NUREG/CR-4839

SAND87-7156

Methods for External Event

Screening Quantification:

Risk Methods Integration and

Evaluation Program (RMIEP)

Methods Development

Prepared by

M. K. Ravindra, H. Banon

NTS/Structural Mechanics Associates

Sandia National Laboratories

Prepared for

U.S. Nuclear Regulatory Commission
AVAILABIUTY NOTICE

Availability of Reference Materials Cited In NRC Publications

Most documents cited In NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, WashIngton. DC 20555

2. The Superintendent of Documents. U.S. Government Printing Office, P.O. Box 37082, Washington.

DC 20013-7082

3. The National Technical Information Service, Springfield, VA 22161

Although the listing that follows represents the majority of documents cited In NRC publications. It Is not

Intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room

Include NRC correspondence and Internal NRC memoranda: NRC bulletins, circulars, Information notices,

Inspection and Investigation notices: licensee event reports: vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents In the NUREG series are available for purchase from the GPO Sales Program:

formal NRC staff and contractor reports. NRC-sponsored conference proceedings. International agreement

reports, grant publications, and NRC booklets and brochures. Also available are regulatory guides. NRC

regulations In the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service Include NUREG-serles reports and

technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature Items, such as

books, journal articles, and transactions. Federal Register notices. Federal and State legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the

Office of Administration, Distribution and Mail Services Section. U.S. Nuclear Regulatory Commission,

Washington, DC 20555.

Copies of Industry codes and standards used in a substantive manner In the NRC regulatory process are

maintained at the NRC Library. 7920 Norfolk Avenue, Bethesda, Maryland, for use by the public. Codes and

standards are usually copyrighted and may be purchased from the originating organization or, If they are

American National Standards, from the American National Standards Institute, 1430 Broadway, New York,

NY 10018.

DISCLAIMER NOTICE

This report was prepared as an account of work sponsored by an agency of the United States Government.

Neitherthe United States Government norany agencythereof, orany of their employees, makes anywarranty,

expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of

such use, of any information, apparatus, product or process disclosed In this report, or represents that its use

by such third party would not Infringe privately owned rights.
NUREG/CR-4839

SAND87-7156

RX

Methods for External Event

Screening Quantification:

Risk Methods Integration and

Evaluation Program (RMIEP)

Methods Development

Manuscript Completed: February 1985

Date Published: July 1992

Prepared by

M. K. Ravindral, H. Banon2

NTS/Structural Mechanics Associates

5160 Birch Street

Newport Beach, CA 92660

Under Contract to:

Sandia National Laboratories

Albuquerque, NM 87185

Prepared for

Division of Safety Issue Resolution

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555

NRC FIN A1386

'Currently with EQE, Inc., Costa Mesa, CA

2Currently with Exxon Production Research, Houston, TX

ABSTRACT

In this report, the scoping quantification procedures for

external events in probabilistic risk assessments of nuclear

power plants are described. External event analysis in a PRA

has three important goals:

1. The analysis should be complete in that all events are

considered.

2. By following some selected screening criteria, the

more significant events are identified for detailed

analysis.

3. The selected' events are analyzed in depth by taking

into account the unique features of the events:

hazard, fragility of structures and equipment,

external-event initiated accident sequences, etc.

Based on the above goals, external event analysis may be

considered as a three-stage process:

Stage I: Identification and Initial Screening of

External Events

Stage II: Bounding Analysis

Stage III: Detailed Risk Analysis

In the present report, first, a review of published PRAs is

given to focus on the significance and treatment of external

events in full-scope PRAs. Except for seismic, flooding,

fire, and extreme wind events, the contributions of other

external events to plant risk have been found to be

negligible. Second, scoping methods for external events not

covered in detail in the NRC's PRA Procedures Guide are

provided. For this purpose, bounding analyses for

transportation accidents, extreme winds and tornadoes,

aircraft impacts, turbine missiles, and chemical release are

described.

iii/iv

CONTENTS

Pacte

ABSTRACT ii

FOREWORD xiii

ACKNOWLEDGEMENT xvii

1.0 INTRODUCTION 1-1

1.1 RMIEP 1-1

1.2 PRA Procedures Guide 1-1

1.3 Objective 1-2

1.4 Report Outline 1-2

2.0 REVIEW OF PUBLISHED EXTERNAL EVENT PRA STUDIES 2-1

2.1 Introduction 2-1

2.2 Zion 2-1

2.2.1 Tornadoes and Tornado Missiles 2-1

2.2.2 Aircraft Accidents 2-2

2.2.3 Transportation and Hazardous

Materials 2-3

2.2.4 Turbine Missiles 2-3

2.3 Indian Point 2-3

2.3.1 Winds and Tornado Missiles 2-3

2.3.2 Aircraft Accidents 2-4

2.3.3 Transportation and Storage of

Hazardous Materials 2-4

2.3.4 Turbine Missiles 2-4

2.4 Limerick 2-4

2.4.1 Tornadoes 2-5

2.4.2 Transportation Accidents 2-5

2.5 Seabrook 2-6

2.5.1 Aircraft Crash Analysis 2-6

2.5.2 Hazardous Chemicals and Transportation Events 2-7

2.6 Millstone Unit 3 2-7

2.6.1 Winds and Tornado Missiles 2-7

2.6.2 Aircraft Accidents 2-8
CONTENTS

(Continued)

Pacre

2.6.3 Transportation and Storage of

Hazardous Materials 2-8

2.6.4 Turbine Missiles 2-8

2.7 Oconee 2-8

2.7.1 Tornado 2-9

2.7.2 Aircraft Impact 2-10

2.7.3 Turbine Missiles 2-12

3.0 EXTERNAL EVENT METHODOLOGY 3-1

3.1 Identification and Initial Screening of

External Events 3-1

3.2 Approximate Bounding Analysis of Risks

from External Events 3-8

3.2.1 Hazard Analysis 3-8

3.2.2 Response and Fragility Evaluation 3-8

3.2.3 Accident Sequence and Consequence

Analysis 3-8

3.2.4 Approximate Analysis of Risks 3-9

3.2.5 Treatment of Uncertainty 3-10

3.3 Detailed Analysis of Risks from External

Events 3-10

4.0 BOUNDING ANALYSES FOR SELECTED EXTERNAL EVENTS 4-1

4.1 Transportation Accidents 4-1

4.1.1 Collection of Information 4-1

4.1.2 FSAR Analysis 4-1

4.1.3 Bounding Analysis 4-4

4.2 Extreme Winds and Tornadoes 4-10

4.2.1 Collection of Information 4-10

4.2.2 FSAR Analysis 4-10

4.2.3 Bounding Analysis 4-12

4.2.4 Scoping Analysis Procedures 4-24

-vi-
CONTENTS

(Concluded)

Pacre

4.3 Aircraft Impacts 4-41

4.3.1 Collection of Information 4-41

4.3.2 FSAR Analysis 4-41

4.3.3 Methods of Bounding Analysis 4-42

4.3.4 Bounding Analysis Based on System

Considerations 4-44

4.4 Turbine Missiles 4-47

4.4.1 Collection of Information 4-47

4.4.2 FSAR Analysis 4-49

4.4.3 Turbine Missile Risk Analysis 4-52

4.5 Other External Events 4-58

4.5.1 Accidents in Nearby Industrial and

Military Facility 4-58

4.5.2 Pipeline Accidents 4-58

4.5.3 Chemical Release 4-59

4.5.3.1 Onsite Storage 4-61

4.5.3.2 Offsite Storage and Handling of Chemicals 4-61

5.0 SUMMARY AND CONCLUSIONS 5-1

REFERENCES R-1

-vii-

LIST OF TABLES

Table Page

2.7-1 Treatment of External Hazards in the

Oconee PRA 2-14

2.7-2 Aircraft Accident Rate R 2-15

2.7-3 Summary of Estimated Turbine Missile

Strike and Damage Rates for Oconee Unit 3 2-16

3.1-1 Natural and Man-Induced External Events

to be Considered in PRA Studies 3-4

4.2-1 Design Basis Tornado Characteristics 4-26

4.2-2 Intensity, Length, Width, and Area Scales 4-27

4.2-3 Regional Tornado Occurrence - Intensity

Relationships Corrected for Direct

Classification Errors and Random Encounter

Errors 4-28

4.2-4 Intensity-Area Relationship Including

Corrections for Direct Observation and

Random Encounter Errors (AIM Matrix) 4-29

4.2-5 Variation of Tornado Intensity Along Path

Length and Across Path Width (VWL Matrix) 4-30

4.2-6 Intensity-Length Relationship Including

Corrections for Direct Observation and

Random Encounter Errors (LIM Matrix) 4-31

4.2-7 Variation of Intensity Along Length

Based on Percentage of Length Per Tornado

(VL Matrix) 4-32

4.2-8 NRC Standard Review Plan Spectrum of

Tornado Missile 4-33

4.2-9 Severe Tornado Event Tree Accident

Sequences (Oconee PRA) 4-34

-ix-

LIST OF FIGURES

Ficture page

2.7-1 Event Tree for Sequences Initiated by a

Severe Tornado 2-17

2.7-2 Oconee Unit 3 - Critical Areas for

Turbine Missiles 2-18

4.1-1 Radius to Peak Incident Pressure of 1 PSI 4-6

4.1-2 Pressure Pulses from TNT 4-7

4.1-3 Free-Field Blast Wave Parameters Versus

Scaled Distance for TNT Surface Bursts

(Hemispherical Charges) 4-8

4.1-4 Dynamic Load Factors. Maximum response

of one-degree elastic systems (undamped)

subjected to rectangular and triangular

load pulses having zero rise time. 4-9

4.2-1 Tornado Risk Regionalization Scheme

Proposed by WASH-1300, Markee, et al.

(1975) 4-35

4.2-2 Tornado Risk Regionalization Scheme

Proposed by Twisdale and Dunn (1983) 4-36

4.2-3 Tornado Parameters and Damage Origin

Area Definition 4-37

4.2-4 Sketch of Hypothetical F4 Tornado

Illustrating Variation of Intensity 4-38

4.2-5 Typical Tornado Hazard Curves for a

Site in Region A 4-39

4.2-6 Event Tree for Sequences Initiated by

a Severe Tornado 4-40

4.3-1 Geometry forAircraft Impact

Probabilistic Model 4-46

4.4-1 Low-Trajectory Turbine Missile Strike

Zone 4-56

4.4-2 Variables and Terminology Used in

Calculating Missile Strike Probabilities 4-57

4.5-1 Fault-Tree-Like Representation of ToxicVapor Release 4-63

4.5-2 Event Tree Illustrating Effect of

Chlorine on Operators 4-64

-xi-

FOREWORD

LaSalle Unit 2 Level III Probabilistic Risk Assessment

In recent years, applications of Probabilistic Risk Assessment

(PRA) to nuclear power plants have experienced increasing

acceptance and use, particularly in addressing regulatory

issues. Although progress on the PRA front has been

impressive, the usage of PRA methods and insights to address

increasingly broader regulatory issues has resulted in the

need for continued improvement in and expansion of PRA methods

to support the needs of the Nuclear Regulatory Commission

(NRC).

Before any new PRA methods can be considered suitable for

routine use in the regulatory arena, they need to be

integrated into the overall framework of a PRA, appropriate

interfaces defined, and the utility of the methods evaluated.

The LaSalle Unit 2 Level III PRA, described in this and

associated reports, integrates new methods and new

applications of previous methods into a PRA framework that

provides for this integration and evaluation. It helps lay

the bases for both the routine use of the methods and the

preparation of procedures that will provide guidance for

future PRAs used in addressing regulatory issues. These new

methods, once integrated into the framework of a PRA and

evaluated, lead to a more complete PRA analysis, a better

understanding of the uncertainties in PRA results, and broader

insights into the importance of plant design and operational

characteristics to public risk.

In order to satisfy the needs described above, the LaSalle

Unit 2, Leve-l III PRA addresses the following broad

objectives:

1) To develop and apply methods to integrate internal,

external, and dependent failure risk methods to

achieve greater efficiency, consistency, and

completeness in the conduct of risk assessments;

2) To evaluate PRA technology developments and formulate

improved PRA procedures;

3) To identify, evaluate, and effectively display the

uncertainties in PRA risk predictions that stem from

limitations in plant modeling, PRA methods, data, or

physical processes that occur during the evolution of

a severe accident;

-xiii-
4) To conduct a PRA on a BWR 5, Mark II nuclear power

plant, ascertain the plant's dominant accident

sequences, evaluate the core and containment response

to accidents, calculate the consequences of the

accidents, and assess overall risk; and finally

5) To formulate the results in such a manner as to allow

the PRA to be easily updated and to allow testing of

future improvements in methodology, data, and the

treatment of phenomena.

The LaSalle Unit 2 PRA was performed for the NRC by Sandia

National Laboratories (SNL) with substantial help from

Commonwealth Edison (CECo) and its contractors. Because of

the size and scope of the PRA, various related programs were

set up to conduct different aspects of the analysis.

Additionally, existing programs had tasks added to perform

some analyses for the LaSalle PRA. The responsibility for

overall direction of the PRA was assigned to the Risk Methods

Integration and Evaluation Program (RMIEP). RMIEP was

specifically responsible for all aspects of the Level I

analysis (i.e., the core damage analysis). The Phenomenology

and Risk Uncertainty Evaluation Program (PRUEP) was

responsible for the Level II/III analysis (i.e., accident

progression, source term, consequence analyses, and risk

integration). Other programs provided support in various

areas or performed some of the subanalyses. These programs

include the Seismic Safety Margins Research Program (SSMRP) at

Lawrence Livermore National Laboratory (LLNL), which performed

the seismic analysis; the Integrated Dependent Failure

Analysis Program, which developed methods and analyzed data

for dependent failure modeling; the MELCOR Program, which

modified the MELCOR code in response to the PRA's modeling

needs; the Fire Research Program, which performed the fire

analysis; the PRA Methods Development Program, which developed

some of the new methods used in the PRA; and the Data

Programs, which provided new and updated data for BWR plants

similar to LaSalle. CECo provided plant design and

operational information and reviewed many of the analysis

results.

