, September 1983, Section 9.9 " Plant Fire Protection System".

D 4-9

E o f

REFERENCES FOR RISK ASSESSMENT TOPIC: TMI-1 RESTART AND ISOLATION FROM TMI-2 L

t

1. TMI-1 Restart: Washington, D.C., U.S. Nuclear Regulatory Commission, April 1981, NUREG-0680 (Supplement 3).

2. TMI-1 Restart: . Washington, D. C. , U.S. Nuclear Regulatory Commis-sion, October 1983,NUREG-0680,(Supplement 4).

3. GPU Nuclear Inter-Office Memorandum 4400-82-M-0509, "TMI-1 Work Suspension During TMI-2 Fuel Handling," May 3, 1982.

4. ASLB Testimony Transcript (PA 6/4/81), " Commonwealth of Penn-sylvania's Proposed Findings of Fact and Conclusions of Law on Plant Design and Modification Issues (First Set)," Docket No. 50-289 (Restart). Three Mile Island Nuclear Station, Unit No.1.

5. TMI-1 Restart: Washington, D.C. , U.S. Nuclear Regulatory Commission, June 1980, NUREG-0680.

6. ASLB " Findings of Fact on Issues Relating to the Separation of TMI-1 and TMI-1," .(Article 1226-1328), Partial Initial Decision of 12/14/81.

l l

l l 4-10 l

i

.w s REFERENCES FOR RISK ASSESSMENT TOPIC: TMI-2 RECOVERY

1. Technical Plan: FHB and Truck Bay: GPU Nuclear - Bechtel National

.TP0/TMI-067, Rev. O, October 1983.

2. Technical Plan:* TMI-2 Proaram Strateay: GPU Nuclear -

Bechtel National TP0/TMI-ll5, Rev. O, June 1984.

3. "TMI-2 Recovery: A Program Overview," J. C. DeVine, Jr. , Technical Presentation Material, June 1984.

4. Recovery Technical Specifications for Three Mile Island Nuclear Station, Unit 2.

e 9

9 4-11

r o REFERENCES FOR RISK ASSESSMENT TOPIC: OTHER RELEVANT CORRESPONDENCE

1. GPU Nuclear Corporation Letter of June 25, 1984, P. R. Clark to Norman Rasmussen, (

Subject:

Comissioning of Independent Assessment of the Risks to Safe Operation of TMI-1 Resulting From TMI-2).

2. Connonwealth of Pennsylvania Letter of June 14, 1984, Governor Richard Thornburgh to Nunzio Palladino, (

Subject:

Comonwealth of Pennsylvania Coments on Restart of THI-1).

l i

i l

l 4-12 l

L

.: 0 .\

Appendix A

SUMMARY

OF EXISTING PLANT CONDITIONS Certain . operational characteristics of each unit on the TMI site, important to the performance of the assessment, are briefly described in the following Appendix.

A.1 UNIT 1 TMI-1 is presently being maintained in a shutdown condition, pending authorization to restart and return to power operation. (The purpose of this

' report is, of course, to provide supporting information for restart licensing activities.)

The plant is undamaged and required equipment is being maintained per plant. Technical Specifications. Upon authorization to restart, TMI-1 can be expected to operate in any mode, from refueling to full power conditions. For the purposes of assessing the impacts of TMI-2 events on the safety of TMI-1 -

operations, it has been assumed that any operating mode from refueling to full power, as well as any " accident" mode, is possible.

Design modifications to plant systems and structures are being carried out under a two-phase program, to increase the potential for continued safe operation of the plant. The first phase (short-term modifications) will be' completed before the initial restart. Longer-term modifications will be installed during the first refueling outage after r,estart.

The likelihood of a severe accident (i.e., design basis accident or beyond) occurring independently at TMI-1 is low: a typical estimate would be on the order of 10-4 per year. The likelihood of an independent TMI-2 event complicating the recovery of TMI-1 from a severe accident would be ext'recely low. Potential external events would be expected to dominate the likelihood of such a dual event, unless an event initiated at TMI-2 could create accident conditions at TMI-1. An examination of this possibility is, of course, the purpose of the present study.

A-1

J o A.2' UNIT 2 TMI-2 can be characterized as in a stable condition with a core decay heat level of about 15kW. This power level will continue to decrease as the recovery period proceeds. The recovery itself involves examination of the core, defueling, decontamination, and transportation activities. Presently, the total radioactivity level on-site is extremely low although the distri-

- bution of_ radioactive materials around the plant is unusual. The existing condition can be best characterized by . comparing the situation at TMI-2 with

~

that at a normally-operating nuclear plant of roughly the same power level.

. Table A-1 compares activity levels and locations for TMI-2 and the hypothetical

" typical" plant, for an important radionuclide, Cesium-137.

Much higher -activity levels for other, shorter-lived nuclides than Cesium-137 are present in the core of the " typical" PWR (perheps as much as 10 10 Curies); these radionuclides have decayed to negligible levels at TMI-2 because of its continuous shutdown period of more than five (5) years.

Table A-1 shows that the total Cesium-137 activity level at TMI-2 is several. orders of magnitude less than that for a normally-operating plant.

This radionuclide is chosen to typify conditions at TMI-2 since it is the most significant nuclide with respect to potential radiological release consequences for the present time, and for several years to come. This conclusion is based on the supposition that there is no production of additional radionuclides through inadvertent operation of the TMI-2 core at power, in sufficient quantities to dominate the dose contributions from the existing Cesium-137 '

^

inventory on-site. Appendix F examines the potential for recriticality.

i i

4

! A-2

m s' Ib Table A-1 CHARACTERIZATION OF TMI-2 RADIONUCLIDE ACTIVITIES AND DISTRIBUTIONS Cesium-137 Activity Levels (Ci)*

Location in the Plant _

Typical Plant TMI-2 (today)

Spent Fuel Pool >10 0

1.5 x 10 3 (spentfuel) (SDSliners)

RCS Liquid negligible 1.S x 10 2 Reactor Building negligible 4.0 x 10 2 Sump Water EPICOR Building N.A 9.0 2 2 Storage Cells >10 10 RCS Fuel Material 10 7

4.0 x 10 5

• Cs-137 was selected because it is expected to be the dominant contributor to dose in the event of a radiokgical release at TMI-2.

A-3 T , __ . . - _ _ _ . _ . . - . , . _ _ . _ . _ _ . _ __ . _ - - _ _ _ _ _ _

< s Appendix B INTER-UNIT DEPENDENCIES l l

In performing a systematic assessment of the risks to safe operation  !

of TMI-1 imposed by TMI-2, it is a requirement that the existence and importance of all possible interactions between units be considered. As described previously, , this mandates the inclusion in concept of all

second-order and higher effects (multiple consequential interactions between units). - The formal structure of such an inter-unit dependency network is shown in Figure B.1.

Any primary *(but mitigatible) event at TMI-1 might have an effect on '

TMI-2 sufficient to ccmplicate the mitigation of the original event at TMI-l.

However, if a primary event at TMI-1 can be mitigated, it is unlikely that the presence of -TMI-2 in the cause-and-effect chain for secondary and higher-order interactions degrades the independent capability for mitigation. This is true because of recovery time-frame considerations, described further in the following paragraphs.

For secondary effects imposed by events at TMI-2 caused by~ TMI-1 primary events, the second-order interaction, if nearly coincidental with the primary event, can effectively be considered as a subsequent failure occurring in the course of an independent TMI-1 event scenario. The TMI-1 Abnonnal Transient _ Procedures (ATPs) have been upgraded to the requirements of I

NUREG-0737 Item I.C.1; they permit the operators to maintain the plant in a safe condition by responding directly to symptoms, rather than to specific events. They also deal with multiple event and/or multiple failure situations, so that plant safety can be maintained through the use of systems or components which may not have been specifically designed for the purpose of accident-mitigation. Thus, there is sufficient reason to believe that unless major portions of the TMI-1 plant are damaged or destroyed by the secondary event effects, the effects of TMI-2 events on TMI-1 resulting from TMI-1 primary events need not-. be considered separately (and in addition to) the direct effects of TMI-2 primary events on the capability to maintain TMI-1 in a safe condition.

B-1

- -4, < ,

l b

, c

(

I

,_.U1 Specific Event

, /

f r

, -~~~~,

I 's Nr (/

s Ut

\ \

\

\

l

\

1 r Common

• i Event I

L-

/

/

U2 /

/

/

/

h  %,~~~-

,s'

, i

, ,ri j i U2 Specific Event _

)

_f

.f Lecend U1- a Unit 1

,U2 m: Unit 2

, Dashed Line: (--) Show Events

! Solid Lines (-)'incicate Dependencies l

Figure 8.1 General Cependencies Setween 3

TMl Unit 1 cnd TMI Unit 2 f

B-2

i r As a further consideration, it is noted that the time-frame required for ' making an effective response to any threatening condition at TMI-2 can potentially (and most probably) be measured in hours, weeks, or months' instead of the seconds, minutes, or hours available to make an effective response to a safety challenge in a normally operating plant. This beneficial situation arises from the present status of the TMI-2 plant: fully shut down, with little decay heat, a significantly reduced fission product inventories, and a steam plant at cold iron conditions. It is, therefore, likely that all activ-ities critical to the termination of TMI-1 plant transients and the subsequent achievement e# sustainable long-term stable conditions will have been com-pleted, before the secondary effects from TMI-2 events caused by the TMI-1 primary failure are " reflected back" to TMI-1.

While not totally conclusive, the arguments made above for limiting the assessment process to consideration only of effects of TMI-2 primary events on TMI-1 are reasonable. If the exclusion of secondary effects is acceptable, then of course, all higher order effects may be excluded from consideration.

B-3

o s i

i Appendix C DEFINITION OF SAFE CONDITIONS FOR TMI-1 RISK ASSESSMENT The top-level event on the fault tree prepared to structure the assessment process was defined in terms of _" maintenance of safe conditions at TMI-1." Further delineation of this top-level event is required before a

, working definition, suitable for use in the risk assessment, is achieved.

Historically, nuclear plant risk assessments have related the def-inition of safety to the risk of excessive release of radioactive materials from the plant. The same association between safety (or for the present tree, its inverse " precluding the maintenance of safe operations") and the risk of excessive releases of radioactive materials has been made for this study.

Since the onset of the commercial nuclear power era, the application. of the barrier ccacept has been the means for achieving a fundamental definition of safe conditions at a nuclear plant. A recent

. further application of the barrier concept has led to the definition of plant Critical Safety Functions. Both the barrier concept and the Critical Safety Function . concept have been explicitly applied to provide a working definition of safe conditions at TMI-1 for this assessment.

C.1 BARRIERS,-CRITICAL SAFETY FUNCTIONS, AND RADIATION RELEASE AT TMI-1

.In order to effectively assess the potential for events at TMI-2 to preclude maintenance of safe conditions at TMI-1, it was decided to apply'the Critical Safety Function concept. The use of this concept facilitates the identification of potentially significant detractors from the capability to

^

contain radioactive materibls at TMI-1 without the need for a full review of systems design features and without requiring the performance of a detailed failure analysis for each conceivable plant operating condition and equipment availability permutation.

C-1

I g C.1.1 Critical Safety Functions for TMI-1 Risk Assessment Critical . Safety Func+1ons (CSFs) are defined as those functions which, being maintained, assure the integrity of the physical barriers to

< radioactive material release and transport from within the plant. CSFs are maintained by a combination of plant structural design features, automatic control and protection functions, and direct operator action. For this risk assessment, a set of CSFs that is complete (i.e., that provides full coverage

. against releases of radioactive materials from TMI-1) is given in Table C-1.

C.1.2 Maintenance of Critical Safety Functions in Various Plant Operating Modes The design of TMI-1 is such that during normal plant operations, all

CSFs can be maintained with adequate margins. Departures from nominal plant conditions are detected and indicated by plant instrumenta'tion and alann systems; plant control systems (augmented by operator action where necessary) are used to maintain CSFs in these cases.

For the less likely off-normal (but within design basis) conditions, I

the plant is provided with protection systems which automatically react to CSF i challenges and place the plant in a condition such that no physical barriers to

[ radiation release are breached. Operator action is generally limited to b confirmation of protection function actuation and subsequent recovery to normal conditions.

In the pxtremely unlikely-(but still within design basis) cases where a plant barrier to radioactive material ralease may have failed, Engineered Safeguards Systems are automatically actuated to maintain or restore CSFs and to protect the remaining barriers. For such emergency conditions, the plant i design and operator actions provided for the continued integrity of the remain-ing barriers as long as the plant is able to operate within its design basis.

i I

I l

C-2 L

3 i

Table C-1 CRITICAL SAFETY FUNCTIONS FOR TMI-1 RISK ASSESSMENT Physical Barrier (s)

Safety Function Purnose Protected

1. Maintenance of o Control reactor power to o Fuel matrix and Reactivity Control match heat production and fuel clad heat removal capabilities o RCS pressure boundary

2. Maintenance Of a Maintain coolant over the o Fuel matrix and Core Cooling and core in the proper state fuel clad Inventory Control and amount o Maintain heat removal o RCS pressure capability from core boundary

3. Maintenance of RCS o Remove heat from core o Fuel matrix and Heat Sink coolant fuel clad o RCS pressure bounda ry

4. Maintenance of RCS o Control RCS pressure and o RCS pressure Integrity RCS heat removal rate bounda ry

5. Maintenance of o Maintain proper containment o Reactor Containment Integrity isolation containment o Maintain reactor buildin'g pressure and temperature control o Reactor building combustible gas control C-3

' r Table C-1 (continued)

CRITICAL SAFETY FUNCTIONS FOR TMI-1 RISK ASSESSMENT Physical Barrier (s)

Safety Function Purpose Protected ,

6. Control of Radiation .o Prevent releases from areas o Other barriers to Releases from Out-of- containing radioactive release of radia-Containment Sources materials outside reactor tion from sources containment outside reactor containment

7. Maintenance of Vital o Maintain operability of o Fuel matrix and Auxiliaries support systems - for safety- fuel clad related systems o RC3 pressure boundary o Reactor con-tainment -

o Other barriers to release of radia-tion from sources outside reactor containment s l

C-4

v .

For - these beyond-design-basis conditions, it is still possible 1 to expect the restoration and maintenance of most CSFs even if plant automatic functions are no longer effective in this regard. CSFs can be maintained by the actions of trained operators utilizing combinations of plant systems or equipment not specifically designed for the purpose. Many of these extremely unlikely events have been analyzed and operating procedures have been developed for them as a result of NRC requirements issued in NUREG-0737, as noted before.

