ML20076J969

Chapters 5,6 & 8,App a to Chapter 5 & Revised Table of Contents to Severe Accident Risk Assessment

ML20076J969
Person / Time
Site:	Limerick
Issue date:	07/01/1983
From:	PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC
To:
Shared Package
ML20076J968	List: ML20076J965 ML20076J969
References
NUDOCS 8307070170
Download: ML20076J969 (117)

Text

i CONTENTS VOLUME 1: MAIN REPORT Pace

SUMMARY

KEY 'IO ACCIDENT SEQUENCE SYMBOLS 1 INTRODUCTION 1-1 1.1 Background 1-1 1.2 Scope and Ground Rules 1-2 1.2.1 External Events Risk Study 1-2 1.2.2 Revised Consequence Analysis 1-2 1.2.3 Uncertainty Analysis 1-3 1.3 Contents of the Report 1-3 2 METHODOLOGY OVERVIEW 2-1 2.1 Introduction 2-1 2.2 The LGS Risk Model 2-1 2.3 Inclusion of Random Reactor-Vessel Failure in the LGS PRA Risk Model 2-2 2.4 Method Used for Assessing the Risk from External Initiating Events 2-2 2.5 Consequence Modeling 2-5 2.5.1 Source Terms 2-5 2.5.2 Meteorological Data 2-7 O 2.5.3 2.5.4 Population Distribution Evacuation Modeling and Other Protective Measures 2-7 2-7 2.5.5 Economic Costs 2-8 2.6 Uncertainty Analysis 2-8 2.6.1 General Approach to Uncertainty Analysis 2-8 2.6.2 Detailed Approach to Uncertainty Analysis 2-9 References 2-11 3 ANALYSIS OF ACCIDENT SEQUENCES RESULTING FROM SEISMIC EVENTS 3-1 3.1 Introduction 3-1 3.2 Overview of the Seismic Design of the Limerick Generating Station (LGS) 3-2 3.3 Overall Methods Used for Analyzing the Seismic Risk 3-2 3.3.1 Estimation of the Occurrence Frequencies of Ground-Motion Acceleration 3-3 3.3.2 Estimation of Structural and Component Fragilities 3-5 3.3.3 Calculation of the Seismic Contribution to Core-Melt Frequency 3-9 3.4 Plant System and Accident-Sequence Analysis 3-9 3.4.1 Initiating Events 3-9 3.4.2 Seismic Event Tree 3-11 3.4.3 Results 3-12 3.5 Classification of Accident Sequences 3-13 References 3-15 p 4 ANALYSIS OF ACCIDENT SEQUENCES RESULTING FROM FIRES 4-1

() 4.1 Introduction 4.2 Fire-Protection Measures at Limerick 4-1 4-1 11 r307070170 830701 PDR ADOCK 05000352 A PDR

CONTENTS (Continued)

Page 4.3 Screening Analysis 4-3 4.3.1 Introduction .

4-3 4.3.2 Identification of Relevant Fire Zones 4-4 4.3.3 Quantification of the Frequency of Significant Fires 4-4 4.3.4 Identification of Potential Initiating Events 4-5 4.3.5 Effects on Mitigating Systems 4-5 4.3.6 Quantification of Fire-Inducted Sequence Frequencies 4-6 4.3.7 Results of Screening Analysis 4-7 4.4 Detailed Analysis of Fire Zones in Which Fires May Make Potentially Significant Contributions to Core-Melt Frequency 4-8 4.4.1 Introduction 4-8 4.4.2 Outline of Methods of Analysis 4-8 4.4.2.1 Method of Analysis for the Majority of Potentially Significant Fire Zones--Fire Zones 2, 20, 22, 24, 44, 45, and 47 4-8 4.4.2.2 Method of Analysis for Fires in Auxiliary Equipment Room--Fire Zone 25 4-9 4.4.3 Detailed Description of the Analysis Used For Potentially Significant Fire Zones--2, 20, 22, 24, 44, 45, and 47 4-10 4.4.3.1 Description of Fire Zone 44 and Its Contents 4-10 4.4.3.2 Evaluation of Fire Frequencies 4-11 4.4.3.2.1 Fires in Installed Combustible O' Materials 4.4.3.2.2 Fires in Transient Combustible 4-11 Materials 4-12 4.4.3.2.3 Application to Fire Zone 44 4-13 4.4.3.3 Description and Evaluation of Fire-Growth Stages and Resulting Core-Melt Frequencies 4-13 4.4.3.3.1 Qualitative Description of the Fire-Growth Stages Considered 4-13 4.4.3.3.2 Qualitative Description of the Fire-Growth Event Tree 4-15 4.4.3.3.3 Quantification of the Fire-Growth Event Tree for Self-Ignited Cable-Raceway Fires 4-15 4.4.3.3.4 Quantification of the Fire-Growth Event Tree for Transient-Combustible Fires 4-19 4.4.3.3.5 Quantification of the Fire-Growth Event Tree for Power-Distribution Panels 4-20 4.4.4 Analysis of the Auxiliary Equipment Room 4-21 4.4.4.1 Description of the Fire Zone and Contents 4-22 4.4.4.2 Evaluation of Core-Melt Frequency Due to the Self-Ignition of Instal 3ed-Combustible Material 4-22 4.4.4.2.1 Self-Ignited Cabinet Fires 4-22 O

iii

l I

CONTENTS (Continued)

Page 4.4.4.2.2 Self-Ignited Cable Fires in Raised Floor Sections and Overhead Cable Raceways 4-24 4.4.4.3 Transient--Combustible Fires 4-24 4.4.4.3.1 Frequency and Nature of Transient-Combustible Fires 4-25 4.4.4.3.2 Effect on Equipment in Cabinets 4-25 4.4.4.3.3 Effects on Cables in Aluminum Gutters 4-26 4.4.4.3.4 Critical Location of Transient--Com-bustible Fires 4-27 4.4.4.3.5 Evaluation of Core-Melt Frequency 4-28 4.5 Results 4-28 4.6 Uncertainties in the Fire Analysis 4-29 4.6.1 Fire Frequencies 4-29 4.6.2 Fire-Propagation Modeling 4-30 4.6.3 Fire-Suppression Model 4-30 4.6.4 Conclusion 4-30 REFERENCES 4-31 5 ANALYSIS OF ACCIDENTS RESULTING FROM FLOODING $-1 O 5.1 Introduction 5-1

\ s/

% 5.2 External Flooding 5-1 5.3 Internal Floods 5-4 5.3.1 Introduction 5-4 5.3.2 Summary of Protection Measures Against Internal Flooding at LGS 5-4 5.3.3 Method of Analysis for Evaluation of Flood-Induced Accident Sequences 5-5 5.3.3.1 General Method of Analysis 5-5 5.3.3.2 Independence of Plant Areas with Respect to Flooding 5-7 5.3.3.3 Evaluation of Flood Frequencies 5-7 5.3.3.4 Screening Criteria 5-8 5.3.3.5 General Assumptions Made Throughout Analysis 5-9 5.3.4 Analysis of Flooding-Induced Accident Sequences 5-10 5.3.4.1 Introduction 5-10 5.3.4.2 Analysis of Turbine Enclosure 5-10 5.3.4.2.1 Independence 5-11 5.3.4.2.2 First-Level Analysis of Turbine-Enclosure Flooding 5-12 5.3.4.3 Diesel-Generator Enclosure 5-12 5.3.4.3.1 Independence from Other Structures 5-13 5.3.4.3.2 First-Level Analysis of Diesel-Enclosure Flooding 5-13 Reactor Enclosure

() 5-14 5.3.4.4 i 5.3.4.4.1 Independence 5-14 iv I

i

3 I

CONTENTS (Continued) 4 Page 5.3.4.4.2 First-Level Analysis Reactor-Enclosure Flooding 5-15 5.3.4.4.3 Second-Level Analysis of Reactor-

Enclosure Flooding 5-15 i 5.3.4.4.4 Third-Level Analysis of Reactor- i Enclosure Flood Area RB-FL15  !

(Elevation 283 Feet) 5-21

! 5.3.4.4.5 Third-Level Analysis of Reactor i Enclosure Flood Area RBFLil j (Elevation 217 Feet) 5-24 5.3.4.4.6 Third-Level Analysis of Reactor Enclosure Flood Area RBFLl4

, (Elevation 253 feet) 5-25 l 5.3.4.5 Control Structure 5-26 1 5.3.4.5.1 Independence of Control Enclosure 5-27 5.3.4.5.2 First- and Second-Level Analyses 5-27

5.3.4.5.3 Third-Level Analysis of the i Control Structure 5-27 I

5.3.4.6 Spray Pond Pump Structure 5-31 5.3.4.6.1 Independence from other Structures 5-31

. 5.3.4.6.2 First Level Analysis 5-31

! 5.3.4.6.3 Second Level Analysis 5-32

5.3.5 Special Concerns 5-32 5.3.5.1 Introduction 5-32

5.3.5.2 Failure of Scram-System-Pipework Integrity 5-33 l 5.3.5.3 Large Water-Storage Facilities 5-34 4

5.3.5.3.1 Suppression Pool 5-34 5.3.5.3.2 Spent Fuel Pool 5-34 5.3.6 Conclusions 5-35 i References 5-36 i

I 6 ANALYSIS OF ACCIDENTS RESULTING FROM TORNADOES 6-1 6.1 Introduction 6-1 6.2 Design Features that Protect the LGS Plant From the Effects of Tornadoes 6-2 6.3 Effects on the Plant and Categorization of Tornadoes 6-3 j 6.3.1 Introduction 6-3 1

6.3.2 Tornadoes with Severity Less Than the Design Basis 6-3 6.3.3 Tornadoes at or Above the Design Basis 6-4 6.3.4 Tornado Missiles 6-4 6.4 Tornado Frequencies 6-5 6.4.1 Introduction 6-5 6.4.2 Tornado Characteristics and Risk Models 6-6 6.4.3 Frequencies of the Tornado Categories 6-8 4

6.5 The Contribution of Tornadoes to Core-Melt Frequency and the

) Effects on Risk 6-10 V

. ~ , - . ._ _._ ,. . . _ _ ,... ..._ . _ . _ _ . - .

. _ _ . - . . _ _ , _ _ , - - _ . . - - - - - _ _ , . . _ , _ . - , ~ _ - - - . . .

CONTENTS (Continued)

Page 6.5.1 Tornadoes Below the Design Basis 6-10 6.5.2 Tornadoes Above the Design Basis 6-12 6.5.3 Conclusions 6-12 References 6-13 7 PUBLIC RISK DUE 'IO TRANSPORTATION AND RELATED ACCIDENTS IN THE VICINITY OF THE SITE (TO BE PROVIDED) 7-1 8 ANALYSIS OF ACCIDENTS RESULTING FROM TURBINE MISSILES 8-1 8.1 Introduction 8-1 8.2 Analysis of Frequency of Damage Resulting From Turbine Missiles 8-1 References 8-4 9 ACCIDENT CLASSES AND REPRESENTATIVE SOURCE TERMS 9-1 9.1 Introduction 9-1 9.2 Accident Classes and Radionuclide Source Terms 9-2 9.2.1 Description of Accident Classes 9-2 9.2.2 Containment-Failure Modes 9-3 9.2.3 Calculation of Source-Term Magnitudes 9-4 9.2.3.1 OXRE Source Term 9-4 9.2.3.2 OPREL Source Term 9-5 9.2.3.3 Source Term Involving Class IV (ATWS) 9-5 9.2.3.4 Cl237" Source Term 9-6 9.2.3.5 LEAKl and LEAK 2 Source Terms 9-6 9.2.3.6 RB Source Term (Class IS) 9-7 9.2.3.7 VR and VRH2O Source Terms (Class S) 9-7 9.2.4 Release-Fraction Uncertainties 9-7 9.2.4.1 Uncertainties in the Release Fractions for the OXRE (Steam Explosion) Source Term 9-8 9.2.4.2 Uncertainty in the Release Fractions for the ATWS Source Term 9-9 9.2.4.3 Uncertainty in the Release Fractions for the OPREL Source Terr. 9-9 9.2.4.4 Uncertainties in Reletti Fractions for Seismically Induced f.eydences and Random Reactor-vessel Tailures 9-9 9.3 Frequencies of Source Terms 9-10 10 ANALYSIS OF OFFSITE CONSEQUENCES 10-1 10.1 Data Requirements 10-1

10.1.1 Basic Radionuclide Data 10-1 10.1.2 Specification of the Source Term 10-2 10.1.2.1 Frequency 10-2 i 10.1.2.2 Source-Term Magnitudes 10-3 10.1.2.3 Times of Release 10-3 10.1.2.4 Duration of Release 10-4 Warning Time 10-4

( 10.1.2.5 vi

CONTENTS (Continued)

Page 10.1.2.6 Rate of Release cf Heat 10-5 10.1.2.7 Dimensions of the Release 10-6 10.1.3 Meteorological Data 10-6 10.1.4 Deposition Data 10-6 10.1.5 Population Distribution 10-8 10.1.6 Evacuation and Other Protective Measures That Reduce Radiation Doses 10-8 10.1.6.1 Evacuation 10-8 10.1.6.1.1 Valaes of R e, R1 and 10-8 10.1.6.1.2 Time Delay Before Evacuation 10-9 10.1.6.1.3 Evacuation Speed 10-10 10.1.6.1.4 Maximum Distance of Travel ,

While Evacuating 10-11 l 10.1.6.1.5 Special Sheltering Zone, I Radius 2 10-11 10.1.6.2 Shielding 10-11 10.1.6.3 Discussion 10-13 j 10.1.6.4 Breathing Rates 10-13 10.1.6.5 Evacuation and Sheltering in the Event of an Earthquakes 10-14 10.1.6.6 Summary 10-15 N 10.1.7 Heath-Physics Data 10-15 10.1.8 Economic Data 10-16 10.2 Point-Estimate Results and Selection of Sequences for Sensitivity Studies 10-17 10.2.1 Point-Estimate Risk of Early Fatalities 10-17 10.2.2 Point-Estimate Risk of Latent-Cancer Fatalities 10-18 10.2.2.1 Latent-Cancer Fatalities Among the Population to 500 Miles (Excluding Thyroid Cancers) 10-18 10.2.2.2 Latent-Cancer Fatalities Among the Population to 50 Miles (Excluding Thyroid Cancers) 10-18 10.2.2.3 Thyroid-Cancer Fatalities 10-18

10.2.3 Point Estimate of the Whole-Body Population Dose 10-19 10.2.4 Individual Dose Impacts from Early Exposure--Point Estimates of Bone-Marrow Doses of 200 Rem or More 10-19 10.2.5 Offsite Costs 10-19 10.2.6 Individual Risk of Early Fatality 10-19 10.2.7 Summary of Senstivity Studies 10-20 10.3 Treatment of Uncertainties in Consequence Analysis 10-20 10.3.1 Characteristics of the Source Terms 10-21 10.3.1.1 Class (ATWS) Source Terms (C47, C47', C47") 10-21 10.3.1.2 Vessel-Failure Source Terms (VR and VRH2O) 10-22 10.3.1.3 OPREL Source Term 10-23 10.3.1.4 RB (Reactor-Enclosure Failure) Source Term 10-23 10.3.2 Evacuation Assumptions 10-23 10.3.3 Heath-Effects Modeling 10-25 i

vii

l p

\j CONTENTS (Continued)

Page 10.3.3.1 Latent-Cancer Fatalities 10-25 10.3.3.2 Early Fatalities 10-26 10.3.4 Discussion 10-26 10.3.4.1 Dry-Deposition Modeling 10-26 10.3.4.2 Rainfall Modeling 10-27 10.3.4.3 Straight-Line, Trajectory, and Multipuff Models 10-27 References 10-29 11 UNCERTAINTY ANALYSIS 11-1 11.1 Introduction 11-1 11.2 Types and Sources of Uncertainty 11-2 11.2.1 Types of Uncertainty 11-2 11.2.1.1 Parameter Uncertainties 11-2 11.2.1.2 Modeling Uncertainties 11-2 11.2.1.1 Completeness Uncertainties 11-2 11.2.2 Sources of Uncertainty 11-3 11.2.2.1 Accident-Sequence Analysis 11-3 11.2.2.2 Analyses of Containment Responsee, In-Plant Accident Processes, Radiohuclide

[ *) Transport, and offsite Consequences 11-3

\s d 11.3 Methodological Framework 11-4 11.3.1 Measures of Uncertainty 11-4 11.3.1.1 Introduction 11-4 11.3.1.2 Uncertainties of the Input Parameters of the System Analysis 11-5 11.3.1.3 Uncertainties Associated with the Modeling of In-Plant and Offsite Consequences 11-6 11.3.2 Uncertainty-Analysis Framework 11-7 11.4 Uncertainty Analysis 11-8 11.4.1 Core-Melt Frequency 11-8 11.4.2 Risk of Early Fatalities 11-10 11.4.2.1 Probability Distributions on Frequencies of Representative Source Terms 11-10 11.4.2.2 Probability Distributions on Conditional CCDFs 11-11 11.4.2.3 Probability Distributions on CCDFs 11-12 11.5 Other Measures of Risk 11-13 REFERENCES 11-14 12 RESULTS AND CONCLUSIONS 12-1 12.1 Introduction 12-1 12.2 The Analysis 12-2 12.2.1 The Structure of the Study 12-2 12.2.2 Quantification and Uncertainty Analysis 12-2 i

f~ ,

viii

1 l

i  !

4 CONTENTS (Continued)

Page i

12.3 Core-Melt and Accident-Sequence Frequencies 12-4 12.3.1 Core-Melt Frequency 12-4 12.3.2 Dominant Contributors to Core Melt 12-5 1

12.4 Accident-Class Frequencies and Associated Source Terms 12-5 12.4.1 Accident-Class Frequencies 12-5 12.4.2 Source Terms 12-7 12.5 Public Risk 12-8 12.5.1 Representation of Public Risk 12-8 12.5.2 The CCDFS 12-9 12.5.3 Early Fatalities--Interpretation and Perspective 12-11 12.5.3.1 Dominant Contributors to Risk 12-11 12.5.3.2 Risk Perspective 12-12 12.5.3.3 Comparison with Other Studies 12-13 1 12.5.3.3.1 LGS PRA 12-13 l 12.5.3.3.2 The Reactor Safety Study 12-13 12.5.4 Latent-Cancer Fatalities--Interpretation and Perspective 12-14 12.5.4.1 Dominant Contributors to Risk 12-14 12.5.4.2 Comparison with Other Studies 12-14 12.5.4.3 Other Measures of the Risk of Latent-Cancer Fatality 12-15 12.5.4.4 Risk of Latent-Cancer Fatality in Perspective 12-15 12.5.5 Whole-Body Population Dose 12-15 l 12.5.6 Individual Dose Impacts 12-16 12.5.6.1 Bone-Marrow Dose of 200 Rem or More from i

Early Exposure 12-16 12.5.7 Of fsite Costs (Decontamination, Relocation, etc.) 12-16 12.5.8 Individual Risk of Fatality 12-18 12.5.8.1 Individual Risk of Early Fatality 12-18 12.5.8.2 Individual Risk of Cancer Fatality 12-19 12.5.9 Future Trends 12-19

REFERENCES 12-21 i

I l

ix l

\

m. -- . ._.. . . . - . - . _,. , ,- - - - - . . _ _ ._ - = . . _ . . , , _ . _ . _ . - - - - - - - , - . . - - . - .

CONTENTS VOLUME la MAIN REPORT Page

SUMMARY

KEY TO ACCIDENT SEQUENCE SYMBOLS 1 INTRODUCTION 1-1 1.1 Background 1-1 1.2 Scope and Ground Rules 1*2 1.2.1 External Events Risk Study 1-2 1.2.2 Revised Consequence Analysis 1-2 1.2.3 Uncertainty Analysis 1-3 1.1 Contents of the Report 1-3 2 METHODOI4GY OVERVIEW 2-1 2.1 Introduction 2-1 2.2 The I4S Risk Model 2-1 2.3 Inclusion of Randon Reactor-Vessel Failure in the I4S PRA Risk Model 2-2 2.4 Method Used for Assessing the Risk from External Initiating Events 2-2 2.5 Consequence Modeling 2-5 2.5.1 Source Terms 2-5 2.5.2 Meteorological Data 2-7 O 2.5.3 Population Distribution 2.5.4 2.5.5 Evacuation Modeling and Other Protective Measures Economic Costs 2-7 2-7 2-8 2.6 Uncertainty Analysis 2-8 2.6.1 General Approach to Uncertainty Analysis 2-8 2.6.2 Detailed Approach to Uncertainty Analysis 2-9 References 2-11 3 ANALYSIS OF ACCIDENT SEQUENCES RESULTING FROM SEISMIC EVENTS 3-1 3.1 Introduction 3-1 3.2 Overview of the Seismic Design of the Limerick Generating Station (LGS) 3-2 3.3 Overall Methods Used for Analyzing the Seismic Risk 3-2 3.3.1 Estimation of the Occurrence Frequencies of Ground-Motion Acceleration 3-3 3.3.2 Estimation of Structural and Component Fragilities 3-5 3.3.3 Calculation of the Seismic Contribution to Core-Melt Frequency 3-9 3.4 Plant System and Accident-Sequence Analysis 3-9 3.4.1 Initiating Events 3-9 3.4.2 Seismic Event Tree 3-11 3.4.3 Results 3-12 3.5 Classification of Accident Sequences 3-13 References 3-15 4 ANALYSIS OF ACCIDENT SEQUENCES RESULTING FROM FIRES 4-1 4.1 Introduction 4-1 4.2 Fire-Protection Measures at Limerick 4-1 11 h,-- ,,

i CONTENTS (Continued)

Page 4.3 Screening Analysis 4-3 4.3.1 Introduction 4-3 4.3.2 Identification of Relevant Fire Zones 4-4

4.3.3 Quantification of the Frequency of Significant Fires 4-4 i 4.3.4 Identification of Potential Initiating Events 4-5 4.3.5 Effects on Mitigating Systems 4-5 4.3.6 Quantification of Fire-Inducted Sequence Frequencies 4-6 4.3.7 Results of Screening Analysis 4-7 4.4 Detailed Analysis of Fire Zones in which Fires May Make Potential!y Significant Contributions to Core-Melt Frequency 4-8 ,

4.4.1 Introduction 4-8 4.4.2 Outline of Methods of Analysis 4-8 4.4.2.1 Method of Analysis for the Majority of Potentially Significant Fire Zones--Fire

> Zones 2, 20, 22, 24, 44, 45, and 47 4-8 4.4.2.2 Method of Analysis for Fires in Auxiliary Equipment Room--Fire Zone 25 4-9 4.4.3 Detailed Description of the Analysis Used For Potentially Significant Fire Zones--2., 20, 22, 24, 44, 45, and 47 4-10 4.4.3.1 Description of Fire Zone 44 and Its Contents 4-10 4.4.3.2 Evaluation of Fire Frequencies 4-11 4.4.3.2.1 Fires in Installed Combustible Materials 4-11 4.4.3.2.2 Fires in Transient Combustible Materials 4-12 4.4.3.2.3 Application to Fire Zone 44 4-13 4.4.3.3 Description and Evaluation of Fire-Growth Stages and Resulting Core-Melt Frequencies 4-13 4.4.3.3.1 Qualitative Description of the Fire-Growt.h Stages Considered 4-13 4.4.3.3.2 Qualitative Description of the Fire-Growth Event Tree 4-15 4.4.3.3.3 Quantification of the Fire-Growth I

Event Tree for Self-Ignited Cable-Raceway Fires 4-15 4.4.3.3.4 Quantification of the Fire-Growth E7ent Tree for Transient-Combustible Fires ,

4-19 4.4.3.3.5 Quantification of the Fire-Growth Event Tree for Power-Distribution Panels 4-20 4.4.4 Analysis of the Auxiliary Equipment Room 4-21 4.4.4.1 Description of the Fire Zone and Contents 4-22 4.4.4.2 Evaluation of Core-Melt Frequency Due to the

) Self-Ignition of Installed-Combustible Material 4-22 4.4.4.2.1 Self-Ignited Cabinet Fires 4-22 4

v iii l

l

CONTENTS (Continued)

Page 4.4.4.2.2 Self-Ignited Cable Fires in Raised Floor Sections and Overhead Cable Raceways 4-24 4.4.4.3 Transient--Combustible Fires 4-24 4.4.4.3.1 Frequency and Nature of Transient-Combustible Fires 4-25 4.4.4.3.2 Effect on Equipmerit in Cabinets 4-25 4.4.4.3.3 Effects on Cables in Aluminum Gutters 4-26 4.4.4.3.4 Critical Location of Transient--Com-bustible Fires 4-27 4.4.4.3.5 Evaluation of Core-Melt Frequency 4-28 4.5 Results 4-28 4.6 Uncertainties in the Fire Analysis 4-29 4.6.1 Fire Frequencies 4-29 4.6.2 Fire-Propagai. ton Modeling 4-30 4.6.3 Fire-Suppression Model 4-30 4.6.4 Conclusion 4-30 REFERENCES 4-31 5 ANALYSIS OF ACCIDENTS RESULTING FROM FIDODING 5-1

/]

(,,/

5.1 Introduction 5-1 5.2 External Flooding 5-1 5.3 Internal Floods 5-4 5.3.1 Introduction 5-4 5.3.2 Summary of Protection Measures Against Internal Flooding at LGS 5-4 5.3.3 Method of Analysis for Evaluation of Flood-Induced Accident Sequences 5-5 5.3.3.1 General Method of Analysis 5-5 5.3.3.2 Independence of Plant Areas with Respect to Flooding 5-7 5.3.3.3 Evaluation of Flood Frequencies 5-7 5.3.3.4 Screening Criteria 5-8 5.3.3.5 General Assumptions Made Throughout Analysis 5-9 5.3.4 Analysis of Flooding-Induced Accident Sequences ,