The LaSalle PRA was begun before the NUREG-1150 analysis and

the LaSalle program has supplied the NUREG-I1S0 program with

simplified location analysis methods for integrated analysis

of external events, insights on possible subtle interactions

that come from the very detailed system models used in the

LaSalle PRA, core vulnerable sequence resolution methods,

methods for handling and propagating statistical uncertainties

in an integrated way through the entire analysis, and BWR

thermal-hydraulic models which were adapted for the Peach

Bottom and Grand Gulf analyses.

-xiv-
The Level I results of the LaSalle Unit 2 PRA are presented

in: "Analysis of the LaSalle Unit 2 Nuclear Power Plant:

Risk Methods Integration and Evaluation Program (RMIEP),"

NUREG/CR-4832, SAND92-0537, ten volumes. The reports are

organized as follows:

NUREG/CR-4832 - Volume 1:

NUREG/CR-4832 - Volume 2:

NUREG/CR-4832 - Volume 3:

NUREG/CR-4832 - Volume 4:

NUREG/CR-4832 - Volume 5:

NUREG/CR-4832 - Volume 6:

NUREG/CR-4832 - Volume 7:

NUREG/CR-4832 - Volume 8:

NUREG/CR-4832 - Volume 9:

NUREG/CR-4832 - Volume 10:

The Level II/III results of

Summary Report.

Integrated Quantification and

Uncertainty Analysis.

Internal Events Accident

Sequence Quantification.

Initiating Events and Accident

Sequence Delineation.

Parameter Estimation Analysis

and Human Reliability

Screening Analysis.

System Descriptions and Fault

Tree Definition.

External Event Scoping

Quantification.

Seismic Analysis.

Internal Fire Analysis.

Internal Flood Analysis.

the LaSalle Unit 2 PRA are

presented in: "Integrated Risk Assessment For the LaSalle

Unit 2 Nuclear Power Plant: - Phenomenology and Risk

Uncertainty Evaluation Program (PRUEP)," NUREG/CR-5305,

SAND90-2765, 3 volumes. The reports are organized as follows:

NUREG/CR-5305 - Volume 1: Main Report

NUREG/CR-5305 - Volume 2: Appendices A-G

NUREG/CR-5305 - Volume 3: MELCOR Code Calculations

Important associated reports have been issued by the RMIEP

Methods Development Program in: NUREG/CR-4834, Recovery

Actions in PRA for the Risk Methods Integration and Evaluation

Program (RMIEP); NUREG/CR-4835, Comparison and Application of

Quantitative Human Reliability Analysis Methods for the Risk

-xv-
Methods Integration and Evaluation Program (RMIEP); NUREG/CR4836, Approaches to Uncertainty Analysis in Probabilistic Risk

Assessment; NUREG/CR-4838, Microcomputer Applications and

Modifications to the Modular Fault Trees; and NUREG/CR-4840,

Procedures for the External Event Core Damage Frequency

Analysis for NUREG-1150.

Some of the computer codes, expert judgement elicitations, and

other supporting information used in this analysis are

documented in associated reports, including: NUREG/CR-4586,

User's Guide for a Personal-Computer-Based Nuclear Power Plant

Fire Data Base; NUREG/CR-4598, A User's Guide for the Top

Event Matrix Analysis Code (TEMAC); NUREG/CR-5032, Modeling

Time to Recovery and Initiating Event Frequency for Loss of

Off-Site Power Incidents at Nuclear Power Plants; NUREG/CR5088, Fire Risk Scoping Study: Investigation of Nuclear Power

Plant Fire Risk, Including Previously Unaddressed Issues;

NUREG/CR-5174, A Reference Manual for the Event Progression

Analysis Code (EVNTRE); NUREG/CR-5253, PARTITION: A Program

for Defining the Source Term/Consequence Analysis Interface in

the NUREG-1150 Probabilistic Risk Assessments, User's Guide;

NUREG/CR-5262, PRAMIS: Probabilistic Risk Assessment Model

Integration System, User's Guide; NUREG/CR-5331, MELCOR

Analysis for Accident Progression Issues; NUREG/CR-5346,

Assessment of the XXSOR Codes; and NUREG/CR-5380, A User's

Manual for the Postprocessing Program PSTEVNT. In addition

the reader is directed to the NUREG-I150 technical support

reports in NUREG/CR-4550 and 4551.

Arthur C. Payne, Jr.

Principal Investigator

Phenomenology and Risk Uncertainty Evaluation Program and

Risk Methods Integration and Evaluation Program

Division 6412, Reactor Systems Safety Analysis

Sandia National Laboratories

Albuquerque, New Mexico 87185

-xvi-
ACKNOWLEDGMENT

The authors wish to acknowledge the guidance and technical

support of Gregory J. Kolb and Kathleen Diegert.

-xvii-

1.0 INTRODUCTION

1.1 RMIEP

The Risk Methods Integration and Evaluation Program (RMIEP)

was performed for the NRC by Sandia National Laboratories.

The RMIEP program was the level I part of the Level III

Probabilistic Risk Assessment (PRA) of the LaSalle County

Station (LSCS). As part of this program, new methodologies

were developed that would be applied in the LaSalle PRA. One

task of the RMIEP program was defined as an external event

scoping quantification study, which would select the external

events to be included in the detailed external events

analysis. NTS/Structural Mechanics Associates was retained by

Sandia National Laboratories to perform the scoping

quantification study for LSCS, which is reported elsewhere

(Ravindra and Banon, 1992). As part of the LaSalle scoping

quantification study, a review of existing methods and

analytical techniques for probabilistic bounding analysis of

potential external events at a nuclear power plant site was

carried out. This report summarizes these methods and

recommends the methods that could be applied in an external

event scoping quantification as of the begining of 1985 when

this task was completed.

Although a general external event scoping study would consider

all possible external events at a site, seismic, internal

flood, and fire events were excluded from the present study.

Based on the experience gained from the recent PRA studies,

they are considered to be potential contributors to plant risk

and thus should be included in any detailed PRA external

events analysis.

1.2 PRA Procedures Guide

A full-scope PRA of a nuclear power plant should consider all

internal and external events that may pose a potential threat

to the plant safety and contribute to the public risk. The

detail to which the risk analysis is performed for each event

depends on its frequency of occurrence and its effect on plant

systems. In recent PRA studies, some external events (e.g.,

seismic, fire, internal flood, and extreme winds) have been

treated in detail; other external events (e.g., turbine

missiles, aircraft impact, and external flooding) have been

dismissed as insignificant based on available data and

judgment. Since PRA is a logical and formal procedure for

examining all potential accidents, a logical and formal

approach is needed for selection of important external events.

The aim is to ensure that all potential external events are

considered and that the significant ones are selected for more

detailed studies. In fact, such a formal procedure has been

1-1
developed in the PRA Procedures Guide, NUREG/CR-2300 (USNRC,

1983). Use of this procedure facilitates complete

documentation of the basis for selecting the external hazards

that deserve further detailed attention.

The PRA Procedures Guide gives appropriate methods for

screening out external natural and man-made hazards from a

full-scope PRA. Chapter 10 of the Procedures Guide gives the

screening techniques based on the site location, design bases,

and probabilistic bounding analyses. For those events

considered to require detailed risk analysis, a general

methodology is described. Chapter 11 of the Procedures Guide

gives detailed procedures for performing risk analysis of

seismic, fire, and flooding events. To date, early 1985,

full-scope probabilistic risk assessments of seven nuclear

power plants have been completed. These are Zion, Indian

Point Units 2 and 3, Limerick, Seabrook, Midland, Millstone,

and Oconee Unit 3. External events have been considered in

each of these PRAs. Some form of scoping analysis has been

followed in each case.

1.3 Obiective

The objective of this report is to describe the scoping

quantification methods for identifying external events (if

any) that require an in-depth consideration in a PRA. The

methods and events to be discussed supplement the seismic,

flood, and fire events described in detail in the PRA

Procedures Guide (USNRC, 1983) and are intermediate between

initial screening methods and the detailed methods.

1.4 Report Outline

This report describes the methods for external event scoping

quantification in a nuclear power plant PRA. It is divided

into four chapters. Chapter 1 is an overview of the study and

its relationship to RMIEP and the PRA Procedures Guide.

Chapter 2 is a review of published external event PRA studies

with the idea of identifying commonly used methods for

external event scoping analysis. Chapter 3 describes the

external event methodology as developed in the PRA Procedures

Guide; it includes identification and initial screening of

external events, approximate bounding analysis, and detailed

risk analysis. In Chapter 4, bounding analyses are described

for external events not analyzed in the PRA Procedures Guide:

transportation accidents, extreme winds and tornadoes,

aircraft impacts, turbine missiles, accidents in nearby

industrial and military facilities, pipeline accidents, and

chemical release. Chapter 5 gives a summary and salient

conclusions of this report.

1-2
2.0 REVIEW OF PUBLISHED EXTERNAL EVENT PRA STUDIES

2.1 Introduction

To date, early 1985, seven full-scope probabilistic risk

assessment studies have been published. They have included

the consideration of external events to varying degrees of

detail. Seismic, wind, flooding (internal), and fire have

typically been treated extensively. Other external events

have been considered; in many instances, some bounding

analyses have been performed to demonstrate that the

contributions of these events to plant risk are not

significant. The methods used for each external event in

these PRAs are essentially identical. In some instances, the

analyst has stopped the evaluation of frequency at the

occurrence of the hazard; in some instances, the analyst has

found the need to carry the analysis up to the calculation of

the core damage frequencies.

In the following sections, we briefly review these published

external event PRA studies.

2.2 Zion

In the Zion Probabilistic Safety Study (CECO, 1981), the

following external events were considered:

Seismic

Fire

Flooding

Tornadoes and Tornado Missiles

Aircraft Accidents

Transportation of Hazardous Materials

Turbine Missiles.

Within the scope of the present report, we discuss the

analyses performed for the last four external events listed

above.

2.2.1 Tornadoes and Tornado Missiles

The annual probability of exceeding velocity V, P(V), at the

site was calculated by (Garson, et al., 1974).

P(V) = A(VdV)/k * R'(V)

where A = local mean rate of occurrence of tornadoes per

square mile per year,

Vd = gale velocity,

2-1
k = 0.5 to 1.6; a parameter depending on a given

storm; taken to be 1.6,

R'(V) = 17.4 * exp (-0.014 * V) for V > 290 mph.

At Zion, if A = 1.0 x 10-3, Vd = 40 mph and V = 360 mph, then

P(V) = 2.8 x 10- 5 per year.

The 5 to 95 percent confidence bounds on P(V) were developed

by considering the uncertainties in A, k, and R' (V); these

resulted in a bound for P(V) from 3.0 x 10-7 to 2.5 x 10-3.

The analysis was not carried further; it did not include the

uncertainty in structural capacity and the consequences of

structural failure in a tornado.

Based on the results of a tornado missile risk analysis

performed by Twisdale, Dunn and Cho (1978), the probability of

tornado missiles striking and scabbing the walls of Zion plant

structures was estimated as 2 x 10-6 per year. The probability of damaging certain equipment thereby leading to core

damage was estimated to be lower by a factor of 10-2 (i.e.,

2 x 10-8 per year). This core damage probability was judged

to be acceptably small, and the tornadoes and tornado missiles

were not considered to be significant risk contributors.

2.2.2 Aircraft Accidents

The aircraft accident analysis considered the hazard from the

operation of the Waukegan Memorial Airport, about 4 miles from

the plant. Since the Zion plant structures have been designed

to withstand an impact by aircraft under 30,000 pounds, the

analysis was limited to large aircraft of the business jet

category. The vulnerable plant area (A), which included

containment buildings, the fuel handling building and the

auxiliary building, was estimated as 0.006 mi 2 with 5 percent

to 95 percent confidence bounds of 0.005 mi 2 to 0.008 mi 2 ,

respectively. The aerial crash density (C) for the air

carrier aircraft of 0.68 x 10-8 per operation was used. The

annual probability of business jet aircraft impacting the

plant was obtained as:

Mean = 2.0 x 10-7

5 percent confidence bound = 1.5 x 10-7

95 percent confidence bound = 5.0 x 10-7

The annual probability of aircraft initiated core damage was

estimated to be much less than 10-8 and was not considered to

be a significant contributor to risk.

2-2
2.2.3 Transportation and Hazardous Materials

A review of the rail, highway, barge, and shipping traffic

lanes in the vicinity of Zion revealed that potential

accidents on them do not pose a threat to the plant safety.

Similarly, no substantial concentrations of offsite or onsite

hazardous materials exist near Zion. Hence, it was judged

that no detailed probabilistic risk analysis of these external

hazards was necessary.

2.2.4 Turbine Missiles

No detailed analysis of turbine missiles was done pending the

resolution of the stress corrosion cracking issue in steam

turbines. It was judged that the probability of turbine

missile initiated core damage would be acceptably small.

2.3 Indian Point

The Probabilistic Safety Study (PSS) of Indian Point Units 2

and 3 (PASNY, 1982) analyzed the following external events:

Seismic

Fire

External and Internal Flooding

Winds and Tornado Missiles

Aircraft Accidents

Transportation and Storage of Hazardous Materials

Turbine Missiles

Within the scope of the present report, we will discuss the

last four items in the above list.

2.3.1 Winds and Tornado Missiles

Indian Point Units 2 and 3 have some steel framed structures

with metal siding and roofing that contain critical equipment.