TMI-1 operators - have been provided with these Abnormal Transient Procedures (ATPs) which address extreme challenges to plant CSFs in a symptom /related manner. The ATPs have explicit guidance for operator actions to cope with multiple event / multiple failure situations which may result in failure of one or more barriers to radioactive material release. The symptem--based guidance relieves the operatcrs of the burden of making a correct " event diagnosis" before being able to initiate appropriate restoration acticns. The symptom--related orientation of the ATPs also meshes well with the CSF concept since it permits operators to deal directly with CSF challenges rather than

+- indirectly through the use of event system or oriented procedures.

Table C-2 contains a high-level summary of the means provided for CSF maintenance at TMI-1 for the normal, off-normal, emergency, and beyond-design-basis conditions. The far right-hand column documents the major " controlling elements", generally plant equipment such as control rods, pumps, valves, etc.

which actually perform the safety-related functions necessary to ensure CSF Maintenance. An important point to note is that the presence of an operating crew in the control room is required for both emergency and beyond-design-basis conditions, in order to ensure that safety-related e_quipment is operated properly to maintain CSFs. Active participation' of the operators is less important or not required to maintain safe conditions during normal operations, which are the prevailing conditions. The nature of the operational guidance provided for emergency and beyonc-design-basis conditions (the ATPs) increases the expected effectiveness of the operator's responses to unusual situations, such as those which could arise because of events at TMI-2 affecting TMI-1.

C-5

~

Table C-2 MEANS FOR CRITICAL SAFETY FUNCTION MAINTENANCE AT THI-l Assumed Assumed THI-l Plant Equipment Barrier Condition Failures Failures Controlling Elements for CSF Maintenance Normal Normal None o Integrated Control System (example: pressurizer o Nonnuclear In'strumentation System 4 level deviation) o Operator (confirms automatic system response)

Off-Normal Single None o Reactor Protection System (example: Loss Of component o Emergency Feedwater Actuation System DNB margin) o Operator (confirms automatic protection n function actuation and performs plant a recovery operations)

Emergency Single Single o Engineered Safeguards Actuation System (example: Loss of component barrier o Emergency Feedwater Actuation System CoolantAccident) or o Operator (confirmsautomaticsafeguards loss of vital systems actuation; performs post-LOCA -

,2wer supply bus switchover to recirculation)

Beyond-Design Basis Hultiple Multiple o Operator (operates equipment manually te (example: loss of components burriers maintain Critical Safety Functions under high-pressure injec- or guidance of ATPs; places plant in long-term tion with Loss Of mul tTple safe mode when CSFs are restored)

Coolant Accident) systems ,,

, s C.1.3 Equiement Reouired for Critical Safety Function Maintenance The Critical Safety Function concept has been introduced because it provides the capability to perform a reasonably comprehensive effects analysis for TMI-1, without the need to consider in detail plant operating modes, process parameter values, or detailed equipment availability combinations.

The multiple levels of automatic protective action provided in the TMI-1 systems design each 'have as a implicit design goal the maintenance or restoration of CSFs to protect physical barriers to the release of radioactive materials from the core. (Other systems are provided for monitoring and protecting against release of radioactive materials from outside of the core region.) The final design level of automatically-actuated protection is at the Emergency Conditions level of Table C-2, where the components of the Engineered Safeguards Systems are actuated to provide protection for the fuel matrix and fuel cladding, the RCS, and the Reactor Containment itself. In most cases, one of the three major barriers is assumed to have already failed (e.g., usually the RCS pressure boundary for most design basis accidents) and the Er.jineered Safeguards Systems are actuated to protect the intact boundaries and the important remaining functions of the RCS pressure boundary, such as the liquid retention capability of the reactor vessel itself.

At each level in the design of TMI-1 plant control and protection systems, the automatic features of the plant will either terminate the tran-sient caused by the initiating event and thus remove the challenge to plant CSFs, or the ensuing transient will be significant enougn to actuate the next level of automas1c protective functions for CSF maintenance. This sequence can continue until all plant Engineered Safeguards System equipment has been actuated, if the transient is severe enough. In practice, this means that a good approximation of the significance of any event on the capability to maintain CSFs at TMI-1 can be gained by assessing the effects of the event on the equipment which has been designed to respond at the last level of defense -

the emergency level. For less significant events, the automatic protective fu,nctions built into the plant will ensure maintenance of CSFs by their design.

C-7

For this TMI-1 risk assessment, the effects analysis has been done on the following basis. In order to determine the potential consequences of a TMI-2 event on the ability to maintain CSFs at TMI-1, only the equipment needed to maintain CSFs at the last level of. system automatic response was considered.

The loss of other equipment caused by TMI-2 events has been assumed to either degrade TMI-1 plant conditions to such an extent that the Engineered Safeguards Systems equipment 'must be actuated, or has been assumed to be mitigated by servicing equipment actuated at a higher protective level. (i.e., CSFs have been maintained.)

Clearly, all potential event scenarios can be treated in this manner.

The apprcach used covers the commen event, a TMI-2 event affecting TMI-1 coincidentally with a TMI-1 independent event, or a TMI-2 event causing a TMI-1 event. The consideration of equipment failures in this way, and their effect upon CSF maintenance at -TMI-1, is certainly not as complete as if a full Failure Modes and Effects Analysis had been completed. It is however, gen-erally conservative.

C.I.4 Role of the Operator in CSF Maintenance Before this approach can be used in the effects analysis, the role of the operator must be clarified. Again referring to Table C-2, it is clear that no operator intervention is required in the short term for CSF maintenance at either the nonnal or off-normal levels: system autematic protective functions assure CSF maintenance. Longer-term operator actions are always required to ensure CSF maintenance, no matter what the operating mode.

For the Emergency and Beyond-Design-Basis conditions, operator actions are essential to maintain CSFs and protect the physical barriers to release of radioactive materials. Even in the case of classic accident scen-arios proceeding unaffected by equipment damage caused by a TMI-1 event, the C-8

i s presence of the operator is required. An example of this would be a large break LCCA at TMI-1, where operator action to switch over the ECCS from injec-tion to sump recirculation is required in about 20 minutes at maximum flow conditions. If the control room operatcrs were incapacitated by a hazard -

imposed through a TMI-2 event occurring coincidentally with the large. break LOCA, the maintenance of fuel clad / matrix integrity could not be assured once the BWST ran dry.

Thus, the operator must be considered as a primary impact element in this risk assessment. Consideration must be given to .both the long-term and short-term role of operating personnel at TMI-1 in assuring the maintenance of safe conditions.

C.2 IMPACT ELEMENTS FOR TMI-1 RISK ASSESSMENT The impact elements considered in this risk assessment are:

1. The actual physical barriers to release of radioactive materials at TMI-1;

2. Equipment necessary to ensure the continued maintenance of CSFs at TMI-1; and

3. Operations personnel required to ensure the correct funct-ioning of systems and equipment necessary to maintain CSFs at TMI-1.

Each impact element is described more fully in the following sub-sections. .

C.2.1 Physical Barriers to Release of Radioactive Materials Any TMI-2 event which directly results in damage to TMI-1 structures or equipment required to contain radioactive materials will for the purposes of C-9

Table C-3 IMPACT ELEMENTS FOR TMI-1 RISK ASSESSMENT PHYSICAL BARRIERS TO RELEASE OF RADIOACTIVE MATERIALS Barriers to Kelease of In-Containment Sources

1. Core fuel matrix and cladding -

2. Reactor coolant system pressure boundary

3. Reactor Building containment vessel and containment isolation provisions Barriers to Release of~0ut-Of-Containment Sources

1. Fuel matrix and cladding for stored spent fuel

2. Pressure boundary for Radioactive Waste System components containing highly active / easily transportable materials

3. Pressure boundary for Makeup and Letdown System components / process lines

4. Fuel Handling Building

5. Spent Fuel Pool and Water

6. Auxiliary Building O

C-10

, 3 this assessment be considered to have precluded the maintenance of safe con-ditions at TMI-1. These physical barriers include not only the three classical barriers to in-core radioactive material release but also include, fcr example, the fuel cladding for spent fuel elements kept in the Spent Fuel Pool, or the pressure boundary of the system holding up radioactive gases in the Waste Processing System. Table C-3 contains a listing of physical barriers to radiation realease at TMI-1.

C.2.2 Ecuipment Recuired to Maintain Critical Safety Functions Equipment to be considered in this category includes not only the

" safety-related" components associated with the Engineered Safeguards Systems, but also the vital auxiliary equipment needed to support Engineered Safeguards Systems equipment. Another category of equipment and structures which must be considered is that necessary to ensure the continued containment of radioactive materials kept outside the Reactor Building.

For convenience in performing the effects analysis the equipment required to maintain CSFs can be considered as being placed in one of three categories, consistent with the following listing:

CSF Category I Those Critical Safety Functions which, being maintained, di-rectly ensure the continued integrity of physical barriers to the release df radioactive materials kept inside the reactat-containment building (including the core inventory).

These CSFs include: -

o Maintenance of Reactivity Control; o Maintenance of Core Cooling and RCS Inventory; o Maintenance of RCS Heat Sink; o Maintenance of RCS Pressure Boundary Integrity; o Maintenance of Containment Integrity.

C-11

o CSF Category II Those Critical Safety Functions which, being maintained, directly ensure the containment of radioactive materials kept -

outside the reactor containment. The single TMI-1 CSF in this category is:

o Control of Radiation Releases from Out-Of Containment Sources.

CSF Category III Those Critical Safety Functions which must be maintained to ensure operability of equipment required to directly maintain all CSFs. The CSF for TMI-1 in this category is:

o Maintenance of Vital Auxiliaries.

Equipment and structures related to each category of CSF are given in Tables C-4, C-5 and C-6. These components and struc-tures are the physical entities which will be specifically considered in the effects analysis for this risk assessment.

C.2.3 Personnel Recuired to Maintain Critical Safety Functions The importance of the operator in maintaining CSFs at TMI-1, and hence in assuring the prevention of excessive amounts of radioactive materials from the plant, was discussed in Sections C.1.2 and C.1.4. The generic term

" operator" used herein refers both to main control room personnel as well as auxiliary operators throughout the plant. Since, the assurance of safe oper-ation nust be given for an indeterminate time, the 3 effects of postulated TMI-2 events on the TMI-1soperator must be assessed for both the short and the long term. -

For control room personnel, the- effects analysis to be acceptable must demonstrate that no TMI-2 event can lead to their rapid and complete incapacitation. This is required, since a credible (though unlikely) sequence of events could be the independent occurrence of a beyond-design-basis event at TMI-1 directly followed and complicated by the TMI-2 postulated event. It must be shown that under all postulated conditions, control room operators have sufficient warning of a hazard to take protective action which permits their continued presence as a functioning crew in the main control rcom. The C-12

q

. l l

Table C-4 ,

IMPACT ELEMENTS FOR TMI-1 RISK ASSESSMENT EQUIPMENT REQUIRED TO ENSURE MAINTENANCE OF CATEGORY I*

CRITICAL SAFETY FUNCTIONS

1. Low Pressure Injection Pumps .

2. High Pressure Injection Pumps

3. Core Flood Tanks 4 Reactor Building Spray Pumps **

5. Decay Heat Removal Heat Exchangers

6. Reactor Building Sump and Valves

7. Emergency Feedwater Pumps and Valves

8. Main Steam Isolation Valves

9. Borated Water Storage Tank

10. Condensate Storage Tank

11. Containment Isolation System

12. Hydrogen Recombiners

13. Reactor Building Ventilation / Coolers **

14 Main Control Room

15. Reactor Protection System

16. Power Control and Instrumentation Cabling associated with 1-15 above ,

• Category I - Equipment that directly ensures the continued integrity of physical barriers to release of radioactive materials from in-containment sources

• • Redundant function for Containment Atmosphere Pressure Temperature Control.

C-13

~

Table C-5 IMPACT ELEMENTS FOR TMI-1 RISK ASSESSMENT

' EQUIPMENT REQUIRED TO ENSURE MAINTENANCE OF CATEGORY II* CRITICAL SAFETY FUNCTIONS

1. Spent Fuel Cooling System Components

- Pool walls and 1.iner

- Pumps (2)

- Heat exchangers (2)

- Process lines

2. Waste Processing System Comoonents

- Radwaste monitoring system

3. Fuel Handling System Comoonents

- Fuel handling crane and equipment ,

- Fuel storage racks

- Fuel transfer tubes

4. Power, Control, and Instrumentation cabling associated with 1-3 above l

,

• Category II - Equipment that directly ensures the continued integrity of physical barriers to release of radioactive materials from out-of-containment sources.

C-14 L

i.

Table C-6 IMPACT ELEMENTS FOR TMI-1 RISK ASSESSMENT EQUIPMENT REQUIRED TO ENSURE MAINTENANCE OF CATEGORY III* CRITICAL SAFETY FUNCTIONS

1. Electrical Power Systems

- 230kV substation and unit auxiliary transformers **

- Emergency diesel-generator sets **

- Diesel fuel oil storage tanks

- 4160V AC vital busses and switchgear

- 480V AC vital power circuits

- 120V AC vital power circuits

- Batteries (125vdc) and chargers

- Inverters

- 125vdc vital power circuits

2. Cooling Water System

- Decay Heat Services Cooling System (river water pumps; closed cycle pumps; coolers)

- Reactor Building Emergency Cooling Water System (river water pumps)

- Nuclear Services Cooling Water System (river water pumps; closed cycle pumps; coolers)

• Lategory III - Equipment required to ensure continued operability of equipment that directly maintains CSFs in Categories I and II, and personnel survivability.

• • These componen:s provide redundant supply of site power.

C-15

~

Table C-6 (continued)

IMPACT ELEMENTS FOR TMI-1 RISK ASSESSMENT EQUIPMENT REQUIRED TO ENSURE MAINTENANCE OF 0F CATEGORY III* CRITICAL SAFETY FUNCTIONS

3. Air Handling and Ventilation Systems

- Air Intake tunnel for TMI-1

- Control Building supply fans and dampers

- Control Building chillers and pumps

- Auxiliary and Fuel Handling Building exhaust fans

- Pump room coolers (NSCC cooling pumps; spent fuel cooling pumps; EFW pumps)

- Penetration area air handling equipment

- Die:el Generator Building ventilation system

4. Fire Protection System

- Yard fire mains

- Altitude tank

- Fire pumps

- Fire dampers, spray systems, suppressant systems, and detectors

5. Power, Control, and Instrumentation cabling associated with 1-4 aoove

• Category III - Equipment required to ensure continued operability of equipment that directly maintains CSFs in Categories I and II, and personnel survivability.

