NUREG/CR-5076 

UCRL-15985 

An Approach to the 

Quantification of Seismic 

Margins in Nuclear Power Plants: 

The Importance of BWR Plant Systems 

and Functions to Seismic Margins 

Prepared by P. J. Amico 

Applied Risk Technology Corporation 

Lawrence Livermore National Laboratory 

Prepared for 

U.s. Nuclear Regulatory Commission 

Lawrence 

Uvennore 

National 

Laboratory 
NOTICE 

This report was prepared as an account of work sponsored by an agency of the United States 

Government. Neither the United States Government nor any agency thereof, or any of their 

employees, makes any warranty, expressed or implied, or assumes any legal liability of reo 

sponsibility for any third party's use, or the results of such use, of any information, apparatus, 

product or process disclosed in this report, or represents that its use by such third party would 

not infringe privately owned rights. 

NOTICE 

Availability of Reference Materials Cited in NRC Publications 

Most documents cited in NRC publications will be available from one of the following sources: 

1. The NRC Public Document Room, 1717 H Street, N.W. 

Washington, DC 20555 

2. The Superintendent of Documents, U.S. Government Printing Office, Post Office Box 37082, 

Washington, DC 20013-7082 

3. The National Technical Information Service, Springfield, VA 22161 

Although the listing that follows represents the majority of documents cited in NRC publications, 

it is not intended to be exhaustive. 

Referenced documents available for inspection and copying for a fee from the NRC Public Docu· 

ment Room include NRC corresponder;;e and internal NRC memoranda; NRC Office .")f Inspection 

and Enforcement bulletins, circulars, information notices, inspection and investigation notices; 

Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and 

licensee documents and correspondence. 

The following documents in the NUREG series are available for purchase from the GPO Sales 

Program: formal NRC staff and contractor reports, NRC·sponsored conference proceedings, and 

NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of 

Federal Regulations, and Nuclear Regulatory Commission Issuances. 

Documents available from the National Technical Information Service include NUREG series 

reports and technical reports prepared by other federal agencies and reports prepared by the Atomic 

Energy Commission, forerunner agency to the Nuclear Regulatory Commission. 

Documents available from public and special technical libraries include all open literature items, 

such as books, journal and periodical articles, and transactions. Federal Register notices, federal and 

state legislation, and congressional reports can usually be obtained from these libraries. 

Documents suchas theses, dissertations, foreign reports and translations, and non-N RC conference 

proceedings are available for purchase from the organization sponsoring the publication cited. 

Single copies of NRC draft reports are available free, to the extent of supply, upon written 

request to the Division of Information Support Services, Distribution Section, U.S. Nuclear 

Regulatory Commission, Washington, DC 20555. 

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process 

are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available 

there for reference use by the public. Codes and standards are usually copyrighted and may be 

purchased from the originating organization or, if they are American National Standards, from the 

American National Standards Institute, 1430 Broadway, New York, NY 10018. 
NUREG/CR-5076 

UCRL-15985 

RD, RM 

An Approach to the 

Quantification of Seismic 

Margins in Nuclear Power Plants: 

The Importance of BWR Plant Systems 

and Functions to Seismic Margins 

Manuscript Completed: April 1988 

Date Published: May 1988 

Prepared by 

P.J. Amico 

Applied Risk Technology Corporation 

P.O. Box 175 

Columbia, Maryland 21045 

Under Contract to: 

Lawrence Livermore National Laboratory 

7000 East Avenue 

Livermore, CA 94550 

Prepared for 

Division of Engineering 

Office of Nuclear Regulatory Research 

U.S. Nuclear Regulatory Commission 

Washington, D.C. 20555 

NRC FIN No. A0398 

ABSTRACT 

In NUREG/CR-4334 ("An Approach to the Quantification of Seismic 

Margins in Nuclear Power Plants"), the Expert Panel on 

Quantification of Seismic Margins presented a technique for 

studying the issue of quantifying seismic margins. As part of 

that technique, the panel included methods for simplifying the 

margins assessment by screening out components and systems using 

both systems and fragilities screening guidelines. At the time 

of that report, the panel was able to develop fragilities 

screening guidelines for all plants, however the systems 

screening guidelines applied only to PWRs (due to a shortage of 

BWR seismic PRAs upon which to base BWR systems screening 

guidelines) . This report develops the BWR systems screening 

guidelines by utilizing the results of a number of BWR PRAs which 

have become available since the publication of NUREG/CR-4334. 

ACKNOWLEDGMENTS 

The author wishes to acknowledge the contributions of the 

following persons in providing input and comments for this 

report. Their assistance was invaluable. 

Robert Murray - Lawrence Livermore National Laboratory 

Peter Prassinos - Lawrence Livermore National Laboratory 

Robert Budnitz - Future Resources Associates, Inc. 

Vojin Joksimovich - NUS Corporation 

Douglas Orvis - NUS Corporation 

This report was prepared for Lawrence Livermore National Laboratory, Nuclear Systems Safety Program under Contract No. 6863805. 

iii 

TABLE OF CONTENTS 

ABSTRACT . . . . . . iii 

ACKNOWLEDGMENTS . . . . . iii 

TABLE OF CONTENTS • •. ' v 

LIST OF TABLES . · . vi 

LIST OF ACRONYMS . · . vii 

1. INTRODUCTION 1 

2. FUNCTIONAL INSIGHTS ON SEISMIC MARGINS FOR BWRs . . . 2 

2.1 BWR Plant Functions ... . . . . . . . . . . . . . 2 

2.2 Presentation of BWR Functional Screening Insights 3 

3. PLANT SPECIFIC EXAMPLE OF FUNCTION/SYSTEM RELATIONSHIPS. 4 

4. 

5. 

TECHNICAL BASIS FOR SCREENING INSIGHTS 

4.1 Summary of Seismic PRA Results. 

6 

. . . . 6 

4.2 

4 • 1 • 1 BWR-A. . . .. ...... .... . 6 

7 

7 

8 

4.1.2 BWR-B. . .. ..•.. . . . 

4 . 1 . 3 BWR-C. . . . . • . . . . . .. .... . 

4 . 1 . 4 BWR - D . . . .. .. . 

4 . 1 . 5 BWR - E • • • • . • . . • . . • . • • . 

4 .1 . 6 BWR-F. . . . . . . . . . . . . . 

Discussion of Seismic PRA Results vs. Screening 

9 

· • 10 

Insights .......... ........ 11 

LIMITATIONS . . . . . . . . . 15 

APPENDIX A - LASALLE UNIT 1 SYSTEM DESCRIPTIONS .27 

v 
LIST OF TABLES 

2.1 FUNCTIONAL SCREENING REQUIREMENTS FOR BWR MARGINS 

REVIEWS . . . . . . . . . . . . · · · · · · · · · · · 17 

3.1 PLANT FUNCTIONS vs. FRONT LINE SYSTEMS MATRIX · · · · · 18 

3.2 FRONT LINE SYSTEMS vs. SUPPORT SYSTEMS MATRIX · · · · · · 19 

3.3 SUPPORT SYSTEMS vs. SUPPORT SYSTEMS MATRIX · · · · · · 20 

4.1 SEISMIC PRA RESULTS FOR PLANT BWR-A · · · · · · · · · 21 

4.2 SEISMIC PRA RESULTS FOR PLANT BWR-B · · · · · · · 22 

4.3 SEISMIC PRA RESULTS FOR PLANT BWR-C · · · · · · 23 

4.4 SEISMIC PRA RESULTS FOR PLANT BWR-D · · · · · · · · · 24 

4.5 SEISMIC PRA RESULTS FOR PLANT BWR-E · · · · · · · · 25 

4.6 SEISMIC PRA RESULTS FOR PLANT BWR-F · · · · · · · · 26 

vi 
AC 

ADS 

BWR 

CM 

DC 

ECC 

HPCI 

HPCS 

LOCA 

LPCI 

MCC 

NC 

PRA 

PWR 

RCIC 

RHR 

RPS 

RS 

SLCS 

S/RV 

VAC 

VDC 

VS 

LIST OF ACRONYMS 

Alternating Current 

Automatic Depressurization System 

Boiling Water Reactor 

Core Melt (or Core Damage) 

Direct Current 

Emergency Core Cooling 

High Pressure Coolant Injection (System) 

High Pressure Core Spray (System) 

Loss of Coolant Accident 

Low Pressure Coolant Injection (System) 

Motor Control Center 

Normal Cooldown 

Probabilistic Risk Assessment 

Pressurized Water Reactor 

Reactor Core Isolation Cooling (System) 

Residual Heat Removal (Function) 

Residual Heat Removal (System) 

Reactor Protection System 

Reactor Subcriticality 

Standby Liquid Control System 

Primary Safety/Relief Valve 

Volts Alternating Current 

Volts Direct Current 

Vapor Suppression 

vii 

1. INTRODUCTION 

This report is an extension of the work of the Expert Panel on 

the Quantification of Seismic Margins which was documented in 

NUREG/CR-4334, "An Approach to the Quantification of Seismic 

Margins in Nuclear Power Plants" [Budnitz, R.J., et aI, August 

1985]. That work can be briefly summarized by quoting from the 

abstract of the report. 

"The objective of this report is to discuss progress 

to date in studying the issue of quantification of 

seismic margins in nuclear power plants. In 

particular, it deals with progress towards the 

establishment of review guidelines that would be 

useful in studying how much seismic margin exists .•.. 