5-10 5.3.4.1 Introduction 5-10 5.3.4.2 Analysis of Turbine Enclosure 5-10

5.3.4.2.1 Independence 5-11 l 5.3.4.2.2 First-Level Analysis of Turbine-Enclosure Flooding 5-12 l 5.3.4.3 Diesel-Generator Enclosure 5-12 5.3.4.3.1 Independence from other Structures 5-13 5.3.4.3.2 First-Level Analysis of Diesel-Enclosure Flooding 5-13 5.3.4.4 Reactor Enclosure 5-14 5.3.4,4.1 Independence 5-14 iv

CONTENTS (Continued)

Page 5.3.4.4.2 First-Level Analysis Reactor-Enclosure Flooding 5-15 5.3.4.4.3 Second-Level Analysis of Reactor-Enclosure Flooding 5-15 5.3.4.4.4 Third-Level Analysis of Reactor-Enclosure Flood Area RB-FL15 (Elevation 283 Feet) 5-21 5.3.4.4.5 Third-Level Analysis of Reactor Enclosure Flood Area RBFLil (Elevation 217 Feet) 5-24 5.3.4.4.6 Third-Level Analysis of Reactor Enclosure Flood Area RBFLl4 (Elevation 253 feet) 5-25 5.3.4.5 Control Structure 5-26 5.3.4.5.1 Independence of Control Enclosure 5-27 5.3.4.5.2 First- and Second-Level Analyses 5-27 5.3.4.5.3 Third-Level Analysis of the Control Structure 5-27 5.3.4.6 Spray Pond Pump Structure 5-31 5.3.4.6.1 Independence from other Structures 5-31 5.3.4.6.2 First Level Analysis 5-31

[N 5.3.4.6.3 Second Level Analysis 5-32 x 5.3.5 Special Concerns 5-32 5.3.5.1 Introduction 5-32 5.3.5.2 Failure of Scram-System-Pipework Integrity 5-33 5.3.5.3 Large Water-Storage Facilities 5-34 5.3.5.3.1 Suppression Pool 5-34 5.3.5.3.2 Spent Fuel Pool 5-34 5.3.6 Conclusions 5-35 References 5-36 6 ANALYSIS OF ACCIDENTS RESULTING FROM 'IORNADOES 6-1 6.1 Introduction 6-1 6.2 Design Features that Protect the LGS Plant Frott the Effects of Tornadoes 6-2 6.3 Effects on the Plant and Categorization of Tornadoes 6-3 6.3.1 Introduction 6-3 6.3.2 Tornadoes with Severity Less Than the Design Basis 6-3 6.3.3 Tornadoes at or Above the Design Basis 6-4 6.3.4 Tornado Missiles 6-4 i

6.4 Tornado Frequencies 6-5 i 6.4.1 Introduction 6-5 6.4.2 Tornado Characteristics and Risk Models 6-6 6.4.3 Frequencies of the Tornado Categories 6-8 6.5 The Contribution of Tornadoes to Core-Melt Frequency and the Effects on Risk 6-10

(

! V v

CONTENTS (Continued)

Page 6.5.1 Tornadoes Below the Design Basis 6-10 6.5.2 Tornadoes Above the Design Basis 6-12 6.5.3 Conclusions 6-12 References 6-13 7 PUBLIC RISK DUE 'IO TRANSPORTATION AND RELATED ACCIDENTS IN THE VICINITY OF THE SITE (TO BE PROVIDED) 7-1 8 ANALYSIS OF ACCIDENTS RESULTING FROM TURBINE MISSILES 8-1 8.1 Introduction 8-1 8.2 Analysis of Frequency of Damage Resulting From Turbine Missiles 8-1 References 8-4 9 ACCIDENT CLASSES AND REPRESENTATIVE SOURCE TERMS 9-1 9.1 Introduction 9-1 9.2 Accident Classes and Radionuclide Source Terms 9-2 9.2.1 Description of Accident Classes 9-2 9.2.2 Containment-Failure Modes 9-3 9.2.3 Calculation of Source-Term Magnitudes 9-4 9.2.3.1 OXRE Source Term 9-4 9.2.3.2 OPREL Source Term 9-5 O 9.2.3.3 9.2.3.4 9.2.3.5 Source Term Involving Class IV (ATWS)

C1237" Source Term LEAK 1 and LEAK 2 Source Terms 9-5 9-6 9-6 9.2.3.6 RB Source Term (Class IS) 9-7 9.2.3.7 VR and VRH2O Source Terms (Class S) 9-7 9.2.4 Release-Fraction Uncertainties 9-7 9.2.4.1 Uncertainties in the Release Fractions for the OXRE (Steam Explosion) Source Term 9-8 9.2.4.2 Uncertainty in the Release Fractions for the ATLIS Source Term 9-9 9.2.4.3 Uncertainty in the Releasa Fractions for the OPREL Source Term 9-9 9.2.4.4 Uncertainties in Release Fractions for Seismically Induced Sequences and Random Reactor-Vessel Failures 9-9 9.3 Frequencies of Source Terms 9-10 10 ANALYSIS OF OFFSITE CONSEQUENCES 10-1 10.1 Data Requirements 10-1 10.1.1 Basic Radionuclide Data 10-1 10.1.2 Specification of the Source Term 10-2 10.1.2.1 Frequency 10-2 10.1.2.2 Source-Term Magnitudes 10-3 10.1.2.3 Times of Release 10-3 10.1.2.4 Duration of Release 10-4 10.1.2.5 Warning Time 10-4

( }

vi

I CONTENTS (Continued)

Page 10.1.2.6 Rate of Release of Heat 10-5 10.1.2.7 Dimensions of the Release 10-6 10.1.3 Meteorological Data 10-6 10.1.4 Deposition Data 10-6 10.1.5 Population Distribution 10-8 10.1.6 Evacuation and Other Protective Measures That Reduce Radiation Doses 10-8 10.1.6.1 Evacuation 10-8 10.1.6.1.1 values of R e, R1 and 10-8 10.1.6.1.2 Time Delay Before Evacuation 10-9 10.1.6.1.3 Evacuation Speed 10-10 10.1.6.J.4 Maximum Distance of Travel While Evacuating 10-11 10.1.6.1.5 Special Sheltering Zone, Radius 2 10-11 10.1.6.2 Shielding 10-11 10.1.6.3 Discussion 10-13 10.1.6.4 Breathing Rates 10-13 10.1.6.5 Evacuation and Sheltering in the Event of an Earthquakes 10-14 10.1.6.6 Summary 10-15 10.1.7 Heath-Physics Data 10-15 O' 10.1.8 Economic Data 10.2 Point-Estimate Results and Selection of Sequences for 10-16 Sensitivity Studies 10-17 10.2.1 Point-Estimate Risk of Early Fatalities 10-17 10.2.2 Point-Estimate Risk of Latent-Cancer Fatalities 10-18 10.2.2.1 Latent-Cancer Fatalities Among the Population to 500 Miles (Excluding Thyroid Cancers) 10-18 10.2.2.2 Latent-Cancer Fatalities Among the Population to 50 Miles (Excluding Thyroid Cancers) 10-18 10.2.2.3 Thyroid-Cancer Fatalities 10-18 10.2.3 Point Estimate of the Whole-Body Population Dose 10-19 10.2.4 Individual Dose Impacts from Early Exposure--Point Estimates of Bone-Marrow Doses of 200 Rem or More '

10-19 10.2.5 Offsite Costs 10-19 10.7,6 Individual Risk of Early Fatality 10-19 10.2.7 Summary of Senstivity Studies 10-20 10.3 Treatment of Uncertainties in Consequence Analysis 10-20 10.3.1 Characteristics of the Source Terms 10-21 10.3.1.1 Class (ATWS) Source Terms (C47, C47', C4 t") 10-21

10.3.1.2 Vessel-Failure Source Terms (VR and VRH2O) 10-22 10.3.1.3 OPREL Source Term 10-23 10.3.1.4 RB (Reactor-Enclosure Failure) Source Term 10-23 10.3.2 Evacuation Assumptions 10-23 10.3.3 Heath-Effects Modeling 10-25 vii

( CONTENTS (Continued)

Page 10.3.3.1 Latent-Cancer Fatalities 10 10.3.3.2 Early Fatalities 10-26 10.3.4 Discussion 10-26 10.3.4.1 Dry-Deposition Modeling 10-26 10.3.4.2 Rainfall Modeling 10-27 10.3.4.3 Straight-Line, Trajectory, and Multipuff Models 10-27 References 10-29 11 UNCERTAINTY ANALYSIS 11-1 11.1 Introduction 11-1 11.2 Types and Sources of Uncertainty 11-2 11.2.1 Types of Uncertainty 11-2 11.2.1.1 ParMoeter Uncertainties 11-2 11.2.1.2 Modeling Uncertainties 11-2 11.2.1.3 Completeness Uncertainties 11-2 11.2.2 Sources of Uncertainty 11-3 11.2.2.1 Accident-Sequence Analysis 11-3 11.2.2.2 Analyses of Containment Responses, In-Plant Accident Processes, Radionuclide

(]

\s_/

Transport, and Offsite Consequences 11.3 Methodological Framework 11-3 11-4 11.3.1 Measures of Uncertainty 11-4 11.3.1.1 Introduction 11-4 11.3.1.2 Uncertainties of the Input Parameters of the System Analysis 11-5 11.3.1.3 Uncertainties Associated with the Modeling of In-Plant and Offsite Consequences 11-6 11.3.2 Uncertainty-Analysis Framework 11-7 11.4 Uncertainty Analysis 11-8 11.4.1 Core-Melt Frequency 11-8 11.4.2 Risk of Early Fatalities 11-10 11.4.2.1 Probability Distributions on Frequencies of Representative Source Terms 11-10 11.4.2.2 Probability Distributions on Conditional CCDFs 11-11 11.4.2.3 Probability Distributions on CCDFs 11-12 11.5 Other Measures of Risk 11-13 REFERENCES 11-14 12 RESULTS AND CONCLUSIONS 12-1 12.1 Introduction 12-1 l 12.2 The Analysis 12-2 1

12.2.1 The Structure of the Study 12-2 12.2.2 Quantification and Uncertainty Analysis 12-2

-m,

\ G viii

CONTENTS (Continued)

Page 12.3 Core-Melt and Accident-Sequence Frequencies 12-4 12.3.1 Core-Melt Frequency 12-4 12.3.2 Dominant Contributors to Core Melt 12-5 12.4 Accident-Class Frequencies and Associated Source Terms 12-5 I

12.4.1 Accident-Class Frequencies 12-5 12.4.2 Source Terms 12-7 12.5 Public Risk 12-8 12.5.1 Representation of Public Risk 12-8 12.5.2 The CCDFS 12-9 12.5.3 Early Fatalities--Interpretation and Perspective 12-11 12.5.3.1 Dominant Contributors to Risk 12-11 12.5.3.2 Risk Perspective 12-12 12.5.3.3 Comparison with Other Studies 12-13 12.5.3.3.1 LGS PRA 12-13 12.5.3.3.2 The Reactor Safety Study 12-13 12.5.4 Latent-Cancer Fatalities--Interpretation and Perspective 12-14 12.5.4.1 Dominant Contributors to Risk 12-14 12.5.4.2 Comparison with other Studies 12-14 12.5.4.3 Other Measures of the Risk of Latent-l Cancer Fatality 12-15 12.5.4.4 Risk of Latent-Cancer Fatality in Perspective 12-15 12.5.5 Whole-Body Population Dose 12-15 12.5.6 Individual Dose Impacts 12-16 12.5.6.1 Bone-Marrow Dose of 200 Rem or More from Early Exposure 12-16 j 12.5.7 Offsite Costs (Decontamination, Relocation, etc.) 12-16

)

12.5.8 Individual Risk of Fatality 12-18 l 12.5.8.1 Individual Risk of Early Fatality 12-18 12.5.8.2 Individual Risk of Cancer Fatality 12-19 12.5.9 Future Trends 12-19 REFERENCES 12-21 1 O ix

Chapter 5 ANALYSIS OF ACCIDENTS RESULTING FROM FLOODING

5.1 INTRODUCTION

The objective of the analysis reported here was to estimate the contri-bution of floods to core-melt and accident-class frequency. Two different types of floods were considered: external floods, or those resulting di-rectly or indirectly from precipitation; and internal floods, those result-ing from the failure or incorrect operation of components within Limerick Generating Station (LGS) Unit 1. Internal floods may occur, for example, from the rupture or cracking of pipes or vessels containing fluids, or from the leakage past glands or seals due to a fluid system component being incorrectly assembled or even lef t in a disassembled state following maintenance.

The two types of floods were analyzed separately. The external flood is discussed in Section 5.2 and the internal flood in Section 5.3. There is no generally accepted methodology for estimating the frequency of severe external floods at a site such as the 1GS , where in order to postulate flooding, an enormous extrapolation of historical data .must be made. Con-sequently, the discussion centers on the conservatisms inherent in the FSAR

[}

\/

evaluation of the design-basis flood. The internal-floods analysis bears some similarity to the fires analysis. A screening analysis was performed to identify those independent areas within which a flood could, given cen-servative assumptions, contribute significantly to core-melt frequency. For these potentially significant areas, a more detailed analysis was performed to obtain a more realistic estimate of core-melt frequency.

5.2 EXTERNAL FLOODING The conclusion of the analysis of the flooding potential of the LGS presented in Section 2.4 of the Final Safety Analysis Report (FSAR) is that there is no hazard from flooding from sources external to the plant and therefore no special precautions are needed. In particular, the following points are made:

1. The topography of the site is such that local intense precipitation does not cause flooding. This is chown by a detailed hydrologic analysis of the site. This analysis is conservative in many ways:

the probable maximum precipitation (PMP) at the site is assumed; all drains and culverts are assumed to be blocked so that all flow is surface flow; peak flows from all subareas are assumed to reach the respective collection points simultaneously; and storage due to ponding is assumed not to attenuate the outflow from any of these subareas. Despite these assumptions, it is demonstrated that the r

) resulting water-surface elevation at any collection point in the

\- / vicinity of the safety-related structures does not result in the flooding of these structures.

5-1

2. Ponding on the roof does not cause the roof design load to be ex-ceeded. This is shown by demonstrating that when all roof drains are blocked and only a 1-foot section of the parapet is available for drainage of the maximum hourly PMP, the resulting head of water producos a roof loading less than the design basis. This is con-servative by virture of using the PMP, by assuming that ponding has occurred on the roof unnoticed (this would take well over 1 day using the PMP), and by allowing only 1 foot of the parapet to give drainage.

3. The probable maximam flood (PMF) on any of the streams and rivers does not affect the site. The combination of a PMF in Possum Hollow Run produced by a local intense thunderstorm and a standard project flood (SPF) on the Schuylkill River produces a water eleva-tion 57 feet below the plant bed. The PMF on the Schuylkill, com-bined with failure of the Ontelaunee Dam, results in an estimated water elevation at the site of 181 feet, or 36 feet below grade level. The highest estimated elevation at the site quoted in the FSAR was 207 fee t , 10 feet below the level of the ground eleva-tion of the reactor enclosure. It resulted from an SPF on the Schuylkill, a seismic failure of three upstream dams in such a way that the flood waters from all events arrive at the site simultane-ously, and a 40-mph wind causing wave run-up.

The SPF is estimated du 50 percent of the PMF. The PMF is deter-mined by the procedure of Appendix B of Regulatory Guide 1.59.

j)g

(, This procedure is a shortcut that is claimed to be more conserva-tive than the site-specific procedure recommended in Appendix A of Regulatory Guide 1.59 (USNRC, 1977). The combination of events causing the maximum flood is in general agreement with ANSI NI70 (American Nuclear Society, 1976).

The fact tha t is stressed throughout Section 2.4.4 of the LGS FSAR is that the calculations performed are conservative. One of the aims of this severe-accident-risk assessment was to estimate the risk from external haz-ards. This implies, in part, an assessment of the frequency with which the maximum precipitation levels and maximum flood levels evaluated in the FSAR are exceeded. The consensus of informed opinion appears to be that this cannot be done with any confidence (Advisory Committee on Reactor Safe-guards, 1952). There are many reasons for this, but the primary one is the dif ficulty of assessing the frequency of exceedance of the PMP. The PMF is a function of the PMP.

The PMP is defined as "the estimated depth of precipitation for a given duration, drainage area, and time of year for which there is virtually i no risk of exceedance. The PMP for a given duration and drainage area ap- l proaches and approximates the maximum which is physically possible within the limits of contemporary hydrometeorological knowledge and techniques" (American Nuclear Society, 1976). In practice, the PMP for a particular site is obtained from estimates made by the National Oceanic and Atmospheric Administration (NOAA) (Schreiner and Riedel, 1978). The basic data for such

[\~ }

estimates are actual observed area-precipitation depths for various i

5-2 l

durations. These data are used as described in Schreiner and Riedel (1978) to estimate the PMP. The essential features are as follows:

1. A maximization of the observed storm precipitation to a value that is consistent with the maximum moisture in the atmosphere for the storm location and month of occurrence. This maximization is done to be consistent with the highest observed dewpoint.

2. A transposition of storms within a region that is homogeneous rel-ative to terrain and meteorological features important to the particular storm rainfall. This transposition greatly increases the available data for evaluating the rainfall potential.

3 A smooth interpolation between the maxima for different durations and areas. This procedure, known as envelopment, gives regionally consistent mapped values.

The PMP is thus an estimate of a maximum precipitation in a given period that is based on observed extreme events and maximized in accordance with current understanding of the phenomena involved in precipitation. In a meeting of the Advisory Committee on Reactor Safeguards' Subcommittee on Ex-treme External Phenomena (1982), which was devoted to external flooding, the question of assigning a probability of exceedance to the PMP was raised.

The consensus was that the analysts involved in estimating the PMP did not have in mind any particular probability of exceedance, and, if one were s established, it would not be the same for every PMP. There was a discussion y , ) of a report (Riedel and Schreiner, 1980) that compared generalized estimates of the PMP with the heaviest observed rainfalls. The conclusion was that there were no cases in which the observed rainfall exceeded the generalized estimate of the PMP obtained from Schreiner and Riedel (1978). There are two apparent exceptions, but these are attributable to the comparison of point-value measurements from a single rain gauge with a 10-square-mile estimate of the PMP. When measurements were averaged over the 10 square miles, the ratio of observed rainfall to the PMP was always below 1. The PMP is a stable estimate, as indicated by the fact that the occarrence of Hurricane Agnes, the worst storm of record in many parts of Pennsylvania, resulted in only small changes in estimates of the PMP made by the NOAA.

However, since it is based on the maximum historical observations, there is no guarantee tha t it would not need to be revised in the light of an extraordinary occurrence. The general conclusion, however, is that use of the PMP is conservative, and, combined with the other conservatisms in the FSAR calculations, it is judged that flooding from intense precipitation at the site does not contribute significantly to risk.

The probability of exceeding the design-besis flood (DBF) on the Schuylkill River is also, given the current s tate of understanding, impos-sible to estimate. There are many factors that make this assessment even more difficult than the case of the PMP, not the least being the importance of the PMP as input to evaluation of the PMF and thus the SPF. There are, moreover, other assumptions and models used to translate the rainfall into flood level, each with its own degree of conservatism. A direct comparison

('"') with historical data gives no means of producing an estimate with any rea-

\ ,/ sonable degree of confidence, since the record encompasses only about 60 years and the flow associated with the DBF is on the order of 10 times the 5-3

l l

i flood of record and over 500 times the average flow of the river. Using the )

rating curve of Figure 7.4-7 of the LGS FSAR, the flow would have to be more

]

than double that of the DBF, that is, . more than 20 times the flood of rec- ,

ord, to give flooding at the site. Therefore, while it was felt to be impossible to estimate the probability of exceedance of the DBF at the LGS site with any precision, it is judged that the elements of conservatism in the FSAR calculations, coupled with the fact that there would be ample warn-ing of the flood, show that the risk to the plant of external flooding is negligible.

While there are large sources of stored water on the site--the spray i pond, cooling-tower basins, condensate and refueling-water storage tanks ,

etc.--it was judged that the frequency of a significant flood resulting from the failure of any of these sources is very low (on the order of 10~3 per year or less). While the turbine enclosure could be flooded, initiating an isolation transient, the frequency of this is much lower than that assumed in the bounding analysis of internal flooding (.016) and hence is an insig-nificant contributor.

5.3 INTERNAL FLOODS 5.

3.1 INTRODUCTION

As discussed in Section 5.1, " internal" flooding is defined here as that flooding caused by the failure or incorrect operation of components or systems within the plant. It should be noted that the definition adopted

here is not restricted to the accumulation of water, but also includes j spraying and dripping water.

4 An internal flood may contribute to the frequency of core melt by caus-ing an initiating event arid possibly damaging systems designed to shut down i

the plant following such an accident. In evaluating the frequency of core melt, the probability of coincident random equipment failures must also be accounted for in addition to the damage caused by the flood itcelf.

The protective measures taken against flooding at the LGS are described in Section 5.3.2. Section 5.3.3 discusses the method of analysis for flood-induced accident sequences, and Section 5.3.4 describes the analysis in de tail. Some special topics are discussed in Section 5.3.5. The results and conclusions of the internal-flooding analysis are discussed in Section 5.3.6. An evaluation of generic flooding data from U.S. light-water reactor (LWR) experience is given in Appendix H, together with other supporting information.

a 5.3.2

SUMMARY

OF PROTECTION MEASURES AGAINST INTERNAL FLOODING AT LGS This section briefly describes the protection measures used at the LGS I. against potential damage caused by internal flooding and is based on the f -

FSAR together with discussions with Philadelphia Electric Company and Bech-l tel Power Corporation staff.

I 5-4

i "s l First, many of the floors, walls, and ceilings and their associated penetration seals are designed to water- and steam-tight standards. As a result, the damage caused by a flood is confined to the particular plant area. Probably the most significant examples of this are the ECCS compart-mants, located in the reactor enclosure, all of which are designed to be watertight.

Second, flooding alarms are provided in those areas where flooding is perceived to be more likely to occur or water is likely to collect, such as the reactor-enclosure sump. Flooding alarms are provided with annunciation in the control room.

Floor and equipment drains are also provided to prevent the accumula-tion of water in the event of leakage from pipes or equipment or as a result of the fire-suppression system being actuated.

The detailed protection measures have been taken into account in the analysis as necessary, and the significant points are discussed in the fol-lowing sections.

5.3.3 METHOD OF ANALYSIS POR EVALUATION OF FLOOD-INDUCED ACCIDENT SEQUENCES 5.3.3.1 General Method of Analysis Conceptually, the contribution to plant risk from internal flooding could be estimated by determining failure probabilities attributabic to in-ternal floods for each key component in the plant. The key components could be identified from event and fault trees already developed for the LGS.

Then, accident sequences could be estimated with flood-caused initia ting-event frequencies and failure probabilities in the same manner that accident sequences were estimated in the LGS PRA (Philadelphia Electric Company, 1981). There are, however, two major factors which make this approach impractical to implement. First, due to a lack of relevant data, there are large uncertainties associsted with the frequencies and impact of individual flood sources, and thus the assessed flood-induced component failure rates would have li t tle meaning. Second, such an approach could not readily take into account the potential for common cause or multiple component failure s ,

, which is the major concern of internal flooding from a risk perspective.

Therefore, for practical reasons it became necessary to develop a more useful method. The method designed and applied here is based on a desire to initially determine whether internal flooding can be a significant contribu-tor to plant risk, rather than an attempt to place an absolute value on the risk and to identify which, if any, of the plant areas are potentially crit-ical with respect to flooding.

l The analysis was conducted in stages or levels, each one successively l more refined than the previous. At the conclusion of each analysis level,

-, some plant areas were dismissed as being nonsignificant, while other areas

} required the next level of analysis.

/

5-5

I l

At the first level of analysis, the plant was divided into broad areas that can be identified as being physically independent with respect to internal flooding. Flood frequencies were determined for each area from generic LWR data. The general manner in which flood independence was estab-lished and the derivation of associated flood frequencies are discussed in Sections 5.3.3.2 and 5.3.3.3, respectively. The worst-case effect of a flood was determined by assuming that all components in an independent area fail and then assessing the resulting accident-initiating event and damage to accident-mitigating systems. Event trees and fault trees constructed for the LGS PRA (Philadelphia Electric Company, 1981) were then modified and a requantified in order to evaluate the effects of flooding in each flood area in terms of resulting core-melt sequence frequencies.

Evaluating the risk significance of a flood in a particular area and the decision on whether to proceed to a more refined analysis or dismiss the i area were done by comparing the worst-case flooding effect to a screening criterion that is based on the potential contribution to a particular accident-class frequency. This screening criterion is discussed in Section 5.3.3.4 At the second level of analysis, a more detailed examination of each j broad flood location identified as potentially significant in the first-level analysis was performed to enable the subdivision of that broad loca-tion itself into physically independent flood areas. In doing so, it was generally possible to demonstrate that the extent of equipment damage is

[~'

much less severe for any given flood than was assumed in the first-level analysis. The worst-case effects of flooding were again evaluated for each new independent flood area in exactly the same manner as before. Those plant areas which still remain potentially significant, according to the screening criterion, were considered in more detail by a third-level analysis.