• • These components provide redundant supply of site power.

C-16

s \

long-term occupancy of the control room must also be assured, in arder to maintain TMI-1 in a stable shutdown condition.

Local equipment operation outside the Main Control Rocm may be required, especially for the case where TMI-2 events can lead to equipmen*.

damage or failure. Generally, local operation is required in the long term (i.e., times greater than .a few hours) to provide for continued maintenance of safe conditions at TMI-1; the attcinment of stable conditions after a transient or accident is most probably the result of control room actions. Personnel access to areas of the plant where local operation may be required (such as the Intermediate Building areas where Emergency Feedwater System valves must be manually positioned, or where manual operation of Atmospheric Dump Valves may be required) must not be restricted by TMI-2 events.

Generally, personnel will be restricte'd frem entering into or re-maining in spaces by hazards such as high radiation, smoke toxic vapors, etc.

Hazards such as fires, explosions, and floods may also restrict personnel access, but could cause significant equipment damage as well.

More specific definitions of the impact of TMI-2 events on these impact elements are necessary for the effects analysis. These are provided in Appendix E.

I .

C-17

_ __. . .. .__ _ . _ _ _ _ - . _ _ _ _ . ~ . . __ _

i  :

Appendix 0 FAULT TREE DEVELOPMENT FOR TMI-1 RISK ASSESSMENT A deductive model (portrayed uas a fault tree) was developed to systematically define the basic categories of events at TMI-2 that could preclude maintenance of safe conditions at TMI-1. The definition of " safe conditions" and salient details of the application of this definition in the risk assessment process are both provided in Appendix C and E of this report.

The development of the " top event" statement and those for succeeding levels of the tree are described in the following subsections of this Appendix.

D.1 TOP-LEVEL EVENT FOR FAULT TREE CONSTRUCTION The top-level event is any event which " precludes maintenance of safe conditions" at TMI-1. The specific statement of this top event for the fault tree is

" Event Occurs at TMI-2 that Precludes Maintenance of Safe Conditions at TMI-1."

Appendix C contains a detailed discussion of the relationship of the

" top event" to plant structures, equipment, and personnel; this relationship is used in performing the detailed effects analysis for all the categories of postulated events contributing to the " top event" risk.

0.2 LOWER LEVEL EVENTS: LEVELS 2, 3, AND 4 The next level of TMI-2 event that could preclude maintenance of safe conditions at TMI-1 is described in three basic categories, which account for all essential permutations of event that result from the spatial proximity of TMf-1 to TMI-2.

o Common physical locations of equipment o Common site for both units o Human substitution error (unit-to-unit) 0-1

Event definitions and further discussion of each of these categories are briefly given below, including detailed ~ descriptions of event category hierarchies to the lowest level.

D.2.1 Events Involving Common Physical Locations of Eouipment If TMI-1 and TMI-2 share equipment in a system, or if TMI-1 equipment is located in spatial proximity to TMI-2 equipment, then the possibility of an effect on TMI-1 from a TMI-2 failure exists. Any event which precludes safe operation of TMI-1 is described on the Fault Tree as

" Event In Location Common to Both Units Creates a Hazard That Precludes Maintenance of Safe Conditions at TMI-1" This second-level event can be further subdivided into a third level with two distinct categories (1) " Event Involving System Inter-Ties Between TMI-1 to TMI-2 Creates a Hazard That Precludes Maintenance of Safe Con-

-ditions at TMI-1" and (2) " Event Involving TMI-1 Oue to Physical Proximity to TMI-2 Creates a Hazard That Precludes Maintenance of Safe Con-ditions at TMI-1" The numbers in parentheses to the left of each event description indicate the box on the fault tree (Figure 1.1) to which they refer.

The first category (1) is defined to address any inter-unit system interactions, for example the possible effect of a TMI-2 event on the func-tional capability of the shared Fire Protection System water mains. The other category accounts for possible events involving only physical proximity. An -

example event in this latter category could be the effect of a TMI-2 event on a TMI-1 power cable or instrument cable located beneath the floor of a TMI-2 structure.

0-2

i  : >

f No events were defined below these third-level categories, since the breakdown at the second level was sufficient to support the effects analysis within the required level of detail for this assessment.

D.2.2 Events Involving Hazard Transoort From TMI-2 to TMI-1 The next second-level event category was defined to address the possibility that TMI-2 events could result in hazard transport by atmosphere, liquids, or through solid material between units, due to their location on a common site. The event is described as

" Event at TMI-2 Creates a Hazard at TMI-1 That Precludes Maintenance of Safe Operation at TMI-1 This event category has been further subdivided into three (3) third-level and eleven (11) fourth-level event categories. These further subdivisions were required to achieve the depth of penetration necessary in order to perform a meaningful effects analysis. For a hazardous situation to exist in TMI-1 as a result of an event in this category occurring at TMI-2, hazard transport would need to occur over distances of tens of meters to several hundred meters (in general).

The mechanisms by which hazards can be transported between TMI-2 and THI-1 are characterized by three distinct material states: solid material transport, liquid transport, and atmospheric transport. The third-level breakdown in this category relating to hazard transport is defined by the subcategories -

" Event Involving Solid Material Hazard Transport to TMI-1 from TMI-2 Precludes Maintenance of Safe Conditions at TMI-1" arid

" Event Involving Liquid Hazard Transport to TMI-1 Frcm TMI-2 Precludes Maintenance of Safe Conditions at TMI-1" D-3

e and

" Event Involving Atmospheric Hazard Transport from TMI-2 to TMI-1 Precludes Maintenance of Safe Conditions at TMI-1".

By examination of the potential hazards located at TMI-2 and their capability to create additional hazard at TMI-1, the fourth level of event categories in this branch could be defined. These are listed below under their transport mechanisms.

Solid Material Hazard Transport (3) o Excessive Missiles (4) o Excessive Fire (propagation through structures)

Liouid Hazard Transoort (5) o Excessive Radioactivity (6) o Excessive Chemicals (7) o Excessive Onsite-Induced Flooding (8) o Excessive Combustible Liquids Atmospheric Hazard Trantocrt (9) o Excessive Smoke (10 o Excessive Radioactivity (11 o Excessive Toxic Gases (12 o Excessive Explosion (shock)

(13 o Excessive Fire (heat conduction, convection, or thermal radiation) 0.2.3 Events Involvino Human Error The last second-level category en the fault tree involves human l error. Since both units are located in close proximity on the island, and have many design features that are similar, it is postulated that a specific oper-l ational, maintenance, repair, or replacement activity planned for TMI-2 could

ce inadvertently performed on TMI-1, thus creating a condition which precluded continued safe operation of TMI-1.

The formal statement of this second-level event for the fault tree is (14) " Human Error at TMI-2 Creates a Hazard That Precludes Maintenance of Safe Conditions at TMI-1" i

k D-4 L

Because of the nature of this event category, no third-level or fourth-level event categories need be postulated to ensure adequate coverage to the depth of detail required by this risk assessment.

D.3 APPLICATION OF EVENT CATEGORIES The event categories denoted with a number in parentheses to their left in the preceding test are those categories used for the effects analysis in Appendix E. The results of the effects analysis are also reported in Section 3.0 of this risk assessment report.

p 0-5

r e &

Appendix E EFFECTS ANALYSIS E.1 CRITERIA FOR DEFINING POTENTIALLY SIGNIFICANT EVENTS This Appendix documents the effects analysis (consequence analysis) for the TMI-2 event categories impacting the selected TMI-1 " impact elements" of direct physical barriers to radiation release, equipment required to main-tain TMI-1 Critical Safety Functions, and TMI-1 operating personnel required to maintain Critical Safety Functions.

Event sequences which can result in one of the following consequences are identified as potentially significant events, and must be evaluated further for their likelihood, hence, overall contribution to the risk of TMI-1 oper-ation.

1. Direct failure of physical barriers designed to contain radicactive materials , which can potentially cause an excessive release at the site boundary.

2. Failure of TMI-1 plant equipment required to maintain Critical Safety Functions.

3. Physical incapacitation or evacuation of control rocm personnel.

4. Restriction of personnel access to plant areas where local actions must be performed to ensure the maintenance of Critical Safety Functions.

Appendix C discussed the relationship of' barriers, plant equipment, and operators to the maintenance of safe conditions at TMI-1. Except fer the first criterion (direct barrier penetration with concomitant excessive radioactive material release) imposition of this set of consequences does not necessarily guarantee excessive radioactivity release to the TMI-1 site bound-ary. However, there are cases (depending upon the prior and/or subsequent TMI-1 operating modes assumed) for which radiation release in excess of accept-able limits could occur.

E-1

~

Each event sequence will be assessed first with respect to its direct effects upon TMI-1. barriers, safety equipment, and operating personnel. If no effects exceeding the four criteria given above are found, then no potentially significant event has occurred. If a potentially significant event is iden-tified, it will-be listed in Section E.4 and the likelihood that it can result in an excessive radiation release will be assessed in the results section (Section 3.0) of this report. Prior to proceeding with the effects analysis, a screening process was used to reduce the need to perform consequence eval-uations or phenomenological analyses for every specific impact element in every event category. The screening process permitted the completion of the risk assessment' in a reasonable period of time, while providing assurance that coverage of important events had been effectively achieved.

E.2 SCREENING CRITERIA FOR EFFECTS ANALYSIS The inherent design features of the TMI-1 physical plant and its reasonably complete separation from TMI-2 make it possible to quickly assess the potential effects from various event categories and their likelihood, for certain areas of the TMI-1 plant. For example, the aircraft protection and river flooding design provisions at the site are generally sufficient to preclude any effects from TMI-2 events which result in violation of any of the four criteria given in Section E.1, resulting from the imposition of missile, flooding, and explosion hazard categories on the plant.

Radiation release from TMI-2 and its effects on TMI-1 has been investigated in detail and the screening criteria development has been docu-mented separately, in Appendix F. For the remain' der of the event categories identified on the fault tree, the screening criteria development is documented in the following sections.

E-2

i' ,

E.2.1 Screenino Criteria for Common Locations This branch of the fault tree covers two subareas: events involving system inter-ties between 1111-1 and TMI-2, and events involving TMI-1 because of its physical proximity to TMI-2. ,

~

E.2.I.1 System inter-ties Because the plants were essentially independent units when built, and have been separated further following the TMI-2 event of 1979, there is little potential for events involving systems which are shared or interconnected.

Table E-1 lists all significant systems inter-ties between units, and indicates thereby the only areas of concern which must be considered in performing the effects analysis for this event category.

The most significant systems inter-tie is through the plant elect-rical systems, each of which have connections to the common TMI site sub-station. A1.1 vital power systems are duplicated (redundant) . within each individual unit and are supplied frcm internal prime movers (diesels). Sep-aration from the substation power entry point is provided by high reliability breaker / bus schemes. The potential for a TMI-2 fault effecting damage to TMI-1 vital power systems sufficient to preclude maintenance of Critical Safety Functions during any TMI-1 operating mode is extremely low. This is particu-larly true considering the fact that the TMI-2 plant will no longer be an electric power source for the grid, and large load transients cannot be imposed on the grid because of TMI-2 operations.

The site fire protection system (fire water supply portion) is common to both units. It is pro'lided with redundant pumping capability, including diesel-driven fire pumps which provide pressure and flow to the fire mains frem the primary water source - the river. Yard mains are designed in a ring structure, located underground, and are sectionalized. Any break in the mains can be isolated with full pressure and flow capabilities provided to the remaining intact unisolated sectors. The TMI-1 Fire Hazards Analysis E-3

I t Table E-1

. SHARED SYSTEMS AND COMP 0 net 1T3 FOR TMI-1 AND TMI-2

1. Electrical Power System

- Site substation and off-site power

2. Liquid Waste Processing System

- Miscellaneous waste subsystem

- Industrial waste treatment system

~

- _ Industrial waste filter system

3. Fuel Handling System

- Fuel handling crane

4. Fire Protection System ,

- Fire System Pumps, Mains, and Distribution Headers

- Altitude tank

5. Demineralized Water System

- 1,000,000 gallon DW tank

6. Auxiliary Steam System

7. 200,000 gallon Diesel Fuel Oil Tank E-4

t

)* l l

"' documents these design characteristics. Thus, the fire water system poses no I

significant hazards, either from loss of capability or frcm internal flooding

.t #

potential, to the safe operation of TMI-1.

Neither the Liquid Waste Processing System shared components nor the Demine'ralized Water Storage Tank are required for the maintenance of safe conditions at TMI-1. Transfers from the Diesel Fuel Oil Tank to either unit are made in the batch mode.

The Fuel Handling Crane receives its power from TMI-1. Its potential effects can be covered under either proximity or missile hazards later in this section.

E.2.1.2 Physical proximity The major areas where obvious proximity between TMI-1 and TMI-2 components exists are the site electrical substation and the truck bay / air space of the Fuel Handling Buildings for each unit. In both areas, there are systems inter-ties (described in the preceding subsection). There are also designed-in physical separation features and administrative controls applied to effect separation between units, when important to preclude adverse impacts upon either plant from its sister unit.

The Fuel Handling Crane is operated under administrative control to ensure it is only lifting Unit 1 loads when in the Unit 1 Fuel Handling Build-ing. This applies also to Unit 2 loads. The shared truck bay is the source of potential hazards for TMI-1, however. Beneath the truck bay floor run the Unit Air Intake Tunnel (well protected) and several critical cable trays for vital equipment for Unit 1.

The possibility of heavy load damage to Unit 1 equipment from a dropped Unit 2 load is present. This area will be investigated further under

" Missiles". Cther possibilities, including radioactive material release to TMI-1 structures from a ruptured transport canister for TMI-2 SDS resins or zeolites, have also been previously identified. These releases can occur through the airspace over the environmental barrier separating the E-5

i units, or (potentially) into a TMI-1 equipment room beneath the truck bay if a heavy load drop penetrates the floor. (Refer to Atmospheric' Hazard Transport for further details of these potential events).