Also there are several exposed critical components (e.g.,

service water pumps, station auxiliary transformers, and gas

turbines). These may all be subject to failure from wind and

tornadic pressures or impact by tornado missiles. Therefore,

a detailed analysis of the wind and tornado missiles was

performed.

The analysis consisted of wind and tornado hazard analysis,

wind fragility evaluation, and plant systems and accident

sequence analysis. For details, the reader is referred to the

Indian Point PSS report.

2-3
2.3.2 Aircraft Accidents

Aircraft crash probabilities as a result of operations from

the Peekskill Seaplane Base and on the federal airways were

evaluated using the methods outlined in the NRC Standard

Review Plan (USNRC, 1975). By reviewing the plant

arrangement, thicknesses of exterior walls and roofs of plant

structures, and the systems needed for safe shutdown, it was

determined that the probability of damage from aircraft

impacts is very low.

2.3.3 Transportation and Storage of Hazardous Materials

Two aspects of the bounding analysis performed to evaluate the

risks from transportation and storage of hazardous materials

are worth noting here. An analysis of the possible accidental

collision of barges of the Hudson River and its potential to

cause a fire at the shoreline or a release of sodium hydroxide

was conducted; the annual frequency of this event was

estimated to be between 10 9 and 1 0-b and hence would not

contribute significantly to core damage frequency.

There are two natural gas transmission lines (26" and 30"

diameter) passing through the site about 400 ft. from the

nearest Unit 3 plant structure. The annual frequency of these

pipes leaking and causing a fire hazard to the plant was

estimated to be 5 x 10-7. The probability of this event

leading to core damage was judged to be extremely small.

2.3.4 Turbine Missiles

No detailed analysis of turbine missile induced risks was done

pending the results of stress corrosion cracking studies being

performed by the turbine vendor.

2.4 Limerick

In the Severe Accident Risk Assessment (SARA) of Limerick

Generating Station (PECO, 1983), the following external events

were studied:

Seismic

Fire

Flooding

Tornadoes

Transportation Accidents including Aircraft Impact

Turbine Missiles

2-4
2.4.1 Tornadoes

A bounding analysis of the risks from tornadoes was performed.

Since Limerick is designed to current criteria for tornado

loading and missile protection, the annual frequency of

tornado-induced core damage is low, as expected. The analysis

divided the tornadoes into two classes: less severe than the

design basis tornado (DBT) and at or above DBT. Structures

not specifically designed for DBT effects (e.g., electrical

transformers and substations, turbine enclosure, condensatestorage tank, and cooling towers) are assumed to be severely

damaged by wind speeds greater than 90 mph. Category I

Structures specifically designed for DBT effects were assumed

to fail in wind speeds greater than 300 mph. The annual

frequency of tornadoes impacting the first class of structures

with wind speeds in excess of 90 mph was estimated to be

2 x 10-5. The DAPPLE index approach proposed by Abbey and

Fujita (1975) and Abbey (1976) was utilized in this

computation. Similarly, the annual frequency of tornadoes

impacting the seismic Category I structures with wind speeds

in excess of 300 mph was estimated at 10-7. With these

tornado-initiated accidents (i.e., damage to the structures),

systems analysis were performed and concluded that the

contribution of tornado-initiated accidents to the core damage

frequency is negligible.

2.4.2 Transportation Accidents

The accidental release of toxic chemicals or flammable vapor

clouds from the railroad, the highway, or the nearby Hooker

Chemical plant was analyzed. It was concluded that such an

accidental release would lead to a reactor accident only if

the plant operators are affected in such a way that they

cannot respond to an emergency if required to do so, or that

they commit errors in responding to the emergency. The plant

is equipped with systems to detect toxic vapors and to provide

counter measures.

The plant requires about 20,000 lbs. of chlorine daily for

water purification. Chlorine is shipped to the plant by

railroad tank car. The accidental release of chlorine due to

spontaneous failure, earthquake, shunting operations, and

failure of pipework or couplings during discharge to the

pumphouse was analyzed in detail. The annual frequency of

core damage induced by chlorine release was estimated as

5 x I0"9.

The Conrail railroad passes about 600 ft. from the nearest

safety-related structure; this structure is designed to

withstand the blast from 56 tons of TNT. Since the railroad

carries a number of hazardous chemicals, such as propane,

2-5
butadiene, and vinyl chloride in quantities larger than 56

tons of TNT, a bounding analysis of the explosion hazard was

done. The frequency of overpressure due to accidents on the

railroad exceeding the capacity of structures was estimated as

the sum of the contributions from accident site explosions and

drifting cloud explosions. The predicted frequency of this

overpressure is 1.1 x 10-7 per year.

The bounding analyses performed for chlorine release and

explosion hazards are the most detailed among the published

PRAs.

2.5 Seabrook

The PRA study on the Seabrook Generating Station has

considered many external events. Two basic approaches were

used in, analyzing the external events. One was a limited

bounding analysis for some external hazards to show that the

largest predicted sizes are not capable of causing significant

damage to the plant or that the frequency of damage to plant

components which may lead to core damage is extremely low when

compared with other internal or external events. Wind and

tornado events and turbine missiles are some examples of the

events analyzed using this approach. The second approach

consisted of a more detailed analysis for external hazards

where it was unclear if the plant damage could be extensive or

where the possible consequences could not be bounded.

Examples of these events are seismic and fire.

There was no formal screening of external events for scoping

quantification as described in the PRA Procedures Guide.

However, even if such a screening technique were rigorously

applied, it may not have uncovered any additional external

events for quantification.

For each external initiating event, point estimates of plant

damage state and core damage frequency were made. These

values were compared to those obtained from internal event

analysis to identify the initiators that are major

contributors to each plant damage state.

2.5.1 Aircraft Crash Analysis

The frequency of aircraft accidents on the nearby air routes

impacting the primary auxiliary building and control building

was estimated as 3.4 x 10-7 per year. The method of analysis

is very similar to that utilized in Oconee PRA (Section

2.8.2).

2-6
2.5.2 Hazardous Chemicals and Transportation Events

Three types of accidents were analyzed which have the

potential to cause either: (1) hazardous concentrations of

toxic or flammable gases or vapors inside the control room,

(2) damage to safety-related structures through overpressure

and missile impacts, or (3) the loss of offsite power without

recovery. It was determined that the release of hazardous

materials into the environment may be from large storage tanks

in the area, a truck tanker passing by the plant, or from a

nearby natural gas pipeline. Both explosions at the accident

site and vapor cloud drift were considered. An analysis was

done for the possibility of a truck running off the road and

damaging offsite power transmission lines. These transmission

lines are closely grouped near the plant switchyard, so a

single accident damaging all the lines could result in a

nonrecoverable loss of offsite power.

These analyses indicated that the mean frequency of hazardous

chemicals entering the control room from its intake is less

than 7 x 10-7 per year, and the frequency of a nonrecoverable

loss of offsite power is 2.8 x 10-4 per year. The nonrecoverable loss of offsite power event was included in the plant

damage state analysis.

The boundary analyses performed for tornado loading, and

tornado and turbine missiles showed that their contributions

to core damage frequency are very small.

2.6 Millstone Unit 3

The probabilistic safety study of Millstone Unit 3 (NUSCo,

1984) analyzed the following external events:

Seismic

Fire

External and Internal Flooding

Winds and Tornado Missiles

Aircraft Accidents

Transportation and Storage of Hazardous Materials

Turbine Missiles

2.6.1 Winds and Tornado Missiles

The frequency of exceeding the design basis tornado windspeed

of 360 mph at Millstone Unit 3 was calculated to be

approximately 5.4 x 10-6 per year. The plant structures were

assessed to withstand the design basis tornado loading with

adequate margin. Hence, it was concluded that tornado loading

would not contribute to the plant risk. Using the results of

2-7
Twisdale and Dunn (1981), the frequency of tornado missileinduced core damage accident sequence was estimated to be less

than 1 x 10-6 per year.

2.6.2 Aircraft Accidents

Estimates of the frequency of aircraft-induced accidents at

Millstone Unit 3 have been obtained as below:

General Aviation - 1.5 x 10-6 per year

Commercial Aviation - 1.2 x 10-7 per year

Military Aviation - 3.4 x 10-9 per year

The plant vulnerability to light (general) aircraft crashes

was examined. It was determined that a general aviation crash

could initiate a loss of offsite power, but a core damage

accident sequence would further require the independent random

failure of onsite power. In view of the extremely low

frequency associated with this scenario, (similarly with

commercial and military aircraft crashes) it was concluded

that aircraft hazards do not constitute a significant

contributor to core damage.

2.6.3 Transportation and Storage of Hazardous Materials

The analysis included road, rail, and waterway traffic routes

carrying hazardous materials. Also, onsite storage facilities

were considered, as were nearby gas and oil pipelines. Based

on the frequency of shipping, limited volumes of shipment, the

strict controls placed on onsite traffic, and the distance

from the transportation routes to the plant structures, it was

concluded that the transportation and storage of hazardous

materials do not contribute significantly to core damage.

2.6.4 Turbine Missiles

The analysis assumed the frequency of turbine failure as 10-4

per year. The resulting frequency of turbine missile damage

to any one of the safety-related structure or equipment was

found to be about 10-6 per year. Since there were several

conservative assumptions made in the analysis, it was

concluded that frequency of turbine missile induced core

damage is well below 10-7 per year and consequently, turbine

missiles do not significantly contribute to core damage.

2.7 Oconee

In the Oconee PRA (EPRI, 1984) external events were selected

and analyzed essentially using the procedures described in the

PRA Procedures Guide (USNRC, 1983). The events were treated

on one of three levels:

2-8
1. Many hazards were eliminated from consideration

because they are inapplicable to the Oconee site

(e.g., avalanches, tsunamis, volcanic activity),

2. Bounding calculations were performed for some hazards

to verify that their frequencies of occurrence were so

low that they would not contribute importantly to

core-damage frequency or risk, and

3. Detailed analyses were performed for events judged to

be of more importance.

Table 2.7-1, reproduced from the Oconee PRA with permission,

lists the external hazard and the level of detail employed in

treating each of them. In the following, we summarize the

approaches taken in performing the bounding calculations for

tornado, aircraft impact, and turbine missiles.

2.7.1 Tornado

The tornado analysis considered the effects of wind loading

and tornado missile impacts. A scoping analysis of the

vulnerability of the plant to damage from tornado missiles was

performed; it was judged that the accident sequences resulting

from missile damage have negligible contribution to the core

damage frequencies and hence were eliminated from further

studies.

Based on an analysis of the vulnerability of structures and

equipment at Oconee to tornado damage, it was judged that only

tornadoes with windspeeds in excess of 150 mph can be damaging

to the Oconee plant. The historical tornado data showed that

in the period of 1950 to 1980, there have been 10 tornadoes

with winds greater than 150 mph in the area within 50 nautical

miles of the Oconee site. The mean damage length for these

tornadoes was 10.6 miles and the mean damage width was 485'.

The tornado damage origin area was calculated to be 1.1 square

miles. The annual mean frequency of damaging tornadoes

causing an initiating event was estimated to be 3.5 x 10-5.

Figure 2.7-1, reproduced from the Oconee PRA with permission,

shows the event tree describing the tornado-induced coredamage sequences. The important contributors are:

Core Damage Bin I: Early core damage at elevated

pressure; leakage rates from the

reactor coolant system corresponding

to a small loss-of-coolant accident -

total frequency 2.2 x 10- 6 /year

2-9
Core Damage Bin III: Early core damage at elevated

pressure, leakage rates corresponding

to cycling pressurizer relief

valves - total frequency 1.1 x 10-5

per year.

The total mean frequency of tornado-induced core damage

sequences was estimated as 1.3 x 10-5 per year. This is small

compared to the core damage frequencies of 8.8 x 10-5 per year

by turbine-building floods and 2.5 x 10-4 per year from all

internal and external events. In terms of the public risk,

tornado induced accident sequences had smaller contribution

compared to those induced by turbine-building floods and

earthquakes.

2.7.2 Aircraft Impact

The Oconee Unit 3 is not near any major airports which have

significant aircraft traffic in a weight category capable of

damaging the plant. Therefore, plant risk caused by aircraft

impact at the plant site was determined by air-corridor

traffic in the vicinity of the plant.

The aircraft impact frequency was reported as

C = RA.E Ni*Di

= RANeZ fi*Di

= RAND

where R = accident rate per aircraft mile,

A = target area (square miles) of site structures

sensitive to aircraft impact,

Ni = average number of yearly flights on airway i,

Di = density function describing the likelihood of

aircraft impact on the ground as a function of

the perpendicular distance from airway i (per

mile),

fj = fraction of flights on airway (i.e., fi = Ni/N),

N = total number of yearly flights on airways within

20 miles of site, and

D = Z f iDi.

The factors R, A, Ni and Di were treated as probabilistic.

2-10
The aircraft-accident rate R was derived using the National

Transportation Safety Board data on aircraft accidents for

both U.S. air-carrier operations and U.S. general aviation.

The accident rate for general aviation is about 50 times

greater than that of air carriers. Less than 2 percent of

general aviation aircraft have a gross take-off weight greater

than 12,500 pounds, sufficient to cause serious damage to

Oconee plant structures. Therefore, the air-carrier data was

used to develop the aircraft-accident rate probability

distribution, R, assuming it is representative of both aircarrier and general aviation traffic (of the relevant weight

category). Based on a 20 year accident data for U.S.

carriers, the aircraft accident rate, R, and its discrete

probability distribution was derived (Table 2.7-2, reproduced

from the Oconee PRA with permission). The median accident

rate is 2.0 x 10-10 per aircraft-mile and the 5 to 95 percent

confidence bounds are 7.6 x 10-11 to 5.1 x 10-10 per aircraftmile.

The spatial accident density Di was derived by examining the

accident data on aircraft crash location relative to original

flight path. This data was used to describe the prior

distribution.