At the third level of analysis, it was not possible to redefine flood boundaries, since the smallest, physically independent areas had been con-sidered at the second level. In order to be less conservative, the assump-tions regarding " worst-case flooding effects" were refined and, if neces-sary, the probabilities and associated impact of various intermediate stages leading up to those worst-case effects were determined. This was achieved by examining the location and size of potential flooding sources, the in-stalled drainage systems, the location of equipment susceptible to flood damage, and the potential for operators to terminate the flood before sig-nificant damage occurs. The results 'of the third-level analysis are final contributions to core-melt accident-class frequencies; tha t is, no further refinement of analysis was considered practicable.

Finally, the various flood-induced core-melt sequence frequencies from each independent flood area were summud to obtain the overall contribution from flooding to each accident-class frequency.

a 5-6 l

l O 5.3.3.2 Independence of Plant Areas with Respect to Flooding Each level of analysis defines various areas of the plant as independ-ent with respect to internal flooding. An area may be termed independent if flooding outside the area could not intrude into the area and fail compo-nents within the area; conversely, flooding in an independent area will not be the direct cause of failures outside the area. The concept is useful because it allows the analyst to define the extent of common-cause failure attributed to a particular flood and assign probabilities to the flood.

The physical characteristics of the plant were considered in determin-ing the independence of an area. At the first level of analysis, a plant may be considered as consisting of a few la rge , independent areas, such as the reactor enclosure, turbine enclosure, and diesel-generator enclosure.

These areas can be easily identified as independent with respect to internal flooding because they represent distinct structures with only a few inter-face points. These interfaces are at entranceways between buildings or possibly with some shared drainage lines. A review of the plant design reveals such design factors as watertight doors, check valves in common drainage lines, or floor-elevation differences between buildings which effectively inhibit any significant flood of water from one building to the other. Thus, in a first-level analysis where the turbine building has been established as independent , it is not realistic to postulate tha t turbine-enclosure flooding will directly fail components in the reactor enclosure.

('

Of course, the effect of the failure of support systems in the turbine enclosure must still be considered. Other factors that may contribute to the independence of an area are physical separation, the presence of weir walls, and flood-detection capability that would allow mitigation before another area is affected.

At the more refined levels of analysis, the areas of independence were defined as smaller areas within a larger independent area. It is often use-ful to define these areas, if possible, in terms of components of mitigating systems. For example, it might be useful to investigate the independence of the emergency core-cooling system (ECCS) rooms within a reactor enclosure.

Factors affecting independence of smaller areas include the use of water-tight (or steam- and airtight) doors, drains within a room, and flood detec-tion and mitigation features. Independence may also be established under certain circumstances with simple doors; for example, a door in a stairwell will funnel vi';tually all water flowing down the stairwell to a lower eleva-tion. Thus, the elevation to which the door provides access will not be susceptible to significant amounts of water inflow from a higher elevation even if the stairwell door is not watertight.

5.3.3.3 Evaluation of Flood Frequencies In Section 5.3.3.1, the internal-flooding analysis methodology was de-scribed; the steps or levels of the methodology divide a plant into in-dependent areas with respect to internal floods. Major independent areas may be further subdivided if the analysis indicates a risk potential in that

\-- area. The flood-frequency data can be developed to correspond to the levels of analyses used in this methodology.

l l

5-7

j'"

-# At the first level of analysis, the plant is divided into only a few large areas. As stated in Section 5.3.3.2, for purposes of analysis, these areas are most useful if they correspond to major plant structures. This type of division is also convenient for data-gathering purposes. Major plant structures, such as the turbine building, tend to house similar equip-ment for major reactor designs (e.g., boiling-water reactors (BWRs) and pressurized-water reactors (PWRs)). Thus, generic industry data would be expected to be applicable to predicting flood frequencies in a major struc-ture of a particular plant. These data are available in Nuclear Plant Expe-rience (Ve rna , 1982), which provides a compendium of industry experience.

Industry experience with internal flooding, as described in Nuclear Plant Experience, is summarized in Appendix H. In some cases, such as turbine flooding, experience for all LWRs may be applicable to a particular design.

Using data from other reactor designs has the advantage of increasing the data base and identifying a broader variety of potential failure modes.

Hewever, care must be used when applying generic data to a particular de-sign; for example data on containment-building floods in a PWR is not likely to be applicable to a BWR containment because of the significant differences in equipment in each structure.

The second level of analysis may be based on a division of the major area according to rooms, floors, or whatever is convenient for the analy-sis. Generic industry data are also available in Nuclear Plant Experience (Va rna , 1982) for internal flooding as a function of room. At this level of analysis, however, some consideration of the design of the specific plant

[~'}

\m,/

under analysis should be made. Although the equipment in a given room, for example, a high-pressure coolant-injection room, may be similar throughout the industry, mitigating factors within the room may be specific to the plant. Such factors include flood alarms or watertight doors that prevent flooding from spreading to another room. Some plants may locate low-pressure core-spray pumps and residual-heat-removal pumps in the same room, thus having a different vulnerability to a flood than plants where these pumps are in separate rooms. Therefore, plant-specific design has to be taken into account when the analysis proceeds to this level.

In summary, data needs and availability correspond well with the ana-lytical techniques used in this methodology. The top-level analysis uses generic data for which a significant data base exists. Data needs become more plant specific, and failure probabilities due to internal flooding must be determined more by analysis rather than experience as the more refined levels of the methodology are used. However, the number of components that need to be considered are reduced by each level of analysis, which has the effect of focusing the more detailed analyses on the more important compo-nents with respect to internal-flooding risk.

5.3.3.4 Screening Criteria l

To determine whether an additional level of analysis is required, the significance of the flooding potential is judged by comparison to a quanti- i f\

d tative screening criterion. That is, if the flooding risk contribution dis-cernible by a given level of analysis is greater than the value of the l

I 5-8

i O screening criterion, then more detailed analysis of that flood will be con-ducted. If the potential flooding contribution to risk becomes less than the value of the screening criterion at any level of analysis, then no fur-ther analysis of that flood is considered.

The screening criterion uced in this study is based on the recommenda-tion in the PRA Procedures Guide (USNRC, 1983), which states that an event with a mean frequency of occurrence of less than one-tenth of that for other events may be excluded as important to risk. (It is further stated that the uncertainties in the frequency of the excluded event are judged to not sig-nificantly influence the risk. ) This recommendation was applied for the LGS internal-flooding analysis by comparing flooding contributions to the frequencies of the accident classes defined for the internal-events analy-sis. That is, if the internal-flooding contribution to the frequency of any accident class was less than 10 percent of the contribution from random failures, then no further analysis was necessary.

Obviously, this screening criterion relates to the final result of an analysis; compliance with the criterion cannot be determined until all po-tential flooding contributions have been evaluated. In the LGS analysis, particular floods are considered, for example, a turbine-enclosure flood, and it would be useful to know as early as possible when the analysis of a particular flood should be terminated because it will not be risk-

! significant. This is done by setting a criterion on the analysis of a particular flood which is more limiting than what must be met for the total

, O internal-flooding probability. For efficiency in the analysis, the crite-rion should not be so low that extensive and unnecessary analysis is re-quired: conversely, this criterion should be low enough that the analysis of a particular flood is not likely to be terminated prematurely. In the LGS analysis, which considers flooding in five major areas, the limiting crite-

! rion for any particular flood was set at 5 percent of the accident class as-

, sociated with the potential accident sequence (s) . The results of any analy-

! sis of a particular flood that is terminated on the basis of the 5-percent criterion were noted. Thus, when all potential floods had been considered, the results were summed to determine whether the 10-percent criterion is met. If it is not, any analysis that was terminated on the 5-percent crite-rion was refined if possible.

5.3.3.5 General Assumptions Made Throughout Analysis A number of assumptions were made in the internal-flooding analysis.

In some cases they may be obvious, but are stated here for completeness.

Most of the assumptions relate to failure modes due to-flooding, which are l not considered because they are presumed to have negligible probabilities.

1. Submergence or dripping or spraying of water onto insulated wiring was not considered to be a credible failure mechanism. However, the potential for grounding or shorting at junction (J) boxes is

, accounted for, l

l 5-9 l

l

[ ) 1

-# 2. Flooding through walls or the collapse of walls was not considered.

Although there have been instances in which some leaking has oc-curred through seams in walls, the leak rates are minor and may be accommodated by installed drainage systems.

3. Piping; conduit; and heating, ventilation, and air-conditioning (HVAC) duct runs or their associated penetrations have been shown not to significantly compromise the integrity of otherwise inde-pendent flood areas. This is discussed further in the analysis, where applicable.

5.3.4 ANALYSIS OF FLOOD-INDUCED ACCIDENT SEQUENCES  !

5.3.4.1 Introduction In Section 5.3.1, internal-flooding " risk" was defined, a method for analyzing that risk was outlined, and the data needs and sources to quantify the risk were specified. This section presents the analysis of internal-flooding risk for the LGS. A plan view is shown in Figure 5-1.

This section is composed of five subsections, each of which presents an analysis of internal-flooding effects in an area of the LGS which may be considered independent of other areas. The five, as a conglomerate, include all components of the LGS and, thus, an analysis of them all represents a Os comprehensive assessment of the LGS internal-flooding risk. These areas are the turbine enclosure, diesel-generator enclosure, reactor enclosure, con-trol enclosure and spray-pond pump structure. Each of the five subsections is further divided to indicate the justification for the conclusion that a given area could be termed " independent" and to provide results of the var-ious levels of analysis. As described in Section 5.3.3, the first level of analysis consists of a worst-case consideration of flood effects on each of the major independent areas; more refined analyses are conducted only if a ,

significant risk potential exists, as reflected by comparison to the screen-ing criterion.

5.3.4.2 Analysis of Turbine Enclosure I

The turbine enclosure at the LGS is used primarily to house components of the power-conversion system. These components include reactor feed pumps, condensate and condensate booster pumps, feedwater heaters, the tur-bine, condenser circulating-water components and some instrument racks ,

motor control centers, and load centers. The turbine enclosure surrounds the control structure, but is a separate building with a 4-inch gap (for seismic design considerations) separating it from the control enclosure.

Appendix H summarizes water sources in the turbine enclosure.

' b\

U 5-10

O V 5.3.4.2.1 Independence To implement the first level of analysis in this methodology, it is necessary to identify major areas of the plant which are independent of each other in terms of internal flooding. As discussed in Section 5.3.3.1, this implies that a flood in an independent area will be contained in that area and, because of physical considerations, cannot reasonably be expected to fail components outside of the independent area. As described below, a re-view of the LGS design revealed that the turbine enclosure can be considered as such an area.

Major plant etructures with which the turbine enclosure interfaces are the reactor enclosure, the control enclosure, and the radwaste enclosure.

In terms of internal-flooding potential, these interfaces are the entrance-ways between structures. Entranceways between the turbine enclosure and other buildings are as follows:

1. Between the control enclosure and turbine enclosure at common ele-vations of 200, 217, 239, and 269 feet and at the control-enclosure elevation of 304 feet to the turbine-enclosure elevation of 302 fee t.

2 Between the reactor enclosure and turbine enclosure at the common elevation of 217 feet and at the reactor-enclosure elevations of 253 or 283 feet to the turbine-enclosure elevation of 269 feet.

O'/ 3. Between the turbine enclosure and radwaste enclosure at the common elevation of 217 feet and at the radwaste-enclosure elevation of 191 feet to the turbine-enclosure elevation of 200 feet.

All of the entranceways between the turbine enclosure and control en-closure are designed to be steam-tight to various pressures and are normally closed during operation. The entranceway between the turbine enclosure and reactor enclosure at the turbine-enclosure elevation of 269 feet is normally closed and designed to be airtight to a reactor enclosure pressure of 2.8 psi. Thus, it is reasonable to assume that the turbine enclosure is inde-pendent of the control and reactor enclosures in terms of internal flooding.

l There is no safety-related equipment in the radwaste enclosure; how-

, ever, independence of the turbine and radwaste enclosures is of interest in l determining whether radwaste flooding could contribute to the likelihood of I

flooding in the turbine enclosure. One entranceway between the turbine en- '

closure and radwaste enclosure is 9 feet higher on the turbine-enclosure side (elevatien of 200 feet versus elevation of 191 feet), making flooding from the radwaste enclosure very unlikely. At an elevation of 217 fee t ,

there is a fire door separating the radwaste and turbine enclosures. Al-though this door is not watertight, it will minimize the rate of flow of water from the radwaste enclosure into the turbine enclosure and limit pos-l sible component failures due to submergence. These factors and the fact that there are no large sources of water at the elevation of 217 feet in the radwaste building indicate that there will be a long time available for the

( detection and mitigation of any flooding of the turbine enclosure from the radwaste enclosure. Therefore, it is reasonable to assume that the turbine and radwaste enclosures are independent.

5-11

1 l

O 5.3.4.2.2 First-Level Analysis of Turbine-Enclosure Flooding As a first level of analysis of the turbine enclosure, it will be as-sumed that the most severe plant transient that could occur from the failure of components in the turbine enclosure occurs for all floods. This approach will provide an upper bound on the core-melt frequency of turbine-enclosure flooding because, in fact, only a fraction of floods yield such a severe effect.

Of the LGS transients identified in the LGS PRA (Philadelphia Electric Company, 1981), the most severe that could occur due to flooding of the tur-bine enclosure would be a loss of feedwater, or Tp, transient. From Appen-dix H, industry experience for internal flooding in the turbine building is 0.016 per reactor-year. Thus, the internal-flooding core-melt contribution can be bounded by using this flooding frequency to represent the frequency of turbine-enclosure floods that cause a Tp transient. The Tp transient tree is shown as Figure 5-2. The tree has been modified in the following manner:

1. The initiating-event frequency is changed to reflect the internal flood frequency of 0.016 per reactor-year.

2. The probability of failing to recover feedwater within 30 minutes for initial inventory makeup event Q is set to 1.0 instead of .2.

f 3. An examination of the data reveals that only 3 out of 10 floods that occurred within turbine enclosures were severe enough to cause significant damage to the power-conversion system. Therefore, the probability of failing to recover the pcwer-conversion system for long-term heat removal within 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> is taken to be .3 as opposed to a value of 4.2 x 10-2 used in the internal-events study. The resulting effect is an increase in the failure probability of event W from 4.2 x 10~7 to 3.0 x 10-6 This, of course, is only appli-cable to sequences where successful closure of all safety-relief valves (SRVs) is achieved. In the event of failing to close the S RV s , the unavailability of the power-conversion system is always 1.0.

The flood-induced accident-sequence frequencies are given in Table 5-1 along with their contribution to accident-class frequencies.

l From Table 5-1, the contribution to the core melt due to internal j flooding in the turbine enclosure can be no greater than 5 percent of the l probability attributed to " internal events." (In all but one case the con-tribution is less than 1 percen t. ) Thus, we can conclude at this level of analysis that internal flooding of the turbine enclosure is not risk-significant and no further analysis is necessary.

5.3.4.3 Diesel-Generator Enclosure The diesel-generator enclosure at the LGS is a single-story structure that houses the four diesel generators and their supporting components.

5-12

I I

l a

These components include lube-oil cooling pumps and tanks, diesel and day  !

tanks, diesel jacket cooling pumps and water jackets, a fire protection sys-tem, instrumentation racks, and motor control centers for emergency power operation. In the event of a loss of offsite power, any combination of three out of four functioning diesel-generator divisions can meet minimum loads required to shut down the plant (LGS FSAR, page 8.3-4). Appendix H summarizes water sources in the diesel enclosure.

5.3.4.3.1 Independence from Other Structures The only plant structure with which the diesel-generator enclosure in-terfaces is the reactor enclosure; however, there are no interconnecting accessways. A corridor running the length of the diesel-generator enclosure connects the four separate rooms of the diesel-generator enclosure.

Each of the separate rooms of the diesel-generator enclosure has a door opening to the plant yard. It is possible that water flowing in the yard could enter underneath the door. However, there is a large surface area available for water flowing in the yard; thus , sources of internal flooding would not be large enough to flood the diesel-generator enclosure to any significant depth.

g From these physical considerations, the diesel-generator enclosure can be considered independent of other plant areas in terms of internal

-} flooding.

5.3.4.3.2 First-Level Analysis of Diesel-Enclosure Flooding The only purpose of the diesel generators at the LGS is to supply emer-gency a.c. power in the event of a loss of offsite power. No components re-quired for the normal operation of the plant are within the diesel-generator enclosure. Therefore, if the diesel-generator enclosure were to be flooded, the only transient tha t could result would be a manual-shutdown transient.

, From Appendix H, industry experience for flooding in diesel buildings is 0.008 per reactor-year. The manual-shutdown transient, TM, event tree taken from the LGS PRA (Philadelpraia Electric Company, 1981) is shown in Figure 5-3. The tree has been modified to indicate the internal-flooding initiating-event frequency of 0.008 (versus the Tg frequency from all sources of 3.2 per reactor-year) . No other events on the event tree are changed by the flooding of the diesel-generator enclosure.

l

( Table 5-2 shows that the contribution to the core-melt frequency due to internal flooding in the diesel enclosure is negligible compared with the frequency attributed to internal events. Thus, at this level of enalysis, it can be concluded that internal flooding is not risk-significant, and no further consideration is necessary.

v 5-13

5.3.4.4 Reactor Enclosure The reactor vessel at the LGS is enclosed by a primary containment.

The primary containment consists of a drywell and a wetwell and, except for safety-related equipment, is designed to be isolated from the remainder of the reactor enclosure, which makes up the secondary containment in the event of an accident. Safety-related equipment is located in the secondary con-tainment, which surrounds the primary containment. This equipment includes ECCS components , motor control centers, load centers, and instrumentation.

As shown in Appendix H, there are numerous fluid sources within the reactor enclosure. Figure 5-4 provides a section view of the LGS reactor enclosure.

5.3.4.4.1 Independence The reactor enclosure interfaces with the radwaste enclosure, the tur-bine enclosure, the control enclosure, the diesel-generator enclosure, and an underground pipe tunnel that borders on the south wall of the reactor enclosure. In addition, an entranceway to the reactor enclosure from the plant yard exists at ground level.

As described in Section 5.3.4.2.1, piping and conduit runs between structures do not compromise the independence of a structure in terms of in-ternal flooding. Therefore, the remaining concern is the entranceways be-O tween structures. Entranceways between the reactor enclosure and other structures are as follows:

1. Between the control enclosure and reactor enclosure at the control-enclosure elevation of 180 feet and the reactor-enclosure elevation of 177 fee t.

2. Between the pipe tunnel and reactor enclosure at the pipe-tunnel elevation of 198 feet and the reactor enclosure of 201 feet.

3. Between the radwaste enclosure and the reactor enclosure at the common elevation of 217 feet.

4. Between the turbine enclosure and the reactor enclosure at the com-mon elevation of 217 feet and at turbine-enclosure elevation of 269 feet to either the reactor-enclosure elevation of 253 or 283 feet.

As discussed in Section 5.3.3.1, the turbine building and reactor en-closure are independent with respect to internal flooding. The entranceways between the reactor enclosure and the radwaste enclosure and between the reactor enclosure and the underground pipe tunnel are air locks. The air locks will be normally closed thereby isolating the reactor enclosure from these structures. Therefore, on the basis of physical considerations, the reactor enclosure may be considered independent of other structures with respect to internal flooding.

5-14

i 5.3.4.4.2 First-Level Analysis of Reactor-Enclosure Flocding A first-level analysis of the reactor enclosure would assume that the most severe plant transient that could be associated with the failure of components in the reactor enclosure occurs for all reactor-enclosure floods.

In this case, the assumption would lead to the postulated flooding of compo-nents associated with all ECCS and long-term heat-removal systems at a fre-i quency derived for all flooding in the reactor enclosure. Since the overall frequency of flooding in the reactor enclosure is 0.039 per year (see Appen-dix H), this indicates that a more detailed analysis is required.

5.3.4.4.3 Second-Level Analysis of Reactor-Enclosure Flooding Introduction At the second, more detailed level of analysis, it is the aim to iden-tify flood-independent areas within the reactor enclosure and subsequently examine the frequency and the potential worst-case equipment damage associ-ated with floods in each of those areas. In this way, it is possible to identify which, if any, of these individual areas are particularly critical with respect to flooding.

Independence of flood areas within the reactor enclosure Taking into consideration the assumptions discussed in Section 5.3.3.5, no flood pathways between major floors within the reactor enclosure, namely elevations 352, 331, 313, 283, 253, 217, 200, and 177, can be identified with the following exceptions:

1. Equipment and floor drains from all elevations within the reactor enclosure empty into sumps located in the reactor-enclosure sump room at the 177-foot elevation. Although sump pumps are provided to transfer water to the radwaste system, their combined capacity is only 300 gpm, which may be insufficient to prevent the accumula-tion of water from a large flood source.

All safety-related components at the 177-foot elevation are in-stalled within watertight ECCS compartments and their only con-nection with the sump room is via the floor drain system. Check valves are to be provided in these drain lines in order to prevent backflooding from the sump into ECCS ccmpartments. However, since the exact design has yet to be finalized, it is not possible to assess the reliability of these valves for preventing back flood-ing. It is to be expected that the design would be such that sig-nificant backflow into more than one ECCS room could not occur without multiple component failures. Assuming this is to be the case, then the risk from back flooding is judged to be insignifi-l cant. The volume of the samp room is approximately 37,000 cubic feet. It would therefore take a considerable period of time for this area to be filled and for water to begin accumulating on the

( ))

sm 201-foot elevation above. Since flooding in the sump room would be annunciated in the control room by a high-level sump alarm and no 5-15

O large-capacity, nonisolable flood sources were identified in the reactor enclosure, the likelihood of the flood level rising to the 201-foot elevaticn is judged to be negligible.

2. Three stairwells and one elevator shaf t located in the corners of the reactor enclosure give access to each elevation via normally closed doors. These doors are not designed to be watertight but would provide considerable restriction in the pathway of any flood-ing particularly if there is no appreciable build up of water be-hind the doors. It is reasonable to assume that if flood water were to enter the stairwells from any elevation within the reactor

enclosure it would be funneled down to the lowest elevation (177 feet) and would not affect components on intermediate levels.

As discussed above, safety-related components at the 177-foot ele-vation would not be damaged by any resulting accumulation of water.

Furthermore, the potential for damage at higher elevations as a result of water backing up the stairwell and elevator shaft is con-sidered negligible for the following reasons: first, the leakage rate into the stairwell and/or elevator shaft from the flood eleva-tion is likely to be anall, and it should be matched by the outward leakage into rooms at the 177-foot elevation; and, second, if the water level were to back up, the leakage through the fire doors that give access to higher elevations would be minor and could be handled by the installed floor drains, thus preventing any f-w aecumulation.

3. Equipment hatches located in the southeast corner of the reactor enclosure at elevations 253, 283, and 281 feet are provided with reinforced concrete plugs which are not sealed. In the event of flooding at one of these floor elevations, dripping onto the floor below may well occur. However, no safety-related equipment is located beneath or close to the periphery of these hatches with the exception of load center 10B204 and MCC 10B214, which are located 8 and 19 feet away, respectively, at the 283-foot elevation. It is highly unlikely that this equipmer.t would be damaged by water drip-ping from above, since the cabinet tops are provided with a raised lip and a silicon-foam fire seals where cable conduits enter.

4. Conduit, piping and HVAC duct penetrations are provided with water-tight seals where such penetrations are located within designated watertight or steamtight boundaries, e.g., ECCS rooms. However, much of the floor area within the reactor enclosure is not designed to be watertight and penetrations in such areas thus present poten-tial flood pathways. As discussed above, from fire protection considerations such penetrations are provided with fire retardant seals as are all conduit or penetrations within motor control cen-ters. Although fire penetration seals are not designed to be watertight, leakage will be limited to minor cracks within the seals and any resulting water drip onto motor control centers will be prevented from entering by, firstly, a raised lip on all top MCC f'"x

( penetrations and, secondly, by the fire seals.

-16

l l

l

5. The RHR pump rooms, located at elevation 177 feet, associated heat exchanger and component rooms, which are located directly above, are not independent.

i It is, there fore , concluded that the flood drains, the stairwells, the hatchways and the floor penetrations do not represent a significant compro-mise of the reactor enclosure floor area integrity with respect to flooding and the only interfloor dependence is associated with the RHR pumps and their associated heat exchanger areas.

In addition to the major floor elevations being independent (with the

! exception discussed above) individual rooms located on certain elevations are also designed to be watertight. Accessways to such areas are fitted with watertight or steamtight doors and hatchways. These particular rooms are as follows:

Elevation 177 feet - the ECCS pump rooms (Areas 102, 103, 108, 109, 110, 113, 114, and 117)

Elevation 201 feet - the RHR component rooms (Areas 203, 240) (Note -

These rooms are not independent of their associated pump rooms, 102 and 103, as discussed earlier. )

Elevation 217 feet - the safeguard system isolation valve area (Area 309)

Elevation 253 feet - the main steam tunnel (Area 407)

Elevation 283 feet - the main steam and feedwater pipe chase (Area 518)

Taking all considerations discussed above into account, sixteen inde-pendent flood areas within the reactor enclosure were defined (as RB-FL1 to RB-FL16) and are identified in Table 5-3.

Flood frequencies within the reactor enclosure flood areas The frequency of flooding in each independent area within the reactor enclosure is evaluated in Appendix H on the basis of flooding experience in similar locations of existing U.S. boiling water reactors. Due to the lack of similarity between BWRs and FWRs in this case, PWR experience was not considered to be relevant. The location categories or types chosen to eval-uate the flooding experience within reactor enclosures are as follows:

1

1. Low pressure ECCS rooms (RHR and core spray) l l 2. High pressure ECCS rooms (HPCI and RCIC)

3. General equipment areas (all other plant areas in the reactor enclosure) t This choice was influenced by the fact that the vast majority of floods have occurred within ECCS rooms. Having evaluated a frequency of flooding in each location category this frequency was initially assigned to appropri-ate independent flood locations identified for Limerick reactor enclosure.