A final area which must be evaluated regarding the Fuel Handling Buildings for TMI-1 and TMI-2 being joined together is that of fire propag-ation. The most recent TMI-1 Appendix R analyses have identified a scenario for fire damage to vital TMI-1 power and instrumentation cables from a postu-lated . total burnout of the TMI-1 Fuel Handling Building Fire Zone 5.. This event sequence will be considered under " Fires" later in this section.

Major electrical equipment (such as transformers) in the site sub-station yard has been protected against hazards such as fires through provision of automatic sprinkler systems, etc. Other failure modes (explosions) cannot disable sufficient TMI-1 equipment to preclude safe operation of the plant.

E.2.2 Solid Material Hazard Transpcrt

- The operative categories for this transport mechanism are missiles and fire propagation through structures. To facilitate development of con-secuence screening criteria for these and later categories, Table E-2 was constructed. It identifies major discrete areas of the TMI-1 plant in terms of structure design and aircraft protection criteria. A similar type of design has been applied to TMI-2 structures. Of note here is the protection of the TMI-1 and TMI-2 plant vital areas from aircraft impact. This design feature virtually ensures that no missiles generated by rotating equipment failure, explosive gas detonation, or stored energy release from pressurized vessels within TMI-2 structures can affect any components or personnel at TMI-1.

l l

i E.2.2.1 Missiles

[ Considering only the structural design of TMI-1 areas where vital components or equipment containing potentially high levels of radioactivity transportable to the site bour.dary are located, it is not possible for a TMI-2 i

! E-6 L

t 1 1

~

\

generated missile to penetrate these and result in a hazard that precludes safe operation. This is underscored by the fact that TMI-2 is in cold iron con-ditions with the Reactor Coolant System depressurized. The most significant potentici TMI-2 external missile hazard for TMI-1 (the turbine-generator) is no longer operating.

The screening for missile damage has thus limited concern to only internally-generated TMI-2 missiles affecting contigious TMI-1 systems, ccm-ponents, or personnel, or externally-generated TMI-2 missiles affecting un-protected (i.e., non-aircraft protected) TMI-1 structures or systems. There are a few such potential event sequences identified which must be analyzed in the event analysis to ' follow.

E.2.2.2 Fire prooagation through structures TMI-1 fire detection and fire suppression systems have been designed to protect the plant and provide for uninterrupted plant safety functions in the event of a fire. As a result of orgoing Appendix R analyses of TMI-1, several modifications are being made to upgrade the plant fire protection systems to meet the intent of 10CFR50, Appendix R requirements. All TMI-1 fire protection systems are being maintained per the plant Technical Specifications during the enforced shutdown since the TMI-2 event.

The separation of TMI-1 and TMI-2 and the structural design of TMI-2 ensures that there are few locations where a TMI-2 fire can propagate to TMI-1 with subsequent detrimental effects on maintaining plant safety. The major hazard area in this regard is TMI-1 Fire Zone FH-FZ-5 (Fire Zone 5) the shared Fuel Handling Building.

~

While plant modifications requiring cutting, burning, and welding are being made at TMI-2, it is the opinion of GPU Nuclear personnel (validated by comparing the number of " hot work permits" issued for TMI-1 and TMI-2 over the past few years) that this is not as much of a contributor to increased po-tential for fire in TMI-2 as it might seem. With regard to fire hazards at TMI-2 that might propagate into events of greater significance (i.e., core E-7

s Table E-2 THI-1 GENERAL PLANT AREAS AND EXTERNALLY - SITUATED COMPONENTS LOCATIONS AND DESIGN FEATURES RELEVANT TO EFFECTS ANALYSIS TMI-2 Design Aircraft TMI-2 System Area / External Comoonent Class I Protected Co-location Intertie Notes Reactor building x x Control building x x Auxiliary building ,

x portions (1)

Turbine building Intermediate building portions portions (1)

Fuel handling building x x x x (2)

Heat exchanger vault x x Service building Intake Screen / pump house x x Main and auxiliary transformers x Electrical substation x x Air intake tunnel x x l

Borated water storage tank x Condensate storage tank x ,

Altitude tank x x (3)

(

( ,

Diesel fuel oil tank x (4)

Diesel generator building x Demineralized water tank x (1) Portions containing vital equipment are aircraft protected.

(2 Single fuel cask handling crane.

(3 Single head tank for both units' fire system.

l (4 Underground location E-8

a &

radiation releases) Fire Protection Analysis for TMI-2 recently ccmpleted demonstrates that no credible fire can jeopardize the capability to maintain and monitor the safe shutdown condition of TMI-2.

E.2.3 Liouid Material Hazard Transport Event categories considered under this transport mechanism are radioactivity, site-imoosed flooding, combustible -liouids, and chemicals.

Radioactivity transport by liquids in sufficient quantities to pose a hazard to the safe operation of TMI-1 is not possible for this site and for the remaining potential sources of high activity at TMI-2. One area where a potential for cross-contamination from TMI-2 to TMI-1 existed was the Unit 2 Fuel Handling Building truck bay area, where floor drains from TMI-2 were directed to TMI-1 radwaste systems. These drains have now been plugged. Refer to Appendix F for a detailed discussion of radioactive materials hazards screening consider-ations.

E.2.3.1 . Site-imoosed flooding .

There are no potential liquid sources in TMI-2 that could cause flooding of sufficient magnitude to overwhelm the flood design features pro-vided for TMI-1. The TMI-1 updated FSAR provides a comprehensive description .

of site and unit-related flood protection provisions. TMI has survived the Hurricane Agnes flood; the largest potential static source of water external to the plant but inside the dikes is the 1,000,000 gallon demineralized water tank. Any ruptured fire main sector may be isolated to prevent continued spillage in the case of the need to continue pumping after line breakage. No potential for precluding safe operation of TMI-1 can be identified in this event category.

E.2.3.2 Combustible liouids The known sources for extensive quantities of combustible liquids on-site which could potentially jeoparoize safe conditions at TMI-1 are the 200,000 gallon fuel oil tank (uparate frcm both units) and the separate diesel E-9 1

p, - , - - , - - - - , , -- - - - - - , , -,,,-.---~--,--,---.,,.m--._, ,, --- , , , - - - -

. s fuel oil storage tanks. TMI-1 diesel fuel oil storage tanks are underground; TMI-2 tanks are provided with curbs and protected with a deluge water spray _

system. Other minor quantities of combustible liquids are located at various points throughout TMI-2. Curbs surrounding the 200,000 gallon fuel oil tank protect against spreading of the liquid from a ruptured tank. Protection for the TMI-1 structures from exterior fires ignited in pooling combustible liquids

, is provided by the aircra.ft crash design provisions and the plant fire pro-tection system.

The only credible situation where combustible liquid fires could jeopardize the safety of TMI-1 is a fire in the shared Fuel Handling Building area, where a postulated " total burnout" of Fire Zone 5 could result in loss of capability to control certain equipment necessary to maintain Critical Safety Functions. The impact of this fire will be considered later in the effects analysis section. However, the control of ccmbustible materials inherent in the TMI-1 and TMI-2 fire protection plans makes it very unlikely that sufficient amounts of combustible liquids could be present in either fuel

~

handling area to sustain a " total burnout" situation. .

E.2.3.3 Chemicals The current inventory of hazardous chemicals in liquid form at TMI-2 is limited. Liquid transport of these chemicals into TMI-1 structures is ,

l restricted by the physical design of the p. ant, and the limited amounts of such

! chemicals available. The present risk to safe operation of TMI-1 from liquid phase chemical hazard transport is at least as low as for the situation where both plants were operating normally. (Liquids which can evaporate to form toxic vapor clouds are treated in a subsequent section on Toxic Gases).

I The recovery of TMI-2 will no doubt involve the use of chemicals in l

liquid form. The TMI-2 recovery group has developed an extensive capability for hazard evaluation, for situations and materials of all sorts. This capa-bility is attested to ty the large number of published documents investigating recovery plans and materials with respect to their safety implications.

E-10 l'

e (

l 1

Therefore, it is unlikely that hazardous chemicals which may be introduced in I

the future will escape a full evaluation of their safety implications, both on TMI-2 recovery personnel and on TMI-1 operations.

E.2.4 Atmospheric Hazard Transcort This transport mechanism encompasses the largest number of identified event categories. Screening for airborne radioactive material transport is described as part of Appendix F. The remaining hazards--smoke, toxic cases, explosions (shock), and fire (atmos;heric heat conduction, convection, and radiation)--are discussed and their consequence screening documented in this section of the report.

E.2.4.1 Smoke Smoke is only considered as a personnel hazard for the purposes of this report. Sources of smoke from TMI-2 which propagate to TMI-1 externally (outside TMI-1 structures) are protecte.d by intake air filtering for the areas where personnel are most likely to be present. These include the Auxiliary Building, Fuel Handling Building, and Control Building at TMI-1. Additionally, the TMI-1 Control Room ventilation system has the capability to be isolated and operated on recirculation, with filters in the recirculating airstream.

Therefore, neither the physical effects of smoke, affecting Control Room habitability nor loss of visibility is considered to be sufficient to preclude maintenance of Critical Safety Functions. The use of self-contained breathing apparatus (SCBAs) will permit the continued presence of personnel in the plant control room until smoke levels are significantly r' educed.

Access to other plant areas while smoke is present is a consideration in TMI-1 fire protection plans. SCBAs are provided throughout the plant to support entry into smoke-filled areas for a time sufficient to permit manual (local) operation of components necessary for maintenance of plant safety. It is unlikely that a TMI-2 smoke source could result in a more smoky condition in a TMI-1 plant area than a TMI-1 fire occurring in or near the area.

E-11

4 s The single exception to this may be a source of smoke in the TMI-2 Fuel Handling Building, which communicates through an upper airspace with the TMI-1 Fuel Handling Building. Both buildings could be quickly ventilated through the truck bay door if the need to enter for CSF maintenance was not because of release of radiation from sources in the area. In any event,SCBAs woul'd be expected to support entry for reasonable periods of time with suf-ficient visibility for equipment location / operation.

E.2.4.2 Toxic Gases Toxic gases are only a personnel hazard. An extensive assessment of TMI-1 control room habitability after releases of toxic vapors on the island (from both TMI-1 and TMI-2 sources) has been performed. The assessment concluded that the only toxic vapors posing a potential hazard to control rocm personnel were chlorine and amonia vapors from liquid chlorine and amonium hydroxide storage tanks, respectively. Potential sources of these vapors have been removed from the TMI-2 site. These materials still remain on the TMI-1 site, and could be directly . activated by TMI-2 events. They were therefore considered as potential atmospherically-transported ha:ards for this risk assessment.

An extensive and conservative hazards analysis for ammonia and chlorine releases has been previously performed, and demonstrates that under the assumptions used, there is sufficient time provided to permit the control

! room operators to don protective equipment (SCBAs) before either gas can reach I

its toxic limit in the control room. The persistence of toxic vapors at l

elevated levels in the control room is limited bi the amounts available for l release and t,y the local meteorological conditions. For the cases investigated, there appeared to be no situation where total incapacitation of

! the control room crew could be predicted, resulting in the loss of capability l to maintain Critical Safety Functions at TMI-l.

l An independent assessment has also shown that the likelihood of a f significant release of toxic gases is low, on the order of 10-6 er year.

l Coupling this with the need to maintain operators continually in the control l

E-12

room during the TMI-1 time period required for the gas plume to disperse, the likelihood of tsxic gas release that could preclude safe conditions at TMI-1 is extremely small.

For areas outside the control room, no hazard evaluation has been performed. These areas are, however, less critical from a personnel entry standpoint since the full . time presence of operating personnel is not required to maintain Critical Safety Functions. Entries into areas where toxic gases may be present would be possible using SCBAs. Local operations (such as manual repositioning of valves) could be quickly performed and tne personnel removed.

The likelihood that such operations would be required to assure plant safety is very-low.

E.2.4.3 Explosions (shocks)

Most TMI-1 areas that potentially contain large amounts of radio-active materials or that contain equipment or personnel vital to the main-tenance of Critical Safety Functions are aircraft-protected (see Table E-2).

It is, therefore, highly unlikely that a detonation of explosive gases or explosion of large high-energy-density electrical components associated with TMI-2 could result in generation of an overpressure sufficient to damage these structures or the components therein.

Since the overpressure from an explosion would be a transitory effect, the hazard to personnel would exist only for a very short time.

Control room and auxiliary operators inside the TMI-1 structures are protected by the ventilation system explosion suppression cap' abilities built into the air intake tunnel. An explosion could c'ause damage to the lightly const,ructed l

ljittman (solid waste handling) building near the entrance to the truck bay, resulting in release of radioactive materials through ruptured process lines or from solidified waste containers. Further discussion of this event is provided ~

in Section E.3.

l E-13 l

I - . . -

44 a 3-'- J -- . . _ _ . . . _ , ,

' t I

E.2.4.4 Fire (heat conduction, convection, and radiation)

This type of hazard could be imposed by deflagration of an explosive gas mixture, or heating of combustible portions of TMI-1 structures by fires occurring on the TMI-2 site itself.

I TMI-1 systems and personnel vital to the maintenance of plant Crit-ical Safety Functions are well-protected from this type of event, if it occurs

! externally. The main plant structures are constructed from thick concrete, i which ' serves as. an effective barrier to the transfer of thermal energy- to interior components. Explosion and flame suppression design features in the TMI-1 air intake tunnel prevents flame front propagation into interior areas.

Only in the case of a flame front propagation or very intense fire within the Fuel Handiing Building could this event category potentially impose

- an important hazardous condition on TMI-1. This situation will be considered I ' in the next section, and has been introduced before under several other event categories.

E.2.5 Human Error l

[ Consideration of this potential source for causing a hazard at TMI-1 l completes the review of event categories for screening criteria development.

To assess the significance of this category, a visit to the TMI-1 site was made. During the visit, a partial walkdown of the units was completed and discussions with operational personnel were held. The findings of this effort were supplemented by additional discussions with 'both TMI-1 and TMI-2 engi-neering, planning, and licensing personnel. ,

The units themselves are physically separate within the security area. Separate security personnel are assigned for each plant. Two separate I sets of maintenance personnel are maintained. Each unit has its own discrete set of administrative directives, guidelines, and procedures.