The posterior probability distribution on Di was obtained

using Bayes' Theorem. The median value of Di was estimated as

0.019 per mile and the 5 to 95 percent confidence bounds were

0.012 to 0.029 per mile.

The target area of plant structures sensitive to aircraft

impact, A, was estimated to have a median value of 0.01 square

mile with 5 to 95 percent confidence bounds as 0.005 to 0.02

square mile.

The total number of yearly flights on airways within 20 miles

of the site, N, was obtained by analyzing the IFR peak day

traffic data for the 6-year period 1971 to 1977. The median

of the peak day traffic is 261 flights per day and the

standard deviation is 81 flights per day. The median of the

average daily traffic was obtained by dividing the peak day

traffic by 1.39 (this ratio of peak to average traffic is

based on the statistics of the Federal Aviation Administration). The median and the standard deviation of the average

daily traffic were calculated as 188 and 58 flights per day,

respectively. The median yearly traffic was calculated as

68,600 and the 5 to 95 percent confidence bounds were 33,200

to 104,000.

2-11
The aircraft impact frequency was calculated using the

probability distributions on R, D, A and N. The median impact

frequency was found to be 2.5 x 10.9 per year and the 5 to 95

percent confidence bounds were 4.9 x 10-10 to 1.3 x 10-8 per

year. Since this frequency was considered very low, the

conditional probability of core damage given an aircraft

impact on Oconee plant structures was not evaluated. The

calculated impact frequency was used as a bounding estimate of

the core damage frequency due to aircraft impact.

2.7.3 Turbine Missiles

A scoping analysis of turbine missile hazards at Oconee Unit 3

was performed using the missile characteristics provided by

General Electric (1973). Based on the historical failure

data, Patton, et al. (1983) have estimated that the rate of

missile generating turbine failures is 1.64 x 10-4 per year,

with 83 percent occurring at operating conditions and the

remainder at overspeed conditions. Patton, et al, (1983) have

also estimated that, on average, two disks fail in each

turbine failure. Since there are 42 disks per low-pressure

turbine at Oconee, the overall failure rate of 7.8 x 10-6 per

year per disk was assumed.

Figure 2.7-2, reproduced from the Oconee PRA with permission,

shows the critical areas of Oconee Unit 3 that are vulnerable

to turbine missiles. The probability of one or more missiles

striking a critical area was calculated using free-flight

ballistics. Damage to safety-related equipment was assumed

when the missile perforates the concrete external wall of the

structure housing the equipment. The CEA-EDF perforation

formula (Sliter, 1983) was used to estimate the probability of

damage given a missile strike. Table 2.7-3, reproduced from

the Oconee PRA with permission, gives a summary of estimated

missile strike and damage rates for each critical area.

The frequency of core damage was estimated using the following

system model. Core cooling can be achieved by means of the

control room (B) or the auxiliary shutdown panel (A), and

either of the penetration areas (D and E), along with

equipment located in the auxiliary and turbine buildings.

Alternatively, the core can be cooled with the standby

shutdown facility (S) and the west penetration area (E). It

is obvious that simultaneous failure of A, B and S, or D and

E, or A, B and E will prevent core cooling. Therefore if we

denote PB, PD etc., to describe the probability of damage to

the control room, the east penetration area, etc., then the

overall frequency of safety compromise (core damage) due to

turbine missile damage is obtained as:

2-12
P - PAPBPS + PDPE + PAPBPE

Using the missile damage rates given in Table 2.7-3, the

frequency of core damage due to turbine missile was evaluated

as 1.6 x 10-9 per year. This is extremely low compared to the

core damage frequency caused by turbine-building flooding.

Hence, turbine missiles were not considered in the Oconee PRA.

2-13
Table 2.7-1

Treatment of External Hazards in the Oconee PRAa

Hazard Treatment

NATURAL HAZARDS

Earthquake

Flood--coastal

Flood--lake

Flood--river

Rainstorm

Tornado

Tsunami

Wind

Explicitly included

Not applicable

Explicitly included

Explicitly included

Explicitly included

Explicitly included

Not applicable

Implicitly included

under tornado

EXTERNAL MAN-MADE HAZARDS

Aircraft-impact

Industrial or military facility

accident

Pipeline accident

Retaining-structure failure

Surface vehicle explosion

Surface vehicle impact

Explicitly included

Eliminatedb

Eliminatedb

Explicitly included

Eliminatedb

Eliminated

aExternal hazards from ANS 2.12 (1978). bReview of the site vicinity indicated that there are no

nearby hazardous facilities or routes used frequently to

transport hazardous materials, and the frequency of these

events was judged to be negligible for the purposes of this

study.

Reproduced from the Oconee PRA with permission.

2-14
Table 2.7-2

Aircraft Accident Rate R

Discrete

Accident ratea probability Cumulative

From To distribution probabilitya

0 6 .5- 1 1b 0.0381 0.0381

6.5-11 1-10 0.0804 0.1186

1-10 1.5-10 0.1692 0.2879

1.5-10 2.5-10 0.3170 0.6049

2.5-10 3.5-10 0.2113 0.8163

3.5-10 5.5-10 0.1578 0.9741

5.5-10 8-10 0.0257 0.9999

aCumulative probability to the end of each interval.

b 6 .5-1i = 6.5 x 10-11.

Reproduced from the Oconee PRA with permission.

2-15
Table 2.7-3

Summary of Estimated Turbine Missile Strike and

Damage Rates for Oconee Unit 3

Strike rate (yr-i) Damage rate (yr-i)

Area LTM HTM Total LTM HTM Total

Auxiliary shutdown

panel

Control room

East penetration

area

West penetration

area

Standby shutdown

facility

Cableway

Spent-fuel storage

Borated-water

storage tank

Steamline

5.6-7b 4.0-9 5.6-7

2.4-6 1.8-7 2.6-6

3.0-5 2.5-8 3.0-5

1.6-9 4.2-8 4.4-8

5.6-7 4.0-9 5.6-7

2.4-6c 1.1-8c 2.6-6

5.0-6 2.6-9 5.0-6

1.6-9d 4.4-9

(e)

(e)

(e)

0

1.8-7 1.8-7

2.3-9

6.0-9

2.1-9

2.3-9

6.0-9

2.2-9

(e)

(e)

(e)

0

0

1.9-8

<1.0-9

0

<1.0-9

2.2-8

6.0-9

1.9-8

<1.0-9

0

<1.0-9

2.2-8

8.1-6

0 2.2-8 2 .2-8

Total 3.3-5

aResults based on a disk failure

bNotation: 2.6-3 - 2.6 x 10-3.

rate of 7.8 x 10-6 per year.

cAssumes all strikes are damaging strikes (either by perforation or by

spallation).

dThis is a safety-compromise rate, because the only path is through the east

penetration area, its redundant component.

eThese were not computed because penetration is negligible.

Reproduced from the Oconee PRA with permission.

2-16
Tornado

with Wind 4 kV SRV 12.hr

missiles >150 power EFW close ASW rec End

To A B C D E F state Frequency Sequence

NCM

NCM

CM-111 5 0 x

CM--I I x

NCM

CM-Ill 6 5 x

NCM

CM-11 5.0 x

CM-111 5 0 x

CM-I 1.1 x

10-6 T0A9C5E

10-6 TOADCD

10- 7 ToABCF

10- 7 ToABC5'EF

10-6 T0ABClE

10-6 ToABCD

Event

Event

Event

Event

Event

Event

T A:

B:

C:

D:

E:

F:

Severe Tornado

4 kV Power: Switchgear, 3TC, 3TD, 3TE,

Main Feeder Bus

Emergency Feedwater-;

Safety Relief Valve Recloses

Auxiliary Service Water

Recovery of RCS Makeup within 12 hours

Figure 2.7-1. Event Tree for Sequences Initiated by a Severe

Tornado

Reproduced from the Oconee PRA with permission.

2-17
000

Low-pressure turbines

0E0 1110 A Auxiliary shutdown panel

8 Control room

C

0

E

F

S

Cableway

East penetration area

West penetration area

Spent fuel storage

Standby shutdown facility

E

'--Steamline

Borated-water

storage tank IZSIZ

Figure 2.7-2. Oconee Unit 3 - Critical Areas for

Turbine Missiles

Reproduced from the Oconee PRA with permission.

2-18
3.0 EXTERNAL EVENT METHODOLOGY

External event analysis in a PRA has three important goals:

1. The analysis should be complete in that all events are

considered.

2. By following some selected screening criteria, the

more significant events are identified for detailed

analysis.

3. The selected events are analyzed in depth by taking

into account the unique features of the events:

hazard, fragility of structures and equipment,

external-event initiated accident sequences, etc.

The first goal ensures that no significant events are

overlooked. The second goal directs the allocation of limited

resources to the study of significant events only. The third

goal assures that differences between external events and

internal events (i.e., common-cause and fragility-related

failures) are recognized and explicitly treated. Based on the

above goals, external event analysis may be considered as a

three-stage process.

3.1 Identification and Initial Screening of External Events

In this stage, an extensive review of information on the site

region and plant design is made to identify all external

events to be considered. The data in the safety analysis

report on the geologic, seismologic, hydrologic, and

meteorological characteristics of the site region as well as

present and projected industrial activities (i.e., the

building of a reservoir, increases in the number of flights at

an airport, construction of a road that carries explosive

materials, etc.) in the vicinity of the plant are reviewed for

this purpose. A visit to the plant site is useful in order to

identify geographical and topographical features, to note any

deviations to the information provided in FSAR and to assess

the vulnerability of plant structures and systems to external

events. In this way, a complete set of external events not

limited either in size or intensity is generated. Table 3.1-1

reproduced from the PRA Procedures Guide (USNRC, 1983) is an

example of such a list of external events.

In this stage, the external events identified as described

above are screened in order to select the events for either

approximate or detailed risk quantification. A set of

screening criteria is formulated that should minimize the

possibility of omitting significant risk contributors while

reducing the amount of detailed analyses to manageable

3-1
proportions. An example set of screening criteria given in

the PRA Procedures Guide is as follows:

An external event is excluded if:

1. The event is of equal or lesser damage potential than

the events for which the plant has been designed.

This requires an evaluation of plant design bases in

order to estimate the resistance of plant structures

and systems to a particular external event. For

example, it is shown by Kennedy, Blejwas, and Bennett

(1983) that safety-related structures designed for

earthquake and tornado loadings in Zone 1 can safely

withstand a 3.0 psi static pressure from explosions.

Hence, if the PRA analyst demonstrates that the

overpressure resulting from explosions at a source

(e.g., railroad, highway or industrial facility)

cannot exceed 3 psi, these postulated explosions need

not be considered.

2. The event has a significantly lower mean frequency of

occurrence than other events with similar uncertainties and could not result in worse consequences than

those events. For example, the PRA analyst may

exclude an event whose mean frequency of occurrence is

less than some small fraction of those for other

events. In this case, the uncertainty in the

frequency estimate for the excluded event is judged by

the PRA analyst as not significantly influencing the

total risk.

3. The event cannot occur close enough to the plant to

affect it. This is also a function of the magnitude

of the event. Examples of such events are landslides,

volcanic eruptions and earthquake fault ruptures.

4. The event is included in the definition of another

event. For example, storm surges and seiches are

included in external flooding; the release of toxic

gases from sources external to the plant is included

in the effects of either pipeline accidents,

industrial or military facility accidents, or

transportation accidents.

In the PRA Procedures Guide (USNRC, 1983), the above screening

criteria are applied to the external events identified in

Table 3.1-1 in order to identify external events which may be

deleted from further considerations. For any specific plant,

the screening criteria should be formulated and applied to the

external events using the particular characteristics of the

plant and site region. By this process, a smaller set of

3-2
external events is identified for risk assessment. For

example, these could be in addition to seismic, fire, and

internal flooding:

1. Aircraft impacts

2. External flooding

3. Extreme winds and tornadoes

4. Accidents in nearby industrial or military facilities

5. Pipeline accidents (natural gas, etc.)

6. Release of chemicals stored near the site

7. Transportation accidents

8. Turbine-generated missiles

3-3
Table 3.1-1

Natural and Man-Induced External Events to be Considered

in PRA Studiesa

Applicable

screeninq

Event criterionb Remarks

Aircraft impact

Avalanche

Coastal erosion

Drought

External flooding

Extreme winds and

tornadoes

Fire

Fog

Forest fire

Frost

Hail

High tide, high lake

level, or high river

stage

-- Site specific, requires

detailed study

3 Can be excluded for most

sites in the United States

4 Included in the effects of

external flooding

1 Excluded under the assumption

that there are multiple

sources of ultimate heat sink

or that the ultimate heat

sink is not affected by

drought (e.g., cooling tower

with adequately sized basin)

Site specific; requires

detailed study

Site specific; requires

detailed study

Plant specific; requires

detailed study

1 Could, however, increase the

frequency of man-made hazard

involving surface vehicles or

aircraft; accident data

include the effects of fog

1 Fire cannot propagate to the

site because the site is

cleared; plant design and

fire-protection provisions

are adequate to mitigate the

effects

1 Snow and ice govern

1 Other missiles govern

4 Included under external

flooding

3-4
Table 3.1-1

Natural and Man-Induced External Events to be Considered

in PRA Studiesa

(continued)

Applicable

screening

Event criterionb Remarks

High summer temperature

Hurricane

Ice cover

Industrial or military

facility accident

Internal flooding

Landslide

Lightning

Low lake or river

water level

Low winter temperature

1 Ultimate heat sink is

designed for at least 30 days

of operation, taking into

account evaporation, drift,

seepage, and other water-loss

mechanisms

4 Included under external

flooding, wind forces are

covered under extreme winds

and tornadoes

1,4 Ice blockage of river

included in flood; loss of

cooling-water flow is

considered in plant design

Site specific; requires

detailed study

-- Plant specific; requires

detailed study

3 Can be excluded for most

sites in the United States

1 Considered in plant design

1 Ultimate heat sink is designed for at least 30 days

of operation, taking into

account evaporation, drift,

seepage, and other water-loss

mechanisms

1 Thermal stresses and embrittlement are insignificant or

covered by design codes and

standards for plant design;

generally, there is adequate

warning of icing on the

ultimate heat sink so that

remedial action can be taken

3-5
Table 3.1-1

Natural and Man-Induced External Events to be Considered

in PRA Studiesa

(continued)

Applicable

screening

Event criterionb Remarks

Meteorite

Pipeline accident (gas,

etc.)