5-17

This is a conservative approach, particularly in the case of the general equipment areas, since the existence of several independent flood areas of a single category means that flood frequencies are counted several times over. However, since the stated intention of the analysis is to dismiss as many flood locations as possible as being insignificant contributors to core i melt and risk, this conservatism is initially permissible.

Flood-induced initiating events A review of the potential causes of the five transients modeled in the LGS PRA (PECo, 1981) indicates tha t three of these could be induced by reac-tor enclosure flooding: MSIV closure (Tp), turbine trip (TT), and manual shutdown (Tg). Flood-induced loss of offsite power (TE) and inadvertent open-relief-valve (Ty) transients were ruled out, as discussed below.

i Flooding within the reactor enclosure will not simulate the common-cause failures associated with loss of offaite power (TE) since the plant power distribution centers (i.e. , the 13 kV auxiliary buses and the 4 kV safeguard buses) and their associated power sources are located within the

! control structure and switchyard.

The inadvertent opening of the safety-relief valves (identified as l Ty) due to flooding within the reactor enclosure was also not found to be a credible initiating event, for the following reasons:

1. The safety-relief valves and the associated solenoid valves are located within the primary containment. Equipment within the con-tainment is designed to withstand severe environmental conditiors and therefore is unlikely to be damaged in any way by a flood.

Furthermore, there is no mechanism for a flood, within the contain-ment, to energize the pilot solenoid valves and thereby cause the

, relief valves to open.

)

l 2. With the exception of the ADS valves, the safety-relief valves are i individually controlled. Their associated controls and d.c. power l supplies are located within the control structure and therefore not susceptible to damage from flooding within the reactor enclosure.

3. The ADS-initiation circuits, including sensors and transmitters, are located within the reactor enclosure, although the initiation-l logic components are located within the auxiliary-equipment room, which is in the control structure. In order to generate an l ADS-initiation signal, either RPV level 1 or high-drywell-I pressure signals are required from two independent channels. In addition, both " low pressure injection system running" and RPV level 3 permissive signals are required. All level and pressure instrumentation is located within the CRD hydraulic-equipment area (RB-FL13), whereas instrumentation associated with the low-pressure-injection system permissive signal is located in the ECCS rooms. The level instrumentation is hermetically sealed and is not susceptible to flood damage. Thus, although a flood within the CRD j hydraulic-equipment area may generate sufficient high drywell pres-l sure signals for ADS initiation, it would be incapable of generat-ing either of the required permissive signals.

5-18

[

(%

4. The instrument-gas supply, which provides motive power tc all the safety-relief valves, is located within the reactor enclosure; how-ever, the loss of instrument gas does not cause the valves to open.

The potential flood-induced transients Tp, TT, and Tg were examined and allocated to flood areas in order of transient severity; thus, if more than one transient may be induced by a flood, the most severe was assumed to occur.

In order to cause MSIV closure, a flood must do at least one of the following:

1. Damage the MSIVs themselves.

2. Induce spurious instrument signals associated with at least two independent channels.

3. Physically damage the reactor-vessel-isolation logic components.

4. Disable power supplies from one RPS bus and one d.c. power division that normally energize the MSIV pilot solenoid valves.

5. Disable both a.c. power supplies to the reactor-vessel-isolation instrumentation, which is derived from RVS buses A and B.

Since the reactor-vessel isolation-logic equipment and its associated a.c.

and d.c. power supplies are located within the control structure, they are not susceptible to damage caused by flooding within the reactor enclosure, thus generally ruling out failure modes 3, 4, and 5. However, the MSIVs and instrumentation associated with the isolation-control system are located in the reactor enclosure. The steam tunnel (RB-FL14) Et the 253-foot elevation contains the outboard MSIVs together with steam-line radiation and area temperature-monitoring instrumentation. The CRD hydraulic-equipment area (RB-FL13) contains reactor-vessel-water-level-monitoring instrumentation.

In the steam tunnel a steam leak would certainly cause MSIV closure by acti-vating the temperature-monitoring sensors and, although less likely, a water spray may have the same effect by damaging MSIV electrical components. An MSIV closure transient (Tp) was therefore assigned for a flood in this area. In the CRD hydraulic-equipment area, the reactor-vessel-water-level

instrumentation is not susceptible to flood damage, as discussed above, and i

MSIV closure is not considered to be a credible event.

The second most severe transient type that may be induced by flood in the reactor enclosure is a turbine trip (TT). This may occur as a result of damage to equipment serving the reactor-recirculation system, which is j located in the safeguard access area (RB-FL12) at the 217-foot elevation, or l damage to reactor-vessel pressure, drywell pressure, or neutron-monitoring l instrumentation in CRD hydraulic-equipment area RB-FL13. A turbine-trip I

transient was therefore assumed for a flood in these two areas.

O

U 5-19

Because of the absence of any automatically initiated transients re-sulting from flooding in other reactor-enclosure areas, it was assumed for the purpose of the second-level analysis that the least severe manual-i shutdown transient occurred.

Impact of flooding on accident mitigating systems I

, A review of the Ty, TT, and TM event tree reveals that systems re-i quired to mitigate these transients are the condensate and feedwater system, HPCI, RCIC, ADS, LPCS, LPCI, RHR, and RHR service water. Thus, to quantify i

the internal flooding risk, it is necessary to investigate the location of components associated with these systems including pumps and valves and their associated motor control and load centers. Sensors required for auto-matic actuation of these systems must also be considered.

i It is assumed that given a flood within a particular flood area all components located within that area fail. On this basis the unavailability of an accident mitigating system was evaluated using system level fault trees developed for the LGS PRA but assigning a failure probability of 1.0 to the components assumed to be damaged by the flood. Thus, for example, in the case of a flood in the RHR pump room, two of the four LPCI injection loops are assumed to be failed and the unavailability of LPCI is increased from 1.8(-3) per demand to 2.2(-3) per demand. In the event of MSIV closure (Tp) the unavailability of the feedwater system for initial inventory makeup (event Q) is assumed to be 1.0. As in the case of the fire analyses, some credit is taken for the recovery of damage sustainel by components re-quired for long-term heat removal (i.e. , power conversion system, RHR sys-tem, RHR service water system, and emergency service water system). Since long-term heat removal is not required for 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> following the transient, it is assumed that the necessary valves could be operated manually (using hand wheels or temporary power supplies) and would not, there fore , be de-l pendent on normal power supplies from motor control centers which may have suffered damage. Under such circumstances the ' probability of the operator failing to perform these recovery actions was assumed to be 10 times greater than that assigned in the internal events analysis to the manual actuation of the RHR system. For cases where damage to pumps or their power supplies may be sustained, no credit for recovery was taken.

Quantification of accident sequences resulting from flooding the reactor encionure I

The possible core-melt sequences resulting from the assigned transient events were reevaluated for each independent flood area, taking into account the flood frequency and the availability of accident mitigating system given the " worst case" damage which might potentially be caused by the flood. The dominant sequence frequencies for each independent flood area are given in Table 5-4 together with their associated contributions to the internal events accident class frequency.

f i The effect of a flood on the reactor-protection system would be to l cause its electrical components to de-energize, leading toward reactor trip.

It is therefore considered that internal flooding is not a significant contributor to ATWS events and does not therefore contribute to accident classes III and IV.

5-20 1

\

In the case of all reactor enclosure flood areas, with the exception of three, flood-induced accident sequences are shown to contribute considerably less than 5 percent to their associated accident classes and, there f ore ,

under the previously established screening criteria (see Section 5.3.2.3) floods in these areas are dismissed as being insignificant contributors to core melt risk. The safeguard-access area (RB-FL11, elevation 217 feet),

the steam tunnel (RB-FL14 , elevation 253 fe e t ) , and the general-equipment area (RB-FL15, elevation 283 feet) cannot be dismissed using the second-level-analysis method and must therefore be considered in a more detailed third-level analysis.

The total frequency of flood-induced class I and class II sequences, excluding RB-FL11, RB-FL14, and RB-FLI S , is 0.4 and 1 percent, respectively, of the LGS PRA accident-class frequencies.

5.3.4.4.4 Third-Level Analysis of Reactor-Enclosure Flood Area RB-FL15 (Elevation 283 Feet)

Description of flood area This flood area comprises the entire cross-section of the reactor enclosure at elevation 283 feet, with the exception of the containment.

Reactor water cleanup and fuel pool heat exchangers are located in several O compartments encompassed by the flood area, as are isolation valves associ-ated with high pressure and low pressure ECCS systems. Two safety-related motor control centers are located within the general equipment area (500) and corridor (506) but are well separated, such that spray damage to more than one of these from any given flood source can be ruled out as a serious consideration.

Water drainage pathways from the area would be via the floor drains, together with any leakage through the stairway- and elevator-access fire doors and the hoistway plugs.

Analysis of each flooding source located within flood area Service water An 12-inch service-water main supplies water to fuel pool service water booster pumps which are located in the general equipment area in the north-east corner of the flood area. These pumps then supply the three fuel pool heat exchangers which are located in a separate room (area 511), via a sec-ond section of 12-inch pipe. A third 12-inch pipe returns water from the heat exchangers to the service water system.

Suction and discharge manifolds serving the booster pumps and heat ex-changers comprise 8-inch pipework, isolation valves, flow throttling valves and check valves, g The frequency of a gross rupture occurring in service water system pipework installed within this flood area is evaluated in Table 5-5. The 5-21

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . - - - - - - - - - - - - - _ _ _ _ _ _ _____________________________J

data for valves are based on the Licensee Event Reports (Miller et al. ,

1982) and those for pipework on the Reactor Safety Study (USNRC, 1975).

Frequency of valve rupture = 1 x 10-8/hr (point estimate)

Frequency of pipe rupture (>6-inch diameter) = 3 x 10-10/hr per section (mean value)

The rupture frequencies evaluated are as follows:

Frequency of 8-inch rupture (valve or pipe) = 1.8 x 10-3 per year Frequency of 12-inch rupture (pipe) = 1.8 x 10-5 per year Given the leakage from an 8-inch break is no greater than 5560 gpm* and the drainage from the floor (via installed draina, doorways, and unsealed equipment hatches) is at least 1500 gpm, the water level in the flood area may rise to 12 inches within 18 minutes and to 36 inches within approxi-mately 54 minutes. At a level of 12 inches, motor control centers 10B213 and 10B214 and load center 10B204 may be disabled causing failure of LPCI (loops A, B and D) and core spray (loops A and B). However, the normal feedwater system, HPCI and RCIC, remains undamaged and the RHR system may be operated manually in the long-term heat remuval mode. The dominant core melt sequences, taking no credit for the operator terminating the flood be-fore it reaches a depth of 12 inches, is:

TM QUV = (1.8 x 10-3)(7 x 10-3)(4,9 x 10-3)(1.0) = 2.1.x 10-8 x,) At a water level of 36 inches, the electrical supplies associated with the HPCI injection isolation valve may be damaged resulting in failure of the HPCI system. However, since this will not occur until 54 minutes af ter the break occurs, it is considered likely that the operator will terminate the flood prior to this level being achieved. A high-water level in the reactor-enclosure floor-drain sump (177-foot elevation) will be annunciated in the control room shortly af ter the break occurs. At present there are no procedures for responding to tnis alarm. However, it is judged that opera-tors, having become aware of this situation, will quickly investigate rele-vant plant areas to determine the flood source and isolate it. A proba-bility of the failure of operators to perform this task is conservatively assigned as 10"I, resulting in the following d;minant core-melt sequence:

TgQUV = (1.8 x 10-3)(7 x 10-3)(o,o7 x 10-1)(1.0) = 8.8 x 10-8 The contribution to core melt frequency and risk from a 12-inch service water pipe break can be dismissed as insignificant without taking credit for l the operator isolating the break. Given an event frequency of 1.8(-5) per year, the dominant accident sequence, TM QUV, has a frequency of 9.9(-9) per year assuming all components within the flood area are failed.

O

• Calculated assuming a guillotine pipe break.

5-22

n L' Fuel pool cooling and cleanup system The total volume of this system is 8000 gallons. As discussed above, spraying can be ruled out as a mechanism for significant damage in this area, the capacity of the system prevents it from being a significant risk contributor.

Reactor water cleanup system This system is connected directly to the reactor coolant system and is thus provided with an automatic redundant isolation system which is actuated in the event of high system flow rates or high area temperatures. This sys-tem doee not, there fore , present a flooding risk.

Fire-suppression system The maximum size of the fire water main in this flood area is 6 inches.

Given the maximum flow rate from a break is limited to 3000 gpm, the time required for the water level to rise and cause significant damage is consid-erably greater than estimated in the analysis of the service water system.

Given results of the service water system analysis discussed above and the increased time available to isolate the break, flooding from the fire sup-pression system does not present any significant contribution to risk.

Emergency core cooling systems Injection pipework and isolation valves associated with core spray, LPCI and HPCI systems are located within this flood area, although within separate compartments. These systems are not normally active but leakage during test must be considered. Assuming the systems are each tested once per month for a' period of I hour each, the frequency of flooding can be es-timated from Total no. of No. of pipe Hourly No. of valves Hourly hours per year x sections per x failure + per system x failure all systems system rate rate operate - -

(7 x 12) 5(3 x 10-10 ) + (1 x 10-8) = 9.7 x 10-7 per year Even in the event of all equipment within the flood area sustaining damage, the feedwater and RCIC systems would remain operable to mitigate the accident. The dominant sequence in this case is TgQUV with a frequency of 4.7(-10) per year demonstrating that flooding from the ECCS system in this flood area is not a significant contributor to core melt or risk.

l

! 5.3.4.4.5 Third-Level Analysis of Reactor Enclosure Flood Area RB-FL11 I (Elevation 217 Feet) l

~'h The second-level analysis assumed a flood frequency within this area of x_,/ 0.0078 per year and further assumed that all equipment located within the 5-23

.. - = - - _ -

area that is susceptible to flood damage is failed. Both of these assump-  ;

tions are known to be conservative. A more refined analysis of the flood-ing frequency was conducted, since this presented the most efficient route for showing flooding in this area to be a noncontributor. Since redundant equipment is well segregated, spraying and dripping are not considered cred-ible common-cause failure mechanisms. Thus, the only concern is flooding that can lead to a large accumulation of water.

The significant flooding sources in this area are as follows:

1. The fire-suppression system

2. The service-water system

3. Several ECC systems

a. HPCI

b. RCIC

c. Core spray

d. RHR Fire-Suppression System The fire-suppression pipework consists of a 6-inch header serving four manual hose stations and possibly two manually activated dry-pipe-sprinkler systems, (the design of the latter has not yet been finalized). There is no automatic-sprinkler or deluge system.

The frequency of rupture in the fire-suppression-system pipework is evaluated on the following bases:

e Frequency of valve rupture = 1 x 10~8 per hour e Frequency of pipe rupture = 3 x 10-10 per hour per section e Estimated number of pipe sections = 20 j e Estimated number of valves = 5

) Therefore, the frequency of flooding from the fire-suppression system is 8760 20(3 x 10-10) + 5(1 x 10-8) = 4.9 x 10-4 per year Service-Water System Two 12-inch service-water pipes pass from floor to ceiling in the northeast corner of the area. There are no valves in the pipework.

The frequency of service-water-pipe rupture is estimated assuming e Frequency of pipe rupture = 3 x 10-10 per hour per section e Number of pipe sections = 2 Therefore, the frequency of service-water-pipe rupture is 8760 2(3x10-10 = 5.3 x 10-6 s

5-24

f r

( ECC Systems Pipe and valves associated with four LPCI loops, two core-spray loops, the HPCI system, and the RCIC system are routed in this area. These systems are not normally active, but the potential for leakage during testing must be considered. Assuming each system loop is tested once per month for a period of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the annual exposure time per loop is 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

The flood frequency for each is then estimated on the following bases:

e 'requency of pipe rupture = 3 x 10-10 per hour per section e Frequency of valve rupture = 1 x 10-8 per hour There are four LPCI loops, each consisting of two valves and three pipe sec-tions. Therefore, the frequency of flooding from the LPCI system is (4 *12) 3(3x10-10)+2(1 x10-8) = 1.0 x 10-6 por year There are two LPCS loops, each consisting of one valve and two pipe sec-tions. Therefore, the frequency of flooding from the LPCS system is (2 *12) 2(3 x 10-10) + 1(1 x10-8) = 2. 5 x 10-7 per year There is one HPCI and one RCIC loop, each consisting of one pipe section.

Therefore, the frequency of flooding from the HPCI and RCIC systems is (2 12) 1(3x10-10) = 7.2 x 10-9 per year Therefore, the total flood frequency from ECC systems is 1.26 x 10-6 per year.

The overall flood frequency in the safeguard-access area (RB-FL14) from all sources is therefore estimated to be 5.0 x 10-4 per year. Based on this flood frequency, in combination with the resulting equipment damage that was conservatively assessed in the second-level analysis, the contribution from flooding in this area to accident class I is 0.4 percent and a negli-gible contribution to class II. Thus, flooding in this area is not a sig-nificant contributor to core melt and risk.

5.3.4.4.5 Third-Level Analysis of Reactor Enclosure Flood Area RB-FL14

( El e vation: 253 Feet)

As with the flood area (RB-FL11) the second-level flood frequency and assumed equipment damage are known to be conservative. Again the most efficient approach was to refine the assessed flood frequency in order to show that flooding in this area is not a contributor to risk.

Flooding sources in this area are as follows:

O e Four main-steam lines e Two main feedwater lines e The RCIC injection line 5-25

l l

The flood frequency was assessed on the following bases:

e Frequency of pipe rupture = 3 x 10-10 per hear per section e Frequency of valve rupture = 1 x 10-8 per hour The main-steam lines in this area each consist of two pipe sections and one MSIV. The annual frequency of flood from all four steam lines is there-fore estimated to be 8760 4 2 (3 x 10-10) + 1(1 x10-8) 3,7 x 10-4 The feedwater line's' in this area each consist of three pipe sections and two isolation valves. The annual frequency of flood from both feedwater lines l is estimated to be 8760 2 , 3,7 x jo-4 3(3 x 10-10) + 2 {1 x 10-8)

The RCIC system is not normally active; however, failure during testing must be considered. Assuming that the system is tested once per month for a pe-riod of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> gives an annual exposure period of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The RCIC system in this area consists of two pipe sections and one isolation valve. The annual frequency of flooding from the RCIC system is therefore estimated to be 12 2 (3 x 10-10) + 1 (1 x10-8) = 1.3 x 10~7

/

( Thus, summing all flooding source frequencies, the total frequency of flood-ing in this area is realistically estimated to be 7.4 x 10~4 per year.

This is a factor of 10 less than the frequency assumed in the second-level analysis. Since the RCIC system and the main feedwater system are the only systems disabled as a result of the flood (see Table 5-4 ) , the dominant sequence frequencies are o TpQW = 7.4 x 10-9 e TpQUX = 1.0 x 10~7 o TpQUV = 4.0 x 10-9 The contribution to the internal-initiator accident classes I and II are 0.9 t and 0.8 percent, respe ctively, thus indicating that flooding in this area is not a significant contributor to core melt and risk.

l l

5.3.4.5 Control Structure The control structure at the Limerick Generating Station is a seismic category 1 structure which is surrounded on three sides by the turbine en-closure and on the fourth side by the reactor enclosure. Included in the control structure are the control room, cable-spreading room, auxiliary equipment room, battery rooms, safeguard switchgear rooms, and the 13-kV switchgear room. Appendix H sitmmarizes water sources in the control enclo-sure. Figure 5-5 is a section view of the control enclosure.

[V}

5-26

1 I

l

' O

\%- 5.3.4.5.1 Independence of Control Structure As described above, the control structure interfaces with both the turbine enclosure and the reactor enclosure. Since the independence of the control structure and these two enclosures is established in Sections 5.3.4.2.1 and 5.3.4.4.1, no further analysis is necessary in order to con-clude tha t the control structure is completely independent from all other

structures with respect to flooding.

5.3.4.5.2 First- and Second-Level Analyses From a general inspection of the control structure and equipment lo-cated therein, it was apparent that there are several flooding locations where, given a postulated " worst-case flood" (i.e., all susceptible equip-ment within independent flood area is assumed to be damaged) , a very signif-icant amount of the equipment capable of achieving safe pisnt shutdown would be disabled. For example, in the case of a flood in the 13-kV switchgear room, all offsite power supplies would be assumed to fail with little poten-tial for recovery within a useful time period; whereas a flood in the auxil-iary equipment room has the potential to disable all balance-of-plant and ECC systems. Furthermore, although there has been no reported flooding in control structure areas (see Appendix H), a conservative assumption that one flood was about to occur would give a basis for evaluating a flood frequency

[~' from BWR generic experience. This would result in a flood frequency of (s,j 0.004 per year. Therefore, explicit first- and second-level analyses were not performed, since the results would certainly be grossly conservative (and indicative of the need for more detailed analysis) . Instead, the entire control structure was exacined using a third-level analysis.

5.3.4.5.3 Inird-Level Analysis of the Control Structure At the third, most detailed analysis level, the location of safety-related equipment within the control structure was investigated together with the independence of flood areas and the location of potential water ,

sources. Equipment locations and flood pathways were first considered and are discussed in the following sections. The possible risk from each individual water source located within the control structure was examineo.

The water sources are e The radwaste system e The service

• water system o The condensate- and refueling-water system o The chilled-water system o The fire-protection system Location of equipment within the control enclosure Referring to Figure 5-5, the 217-foot floor is the lowest elevation at

, which equipment necessary for the safe shutdown of the reactor is located; that is the 13-kV switchgear area. Equipment below this level is associated 5-27

l l

I with the chilled-water and radwaste systems, which may be lost with no det-rimental effect on plant shutdown capabilities. Above the 13-kV switchgear room there are the safeguard switchgear and battery rooms (elevation of 239 feet), the cable-spreading room and static-inverter rooms (elevation of 254 feet), the control room and instrument labs (elevation of 269 fee t) , and the 1 auxiliary equipment room (elevation of 289 feet), all of which contain com-ponents essential for safe reactor shutdown. Equipment at the 301-foot i elevation and above is associated with control structure HVAC and not con-I sidered essential.

Independence of flood areas within control enclosure As with the reactor enclosure, the major floors of the control struc-ture can be considered independent with respect to flooding. The only flood pathway between floors is the stairwell, located in the northeast corner of the enclosure, which provides access to all elevations except the control l room (elevation of 269 feet) and the safeguard switchgear and battery rooms (elevation of 239 feet). Fire doors are provided at all entrances to the stairwell. The recombiner compartments and condensate backwash compart-ments, which that are located at the base of the stairwell (elevations of 180 and 200 feet), do not contain equipment required for safe plant shut-down. Thus, using arguments discussed in the second-level analysis of the reactor enclosure, it can be concluded that the major floor elevations l within the control enclosure are essentially independent with respect to l flooding. Unlike the reactor enclosure, however, there are no flood areas on any given floor which may be considered independent from each other.

Analysis of flood sources located within control enclosure: radwaste, con-2 densate and refueling-water, and service-water systems Equipment associated with the radwaste system, which includes i

condensate-backwash-receiving tanks and transfer pumps, and the recombiner aftercondensers are located at the 180- and 200-foot elevations. Pipework serving this equipment enters these areas via sealed piped tunnels at the same elevations.

Twenty-inch service-water mains, routed in the pipe tunnels mentioned above, serve the recombiner af tercondenser via 8-inch pipework and the chilled-water system via 4-inch pipework. The chilled-water system equip-ment served by the service-water system is located at the 200-foot elevation.

i l Only a minimal amount of pipework associated with the condensate and refueling-water storage system is located within the control structure and is routed within pipe tunnels located at an elevation of 200 feet.

From the above discussion, we conclude that none of these water sources j are present within the control structure at or above the 217-foot elevation, which is the lowest elevation at which water sources required for safe plant shutdown is located.

For such a water source to have any significant impact on safe shut-down, equipment would require total flooding of the 180- and 200-foot level up to the 217-foot elevation, which would take over 1 million gallons of 5-28

(

water. Since the largest source of water present is 8-inch service-water piping and any flood would be annunciated by a high level in the condensate backwash sump, the likelihood of such a flood occurring and not being iso-lated before causing significant damage is extremely small. Furthermore, the consequences of damaging equipment at the 217-foot elevation would be to cause a loss of offsite power and disable Divisions III and IV d.c. power supplies. Safeguard equipment served by Divisions I and II would still remain operable to shut down the plant. On this basis, the flooding of the control structure by the refueling , condensate , and service-water systems, and the radwaste system can be discounted as a significant contributor to risk.

Chilled-water system Most of the equipment associated with the control-structure chilled-water-system loops A and B is also located at the 200-foot level. However, 6-inch supply and return headers for chilled-water loops A and B are routed through areas within the control structure containing safety-related equip-I ment, namely the 13-kV switchgear room (elevation of 217 fee t ) , the Division II battery room, the cable-spreading room, the static-inverter room, the control room, and the auxiliary equipment room. The system is designed to Seismic Category 1 standards and the water inventory per loop including pipework is less than 1000 gallons. Equipment served by the chilled-water system includes HVAC coolers located at an elevation of 304 feet, where there is no safety-related equipment, and also in the 13-kV switchgear room >

f

's_- Flooding from equipment served by the chilled-water system or from the chilled-water headers or pipework located at the 200- and 304-foot eleva-tions present no risk to the plant since there is no equipment required for plant shutdown in these areas.