E-14 l

S :-

The physical differences between plants are another discriminating feature which makes this type of event extremely unlikely. Since the THI-2 accident, several modifications have been made to Unit 2 equipment and struc-tures which identify it uniquely to personnel who are involved in the recovery operations. Radiation area signs are more prevalent in Unit 2, and the equip-ment itself is in a different state (totally shut down rather than supporting an operable plant). All in all, the overall likelihood of a human error associated with TMI-2 recovery operations which results in planned activities being performed instead on TMI-1 is extremely low. This type of event will not be pursued further in the effects analysis.

E.3 ANALYSIS BY IMPACT ELEMENT The screening performed in the previous subsection (and for radio-active materials release consequences, in Appendix F) permits a fairly rapid assessment of the effects of TMI-2 events on the ability to operate TMI-1 safely. Recall that the impact elements for this risk assessment are the direct barriers to radiation release (for core-related materials, the fuel matrix and clad, the reactor coolant system pressure boundary, and the contain-ment structure), equipmen.t required to maintain Critical Safety Functions, and personnel required to operate the plant to ensure its continued safety.

The effects analyses performed will be described and documented by impact element. In Appendix C specific listings of barriers and equipment to be used were provided. This Appendix also documents the criteria used to define whether or not a given TMI-2 event sequence in any fault tree event category can be said to be a "potentially significa'nt event," that is, one that may have unacceptable consequences on the safety of operation of TMI-1. The criteria used are quite conservative, since the scope of the assessment and the time available for its performance dictated the approach to be taken - which was an assessment performed at a very high level. Because of the level at which the assessment is done, spec fic detailed mitigative features of the TMI-1 designs which could be effective in obtaining an acceptable outcome for a given event sequence in a given operating mode cannot be called upon. This may E-15

result in identification of certain events as "potentially significant," even though personnel thoroughly familiar with the design and operations of TMI-1 ray be aware of alternative paths to ensure maintenance of safe conditions, with the postulated event having occurred.

E.3.1 Direct Barrier Damace In order to result of itself in direct release of core radioactivity from TMI-1, a TMI-2 event sequence would have to cause a breach of all three classical barriers: the containment, the reactor coolant pressure boundary, and the core clad /fue1 matrix. No possible means to achieve this has been identified.

For radiation release from the core area under the assumption that a major accident has occurred at TMI-1 independent of the TMI-2 event, at least cne design barrier (usually the containment itself) would have to be bre. ached.

No credible event category has been identified which could result in this situation.

Non-core-related radioactive materials containment is provided for relatively high activity materials by piping, tanks, and other components of the TMI-1 Makeup and Purification System, Radwaste Processing Systems, acd by the cladding fuel matrix of the fuel in the Spent Fuel Pool. These physical l barriers are considered together with the equipment which supports their l integrity in the following section.

l l In summary, no TMI-2 event category was identified which contained a potentially significant event for this impact element.

E.O.2 Failure of Eouicment Required for Critical Safety Function

! Maintenance .

The effects analysis results are described by Critical Safety Func-tion Category (see Appendix C) beginning with Category III.

E-16 l

s .1 l

E.3.2.1 Failure of equioment recuired to maintain catecory III Critical Safety Functions The single Category III Critical Safety Function defined for this risk assessment is Maintenance of Vital Auxiliaries. Salient auxiliary serv-ices which must be provided are electrical power, cooling water , and area cooling and ventilation.

E.3.2.1.1 Electrical power l The most significant detrimental effect on the TMI-1 plant in the Category would be sustained loss of electrical power. No other Critical Safety Function can be adequately maintained unless electrical power is available.

The TMI-1 electrical power system is tied to the TMI-2 system only through the 230kV substation located in the station transfer yard. Under worst-case assumption, a failure in the TMI-2 electrical system can result in the loss of one of the two TMI-1 auxiliary transformers. The second unit auxiliary transformer and both diesel generators would be available as power sources for TMI-1 equipment.

Damage or loss of TMI-1 electrical power generating and distribution equipment sufficient to result in a sustained loss of ac power cannot occur due to the physical proximity of TMI-2 equipment to TMI-1 equipment. The TMI-1 auxiliary transformers and the TMI-1 diesel generator sets are located in different portions of the site remote from one another and from any TMI-2 equipment. TMI-1 vital power supply boards and" motor control centers are duplicated, separated, and enclosed almost entirely within the hardened areas of the TMI-1 plant structures. Therefore, credible TMI-2 events cannot result in total sustained loss of all ac power to TMI-1 equipment served by these power supply and distribution elements. The potential for a simultaneous loss of power to the Decay Heat River Water pumps has been previously identified.

This will be discussed in the following subsection.

E-17 L

E.3.2.1.2 Cooling water Cooling water is supplied to heat exchangers, pumps, motors, and other equipment in systems used to maintain Critical Safety Functions at TMI-1.

Cooling water-system pumping power is assured if the plant electrical system is p'roviding power to vital AC busses. The operation of both open-cycle (river water) and closed-cycle portions of the TMI-1 cooling water systems is required to ensure continued maintenance of Critical Safety Functions in both Category I and Category II.

The major cooling water systems which are required to operate to ensure Critical Safety Functions maintenance are:

1. Decay Heat Services Cooling Water System

- closed-cycle subsystem

- river water subsystem

2. Reactor Building Emergency Cooling Water System

3. Nuclear Services Cooling Water System

- closed-cycle subsystem

- river water subsystem River water subsystems The river water portions of the Decay Heat Services and Nuclear Services Cooling Water Systems are . protected in aircraft-hardened concrete structures. Both systems are provided with redundant supply lines to inter-mediate coolers in the Heat Exchanger Vault. (Redundancy of lines in the o r Services Coolin river water syst The Reactor Building Emergency Cooling Water System has redundant lines supplying the RB cooler manifold outside the TMI-1 Reactor Building. The i Reactor Building Emergency Coolers are themselves redundant to the Reactor

[ Building Spray System for maintaining Reactor Building pressure and temper-l ature. Within the River Water Pump House itself, the river water pumps for l

! E-13

i & I i

1 1

these vital systems are separated by concrete walls and other system pumps.

Power to the river water pumps is provided from the redundant diesel generator vital ac busses.

Because of the protection provided against the hypothetical aircraft incident, the river water portions of the vital cooling water systems are protected against loss caused by external missiles, fires, and explosions from TMI-2. There is no possibility of systems interaction between Units 1 and 2 since the river water systems are entirely independent and separated. With at least one train of vital electrical power available, sufficient cooling water flow to the intermediate coolers and the Reactor Building fan coolers is assured.

A heavy load dropped in the truck bay of the Fuel Handling Building can potentially penetrate the floor of the bay, serving power supply cables to both Decay Heat River Water pumps. This type of event sequence has been identified previously. There appear to be no other event sequences which cause the failure of any other river-water subsystem associated equipment, but by the criteria defining potentially significant events used for this study, this heavy load drop is such an event.

Closed-cycle subsystems The closed-cycle portions of the Decay Heat Services and Nuclear Services Cooling Systems are contained entirely within structures hardened to withstand the hypothetical aircraft incident. Power to the closed-cycle pumps is provided by redundant and protected vital busses, thereby assuring suff-

icient cooling water flow if at least one train of vitt.1 electrical power is available.

The Decay Heat Services closed-cycle cooling subsystem is separated into two redundant,100 percent capacity systems. The Nuclear Service closed cycle cooling subsystem is capable of being aligned by the operator (or auto-matically upon initiation of a safeguards actuation signal) into a pair of redundant, 100 percent capacity systems serving the safety-related equipment to

, which it is connected.

E-19 f

e s There are no system inter-ties or co-locations with TMI-2 equipment for the closed-cycle portions of the TMI-1 cooling water systems. The location of system components in hardened and fire-protected structures prevents their loss of function due to fires, explosions, or missiles. Total loss of function due to human error (substitution error while performing maintenance for TMI-2) is not considered credible given the unit separation.

E.3.2.1.3 Area cooling and ventilation Area cooling and ventilation is provided for spaces occupied by personnel and vital equipment to ensure their continued procer functioning under all plant modes of operation. Cooling and ventilation services necessary to ensure maintenance of TMI-1 Critical Safety Functions include:

1. Control Building supply fans;

2. Control Building mechanical water chillers;

3. Control Building chilled-water pumps;

4. Auliliary and Fuel Handling Building exhcust fans;

5. Diesel Generator Building ventilation system;

5. Auxiliary Building exhaust fans;

6. Nuclear Service Closed-Cycle cooling pump rcom recir-culation coolers;

7. Spent Fuel Cooling pump room recirculation coolers;

8. Emergency Feedwater pump area coolers and air-handling units.

Complete redundancy in air handling and cooling is provided for all these services. Electrically powered equipment is supplied from redundant vital power busses. Cooling water (where required) is supplied by the Nuclear Service Cooling raw water system (or in the case of Control Room cooler mechanical chillers) the Nuclear Service Cooling closed-cycle cooling system.

E-20

i There are no system inter-ties nor co-locations with TMI-2 equipment.

All components are located in aircraft-protected structures and, therefore, are protected against the effects of fires, missiles, or explosions propagating from TMI-2 events. Loss of function due to human error is not credible given

.the results of the screening process for this event ' category, described earlier.

There are no credible TMI-2 event . categories identified which can result in failure / damage to the vital TMI-2 area cooling and ventilation services, sufficient to affect continued maintenance of Critical Safety Func-tions for TMI-1. .

E.3.2.2 Failure of eouioment required to maintain catecory II Critical Safety Functions Only one TMI-1 Critical Safety Function is identified in this cate-gory: " Control of Radinctive Material from Out-of-Containment Sources." The major out-of-containment sources of radioactive materials at TMI-1 are:

1. Spent fuel stored outside the core;

2. Process lines, ion exchangers, and tanks associated with the Makeup and Purification System;

3. Radioactive waste processing system equipment and radwaste storage facilities.

E.3.2.2.1 Spent Fuel Release of radioactivity from spent fuel can potentially occur by overheating or by mechanical damage to the fuel.

Movement of spent fuel at TMI-1 is accomplished with the fuel kept totally submerged in water. The water is cooled by the Spent Fuel Cooling System, which has redundant pumping and heat exchange capability. (The effects analysis for the TMI-1 CSF " Maintenance of Vital Auxiliaries" concluded that no credible TMI-2 event category could result in failure to maintain cooling water flow to the Spent Fuel Coolers, or power to at least one of the Spent Fuel E-21

~

Cooling Pumps.) Thus, cooling of the spent fuel pool water is assured unless

' damage to the pools and liners, or to the single cooling pump suction line is sufficient to lower the water level below the cooling pump intake elevation.

Because of the location of the Spent Fuel Cooling System components in aircraft-protected areas, there appears to be no chance for external mis-siles, explosions, floods, or fires to affect their operation. Detonation of explosive gases or other materials within the TMI-2 Auxiliary and Fuel Handling Building are unlikely to result in damage to either fuel or pool structures due to shock effects on the Fuel Handling Crane, since it is designed structurally  !

to ensure no loss of function during and after a seismic event while lifting ,

rated load. The crane also has a mechanical load brake and a solenoid brake which are designed to preclude acceleration of the load.

The only system inter-tie between TMI-1 and TMI-2 lies in the use of the Fuel Handling Crane itself. The crane remains in the Unit 2 buildings and truck bay area when handling TMI-2 loads. Therefore, no damage to TMI-1 pools, liners, or full elements can occur from this source.

4 A potentially significant event identified previously was the

, creation of a large energetic missile from TMI-2 Standby Pressure Control System nitrogen bottles which are located in the area near the TMI-1 Fuel j Handling Building. This missile could potentially cause sufficient damage to l

spent fuel to result in a release into the Fuel Handling Building. Even if L such a release occurred, the TMI-1 Fuel Handling Building ESF filtration system (which must be in operation prior to handling spent fuel at TMI-1) is designed to prevent off-site doses from exceeding allowable values. The existing ventilation system, while not totally qualified, will also mitigate the consequences of such an accident.

I E.3.2.2.2 Makeup and purification system l

The Makeup and Purification System has fluid lines which penetrate the Reactor Building containment and normally carry Reactor Coolant to be purified and recycled. This coolant contains dissolved radioactive materials E-22

i. (

l l

which can be released upon system or component failures. Significant levels of radioactive materials are only present in the reactor coolant stream following certain design. basis events, such as a LOCA. Detection and isolation for pipe breaks in systems penetrating the reactor containment is provided.

Release of excessive amounts of radioactive materials from TMI-1, sufficient to exceed allowable limits at the site boundaries, is, therefore, extremely unlikely as a result of the effects of any TMI-2 event categories on the Unit 1 Makeup and Pur'ification System.

J E.3.2.2.3 Waste Processing System and Radwaste Storage Facilities All components of the TMI-1 gaseous and liquid radwaste processing systems are enclosed within aircraft-hardened Unit I structures. They are, therefore, protected from the effects of missiles, explos'ons, fires, or ficods resulting from events at TMI-2, and cannot be the source of inadvertent release of radioactive materials from the site due to human error while performing m3.intenance intended for equivalent TMI-2 components. There are a limited number of systems inter-ties between TMI-1 and TMI-2 liquid radwaste systems.

However, the separate TMI-1 and TMI-2 liquid radwaste components have been permanently isolated from one another by electrical and mechanical means, thereby essentially removing the possibility of systems interactions between units through these connections.

Separate solid radwaste systems are provided for each unit. The TMI-1 waste solidification system is a Butler-type building outside the TMI-1 Fuel Handling Building, near the door to the fuel' cask handling and shipping area. Process lines containing radioactive ion exchange resins from TMI-1 i purification ion exchangers enter this interim facility, and are thereby exposed ' to potentially damaging effects of TMI-2 event categories such as missiles and explosions.

In the screening for radioactive releases, the potential amounts of radioactive material that can be released from the spent wet resins from TMI-1 l

themselves, or the containers with concrete-bound resins, which are produced l

E-23 l

l I

e in the Hittman facility, are reviewed. There is no credible event which can I result in a release of radioactive material from the facility in excess of I allowable limits at the site boundary. There is also no credible event which results in a challenge to TMI-1 control room habitability, or restriction of personnel entry into other plant areas where local equipment operation may be necessary to maintain Critical Safety Functions.

E.3.2.3 Failure of equipment reouired to maintain catecorv I Critical Safety Functions Appendix C provided the logic for enveloping all potential TMI-1 operating modes with conditions expected at the last (lowest) level of auto-matic protection system operation. This process automatically identified the major pieces of equipment which had to be considered in the effects analysis for this risk assessment.