Intense precipitation

Release of chemicals in

onsite storage

River diversion

Sandstorm

Seiche

Seismic activity

Snow

Soil shrink-swell

consolidation

Storm surge

Transportation accidents

2 All sites have approximately

the same frequency of

occurrence

-- Site specific; requires

detailed study

4 Included under external and

internal flooding -- Plant specific; requires

detailed study

1,4 Considered in the evaluation

of the ultimate heat sink;

should diversion become a

hazard, adequate storage is

provided

1 Included under tornadoes and

winds; potential blockage of

air intakes with particulate

matter is generally considered in plant design

4 Included under external

flooding

-- Site specific; requires

detailed study

1,4 Plant designed for higher

loading; snow melt causing

river flooding is included

under external flooding

1 Site-suitability evaluation

and site development for the

plant are designed to

preclude the effects of this

hazard

4 Included under external

flooding -- Site specific; require

detailed study

3-6
Table 3.1-1

Natural and Man-Induced External Events to be Considered

in PRA Studiesa

(concluded)

Applicable

screening

Event criterionD Remarks

Tsunami

Toxic gas

Turbine-generated

missile

Volcanic activity

Waves

4 Included under external

flooding and seismic events

4 Site specific; requires

detailed study

-- Plant specific; requires detailed study

3 Can be excluded for most

sites in the United States

4 Included under external

flooding

aModified from ANSI/ANS-2.12-1978 (American Nuclear Society,

1978).

bSee Section 10.3.3 for a sample set of screening criteria.

The values given in this table are intended for illustration

purposes only. For a specific PRA project, the analyst of

external events should establish site-specific screening

criteria and apply them to select the external events that

may require a detailed study.

Reproduced from PRA Procedures Guide, USNRC, 1983.

3-7
3.2 Approximate BoundinQ Analysis of Risks from External

Events

Although a specific external event is identified for further

risk analysis, it may still be possible through simplified

analysis to show that the event is not significant. This is

an essential step in the external event PRA as it minimizes

the amount of analyses required.

The key elements of the analysis of risk from an external

event are:

1. Hazard analysis

2. Plant-system and structure response analysis

3. Evaluation of the fragility and vulnerability of plant

structures and equipment

4. Plant system and accident sequence analysis

5. Consequence analysis

3.2.1 Hazard Analysis

A hazard analysis estimates the frequency of occurrence of

different intensities of an external event. These are called

"hazard intensities." Typically, the output of a hazard

analysis is a hazard curve giving exceedance frequency versus

hazard intensity. Since there is normally a great deal of

uncertainty in the parameter values and in the mathematical

model of the hazard, the effects of uncertainty are often

represented through a family of hazard curves with a

probability distribution assigned to the family of curves,

representing the relative likelihood of one hazard curve

relative to the others.

3.2.2 Response and Fragility Evaluation

The analysis of plant system and structure response translates

the hazard input into responses of structures, piping systems,

and equipment. The fragility or vulnerability of a structure

or equipment is the conditional frequency of failure given a

value of the response parameter. In some external event

analyses, the response and fragility evaluation are combined

and the fragility is expressed in terms of a global parameter

of the hazard (e.g., tornado wind speed).

3.2.3 Accident Sequence and Consequence Analysis

The analysis of plant systems and accident sequences consists

of developing event trees and fault tress in which the

initiating event can be the external hazard itself or a

transient or LOCA initiating event induced by the external

event. Various failure sequences that lead to core damage,

3-8
containment failure, and a specific release category are

identified and their conditional frequencies of occurrence are

calculated. The unconditional frequency of core damage or of

radionuclide release for a given release category is obtained

by integrating over the entire range of hazard intensities.

If the consequence analysis 'is carried out separately for each

external event, the output could be curves of frequencies of

damage (i.e., early fatalities, latent-cancer deaths, or

property damage).

3.2.4 Approximate Analysis of Risks

In this stage of the analysis, an external event can be

excluded from further risk assessment based on the frequency

of core damage (or serious release) induced by the event.

Calculation of this core damage frequency may be done using

different bounding assumptions as explained by the following example. Typically, nuclear power plants are sited such that

the accidental impact of plant structures by aircraft is

highly unlikely. For the purposes of an external event PRA,

the risk from aircraft accidents may be assessed at different

levels. The mean annual frequency of aircraft impacting the

plant during takeoff, landing, or in flight may be determined.

If this hazard frequency is very low (e.g., 10-7 per year),

then the aircraft impact as an external event may be

eliminated from further study. This approach assumes that the

aircraft impact results in damage of the structure leading to

core damage or serious release (this assumption is likely to

be highly conservative). If the frequency of aircraft

impacting the plant structures is estimated to be larger, the

fragility of the structures may be evaluated to make a refined

estimate of the frequency of core damage. Further refinements

could include (1) elimination of certain structural failures

not resulting in core damage (e.g., damage to diesel generator

building may not result in core damage if offsite electrical

power is available); and (2) performing a plant-systems and

accident analysis to calculate the core damage frequency.

This example shows that for some external events, it may be

sufficient to perform only the hazard analysis; for some

others, the hazard analysis and a simple fragility evaluation

may be needed; in rare cases, a plant-systems and accident

sequence analysis may be necessary.

The procedure of screening out the external events in this

stage consists of (1) establishing an acceptably low mean

frequency of core damage based upon simplifying conservative

assumptions (e.g., 10-7 per year); (2) performing bounding

calculations of the mean core damage frequency for each

external event and (3) eliminating from further consideration

those events which have mean core damage frequencies less than

the acceptable value (i.e., 10-7 per year).

3-9
As part of the plant licensing evaluation, probabilistic

analyses are performed for a few external events and the

frequencies of unacceptable damage (i.e., exceedence of 10 CFR

Part 100 guideline exposures) caused by these external events

are shown to be very small. The information contained in the

plant safety analysis reports and the analyses performed at

the design stage in support of FSAR should be reviewed in an

external event PRA and any new information gathered as part of

PRA effort should be used in performing the bounding analyses.

Since the PRA attempts a realistic risk evaluation, the

conservative bias introduced by the assumptions made in the

licensing analysis should be appropriately removed.

3.2.5 Treatment of Uncertainty

Uncertainties exist in the hazard analysis and the fragility

evaluation of plant structures and equipment. These arise

from lack of data and in the use of analytical models to

predict failure. The uncertainty in each phase of the

external event PRA is to be estimated using limited analysis,

available empirical data and expert judgment. Typically, the

uncertainties in hazards and fragilities are represented by

families of hazard and fragility curves. The uncertainties in

different phases of the external event PRA are propagated

using the methods described in Chapter 10 of the PRA

Procedures Guide.

3.3 Detailed Analysis of Risks From External Events

For the external events that are not screened out in the first

two stages, a detailed risk analysis is necessary. Presently,

such an analysis is usually done for seismic events, internal

flooding, and fire. The risk analysis methods are described

in Chapter 11 of the PRA Procedures Guide. Detailed PRA

analysis for other external events is outside the scope of the

present document.

3-10
4.0 BOUNDING ANALYSES FOR SELECTED EXTERNAL EVENTS

Methods of bounding analysis for a selected number of external

events are described in this chapter. The external events

which are included in this chapter are judged to be potentially more significant risk contributors than other external

events. These events include transportation accidents,

extreme winds and tornadoes, aircraft impact, and turbine

missiles. Detailed analyses of seismic, fire, and flooding

events are done in the PRAs and, as such, they are not

included in this report. For the methodology to perform

detailed analysis of any external event, the reader is

referred to Chapter 10 of the PRA Procedures Guide (USNRC,

1983) or to the appropriate RMIEP report listed in the

Foreword. For each external event, collection of information,

FSAR analysis, and method of bounding analysis is presented.

The bounding analyses methods which are presented in this

chapter are those which are used in the LaSalle external event

scoping quantification (Ravindra and Banon, 1992). These

methods are deemed to be appropriate, but they are not the

only methods which could be used for this purpose, i.e., other

probabilistic models may be used for bounding analyses if they

include the same features as the models that are presented in

this chapter.

4.1 Transportation Accidents

4.1.1 Collection of Information

There are three typical modes of transportation near nuclear

power plants; namely, highway, railroad, and river. Information regarding these modes of transportation is usually

available in a plant FSAR in the form of type and number of

shipments of hazardous materials on the transportation routes

in the vicinity of the plant, maximum quantity of material in

any shipment, and location of the routes with reference to

plant structures. Other information which may be required for

a probabilistic bounding analysis would include accident rates

for barges, railroads, and highways. Statistics of accident

rates for railroads, highways and barges have been used in

previous external event PRAs (e.g., Severe Accident Risk

Assessment, Limerick Generating Station, PECO, 1983).

4.1.2 FSAR Analysis

A transportation accident near a plant could lead to core

damage in one of the following ways: (1) a chemical explosion

due to a transportation accident may cause damage to Category

I structures and safety-related equipment, and (2) toxic

chemicals which are spilled in a transportation accident may

drift into the control room and cause incapacitation of the

4-1
operators. Both of these accident modes have been mentioned

in the USNRC Regulatory Guides as will be discussed below.

A review of the plant FSAR should be conducted to determine if

the hazards from transportation and storage of chemicals were

considered in the plant design and if the plant design meets

the regulatory requirements in this regard. In this review,

any changes in the transportation characteristics (i.e.,

quantity and type of hazardous material, routes) and storage

of chemicals should be examined to determine their effect on

the FSAR conclusions.

A chemical explosion near the plant structures may cause

overpressure, dynamic pressures, blast-induced ground motion,

or blast generated missiles. However from previous research

in this area, it has been determined that overpressures would

be the controlling consideration for explosions resulting from

transportation accidents (Regulatory Guide 1.91). An

accidental overpressure at the site can also occur because of

vapor cloud explosions drifting towards the structures. This

type of explosion involves complex phenomena which depend on

the material involved, combustion process, and topographical

and meteorological conditions. According to a study by

Eichler and Napadensky (1978), present theoretical and

empirical knowledge is too limited to quantitatively evaluate

realistic accidental vapor cloud explosion scenarios.

However, vapor cloud explosions are implicitly included in the

TNT equivalents that are used to represent transportation

accidents.

According to the Regulatory Guide 1.91, chemical explosions

which would result in free-field overpressures of less than

1 psi at the site do not need to be considered in the plant

design. Based on experimental data on hemispherical charges

o f TNT, a 1 psi pressure would be translated into a safe

distance R (feet), which is defined as:

where K = 45 and W is an equivalent weight of TNT charges.

The maximum probable equivalent TNT charge is 50,000 lbs for a

highway truck, 132,000 lbs for a single railroad boxcar, and

5, 000 tons for a river barge. Figure 4.1-1, which is reproduced from Regulatory Guide 1.91, shows the safe distances for

a highway truck, a railroad boxcar, and a river barge.

Although the NRC Regulatory Guide is conservative in defining

the equivalent TNT explosive loads, it is nonconservative with

respect to structural capacities because of the following

4-2
reason. The free-field pressure wave which results from a TNT

explosion is reproduced from Kennedy, et al. (1983) in Figure

4.1-2. This pressure consists of an instantaneous rise and a

decay to zero followed by a slight negative pressure. The

values of peak incident overpressure (Pso), positive phase

impulse, I, and positive duration (td) for values of ground

range A = R/Wl/ 3 are shown in Figure 4.1-3, also reproduced

from Kennedy. The curves in this figure are based on field

blast experiments. Note from Figure 4.1-2 that the

overpressure acting on the wall panels of a structure also

includes a reflected pressure. Therefore, the overpressure on

the wall panels is approximately twice the incident

overpressure. In addition, the dynamic effect of peak

overpressure for a wall panel may be significant. Figure

4.1-4 shows dynamic load factors for a single-degree-offreedom system as a function of the ratio of pulse duration

(td) to the period of the structure (T) for a triangular pulse

and a rectangular pulse (reproduced from Biggs, 1964 with

permission). It can be observed that the dynamic load factor

for a pulse can reach a maximum value of 2.0 for higher td/T

ratios. As a result of pressure reflection and dynamic

effects, a free-field overpressure of 1 psi at the site could

result in an effective static overpressure of up to 4 psi on

the wall panels. Therefore, a more detailed study of

overpressure due to transportation explosions may become

necessary. If the FSAR considered the hazard from

transportation and storage of chemicals, if there are no

changes in the operations as regards transportation and

storage, and if the above nonconservatism can be shown to be

unimportant, then no further analysis of the hazards is deemed

necessary.

A toxic chemical spill near a power plant would pose a danger

to the plant if the chemicals penetrate into the control room

air intakes and cause incapacitation of the operators.

Regulatory Guide 1.78 discusses the assumptions for evaluating

the habitability of a nuclear power plant control room during

a postulated hazardous chemical release. In this approach,

toxicities of hazardous chemicals potentially involved in

accidental releases are identified. Then, based on each

toxicity limit, a safe distance is calculated for different

amounts of the hazardous chemicals. It should be noted that

the safe distance in this case does depend on the leaktightness of plant control rooms, i.e., more hazardous chemicals

are allowed near a control room which has low leakage

construction features. A probabilistic bounding analysis of

the plant for toxic chemical accidents is required only if

chemicals are stored closer than the calculated safe

distances.