The work presented in this report is the result of a 

detailed study of seismic Probabilistic Risk 

Assessments, historical earthquake performance of 

nuclear and non-nuclear facilities, and test data, 

augmented by the individual experience and expertise 

of the Panel members. The major development 

discussed in this report is the HCLPF concept, which 

demonstrates margin by showing that there is a High 

Confidence of a Low Probability of Failure for a 

given earthquake size." 

The extension work documented in this report expands upon one of 

the areas treated in NUREG/CR-4334 for which insufficient data 

was available at the time that report was written. Since this 

report is not intended as a stand-alone document, the HCLPF 

concept and its associated documentation will not be discussed 

here in detail. The reader is referred to NUREG/CR-4334 for 

further information, and a familiarity with that report is 

essential for a thorough understanding of the material presented 

in this report. 

There is, however, one specific part of the overall HCLPF concept 

which is particularly important to the work reported here, and so 

it will be discussed in slightly greater detail. A major step in 

the approach developed in NUREG/CR-4334 is the screening of 

systems and components in the margins analysis. In order to 

simplify the margins analysis, it is necessary to limit the 

application of detailed analytical techniques to as few 

structures and pieces of equipment as possible. NUREG/CR-4334 

developed a screening technique which allows the analyst to 

eliminate from consideration certain classes of components and 

some entire systems based on a set of rules. The system 

screening eliminated systems based on a review of seismic PRA 

results which indicated that certain plant safety functions 

dominated the core melt scenarios most likely to occur following 

a seismic event, while other plant safety functions did not have 

a dominant effect on seismic core melt. Thus, by screening out 

those systems (or parts of systems) which were used only in the 

performance of these "non-dominant" functions and concentrating 

1 
on the systems (or parts of systems) which performed the 

"dominant" functions, the margins review could be greatly 

simplified. Unfortunately, at the time this "systems screening" 

technique was developed, there were only a sufficient number of 

PWR seismic PRAs available to come to a consensus on screening 

insights. Thus, NUREG/CR-4334 only contained a systems screening 

technique for PWRs. Since that time, a number of BWR seismic 

PRAs have become available, which makes it possible to expand the 

systems screening technique from NUREG/CR-4334 to include BWRs. 

It is this BWR system screening technique which is the subject of 

this report. 

A word of warning is required prior to the presentation of the 

results. It should be noted that these insights are based on the 

resul ts of only six BWR seismic PRAs containing forty-two 

dominant sequences. However, substantial conservatism was 

injected into the development of the BWR insights in order to 

compensate in some way for this shortage of data (see Section 5). 

It is felt that the insights presented here can be used with the 

same level of confidence as exists for the PWR insights contained 

in NUREG/CR-4334. Also, it should be noted that core damage 

frequency, not risk, is used as the figure of meri t for 

developing these insights, consistent with the current seismic 

margins methodology. 

2. FUNCTIONAL INSIGHTS ON SEISMIC MARGINS FOR BWRs 

This section discusses the functional insights on seismic margins 

developed for BWRs based on the review of six BWR PRAs. Section 

2.1 describes the five plant safety functions which are commonly 

associated with BWR response to upset in steady state operating 

conditions. Section 2.2 discusses how these functions appear to 

relate to each other during seismic events and the implications 

of those relationships for the seismic margin review process. 

2.1 BWR Plant Functions 

In order to evaluate and compare the results of the seismic PRAs 

and develop insights for system level screening, it is necessary 

to look at the results in terms of the plant safety functions. 

This is required because these functions are the one aspect of 

plant response to accident conditions which are the same for all 

BWRs, while the systems which perform these functions may differ 

from plant to plant. A list of the plant safety functions 

generally considered in BWR plant PRAs (seismic or otherwise) is 

as follows: 

1) Reactor Subcri ticali ty shutting down the nuclear 

reaction such that the only heat being generated is decay 

heat. 

2) Normal Cooldown - providing cooling to the reactor core 

through the use of the normal power conversion system, 

normally defined as the main steam, turbine bypass, 

condenser, condensate, and main feedwater subsystems. 

2 
3) Vapor Suppression - controlling the build-up of pressure 

in the containment due to the evolution of steam by 

condensing this steam throughout the event sequence. 

This is accomplished by passing the steam released by the 

reactor coolant system through a large volume of water in 

the containment, condensing the steam and heating the 

water. A secondary effect of this function is to remove 

some of the radioactive effluents which may be released 

along with the steam. 

4) Emergency Core Cooling - providing cooling to the reactor 

core during the transient and stabilized phases of an 

event sequence by the use of one or more of the emergency 

systems designed for this purpose. The exact timing of 

this function is somewhat plant and sequence dependent, 

but it can be deemed to be the time period during which 

these systems are initially called upon to operate 

through the time when the reactor coolant system level 

and pressure are stabilized and the heat being generated 

in the core drops below the capability of the residual 

heat removal function (see below). 

5) Residual Heat Removal 

containment during the 

sequence by the use of 

systems designed for this 

removing heat 

stabilized phase of 

one or more of the 

purpose. 

2.2 Presentation of BWR Functional Screening Insights 

from the 

an event 

emergency 

The BWR functional screening insights have been developed by 

reviewing and interpreting the results of six seismic PRAs 

performed on BWRs. This is discussed in detail in Section 4. 

This section presents the screening insights obtained from that 

review. 

Regarding the functions identified in the previous section, the 

dominant core melt sequences always involved failure of Normal 

Cooldown and never involved failure of Vapor Suppression. As far 

as the other functions, various success and failure combinations 

were observed in the dominant sequences, and no particular 

pattern was observed. Thus, the functional interrelationships 

identified for PWRs, as documented in NUREG/CR-4334, do not 

appear to exist for BWRs. Rather, the straightforward insight 

that Normal Cooldown always fails and Vapor Suppression never 

fails allows us only to eliminate these functions from the margin 

review. All other functions must be considered. 

As with the PWR case, it is also. necessary to consider the 

ini tiating events which must be considered. Wi th respect to 

transient initiators, every dominant sequence involves a loss of 

offsite power. Therefore, loss of offsite power can be assumed, 

and other transient initiators need not be considered. Wi th 

respect to loss of coolant (LOCA) initiators, the only LOCAs 

observed in the dominant sequence list can be categorized as 

3 
large LOCAs or vessel rupture. Thus, only LOCAs involving the 

largest RCS piping (recirculation and main steam/feedwater 

piping) need be included in the margin review. Since smaller 

LOCAs did not appear in the dominant sequences other than as 

transient induced S/RV LOCAs (which are evaluated directly on the 

event trees), they need not be considered. Finally, no seismic 

induced containment failures appeared in the list of dominant 

sequences, so they do not need to be considered in the margin 

review either. 

Based on the above discussion, the final BWR functional screening 

insights are presented in Table 2.1. As previously noted, these 

insights are based on the end state of core damage. If some 

other measure were used (such as one of the offsite consequence 

measures) some of the insights might be different. (Note - see 

Section 5). 

3. PLANT SPECIFIC EXAMPLE OF FUNCTION/SYSTEM RELATIONSHIPS 

Up to this point the discussion has concentrated on plant 

functions. Obviously, the heart of these functions is the 

systems which perform them. However, the precise systems which 

are required in the performance of these functions can differ 

greatly from plant to plant. Getting system insights directly 

is, therefore, extremely unlikely. However, for a specific plant 

undergoing a margin review it is important that the systems 

required to perform each function be identified. Since it is not 

possible to create a generic list of systems, this section 

presents a specific example of the identification process for the 

LaSalle nuclear plant, a BWR owned by Commonwealth Edison. The 

text assumes some understanding of the systems in the plant. For 

those who are not familiar with the plant design, a description 

is provided as Appendix A. 

Table 3.1 shows the front line systems which are used to perform 

each function. The leftmost column lists the functions and the 

systems are listed across the top. An "X" ·under a system means 

that the system is utilized in the performance of the function in 

that row. By reading across a functional row, it is possible to 

quickly identify all the front line systems involved in the 

performance of the function. Front line systems are defined as 

those systems which are directly used in the performance of a 

function. Therefore, since our screening insights infer that we 

are interested only in the first, fourth, and fifth functions for 

a seismic margin review, the front line systems list for a margin 

review at LaSalle would be: 

- Reactor Protection System 

- Standby Liquid Control System 

- Safety/Relief Valves 

- Reactor Core Isolation Cooling 

- High Pressure Core Spray System 

- Low Pressure Coolant Injection/Residual Heat Removal - Low Pressure Core Spray System 

- Condensate System 

4 
The list of front line systems is only part of the problem. 

Excluded from this designation are those systems which provide 

support (cooling, power, control, etc.) to the front line 

systems. These are referred to as support systems. In order to 

determine which support systems are required in the analysis, 

another matrix needs to be constructed. This matrix relates the 

front line systems to their required support systems, and is 

shown in Table 3.2. The determination of which support systems 

would have to be included in the analysis is performed by going 

across the table for each front line system from the above 

listing and finding the indicated dependencies. An "X" signifies 

a dependency in all cases, a "Y" signifies an AC power dependency 

restricted to offsite power only (no emergency AC power is 

available to operate the system), and a "Z" signifies that the 

indicated dependency exists only for the utilization of the 

system for performing the residual heat removal function. The 

first finding from this table is that the condensate system 

should be removed from the front line systems list because it 

requires offsi te power and the screening insights state that 

offsite power should be assumed to fail. Following that, the 

support system list for a margin review of LaSalle would be as 

follows: 

- DC Power System - AC Power System - Diesel Generator Service Water System - Residual Heat Removal Service Water System 

The final step is to determine if the support systems already 

identified on the list require any additional support systems 

which are not yet included. That is, are there any support 

systems which do not directly support a required front line 

system but which do support a required support system? The 

matrix for this is shown on Table 3.3. An "X" or a "Y" signify 

the same thing as on Table 3.2 and an "N" means "not applicable." 