A general conclusion resulting from the application o'f the screening criteria for the various event categories is that there is no potential for direct damage to any of the major operating components required to maintain Category I CSFs. Table E-3 shows that most of the equipment specified for supporting CSFs in Category I are located in aircraft-protected structures well-separated from TMI-1. Exceptions are the large tanks for ECCS injection water (the BWST) and for auxiliary feedwater (the redundant CSTs).

The most significant potential source of damage to these large tanks would b'e TMI-2 generated missiles. However, there have been no credible l missile sources with energy sufficient to cause damage identified.

j In reviewing all event categories, only one potentially significant event for this equipment was identified: a fire in the TMI-2 Fuel Handling l Building which results in total burnout of the TMI-1 Fuel Handling Building l Fire Zone 5. This type of fire, postulated for evaluating the fire hazards

! attendant to TMI-1 operation as a result of Appendix R requirements, can affect some safety-grade control circuits located in the TMI-1 Fuel Handling Building truck bay " patio." Loss of these circuits would disable certain pieces of safety-grade equipment.

l E-24 l

i :

Table E-3 LOCATIONS OF EQUIPMENT REQUIRED TO MAINTAIN CATEGORY I CRITICAL SAFETY FUNCTIONS AT TMI-1

1. Reactor Building Core Flood Tanks

- Peactor Building Sump

- Reactor Building Ventilation Coolers

- ECCS Piping

- EFW Piping - Steamlines

2. Auxiliary Building

- Low Head Injection Pumps

- High Head Injection Pumps

- Reactor Building Spray Pumps

- Decay Heat Removal Heat Exchangers

- ECCS Piping

3. Control Building

- Main Control Room

- Instrumentation and Control Equipment

- Protection System Equipment

4. Intermediate Building (aircraft-orotected oortions)

- Hydrogen Recombiners l

- Emergency Feedwater Pumps

- EFW Piping

- Atmospheric Dump Valves -

f.'

Steamlines 1

5. Yard

- Borated Water Storage Tank

-- Condensate Storage Tanks (2)

E-25

.: 4 The result of this type of fire could be the inability to attain cold shutdown within the prescribed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (assuming that the fire was in fact the only event occurring to TMI-1). Changes to the affected TMI-1 Fuel Handling Building areas have been prescribed for mitigation purposes, but will not be installed until the first' refueling outage after startup. It should be noted that maintenance of the plant in a hot shutdown condition is acceptable; while emergency feedwater is available. The fire combined with certain accident ,

conditions could jeopardize plant safety. This type of combined event is, therefore, designated as a potentially significant event, and its likelihood will be estimated further. Recall that the Fuel Handling Building fire was also identified in Section E.2.1.2.

E.3.3 Personnel Hazards Event categories which can be expected to pose substantial personnel hazards include release of toxic gases, smoke generation, and airborne trans-port of radioactive materials. As a result of the screening process in Section E.2, all but the last category have been shown to have no identified critical consequences, as defined by the criteria first stated in this Appendix.

With respect to radiation releases, Appendix F reviews potential events that could cause releases of radiation which could result in personnel incapaciation or exclusion frcm TMI-1 plant areas. Most potential releases from TMI-2 (or resulting from TMI-2 events) are shown to be bounded by the releases characteristic of a WASH-1400 PWR-8 category of release.

One potential release with relatively* high significance to the overall risk of TMI-1 operation is the rupture of an SDS canister or TMI-2 fuel handling canister in the TMI-1 piping penetration room directly beneath the Fuel Handling Building truck bay. The canister is postulated to have been dropped from a height sufficient to cause its penetration through the concrete truck bay floor.

The overall effects of this type of release have apparently not been fully evaluated for impact on safe operations of TMI-1. An SDS canister rupture in the truck bay itself was shown in earlier analyses (TDR-317) to have E-26

no impact on the maintenance of safe conditions at TMI-1. For radiation release direct to the TMI-1 ventilation system, which is expected to be pos-sible through various penetrations in the TMI-1 piping penetration room, a quick analysis was performed and showed that dose rates would be acceptable for control room personnel. The effect on personnel requiring access to other portions of TMI-1 Structures to perform local actions in support of Critical Safety Function maintenance was not so clear, because of complicating assump-tions regarding the spread of airborne activity around the plant. This par-ticular event permutation will be conservatively identified as a significant event, and its likelihood will be assessed in Section 3.0, to determine its overall risk significance for TMI-1 operations.

No other personnel hazards resulting from radioactive material transport to TMI-1 were identified.

E.4

SUMMARY

OF POTENTIALLY SIGNIFICANT EVENTS Table E-4 lists the potentially significant events identified as a result of this effects analysis. Each event identified occurs in the shared rea of the Fuel Handling Building, although the event categories for each are different. The likelihood of each event, and the probability that it can result in release of excessive amounts of radioactive materials frem TMI-1 will be evaluated in Section 3.0 of this report.

E-27

Table E-4 POTENTIALLY SIGNIFICANT EVENTS FOR THI-l RISK ASSESSMENT Event Location Event (event category) Direct Effect on THI-l Impact Element Affected THI-2 Fuel - Fire in truck bay area Burnout of THI-l control Equipment required for llandling Building (Fire Zone FH-FZ-5) cabling in truck bay Critical Safety function (fire) patio area maintenance

- Fuel canister Loss of power cables Equip::ient required for drop over truck bay to both THI-l Decay Heat Critical Safety function shipping area which River water pumps maintenance penetrates floor (missile / proximity)

- Fuel removal canister Canister ruptures inside Operations personnel

'l' drop or SDS canister THI-l piping temperature required to perform M over truck bay which room beneath floor. Radio- local actions to penetrates floor active materials released maintain Critical (missile / proximity / to THI-l Auxiliary and Safety Functions at atmosp.heric transport Fuel llandling Buildings THI-l of excessive radio-activity)

We

i L Appendix F RADI0 ACTIVITY RELEASE INVESTIGATIONS F.1 OVERVIEW Two categories of radioactivity releases were identified in the fault tree development discussed in Section 2.0 of the main report and Appendix D.

These categories -involve 1) liquid, or 2) gaseous releases. The purpose of this appendix is to investigate the potential for excessive releases of radio-active material in either a gaseous or liquid fann.

The definition of excessive was developed in Section 2.0 and Appen-dices C and D. Briefly, with respect to radioactivity releases, the following defines " Excessive Radioactivity Releases."

1. Radiation levels that do not permit operating personnel to maintain Unit 1 in a safe condition, E

2. Radiation levels that result in unrecoverable failure of plant equipment required to maintain Unit 1 in a safe condition.

Both control room operations and local operations were considered.

F.2 REVIEW 0F PRESENT AND FUTURE SITUATION Section 2.0 of the main report provided a brief review of the present and future situation at Unit 2. Appendix A provided a more detailed review of these conditions. In summary, Unit 2 is in a stable shutdown condition with a total decay heat level of about 15kW. No active systems are required to remove this decay heat because of its low value. Ambient losses through the vessel and upper surfaces of the water are maihtaining the coolant at about 100 F.

Other locations of radioactive material also are adequately cooled by ambient losses.

F-1

-. . -.._---.-.-. - .-. _=..- - . - . . , -

i 1 Radioactive material form and distribution around the plant is unusual when compared to a " typical" plant, although the present radioactive inventory is several orders of magnitude less than in a typical plant because of the five year-shutdown.

The general process for defueling is well defined. Technical plan-ning documents have been developed. Details for each specific activity in the process are being defined, and a safety evaluation is being performed where hazard potential is identified. Ultimately the core material will be trans-ferred to hanoling canisters for removal from the site. Already there have been significant quantities of radioactive material originally in the core transported offsite.

F.3 APPROACH Numerous evaluations of the potential for release of radioactive material from Unit 2 during cleanup operations have been performed (See Section 4.0 of the main report). These investigations involved utility, regulatory, national lab, and college personnel. In general, the effects being examined involved impacts tc the public and workers at Unit 2.

2 Proper investigations of public health and safety risk and worker risk during cleanup of Unit 2 would be expected to bound consideratio's of impacts on Unit I workers and equipment. As the results provided subsequently in this section demonstrate, this is indeed the case.

The fomal approach taken can be desc'ribed in 5 basic steps as follows:

1. Identify current and future locations and confinement means for radioactive materials.

2. Identify potential release mechanisms of this material.

3. Review available information to assess if these release mechanisms have been investigated and to determine poten-tial consequences.

F-2

s

4. Develop new information where required, and

5. Develop a statement of risk with respect to maintaining Unit 1 in a safe condition.

Sections F.4 and F.5 provide the assessment perfomed. Note that rather than attempting to redefine all possible minor release type events, conservative screening criteria based on the potential releases of a " maximum credible" event were used to envelope these events. This approach was possible because of the 1) the extremely low rad 1oactivity levels present at Unit 2, and

2) the consequently low decay heat level.

F.4 MAJOR RELEASE POTENTIAL F.4.1 Background In order to hypothesize an event that could lead to excessive re-leases of radioactive material, events affecting radioactive materials in relatively large quantities (>1000 Ci) directly must be considered. Failures such as filtering equipment or liquid releases were shown in previous analysis (e.g., NUREG-0683) to have minor impact on Unit 2 workers and the public. The results of the hypothetical events discussed below confirm that all events considered previously as " credible" do not prevent maintenance of Unit 1 in a safe condition.

Currently, the major quantity of radioactive material is contained within the damaged fuel in the reactor vessel. However, defueling activities will transfer this material to the Fuel Pool a,nd ultimately via canister storage in shipping casks off the site. Thus, we can consider the material to.

be in one of two locations as follows, in containment (called the Reactor Building) or outside the containment (primarily the Fuel Handling Building).

In assessing credible events, these previous analyses, most of which are summarized and referenced in NUREG-0683, also examined the potential for major releases directly involving large quantities of radioactive material. No F-3

i credible means of releasing large quantities of radioactive material were identified. As stated above, this can be traced to currently low radioactivity levels when compared to a typical plant and consequently low decay heat levels (about 15kW). Conservatively neglecting losses, this power level would boil about six gallons of water per hour. Fuel heatup without ambient loss would be about 4*F per hour. For a typical cperating plant shortly after shutdown, corresponding values would be about 40,000 gal per hour (about 700 GPM) and 7'F per sec, respectively. The time constant is about fcur orders of magnitude longer at Unit 2. This increases the time to respond to an event corres-pondingly, if the radioactive material is maintained in a subcritical state.

F.4.2 Confining Ra'dioactive Material The barriers to release of radionuclides can be characteriz u as follows:

1. Confinement within fuel material;

2. Confinement within the ccoling vessel, such as the RCS vessel, refueling pool, or canisters; and

3. Confinement within a " containment" such as the reactor building, fuel handling building, or transport casks.

In order to hypothesize a major release of radioactive material, violation of these three basic categories of barriers must occur.

F.4.2.1 Confinement within fuel material There are two basic categories of accidents that could result in release of radionuclides from damaged fuel material.

1. Severe overheating due to insufficient cooling or mechan-ical damage, or

2. Recriticality F-4

F.4.2.1.1 Severe overheating or mechanical damage Decay-Heat Considerations The present condition of radioactive material is such that active cooling is not required. Even a core uncovery event would not result in overheating of the fuel material either due to decay heat caused fuel heatup or due to concerns of recriticality during water drain down or refill. However, an event involving core uncovery would be undesirable from a worker radiation

. level perspective and precautions are in place to minimize this possibility.

The only credible leak that could uncover the core if makeup systems failed involves failure of instrument tubes that penetrate the bottom of the reactor vessel. Failure of one of these 0.5 inch Schedule - 80 penetrations would -result in a leakage rate less than 20gpm. Procedures exist (Emergency Procedure 2202-10.2) to address this . event. Several systems are available to replace any fluid loss through .a failure of this type. As stated in Section F.3, core heatup rates of about 4 F per hour would occur, if the core somehow remained uncovered, until conduction and convection from the fuel material to air were sufficient to terminate the heatup. Calculations indicate that this temperature would be much less than 1000 F, significantly below the temperature required to release significant quantities of radioactive material to air

-(melting could not occur).

Ignition of Zirconium In addition to core heatup resulting from decay heat, fires ceve-laping due to zirconium and zirconium hydride ignition were investigated.

Teveral investigations have been performed (flVREG-0683 and TP0/TMI-120, for example). The results can be summarized as follows:

1. Analysis of TMI-2 core material shows that it is not pyrophoric;

2. Only finely divided zirconium hydride, in powder form, when exposed to air (oxygen) would be pyrophoric; F-5

t i 3 Presence of hydrided zircaloy cladding in a powdered state would be readily identified by visud inspection and precautions could be taken (samples indicate that this condition does not exist);

4. Defueling operations will be perfonned with water coverage (zirconium will not ignite under water); and

5. Realistic particle sizes would not ignite until temper-atures in excess c? 1000*F were reached.

This information confirms the low likelihood approaching the level of a major zirconium hydride ignition for the following reasons:

1. Defueling activities will be performed under water and ignition will not occur within water;

2. The likelihood of a water cover not existing is extremely low, either in the reactor vessel or refueling pool; and

3. Even if water is not present, fuel temperatures cannot attain values needed for realistic particle sizes to ignite even if an ignition source were present. The sampling that has been performed indicates the material to be nonpyro-phoric.

Even assuming ignition of the zirconium material, liquefaction of the fuel material could not occur unless the majority of the zircolium material were involved in the reaction. Furthermore, the amount of unreacted zirconium material present is less than in a typical reactor because of the accident in March of 1979.

Mechanical Damage -

As discussed earlier, most of the remaining fission products are trapped within fuel particles and would require very high temperatures for release. However, there may be small pockets of more readil~y released products such as noble gases that could be released by mechanical damage.

F-6

t 8 l

These types of releases were examined in previous studies and found to be ' acceptable. The conclusions of this assessment are the same. The quantity svailable for release is too low to preclude maintenance of Unit 1 in a safe condition. The screening analyses performed in Section F.5 of this appendix are far more limiting.

4.2.1.2 Recriticality Several investigations have been performed in this area, including those documented in ANL/NRC-RAS 81-1, TP0/TMI-071 and NUREG-0683. The overall conclusion of these studies is that the risk of events involving recriticality is extremely low.