4-3
4.1.3 Bounding Analysis

Section 4.1.2 described the methods that could be used to

screen transportation accidents based on FSAR information. In

this section, methods of bounding analysis for screening

transportation accidents will be discussed. It is suggested

that these accidents may be screened initially without resort

to probabilistic models. However, more detailed probabilistic

models would be required if the accident effects are judged to

be important. For the purpose of bounding analysis,

explosions and toxic chemical releases are considered

separately. Toxic chemical release is discussed in Section

4.5.3.

As explained in Section 4.2, nuclear power plants depending on

their location are designed for different magnitude tornadoes.

One of the tornado effects against which plants are designed

is a uniform pressure drop due to passage of a tornado field.

As an example, for Zone I tornadoes, plants are designed for a

pressure drop of 3.0 psi. If maximum overpressure due to a

transportation accident including the effects of reflective

pressure and dynamics is less than the tornado design pressure, then the probability of core damage due to

transportation accidents is expected to be negligible. It is

noted that such an analysis should consider each accident at

the closest possible point to the plant structures.

Therefore, the method of analysis would be as follows. Given

an accident (e.g., truck, barge, or railroad), maximum

equivalent TNT weights of chemicals can be based on the NRC

recommendations (Reg. Guide 1.91). These equivalent TNT

weights are 50,000 lbs for truck loads, 132,000 lbs for

railroad boxcar loads, and 5,000 tons for river vessel loads.

Although vapor clouds are not specifically considered in such

an analysis, these effects are implicitly taken into account

in defining the equivalent TNT loads. In the study by

Eichler, Napadensky, and Mavec (1978), the hazard from vapor

cloud drifts which could be generated in barge accidents were

examined. According to this study, although a vapor cloud may

theoretically drift towards the site and produce higher

incident overpressures at the site, the following reasons

minimize the threat due to drifting vapor clouds.

o Probability of a vapor cloud explosion rapidly

decreases due to the decrease in concentration as it

travels away from the accident site.

o Range of unfavorable wind directions (i.e., wind

directions that can impact the plant) rapidly decreases

as spill to site distance increases.

4-4
Based on this study, it was concluded that the equivalent TNT

explosive weights which are specified by the NRC are very

conservative. Next, Figure 4.1-3 can be used to calculate the

maximum incident overpressure Pso for the accident. If

4 x Pso is lower than the design tornado overpressure for the

plant, then transportation accidents may be ignored. However,

if this condition is not met, one may take advantage of

expected inelastic energy absorption capacity of reinforced

concrete wall panels. According to Kennedy et al. (1983), a

conservative ductility value equal to 3.0 may be used for

reinforced wall panels. Also, in the study by Kennedy et al.

(1983), conservatism factors which could be expected due to

inelastic energy absorption have been presented, e.g., it has

been shown that there is at least a conservatism factor in the

range of 2.0 to 3.0 due to panel ductilities. If the median

capacity of wall panels including the ductility factor is

higher than the maximum overpressure which can be expected at

the site, transportation accidents could be eliminated from

further consideration. Otherwise, a simple probabilistic

bounding analysis may be performed which is discussed in the

following paragraph.

From Figure 4.1-3 and knowledge of transportation routes near

the plant, one can determine the segment of each transportation route which is most critical in terms of potential

overpressures at the site. For example, this segment can be

determined by identifying the two points on a route where

accidents could cause overpressures equal to the wall panel

capacities. From accident rate data per length of each

transportation mode, one can then determine the frequency of

an accident resulting in unacceptable overpressures for each

route. If the sum of these accident frequencies does not

exceed a predetermined limit (e.g., 10-7 per year), transportation accidents near the plant can be eliminated from further

consideration.

In this section, we have described how approximate analysis

using the Regulatory Guide criteria may be performed to assess

the contribution of transportation accidents to the frequency

of core damage. If this contribution is judged to be

unacceptable, a detailed analysis of the risks from the

transportation and storage of chemicals may be conducted. For

a detailed treatment of this issue, the reader is referred to

the Limerick Severe Accidents Risk Assessment (PECO, 1983)

report.

4-5
•"10.000, ---------- ",,-

I--

w

A

'III

1 _ 0

I 13111o __ __ _ __ _ __ _

TNT EOUIVALENT IN POUNDS

Figure 4.1-1. Radius to Peak Incident Pressure of 1 PSI

Reproduced from Regulatory Guide 1.91.

107
PRESSURE

a) INCIDENT PRESSURE

PS0

PO TIME t+

PRESSURE

Pr -b) REFLECTED PRESSURE

Pso

• ------ JIM

tc + TIME

td

Figure 4.1-2. Pressure Pulses from TNT

Reproduced from Kennedy, 1983.

4-7
.01o

.01 .10 1.0 10 100 1000

GROUND RAWN A (PT/LSS 112 )

Figure 4.1-3. Free-Field Blast Wave Parameters Versus Scaled

Distance for TNT Surface Bursts (Hemispherical

Charqes)

Reproduced from Kennedy, 1983.

4-8
2

I

I

08i

0.41 0

0_

005

Figure 4.1-4.

05

Idl',

Dynamic Load Factors. Maximum response of one- degree elastic systems (undamped) subjected to rectangular and triangular load pulses having zero rise time.

Reproduced from Biggs, 1964 with permission.

4-9
4.2 Extreme Winds and Tornadoes

4.2.1 Collection of Information

In order to perform a probabilistic bounding analysis for

winds and tornadoes, information regarding the plant design

should be collected. One source is the final safety analysis

report (FSAR). Other details regarding structural dimensions

and wall thicknesses may be obtained from plant drawings. For

structures which are enclosed by metal siding, data may be

obtained from the metal siding manufacturer. In general, one

would be able to obtain test data and analytical results for

the siding behavior under applied pressure loads. Since

nuclear power plants are generally designed to resist lateral

seismic loads, nuclear power plant structures are expected to

have a high capacity against wind and tornado loads. The

governing mode of failure for winds and tornadoes as well as

for tornado generated missiles is failure of exterior walls or

metal sidings. Therefore, one needs to concentrate only on

the exterior walls of plant structures, i.e., failure of metal

siding or out of plane failure of wall panels under wind and

tornado pressure loads. For tornado-generated missiles,

impact formulas have been developed based on test results

which could be used to evaluate the fragility of wall panels

for different missile sizes and weights.

Other data which are required for a wind and tornado bounding

analysis include records of maximum yearly wind speeds at the

site and the number of occurrences of tornadoes in the

vicinity of the plant site. If maximum yearly wind speeds are

not available for a site, data from nearby weather stations

may be used. Also, frequencies of occurrences of tornadoes at

various regions in the United States have been developed in

terms of tornado zones which could be used in lieu of

historical local information.

4.2.2 FSAR Analysis

The design basis wind, the design basis tornado, and the

spectrum of tornado generated missiles which are used in a

plant design are indicated in the Final Safety Analysis

Report. Generally, both seismic Category I structures and

non-Category I structures are designed for wind loads.

However, the design basis wind loads may be different for

these two classes for structures, i.e., seismic Category I

structures are usually designed for higher wind loads. Also,

seismic Category I structures are required to be designed

against the effects of tornadoes and tornado generated

missiles whereas other nuclear power plant structures are not

usually designed against tornado loads and missiles.

4-10
Wind and tornado analyses, presented in the FSAR, are usually

not directly applicable in a probabilistic bounding analysis.

This is because FSAR analyses are performed from the

standpoint of plant design and conformance with the regulatory

requirements. Therefore, risk due to winds and tornadoes is

not usually calculated in a FSAR analysis. However, a plant

FSAR would indicate the information such as locations of

safety-related equipment, details of outside walls, and

properties of metal sidings which are required for a

probabilistic analysis. Other information regarding walls and

sidings can be found in the plant engineering drawings.

As mentioned above, seismic Category I structures in a nuclear

power plant are required to be designed against tornado load

effects. The design tornado loads include the tornado

rotational speed, translational speed, and a rapid pressure

drop.

Two different regionalization schemes are currently used for

tornadoes. Figure 4.2-1 shows the regionalization scheme

which was proposed by WASH-1300 (Markee et al., 1974) and

Figure 4.2-2 shows the regionalization scheme proposed by

Twisdale and Dunn (1981). Regulatory Guide 1.76 (USNRC)

describes the design basis tornado for nuclear power plants.

Regulatory Guide 1.76 (USNRC) has adopted the regionalization

scheme in WASH-1300. Table 4.2-1, which is reproduced from

Regulatory Guide 1.76, lists the design tornado

characteristics for each region. If a structure has been

designed against tornado loads, the straight extreme winds

will not govern in its design, i.e., the annual frequency of

exceedence of 240 mph (which is the lowest tornadic wind

speed) straight winds is negligibly low. Therefore, for the

buildings having tornado design, it is sufficient to consider

only tornadoes in a probabilistic bounding analysis. Since

safety-related components in modern plants are all located in

seismic Category I structures, a probabilistic bounding

analysis for modern plants should concentrate on the risk from

failure of Category I structures due to tornado winds. On the

other hand, for older plants it is possible to find some

safety-related components outdoors or in non-Category I

structures. In such cases, the non-Category I structure may

have a wind capacity much lower than 240 mph winds. For

example, if a building has a wind capacity of 120 mph, the

frequency of exceedence of 120 mph straight winds is much

higher than the frequency of a tornado strike at the plant.

This is true because tornadoes are rare events. Thus, for

non-Category I structures containing safety-related equipment,

both straight winds and tornadoes must be taken into account.

4-11
The probabilistic bounding analysis methodology described in

the next section is for tornado risks. For the straight

winds, development of site hazard is briefly described as

follows. Maximum yearly wind speeds at the site or at a

weather station near the site can be used to find the probability distribution of maximum annual wind speeds (Changery,

1982). Usually, an extreme value Type I distribution is fit

to the data. Therefore, a hazard curve for maximum annual

straight winds can be developed for the plant site. Once the

wind hazard curve is developed, evaluation of fragilities and

accident sequences would be similar to those for tornado

loads.

4.2.3 Bounding Analysis

Characteristics of Tornadoes - Tornadoes are rare events which

are usually characterized by their rate of occurrence,

direction, maximum intensity, path length, and path width.

The most important aspect of a tornado is its maximum wind

speed. Other characteristics of a tornado such as velocity,

pressure, and pressure drop can be predicted from maximum

tornado wind speeds. The methodology for a tornado bounding

analysis is described in Reinhold and Ellingwood (1982). In

this approach, the tornado hazard curves at the site are

developed in terms of maximum tornado wind speeds, i.e., the

hazard curve is a plot of annual frequency of exceedence for a

range of maximum tornado wind speeds. It can be shown that

such tornado hazard curves are dependent on the geometry of

structures exposed to tornadoes.

Tornadoes are usually classified according to their intensity.

The most common classification of tornadoes is the Fujita

F-Scale and Pearson length and width scale (FPP) which is a

measure of destructiveness of a tornado (Fujita and Pearson,

1973). In this scale, tornadoes are assigned a number from 0

to 6 (FO - F6) with higher numbers indicating higher intensity

tornadoes. Table 4.2-2, reproduced from Fujita with

permission, shows the FPP classification of tornadoes along

with intensity scale, length scale, and width scale. Also,

listed in Table 4.2-2 is an area intensity scale which is

based on total damage area. The F-scale intensities are

assigned using a qualitative assessment of the worst damage

that occurs during a tornado. This is usually accomplished by

observing the damage to residential buildings or other

structures and calculating the pressure that is needed to

cause the observed damage. From calculated tornado wind

pressure, one can find the maximum velocity that could

generate such pressures. Since classification of tornadoes is

based on observation of damage rather than direct measurement of wind speed, two types of errors can be introduced in

this process.

4-12
Direct classification errors are due to inaccuracies in

assigning intensity scales to tornadoes whereas random

encounter errors are due to lack of damage observation. The

uncertainty due to direct classification errors is expected to

be unbiased, i.e., it is equally likely that a tornado is

underscaled as it is overscaled. On the other hand, random

encounter errors are due to the lack of damage medium in a

tornado path which could subsequently be used for the tornado

classification. Therefore, random encounter errors are always

associated with underestimating the tornado characteristics.

Another source of random encounter errors is that small

tornadoes are often undetected in unpopulated areas. As an

example, increased public awareness has led to a trend toward

increased reporting of weaker tornados in recent years whereas

the average number of strong tornadoes reported is basically

unchanged (Twisdale and Dunn, 1983). This error would tend to

underestimate the rate of occurrence of all tornado

intensities but it would overestimate the occurrence rates of

higher intensity tornadoes. An attempt has been made in the

study by Twisdale and Dunn (1983) to correct the reported

tornado data for the above errors.

A tornado hazard model should include the following elements:

o variation of tornado intensity with occurrence

frequency; the frequency of tornado occurrence

decreases rapidly with increased intensity.

o correlation of width and length of damage area; longer

tornadoes are usually wider.

o correlation of area and intensity; stronger tornadoes

are usually larger than weaker tornadoes.

o variation in tornado intensity along the damage path

length; tornado intensity varies throughout its life

cycle.

o variation of tornado intensity across the tornado path

width.

Tornado Occurrence Rate - As a first step in the bounding

analysis, the frequency of occurrence of all tornadoes

(regardless of their intensities) at the site should be

calculated. The frequency of occurrence of tornadoes at a

plant site may be calculated from historical data or from

tornado zoning maps. Historical data at a site could be in

terms of number of occurrences of tornadoes in the vicinity of

the site. If such data are not available, tornado risk

regionalization schemes (Figures 4.2-1 and 4.2-2) may be used.