The EVAC coolers and chilled-water-system valves, located in the 13-kV switchgear room; are provided with secondary containments that are also designed to Seismic Category 1 standards and drained via the equipment drain system. If a leak were to occur, equipment damage would only be sustained within the range of any spraying and dripping, since the capacity of the chilled-water system is not large enough to cause a signficant accumulation of water. The equipment within the area is the station auxiliary bus, which supplies safety-related and balance-of-plant equipment; 13-kV switchgear, which supply balance-of-plant equipment only; and 125-V d.c. batteries associated with Divisions III and IV. Although the 13-kV switchgear are positioned directly beneath the HVAC coolers and chilled-water-system valves, the station auxiliary bus is at least 25 feet way and the batteries are in separate rooms off the 13-kV switchgear room. From the above discus-sion, the following conclusions were drawn: (1 ) significant leakage of etilled water from equipment in this area is an event of very low probabil-ity; and (2) if such an event were to occur, it is highly unlikely, given the arrangement of equipment within the room, that more than balance-of-plant equipment would be failed. Flooding from equipment associated with the chilled-water system is therefore considered a minor contributor to g, risk.

l I

5-29 l

Failure of the chilled-water-pipework headers within the control struc-ture areas that contain equipment required for plant shutdown was also con-sidered. The areas, which are listed above, were analyzed in turn. The frequency of flooding from chilled-water system pipework is estimated on the basis of a pipe rupture frequency of 3 x 10-10 per section per hour. The number of pipe sections in each area is estimated from P&ID M41.

There is no equipment, located within the cable-spreading room, which is susceptible to flood damage.

There are two pipe sections within the static-inverter room, giving a flood frequency of 5.3 x 10-6 The most severe transient that could re-sult would be a turbine trip and, as a minimum, two safety-related equipment divisions and the feedwater/ condensate system would remain undamaged to mit-igate the accident. The risk from flooding in this area is therefore a neg-ligible contributor to risk.

Four chilled-water pipe sections are routed within the peripheral rooms at the control-room elevation and not in the control room itself. This pipework is provided with a secondary containment. In the event of loss of all equipment within the control room, shutdown may still be achieved from the remote-shutdown panel. On the basis of this discussion, flooding from the chilled-water system at the control-room elevation is considered to be a negligible contributor to risk.

The auxiliary-equipment room contains two chilled-water-pipe sections located in the vicinity of equipment serving Unit 1, giving a flooding fre-

's -) quency of 5.3 x 10-6 per year. As discussed above, the capacity of the the chilled-water system is limited, such that only spray or dripping may be a potential cause of equipment damage. The Division II and IV equipment is shielded from the chilled-water pipes by Division I and III cabinets; thus ,

the former will remain undamaged to mitigate any resulting accident initia-tor. The most severe transient tha t could occur would be an MSIV closure (Tp). The conditional probability of core melt given that Divisions II and IV remain undamaged would be 1 x 10-4 Therefore, the resulting core-melt frequency from flooding in the auxiliary-equipment room is assessed to be 5.3 x 10-9 per year, which is a negligible contributor to risk.

There is a total of 12 chilled-water-pipe sections in the 13-kV switch-gear room, giving a flood frequency of 3.1 x 10-5 per year. The worst consequence of such an event would be a simulated loss-of-offsite-power transient resulting from damage to the station auxiliary bus. Since the i conditional probability of core melt given such an event is approximately 1

10-3, which is the common-cause failure of diesel generators to start and run, a conservative estimate of core-melt frequency resulting from such an event is less than 3.1 x 10-8 per year, which is not a significant con-tributor to risk.

Since there are only two pipe sections in the Division II battery room, the annual flood frequency is 5.3 x 10-6 The only potential consequence would be the loss of safety-related equipment served by Division II batter-ies, and the most severe transient that could occur would be a manual shut-down (TM*I 5-30

, Fire-protection system Pipework associated with the fire-protection water system is located entirely within the control-structure stairwell, with the exception of sup-j plies to the charcoal filter system at the elevation of 304 feet, the wet

pipe deluge system in the cable-spreading room, and hose reels at elevations of 180 and 200 feet. Flooding in any of the above-mentioned areas is not capable of causing damage to equipment required for plant shutdown. Water leakage tha t cannot be handled by the installed floor and equipment drains will be funneled down the stairwell to the lowest level in the building, which is the condensate-backwash area at the 180-foot elevation. Water

, accumulation in this area does not preaant any significant risk to the plant, as discussed above. Thus, the fire-protection system may be ruled out as a significant source of flooding in the control structure.

5.3.4.6 Spray-Pond Pump Structure The spray-pond pump structure is divided into two areas, east and west, which are separated by a reinforced-concrete fire wall. The only access through this wall is a single fire door located at floor elevation (268 feet). Housed within the structure are all four emergency service-water (ESWS) pumps and all four residual-heat-removal service-water (RHRSW) pumps.

Those pumps associated with Divisions A and C are located on the east side i and those associated with Divisions B and D on the west side. The wet and g dry pits occupy the lowest section of the structure, which exten.ds from the 238-foot elevation to the main equipment ficor at the 268-foot elevation.

The wet pits are connected directly to the spray pond, whose maximum surface i height is 261 feet, via normally open sluice gates. These pits provide the suction source to the pumps. The dry pits contain valves associated with

the ESW and RHRSW systems. The pumps, their discharge valves, and their motor control centers are located on the main floor at the 268-foot elevation.

5.3.4.6.1 Independence from Other Structures The spray-pond pump structure is located at the southern edge of the spray pond, well separated from other buildings, and thus it may be consid-ered totally independent with respect to internal flooding from all other l plant structures.

1, 5.3.4.6.2 First-Level Analysis i

A first level of analysis of the spray-pond pump structure was per-formed assuming failure of all ESW and RHRSW loops. The most severe tran-i sient that could result from flooding in this area is a manual shutdown (Tm) . The main feedwater and condensate system would remain undamaged to

( mitigate the accident. Furthermore, safety-related equipment in the KPCI, 5-31 l-

s LPCI, and LPCS systems, which is cooled by the ESWS during accident condi-tions, can also be manually aligned to the normal service-water system.

There is, however, no alternative to the RHRSW system as a means of cooling the RHR heat exchangers.

Given a total flood frequency of 6.7 x 10~3 per year (see Appendix H), the contribution to accident class II is approximately 17 percent, in-dicating that a more detailed second-level analysis is required.

5.3.4.6.3 Second-Level Analysis ,

At the second level of analysis, it was the aim to exacine the inde-pendence between areas within the broad structures and to reevaluate the frequency and worst-case damage associated with floods within independent areas.

As described above, the pump structure is divided into two halves, east and west, the only access and potential flood pathway between the two halves being a fire door located at the 268-foot floor elevation. The 268-foot floor elevation is connected to the wet and dry pits via open grills that are flush with the floor. It may thus be argued that any water spilling onto the 268-foot floor elevation will be drained into the dry or wet pits.

The former may ultimately fill and overflow onto the floor; however, the wet  ;

pits are capable of accepting this water, as they are connected directly to the spray pond. Any leakage through the fire door connecting the east and west halves of the pump structure will therefore be minor and will also ultimately drain into the wet pits. On this basis, it is argued that damage as a result of flooding will be limited to one-half of the pump structure.

For this second-level analysis it is therefore assumed that the worst-case damage results in failure of ESWS loops A and C or loops B and D and RHRSW loop A or loop B. As discussed in the first-level analysis, failure of the >

ESWS does not cause subsequent failure of any safety-related equipment.

H oweve r, failure of one RHRSW loop will result in an inability to remove heat via one of the RHR heat exchangers.

In summary, flooding of the spray-pond pump structure is assumed to cause a manual-trip transient. The main feedwater and condensate system and the HPCI, RCIC, LPCI, and LPCS systems remain undamaged; however, one loop of the RHR system is assumed to be failed. Given a flood frequency of 6.7 x 10-3 per year, there is no significant contribution to accident classes I and II.

5.3.5 SPECIAL CONCERNS 5.3.5.1 Introduction The analysis as performed implicitly takes into account floods from all sources of water in the plant, and has explicitly taken into account all those types of floods that have occurred historically, by virtue of their being included in the data base used to estimate the frequencies of floods.

5-32

There are, however, some potential leaks from large fluid sources which would be unisolable. Their potential for causing floods large enough to compromise the independence assumed for the different areas of the plant are discussed in this section.

5.3.5.2 Failure of Scram-Syste?+Pipework Integrity In the event of failure of the scram discharge volume or loss of sub-system integrity, the potential exists for an unisolable blowdown of the reactor-coolar.t system outside containment. In fact, the blowdown would occur in the CRD hydraulic control area, which is located at an elevation of 259 feet of the reactor enclosure (identified as flood area RB-FL13 in this study). Although the immediate impact of flooding in terms of spraying and accumulated water from this source is considered implicitly in the analysis of flood area RB-FL13, the long-term environmental impact throughout the reactor enclosure, from an unisolable blowdown, is not considered. This po-tential problem has however been the subject of a detailed study performed by General Electric on behalf of the BWR Owners Group (General Electric, 1982). The results are applicable to LGS Unit 1. A su= mary and the con-clusions of this report are as follows:

"The loss of SDV integrity can occur from any of four failure modes: (1) rupture of the SDV piping upstream of the vent and drain valves, (2) failure of the redundant vent valves to close following a scram, (3) failure of the redundant drain valves to close follow-ing a scram or (4) failure of the SDV relief valve. The first failure mode was it.vestigated using methods similar to those used in NUREG-0803 and NEDO-24342. Actual plant data on SDV pipe size and scram frequency was considered for these two approaches. The calculated break probabilities from those two approaches was com-pared to the calculated probability using a fracture mechanics ap-proach and the results were shown to be consistent.

The probabilities associated with failure of the vent or drain valves to close were calculated based on previous op? rating history with this type of valve. The probability of an SDV relief valve failure to close was small relative to the other failure modes due to the relatively low frequency of challenge to this valve.

Consideration was given in the probability analysis to the ability of the operator to reset the scram. Due to the more severe envi-ronmental conditions, that probability is lower for the SDV pipe break than for the vent or drain valve failure.

The total probability of a breach in SDV integrity is the sum of the indb iual probabilities for each failure mode. That total probabitis r was determined to be approximately 3 x 10~7 per reactor-year.

5-33 m

The probability of a core melt event given the breach in SDV integ-rity was prevously calculated and reported in Section 7.8 of NEDO-24342 and was determined to be 1.2 x 10-4 per plant year. There-fore, the probability of a breach in SDV integrity leading to a core melt is approximately 4 x 10-11 per plant year."

From these results, and considering the large margin to a frequency at which the core melt might be significant, it was concluded that the breach of the SDV integrity is not a significant contributor to core melt or risk.

5.3.5.3 Large Water-Storage Facilities The suppression pool and the spent-fuel pool are the only storage tanks of significant size (>5000 gallons) within the reactor enclosure or control structure. Their potential for being significant sources of flood is ex-amined below.

5.3.5.3.1 Suppression Pool The suppression pool is situated within the primary containment, which is a reinforced-concrete pressure vessel, lined with stainless steel plate.

The suppression-pool boundary and its asrociated pipework are designed to Seismic Category 1 standards and as such the likelihood of a failure leading to extensive flooding is very small. Futhermore, in the event of such a failure, by far the most likely consequence would be flooding of only one of the ECCS compartments, which would have negligible impact on the capability to shut down the plant.

5.3.5.3.2 Spent-Fuel Pool The spent-fuel pool is a post-tensioned reinforced-concrete structure, "

lined with stainless steel plate and forms an integral part of the reactor enclosure. Pool-water recirculation is achieved by overflowing into the shimmer surge tank s . There are no pipe outlets from the pool below the nor-mal water level, and thus there is no potential for draining the pool via any connecting pipeweik system. A leak-collection system is provided to permit detection of leaks through the stainless steel liner.

Given the above design, the likelihood of extensive flooding from the fuel pool is judged to be very small. Any leakage would be directed onto the reactor-enclosure floor at an elevation of 313 feet, which is designated as flood area RB-FL16 in this study. In Section 5.3.4.4.3, the impact of a flood having a frequency much higher than that resulting from fuel-pool failure has been shown to be a negligible contributor to core melt and risk.

The prior analysis assumed the failure of all equipment in the flood area and no credit is taken for limiting the size of the flood. Thus, it follows that similar damage resulting from failure of the fuel-pool integrity is also a negligible contributor. Fuel-pool water arising from the postulated 5-34

leak would ultimately find its way to the reactor-enclosure sumps at an ele-vation of 177 feet via the plant-drainage system on the stairwells. (For reasons discussed in Section 5.3.4.4.3, equipment on intermediate elevations would not be affected.) The total loss of the fuel-pool water inventory is estimated to be capable of flooding some areas eutside of the watertight ECCS rootu, on a 177-foot elevation, up to, but not including, the floor el-evation of 201 feet.

It is thus concluded overall that the risk from flooding caused by failure of large water-storage facilities is negligible.

5.

3.6 CONCLUSION

S The results of this analysis, which are summarized in Table 5-5, are as follows:

1. The frequency of Class I accidents resulting from internal flooding is less than 5 x 10-7 per year and is therefore about 4 percent of the internal initiating events class I frequency.

j 2. The frequency of class II accidents resulting from internal flood-ing is less than 7 x 10-8 per year and is therefore about 7 per-cent of the internal initiating events class II frequency.

Since the analysis, being largely a bounding analysis, is conservative, it is concluded that internal flooding has a negligible effect on risk.

O t

5-35

___-= _ _ - _ ._- _ . _ . _ - _ _ - ._ - _ . - - - _ - _____ _ __ ._ _ - -

s j

REFERENCES i

American Nuclear Society, 1976. Standards for Determining Design Basis Flooding at Power Reactor Sites, ANSI N-170-1976.

Advisory Committee on Reactor Safeguards, 1982. Transcript of Meeting of Subcommittee on Extreme Natural Phenomena, April 30, 1982 General Electric Company, 1982. Analysis of Scram Discharge Volume System

]

Piping Integrity, NEDO-22209.

Miller, C. F., W. H. Hubble, M. Trojorsky, and S. R. Brown, 1982. Data Sum-maries of Licensee Event Reports of Valves at U.S. Commercial Nuclear l

Power Plants from January 1, 1976 to December 31, 1980, EGG-EA-5816.

i

] Philadelphia Electric Company, 1981. Probabilistic Risk Assessment, Limer-ick Generating Station, Docket Nos. 50-352, 50-353, U.S. Nuclear Regulatory Commission, Washington, D.C.

Philadelphia Electric Company. Final Safety Analysis Report.

Riedel, J. T., and L. C. Schreiner, 1980. Comparsion of Generalized Esti-mates of Probable Maximum Precipitation with Greatest Observed Rain-falls, NWS 25, National Oceanic and Atmospheric Administration, Washington, D.C.

' Schreiner, L. C., and J. T. Riedel, 1978. Probable Maximum Precipitation Estimates, Urited States East of the 105th Meridian, NOAA Hydrometeoro-logical Report No. 51, U.S. Government Printing Office, Washington, S.C.

USNRC (U.S. Nuclear Regulatory Commission), 1975. Reactor Safety Study--An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants,

. WASH-1400 (NUREG-75/014), Washington, D.C.

USNRC (U.S. Nuclear Regulatory Commission), 1976. Flood Protection for Nuclear Power Plants, Regulatory Guide 1.102, Revision 1.

USNRC (U.S. Nuclear Regulatory Commission) , 1977. Design Basis Floods for Nuclear Power Plants, Regulatory Guide 1.59, Revision 2 USNRC (U.S. Nuclear Regulatory Commission), 1983. PRA Procedures Guide, l NUREG/CR-2300, Washington D.C.

O 5-36 ge a g y ,._. , - ~.s_ ,,,yp _y - - - - - _ - .... , , . _ , . -.,_. ,,

~ . . _ . _ = . . _ _ . _ _ _ _ . _ . . _ -

, _ _ _ _ _ _ _ _ _ _ _ _ ___________m _ _ _ _ _ _ _ . . __.- . _ _ - , _ _ .-

4

! 1 t

i 6

Table 5-1. Effect of internal turbine i enclosure flooding on risk i

Contribution to accident

class Flood-induced Degraded frequen cy Sequence sequence frequency core class (percent)

TpQW(Q) 4.8(-8) II 5.0 j TpQUW(Q) Negligible II

T pQUV 6.04(-9) I Negligible

! T pQUX 1.57(-7) I 1.3

, TpPW(P) 0 II T pPQW(PQ) 1.58(-9) II 0.2 T pPQUW(PQ) Negligible II T pPQUV Negligible I

T pPQUX Negligible I 1

! Note: Frequencies of LGS PRA accident classes:

Class 1: 1.2(-5)

Class 2: 9.6(-7)

I I

i t

l l

t f

I l

l 5-37

. .. .._ _ . . _ . - _ _ _ ._. _ . - _ _ . . _ _ . _ - . ~-- ... - ., - -

i 1

I i

! Table 5-2. Effect of diesel internal flooding on core-melt frequency Contribution to accident Flood-induced Degraded class Sequence sequence frequency core class frequency TgQW(Q) Nagligible II TgQUW(Q) Negligible II TgQUV 2.1(-11) I Negligible TMQUX 2.2(-10) I Negligible Note: Frequencies of LGS PRA accident classes:

Class 1: 1.2(-5)

Class 2: 9.6(-7) d i

r i

l O

5-38

O O O Table 5-3. Flood independent areas within the reactor enclosure which contain equipment required for safe plant shutdown Plant locations Independent included within Flood frequency flood area flood area (as Fire zones included assigned for (defined by designated by within flood area level 2 analysis this analysis) the QADa a (included for information only) (per year)

ELEVATION 177 FEET RB-FL1 102 203 32 RHR heat removal compartment 0.016 RB-FL2 103 304 31 RHR heat removal compartment 0.016 RB-FL3 110 35 Core spray compartment 0.016 RB-RF4 113 36 Core spray compartment 0.016 RB-FL5 114 37 Core spray compartment 0.016 l RB-FL6 117 38 Core spray compartment 0.016 i

RB-FL7 108 34 High-pressure coolant injec- 0.023 tion compartment RB-FL8 109 33 Reactor core isolation cooling 0.023 compartment ELEVATION 201 FEET i

RB-FL9 200 209 42 Safeguard access area 0.0078 PS-FL10 207 41 Reactor-enclosure cooling 0.0078 water equipment area j

l

Table 5-3. Flood independent areas within the reactor enclosure which contain equipment required for safe plant shutdown (continued)

Plant locations Independesat included within Flood frequency flood area flood area (as Fire zones included assigned for (defined by designated by within flood area level 2 analysis this analysis) the QADa a (included for information only) (per year)

ELEVATION 217 FEET RB-FL11 302 305 44 Safeguard system access area 0.0078 303 306 304 307 RB-FL12 309 43 Safeguard isolation valve area 0.0078 Y ELEVATION 253 FEET e

RB-FL13 402 45 CRD hydraulic control area 0.0078 RB-FL14 407 46 Main steam tunnel 0.0078 ELEVATION 283 FEET RB-FLIS 500 506 47 RWCU c6cpartment, FPCC com- 0.0078 501 507 partstut and general equip-502 508 ment area '

503 509 504 510 505 511 518

Table 5-3. Flood independent areas within the reactor enclosure which contain equipment required for safe plant shutdown (continued)

Plant loca tions Independent included within Flood frequency flood area flood area (as Fire zones included assigned for (defined by designated by within flood area level 2 analysis this analysis) the QADa a (included for information only) (per year) i ELEVATION 313 FEET RB-FL16 601 695 48 RWCU holding pump compartments 0.0078 602 RERS, fan area and corridors

, aQuality assurance drawings.

i t ,

e i

l 1

i l

i i

I  !

i.

O ~ O Table 5-4. Flood-induced accident sequence frequencies for reactor enclosure - level 2 analysis Flood frequency Dominant accident Flood area (refer assigned for Accident-miti- sequences to Table 5-3 for level 2 analysis gating systems Accident definition of area) (per year) degraded Frequency class RB-FL1 0.016 LPCI (loops A & C) TM EW I'OI-93 II (elevation 177') RHR (loop B) TMQUV 4.4(-11) I RB-FL2 0.016 LPCI (loops B & D) T gQW 1.8(-9) II (elevation 1778) RiiR (loop B) TM 90Y 4*4I-III I T gQUX 1.1(-9) I RB-FL3 0.016 LPCS (loop A) TgQUV 5.9(-11) I (elevation 1778)

Y g RB-FL4 0.016 LPCS (loop B) TgQUV 5.9(-11) I (elevation 177')

RB-FL5 0.016 LPCS (loop A) TgQUV 5.9(-11) I

(elevation 1778)

RB-FL6 0.016 LPCS (loop B) TMQUV 5.9(-11) I (elevation 177' )

RB-FL7 0.023 IIPCI TgQUW 8.7(-10) II (elevation 177') TgQUV 0.7(-10) I TgQUX 2.3(-8) I r

RB-FL8 0.023 RCIC TgQUX 8.7(-10) II (elevation 1778) TMQUV 8.7(-10) I TgQUX 2.3(-8) I i

i

x s

+

1 Table 5-4. Flood induced accident sequence frequencies for reactor enclosure - level 2 analysis (continued)

Flood frequency Dominant accident i Flood area (refer assigned for Accident-miti- sequences to Table 3-3 for level 2 analysis gating systems Accident definition of area) (per year) degraded Frequency class i

RB-FL9 0.0078 RHR (loop A) TgQW L.6(-10) II

, (elevation 201')

l I

RB-FL10 0.0078 LPCI (loop D) TgQW 1.4(-9) II (elevation 201') LPCS (loop B) TMQUV 2.9(-11) I RHR (loop B)

RB-FL11a 0.0078 HPCI T pQUW 1.6(-9) II (elevation 2178) RCIC TpQUV 3.4(-7) I y LPCI (loops A & . TpQUX 3.1(-7) I g LPCS (loops A & B)

RHR (loops A & B)

RB-FL12 0.0078 Noaa None '

(elevation 2178)

RB-FL13 0.0078 LPCI (loops C & D) TTQW 1.6(-9) II (elevation 253 8 ) RHR (loop A) TTQUX 1.5(-9) I T TQUV 5.9(-11) I

] RB-FL14a 0.0078 RCIC T pQW 7.8(-8) II (elevation 253') Feedwater/ condensate T QUW p 5.5(-9) II

T pQUX 1.1(-6) I

) TpQUV 4.2(-8) I

! RB-FL15a 0.0078 HPCI TgQW 5.5(-10) II l (elevation 283') LPCI (loops A, B TMQUV 3.8(-6) I

C & D) TMQUX 7.C(-9) I l LPCS (loops A & B)

RHR (loops A & B) l l

1 i l

2 i [

Table 5-4. Flood induced accident sequence frequencies for I reactor enclosure - level 2 analysis (continued) l l

. Flood frequency Dominant accident Flood area (refer assigned for Accident-miti- sequences ,

to Table 3-3 for level 2 analysis gating systems Accident i definition of area) (per year) degraded Frequency class j B

d RB-FL16 0.0078 LPCI (loops A & B) TMQW 5.5(-10) II (elevation 313') LPCS (loops A & B) T MQUV 5.8(-10) I RHR (loops A & B) 4 j acontribates more than 5 percent to accident class frequency. .

l' i

Ut i

4 i ,

i I

i i

i ,

I h

I t

i t

i l

i _ _ _ _ _

1 I l l

Table 5.5 Frequency of gross rupture in service-water systems pipework iccated in flood area RB-?L1.5 l

Frequency of Total estimated

! Item Number rupture per unit frequency of rupture per hour per hour i

12-INCH-DIAMETER PIPEWORK Pipe sections 7 3 x 10-10 2.1 x 10-9 i Valves 0 1 x 10-8 o Total 2.1 x 10-wa 1

8-INCH-DIAMETER PIPEWORK Pipe section 12 3 x 10-10 3.6 x 10-9 Valve (butterfly, check, and throttle) 21 1 x 10-8 2.1 x 10-7 Total 2.1 x 10-7b al.8 x 10-5 per year.

p bl .8 x 10-3 per year.