The current plan at TMI-2 is of course to prevent recriticality rather than to accommodate it. The analyses cited above investigated both the potential for recriticality and its consequences. Procedurally initiated and enforced actions represent the first line of defense, with baron concentration sniling providing the second line of defense to preventing recriticality.

These activities consist of physical isolation of non-borated systems with frequent valve position indication confirmation, procedural controls regarding use of these valves, and/or physical separation. Water level moni-toring and alarm provide additional protection actions in place. Additionally, emergency procedures are in place (e.g., Emergency Procedure 2202-1.2) to address boron dilution events or increases in nuclear instrumentation count rate.

Where required, this program has been reviewed and approved by NRC.

The relevant information 'has been reviewed for this study and the folicwing conclusions have been made.

1. The only credible means of a return to critical canditions would involve a boron dilution event. This agrees with previous studies.

2. The program in place at Unit 2 reduces the likelihood of a major dilution event to an extremely lcw value.

F-7

n 2

3. Minor dilution events (several gpm equivalent) allow substantial time (days) for operating personnel to respond to level alarms and samplir.g analysis findings to terminate the dilution.

4. Present boron concentration in the reactor vessel is about 5000 ppm. The analyses performed previously assumed 3500

, ppm._ The higher concentration further reduces the poten-tial for recriticality.

5. The consequences of a recriticality event are not severe with respect to precluding Unit 1 in a safe condition if radionuclides remain substantially contained within one RF the three barriers discussed earlier.

The bases for these co'nclusions are provided below in corresponding order. '

1. Simple analyses indicate that core reconfiguration will not result in recriticality either in the reactor vessel or other storage locations when design characteristics of the core and storage locations are considered.

2/3. TMI Unit 2 bas a technical plan involving design, opera-tional, and risk assessment personnel to " ensure" recrit-icality does not occur. For example, there is dynamic

, interaction between operational activities and boron sampling frequency to minimize the potential for any

" credible" baron dilution to proceed to the point of returning the core to a critical situation. This is above and beyond the level monitoring. Table F-1 highlights scme wf this information.

4. With the present boron concentration, about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> to one day would be available to detect a dilution up to 15 gpm, considered large, by daily mass balances, before cri t-icality could occur. Ncte again that level increase indications would be expected to, occur much earlier, although these could be temporarily masked by level fluc-tuations which normally occur during non-static con-di' ions.

5. As evidenced by the March 1979 accident, Unit I would not be precluded from being maintained in a safe condition even

if an event involving severe core damage occurred as long l as the material is confined.

Confinement within a " cooling vessel" and a " containment" are discus-

~

sed next.

o F-8

Er- i 4.2.2 Confinement Within A Cooling Vessel The major " cooling vessels" are the reactor vessel, refueling pool and shipping canisters.

Reactor Vessel Currently, the reactor vessel head is off and hence a direct path for release . to containment exists if additional radionuclides are liberated from fuel material and the- water in the vessel. This situation is typical of a ,

refueling condition although the present fuel condition is both abnormally formed and much lower 'in overall radioactivity levels, as discussed earlier.

The primary purpose of the vessel is to maintain a cooling and shielding medium, water, around the fuel. Violation of this vessel's integrity was discussed in Section 4.2.1. In its present situation, its impact as a confinement mechanism is dominated by these functions.

Refueling Pool The Refueling Pocl is the primary storage location for highly radio-active material transferred from the reactor vessel. Investigations of the risk to public health and safety from accident involving the Refueling Pool have been performed. Considerations are identical to those discussed in Section F.4.2.1, i.e. , overheating, mechanical damage, or recriticality. The Refueling Pool provides the same function as the reactor vessel. This primarily consists of providing cooling and shielding via barated water around stored radioactive material . Since it is "open" at the top, gaseous releases of radioactive I

materials could escape. However, as discussed earlier, most of the gaseous fission products have either . decayed substantially or have already been re-leased.

Canisters The defueling activities will involve placement of radioactive material presently in the Refueling Pool and Reactor Vessel into about 250 F-9 w- , - .,-c. < ,+g ----,-,r,...,-an - - -n-+ ,.we. ,,,,e. ,e asc. ------------g.,,-,-n

n i storage canisters. These canisters will then be loaded into transport casks for shipment offsite. These canisters serve the same purpose as the reactor vessel and refueling pool in that they will be designed to ensure cooling and shielding functions are maintained. Additionally, unlike the reactor vessel or refueling pool, the canisters are sealed and thus act more like the Reactor Building with respect to confinement of radioactive material.

4.2.3 Confinement Within a " Containment"

.The final barrier to release is the " containment" characterized by the 1) Reactor Building, 2) Fuel Handling Building, and 3) Shipping Casks.

Reactor Building ~

The Reactor Building is the " final" barrier to release of radioact-ivity contained within this building, such as the reactor vessel and presently the damaged core. The design pressure of this building is about 55 psig. The March 28,1979 event did not exceed this design pressure. In fact, a design pressure rating of 55 psig typically corresponds to a realistic pressure capacity exceeding 100 psig.

The reactor building penetrations, the expected weaker elements of the containment remain qualified for 55 psig, excepting four penetrations. (The concrete and steel structure are unaffected by the March 29, 1979 event.) Two of these three penetrations are qualified for about two psig. The remaining two are qualified for about 10 psig.

The maximum leakage area possible would occur by complete failure of the gasket around the two psi penetration, about two square inches. The leakage area possible by failure of the other two penetrations is substantially smaller. Thus, even if these penetrations were to fail, only minor leakage paths would exist. Additionally, the penetration leakage would be into build-ings not directly to the atmosphere.

l l

l F-10 i

e

r 8-There have apparently been no containment pressurization analyses performed and documented for potential severe events at TMI-2 for the present- ,

core configuration, excepting - containment pressurization analyses involving simulated fires. The resultant pressure rise for these cases was about three psi. Recently, the NRC has issued a Safety Evaluation Report that examined present and proposed containment capability. This study concluded that public health and safety were assured. Again, criteria used to draw these corclusions are generally more restrictive than those involving events that would preclude maintaining Unit 1 in a safe condition.

Fuel Handling Building Potential releases from the Fuel Handling Building can be addressed similarily to those from the Reactor Building. NUREG-0683 addresses this area in detail. A spectrum of events were examined. Core melt was however not considered because of its extremely low likelihood. The analyses presented in Section F.5 encompass any credible event .a this area.

Transport Casks Analyses performed in NUREG-0683 were reviewed. The results were included in our overall assessment. The analyses presented in Section F.5 encompass any credible event identified, including very low likelihood events such as cask ruptures as a result of dropping during movement.

F.4.3 Defining a Maximum Credible Event As discussed in Section F.4.1, previous reviews of Unit 2 have not identified a " credible" event that would result in unacceptable risk to the public health and safety or workers at the site. The reviews described in Section F.4.2 concluded that serious releases-(e.g., core melt plus containment failure) - are either 1) not possible, or 2) extremely unlikely. The review team was unable to postulate a credible event-defined as an event the team believes can happen, that would severely damage the remaining core material and result in i

F-11 l_

n i significant releases. However, as a means of bounding the quantity of releases that might prevent maintaining Unit 1 in a safe condition, conservative sce-narios have been considered. These are described below.

F.4.3.1 Releases from the reactor buildino WASH-1400 serves as the bases for this investigation. WASH-1400 addressed the risk due to both core melt and noncore melt events. The release of radioactive material from the reactor building is driven by 1) the radio-nuclides released from the core material in the reactor vessel, 2) chemical and physical processes within the Reactor Building and 3) the integrity of the Reactor Building.

There was no credible event found that would cause core material liquefaction. Even if core melt did occur, the Reactor Building integrity would not be challenged unless the core melt had been caused by a severe recriticality. And in this case, the expected response would be excessive leakage, not gross failure of the containment. The maximum release fractions identified in WASH-1400 for non : ore melt sequences were characterized by Release Category PWR-8. For example, about .05". cf the Cesium in the core was released from containment.

This release category is characteristic of a failure to isolate containment during a large break LOCA in which other important emergency systems do operate.

Other release categories characteristic' of core melt events, were also reviewed, and more recently published information was also examined. Even for core melt events, the ,haracteristics of Release Category PWR-8 are rea-sonable if the reactor building remains isolated (viz., release category PWR-6 ofWASH-1400.)

If during fuel movement, a fire were to occur that seriously over-heated the damaged fuel, there might be releases comparable to the release fractions for PWR-8. However, no fire of ordinary combustibles could heat the F-12

i -1 fuel to its melting point. And Reactor Building pressure would at most in-crease a few psi. Even if the containment were not isolated at the time of this hypothetical event, a substantial period of time would exist to isolate it. It should be noted that in the TMI-2 accident, the release fraction of the important radionuclides remaining were substantially less than characterized by

. PWR-8.

Thus, releases characteristic of WASH-1400 PWR-8 release category will be used as the maximum credible release of radionuclides from the Reactor Building.

F.4.3.2 Release from the fuel handling building Examining the potential for releases from the reactor building, it was concluded that the analysis of a PWR-8 type release wculd conservatively envelope these types of events. The same basic categories of events can be postulated during movement of fuel material to the Refueling Pool, in the Refueling Pool and during movement of canisters from the Refueling Pool to transport casks.

. There has been no credible event identified that would result in releases exceeding a PWR-8 type release. Previous analyses and analyses performed specifically for this study are the bases for this conclusion. Resia Canister Handling Accidents are addressed separately, however, because dropping of a canister is a credible event and these canisters can contain large quant-ities of radioactive material. .

F.4.3.3 Releases from transoort casks .

The transport casks will be located on railroad cars and will receive the canisters containing radioactive material from the Refueling Pool. No credible event involving these transport casks would result in releases exceeding those from events involving the canisters themselves. As indicated in the next section, oropping of a canister during movement from the Refueling Pool to F-13

1 these transport casks were analyzed. And potential consequences of failure of these canisters (actually a canister within a canister) were included in our overall investigation.

F.4.3.4 Sumary In sumary, two Lasic releases will be investigated.

1. PWR-8 release category release and

2. Dropping of a SDS Resin Canister or Fuel Removal Canister The consequences of these events are examined in the next section.

I F-14

i . &

Table F-1 BORON DILUTION MONITORING AT TMI-2 Monitoring of Baron Concentration Static Conditions - every week Fluid inflow / outflow maneuvers to RCS - every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (variable by rate)

Defueling - can be significantly less than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Level Monitoring Provided by redundant remote sensors (can be isolated)

Control Room Indicator Barton meter Tygon tube Level logged every hour Hi-level alarm on remote indicator channel Mass balances performed daily during static conditions; more frequently during .t.aneuvers from potential dilution sources.

O F-15

1 .

i F.5 CONSEQUENCE INVESTIGATIONS F.5.1 Current Radioisotope Inventory at TMI-2 In considering whether there can be a radioactive release accident at

! TMI-2 severe enough to prevent the maintenance of TMI-1 in a safe condition, it is important to review the current radioisotope inventory of TMI-2. The present inventory has been calculated using the ORIGEN computer code. This code calculates the amount of each isotope present in the core at the time of the accident and the effect of radioactive decay since that time. The first two columns in Table F-2 list all the isotopes present in a quantity greater than 10,000 curies. The decay is for 1,950 days since the accident (8/3/84).

The third column shows the approximate fraction of inventory that remains at TMI-2 following already completed clean-up operations.

F.5.2 Isotopic Contribution to Dose To estimate which of the isotopes will be the main contributors to the gamma dose, the fourth column of Table F-2 lists the rem /hr dose from an infinite plane surface having a concentration of I curie / square meter. The fifth column is the product of columns 2, 3, & 4 divided by 10,000. This number can be thought of as the dose field at one meter above a square surface 100 meters on a side that is unifcrmly covered with the entire inventory of the principal isotope present at TMI Unit 2. This number bears no relation to any accident produced dose, but is a useful way to show the relative contribution of the various isotopes to the dose field.

As can be seen from Table F-2, Cs-137 is by far the pominant contri-butor to the dose. Its importance will continue to increase with time because of its longer half-life. In addition, it is more soluble in water then any of

.the other isotopes so it can be gradually dissolved from the fuel and so in a sense is more mobile, thus making it more likely to be a source of contam-ination. It is generally the isotope of primary concern when evaluating possible serious effects on TMI-1 operation.

F-16

g . t

.F.5.3 Estimated Dose from a PWR-8 Release Category Event (Core Release)

F.5.3.1 Ground contamination external to TMI-1 structures To estimate the dose from a postulated accident, one must determine the ground concentration'(curies / square meter) produced in the area of TMI-1.

This quantity must then be multiplied by the dose conversion factor (column 4, Table F-2) to nbtain the dose field. The field would then have to be reduced by .the shielding factor of any structure between the source and the area of Concern.

The usual method of determining the c,round concentration is given by the following expression:

2 C(Ci/m ) , (xjg 0)*(Y d)*(Q O)

The commonly used expression for x for a point on the ground (z =

zero) downwind (y=zero) a distance x is given by 1

= Q 0 exp h 2-x wgaa where Yz - -

0 0

=

curies released (C1)

D = wind speed (m/sec) a = f(x) a measure of the width of the plume in the crcss wind Y

direction (m) o = f(x) is a measure of the plume" width in the vertical Z

direction (m) h = height above the ground of the release (m) 1 See Meteorology and Atomic Energy USAEC, 1968, p. 380.

F-17

6 .,

i QO can be expressed as QF where Q is the total inventory and F the fraction released in the accident.

Values of x/Q will depend both on the weather stability and the distance downwind and, of course, any unusual local turbulence. However, typical values at distances of 100 to 1,000 meters are 10-3 to 10-4 .

The quantity V , called the deposition velocity, is discussed in d

WASH-1400 Appendix VI, page S-9. Values observed range frcm 10-3 to 10~Im/sec with an expected value of 10-2m/sec.

Q, the inventory of Cs-137, is from Table A-1: Appendix A 5 5 (7X10 ) (.6) = 4x10 Ci.