Following the procedure previously used, it can be determined 

that no additional support systems need be added to the list. 

It is important to note that, in addition to screening out some 

support systems in their entirety, there are large parts of the 

support systems retained which do not have to be analyzed. 

Support systems are very complex and provide support to many 

plant systems. When the margins assessment is performed, it will 

only be necessary to include those parts of the support systems 

which provide support to the required front line systems. 

The above exercise has developed a final list of which systems 

would be included in a margin review of LaSalle. The list is as 

follows: 

- Reactor Protection System - Standby Liquid Control System - Safety/Relief Valves - Reactor Core Isolation Cooling 

5 
- High Pressure Core Spray System - Low Pressure Coolant Injection/Residual Heat Removal - Low Pressure Core Spray System - DC Power System - ACPower System - Diesel Generator Service Water System 

- Residual Heat Removal Service Water System 

4. TECHNICAL BASIS FOR SCREENING INSIGHTS 

This section will present the information used for the 

development of the functional insights discussed in Section 2 and 

the reasoning used to develop those insights from that 

information. 

4.1 Summary of Seismic PRA Results 

In this section, the dominant seismic core melt sequences from 

the six PRAs used for this report will be discussed in detail. 

These results are summarized in six tables ( 4 . 1 through 4.6). 

The format for each of the tables is identical. The first column 

identifies the particular functional failure (from the functions 

given in Section 2.1) which directly resulted in core melt. That 

is the functional failure which, given the state of the plant 

when that function failed, would lead to a core melt sequence 

regardless of the success or failure of any subsequent functions. 

The second column is a brief narrative description of the 

sequence. The third through seventh columns give the state of 

each plant function for each sequence. An "S" in the column 

means the function has succeeded, an "F" in the column means that 

the function has failed, and a "-" in the column means the state 

of that function is not important (i.e., that function has no 

effect on the end state of the sequence). The sequences are 

listed in descending order of their contribution to core melt 

frequency. Every sequence for all plants involves a loss of 

offsite power due to failure of low capacity switchyard 

components, so this will not be mentioned in the discussion of 

each sequence. It should be noted that the names of the plants 

are not given. This is because the results of the seismic PRAs 

for most of the plants are not generally available. Therefore, 

no names are given in order to prevent association of the plant 

with the results. 

As an aside, it is worth noting that NUREG/CR-4334 discussed some 

general insights from seismic PRASe Those insights are supported 

by the additional PRAs presented here. Of particular note, these 

additional PRAs support the contention that seismic core damage 

is usually dominated by events in the range of 0.3 to 0.5g or so. 

4.1.1 BWR-A 

The results for plant BWR-A are presented in Table 4.1. The 

first sequence is caused by a complete loss of AC power due to 

seismic induced relay chatter. This fails all systems except the 

RPS, RCIC, and HPCI. RCIC and HPCI fail due to failure of the 

6 
condensate storage tank, which provides suction to the RCIC and 

HPCI pumps, and the inability to switch RCIC or HPCI to their 

alternate suction source prior to pump failure. The failure to 

depressurize the RCS is not really an operator error, but rather 

the conscious decision by the operator not to depressurize 

because it would do no good due to the unavailability of AC power 

to the LPCI system. 

The second and fifth sequences are caused by the collapse of the 

reactor building or the control building, either of which will 

sever numerous pipes and electrical lines. This results in the 

failure of virtually all plant systems. The difference between 

the two sequences is that in the second sequence the control rods 

can still insert and shut down the reactor whereas in the fifth 

sequence the reactor core shroud support fails, resulting in core 

movement preventing insertion of the control rods. 

The third sequence involves failure of vessel support, in this 

case resulting in a large LOCA due to vessel rupture. This is 

assumed to create loss of all RCS inventory and an uncoolable 

geometry. Failure of RHR occurs because of secondary failures to 

the system resulting from the vessel failure. 

The fourth sequence is caused by failure of the control rods to 

insert due to core internal failure resulting in core movement. 

The standby liquid control system (SLCS) fails to shut down the 

reactor due to random (non-seismic) failures. The other plant 

systems are not sized to remove heat following shutdown failure, 

so their states are not important. 

The sixth sequence is caused by seismic induced failure of the 

RHR heat exchangers, which fails long term cooling. In this 

case, initial core cooling is provided by either RCIC or HPCI. 

4.1.2 BWR-B 

The results for plant BWR-B are presented in Table 4.2. The 

first sequence is caused by the loss of all AC power due to 

random (non-seismic) failures of the emergency diesel generators. 

This fails all systems except the RPS and RCIC. RCIC fails 

because of seismic induced failure of the condensate storage 

tank, which provides suction to RCIC, and the inability to switch 

the RCIC to its alternate suction source prior to pump failure. 

The second sequence is also caused by the loss of all AC power 

due to random failures of the diesel generators. In this case, 

the RCIC succeeds in providing cooling. Core melt still results 

because the diesel generators are not recovered prior to the need 

for the RHR system for long term heat removal, which requires AC 

power to operate. 

4.1.3 BWR-C 

The results for plant BWR-C are presented in Table 4.3. The 

first sequence is caused by seismic induced failure of the RHR 

7 
heat exchangers, which are required for long term cooling. The 

high pressure injection systems are not affected, thus initial 

core cooling is available. 

The second sequence is caused by the loss of all AC power due to 

random (non-seismic) failures of the diesel generators. This 

fails all systems except the RPS and RCIC. Core mel t results 

from the lack of AC power to run the RHR system when long term 

cooling is eventually required. 

The third sequence is caused by the collapse of the auxiliary 

building, which results in failure of all systems except the RPS 

due to damage to numerous pieces of equipment and the severing of 

piping and electrical lines. 

The fourth sequence is caused by the failure of the core shroud 

support, which results in the inability to insert the control 

rods due to core movement. Random (non-seismic) failure of the 

SLCS prevents the use of this system to shut down the reactor. 

The other systems are not sized to remove heat following shutdown 

failure, so their states are not important. 

The fifth sequence is caused by a number of seismic induced 

failures which fail all the injection systems. One combination 

is failure of the condensate storage tank, which fails all high 

pressure injection, along with failure of the RHR heat 

exchangers, which. fails low pressure injection. Other failures 

include relay chatter and failure of the service water system, 

either of which will fail both high and low pressure injection. 

RHR failure also results from these seismic failures. 

The sixth sequence is caused by random (non-seismic) failures of 

high pressure injection and automatic depressurization, which 

result in a loss of initial core cooling. Failure of the core 

shroud support results in the inability to insert control rods, 

but the SLCS is unaffected and successfully shuts down the 

reactor. The RHR system is also unaffected, and long term 

cooling can be provided in the containment. 

4.1.4 BWR-D 

The results for plant BWR-D are presented in Table 4.4. The 

first sequence is caused by loss of all AC power due to random 

failures of the emergency diesel generators. This results 

directly in the failure of all systems except the RPS and RCIC. 

RCIC fails indirectly due to loss of cooling for the RCIC pump 

room, since the cooling system requires AC power. The failure to 

depressurize the RCS is not really an operator error, but rather 

the conscious decision by the operator not to depressurize 

because it would do no good due to the unavailability of AC power 

to the LPCI system. 

The second sequence is caused by the random (non-seismic) failure 

of the "C" diesel generator, which results in the failure of 

HPCS, and seismic induced failure of the emergency chilled water 

8 
pump supports, which results in failure of RCIC and LPCI due to 

loss of required cooling. This also causes the RHR system to 

fail for the same reason. The RPS system in unaffected. 

The third sequence is caused by the seismic failure of the vessel 

top guide, which results in the inability to insert the control 

rods. HPCS and RCIC fail because the operator fails to transfer 

pump suction from the normal source, the suppression pool, to the 

backup source, the condensate storage tank, prior to suppression 

pool overheat. It should be noted that, even though the PRA 

evaluated it, the success or failure of HPCS and RCIC does not 

affect the eventual core melt result due to failure to shut down 

the reactor. 

The fourth sequence is caused by total loss of AC power due to 

seismic failure of the emergency circulating water sluice gates, 

which results in a loss of cooling to the emergency diesel 

generators. This directly fails all systems except the RPS and 

RCIC, however, RCIC fails due to loss of room cooling. 

The fifth sequence is also caused by a total loss of AC power, 

this time due to seismically induced unrecoverable relay chatter 

on the 4160V switchgear breakers. This is accompanied by a large 

LOCA caused by seismic failure of the recirculation pump supports 

resulting in recirculation line failure due to pump movement. 

The sixth sequence is also caused by total loss of AC power, this 

time due to seismic failure of a lube oil sump tank which fails 

the "A" and "B" diesel generators and random (non-seismic) 

failure of the "C" diesel generator. 