I I

i i

5-45

. - . - - . . __ . , - , - , . - . - - _ . - . = - . - . _ . .- . . - - - . . . - . . . . . . , , . - . - - -

n e

o r it u

s a

t o r S

l c o t

n a e g e r e

r n

r o n su it t egl o a c c r a l e en e .

e r s e n 2

e iD G it n k

. U i c

r e e r e s u s

r u m r

e o t c

i L

m lc u r n r f f

o e t s o L T s

n a

r i

br T

e n

u l

t o

r n

o _

lp d

n a

C e r e u

s i z

r o o l

a lc t a r n

e r e e n

e r u n r

o e s e gl o t

G c

a le- cn e

r s

e e

_ i 1 1 D -

5 it n e r

U u

.\'

g i

F e

t g s

a i n

- d w i d

l u

a R b iI' i ; , iIj14}ii-  !! ,-1

O O

1 MSIV Generalized closure S/R S/R Cond/FW HPCI Timely LP # S* '

Reactor RR Estimated valves valves and PCS or RCIC ADS ECCS Sequence postulated and loss of subcntical

• 9uence o en reclose available available actuated available des gn tor deg aded a aia e rob Tr C M O condition P U X V W T*p OK -

s Tp O* OK -

130x10-6 Tp OW(0) 4.8 x 10 -8 Class ll 1.0 Tp OU* OK -

33 OX10 6 gqg ggg mgn l 4 9x10-3 7.7 X 10 - 5 TpOUV 6 04 X 10-9 Class i 2 X 10 - 3 1 T OUX 1.57 X 10-7 Class i Tp P* OK -

19 9x10 6 TpPW(P) 1.58 X 10-9 Class 11 10 2 , TpPO

• OK -

(Multiple valves TpPOW (PO) Negligible Class II fail to reclose) 1.0 TpPOU* OK -

,8.5 M O 4 3

' Tp POUW(PO) Negligible Class 11 O.016 4.9X10 ~ 3 7.7 X 10 5 pg g gy i 2 X 10-3 T,POUX 1.6 x 10 9 Class 1 10-6 Tp Mt (1.78 x 10 - 6)

3 X 10- 5 l Tp Ct (4 8 x 10 7)

• Not core-melt sequence l t Transfers to the appropriate LGS PRA event trees (large LOCA, ATWS) give negligible contobutions i

! Figure 5-2. Transient-event tree for closure of main-steam isolation valve, loss of feedwater, and loss of main condenser resulting from turbine-enclosure flooding.

i

O O RHR and Ge,eralized S/R S/R Cond/FW HPCI Timely LP class of Manual Reactor RHRSW Estimated v Ives valves and PCS or RCIC ADS ECCS Sequence stulated shutdown subcritical or PCS n a>

open reclose available available actuated available designator degraded available ' C '"

Tu C M P Q U X y W condition T'

u OK -

TuO- OK -

! 3.5x 10 - 2 TyOW(Q) Negligible Class 11 7X10 TuGU* OK -

13 0 x 10 - 8 Negligible TuGUW(Q) Class 11 4.9 x 10 3 7.7 X 10 5 ---

W DXmm Class i 2 X 10-3 TuGUX 2.2 X 10 -10 Class 1 0.008 1

i t

l I

i TM C" NA NA i

l'

• Not core-melt sequence

" ATWS is judged not to be risk contributor for manual shutdowns Figure 5-3. Event tree for manual shutdown resulting from flooding of diesel-generator rooms.

I l

i J

TS -

S S D E @ -

m=r e i . , -

1 I

i LJ P==* -

( 3 t

7.f ,_

i 1 4 .

EE [ .

e _- \U 'l/ g l

).

v.ty Pa

• 4 4

l - -

+ 6, ,

i  ;

!l l t t- .

. ,M ,i

!. .s,

. ,s w5 a]-e== m i.d L== f . . .

. H[Ol e.cmn

,i i i

,i, 1>s:_ c

--, Il .. ,

. . , .. . . i.. _. 9 (* ist1 sU- ue,fl l' -(

7 Q

f.,h [*.*.f y v -

.u:

m --" . , j_--l

~

a f- ,

/j _f f i -

".:J i J

. 3 e..r-(F_ .. g-

m. _,

j 7 .- i t--. w  ; .er-m 1. - y

• --;VM Q

t #

!s .i l

li 4 l . 2A M...

i i

v 4*e: :, i . . 0 ' "".'. \ \ N ,

__sus r !I1 . . .

r :p

.\ r l

! L4, f - : { ,

' " ' " s va,_ ::

'_I ,

i4 I . n. / ; - ..

h% uy/ I: r 1

i\ $rn![. -Ng. -==

n 1- T R J:i ,ph v %. g -

3 7, %w s,'.,9 R;.*T r 1

.,\, _ \'h,c 5 eh,Nis1 i ,,,,

I @ I pl44..  ;  ; \ jl b .

b=

h}- i

/ ~~.; , 8 c ..

".7 un - p ,.__j_ ,

.l 4, _!x__ s j q!! a

, j h,ji [,

l i

I Ii $.I  ;

'i I ew. []

' ! ., m ; I i; ::jjd 1lI j,! yj ,.! l,l t ii i

l

,, t. I,

,1 '.d ll; m ':

- - ,'1 ' , , , .

I e 7 l

--l ia. .- = : t I ,e

,a m' --_

- p I Le

.["4,] lfL !lH.l ![ l T'i,[ " 7

$ .) ;j--l' h.l ph --

-# ~ ,, .

t i wg __ /,'  :, c t i

, il ;r ~~,

h, j j !, L ?Tlh l lIdL_ / " ". -q il f ,

m '. e

}. 1 .i , -

~

m----n-*C. u. .

n i ,

Marr g

q i e hf* T .u .'

u.:!! rh-l  : ll U-,g gu -

l

' c' .T: .

.s

)'p,-" ++ .,i . . ,

l SECTo* A A i

l Figure 5-4. Cross-sectional view of reactor enclosure at Limerick Generating Station.

1 1

l V e

rh I

d

@ O r.

..- _ 8"T h sur.y_Q M ,*ee.cw Q 3

i' 'j .,

M

--: 9 m' h i /

Q *,

u.-.- '~~

7 '

7 u n. ..- ss! -

1 d u-h E ,$"'",w- e- [

tnu emt:f

.% n L> i .;

.o..-.-

^%QdQ -_

.J I -

m,

-f. *E' ('.l. / .

l a; l

i ae .

i n,f b.,f.t!

uA _k* 1 _f + ' E- m" i. i. .

6. i si l l

{.,n

{ ......... ,

s:l

w.. . .- _ _

q L

I g

. .. e7 er._ *'g * -

g' Q p....-

ll . ..

u . ..w r

p J  :- is

( . . . . = . N l

ed,, .

u n. -.- ',  ;

i t.

r

!$*..!: M 1"'d.'.',N l  ?.. .. .. *[ k O -Ej[+=

e- A esg . . .~

t ._ I.

y . gia y -

@ Rhja u n, ..- i ' i d r i E . [

= 8;w -yn - , .. ,

T'""""

_;_ suas k !; ,,, . I 3 ru . 4 7- :,g/%'%.T.

==

g,?.*

. - . - y -

[$sE*h

. ITF5El $ -

:',7* IJ wsr_ . . . . . ._ . J

• • • 0 *.udis_

t

• m %I

g;g h  ; . : dI f..

=:

s*3d 4

- - madr- -emmus - - . -

- cm

a. a.,

2 -

m,!#:.l:*'

• • 4Li I=R

.. ,[* c

• L't-- 11 8 l .,

!.- -l  ::l:f .

1 r

-'r ,i -i '

I .i~.1::': U! I i-

[] , ,'.g*"'. ..*.::* *** . ;! X , I f . . . . . ,

c

./

f.z i 4*#. 'n I

. n nl

.&. e f' 3 s  % 4

.i +-

2 . . . .j E6E' i

_' tu..

b* I e,

Figure 5-5. Cross-sectional view of control enclosure V at Limerick Generating Station.

i Cr. apter 6 ANALYSIS OF ACCIDFATS RESULTING FROM ERNADOES

6.1 INTRODUCTION

The objective of the analysis reported here was to estimate the contribu-tion to the frequency of core melt and to the frequencies of the various acci-dent classes of accident sequences initiated by a tornado strike at the plant.

Tornadoes are generally characterized by a violently rotating column of air that usually has the appearance of a funnel dipping down from the base of an 1

existing cloud. The tornado vortex tends to behave erratically; the path of a particular tornado is unpredictable, and the base of the vortex lif ts off the ground at irregular intervals. When this base " touches down," severe damage can be caused. This damage can be one of three types

a. Direct damage due to the extremely high wind speeds. While some analysts have estimated wind speeds in excess of 450 mph, the estima-tion of wind speeds is a matter of much uncertainty, and many experts now believe that maximum speeds are in the region of 250 mph.

b. Dar; age due to the pressure difference between the inside and outside of the tornado.

c. Damage due to missiles. It is well documented that tornadoes can pick up and transport missiles with significant velocity and momentum.

Tornadoes do occur in the Eastern United States, and certain critical build-ings at nuclear power plants are designed to withstand severe tornadoes (USNRC, 1978). The features of the Limerick Generating Station (LGS) that protect against the effect of tornadoes are discussed in Section 6.2.

An evaluation of the risk from tornadoes requires a classificacion of plant damage states and an assessment of the site-specific frequency of occur-rence of tornadoes that have the potential for producing those plant damage sta te s. Tornado characteristics vary considerably with geographical location.

There is considerable literature on tornado characteristics. The Appendix to EPRI-NP-768, " Tornado Missile Risk Analysis" (Twisdale, et al., 1978a), has an extensive list of references. However, it is clear that the phenomenology of tornadoes is not yet well understood. Furthermore, much of the assignment of tornado characteristics to actual occurrences has been subjective rather than determined by scientific measurement. This means that, it is difficult to predict accurately the frequency of occurrence of tornadoes with specified characteristics. This is particularly true for the really severe, damaging I tornadoes, which are quite rare. For the region around the LGS site, no such tornado has been observed for about 30 years. Nevertheless, from the evidence available, it is possible to estimate an upper bound on the frequency of acci-dent sequences that lead to core melt, as explained in the following sections.

In Section 6.3, the physical affects of a tornado on the plant are dis-cussed. This leads to a definition of two categories of tornadoes for which 6-1

f'"g site-specific statistics are required. This categorization is crude, but it

() is sufficient for the bounding analysis performed here. The two categories are defined by ranges of maximum wind speed, category 1 being tornadoes with wind speeds in excess of 90 mph, and category 2 being tornadoes with wind speed: in excess of 300 mph. What makes this a workable definition is that tornadcas are classified by the National Severe Storms Forecast Center in terms of cbserved " damage states." In this classification, damage state is assigned an integer--the F number--af ter Fujita (1971) . Each F number is associated with a range of wind speeds. This is discussed in more detail in Section 6.4, where the estimation of the frequencies of the two tornado categories is described. The impact of tornadoes on core-melt frequency and also on risk is discussed in Section 6.5.

6.2 DESIGN FEATURES THAT PROTECT THE LCS PLANT FROM THE EFFECTS OF 'ICIWADOES The plant layout is shown in Figure 6-1. As mentioned in the introduc-tion, ccrtain safety-related structures are required to be protected against the effects of tornadoes. The design-basis tornado for the Limerick site is defined as follows:

1. Dynamic wind loadings. These are the external pressure or suction forces on a structure due to the passage of a tornado funnel. The design-basis tornado has a rotational speed of 300 mph and a transla-tional speed of 60 mph. Conservatively, this is taken as a 300-mph wind applied uniformly over an entire structure.

2. Differential pressures. When the low pressure within a tornado fun-nel engulfs a structure, a rapid depressurization occurs and produces differential pressures between the inside and outside of the struc-ture and between the compartments inside the structure, depending on the available vent patt;n. The pressure transient caused by the design-basis tornado is a 3-psi pressure drop at the rate of 1 psi per second, followed by a 2-second calm and then a repressurization to the original pressure at a rate of 1 psi per second.

3. Tornado missiles. Three types of missiles are postulated: wood planks, steel pipes, and automobiles. The weight, velocity, and other charac-teristics of these missiles are provided in Table 6-1.

Table 6-2 lists the structures that are designed to withstand the effects of such a tornado. As described in Section 6.3, the definition of the design-basis tornado is used to define two categories of tornado for which frequency estimates are required. It should be noted that, in general, the design pro-cess is conservative and the structures are expected to withstand wind speeds, pressure drops, and missiles that are more severe than the design basis.

One important feature of the design of the plant is that offsite power is supplied to the station via underground cables from the substation. The use of these cables helps to preserve the protection afforded by the physical separation of the two substations (see Figure 6-1) frcm the turbine enclosure.

O G

6-2

)

l

/'~'} The cables surface in the turbine enclosure as cable buses that are fed into x ,/ the control enclosure.

6.3 EFFECTS ON THE PLANT AND CATECORIZATION CF TORNADOES 6.

3.1 INTRODUCTION

The purpose of this section is to identify those portions of the plant at risk from a tornado and to establish a categorization of tornadoes for which site-specific statistics are required. As a first approximation, it was de-cided to treat tornadoes in two different categories: those that are less severe than the design-basis tornado and those that are more severe. These categories are defined more precisely in Sections 6.3.2 and 6.3.3. The cate-gories are defined in terms of maximum wind speed but not pressure drop. The reason for this is that, in the published data sources, tornado damage is clas-sified on a scale that correlates to ranges of wind speed but not pressure drop. This classification scheme, which is used as a basis for generating the statistics on tornado occurrence and tornado risk, is discussed in Section 6.4.

The missiles and their potential for damage are discussed in Section 6.3.4.

6.3.2 ERNADOES WITH SEVERITY LESS THAN THE DESIGN BASIS As shown in Table 6-2, the reactor enclosure, the control structure, the diesel-generator enclosure and the spray-pond pump structure are all built to fx\-}' withstand the design-basis tornado. However, there are other structures designed to lower standards, which could, if damaged, initiate a transient or jeopardize the safe shutdown of the reactor. The structures identified as having such impact are as follows:

a. The electrical transformers and substations

b. The turbine enclosure

c. The condensate-storage tank

d. The cooling towers To perform a bounding analysis, two damage scenarios involving these struc-tures have been developed.

Case 1 The turbine enclosure, the condensate-storage tank, and the auxiliary and safeguard transformers are all in the same general location close to the reac-tor enclosure, and it is probable that they would be damaged by the same tor-nado. Therefore, the first case considered was the destruction of, or severe damage to, the turbine enclosure, the condensate-storage tank, and the electri-l cal transformers. The turbine enclosure and condensate-storage tank are de-signed according to the code of the American National Standards Institute and the Uniform Building Code and thus have the capability of withstanding 90-mph winds at the lowest levels (0-50 feet) and wind speeds in excess of 115 mph at levels above 50 feet (see Table 3.3-1 of the FSAR) .

6-3

i a

1 i For this first care, it is assumed that there is no substantial damage at

! wind speeds less than 90 mph, but it is very conservatively assumed that, for i i a tornado with wind speed greater than 90 mph striking the turbine enclosure  !

area, the turbine enclosure, condensate-storage tank and electrical transform-ers are severely damaged. The implications of these damage assumptions for risk are considered in Section 6.5. These assumptions define the first cate-gory of tornado: one which has wind speeds greater than 90 mph. A frequency of impact of such a tornado on the target area will be estimated in l Section 6.4.  ;

Case 2 j The cooling towers are scme 500 to 600 feet from the turbine building and about the same distance from the spray-pond pumpheuse. Loss of the cooling towers as suen does not directly affect risk, but cooling-tower collapse could i have an indirect effect in the form of damage to the turbine-building area or the spray-pond pumphouse. The cooling towers are designed to withstand winds with speeds of 90 mph at grade level and higher speeds at levels above grade (PECo, 1982a). The second case then consists of the very conservative assump-tien that a 90-mph tornado is sufficient to collapse the cooling towers with ,

j potential damage to the spray pond, the spray-pond pumphouse, and the turbine i enclosure. This category of tornado is the same as in case 1. The implica-tions for risk of these damage assumptions will be discussed in Section 6.5.

l It is possible that a single tornado could damage both the substations, leading to a loss of offsite power and a much longer recovery time than was I

assumed likely in the LGS PRA. However, the physical separation of the two i

substations makes this much less prooable than damage to the area around the turbine enclosure. The conditional probability of core melt frem the loss of both substations is not judged to be greater than that resulting frem damage to the turbine-enclosure area. Consequently, no assessment was made of the frequency of tornado damage of both substations. Similarly, simultineous dam-age to both the cooling towers and the turbine-enclosure area is much less likely than damage to either one on its own, with consequences no more severe.

J l 6.3.3 TCENADOES AT OR ABOVE THE DESIGN BASIS The design criterion for protected buildings is a uniform wind speed of 300 mph. For the bounding analysis, it is assumed that winds of 300 mph and above will cause significant damage to protected buildings. This is very con-servative, since no account is taken of any margin of safety. This, however, serves to define the second category of tornado. In Section 6.4, an estimate is made of the frequency with which such tornadoes might strike the reactor-enclosure area, and the impact on risk is discussed in Section 6.5.

[

l 6.3.4 WRNADO MISSILES Missile damage is expected to be much less serious than direct wind damage. This is based on the observation that missile damage is localized; a single missile is not likely to damage a number of physically and functionally 6-4

l O separate systems. Wind affects a much larger acea, and therefore damage to many items of critical equipment is more likely. It is argued in EPRI NP-709 (Twisdale et al., 1978a) that missiles tend to lie within the damage path of the tornado, so that significant damage from a tornado passing close by but not directly hitting the plant is unlikely. Consequently, the frequency of a tornado with the potential for producing missiles that hit the target is not significantly different from that of the direct impact of a tornado on the target.

Some results using the code TORMIS (Twisdale et al.,1975b) indicate that the likelihood of backface scabbing of 18-inch-thick concrete by a tornado missile is very low. Two case studies were reported and, in the worst case, the frequency of backface scabbing of a safety-related structure was fourd to be 2.1 x 10-6 This calculation was performed for a site with an annual fre-quency of tornado strikes of 2.3 x 10-3 and a potential for 5000 missiles over the first 3 years of operation and 1000 thereaf ter. The damage model used to predict scabbing is considered by Twisdale et al. (1978b) to be conservative.

The frequencies of simultaneous damage from a number of missiles were found to be much lower.

As will be seen later, the frequency of tornadoes at the Limerick site is an order of magnitude lower than the figure used in the case study in Twisdale et al. (1978b). The potential for missiles should be low because of the layout of the site and the fact that tornadoes are seen to travel preferen-tially in a west-to-east direction. In this direction the site slopes down j toward a bluff along the bottom of which run the railroad line and the

Schuylkill River. No construction or parking is intended in this area.

These arguments led to the conclusion that the risk of tornado missiles as such is low and is bounded by the risk of tornado impact itself.

6.4 ERNADO FREQUENCIES _

6.

4.1 INTRODUCTION

Data on tornadoes were obtained from the National Severe Storms Forecast Center (NSSFC) in the form of computer printout that gives a variety of infor-ma tion, the most important of which, for the purposes of risk assessment, is the FPP classification. The FPP classification scheme was devised by Fujita and Pearson (1973) to provide a consistent data-collection scheme. The scheme is described in the following paragraphs.

Each tornado is assigned an F number (an integer) according to the ob-served level of damage. Each F number is given an interpretation correspond-ing to a maximum wind speed in a specified range (see Table 6-3) . The F scale wind speeds are computed from the following formula:

/

vp = 14.l(F + 2) mph (6-1)

() The wind speed is expected to vary along the tornado path, and the F classification for a particular tornado is taken to be that of the maximum speed anywhere in the path. In a similar way, the total path length and l

l 6-5 l

O average path width (averaged over the entire path length) are characterized by integer values corresponding to ranges of length and width respectively. The path-length scale PL is computed as follows:

L = 10 1/2 (Pg -1) miles (6-2) and the path width scale Pw is computed as follows:

W = 101/2(Py -5) miles (6-3)

The ranges corresponding to the different integer values of PL and Pw are given in Table 6-3.

The other important information obtainable from this source is the number of tornadoes that have occurred in the vicinity of the region of interest.

This can be used to give an estimate of the frequency of occurrence of torna-does. Combining this frequency with information on the area covered by torna-does, Thom (1963) suggested a way of estimating the probability of a tornado strike at a particular point. He used the following geometrical definition of the probability P:

P= (E (6-4)

A is the area (in square miles) of the 10 square around the point, N is the number of tornadoes that have occurred in that square in a total of T years, s and a is the average path area of those tornadoes.

The data obtained from the NSSFC for the Limerick site region for the years 1950-1980 inclusive indicate that there were 37 tornadoes in 31 years, or a frequency of occurrence of abcut 1.2 tornadoes per year. This figure is consistent with that quoted in the FSAR.

From the path lengths and path widths given in the NSSFC data, the fre-quency of a tornado of any F classification striking a point is estimated as 1.13 x 10-4 per year. Thus, while tornado strikes are relatively rare events, this frequency ic not sufficiently low to rule them out as significant risk contributors because of their potentially significant common-cause-failure capability. In Secticn 6.3, two categories of tornadoes were establishei and assumptions made about their effects on the plant structures. In this section, estimates will be made of their frequencies. In Section 6.5, these frequencies will be used with conservative assumptions of the damage caused by tornadoes in these categories to bound the contribution of tornadoes to core-melt fre-quency, and hence risk.

6.4.2 TORNADO CHARACTERISTICS AND RISK MODELS There are three very important tornado characteristics that affect the evaluation of the frequencies of the tornado categories:

1.

O The frequency of tornadoes is a function of wind speed and therefore of F number. This is shown in Figure 6-2 and Table 6-4.

6-6

l 1

i i

t l

' 2. The straightforward weighting of the overall frequency of occurrence i by the frequency of the various F numbers does not give a true meas-ure of the risk associated with a tornado having a specified F num-ber. This is because the area covered by a tornado is correlated

! with its F classification (Twisdale et al.,1978a) . Thus, a measure of this correlation must be factored in.

< 3. A tornado is only at its F classification for a fraction of the time.

A graphic example of this is shown by contour plots of the various F regions of the Xenia, Ohio, tornado of April 3,1974 (Abbey, 1976).

, There are many tornado-risk models (Wen and Chu,1973; Garson et al.,1975; Markee et al.,1974; Abbey and Fujita,1975) .* They are all calibrated in 1 some sense to historical data. The model which best takes all of the above

! facts into account is that of Abbey and Fujita (1975) . It is an empirical model whose data base is the library of tornado statistics compiled by Fujita and classified in intensity according to the F-scale damage index. Detailed

damage surveys were performed for the 148 tornadoes that occurred on April 3 and 4, 1974. The survey findings show that, in general, the F5 damage within an FS tornado is concentrated in narrow swaths no wider than about 20 meters.

It is impossible to do such an analysis for all historical tornadoes; there-fore it was assumed that gradations of F-scale damage within the tornado i

paths, as observed in this particular outbreak of tornadoes, would be typical.

In order to apply this information to all tornadoes, the damage-area-per-path-length (DAPPLE) index was created. The assumption is made that the total dam-O age area as well as tornado outbreak of general. Since path the gradations of damage per F-scale rating for the April 3 and 4,1974, is representative of tornadoes in lengths are usually the most accurately recorded tornado I

characteristic, the total damage area per F-scale intensity was normalized to the path length per tornado.

Figure 6-3 shows the findings of Abbey and Fujita (1975) for the DAPPLE index, whose derivation is discussed in their paper.

In their model the tornado risk, defined as the frequency, f, of a level of intensity F or greater at a point within the lo square of damage can be calculated by the following formula:

1

[Pg(F')][D ep (F)]

f=

Ay (6-5)

P'=P

! where PL(F') is the total path length of tornadoes classified as F', DFe (F) the DAPPLE index for damage level F and above of a category F' tornado, y the number of years of observation, and A the area of the lo square.

• In this context, risk is defined as the probability of a point being hit by a tornado.

6-7

, _ _ _ _ _ _ - ,~ . _ ___ _ _ ._ _ _

Results obtained by applying the model to the LGS site are as follows:

1. Frequency of damage level F1 and above. Using data from the NSSFC to provide the total path length of tornadoes F1 and above gives a fre-quency of damage at level F1 and above of 5.0(-5) .

2. Frequency of damage level F4 and F5. The NSSFC data show no cccur-

rences of F4 or F5 tornadoes in the 1 square centered on the plant.

l However, Figure 10(c) of Abbey (1976) indicates that in a 10,000-square-mile area in the general location of southeastern Pennsylvania there was a total path length of 6 miles in categories 4 and 5 for the period 1930-1974. Using this value gives an estimate of about 1 x 10-8 for the frequency of a point being hit by an F4 or F5 tornado.

This implies a very low frequency for tornadoes above the design basis, since the upper bound of F5 is a wind speed of 318 mph, which is close to the design wind speed.

These results are valid when the target, in our cace the turbine-enclosure area, reactor enclosure area or the cooling towers, is small compared to the average dimensions of the area of damage considered. In the event that this is not the case, the above results are underestimates. A typical dimension of the areas being considered is 500 feet. While this is small compared to a typical tornado path length, it is of the same order as the path width of the tornadoes seen in this region. It is large when compared with the width of the areas of intense damage as illustrated by the contour plots of the Xenia tornado (Abbey, 1976). Thus, while the above calculations indicate the order O of magnitude of the problem, it was felt necessary to modify this model to take into account the finite size of the target. In the next section a method of taking the finite size of the target into account is described.

6.4.3 FREQUENCIES OF THE 'IDRNADO CATEGORIES A tornado will impact a particular target if it touches down in such a way that the envelope of the tornado path includes some or all of the target.

Referring to Figure 6-4, the tornado characterized by path length L, path width w, and the direction indicated would impact the target only if it touched down within the boundary indicated, which is the locus of the point A such that one point on the rectangle enclosing the tornado path touches the target boundary.

The frequency of a tornado impacting a target may be estimated by constructing an impact area Ar using average values for the tornado width, length, and direction and estimating the frequency i as follows:

f= (6-6) where N is the number of tornadoes occurring in an area of size A around the plant in T years. Ay, the impact area, is a function of the average tornado characteristics and the target size.

O 6-8

l i

When the target size is small, At becomes the average tornado size and f(' Equation 6-6 becomes Equation 6-4. The assumption used in deriving both equa-tions is that the tornado occurs randomly within area A.

For the first category of tornado--those with a wind speed of 90 mph and above--a conservative approximation of the tornado strike probability was cb-tained by adding 500 feet (a conservative estimate of the target size) to both the average width and length of the tornadoes and using these modified averages to estimate Ar. Using the NSSFC data for tornadoes of class F1 and above gives a frequency of impact of approximately 2.3 x 10-4 per year.

This does not, however, take into account the variation in intensity within the path. The DAPPLE index (Abbey and Fujita,1975) for F1, F2, and F3 tornadoes indicates that a reduction of at least an order of magnitude in dam-age area is appropriate. Thus, a frequency of 2 x 10-5 is a conservative esti-mate of severe damage to the reactor-enclosure or cooling-tower area.