4-13
The occurrence rates for each region as classified in Figures

4.2-1 and 4.2-2 are shown in Table 4.2-3 reproduced from

Reinhold and Ellingwood.

Tornado Hazard Model - Using a Poisson process for occurrence

of tornadoes, the probability of a tornado striking plant

structures during time T with a velocity exceeding V* may be

written as:

P[strike by tornado with V > V*] = vT*E[V(Al) > V*(AI)]

(4.2-1)

where v is the mean arrival rate per unit area per year for

the site, V*(AI) is the velocity in an area A, which will be

defined below, and E(.) is the expectation operator taken over

all tornado parameters.

Figure 4.2-3 (reproduced from Garson, et al, 1974 with

permission) shows a rectangular structure with dimensions A

and B. Assume that this structure is approached by a tornado

that travels at an angle a measured from the side B. Also,

let us assume that this tornado travels a distance equal to L

and the damage is limited to width W during the lifetime of

the tornado. Knowing the above information, one can define an

area AI where any tornado initiated in this area would strike

the structure. Here, the point of initiation for the tornado

is assumed to be the mid-point of width W, but in general the

following results are not dependent on this assumption. The

area AI is shown in the lower part of Figure 4.2-3. Using

simple geometry, it is observed that AI is made up of four

distinct regions (Garson et al., 1974).

1. The sum of the areas denoted by T1 and T2 is equal to

the total tornado damage area WL.

2. The area denoted by P is equal to HL where H is

projection of the structure on a line which is

perpendicular to the tornado path.

3. The areas denoted by BA1 and BA2 sum to the structure

area AB.

4. The areas denoted by El, E2 , E3 and E4 sum to WG where

G is the projection of the structure on the tornado

path.

Therefore, it is observed that the tornado will strike the

structure if it is initiated within an area AI given by

4-14
AI = WL + HL + WG + AB (4.2-2)

The first term in Equation (4.2-2) is the tornado damage area

whereas the next two terms indicate an interaction between the

tornado and the structure. Finally, the last term in Equation

(4.2-2) is the structure's area. Thus, the tornado hazard

curves for a site are expected to depend on the structure's

size. For typical structures struck by tornadoes, the last

two terms in Equation (4.2-2) may be neglected and AI may be

written as:

AI = WL + HL (4.2-3)

where WL is the area for a point structure and HL is the

lifeline term which also contributes to the probability of

tornado strike. Normally, one would integrate the results

over the probability distribution of angle a for all possible

tornado strikes. However, angle a may be conservatively

chosen such that it would maximize the second term in Equation

(4.2-3), i.e., H may be chosen as the maximum projection

length of the structure. In the following paragraphs, a

matrix formulation for calculating the annual frequency of

tornado strikes with V > V* is presented which accounts for

both terms in Equation (4.2-3).

The probabilistic model for calculating tornado hazard curves

at the site may be described as follows. The occurrence of

tornadoes in this model is assumed to have a Poisson

distribution (Equation (4.2-1)), i.e., the probability

distribution of tornado inter-arrival times is assumed to be

exponential. Given that a tornado has occurred at the site,

the conditional probability of the tornado intensity scale

(FPP) is then based on historical data. Next, for each

tornado intensity scale, one has to determine the average or

the expected value of tornado area (WL) and tornado path

length (L) which is to be used in Equation (4.2-3). Thus, one

can calculate the expected value of area A, for each tornado

intensity scale (FPP). Assuming that the maximum tornado wind

velocity for each FPP intensity scale is the mid-point of the

velocity scale as reported in Table 4.2-2, the probability of

a tornado strike with maximum wind speeds exceeding a given

velocity V* is equivalent to the probability of that tornado

being initiated in the area A,. As an example, an F3 tornado

in Table 4.2-2 would correspond to a maximum wind velocity of

182 mph. Also, one can calculate a corresponding AI area for

F3 tornadoes. Therefore, the probability of exceeding 182 mph

winds at the site is equivalent to the probability of an F3

4-15
tornado occurring in the corresponding Al at the site.

However, the problem is complicated due to the fact that an F3

tornado does not exhibit the same level of damage along its

path. A detailed description of the probabilistic model is

given in the next paragraphs.

Table 4.2-3 shows the variation of tornado intensity with

occurrence for the regions which are identified in Figures

4.2-1 and 4.2-2. The occurrence-intensity (01) relationships

in this table are based on historical data and they have also

been corrected for direct classification errors and random

encounter errors. Each row of Table 4.2-3 is a vector (01)

which shows the conditional probability of each F-scale

intensity tornado given that a tornado has occurred.

As stated previously, each tornado FPP scale is also

associated with an area scale, a length scale, and a width

scale as shown in Table 4.2-2. For example, an F4 tornado is

expected to have a damage area of 1.0 mi 2 to 9.999 mi 2 . On

the other hand, it is possible for an F4 tornado to have a

smaller or a larger damage area. The same statement may be

made about the length scale and width scale of tornadoes which

are listed in Table 4.2-2. For the present study, one is

interested in the expected value of tornado damage area (WL)

for each FPP intensity scale. These average areas may be

calculated from historical measured damage areas of observed

tornadoes, i.e., one has to obtain an area-intensity

relationship for tornadoes. Table 4.2-4 (reproduced from

Reinhold and Ellingwood, 1982) shows a matrix of areaintensity relationship for all tornadoes. This area-intensity

relationship is based on the area and intensity of 10,240

observed tornadoes (Schaefer, et al., 1980). Each row of this

table shows the percentages of each F-scale intensity tornado

classified according to area classifications in Table 4.2-2.

Since F6 tornadoes have not been observed in the past, the

last row in Table 4.2-4 represents engineering judgment in

assigning area classifications. This matrix shows that the

calculated area and wind scales are slightly skewed and that

no tornadoes are expected to have areas in the A6 range.

Representing the average of area scales in Table 4.2-2 by a

vector {AA) and the matrix in Table 4.2-4 by (AIM), the vector

of expected values of areas for each F-scale intensity (AI)

may be written as:

(AI) = (AIM) * (AA) (4.2-4)

As an example for Region A, mean tornado areas (mi 2 ) for each

F-scale intensity are obtained as tAI)T = (0.30, 0.72, 1.8,

4.3, 8.5, 15.7, 18.9).

4-16
Another characteristic of a tornado is that its intensity does

not stay constant along its path. As noted previously, an FPP

intensity scale is assigned to a tornado based on the most

severe observed damage. However, a tornado is usually at its

highest intensity only for a fraction of the time that it is

active. Figure 4.2-4, reproduced from Reinhold and

Ellingwood, shows a hypothetical F4 tornado with variation of

intensity along its path. Table 4.2-5, reproduced from

Reinhold and Ellingwood, shows a matrix (VWL) for combined

variation of tornado intensity along its path length and

across its path width. Each column of matrix (VWL) in Table

4.2-5 shows the percentage of each F-scale damage in the area

(WL) for a tornado which has been assigned an intensity scale

based on the most severe observed damage. As an example, F3

tornadoes are expected to inflict F3 damage on only 2.7

percent of the total damage area. In fact, 61.5 percent of

the damage that is inflicted by a F3 tornado is expected to be

very light (FO). This matrix was obtained from the analysis

of the damage from 149 tornadoes that occurred on April 3 and

4, 1974.

For a point structure where AI = WL (see Equation 4.2-3), the

probability of wind speeds exceeding {V*) at the site may be

written as:

P[(V(AI,WL)) > {V*)] = (VWL) 9 (AI * 01) (4.2-5)

where fV*) is taken to be the mid-point of tornado velocity

scales as shown in Table 4.2-2, i.e., the left-hand side of

Equation (4.2-5), which is the probability of exceedence or

F-scale intensities, is also equivalent to the probability of

exceedence of the mid-point velocities for F-scale intensities

from Table 4.2-2. The matrix (VWL) was described in the above

paragraph and (AI * 01) is a vector where its elements are the

expected values of tornado areas times the occurrenceintensity rates for the same F-scale intensity. As an

example, for F6 tornadoes, the above equation for Region A may

be written as:

PA[F * F6 ] = PA [V(AI,WL) > 349 mph]

= 0.001 x 18.9 x 0.0013 (4.2-6) = 2.46 x 10-5

As described previously, there is a second contribution to the

probability of the tornado wind speeds exceeding a certain

value which arises from the lifeline term in Equation (4.2-3).

As shown in Equation (4.2-3), the lifeline term (HL) depends

on the tornado length and it is independent of tornado width.

4-17
In fact, the effect of tornado width variations on the

probability of exceedence was ignored by neglecting the term

WG in Equation (4.2-2).

Table 4.2-6, reproduced from Reinhold and Ellingwood, shows a

matrix of the intensity-length relationship LIM where each row

of the matrix is the fraction of tornadoes with a given

F-scale intensity which were observed to have length scales

according to Table 4.2-2. This matrix was based on an

analysis of 7,953 tornadoes between 1971-1979 (Reinhold and

Ellingwood, 1982). The expected value of tornado length for

each F-scale intensity tornado (LI) may be computed from:

(LI) = (LIM) 9 {LL) (4.2-7)

where (LL) is the vector of mid-point length scales from Table

4.2-2. As an example, for Region A a length-intensity vector

(LI}T = (1.53, 3.01, 4.76, 9.15, 18.8, 26.9, 30.1) is obtained

(miles).

Since a tornado's intensity varies along its length, one needs

to establish a relationship between the total length for a

given F-scale tornado and the percentages of total length

which were observed to have different F-scale intensities.

Such a relationship is shown in terms of the matrix of

variation of intensity along length {VL) in Table 4.2-7,

reproduced from Reinhold and Ellingwood, where each column of

the matrix lists the percentages of total tornado length with

different F-scale intensities. This matrix was based on 149

tornadoes which occurred on April 3 and 4, 1974.

Thus, the contribution of lifeline term to the probability of

exceedence of a wind speed (V*) at a site may be written as

P[(V(AI1 WH))>(V*)) = (VL) 9 (LI • 01) & H (4.2-8)

Again, V* is taken to be the mid-point of velocity scales for

each F-scale tornado as shown in Table 4.2-2. The vector {LI *

01)) is obtained by multiplying each term of the lengthintensity vector (LI) by the occurrence-intensity vector (OI).

As an example, the contribution of a structure with a

characteristic length of H = 1 ft. to the probability of

exceedence of F6 tornadoes for Region A is

4-18
~ P', I F 2 F61 -ý AIV(AIWH) > 349 mph]

1

- 0.160 x 30.1 x 0.0013 x 5280

- 1.19 x 106 (4.2-9)

Combining the point structure strike probability and the

lifeline strike probability and using the Poisson arrivals for

tornadoes (Equation (4.2-1)), the annual probability of

exceedence for each F-scale velocity may be written as:

RPIF ; Fi]) = (P[V > Vi*]) = m[C 1) + (C 2 )*H] (4.2-10)

where vectors (C1 1 and (C2) are obtained from Equations

(4.2-5) and (4.2-8). For a site located in Region A, vectors

(Cl) and (C2) are obtained as:

(C1 )T = (1.28, 4.76(E-1), 1.52(E-1), 3.08(E-2),

4.39(E-3), 3.66(E-4), 2.46(E-5))

(C2 )T = (2.15(E-4), 2.79(E-4), 2.69(E-4), 1.31(E-4),

4.84(E-5), 9.31(E-6), 1.19(E-6))

Figure 4.1-5 shows the tornado hazard curves for a site in

Region A for lifeline lengths of 100, 300 and 500 feet. The

curves in Figure 4.2-5 are developed for a tornado occurrence

rate (v) equal to 4.8 x l0-4 /square mile-year.

Structural Fragilities - Development of tornado hazard curves

for a plant site was described in previous paragraphs. Next,

one should develop the conditional probability distribution of

plant failure given the maximum tornado wind speed. If plant

failure is conservatively assumed to occur when any one of the

Category I structures fails, the plant fragility is simply

equal to the conditional probability of failure for the

Category I structure which has the lowest tornado capacity.

Calculation of tornado fragility curves for structures is

briefly described below.

Development of fragility curves for a probabilistic bounding

analysis could be based on plant design criteria. The design

basis tornado characteristics are known for Category I

4-19
structures (Table 4.2-1). However, one should take into

account the conservatisms in design codes, material strength

specifications, and assumed failure modes, etc. to calculate

the median capacity of plant structures (PRA Procedures Guide,

USNRC, 1983). For example, a structure which has been

designed for a Zone I DBT (Table 4.2-1) is expected to have a

minimum wind capacity of 360 mph. Based on site-specific

tornado hazard curves, using 360 mph as the plant capacity may

result in a negligible contribution of tornadoes to the plant

risk. In such cases, there is no need to develop fragility

curves for plant structures. On the other hand, if using the

design tornado wind speed leads to high tornado risks, then

one needs to further calculate structural fragility curves.

As an example, one should consider the conservatisms in design

code formulas and material strength, etc., which were used to

design the structures for a 360 mph wind. In addition, one

should estimate the total variability associated with the

calculated median capacity. A probability distribution which

has been frequently used to model structural fragilities is

the lognormal distribution. From the knowledge of median wind

capacity and variability in terms of logarithmic standard

deviations, the fragility of plant structures is completely

defined. The probability of plant failure (core damage) due to

tornadoes is expressed as:

Pf't = fPICi < Ri, V v fv(v)dv (4.2-11)

V

where Ci is the lowest capacity of Category I structures, Ri

is the resistance, and v is a given tornado wind speed. The

first term in the above integral represents the plant level

fragility and the second term represents the slope of tornado

hazard curve, i.e., the second term is the probability density

function of tornado wind speeds at a site.

If the above formulation results in negligible risks due to

tornadoes, then there is no need to include tornadoes in a

detailed PRA external events analysis. On the other hand, if

the risk due to tornadoes is found to be significant, then

tornadoes should be included in the PRA study.