4.1.5 BWR-E 

The results for plant BWR-E are presented in Table 4.5. The 

first sequence results from a loss of service water due to 

seismic induced failure of the service water pumphouse or 

screenwell building walls or seismic induced trip of the local 

480V MCCs. This fails all cooling to the RHR systems and to the 

emergency diesel generators. This fails all systems except the 

RPS, RCIC, and HPCI (the latter two of which utilize turbine 

driven pumps). Core melt results due to the inability to provide 

power and cooling to the RHR systems when long term cooling is 

required. 

The second sequence results from a seismic failure of the reactor 

vessel supports or the recirculation pump supports, which leads 

to a very large LOCA which is likely to involve shearing of 

safety system lines and/or leak rates in excess of ECC 

capability. All fluid systems are assumed to be disabled. 

The third sequence results from seismic failure of the control 

building or of the cable trays in that building. This interrupts 

power and control signals to all systems and results in failure 

of all systems which require active power and control to function 

(all ECC and RHR systems). 

9 
The fourth and eighth sequences are similar, and result from 

seismic failure of the emergency diesel systems (due to various 

seismic failures of support bolts, switchgear, etc.) resultlng in 

station blackout. Core cooling is still provided by either RCIC 

or HPCI, but power cannot be recovered in time to establish long 

term cooling, so core melt results. The difference between the 

two sequences is that the eighth sequence also involves nonseismic (random) failure of a primary S/RV to reclose, resulting 

in a small LOCA. 

The fifth and tenth sequences are similar, and result from nonseismic (random) failures which disable the ECC and RHR systems 

( HPC I , RC I C , and LPC I /RHR) . The di f f erence between the two 

sequences is that the tenth sequence also involves random failure 

of a primary S/RV to reclose, resulting in a small LOCA. 

The sixth sequence results from random failures of the HPCI and 

RCIC systems along with a mix of random and seismic failures of 

the ADS depressurization valves. The seismic failures are due to 

failure of the nitrogen accumulators which provide pressure to 

open these air-operated valves. These failures combine to render 

all core cooling inoperative, however they do not prevent the use 

of RHR for containment cooling. 

The seventh and ninth sequences are similar, and involve core 

melt due to random failures in the RHR systems when required for 

long term cooling. In both cases, core cooling is initially 

successful, but in different manners. In the seventh sequence, 

ECC is provided by RCIC or HPCI. In the ninth sequence, RCIC and 

HPCI fail due to random causes and ECC is provided by utilizing 

depressurization and LPCI. 

4.1.6 BWR-F 

The results for plant BWR-F are presented in Table 4.6. The 

first sequence results from seismic failure of the service water 

system discharge lines, which fails all plant service water. 

This results in a loss of all AC power due to loss of cooling to 

the emergency diesels, which in turn fails all RHR and low 

pressure ECC systems. Loss of all high pressure cooling pumps 

(which are turbine driven and do not require AC power) also 

occurs due to loss of room cooling (which requires AC). 

The second and seventh sequences are similar, and result from 

seismic failure of the 480 VAC breaker cabinets and the 125/250 

VDC swi tchgear. This causes loss of all power and control 

signals to the safety systems, and results in failure of all 

those systems which require positive power or control to be 

successful (all fluid systems). RPS is not directly affected. 

The difference between the two sequences is that the seventh 

sequence also includes failure of the RPS (either seismically or 

through random faults not related to the power/control failures). 

The thirq, tenth, and eleventh sequences are all similar, and are 

10 
the result of seismic failures of the RCS resulting in very large 

LOCAs and extensive damage to safety system piping. This is 

assumed to lead to core melt due to the inability of any ECC or 

RHR systems to mitigate the event. The difference between the 

sequences is that the third sequence results from seismic failure 

of the recirculation pump support lugs, the tenth sequence from 

seismic failure of reactor vessel support (the shield wall), and 

the eleventh sequence from both of these seismic failures. 

The fourth and eighth sequences are also similar, both resulting 

from seismic failure of the reactor and control building shear 

walls. This causes extensive damage to all of the ECC, RHR, and 

other systems which require through building piping, power, or 

positive control. Only the RPS is unaffected. The difference 

between the two sequences is that the eighth sequence also 

includes failure of the RPS (either seismically or through random 

faults not related to the structural failures). 

The fifth sequence results from seismic failure of either the RHR 

outboard injection valves, the RHR pump supports, or the RHR heat 

exchangers, which fail long term cooling when it is required. 

Core cooling is initially supplied by either the RCIC or HPCI 

systems, which are unaffected. 

The sixth sequence results from a failure of the RPS to scram due 

either to seismic or random causes. Subcriticality fails due to 

the operator fail~ng to properly initiate the standby liquid 

control system (SLCS). A high human error probability for this 

act is a direct result of the seismic event (thus it could be 

deemed a seismic induced human error). The other emergency 

systems are not capable of responding to an event where 

subcriticality is not achieved. 

The ninth sequence results from a seismic or random failure of 

the RPS combined with the seismic or random failure of HPCI. The 

seismic HPCI failures are failure of the turbine, pump, or 

condensate storage tank. In this sequence, SLCS is successful in 

achieving subcri ticali ty, but core melt results when HPCI is 

unavailable to provide the necessary RCS water level control. 

RHR is unaffected, and is available for containment cooling. 

The twelfth sequence is similar to the ninth sequence. The 

difference in this case is that, following failure of RPS and 

success of SLCS, it is an operator error which causes failure of 

inventory control and depressurization (rather than the HPCI 

failures observed in the ninth sequence). 

4.2 Discussion of Seismic PRA Results vs. Screening Insights 

The results presented above were used to identify screening 

insights which would help to simplify the margins analysis 

required to determine an estimate of the HCLPF for a particular 

BWR. This was done much in the manner used for developing the 

PWR functional/systemic screening insights presented in NUREG/CR4334. In discussing these insights, a two character nomenclature 

11 
will be used. The five BWR functions will be identified by 

number as follows: 

1 - Reactor Subcriticality 

2 - Normal Cooldown 

3 - Vapor Suppression 

4 - Emergency Core Cooling 

5 - Residual Heat Removal 

When referring to the state of a function, a letter will be added 

following the number. An" S" will signify success of the 

function and an "F" will signify failure of the function. Thus, 

1S signifies that reactor subcriticality has succeeded, while 4F 

signifies that emergency core cooling has failed, and so on. 

Event probability is signified by the function "P". Thus, P(4F) 

is the probability that emergency core cooling has failed. 

The first thing that was noted was that there did not appear to 

be an obvious delineation of functional groups for the BWRs as 

there was for the PWRs. The PWR insights seemed to just drop out 

of a quick review and the functional group hypothesis which was 

later adopted was clear. Since this is not the case for the 

BWRs, the process which we used was to look for initial insights 

on a function-by-function basis and then aim for further 

refinements. 

The first insight which can be determined from the PRA results is 

that normal cooldown always fails. In terms of a screening 

insight, this means that it is not necessary to perform a 

detailed evaluation of the systems used to perform function 2. 

Rather, it is reasonable to assume that; 

P (2F) = 1. 0 

The potential error that could be made would be to identify core 

damage sequences which result directly from the failure of the 

other functions and which could have been prevented if function 2 

had been available. We will refer to this as a Type III error. 

(The definition of Type I and Type II errors was established in 

NUREG/CR-4334 as they apply to PWR functional/systemic inSights. 

In order to avoid confusion, those designations will be used only 

to discuss errors of the same type for BWRs.) In reviewing the 

42 dominant sequences included, it is found that all 42 include 

failure of normal cooldown. The root cause of this failure is 

that every sequence involves a loss of offsite power due to the 

extremely low seismic capacity of key switchyard components. All 

seismic sequences which have been found to contribute to seismic 

risk have been large enough to assure failure of these 

components. Since function 2 requires offsite power in order to 

succeed (which is true in all nuclear power plants, both BWRs and 

PWRs) the failure of function 2 is assured. Thus, in the PRAs 

reviewed, no Type III errors would have occurred if the 

assumption were used and thus the screening insight is supported. 

It should be noted that this insight also leads directly to the 

conclusion that it is not necessary to consider any transient 

12 
initiating events other than loss of offsite power, since only 

loss of offsite power initiators contribute to seismic risk. 

The second insight identified is that function 3 always succeeds. 

In terms of a screening insight, this means that it is not 

necessary to perform a detailed evaluation of the systems which 

are required for function 3. Rather, it is reasonable to assume 

that; 

P(3S) = 1.0 

Since failure of function 3 will always result directly in core 

damage, regardless of the states of the other functions, the 

error which would result from the use of this assumption would be 

that if there were any dominant sequences which involved failure 

of this function, they would be missed. This will be called a 

Type IV error. If this type of error were potentially important, 

we would expect to see some dominant sequences from the PRAs 

(where this assumption was not made) which involved failure of 

function 3. However, of the 42 sequences reviewed, no Type IV 

errors would have occurred if the assumption were used and thus 

the screening insight is supported. (Note - see Section 5). 

The first two insights leave three functions to be considered. 

Function 1 is interesting in that it is a basically independent 

function. That is, if it fails, the states of all of the 

subsequent functions are unimportant. An early core melt with 

early containment overpressure failure will occur. Now, no 

assumption regarding the success or failure of this function can 

be made as was done for functions 2 and 3 since it fails in some 

dominant sequences but not in others. However, when considering 

the contribution of this functional failure to plant HCLPF, it 

can be analyzed separately from the other functions. Once the 

independent HCLPF for function 1 is identified it can be taken as 

an independent element of the plant HCLPF equation. This does 

simplify the analysis somewhat, although it is not specifically 

an "insight" in the sense meant in the past work. It falls not 

from the seismic PRA results themselves as from the results of 

BWR PRAs in general and the limitations of BWR plant design. 