The correction for the size of the target is also important for the case of the second category of tornado--those that have a severity greater than the design-basis tornado and hence have an F rating of 5 and above. The tornado dimensions of importance here are the width and length of those areas within the tornado paths that have the maximum F rating. The width in particular can be very small, as shown by the Xenia tornado (Abbey, 1976) and by Fujita's analysis of the 148 tornadoes, which showed that the F5 damage was concen-trated in swaths usually no more than 20 meters wide. The total length of such damaging areas is a fraction of the total path length, as discussed in js EPRI NP-709, but since F5 tornadoes tend to have long paths, it is probably

() still larger than the typical target area.

The target area is the area of the reactor enclosure, control enclosure, and the diesel-generator enclosure and a characteristic dimension of this area is 300 feet, which on the basis of historical evidence is smaller than the length but greater than the width of the typical severe-damage path.

The frequency with which this area is damaged by a tornado of the second category can therefore be estimated by the following formula:

f = f(F > 5) [f 2 0 (6-7) where f(F > 5) is the frequency of tornadoes with F classification 5 and above; A is the area, in square miles, in which they occur; and <L> is the average path length, in miles, of tornadoes in these categories.

The only data available on path lengths of severe tornadoes in the region of interest are those shown in Figure 10(c) of Abbey (1976) for F4 and F5 tor-nadoes. Conservatively assigning these data to F5 tornadoes only, an estimate of f(F3 5) x <L> is given by the total path length (6 miles) divided by the time of observation (35 years), since, assuming there were j tornadoes of path lengths L i ,...,Lj, then f=1 (6-8) b v

6-9

l

<L>= (6-9) i=1 and i

f x <L> = (6-10) i=1 Since A = 10,000 square miles, an estimate of f (Equation 6-7) is x

10,000 x = (- ) per year.

In this recorded path length, no allowance has been made for a gradation of intensity along the tornado path. Table 1-7 of EPRI NP-769 (Twisdale et al., 1978a) indicates that an F5 tornado is only at intensity F5 for a fraction (.185) of its length. Applying this correction factor, it is estimated that the frequency of F5 or greater wind speeds at the reactor-enclosure area is on the order of 1.8(-7) per year.

It should be noted that this estimate is substantially in agreement with that reported in a recent study of tornado-risk models (Reinhold and Ellingwood, O 1982). Since by definition the wind speed of an F5 tornado only barely exceeds the design-basis wind speed of 300 mph, and the consensus of experts is that the greatest possible tornado wind speeds are in the region of 250-275 mph (Golden, 1976), it is believed that 10-7 is a conservative upper bound on tornado impact at or above the level of the design-basis tornado.

6.5 THE CONTRIBUTION OF TORNADOES TO CORE-MELT FREQUENCY AND THE EFFECTS ON

) RISK a

The contributior J tornadoes to core-melt frequency was estimated by adding the contriba"Cior , oC the two cases of tornadoes with severity less than j the design bas'; L ct( 't 6.3.2) and the case of tornadoes above the design basis (Sectio: 6 * . 3. csing the frequencies derived in Section 6.4. The ini-tial bounding ..,sumpua was that the Urgets specified are severely damaged.

This is a conservative assumption, since severe damage is unlikely at the de-sign level, which is that level at which the onset of damage cannot be ruled out.

I 6.5.1 TORNADOES BELOW THE DESIGN BASIS Severe damage to the turbine enclosure would cause a transient initiator.

Since the feedwater and condensate systems and the power-conversion system (PCS) have components located in the turbine enclosure, the most likely of l

6-10 l

l

those initiating events identified in the MS PRA is T p, a closure of the main-steam isolation valves (MSIVs) and loss of feedwater. The event-tree for MSI7 cleare is shown in Figure 6-5 with the functional unavailabilities suitably modified. The feedwater and condensate systems and the PCS have been considered nonrecoverable, which modifies the unavailabilities for events Q and W. The modified value for W is taken from PECo (1982b) . The unavailability of event U has been modified since the condensate-storage tank is assumed not to be available. The detailed fault-trees indicate that, given a failure of supply from the condensate-storage tank (CST) and no indication of CST level, the failure of the high-pressure coolant injection (HPCI) and reactor core and isolation control (RCIC) systems is dominated by the failure of the operator to switch over to the suppression pool, which event has a probability of .2.

This was taken in this analysis as a common-cause failure of the HPCI and RCIC systems. None of the othet functions are modified. As shown by the sequence quantification in Figure 6-5, the frequency of core melt resulting from the scenario is a negligible contribution to core-melt frequency.

Another possibility is that structural failure of the turbine enclosure could damage the offsite power-cable buses, leading to an offsite power-loss transient and little chance of rapid recovery. In this case, the contribution to core-melt frequency would be dominated by the frequency of that initiating event (2.0 x 10-5) multiplied by the probability of a common-cause failure of all diecel generators (1.08 x 10-3) . Being a TUV-type sequence, this is in the MS PRA accident Class I, and comparing this bounding frequency of 2 x 10-8 to the Class I frequency of 1.2 x 10-5 indicates that, for this case, e tornadoes below the design basis are not significant contributors to core-melt frequency or to risk.

Loss of the cooling towers as such does not lead directly to core melt but could initiate an isolation transient owing to loss of the PCS. A problem could occur if the cooling towers were to collapse and damage either the tur-bine building area or the spray-pond pumphouse or the spray pond itself.

These targets are physically separated from the cooling towers by a distance approximately equal to the height of the cooling towers so that a complete collapse covering those target areas is highly unlikely. Damage to the turbine-building area has already been discussed.

In order to be a significant contributor to core-melt frequency and thus to the risk of latent-cancer fatalities, a tornado-induced collapse of the cooling towers onto the spray pond and pumphouse would have to occur with a frequency exceeding 10-6 per year. This implies that, given a collapse, the probability of severe damage to the spray pond or the pumphouse would have to be greater than 10-2 Such accidents would be allocated to Class I or Class II and would have a negligible effect on the risk of early fatalities, which is dominated by Class IV aacidents.

Damage to the cooling towers could produce missiles. The spray-pond pumphouse, however, is designed to withstand aircraf t impact, and it is dif-ficult to imagine how a concrete missile that is likely to shatter on impact can have a worse effect than an aircraft. Substantial damage to the spray pond itself seems unimaginable owing to its size, its distance from the cool-ing towers, and the physical separation of the spray networks. Consequently, 6-11

collapse of the cooling towers is not deemed a significant contributor to either core-melt frequency or risk.

The impact of a tornado on both the turbine-building area and the cooling tower is an event of lower frequency than such an impact on either area sepa-rately and the consequences are no more severe.

Consequently, tornadoes below the design basis are judged to be insignif-icant contributors to risk.

6.5.2 'IORNADOE3 ABOVE THE DESIGN BASIS In Section 6.4.3 it was estimated that the frequency with which a tornado greater than the design basis strikes the reactor-enclosure area is less than 10-7 Such an event could cause significant damage to the reactor enclosure and the control structure. The damage, if severe enough, would lead to core me lt ,- since all control could be assumed to be lost. It coald, however, sig-nificantly affect risk only if it led, with a probability close to 1, to acci-dent sequences that would be allccated to Class IV. However, it is expected that since all control, and thus all inventory makeup, would be lost, the most likely accidents would be allocated to Class I, with some very small possi-bility of Class III accidents if somehow the automatic shutdown system were to be rendered inoperable. This is a remote possibility because of the physical location of the components of the system and its fail-safe nature. In any G case, since Class III and Class I accidents are treated the same in the IGS PRA with respect to consequences, the precise allocation is unimportant, and, at an overall frequency of 10-7 per year, the contribution to risk is insignificant.

6.

5.3 CONCLUSION

S On the basis of the evidence concerning the frequency of various levels of tornado damage, the opinions of experts on tornado characteristics, and the protective measures taken at the plant, it is judged that tornadoes would have a negligible effect on core-melt frequency or on the risk of operating the LGS.

O 6-12

REFERENCES O'

'-- Abbey, R. F., Jr., 1976. " Risk Probabilities Associated with Tornado Wind Speeds," paper presented at the Symposium on Tornadoes, Lubbock, Tex.,

June.

Abbey, R. F., Jr., and T. T. Fujita, 1975. "Use of Tornado Path Lengths and Gradations of Damage To Assess Tornado Intensity Probabilities," paper presented at the Ninth Conference on Severe Local Storms, Norman, Okla.,

October 21-23.

Fujita, T. T., 1971. " Proposed Characterization of Tornadoes and Hurricanes by Area and Intensity," SMRP Paper No. 91, University of Chicago, Chicago, Ill.

Fujita, T. T., and A. D. Pearson, 1973. "Results of FPP Classification of 1971 and 1972 Tornadoes," paper presented at the Eighth Conference on Severe Local Storms, October.

Garson, R. C., T. M. Catalan, and C. A. Cornell, 1975. " Tornado Design Winds Based on Risk," Journal of the Structural Division, ASCE, Vol. 101, No. 579, pp. 1883-1897.

Golden, J. H., 1976. "An Assessment of Wind Speeds in Tornadoes," paper pre sented at the Symposium on Tornadoes, Lubbock, Tex., June.

Markee, E. H., J. G. Berkely, and K. E. Sanders, 1974. Techr:! cal Basis for

'N Interim Regional Tornado Criteria, WASH-1300, available at U.S. Govern-ment Printing Office, Washington, D.C.

PECo (Philadelphia Electric Company), 1982a. Limerick Generating Station Final Safety Analysis Report, Philadelphia, Pa., Section 3.3.

PECo (Philadelphia Electric Company), 1982b. Quantificaticn of Event Tree Functions, Philadelphia, Pa.

l Reinhold, T. A., and B. Ellingwood, 1982. Tornado Damage Risk Assessment, l NUREG/CR-2944, BNL-NUREG-51586, September.

Thom, H. C. S., 1963. " Tornado Probabilities," Monthly Weather Review, Vol. 19, pp. 731-736.

I Twisdale, L. A., W. L. Dunn, and J. Chu, 1978a. Tornado Missile Risk Analvsis: Appendices--Analvtical Models and Data Bases, EPRI NP-769, Electric Power Research Institute, Palo Alto, Calif.

Twisdale, .. A., W. L. Dunn, and J. Chu, 1978b. Tornado Missile Simulation and Risk Analysis, Proceedings of the ANS meeting on Probabilistic Anal-ysis of Nuclear Safety, Newport Beach, Calif., May 8-10.

6-13

USNRC (U.S. Nuclear Regulatory Commission), 1978. Tornado Design Classi-fication, Regulatory Guide 1.117, Washington, D.C.

Wen, Y. K., and S. L. Chu, 1973. " Tornado Risks and Design Wind Speeds,"

Journal of the Structural Division, ASCE, Vol. 99, No. ST12, pp. 2609-2421.

6-14

\

1

Table 6-1. Characteristics of selected missiles generated by the design-basis tornado Weight velocity Missile (lb) (mph)

Wood plank (4 in. x 12 in.

x 12 f t) 200 300 Steel pipe (3-in, diameter x

10-ft schedule 40) 78 100 Automobile (not more than 25 ft above ground, 2

20-ft contact area) 4000 50 i

j I

l l

6-15 1

I 1

- - - - - - _ , -. , _ _ , _ _ . _ _ _ _ . _ . . _ . . _ _,______.___...._1

l 1

Table 6-2. Tornado-protected systems and their i tornado-resistant enclosures Protected system or component Tornado-resistant enclosure Reactor-coolant pressure boundary Reactor enclosure Emergency core-cooling system Reactor enclosure Residual-heat removal system Reactor enclosure Residual-heat removal service- Reactor enclosure and spray-water system pond pump structure Emergency service-water system Reactor enclosure, diesel-generator enclosure con-trol structure, and spray-pond pump structure Reactor-enclosure cooling-water Reactor enclosure system Fuel-pool-cooling system Reactor enclosure Fuel pool Reactor enclosure Control-rod-drive hydraulic system Reactor enclosure Standby liquid-control system Reactor enclosure Standby diesel generators Diesel-generator enclosure Gaseous-radwaste system Radwaste enclosure Control room Control structure Control-structure chilled-water Control structure O. system various electrical, instrumentation, Reactor enclosure, diesel-and control equipment required generator enclosure, for safe shutdown spray-pond pump structure i

6-16

)

Table 6-3. FPP classification scheme for tornadoesa 1

Interpre tation b F, Pg , or P,# Vp (mph) L (miles) w (yd)

Negative Less than 40 Less than 0.3 Less than 6 0 40-72 0.3-1.0 6-17 4 1 73-112 1.0-3.1 18-55 2 113-157 3.2-9.9 56-175 4

3 158-206 10-31 176-556 d

4 207-260 32-99 0.3-0.9 5 261-318 100-315 1.0-3.l d 6 319-380 316-999 3.2-9.9 d

aSource: Fujita, T. T., and A. D. Pearson, 1973. "Results of FPP Clas-sification of 1971 and 1972 Tbrnadoes," paper presented at the Eighth Confer-ence on Severe Local Storms, October.

b V , L, and w are defined in terms of F, P , or Pw in Equations 6-1, P L 6-2, and 6-3, respectively.

C Negative numbers or numbers higher than 6 may be used whenever necessary, din miles.

l l

l l

6-17

- .- . . - - -._ . - , . . . . . . . . - - . . - - . - - _ . . -.-..~ _ - . . - .-

Table 6-4. Number of tornadoes as a function of F-scale rating, 1965 and 1971-1975a Year F5 F4 F3 F2 F1 F0 Total 1965 1 10 49 150 391 292 893 1971 2 23 72 256 367 152 872 1972 0 11 43 174 343 169 740 1973 1 24 82 288 494 214 1103 1974 6 30 102 200 369 213 920 1975 _1 9 42 193 362 307 914 Tbtal 11 107 390 1261 2326 1347 5442 Percentage .20 1.97 7.17 23.17 42.73 24.75 Cumulative percentage 2.17 9.34 32.51 75.24 99.99 aAdapted from Abbey, R. F., Jr., 1976. " Risk Probabilities Associated with Tbenado Wind Speeds," paper presented at the Symposium on Tornadoes, Lubbock, 'fex. , June.

O 6-18

Q V

\ ==

-- SN s

,=.: , j

/

e

\

a f

'JW( \ I C

1 <

+ -A ,

//

i: -

f =. yrdh =-

\

//,/ /

% /

e g - fr u<m:=:sm z~'%  ; p ,- //

4 >~

/p /

\ .

x \ s

..., a 3 i1 .

e= /

\

\

\

\\\ -< qA' _~ =jp==:3"';.

943 =- .

Ag f,].

\ .

1

\N\v% \W#[ g i 6  ::::,- 1 =

.WE

1) M ]j - .e ' .; ,

Jt n

s ger d

x

\ s,

~

x

=y0- ,,. . 7 I- ; :;-l :::-

g::.;=D -y -

g '\\

't? ,

x ...

^pf'= h t=! .... l",7 H",7 k,,* ,

~~-- -

-fe (j //. '-

- f, s

\. g g q % -

a <

n e.,4 #p-k""q[,

\

g N

+

' *!g, E '*3 w-- [/ -fl'~ f

's . .

s'

\

s A

x .~ (; /gp* /

', gi ;- .

x -

+

'""Q% t .. -%

- ' T*. t **/g s

\

Eg. '

q #

' N. '*N';, 49* ylf V i +4 N

.w.- *

. Yy,v/

+

..,,, ,,m

q 7,' 8 /

t,

\5O \., g Ms\

s ,y v'% ^> t , 'Ab=/ , '"Z" ll"

,e . b. s , /

. .. s~ >

,d""qv'f,-

F \ ^

v 9Ch P.a..=r . =.1 -

Figure 6-1. Plot plan of Limerick Generating Station.

l l

l ng l y$w HO$>oOg I

I 2 , o2 L. e$ .,Y8e3 ya0 t

I I

-o' b l I

e la I c

N E' s

F 1 y

b s

e o 1

- d a

n r yo .

l

_ t o

- f o

J r l E

e b

m u l R

N s

1 e B

o d

a l n r

E o

T i ' 3 u8 l

' F E

' 0 3

' 3 l

E s

e l - o

- d E

a 4

F n

r 1 - -

5 o 9

T

/ 5 E [

. F l

0

- ^ _ 1

.- ~

o .  :

o9 _  : pO n c'o D Ca a pa9

• 3 x y ci W $' gel E$

fin 3 E"

~3RQ EE

.  ?'

) q6 ! .

[ Q  !! n gO:Ss$O3 g25' e

l O F Scale l

0 1 2 3 4 5 100 l I Violent (o e F4F5 Tornadoes Tornadoes l .7 X 10-1 i

Strong ( e F3 Tornadoes o F2 Tornadoes 2.5 x 10-1 w

' i 1.6 X 10-1 Weak [$ F1Tornadoes O FO Tornadoes 10-1 h7.1kh x 10-2 5.3 X 104 s \

\ -1.8 X 10-2 g .5 X 10-2

\

\ \ 10-2 g \ .o i b U \

\

\ \ 3.6 X 10-3 g3 3.4 X 10-3 3.2 X 0-3 g

\

\ \ \ \ \

\ \ \ ^

\ \ \

\

T S  %,

I i \ s  % '

10-3

, \ \

'g S \

\ \

\ \

] -

6.0 X 10-4

\ \

\gs\ \

\ -

%\ g \

T #] ~^N\\\{g

\ \ \

1 g

\

g \

\

g\ \s i +1.6 x 10-4 g g \ \\\

\ k \ \ \ \ \\\ 30-4 Source Abbey, R F., Jr., and T. T Fujita.1975 "Use of Tornado Path Lengths and Gradations of Damage To Assess Tornado intensity Probabilities." paper presented at the Ninth Conference on Severe Local Storms, Norman. Okta..

October 21-25 Figure 6-3. Damage area per path length (DAPPLE) as a function of F-scale rating.

i i

O i

b Rectangle drawn to A indicate length, width.

and direction of tornado path

/ \

/

/

s' />

O

/

/

/

s' 3'/

- \

Target g -

/

/>

s'/

"i' /

/

! /

%/

l Dark line reoresents boundary constructed us of by following foc point A such that the rectangle enclosing tornado path just touches the target boundary. Four representative positt ns of the rectangle are indicated.

Figure 6-4. Definition of boundary of touchdown a are t

for tornado impacting a target.

O

O O )

RHR and Generalized S/R S/R Cond/FW HPCI Timely LP c

cs e Reactor " Estimated o 7 v Ives valves and PCS or RCIC ADS ECCS Sequence ,

and loss of subcritical PC s pen reclose available available actuated available designator degraded feedwater available probabIt TF C M P Q U X V W condition 0 _ __ _

TpO' OK

,9 u

9 X 10-6 TpOW(Q) 2.0 X 10-10 Class 11 a

1 TpOU* OK -

n 8 5 X 10-6 TpOUW(Q) Negligible Class 11

.2 7.7 X 104 TpOUV 2.0 X 10-10 Class 1 04 T,QUX 8.0 X 10-9 Class 1 0

10-2 i F T M -

(Multiple valves fail to reclose) 1 y

Tp POU

• OK -

l n 8 5 X 10-6 TpPQUW(PQ) Negligible Class il 2(-5) .2 7.7 X 10-5 TpPQUV Negligible Class I

) 2 X 10-TpPQUX 8.0 X 10-11 Class 1 10-6 Transfer TpMt (2.0X 10-11) 3 X 10-5 TpC" 6.0 X 10-10 -

1 Not core-melt sequence

" ATWS initiators are treated in a separate event-tree t Transfer to large LOCA event-tree Source- LGS PRA(adapted from Figure 3 4 3) 4 Figure 6-5. MSIV closure / loss of feedwa.ter/ loss of main condenser transient-event-tree.

l

\ Chapter 8

[G ANALYSIS OF ACCIDENTS RESULTING FROM TURBINE MISSILES

8.1 INTRODUCTION

The objective of the analysis reported here was to estimate the con-tribution to the frequency of core melt and to the frequencies of the vari-ous classes of accident sequences due to missiles resulting from rupture of the disks on the main turbire at the LGS. While the frequency of such an event is low (historically on the order of 10-4 to 10-5 per year (Bush, 1978), the missiles may be energetic and consequently may have the potential for damaging equipment essential to the safe shutdown of the plant. Figures 8-1 and 8-2 show the areas of the plant considered vulnerable.

The LGS FSAR analysis has shown that the frequency with which a tur-bine missile strikes and damages safety-related equipment is exceedingly low (4.11 x 10-10). The analysis used a very low value for the frequency of a turbine failure resulting in the ejection of a missile (5 x 10-9) . This is based on an assessment of the probability of brittle fracture of the disks and the frequency with which a severe turbine overspeed condition might occur. Historical evidence, which includes data from a very heteroge-neous population of turbines, indicates numbers on the order of 10-4 to 10-5 per year. The Philadelphia Electric Company (PECo) has, however,

{g committed to the Nuclear Regulatory Commission to carry out a maintenance program aimed at assuring a turbine-missile-generation frequency of 10-5 g _ ,/

per reactor-year or less.

Using the 10-5 frequency, it is demonstrated in Section 8.2 that the probability of damage by a turbine missile that could lead to core melt is low enough that turbine missiles are insignificant contributors to risk.

8.2 ANALYSIS OF FREQUENCY OF DAMAGE RESULTING FROM TURBINE MISSILES The frequency of damage caused by turbine missiles (fd) is estimated in the LGS FSAR as follows:

~

d" 1 2 3 where P1 is the frequency of a barbine failure resulting in the ejection of a missile; P2 is the probability that a missile ejected from the lD) a 8-1

turbine will strike a barrier that protects a critical plant component;

• and s_, P3 is the probability that an impacting missile will damage the barrier sufficiently to damage a critical plant component.

The detailed calculations presented in Table 3.5-2 of the LGS FS AR show that P2, the probability of striking a wall or roof within the targe t-impact zone, is 9.70 x 10-2, of which 8.67 x 10-2 comes from the reactor enclosure. A value of 9.7 x 10-2 for P2 is, however, a conservative estimate, since these are large areas in the plant where there is no safety-related equipment or cabling. There is no safety-related equipment on the target area in the control enclosure, which, because of the equipment it contains, is potentially a very vulnerable structure. Based on the observa-tion that only a fraction of the wall space is actually in the vicinity of safety-related cable raceways or equipment, a factor cf 10 reduction in the value of P2 is considered appropriate for the reactor enclosure.

Missile damage to the other plant structures were ruled out as a sig-nificant contributor to core-melt frequency because of the low probability of missile impact even without taking into account the factor associated with the probability of damage to the equipment within these structures or that other independent failures would have to occur before core melt.

In the LGS FSAR, the product of P2 and P3 was estimated as 8.4 x 10-2 The damage criterion used in the FSAR evaluation is such that almost any missile that strikes the barrier produces acabbing and thus dam-ages the barrier, so that P3 is essentially unity. The particular damage p criteria used in the LGS FS AR evaluations were reviewed by R. Kennedy of t l Structural Mechanics Associates (Kennedy, 1982). The following observations were made:

1. Based on available turbine-missile tes t data, it is felt that the formula used to predict scabbing thickness and velocity is conservative.

2. The scabbed concrete is generally lightweight and of low velocity and is unlikely to cause any damage to equipment protected within cabinets or to exposed rugged mechanical components, although small-diameter piping, exposed cables, or instrumentation near the walls might be damaged.

Kennedy estimated that P3 may be conservative by more than an order of magnitude.

Taking these factors into account, the frequency of damage (fd) to safety-related equipment in the reactor enclosure is estimated to be on the order of 10-8 per year for a missile-generation production frequency of 10-5 per year, the probability of a missile hitting the reactor enclosure

• The barriers considered are in fact the walls and roof of those plant structures housing critical components and lying in the missile-ejection zones.

[

v 8-2

i a

\

in the vicinity of safety-related equipment on the order of 10-2, and a probability of equipment damage resulting from concrete scabbing on the order of 10-1 Furthermore, the frequency of damage to safety-related equipment should not be equated to the frequency of core melt. The equipment most suscep-tible to damage is the cable raceways. As discussed in the Fire Protection Evaluation Report (FPER) (PEco, 1981), cabling and equipment associated with

' differgut shutdown methods are generally physically separated by 20 feet or more. No areas in the target zone were identified where this was not so.

Consequently, if one of the shutdown methods discussed in the FPER is avail-able, there is a conditional probcbility of core melt of less than 10-2 per year. Thus, it is concluded that turbine missiles represent a negli-

, gible contribution to the frequency and risk of core melt.

1 i

t I

i 1

i

\

8-3

-. . . - = - . = - . _ . . . . - _ . _ _ _ - .

l i

i I

l REFERENCES

Bush, S. H., 1978. "A Reassessment of Turbine-Generator Failure Probabil-1 ity," Nuclear Safety, Vol. 14, No. 3, pp. 197-201.

Kennedy, R. P., 1982. Letter to G. Parry, NUS Corporation, June 30.

PECo (Philadelphia Electric Company), 1981. Fire Protection Evaluation Report: Revision I.

i I

i l

l l

l a

i s

)

l l

8-4

1 O .. .-

a g ,#

% ,/

%/j#

~

,s'  %

p* O  %,

,f' *s -

?. .8 2

o l c l E E E 0 0

$ N 8 m g O

i a 5

- .s

, 'E

~' ~,, .h

~ % _, y e

c 5

it

\

,' ' 'N ,,

f _5$

,' s ,. ag

,,,' 's ,

N a2a

,'s e a

,'N 2 o

,'s,' s, 5, g@ i a

,2 e 'E a c,)/

8 E I x.. l

' " 0 O' 0 0 0 1' 3' ' 3' 2' 3 1 3 5 5 8 2 3 3 3 2 .

l

. l l .