Thus, the estimate of the dose field would be:

C =

Q*F*V d 'IX/0o )

5

=

(dX10 ) (5X10-4) (10-2) (10-3) 2

= 2X10-3Ci/m 2

Dose = C*DF = (2X10-3) (7.8 rem /hr/Ci/m )

= 16X10-3 rem /hr or 16 mrem /hr The dose conversion factor in Table F-5 for calculating dose from ground contamination are for the gamma activity. The dose contribution due to beta activity was estimated to be an additional 10 percent of that due to gamma, b

This dose level is what would be expected about cne meter above an infinite plane contaminated to a level of 2 mC1/m 2of Cs-137. Actually, the va.ues of oj and az used to calculate x/00 are of the order of ten meters for each. Thus, the contaminated area would be a strip across the island about 30 F-18

a* g feet wide. The dose level over this strip is about 15 mrem /hr, but will drop off rather quickly once outside the contaminated region. Even if one had to cross this strip to enter the control room assuming it took one minute to cross the '30-foot stri p , the total annual dose pstr year would be (250 working days /yr) (4 crossings / day) (1 minute / trip) (1 hr/60 min) (15 mr/hr) = 250 mrem /yr.

This dose is comparable to the annual background dose and poses no problem.

It is, of course, probable that because of the atmospheric turbul-ences around the plant thet (x/QO ) will be considerably smaller thus, contam-inating a larger area to a lower level. If the release were to be thoroughly mixed in the contaminant wake, thenyo and go are on the order of 50m. Again, with a five-mph wind, x/Q0 is about 10 The ground contamination strip would be about 150 feet wide with a contamination level 1/10 of the previous case or 2 X 10-4 Ci/m2 , giving a dose level of about 1.5 mrem /hr.

A dose field in this range would create no problem that would prevent access to a critical area. Of course, the dose level in any building would be further reduced by any shielding provided by the structures. The control room is heavily shielded having a dose reduction factor for gamma rays much gre:.ter than 10.

F.5.3.2. Control room habitability F.5.3.2.1 Source term release and transport To estimate the dose consequences to personnel in the control rocm of TMI-1 due to an accidental release of radioactivity from the TMI-2 core, the following approach was taken.

F-19

~

i . g The radioactive inventory present in the core was that given by the products of columns two and three of Table F-2. The basis for this inventory

-was discussed above. The fractions of the available inventory assumed released was based on the PWR-8 release category, as discussed in Section F.4.

The isotopic release is assumed to occur over an eight-hour period 3

with atmospheric dispersion based on the 0-8 hour x/Q of 2 x 10-3 sec/m . This value is based on site meteorology and for the minimum distance from release to receptor. Table 5-2 summarizes the inventory release and concentrations outside the TMI-1 control room during the release for those isotopes with concentrations greater than 10-10 Ci/m3 ,

F.5.3.2.2 Inhalation doses Airborne radioactivity surrounding the TMI-1 control room building is assumed to enter the control room by way of a 3,000 cfm in-leakage through the closed intake damper. At this rate of in-leakage, the control room volume could be replaced several times with the outside air over an eight-hour period so, without filtering, the inside concentration could reach equilibrium with the outside concentration. However, in-leakage through the intake damper is filtered before entering the control room. A conservative filter efficiency of 90 percent was assumed for this analysis; 99 percent is realistic. No credit was taken for the concentration reduction which would occur as a result of continued recirculation and filtering during the eight-hour period. It was assumed that krypton is not subject to filtering.

Based on the above arguments, it was as'sumed that the average cen-centration inside the control room during the eight-hour period was 10 percent of the outside concentration. The 0-8 hour breathing rate of 3.47 x 3

10"# m /sec from Regulatory Guide 1.4 was used. Inhalation dose conversien factors were taken from NUREG-0172.

The inhalation whole-body dose calculated for the eight-hour period was about 0.8 rem. The thyroid dose was on the order of 10" rem.. The accident release duration and exposure time assumed in this analysis was eight hours. If the release and exposure time is less than eight hours, the dose consequences F-20

i

• 6 are essentially the same. If the time is greater than eight hours, the consequences would be lower due to reduced x/Q values, lower breathing rates, and shift changes.

F.5.3.2.3 Cloud doses Personnel inside the control room could receive some dose to the whole body and skin due to being immersed in the radioactive cloud surroundine the control room building and from the air within the building. Activity outside the building can contribute to the gamma whole-body dose, but is attenuated by a factor much greater than ten due to the shielding afforded by the building. The ganna cloud whole-body dose from air inside the control room has no shielding factor.

Contribution to the operator exposure from cloud gamma whole body and beta-skin doses was calculated using the equations in Regulatory Guide 1.4 and the concentrations in Table F-3 with appropriate shielding ~ ai d filtering factors.

The resulting gamma cloud dose was estimated to be about five mrem.

The estimated beta-skin dose is about 55 mrem.

F.5.3.3 Eouipment Radiation levels that affect the normal operation of plant equipment are several orders of magnitude higher than those which would pose a distinct hazard to plant operating personnel. Since the* previous sections of this appendix have demonstrated that resultant releases from TMI-2 pose no hazards for TMI-1 operating personnel, plant safety will not be jeopardized because of equipment failures caused by radioactive materials from TMI-2 operations.

F.5.3.4 Conclusions Doses calculated for control room personnel resulting from radio-active material releases from the TMI-2 core have been shown to be within the dose limits set forth in Section 6.4 of the USNRC Standard Review Plan for F-21

b

• 1 emergency (one-time) occupational doses. These doses do not result in inca-pacitation of control room personnel. They are in fact considerably less than the doses that many workers have received during the cleanup of TMI-2.

For other areas outside the plant control room where local operations to maintain plant Critical Safety Function may be required, the dose rates would be expected to be no greater than ten times those calculated for control room personnel for continuous occupancy. These out-of-control-room dose rates can be reduced by use of respirators, for example. Even with no assumed reduction, they will not result in either personnel incapacitation or equipment failure.

F.5.4 Resin Canister and Fuel Remosal Canister Handling Accidents The remaining large amount of .adioactivity in the TMI-2 plant outside the core materials themselves will be concentrated in ion exchange resins to be used for liquid decontamination. These resins are contained in liners and handled in the TMI-2 auxiliary and fuel handling buildings, which communicate via airspace with the TMI-1 fuel handling building.

F.5.4.1 Canister droo in Fuel Handling Building One credible event is the accidental drop of a canister containing a single, highly loaded resin liner frcm a TMI-2 liquid cleanup system with a breach of both canister and liner and release of the contained resins. flVREG-0683 anal-yses were done specifically for off-site dose consequences from this type of event. Releases in the Fuel Handling Building ar tabulated in Section 8 of flUREG-0683. For a zeolite filter from the TMI-2 SOS loaded to 120,000 Ci*,

airborne release to the TMI-2 Fuel Handling Building of abcut 10 C1 Cs-137 is assumed. This release is based on the assumption that an accidental fire involving radioactive resins when exposed to the atmosphere is not a credible event.

• The maximum loading to date was about 1/2 this value. Because of reduced concentration in primary system water, future loadings are expected to be of the order of a factor of 20 less than this value. Fuel material would result in canister loadings on average of about 2000 Ci of Cs-137, about 20,000 Ci total.

F-22

pp For this level of release, no estimates of airborne contamination levels and dose rates in the TMI-1 fuel handling building have apparently been made. However, for a slightly smaller ( 4 Ci) release from the inadvertent drop of an SDS shipping canister, analysis has been completed to show that the ability to operate TMI-1 safely will not be compromised (reference: TDR-317, Attachment E, Chapter 7).

The TMI-1 Fuel Handling Building ESF filter system has been designed, and modifications to the auxiliary building ventilation system have been

j. performed, to assure that airborne radioactivity resulting from event in the shared fuel handling areas cannot pose a hazard to TMI-1 operations personnel in other parts.of the plant.

Previous analyses (reported in TDR-317) have demonstrated that the capability to operate TMI-1 safely would .ot be compromised due to the inadvertent drop of an SDS zeolite resin shipping canister that resulted in releases to the Fuel Handling Building shipping area. The assumed releases to.

134 the area were about 3.5 Ci of Cs 137 and 0.5 Ci of CS . This level of release would be expected to bound any future potential SDS resin canister release.

This type of release in the protected envelope of the Fuel Handling Building could not jeopardize either the control room operators or out-of-control room personnel required to perform local actions to maintain Critical Safety Functions. The Fuel Handling and Auxiliary Building I ventilation system and the planned (but not yet installed) ESF filtration system both provide protection from excessive releases to other TMI-1 areas as well as to the environment.

l The consequences of dropping in the Fuel Handling duilo1ng a single fuel removal canister (one of 250 expected to be required, for total core material removal from TMI-2) are bounded by the releases from a heavily-loaded SDS resin canister, as described above.

F-23

e -. ;

F.5.4.2 Canister droo with floor penetration and subseauent release of activity if either a fuel removal canister or an SDS resin canister is dropped in such a manner that it can penetrate the loading dock floor, the consequences of such an event may be more severe than a similar release in the Fuel Handling Building loacing dock area.

The increased severity results from the possibility that the released activity will bypass protective features of the Fuel Handling Building ventilation system designed to minimize releases to the remainder of the TMI-1 plant and to the environment. The potential for such a drop causing floor penetration has been previously noted (TPO-067) and it was independently investigated as part of the radiation release consequence screening for this assessment.

The air intake tunnel for TMI-1 lies beneath the loa' ding dock area, although there is apparently at least one level of TMI-1 Fuel Handling Building spaces between the loading floor and the tunnel. TPO-067 identified the potential for releasing the canister contents to either

1. The air intake tunnel itself, or

2. A pip;ng penetration room for TMI-1 which communicates with other Fuel Handling and Auxiliary Building volumes.

Both locations were evaluated as potential' release points for SDS resin activity and for fuel removal canister activity.

F.5.4.2.1 Canister rupture in TMI-1 piping penetration room For an SDS canister rupture in the piping penetration rocm, a simplified model of the Auxiliary and Fuel Handling Building ventilation system 137 124 was t sed to estimate concentrations of and doses from Cs and Cs through-out the Auxiliary Building and Fuel Handling Building after the release. The F-24

, . .w a maximum dose rate predicted for personnel in the Auxiliary and Fuel Handling Buildings (excluding the release point itself) was about 2 rem /hr (whole body).

These results assumed the continued operation of the exhaust portion of the Auxiliary and Fuel Handling Building ventilation system after the release.

Beca'ise the exhaust fans for these areas are shut down automatically when high radiation is detected in the exhaust stream, this may be a non-conservative estimate of dose rate. Therefore, the SDS canister rupture in the TMI-1 piping penetration room will be considered a potentially significant event, and will be evaluated as to its likelihood and its overall impact on the risk to safe operation of TMI-1.

Note that Co'ntrol Building personnel are not affected by this type of event, since the Control Building ventilation system is -completely separate from that of the Auxiliary and Fuel Handling Building. The relevant impact element for this event is only personnel required to perform local actions in either the Auxiliary Bu11 ding or the Fuel Handling Building in support of Critical Safety Function maintenance.

The rupture of a fuel removal canister in the piping penetration rocm was also investigated. This event results in less severe consequences (from a dose rate standpoint) than for the SDS canister release described above.

However, the modeling of ventilation system and mixing of released activity in the free volume of the Auxiliary and Fuel Handling Buildings resulted, as before, in the potential for a non-conservative result. This event will also be noted as potentially significant to the maintenance of safe conditions at TMI-1, and investigated further.

F.5.4.2.2 Canister rupture in air intake tunnel Estimates of dose rates in the Control Building and in the Auxiliary and Fuel Handling Buildings resulting frcm both a fuel removal canister and an SDS resin canister rupture in the TMI-1 air intake tunnel were performed. Dose rates to personnel in either case were below the limits of the NRC Standard Review Plan for one-time occupational doses. Therefore, no further review of these events is required. The capability to maintain TMI-1 in a safe condition is not jeopardized by this type of event.

F-2 5

+ -

m --n + - - - , gg-,g ,--w 7,,-y- -y- , - --~-w-m

, e,- g,- o-- , ,, y n g, - - , -- ---. _ - - - - -p... e -m,,--,p.

o o,. ,

Table F-2 COMPARISON OF IS0 TOPES FOR POTENTIAL TMI-2 CORE RELEASES

.1 2 3 4 5 6 Dose Quantity (C1) Fraction Conversion ** Columns.

as of 8/3/84 Remaining Factor 2 2x3x4 Percent Isotope -approx.- -aporox.- (Rem /hr/Ci/m ) x (10-4) of Dose Kr-85 .4 0* 0 0 Sr-90 7x10f 6 x 10 .95 0* 0 0 Y-90 .95 0* 0 0 Ru-106 Sb-125 6x10l5 2 x 10 3 x 10 4 1

1 2.7 8.8 54 26 12 6

Cs-134 3 x 10 5 .6 22 40 8 Cs-137 7 x 10 5 .6 7.8 328 70 Ce-144 3 x 10 1 0.7 21 4 Pm-147 8 x 10 54 1 0* 0 0 Sm-151 1 x 10 4 1 0* 0 0 Eu-155 2 x 10 1 0* 0 0

• 8 emitter or low energy x-rays

• • Reference WASH-1400, Appendix 6, page C-6 i

e I

F-2 6

g ,,. 6 -

TABLE F-3 POSTULATED CORE INVENTORY RELEASES AND RESULTING CONCENTRATIONS Quantity (C1) Fraction Release

• Resulting** 3 Isotope As of 8/3/84 Remainino Fraction Concentration (Ci/m )

4 Kr-85 7 x 10 0.4 2 x 10~3 3.7 x 10-6 Sr-90 6 x 10 5 0.95 1 x 10-8 3.8 x 10-10 4

Sb-125 3 x 10 1.0 1 x 10-6 2.0 x 10~9 4

Cs-134 3 x 10 0.6 5 x 10-4 6.0 x 10~7 Cs-137 7 x 10 5 0.6 5 x 10~4 1.4 x 10-5

• From WASH-1400, Table VI 2-1, for PWR-8 category.

3

• • Based on an eight-hour release with x/Q = 2 x 10-3 sec/m .

F-27

., b :g F.6

SUMMARY

OF SCREENING FOR RADI0 ACTIVE RELEASE CONSEQUENCES Only a single type of credible event involving the release of radioactive material from TMI-2 has been identified as having the potential to preclude maintaining TMI-1 in a safe condition. This event is the release of high activity materials from a dropped fuel removal or SDS resin canister, which has penetrated the truck bay floor and broken open in the piping penetration room underneath the Unit 1 truck bay area. For the cases investigated, the release of SDS resin activity was the more serious occurrence.

Both of these potentially significant events are expected to have a very low likelihood of occurrence. See Section 3.0 for further evaluation of the risk inherent in this type of event.

F-28

-.--..---_-_---_-----.-----_--_.-_--J