There are no significant potential error types of any kind 

associated with this insight. 

With the final two functions, the review has been reduced to a 

point similar to that of the PWR review. That is, the 

consideration of early cooling versus late cooling. Briefly, in 

the PWR analysis, the insight identified was that it was 

reasonable to assume that if early cooling succeeded then late 

cooling also succeeded and that if early cooling failed then late 

cooling also failed. This permits the margins review to 

concentrate the detailed analysis only on the systems which 

provide the early cooling functions and to consider only those 

aspects of the late cooling functions which are the result of 

very gross plant unique design features. This saves a large 

amount of analysis. In order to see if a similar insight to the 

PWR insight is possible, it will be hypothesized that a similar 

13 
insight exists in the BWR case. Put in terms of the PWR insight, 

this would be expressed as follows: 

P(55145IEQ) = 1.0 

P(5FI4FIEQ) = 1.0 

That is, the probability of S5 given 45 given the the occurrence 

of an earthquake is 1.0 (a certainty) and the probability of SF 

given 4F given the occurrence of an earthquake is also 1.0. 

Direct corollaries of these statements are: 

P(SSI4FIEQ) = 0.0 

p(SFI45IEQ) = 0.0 

and, interestingly, combining with the insight discussed above 

regarding function 1: 

p(CMIEQ) = P(lFIEQ) + P(4FIEQ) 

P(NCMIEQ) = P(15IEQ) + p(4SIEQ) 

where "CM" is core melt (core damage) and "NCM" is no core melt 

(no core damage). Thus, what the above two equations signify is 

that, if the assumption can be shown to be viable, it is possible 

to evaluate core damage probability (or, obviously, HCLPF) by 

only performing detailed evaluations of function 1 and function 

4, and what's more, the system analysis part of the evaluations 

could be completely independent. As stated in NUREG/CR-4334, 

this kind of assumption is prone to two types of error, as 

follows: 

Type I Error - This error involves seismic core damage 

sequences which would result from the success of function 4 

and failure of function S. These sequences will be missed 

since the core damage is caused by failure of function 5 and 

the assumption would be that if function 4 succeeds then 

function S succeeds, which is a non-core damage sequence. 

This type of error would be obviously non-conservative. 

Type II Error - This error involves seismic core damage 

sequences which result from failure of function 4 but which 

are followed by success of function S. These sequences 

would not be entirely missed since the core damage results 

from failure of function 4, which the assumption would allow 

to be found. However, they would erroneously be considered 

to have included failure of function S since the assumption 

states that success of function 5 is not probable given 

failure of function 4. This type of error would be 

conservative, since these 4F/S5 sequences would be placed 

into 4F/SF plant damage states, which have higher 

consequences. Further, since the HCLPF concept is tra~sparent to plant damage state, the calculation of HCLPF 

would not be affected by this type of error. 

14 
Going back and reviewing the 42 dominant seismic sequences in 

Tables 4.1 through 4.6, it can be seen that if the assumption 

presented above had been used in the PRAs there would have been 

ten Type I errors and four Type II errors. Further, four of the 

Type I errors are potentially quite significant. Type I errors 

represent the top two dominant sequences for BWR-C, the most 

dominant sequence for BWR-E, and one of the only two dominant 

sequences for BWR-B. These Type I errors could cause a 

potentially serious overestimation of the HCLPF for all three 

plants, which is half the available data base. Thus, the seismic 

PRA results do not support this assumption, and the hypothesized 

functional insight is not valid. 

The final consideration with regard to the functional insights is 

which initiating events need to be considered in the margins 

review. As previously discussed, the transient initiator loss of 

offsite power is the only transient required to be analyzed, and 

loss of offsi te power should be assumed for all sequences 

evaluated. This leaves the consideration of the three 

tradi tional LOCA sizes, vessel rupture, and direct containment 

failure. It was decided that any initiating event which appeared 

in the forty-two sequences in the data base should be included in 

the list of initiators to be evaluated in the margins review and 

those which did not appear could be eliminated. Reviewing the 

forty-two sequences, two other initiators appeared (in 

combination with loss of offsite power), Large LOCA and Vessel 

Rupture. Thus, these should also be considered in the margins 

review. 

The functional insights which resulted from the above process 

were presented in summary form in Section 2 and on Table 2.1. 

5 . LIMITATIONS 

There are a number of limitations on the insights presented in 

this report. In general, they are the same as those discussed 

for the entire methodology in NUREG/CR-4334. However, one 

particular limitation applies more strongly to the BWR 

functional/systemic insights presented here than to the 

equivalent PWR insights from the previous report. That is the 

fact that the insights are based on the results of a limited 

number of seismic PRAs. The PWR insights were founded on a base 

of 10 seismic PRAs containing 60 dominant accident sequences. In 

contrast, the BWR insights have a base of only 6 seismic PRAs 

containing 42 dominant accident sequences. Thus, we were much 

stricter in identifying BWRs insights. In the PWR analysis, we 

permi tted exceptions to the insights to exist as long as they 

would not have significantly altered an assessment of plant HCLPF 

and identification of plant weaknesses had a margin study been 

performed on that plant. That is, all 60 of the dominant 

sequences identified did not have to agree perfectly with the 

insights in order to allow the insight to be proclaimed a valid 

and reasonable approximation. However, in the BWR analysis, any 

insight which would allow simplification of the systems model was 

15 
considered valid only if it were valid for all 42 dominant 

sequences. Thus, function 2 being assumed to fail and function 3 

being assumed to succeed are designated as valid insights because 

these functional states were present in all 42 sequences. 

Similarly, initiating events were eliminated from consideration 

only if they did not appear in any of the 42 sequences. An 

interesting note is that even if an occasional insignificant 

exception were allowed in the development of the BWR insights, 

the conclusions would not have changed. That is because the 

results of the six PRAs considered did not reveal any additional 

simplifying assumptions whose exceptions could be judged to be 

broadly insignificant to the assessment of a plant HCLPF. 

In addition, there is one other limitation which applies 

specifically to these BWR results. All of the seismic PRAs 

considered in this report have either MARK II or MARK III 

containments (no seismic PRA were available for plants with MARK 

I containments). Therefore, the insight with regard to the vapor 

suppression function (function 3) always being available and the 

insight that it is not necessary to consider containment 

integrity failure as an initiating event may not apply to plants 

wi th Mark I containments. This is not necessarily a critical 

weakness, since in their functional system behavior, BWRs are not 

all that different from one to the next. Nevertheless, it 

appears that it will be necessary (and prudent) to give some 

consideration to these failures for the first few MARK I plants 

to be subjected to a margins review. After a fragilities 

analysis has been performed on a few representative MARK I 

containments in the context of a margins study, it will be 

possible to positively determine whether this insight can be 

extended to that containment type. 

16 
TABLE 2.1 

FUNCTIONAL SCREENING REQUIREMENTS FOR BWR 

SEISMIC MARGINS REVIEW 

Function 

Initiators: 

Offsite Power 

RCS Integrity - Small LOCA 

RCS Integrity - Medium LOCA 

RCS Integrity - Large LOCA 

RCS Integrity - Vessel Rupture 

Containment Integrity 

Plant Functions: 

Reactor Subcriticality 

Normal Cooldown 

Vapor Suppression 

Emergency Core Cooling 

Residual Heat Removal 

Screening Requirement 

Assume Failure 

Assume Success 

Assume Success 

Margin Evaluation Required 

Margin Evaluation Required 

Assume Success [1] 

Margin Evaluation Required 

Assume Failure 

Assume Success [1] 

Margin Evaluation Required 

Margin Evaluation Required 

[1] See discussion in Section 5 regarding MARK I containments. 

17 
TABLE 3.1 

PLANT FUNCTIONS VB. FRONT LINE SYSTEMS MATRIX 

"-

(f) [ -, I 

L a OJ E [ E E E 

W -- [ - [ 0) H 0) OJ ID 

I- ;..J a a - ;..J tr ;..J ;..J 

(f) 0 "0 E -- 0 - (J) - OJ (J) 

>- 0) -- ID OJ Ir- 0.. a 0) J) O;..J J) J) 

(f) ;..J ] ;..J L (]) 0) 0 L({) o a ID({) (f) 

0 IT [IJ OJ -- [ LU ::l u OJ L 

W L -- J) > - 0 0 Q) J) I J J) (]} 

Z 0.. .J(1) [ OJ - U [ (J) a fD fD a ;..J 

H 0 tr Q) a OJ L fD- ID L d 

.J L J)- U \. (J) L -- L 0. ID a OJ 0. ID 

0 E .0 0 E ])(/) OJ O;..J D..({) L ::l L(f) [ 

I- ;..J (D 11 L L (I) ;..J (I) L ;..J a 0..11 0.. ID 

Z o ;..J [ ;..J OJ;..J (]) > 0. 0- .c (]) -- (]) D 

0 o rn o [ 3 (/) Ir-- Q. o 0 OJL 3 OJ 3 L [ 

rr 0) ]) ;..J 0 o J) a a J (J) (jJ -- a o (J) o a 0 PLANT FUNCTIONS II tr(1) (flU 0..(1) (f» (f) trH IU .Jtr .JU U 