E l

E E E l E

s n

I o it a

v e

le s

e n

o z

n i

o t

c j

e

_ e l

e is s

im -

e n

ibr u

T 2

_ 8

_ e r

. u

. r.L ig

. F a.

L

_ g n

. i d

_ l .

n iu L o

b it s

e a f

o ce

_ n e yj

_ ib r r e r

u a a t

dl e

_ T e ni

. g s e r us n

_ d T B mzo a oi

_ n -

e _

eh-L g _

s

O r

Appendix H SUPPORTING DATA FOR FLOODING ANALYSES O

O

l TABLE OF CONTENTS Page H.1 Industry Flood Experience and Frequencies H-1 H.2 LGS Fluid Sources H-1 F-il

l l

H.1 INDUSTRY FIDOD EXPERIENCE AND FREQUENCIES v

To ascertain industry experience with internal flooding, a review was made of information contained in Nuclear Power Experience (NPE) (Verna, 1982).* This document provides event summaries of significant incidents occurring in light-water reactors. The event summaries can be referenced through a keyword listing. For this analysis, the keyword listing was re-viewed to identify events related to internal flooding. Five keywords or phrases were found that could be relevant: " flooded area," " flooding," " water movement damage," " water pool leak," and " wet wiring." The events associated with these keywords were examined to determine their relevance to this analy-sis. Occurrences of internal flooding in both boiling-water reactors (BWRs) and pressurized-water reactors (PWRs) were reviewed, because some areas of the plant ate common to both designs. The reporting period covered by these events is through March 1982; this represents approximately 257 reactor-years of BWR operation and 343 of PWR operation. Table H-1 provides a summary of internal-flooding events reported in NPE.

From the events shown in Table H-1, generic flood frequencies were derived. The frequencies are shown in Table H-2 as a function of all plant locations, major plant structures, or rooms within major structures. In some cases, the location of a flood could not be determined exactly from the event description; thus, it may be counted as a contributor to more than one flood location.

/

Q) H.2 ISS FLUID SOURCES Table H-3 contains a list of tha fluid sources identified in a review of the Limerick FSAR. Included in the table is information on the normal state of the fluid source, its magnitude, the fluid type, and the location of the source.

• Verna, B. J., 1982. Nuclear Power Experience.

D H-1 l

l

O Table H-1. Summary of internal-flooding events NPE itema Affected system Event Comments BOILING-WATER REACMRS VI.E.31 Condensate ard feedwater During backwash of condensate deminer- No indication whether alizer traps, valve malfunctioning reactor or turbine trip i

caused the backwash-receiving tank to occurred. Appears to overflow into the turbine-building have been no significant equipment drain sump. The sump capac- damage to the power ity was eventually exceeded, causing conversion system (PCS).

overflow onto the turbine-building floor and into drains feeding the nor-mal waste cump. To prevent discharge to the environment, the normal. waste m sump pumps were eventually turned off.

b About 123,000 gallons of water accumu-lated in the turbine building.

VI.E.33 Condensate and feedwater After receipt of a condensate pumproom May have been significant flood alarm, an operator noted approxi- damage to PCS.

nately 6 inches of water in the room.

'*he source of the water could not be immediately determined. About 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> later, the water had risen to approximately 20 inches and it was determined that the source was a rup-tured condensate-booster-pump vent line. It was felt that the line could not be repaired in time to prevent the rising water level from reaching the pump motors; thus the unit was manually scrammed. Leakage was contained in the turbine building.

b O O d U d Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments BOILING-WATER REAC'IORS (continued)

VI.F.2 Condensate and feedwater Work was being performed on the flow- Plant not at power during circulating water reversing valves of the main condenser incident. However, simi-when a butterfly valve on the northeast lar incident during oper-water box slammed shut. This caused ation cannot be ruled out.

the rupture of a rubber expansion Significant damage to PCS.

joint, allowing river water from the circulating-water system to flood the condensate pumproom in the turbine-building basement. Water eventually reached a level of 15.5 feet in the a: basement. Equipment damaged by the b flood included four service-water pumps of the residual-heat removal system, two diesel-generator cooling-water pumps, four condensate-booster ]

pumps, three condensate-transfer pumps, four equipment- and floor-drain sump pumps, and condensate-system pressure gauges and transmitters.

VI.F.25 Circulating water A rubber expansion joint of the Incident occurred during cooling-tower pump failed, causing shutdown.

flooding of the discharge structure.

VII.E.44 High-pressure coolant The high-pressure coolant injection See item VII.E.46 for injection (HPCI) system was automatically initi- similar incidents at same ated after a scram. During a subse- plant.

quent routine inspection of the area, it was observed that the upper head ,

O {- /*

I) x s O Table H-1. Summary of internal-flooding events (continued) 1 Event Comments NPE itema Affected system BOILING-WATER REACERS (continued) 4 VII.E.44 gasket on the gland-steam condenser (continued) was leaking and had caused flooding of the sump; this, in turn, had caused failure of the gland-steam condenser hotwell pump and the drain valve of the exhaust-line drain pot.

VII.E.46 High-pressure coolant The HPCI system was manually initiated after a scram. During a subsequent (two events) injection routine inspection of the area, it was observed that the upper and lower gas-y kets on the gland-seal condenser were leaking and had caused flooding of the suinp surrounding the HPCI turbine; -

this, in turn, caused flooding of the gland-steam condenser hotwell pump.

A similar sequence of events occurred about 1 month later.

VII.E.147 High-pressure coolant Following a reactor scram, the supply injection line to the condensate-ring header in (two events) the torus room failed at a welded Core spray joint. The failure resulted in the loss of 80,000 gallons of condensate, which flooded the room housing core-spray pumps A and C and then overflowed the door base into the common torus

" floor area. The probable cause was

' identified as weld fatigue covered by line movement during repeated

I'

\ s Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments BOILING-WATER REACTORS (continued)

VII.E.147 operations of the HPCI system. A (continued) similar event had occurred about 6 months earlier.

VIII.C.110 Residual-heat removal After a reactor scram, the residual- Incident also caused a heat removal (RHR) system was to be spurious withdrawal of Service-water core spray placed into the shutdown-cooling mode transversing incore probe.

of operation, which required the use of an RHR service-water train. When the service-water train was in opera-tion, water was observed spraying from ni the 20-foot elevation in the reactor b building. The source of the spray was a ruptured flange gasket on an RHR service-water heat-exchanger outlet valve. Another RHR and RHR service-water train were placed into operation.

When an attempt was made to place the second RHR loop into operation, a valve would not open because a pressure switch failed (from water damage), pro-ducing a false indication of high reac-tor pressure. The reactor pressure was verified to be low enough and a safety-I related jumper was issued to open the

valve. The spraying caused damage to a core-spray pump and the flooding of its room; damage to core-spray instrumentation also occurred.

a O O C ~

Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments BOILING-WATER REACTORS (continued) i VIII.C.153 Service water During maintenance at power, a service- Appears to have been no water valve was overpressurized, significant damage to causing a blowout of the valve-body PCS.

seat. This disabled one train of the service-water system, placing the plant in a limiting condition for operation.

VIII.C.169 High-pressure coolant During a test of the HPCI turbine, the injection auxiliary HPCI oil pump tripped, caus-ing the HPCI turbine to trip. The aux-iliary oil pump was shorted out because y of a high water level in the HPCI room; the high level was caused by a backflow through the sump drain from the drain-collecting tank ar.d by the pumping of water from core-spray and RHR sumps to the HPCI room for transfer to radwaste.

VIII.C.178 Plant-drainage system The plant used a drainage system encir- Appears to have been no I

cling the reactor building and the tur- significant damage to bine building. The system included two ECCS or PCS.

wells and two pumps to control the level of ground water. Because both pumps were out of service, inleakage occurred through construction joints

' in the reactor and turbine buildings.

This inleakage exceeded the capacity or the radwaste system; thus, some flood-ing of basement floors and sumps occurred.

I

Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments BOILING-WATER REAC'IORS (continued)

XI.A.45 Emergency power Packing leakage from the diesel-building steam-heat-condensate return unit ran onto the floor over to the voltage regulator and control panel for a diesel generator. This caused the failure of a diesel generator during a test.

XII.67 Radwaste A clean demineralized-water hose rup-tured in the radwaste-reboller room, flooding the radiation-contaminated m floor.

O XIV.A.77 Emergency power During modifications of the fire- '

protection system, water ran down into the diesel-generator control cabinet causing a diesel auto-start block alarm. The alarm was tripped when the auto-start relay contact was shorted.

The diesel generator was declared inoperable.

XVI.C.377 Low-pressure coolant During a test, river water spilled from Incident occurred during injection a disassembled low-pressure coolant shutdown.

injection heat-exchanger water outlet Core spray valve into a low-pressure coolant injection / containment spray pumproom.

About 3.5 feet of water collected in the room. The cause of the flood was personnel error (i.e., failure to adhere to proper procedures).

~'N ("%

(\ })

j ~J

) (

w)

Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments PRESSURIZED-WATER REACTORS V.A.40 Reactor coolant A seal on a reactor-coolant system Event represents a small (multiple (RCS) pump leaked, flooding the con- loss-of-c;oolant accident events) tainment with approximately 130,000 (LOCA).

gallons of water. The leak rate was greater than the capacity of the charg-ing pumps; thus, SI was initiated. The incident caused flooding of 650 feet of piping near the containment basement.

Two other incidents of primary-system seal failures were reported; however,

[ these apparently did not result in sig-nificant flooding of the containment building.

V.A.84 Reactor coolant A seal on an RCS pump failed, resulting Event represents a small in the leakage of approximately 42,000 LOCA.

gallons of primary coolant onto the basement floor of the reactor building.

V.B.10 Reactor coolant A pressure-transmitter sensing line Event represents a small failed, resulting in a breach of the LOCA.

RCS. It was estimated that approxi-mately 5300 gallons of primary coolant was discharged to the containment.

Table H-1. Summary of internal-flooding events (continued)

NPE ftema Affected system Event Comments PRESSURIZED-WATER REACTORS (continued)

V.D.133 Feedwater During low-power physics testing, a valve that isolated a steam generator from its blowdown tank leaked, allowing secondary water to overflow the blow-down tank and spill over into a venti-lation duct. The failure of the valve to close was caused by a sludge buildup on the valve seat.

V.F.5 Reactor coolant During a reactor-plant-container leak test, approximately 9000 gallons of pri-y mary coolant leaked into the reactor

[

t e chamber. The cause was open tell-tale drain valves between the double pair of closed isolation valves in two isolated reactor-coolant loops.

VI.D.176 Main steam A main-steam isolation valve (MSIV) closed as a result of the failure of its air solenoid. The closure of the MSIV resulted in a sequence of events that included actuation of the contain-ment sprays for about 2 minutes; ap-proximately 50,000 gallons of borated water ended up in the containment-building sump.

l

O Table H-1. Summary of internal-flooding events (continued) i t

NPE itema Affected system Event Comments PRESSURIZED-WATER REAC'IORS (continued) l VI.E.200 Feedwater Subsequent to a transient in the con- Event represents a small, 1

" densate and feedwater system, a major transient-induced LOCA. ,

accident sequence occurred. Events of '

this sequence included a stuck-open i PORV, the rupture of a pressurizer- I 4

quench-tank rupture disc, the pumping i of water from the centainment to the auxiliary building, and the overflow of the tanks in the auxiliary building.

Approximately 150,000 gallons of pri- i i

mary coolant was ultimately released to m the containment.

N VI.E.214 Feedwater During the cleaning of a secondary- May have been significant services heat exchanger, a solenoid damage to PCS. L failure caused the opening of a l

seawater-inlet block valve. Seawater '

then flowed through the circulating-water pump into the turbine building.

The water contacted and shorted out the  !

local centrol switches, thereby caus-ing both condensate pumps to trip. t i

VI.F.52 Circulating water During a test of a circulating-water pump, before the return of the plant from a refueling outage, the pump cas- i ing split, spilling water into the '

circulating-water pumphouse. All six circulating-water pumps and motors were flooded.

l t

N s_-

Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments PRESSURIZED-WATER REAC'IORS (continued)

VII.B.28 Containment spray An inadvertent actuation of the containment-spray system resulted in approximately 650 gallons of water being sprayed into the containment.

The reactor-coolant drain-tank pump motors, cavity-fan motors, rod-drive fan motors and RCS isolation-valve motore were sprayed, but their opera-tion was apparently not affected.

VIII.A.216 Residual-heat removal During a refueling outage, the head i i (also gasket on the spent-fuel pool deminer-U VIII.B.134) Containment spray alizer failed, causing a large volume i of water to spill into the auxiliary Safety injection building and accumulate in a passage- l way. As a result of operator actions to pump out the passageway, and leaks in the waterproof barriers of engineered-safety-feature roocas, water was found in rooms containing RHR pumps A and B and containment-spray pumps A and B.

VIII.B.30 Nuclear instrumentation During a monthly test, two cooling and head gaskets in a control-rod-drive mechanism cooling fan failed, leading

to flooding of the fan intake plena.

Water then proceeded to an area where l

i 4

i Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments '

PRESSURIZED-WATER REACTORS (continued)

~

i VIII.B.30 nuclear instrumentation thimbles are (continued) located. The reactor tripped because  !

of an indication of overpower from i these thimbles. Other instrumentation l I

affected included the high-temperature detector and intermediate- and short- I range monitors.

, VIII.B.54 Service water A service-water pump seal leaked, fill- No apparent damage to PCS.

I ing the valve pit with water and caus- t ing an electrical short in the motor

. 7 operator.

I U I VIII.B.101 Residual-heat removal During shutdown, a flexible service ,

j water pipe to a fan-coil unit ruptured

] and sprayed an electrical panel. The j resulting short caused erratic RCS hot-  !

, leg pressure indication and consequent closure of an RHR valve, thus inter-

! rupting the operation of that RHR loop.

t VIII.B.134 (Same as VII.A.216?)

i  !

.VIII.C.6 Low-pressure injection Owing to failure of the operator to l isolate an LPI header, 3 feet of water j Containment spray accumulated in a room containing two l low-pressure injection pumps and two l containment-spray pumps. Both spray [

pumps were submerged, removing one i

train from service for each of two  !

reactor units.

1 1

I  !

) V Table H-1. Summary of internal-flooding events (continued) i i

NPE itema Affected system Event Comments PRESSURIZED-WATER REACMRS (continued) 2 XI.A.229 During shutdown, a transient in the dc power system initiated an SI sig-nal. Three code safety valves had been I

removed from the pressurizer for main-tenance, so that when the SI tanks dis-l charged into the RCS, there was an 1

overflow of approximately 25,000 gal-1cns of coolant into the containment.

XI.B.163 Condensate and feedwater During a refueling outage, the conden- Plant shutdown. No

ser was open for maintenance. Because apparent significant j

of a solenoid-valve failure, water damage to PCS.

[ flowed from the condenser onto the turbine-building floor. '

XI.B.299 (Same as VI.D.176)

XII.53 Liquid radwaste Because of improper design and con-(multiple struction, the capacity of the liquid-events) radwaste system was too small. This i resulted in numerous incidents of over-flowing and flooding of the lower level of the auxiliary building until the radwaste system was modified.

3 O J

)

Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments PRESSURIZED-WATER REAC'IORS (continued)

XIII.40 Containment-gas filter As a result of leaking equipment, some contaminated liquid accumulated on the basement floor of the containment.

This water apparently got into the con-tainment iodine filters, greatly reduc-ir.g their efficiency.

XVI.B.34 Reactor coolant During the initial fuel load, valves were mispositioned by the operator, allowing water to flow from the j3 refueling-water storage tank (RWST)

Z onto the refueling-cavity floor.

XVI.C.149 Reactor coolant During shutdown, inspection was being performed on the steam generators.

Residual-heat removal Owing to operm 3r errors, the RHR system was disabled, resulting in increased RCS temperature. It was reported that " steam was exiting the RCS through the steam generator manways and the water level had increased in the RCS and water was also spilling out of the generator manways."

XVI.C.226 Emergency core-cooling During a safeguard-valve operation

! system test, a flow path from the RWST to a containment sump was inadvertently 4

\ D R.

)

d Table H-1. Summary of internal-flooding events (continued)

NPE itema Affected system Event Comments PRESSURIZED-WATER REACTORS (continued)

XVI.C.226 left open. Approximately 12,000 gal-(continued) lons of refueling water were trans-ferred to the containment. There was no apparent damage to any equipment.

XVI.C.518 Emergency service water A valve pit containing two emergency Incident occurred during service-water (ESW) valves was flooded zero-power testing. No because of open drain valves in the ESW apparent significant dam-lines. The incident occurred during age to PCS.

zero-power physics testing before the 7 installation of sump-level alarms.

. Cl l XVI.C.679 Service water During cold shutdown, while the main Plant shutdown. No condenser was being drained, a valve apparent significant dam-pit containing a service-water valve age to PCS.

was flooded, disabling the valve in its automatic mode.

XVI.C.771 Reactor coolant During inspection of the steam genera-tor during a cold shutdown, flooding occurred through the open primary man-ways of the steam generator. The cause of the flooding was overflow of the RCS by water injected through a low-pressure safety injector line from the RNST; problems had been experienced in determining the RCS hot-leg level necessary to prevent the overflow.

aNPE = Verna, B. J., 1982. Nuclear Power Experience.

l a

a

Table H-2. Flooding frequencies derived from industry experience" Frequency per b

Location reactor-year Events All plant locations BWR: 0.070 VI.E.31, VI.E.33, VI.F.2, VI.F.4, VI.F.25, VII.E.44, VII.I:.46, VII.E.147, VIII.C.110, VIII.C.153, VIII.C.169, VIII.C.178, XI.A.45, XII.67, XIV.A.77, XVI.C.377 PWR: 0.078 V.A.40, V.A.84, V.B.10, V.D.133, V.F.5, VI.D.176, VI.E.200, VI.E.214, VI.F.52, VII.B.28, VIII.A.216, VIII.B.30, VIII.B.54, VIII.B.134, VIII.C.6, XI.,B.163, XI.B.299 Overall: 0.075 XII.53, XIII.40, XVI.3.34, XVI.C.149, XVI.C.226, XVI.C.518, XVI.C.679, XVI.C.771

n Turbine building (all) BWR: 0.019 VI.E.31, VI.E.33, VI.F.2, VIII.C.153, VIII.C.178 b

• PWR: 0.014 VI.E.214, VIII.B.54, XI.B.163, XVI.C.518, XVI.C.679 Overall: 0.016 Reactor and auxiliary BWR: 0.039 VII.E.44, VII.E.46(2), VII.E.147(2), VIII.C.110, VIII.C.169, buildings (Primary and VIII.C.178, XVI.C.377, VIII.C.153 secondary)

PWR: 0.061 V.A.40 V.A.64, V.B.10, V.F.5, VI.D.176, VI.E.200, VIII.B.101,

(Reactor and VIII.C.6, XI.A.229, VII.B.28, VIII.A.216, VIII.B.30, XIII 40, auxiliary XVI.B.34, XVI.C.149, XVI.C.226, XVI.C.518, XVI.C.771 buildings)

Overall: 0.052 VIII.B.54, XII.53(2)

Diesel generator room BWR: 0.008 XI.A.45, XIV.A.77 PWR: None reported k

I i

a a J' Table H-2. Flooding frequencies derived from industry experience" (continued)

Frequency per b Location reactor-year Events Control enclosure BWR: None reported PWR: None reported Service water pump BWR: 0.0067 VIII.C.153, VIII.B.101, RVI.C.518, XVI.C.771 structure PWR:

High-pressure ECCS BWR: 0.023 VII.E.44, VII.E.46(2), VII.E.147(2), VIII.C.169 (HPCI, HPI, HPCS, HPSI)

PWR: 0.012 VIII.A.216, VIII.B.134, XII.53(2)

? 0.016 VII.E.147(2), VIII.C.110, XVI.C.377

[ Low-pressure ECCS BWR:

(LPCI, LPI, LPCS, LPSI, RHR) PWR: 0.018 VIII. A.216, VIII.B.134, VIII.C.6, XII .53 (2) , XVI.C.771 General equipment areas BWR: 0.0078 VIII.C.178, VIII.C.153 within reactor enclosure PWR: 0.012 VIII.B.54, XVI.C.518, VIII.B.30, VIII.B.101 Containment BWR: - None reported PWR: 0.034 V.A.40, V.A.84, V.B.10, V.F 5, VI.D.176, XI.A.229, VII.B.*e8, XIII.40, XVI.B.34, XVI.C.149, XVI.C.226, XVI.C.771

1. BWR = boiling-water reactor; PWR = pressurized-water reactor; ECCS = emergency core-cooling system; HPCI = high-pressure coolant injection; HPI = high-pressure injection; HPCS = high-pressure core spray; HPSI = high-pressure safety injection; LPCI = low-pressure coolant injection; LPI = low-pressure injection; LPCS = low-pressure core spray; LPSI = low-pressure safety injection; RHR = residual-heat removal.

bSee Table H-1 for description of events.

i i

%,/ .

Table H-3. I4S fluid sources Total Fluid system Normally supplyc glowd Fluid Incationa Fluid source (system) activeb (gal) (gpm) type REE TE CE DE Other Main steam Yes 700,000f 14x106f Steam X Extraction steam Yes 700,000f --

Steam X Heaters and drains Yes -- --

Water / X steam Air removal steam Yes -- --

Steam Condensate- and refueling- I 950,000 600/1500 Water X X X X water storage Circulating water Yes 7.2x106 476,600 Water X X Service water Yes 7.2x106 54,000 Water X X X X X m Emergency service water No 26.4x106 6,400 Water X X X X X b

Residual-heat removal No 26.4x106 18,000 Water X service water Reactor-enclosure cooling Yes 790 1,500 Water };

water Turbine-enclosure cooling Yes 210 225 Water X X water Condensate filter I -- --

Water X X demineralizers Clarifier water I River 300 Water and 200,000+ caustic solutions X Domestic water Yes 10,000 --

Water X X X X Makeup demineralizer I 50,000J 609 Water X X X X X Lube oil Yes 48,000 100 Oil X X 15,000+

Fuel- and diesel-oil I -- --

Fuel and X X ,

storage and transfer oil i

i

__. - _ . . . _ _ - _ - . _ _ . _ . - - _ . - - - _ - _ . _ - . = - _ . .

O O Table H-3. IES fluid sources (continued)

Total Fluid system Normally supplyC flowd Fluid Ixx:ationa Fluid source (system) activeb (gal) (gpm) type REe TE CE DE Other Auxiliary steam Yes -- --

Steam X X X Fire protection Yes 7.2x109 5,000 Water X X X X X Process sampling I Varies --

Water and X X X X chemical Chlorination I -- --

Chemical X solutions Plant process I X X X radiation monitoring condensate and feedwater Yes 150,000h 34,710 Water X X

n Instrumentation Yes Varies --

Steam / X X X X X

,L water

• Reactor-water cleanup Yes PCS --

Water X X X Control-rod-drive hydraulic Yes 150,000 100 Water X X X Standby liquid control No 1,400 86 Sodium X pentaborate Emergency core coolingi No 106 --

Water X Safeguard fill Yes 106 100 Water X Fuel-pool cooling and I 8,000k 1,800 Water X X cleanup 3 Liquid-chemical and solid- I -- --

Water, X X X radwaste collection and chemical and processing sludge Plant wastewater effluent Yes -- --

Sewage X X X water Gaseous-radwaste ambient- Yes -- --

Glycol X charcoal treatment (SW)

Drywell chilled water Yes 3001 2,400m Water Xn x x

O '

Table H-3. 14S fluid sources (continued) 1 1

Total Fluid system Normally supplyc glowd Fluid Locationa Fluid source (system) activeb (gal) (gpm) type RE8 TE CE DE Other Control-enclosure chilled Yes 341 705 Water X water Plant-heating steam0 Yes -- --

Steam X X X X aRE = reactor enclosure; TE = turbine enclosure; CE = control enclosure; DE = diesel-generator enclosure.

bI = intermittent operation. Note that systems that operate during infrequent surveillance testing or as I a result of a transient are not contsidered to be normally active.

cIncluded is just the amount of fluid within storage facilities such as storage or head tanks and the

n cooling-tower basin. All values are representative.

4 dFlow rate from a ruptured line need not correspond to the total system flow rate and in most cases it will not. Values given are maximum for normal operation.

eOutside of the primary containment and does not include the steam tunnel.

fall quantities of steam given in Lbe and Lbm per hour. The 70G,000 Lbm represents reactor-vessel inventory.

9 Represents supply to the various locations.

h Represents the hotwell liquid volume and water available from the condensate storage and transfer sys ter.i.

IIncludes residual-heat removal, high-pressure coolant injection, reactor-core isolation control, and containment spray systems.

jIncludes the fuel-pool filter demineralizers located in the radwaste enclosure.

kVolume corresponds to hoth skimmer surge tanks. During normal operation, fuel-pool cooling and cleanup system does not use pipe work that is connected to the bottom of the storage pools. This pipe work '

is in a passive state during normal operation. Water cannot be siphoned out of the fuel-pool storage area, since the pipe work is designed with siphon breakers to preclude this (see P&ID, M-53, Note 4).

j IThis information was not available from the P6ID function description. Volumes were obtained from the FSAR.

mUnder maximum cooler loads (5 gallons per minute of steam leaking into the drywell) the standby pump can be initiated to provide additional system flow.

D Drywell chilled-water system supplies cooling water to several pieces of equipment within the dry *cll, reactor enclosure, radwaste enclosure, and turbine enclosure.

OEquipped with automatic isolation valves in radwaste reactor, and turbine enclosures.