Reactor 

Subcr i t. i ca I it!d X X 

Normal 

Cooldown X 

Vapor 

Suppression X X 

Emergenc!d Core 

Coo X X X X X X I I ng 

Residual Heat 

Removal X 

18 
TABLE 3.2 

·FRONT LINE SYSTEMS vs. SUPPORT SYSTEMS MATRIX 

-

o E E L L 

> ID OJ OJ ID [J) 0+1 +I -f-l +I 

2:: E OJ Ol L 0 0 

W (D JJ L JJ OJ m:> 0):> f- E E rr[J) o [J) +' [ [ [J) OJ OJ .p a - OJ - OJ 

}- +' +' +l L o L 3 1) [ TI [ [J) (J) (J) o ill L ill - - - -- J) ]} (D-tI (!) +' OJ - - - - f- [J) [J) I D [ D [ ::J 0 ::l 0 

!r 3 (!) 3 .- m 0 m 0 

0 L L - ~ .p U U 

0.. (I) OJ a ID (I) a OJ L 

0.. 3 3 ::l 0 - 0 - E [ 1) 01) :J a a 1) -- ID -- J OJ - OJ +l ill 

[J) 0.. 0.. - > [J) > 0+1 .0 CD o CD 

ID L (!) L L (J) L 0 a 0 

U U (D ill .- ill .- JJ ::J ..,.. (D - FRONT LINE SYSTEMS ([ 0 rren om U[J) f-U frU 

Rsactor Protection 

Sbjstem )( 

Standbbj Liquid 

Control Sbjstem )( )( 

Power Conversion V Sbjstem )( )( )( 

Safetbd/Rel i ef 

Valves )( 

Suppression Pool 

Rsactor Core 

Isolation Cool ing )( )( 

High Pressure 

Core SprClbd )( )( )( 

Low Pres Cool Inj / )( )( Z Residua.l Heat Rem. )( 

Low Pressure )( )( X Cors SprClbd 

Condensate Sbdst.em V X X 

19 
TABLE 3.3 

SUPPORT SYSTEMS VB. SUPPORT SYSTEMS MATRIX 

"SUPPORTED" SUPPORT SYSTEM 

AC Power Sbjstem 

DC Power Sblstem 

Residual Heat Removal 

Service Water S~stem 

Diesel Generator 

Service Water S~stem 

Circulating Water Sblstem 

Turbine Sui Iding Closed 

Cool ing Water Sblstem 

Reactor Bui Iding Closed 

Cool ing Water Sblstem 

Service Water Sbjstem 

20 

2: 

W 

I-

(J) 

>-

(J) 

fCC 

o 

Q. 

0.. 

:J E 

(J) ID 

+' t ID ~ J) 

z en 

H 

f- L 

CC (!) 

o :3 

Q. 0 

Q. 0... 

:J 

(J) U ~ a:: 

N 

)( 

)( 

E 

ID 

+' 

ID 

J) 

(f) 

L 

(!) 

:3 

o 

0.. 

U 

o 

)( 

N 

)( 

)( 

)( 

x 

x 

x 

E E 

OJ OJ 

+' +' 

{O (O 

L Jl ]) a (J) (J) 

+' 

o L L 

L ill ill 

OJ +' +' 

[0 0 

m 3 3 

(!) 

OJ OJ 

- 0 0 

mID > > 

m L L 

.- OJ OJ 

o (J) (J) 

)( 

N 

)( 

x 

N 
TABLE 4.1 

SEISMIC PRA RESULTS FOR PLANT BWR-A 

Core 

Melt Sequence Description RS NC VS ECC RHR 

Cause 

ECC Seismic Induced Loss of Offsite and S F S F F 

Onsite Power, Failure of High Pressure 

Injection, Failure to Depressurize RCS 

ECC Seismic Induced Collapse of Reactor or S F S F F 

Control Building, Loss of All Systems 

Except RPS 

ECC Seismic Induced Rupture of Reactor F S F F 

Pressure Vessel, Loss of All Systems 

Except RPS 

RS Seismic Induced Loss of Offsite Power, F F 

Failure of RPS and Standby Liquid 

Control System 

RS Seismic Induced Collapse of Reactor or F F 

Control Building, Loss of All Systems 

RHR Seismic Induced Loss of Offsite Power, S F S S F 

Failure of Long Term Heat Removal 

21 
Core 

Melt 

Cause 

ECC 

RHR 

TABLE 4.2 

SEISMIC PRA RESULTS FOR PLANT BWR-B 

Sequence Description RS 

Seismic Induced Loss of Offsite Power, S 

Failure of Onsite Power, Loss of All 

Systems Except RPS 

Seismic Induced Loss of Offsite Power, S 

Failure of Onsi te Power, Failure of 

Long Term Heat Removal 

22 

NC 

F 

F 

VS ECC RHR 

S F F 

S S F 
Core 

Melt 

Cause 

RHR 

RHR 

ECC 

RS 

ECC 

ECC 

TABLE 4.3 

SEISMIC PRA RESULTS FOR PLANT BWR-C 

Sequence Description RS NC VS ECC RHR 

Seismic Induced Loss of Offsite Power, S 

Failure of Long Term Cooling 

Seismic Induced Loss of Offsite Power, S 

Failure of Onsite Power, Failure of 

Long Term Cooling 

Seismic Induced Collapse of Auxiliary S 

Building, Loss of All Systems Except 

RPS 

Seismic Induced Loss of Offsite Power, F 

Failure of RPS, Failure of Standby 

Liquid Control System. 

Seismic Induced Loss of Offsite Power, S 

Failure of High and Low Pressure 

Injection, Failure of Long Term 

Cooling 

Seismic Induced Loss of Offsite Power, S 

Failure of RPS, Failure of High 

Pressure Injection and Automatic 

Depressurization 

23 

F 

F 

F 

F 

F 

F 

S S F 

S S F 

S F F 

S F F 

S F S 
Core 

Melt 

Cause 

ECC 

ECC 

RS 

ECC 

ECC 

ECC 

TABLE 4.4 

SEISMIC PRA RESULTS FOR PLANT BWR-D 

Sequence Description RS NC VS ECC RHR 

Seismic Induced Loss of Offsite Power, S 

Failure of Onsi te Power, Failure of 

High Pressure Injection, Failure to 

Depressurize RCS, Failure of Long Term 

Cooling 

Seismic Induced Loss of Offsite Power, S 

Failure of High and Low Pressure 

Injection, Failure of Long Term 

Cooling 

Seismic Induced Loss of Offsite Power, F 

Failure of RPS, Failure of High 

Pressure Injection. 

Seismic Induced Loss 

Onsite Power, Loss 

Except RPS 

of Offsi te and 

of All Systems 

S 

Seismic Induced Large LOCA with Loss S 

of Offsi te and Onsi te Power, Failure 

of Low Pressure Injection, Failure of 

Long Term Cooling 

Seismic Induced Loss of Offsite Power, S 

Failure of Onsi te Power, Loss of All 

Systems Except RPS 

24 

F 

F 

F 

F 

F 

F 

S F F 

S F F 

F 

S F F 

S F F 

S F F 
TABLE 4.5 

SEISMIC PRA RESULTS FOR PLANT BWR-E 

Core 

Melt 

Cause 

Sequence Description RS NC VS ECC RHR 

RHR 

ECC 

ECC 

RHR 

ECC 

ECC 

RHR 

RHR 

Seismic Induced Loss of Offsite Power S 

and Service Water, Loss of Onsi te 

Power and Long Term Heat Removal 

Seismic Induced Rupture of Reactor 

Coolant System, Loss of All Systems 

Except RPS 

Seismic Induced Collapse of Control S 

Building or Cable Trays, Loss of All 

Systems Except RPS 

Seismic Induced Loss of Offsite and S 

Onsi te Power, Loss of Long Term Heat 

Removal 

Seismic Induced Loss of Offsite Power, S 

Failure of High and Low Pressure 

Injection, Failure of Long Term Heat 

Removal 

Seismic Induced Loss of Offsite Power, S 

Failure of High Pressure Injection, 

Seismic/Random Failure to Depressurize 

Seismic Induced Loss of Offsite Power, S 

Failure of Long Term Heat Removal 

Seismic Induced Loss of Offsi te and S 

Onsite Power, Transient Induced Small 

LOCA, Loss of Long Term Heat Removal 

RHR Seismic Induced Loss of Offsi te Power, S 

Failure of High Pressure Injection and 

Long Term Heat Removal 

ECC Seismic Induced Loss of Offsite Power, S 

Transient Induced Small LOCA, Failure 

of High and Low Pressure Injection, 

Failure of Long Term Heat Removal 

25 

F 

F 

F 

F 

F 

F 

F 

F 

F 

F 

S S F 

S F F 

S F F 

S S F 

S F F 

S F S 

S S F 

S S F 

S S F 

S F F 
Core 

Melt 

Cause 

ECC 

ECC 

ECC 

ECC 

RHR 

RS 

RS 

RS 

ECC 

ECC 

ECC 

ECC 

TABLE 4.6 

SEISMIC PRA RESULTS FOR PLANT BWR-F 

Sequence Description RS NC VS ECC RHR 

Seismic Induced Loss of Offsite Power S 

and Service Water, Loss of Onsi te 

Power, Loss of All Systems Except RPS 

Seismic Induced Loss of Offsite Power S 

and All Control and Instrumentation 

Power, Loss of All Systems Except RPS 

Seismic Induced Rupture of Reactor 

Coolant System, Loss of All Systems 

Except RPS 

Seismic Induced Collapse of Reactor or S 

Control Buildings, Loss of All Systems 

Except RPS 

Seismic Induced Loss of Offsite Power S 

and Long Term Heat Removal 

Seismic Induced Loss of Offsite Power, F 

Seismic/Random Failure of RPS, Failure 

to Initiate Standby Liquid Control 

Seismic Induced Loss of Offsite Power F 

and All Control and Instrumentation 

Power, Loss of All Systems 

Seismic Induced Collapse of Reactor F 

and Control Building, Loss of All 

Systems 

Seismic Induced Loss of Offsite Power, S 

Failure of RPS, Random/Seismic Failure 

of High Pressure Injection 

Seismic Induced Vessel Rupture, Loss 

of All Systems 

Seismic Induced Vessel and Reactor 

Coolant System Rupture, Loss of All 

Systems 

Seismic Induced Loss of Offsite Power, S 

Failure of RPS, Failure to Maintain 

Proper Event Control 

26 

F 

F 

F 

F 

F 

F 

F 

F 

F 

F 

F 

F 

S F F 

S F F 

S F F 

S F F 

S S F 

S F S 

S F F 

S F F 

S F S 
APPENDIX A 

LASALLE UNIT 1 SYSTEM DESCRIPTIONS 

The purpose of this appendix is to provide background information 

on the systems design for LaSalle Unit 1, which is used in 

Section 3 as a plant specific example of the identification of 

plant systems that are required to provide each plant safety 

function. Each system mentioned in that section is described in 

some detail in this Appendix. 

A.I Reactor Protection System (RPS) 

The RPS constantly monitors plant parameters and initiates the 

actions necessary to shut down the nuclear reaction. It examines 

selected plant parameters and determines whether plant operating 

limits are exceeded. If they are, the system transmits actuation 

signals to the components required to operate in order to shut 

down the nuclear reaction. 

The signal is processed by the main RPS sensors and logic and is 

transmi tted to the scram solenoids. This is a two train 

arrangement, and either train is capable of sending the required 

signal. In addition, there is an alternate set of sensors, logic 

and solenoid valves (called alternate rod insertion (ARI» which 

backs up this portion of the RPS. The opening of the scram 

solenoids results in the opening of a set of redundant scram 

valves. This admits water from a pressurized scram system to 

enter the control rod drives and force the control rods into the 

core, shutting down the nuclear reaction. 

A.2 Standby Liquid Control System (SLCS) 

The SLCS provides a backup means of shutting down the nuclear 

reaction by injecting a concentrated boron solution into the 

reactor coolant system. The system is entirely manual in 

operation, and in addition to initiating it the operator must 

take other actions to reduce core power in order to gi ve the 

boron concentration sufficient time to build up. It takes about 

30 minutes to fully shut down the nuclear reaction using the 

SLes. 

The SLeS consists of two independent SLCS pumps along, with their 

associated piping, valves, and control circuitry. Both trains 

take suction from a single boron injection tank, which contains a 

concentrated boric acid solution. Success of at least one pump 

train is required to shut down the reaction. 

A.3 Power Conversion System (PCS) 

The pes is an extremely complex plant system whose function it is 

to convert heat produced in the reactor core into electrical 

power. It is the major part of the secondary side of the plant. 

It is always operating when the plant is at power, and is also 

27 
capable of removing decay heat after plant shutdown. 

There are five major systems that make up the PCS: main steam, 

turbine, condenser, condensate, and feedwater. The main steam 

systems takes steam from the reactor and brings it to the 

turbine. It consists of four main steam lines, each of which has 

a pair of isolation valves (one ~nside containment and one 

outside containment) and other associated valves and piping. The 

turbine system consists of the turbine itself with its associated 

turbine stop and control valves along with piping and control 

circuitry, and the turbine bypass valves with their piping and 

control circuitry. Steam passes through the turbine during 

normal operation and around the turbine (through ,the bypass) when 

a shutdown occurs. In either case, the steam is passed on to the 

condenser. 

The condenser is a large heat exchanger that cools the steam by 

passing it over a large number of water cooled tubes. The 

cooling for these tubes is provided by the circulating water 

system. The steam is condensed to water and falls into the 

condenser hotwell, a kind of tank which provides suction for the 

condensate system. 

The condensate and feedwater systems take water from the hotwell 

and return it to the reactor vessel to be heated again. These 

two systems contain a number of components, the primary of which 

are the motor-driven condensate pumps, the main feedwater pumps 

(two turbine-driven, one motor-driven), and the feedwater stop 

and control valves. They also contain a number of other pumps 

and valves, as well as piping, heat exchangers, and control 

circuitry. 

A.4 Safety/Relief Valves (S/RV) 

The S/RVs are designed to protect the reactor vessel from the 

rupture of any part of its pressure boundary, thus preventing a 

LOCA caused by overpressure. It does this by providing a group 

of valves that open when the vessel pressure i.s too high, 

removing heat and maintaining vessel pressure within design 

limits. The valves then reclose, returning the integrity to the 

pressure boundary. The valves can also be used to depressurize 

the reactor coolant system by being locked open. This mode of 

operation is either automatically initiated by low reactor water 

level or manually initiated by the operator, depending on the 

scenario. The valves discharge steam into the suppression pool. 

The major function of the S/RVs is to relieve pressure from the 

reactor coolant system when the RCS becomes isolated from the 

condenser. After the valves open, they must reclose in order to 

prevent a LOCA condition from existing. A stuck open valve 

results in a small LOCA. The depressurization mode is used in 

cases where the RCS is isolated and no high pressure cooling is 

available. In this case, locking the valves open reduces the RCS 

pressure so that low pressure cooling systems can be used to 

provide the necessary cooling. 

28 
A.5 Suppression Pool (SP) 

The SP is essentially a large pool of water located inside the 

containment and is used to condense steam and prevent containment 

overpressure. The containment is arranged such that steam 

escaping from the RCS, either through the S/RVs or from a break 

elsewhere in the RCS pressure boundary, is routed through the SP. 

The SP contains cool water, and the steam is condensed in passing 

through the water, causing the water temperature to rise but 

preventing pressure build-up in the containment from a build-up 

of steam. The SP also provides an alternate suction source for a 

number of emergency cooling systems. After a period of time, the 

SP water gets too hot and must be cooled it it is to continue 

providing its vapor suppression function. 

A.6 Reactor Core Isolation Cooling (RCIC) System 

The RCIC is an engineered safeguards system that is designed to 

provide reactor core cooling by injecting water into the reactor 

vessel at high pressure. It is automatically actuated by a 

low reactor water level signal. 

The RCIC consists of a turbine-driven pump along with the 

associated piping, valves, and control circuitry. Upon receipt 

of a signal, the system is automatically aligned and the steam 

admission valve to the pump turbine opens, starting the pump. 

The steam is provided from the reactor vessel. The pump takes 

suction from the condensate storage tank (CST) and discharges 

directly to the reactor vessel. If desired, the pump suction 

lines can be realigned to take suction from the suppression pool, 

but this is generally not essential since the RCIC' s mission 

should be completed prior to draining the CST. 

A.7 High Pressure Core Spray (HPCS) System 

The HPCS is an engineered safeguards system that is designed to 

provide reactor core cooling by injecting water into the reactor 

vessel at high pressure. It is automatically actuated by a 

low reactor water level signal. 

The HPCS consists of a motor-driven pump along with the 

associated piping, valves, and control circuitry. Upon receipt 

of a signal, the system is automatically aligned and the pump 

starts. The pump takes suction from the condensate storage tank 

(CST) and discharges directly to the reactor vessel. The pump 

suction lines will be automatically realigned to take suction 

from the suppression pool when high SP level is detected, but 

this is generally not essential since the HPCS's mission should 

be completed prior to draining the CST. 

29 
A.a Low Pressure Coolant Injection/Residual Heat Removal 

(LPCI/RHR) System 

The LPCI/RHR is an engineered safeguards system designed to 

provide core cooling by injecting large amounts of water into the 

reactor vessel at high pressure and also to provide long term 

decay heat removal from the containment. Depending on its mode 

of operation, it is actuated by a low reactor vessel water level 

or high drywell pressure signal or by manual action. 

For the core cooling mode, the LPCI/RHR consists of three 

redundant pump trains along with their associated valves, piping, 

and control circuitry. Upon receipt of a signal, the system is 

automatically aligned and the pumps start. The pumps take 

suction from the suppression pool (SP) and discharge directly to 

the reactor vessel. 

For the residual heat removal mode, the LPCI/RHR consists of the 

two redundant pump trains (of the three mentioned above) which 

contain the RHR heat exchangers. Each train has two heat 

exchangers. Cooling to the heat exchangers is provided by the 

Residual Heat Removal Service Water System (RHRSWS), which is 

automatically actuated (see Section A.13). The alignment of the 

system is performed manually (if required) and depends on the 

existing plant conditions. For LOCA conditions (the reactor is 

not isolated and coolant is being lost to the suppression pool), 

no alignment is required since the suction and discharge is the 

same as for the core cooling mode. For transient conditions (no 

coolant loss from the reactor vessel), the pump suction lines are 

realigned to take suction directly from the reactor vessel and, 

if the system has not been automatically placed in operation, the 

pumps are started. 

A.9 Low Pressure Core Spray (LPCS) System 

The LPCS is an engineered safeguards system that is designed to 

provide reactor core cooling by injecting water into the reactor 

vessel at low pressure. It is automatically actuated by a low 

reactor water level signal. 

The LPCS consists of a motor-driven pump along with the 

associated piping, valves, and control circuitry. Upon receipt 

of a signal, the' system is automatically aligned and the pump 

starts. The pump takes suction from the suppression pool (SP) 

and discharges directly to the reactor vessel. 

A.10 Condensate System (CS) 

The condensate system was discussed previously as part of the 

power conversion system (Section A. 3) . It is capable of 

performing a low pressure injection function when the rest of the 

PCS is unavailable. In this mode , it takes suction from the 

condenser hotwell and injects it into the reactor vessel through. 

the idle feedwater pumps, using the motor driven feedwater pump 

control valve as its injection path. . 

30 
A.ll AC Power System (ACPS) 

The ACPS is a major support system that supplies power to the 

normal and emergency systems in the plant. The normal power 

system supplies power from the offsite power grid or the output 

of the main generator to all plant systems. If these power 

sources are not available, the emergency AC power system is 

capable of supplying power to those systems that are required to 

ensure safe shutdown or to mitigate the effects of any accident 

condition. 

During normal operation, the power is supplied to the electrical 

system through the normal station service transformer (NSST) from 

the main generator. In the event of a unit trip, the generator 

is isolated and power is supplied through the NSST or the reserve 

SST from the offsite grid. 

When offsite power is not available, the emergency AC power 

supplies a limited amount of power to the two main emergency 

busses and a third smaller emergency bus. The emergency AC power 

source consists of three emergency diesel/generator units. The 

first two are redundant, and each is dedicated to one of the two 

main emergency busses and is capable of supplying power to all 

engineered safety features and safe shutdown equipment fed from 

that bus. The third unit feeds the third emergency bus, which is 

specifically dedicated to the high pressure core spray system. 

All three units are started and tied to the emergency busses 

automatically upon receipt of a loss of offsite power signal. 

Cooling to the units is supplied by the diesel generator service 

water system (DGSWS). 

A.12 DC Power System (DCPS) 

The DCPS is the support system which provides power to plant 

controls and instruments, to the switchgear breakers for large 

pieces of equipment, and to actuate and load the emergency 

diesel/generators when offsite power is lost. Power is provided 

by a DC battery for each train (when AC power is not available) 

or by a battery charger unit (when AC power is available). 

The DC power system consists of three trains (each containing a 

battery and battery charger), along with associated busses, motor 

control centers, instrument AC inverters, distribution panels, 

switches, wires, fuses, etc. Each train is dedicated to one of 

the emergency AC power trains. 

A.13 Residual Heat Removal Service Water System (RHRSWS) 

The RHRSWS is the support system that cools the LPCI/RHR system 

equipment. Raw water suction is taken from the ultimate heat 

sink and pumped through the RHR heat exchangers and equipment 

coolers. The water is returned to the ultimate heat sink. 

31 
The RHRSWS consists of two pump trains (each containing two 

pumps), along with associated piping, valves, and control 

circuitry. Each train is dedicated to a LPCI/RHR train, and 

provides cooling to the associated RHR pump and heat exchanger. 

This cooling is only required during the RHR cooling mode of the 

LPCI/RHR system. The RHRSWS automatically starts on receipt of a 

signal which would initiate the LPCI/RHR system. 

A.14 Diesel Generator Service Water System (DGSWS) 

The DGSWS is the support system that cools most of the engineered 

safety features equipment. Raw water suction is taken from the 

ultimate heat sink and pumped through various heat exchangers and 

equipment coolers. The water is returned to the ultimate heat 

sink. 

The DGSWS consists of three pump trains, along with associated 

piping, valves, and control circuitry. Each train is dedicated 

to a particular diesel generator train, and provides cooling to 

the associated diesel generator and to all the safety equipment 

which is powered by that electrical train. The system 

automatically starts on receipt of any signal which would 

initiate any safety system or diesel generator unit. 

A.1S Circulating Water System (CWS) 

The CWS is a support system which provides cooling to the main 

condenser. It does this by injecting cool water through the 

tubes of the main condenser. It is a normally operating system. 

The CWS consists of a series of circulating water pumps, along 

with piping, valves, and control circuitry. The pumps take 

suction directly from the ultimate heat sink and inject it 

through the circulating water piping to the main condenser. The 

water is then discharged back to the ultimate heat sink. 

A.16 Turbine Building Closed Cooling Water System (TBCCWS) 

The TBCCWS is a support systems which provides cooling to the 

secondary plant equipment used to operate the secondary plant 

cycle. It does this by circulating water through various 

equipment coolers in that equipment. It is a normally operating 

system. 

The TBCCWS consists of the TBCCW pumps, TBCCW heat exchangers, 

along with piping , valves, and control circuitry. The pumps 

circulate water in a closed loop, pumping the water first through 

the TBCCW heat exchangers and the discharge of the heat 

exchangers is routed to the secondary equipment coolers. The 

discharge of the equipment coolers is then returned to the TBCCW 

pump suction header. The cycle is cooled by the service water 

system. 

32 
A.I7 Reactor Building Closed Cooling Water System (RBCCWS) 

The RBCCWS is a support systems which provides cooling to the 

secondary plant equipment used to operate the primary (reactor 

coolant system) plant cycle. It does this by circulating water 

through various equipment coolers in that equipment. It is a 

normally operating system. 

The RBCCWS consists of the RBCCW pumps, RBCCW heat exchangers, 

along with piping , valves, and control circuitry. The pumps 

circulate water in a closed loop, pumping the water first through 

the RBCCW heat exchangers and the discharge of the heat 

exchangers is routed to the secondary equipment coolers. The 

discharge of the equipment coolers is then returned to the RBCCW 

pump suction header. The cycle is cooled by the service water 

system. 

A.I8 Service Water System (SWS) 

The SWS is a support system which provides cooling the the TBCCW 

and RBCCW systems. It does this by injecting water into the 

secondary side of the heat exchangers in those systems. It is a 

normally operating system. 

The SWS consists of a series of service water pumps, along with 

piping , valves, and control circuitry. The pumps take suction 

directly from the ultimate heat sink and inject it through the 

service water piping to the TBCCW and RBCCW heat exchangers. The 

water is then discharged back to the ultimate heat sink. 

33 

NRC FORM 335 

12·84) 

U.S. NUCLEAR REGULATORY COMMISSION I. REPORT NUMBER (Assigned by TlDC, add Vol. No., if any) 

NRCM 1102, 

3201,3202 BIBLIOGRAPHIC DATA SHEET NUREG/CR-5076 

SEE INSTRUCTIONS ON THE REVERSE. 

2. TITLE AND SUBTITLE 

An Approach to the Quantification of Seismic Margins 

in Nuclear Power Plants: The Importance of BWR Plant 

Systems and Functions to Seismic Margins 

5. AUTHOR IS) 

PaulJ. Amico 

7. PERFORMING ORGANIZATION NAME AND MAILING ADDRESS (Include Zip Code) 

Applied Risk Technology Corporation 

P.O. Box 175 

Columbia, MD 21045 

Under Contract to: 

LLML 

7000 East Avenue 

Livermore CA 94550 

10. SPONSORING ORGANIZATION NAME AND MAILING ADDRESS (Include Zip Code) 

Division 6f Engineering 

Office of Nuclear Regulatory Research 

US Nuclear Regulatory Commission 

Washington, DC 20555 

12. SUPPLEMENTARY NOTES 

13. ABSTRACT (200 words or less) 

UCRL-15985 

3. LEAVE BLANK 

4. DATE REPORT COMPLETED 

MONTH YEAR 

Aoril 1988 6. DATE REPORT ISSUED 

MONTH YEAR 

May 1988 8. PROJECT/TASK/WORK UNIT NUMBER 

9. FIN OR GRANT NUMBER 

A0398 

11 •. TYPE OF REPORT 

Technical 

b. PERIOD COVERED (Inclusive dates) 

1986-1988 

In NUREG/CR-4334 ("An Approach to the Quantification of Seismic Margins in Nuclear 

Power Plants"), the Expert Panel on Quantification of Seismic Margins presented a 

technique for studying the issue of quantifying seismic margins. As part of that 

technique, the panel included methods for simplifying the margins assessment by screening out components and systems using both systems and fragilities screening out 

components and systems using both systems and fragilities screening guidelines. At 

the time of that report, the panel was able to develop fragilities screening guide- lines for all plants, however the systems screening guidelines applied only to PWRs 

(due to a shortage of BWR seismic PRAs upon which to base BWR systems screening guidelines). This report develops the BWR systems screening guidelines by utilizing the results of a number of BWR PRAs which have become available since the publication 

of NUREG/CR-4334. 

14. DOCUMENT ANAL YSIS •. KEYWORDS/DESCRIPTORS 

Seismic Design, Seismic Margins Probabilistic Risk Analysis, Boiling 

Water Reactor 

b. IDENTIFIERS/OPEN,ENDED TERMS 

15. AVAILABILITY 

STATEMENT 

Un 1 imited 16. SECURITY CLASSIFICATION 

Unclassified 

(This rtlport) 

Unclassified 17. NUMBER OF PAGES 

18 PRICE 
.,.