Tornado Generated Missiles - In previous paragraphs, a

methodology for a probabilistic bounding analysis of nuclear

plant structures for tornado wind effects was presented.

Tornado-generated missiles that could potentially impact plant

structures at damaging velocities is another aspect of tornado

effects on structures. Plants that are designed for tornado

4-20
wind loads are also usually designed for tornado missiles. As

an example, Table 4.2-8 shows the recent spectrum of tornado

missiles published by the USNRC in the Standard Review Plan

(USNRC, 1975). Experience in evaluation of structures for

impact loads has shown that if all Category I structures are

designed for impact loads, and if all safety related equipment

and tanks are protected by reinforced concrete walls which are

at least 181" thick, then the probability of damage to the

plant which could lead to core damage is extremely small.

However, if these conditions are not met, then the

probabilistic bounding analysis for tornado generated missiles

should be performed as explained in the following paragraphs.

As a first step in a bounding analysis for tornado missiles,

capacities of structural walls for different missile impacts

should be evaluated. For this purpose, the spectrum of

missiles in Table 4.2-8 can be used. The missiles in this

table cover a wide variety of potential missiles at a plant

site. Missiles A, D, and F in Table 4.2-8 nay be classified

as deformable missiles whereas missiles B, C and E are

nondeformable missiles. Except for missile C, these missiles

have vertical velocities of 70 percent of postulated

horizontal velocities. Missile C which is used to test

barrier openings is assumed to have the same velocity in all

directions. Missiles A, B, C, and E are considered at all

elevations and missiles D and F are considered at elevations

up to 30 feet above grade. Although Table 4.2-8 includes both

deformable and nondeformable missilps, test data on deformable

missiles (Stephenson, 1976) has shown that utility poles and

wood planks are not capable of scabbing reinforced concretewalls. Therefore, only an automobile impact needs to be

considered among the deformable missiles. Since an automobile

can also be treated as a nondeformable missile by calculating

an equivalent missile weight (Report of the ASCE Committee on

Impactive and Impulsive Loads, 1980), the following discussion

will be limited to nondeformable missile impact.

Based on test data, several formulas have been suggested for

nondeformable missile impact on reinforced concrete walls. In

all of the studies on missile impact which have been performed

to date, it has been concluded that the amount of

reinforcement is not an important factor in calculating the

scabbing thickness or perforation thickness of a reinforced

concrete wall. The most widely used formulas for determination of minimum wall thickness required to prevent scabbing

are Chang's formula and the modified National Defense Research

Committee (NDRC) formula (Chang, 1981).' According to Chang,

the scabbing thickness (t.) of a wall or slab may be

calculated by

4-21
0O.4 V0.67

t - 2.47 - V.

S d0.2 f, 0.4

C

(4.2-12)

where w = weight of missile (lbs),

V = velocity of missile (ft/sec),

I4Ac

d = missile effective diameter (inches) = C

fe = ultimate strength of concrete (psi),

Ac = contact area of missile (in 2 ).

The modified NDRC formula gives the penetration depth, x, of a

solid missile as

x - 4KNZ (IOV)1 -8

-IiKNW (1o)d)1.]

for 2 < 2.0

for 2 > 2.0

(4.2-13)

where

180

N--

N is an empirical constant equal to 0.72 for flat-nosed

missiles, 0.84 for blunt-nosed missiles, 1.0 for average

bullet nosed missiles, and 1.14 for very sharp missiles.

Scabbing thickness is then related to penetration depth as

follows:

_ - 7.81 (ý) - 5.06 (X)2 d

t .

for 2 < 0. 65

for 0.65 > 2 < 11.75 (4.2-14)

For the NDRC formula, best results are obtained for pipe

missiles when d is the actual outside diameter of the pipe in

calculating penetration depth and equal to an effective

diameter in calculating scabbing thickness.

4-22
From the above formulas, one can calculate the minimum tornado

missile velocity required to scab the concrete walls and roofs

by the spectrum of missiles in Table 4.2-8.

Twisdale and Dunn (1981) have performed simulation studies

using the TORMIS Code for typical nuclear power plants to

obtain tornado missile impact probabilities and probability

distribution of missile velocities. Their study used a total

of 65,500 potential missiles that could be injected from

different zones near the plant. Most of these missiles

represented objects which would be available during

construction of a plant. Therefore, their results should be

adjusted for other plants where fewer missiles are available.

The study by Twisdale and Dunn (1981) shows that the

conditional probability of a high velocity missile impacting

any of the Category I structures given a tornado strike at the

plant site is on the order of 10-2. Finally, the probability

of scabbing due to tornado missiles may be written as

P[S] = P[TS] * P[MIITS] * P[SIMI] (4.2-15)

where S = scabbing, TS = tornado strike, and MI = missile

impact. P[TS] is the probability of a tornado strike which is

capable of injecting and transporting potential missiles at

the plant site. P[MIJTS] can be estimated from the study by

Twisdale and Dunn (1981) and P[SIMI] may be conservatively

assumed to be 1.0 for a missile which impacts a wall at the

minimum speed required to initiate scabbing.

Bounding Analysis Based on System Considerations - If the

frequency of a tornado (i.e., tornado loading or tornado

missiles) damaging any one of the safety-related structures in

the plant is considered to be high (e.g., >10-6 per year), an

approximate estimate of the tornado-induced core damage frequency can be obtained by developing an event tree for

sequences initiated by tornadoes. Figure 4.2-6 is an example

of such an event tree for Oconee (reproduced from the Oconee

PRA with permission, EPRI, 1984). It models the initiating

event (i.e., transient) caused by a tornado and the

performance of mitigating systems in a tornado loading

environment. A particular core damage sequence is that a

tornado has caused loss of offsite power, the reactor trips, main feedwater is lost, emergency feedwater fails, and the

safety/relief valve fails to close. High-pressure injection

is unavailable due to the tornado failing the borated water

storage tank. Table 4.2-9, summarized from the Oconee PRA,

gives the other tornado-induced accident sequences. The

conditional probabilities of structures housing the initiating

4-23
sequences are calculated using the fragility analysis.

Structural failure is assumed to occur when the exterior

barrier is breached by pressure loading or scabbed by tornado

missiles. For more details, see the Oconee PRA and Limerick

SARA reports.

4.2.4 Scoping Analysis Procedures

The scoping analysis depends on the location of the plant

(site) and its design basis. There are essentially two types

of sites from the standpoint of tornado and wind loading:

coastal site and inland site. Plants on coastal sites are

generally designed to withstand hurricane effects; those on

inland sites are designed to resist extreme straight wind

loads. Invariably, plants on both types of sites are designed

to resist some level of tornado loading. The design bases for

different plants vary in the postulation of design basis

tornado effects (i.e., speed, pressure drop, and missiles) and

selection of extreme wind and hurricane velocities. Also,

some essential equipment in certain plants may not have

tornado missile protection per current regulatory

requirements.

Based on the review of tornado design criteria and the

experience gained in the PRA community in performing tornado

risk analysis, the following procedures are recommended for

scoping analysis:

1. If the plant has been designed against tornado

effects, if there are no metal-sided walls or roofs in

seismic Category I buildings, if the reinforced

concrete walls of seismic Category I buildings are at

least 18 in. in thickness, and if there is no nonredundant outdoor unprotected equipment, the

contribution of tornado- and extreme wind-induced

accidents to the plant risk is judged to be very low.

A review of the FSAR and engineering drawings of the

plant structures would be necessary for this purpose.

If this review shows that the plant meets the above

conditions, no further analysis of tornado risks is

necessary.

2. If the FSAR review cannot screen out tornado and wind

from further analysis, a bounding analysis for tornado

risks is done by assuming that structural failure (by

pressure loading, pressure drop, and scabbing by

tornado missiles) of the exterior barrier of any one

of seismic Category I structures leads to unacceptable

core damage. Tornado hazard analysis and structural

fragility evaluation are to be performed. The results

of tornado missile risk studies performed by Twisdale

4-24
and Dunn (1981) may be utilized in this bounding

analysis. If the frequency of plant damage (i.e.,

structure) is less than 10-7 per year, no further

consideration of tornado and extreme wind is needed in

the PRA since the conditional probability of core

damage is expected to be less-than 0.1 in all cases.

3. If the bounding analysis based on failure of any one

of the Category I structures cannot be used to screen

out tornado and wind from further analysis,

consideration of plant systems (accident initiating

and mitigating) may be used to obtain a refined

estimate of tornado and wind-induced core damage

frequency. A simplified event tree is developed to

identify important accident sequences. For examples

of this approach, see the Limerick SARA and Oconee

PRA.

4. If the scoping analysis indicates that the frequency

of tornado and wind-induced core damage is higher than

10-7 per year, then a detailed analysis of tornado

risks is warranted.

4-25
Table 4.2-1

Design Basis Tornado Characteristics

Radius of

Translational Maximum

Maximum Rotational Speed (mph) Rotational Pressure Rate of

Wind Speed Speed Speed Drop Pressure

Region (mph) (mph) Maximum Minimum (feet) (psi) Drop (psi/sec)

I 360 290 70 5 150 3.0 2.0

II 300 240 60 5 150 2.25 1.2

III 240 190 50 5 150 1.5 0.6

!~

Reproduced from Regulatory Guide 1.76.
Table 4.2-2

Intensity, Length, Width and Area Scales

!)

Fujita - F Pearson - P Pearson - P

Scale Intensity Scale Length Scale Width Scale Area Scale

No. (mph) (mi) (mi) (mi 2 )

0 72 1.00 0.010 0.001

1 73-112 1.00-3.15 0.010-0.031 0.001-0.009

2 113-157 3.16-9.99 0.032-0.099 0.010-0.099

3 158-206 10.0-31.5 0.100-0.315 0.100-0.999

4 207-260 31.6-99.9 0.316-0.999 1.000-9.999

5 261-318 100-315 1.00-3.15 10.00-99.99

6 319-380 316-999 3.16-9.99 100.0-999.9

Permission to use this copywright material was granted by T. T. Fujita.
Table 4.2-3

Regional Tornado Occurrence - Intensity Relationships

Corrected for Direct Classification Errors and Random Encounter Errors

(Each Row in the Table is the Vector 01)

Corrected Probability of Occurrence

at Each F-Scale Intensity

Reg 4ion

Fig. 4.2-1

Fig. 4.2-2

F

Scale

I

II

III

A

B

C

D

FO

.2227

.3610

.3044

.1658

.2263

.2830

.3034

Fl

.3785

.3116

.4421

.3379

.3527

.3611

.3799

F2

.2576

.2198

.1730

.3122

.2785

.2426

.2436

F3

.1016

.0912

.0681

.1322

.1040

.0856

.0622

F4

.0324

.0147

.0112

.0413

.0312

.0225

.0096

FS

.0066

.0015

.0012

.0093

.0063

.0047

.0011

F6

.0009

.0002

.0001

.0013

.0008

.0006

.0001

00

Regional Occurrence Rates Corrected

for Unreported Tornadoes (occurrences

Reg-ion per sauare mile per year)

Fig. 4.2-1

Fig. 4. 2 -2

I

II

II

A

B

C

D

4.12

2.67

1.35

5.18

6.98

3.37

3.53

x

x

x

x

x

K

x

10-4

10-5

10-5

10-4

10-4

10-4

10-5

Reproduced from Reinhold and Ellingood 1983.
Table 4.2-4

Intensity-Area Relationship Including Corrections

for Direct Observation and Random Encounter Errors (AIM Matrix)

Percentage of Tornadoes with Indicated

Area Classification

Actual Maximum

Tornado State AO Al A2 A3 A4 A5

Fo" .155 .421 .269 .125 .029 .0016

FP" .057 .255 .355 .259 .071 .003

F2" .022 .139 .303 .368 .155 .013

F3" .009 .070 .210 .376 .289 .046

F4" .003 .033 .123 .299 .435 .107

F5" .001 .017 .068 .216 .461 .237

F6" .001 .012 .049 .185 .458 .295

Reproduced from Reinhold and Ellingwood 1983.
Table 4.2-5

Variation of Tornado Intensity Along Path Length

and Across Path Width (VWL Matrix)

True Maximum Tornado State

Local Tornado

State FO" F11" F2" F3" OF4 F5" F6"

FO* 1.000 .743 .658 .615 .637 .632 .625

Fl* 0 .257 .248 .267 .234 .236 .238

F2* 0 0 .094 .091 .093 .088 .089

F3* 0 0 0 .027 .028 .033 .033

F4* 0 0 0 0 .008 .009 .011

F5* 0 0 0 0 0 .002 .003

F6* 0 0 0 0 0 0 .001

Reproduced from Reinhold and Ellingwood 1983.
Table 4.2-6

Intensity-Length Relationship Including Corrections

for Direct Observation and Random Encounter Errors (LIM Matrix)

Percentage of Tornadoes with Indicated

Length Classification

Actual Maximum

T:ornado State PlaPL_3 PL4 RUL

FO" .801 .115 .069 .014 .001 0

Fi" .590 .219 .140 .046 .005 0

F2" .436 .249 .212 .093 .010 0

F3" .272 .226 .268 .195 .038 .001

F4" .141 .152 .272 .326 .090 .019

F5" .079 .113 .197 .444 .131 .036

F6" .058 .101 .155 .496 .147 .043

Reproduced from Reinhold and Ellingwood 1983.
Table 4.2-7

Variation of Intensity Along Length

Based on Percentage of Length Per Tornado (VL Matrix)

Recorded Tornado State

Local Tornado

State FO F1 F2 E3 F4 F5 F_.

FO 1.000 .383 .180 .077 .130 .118 .100

F1 0 .617 .279 .245 .131 .125 .110

F2 0 0 .541 .310 .248 .162 .120

F3 0 0 0 .368 .234 .236 .160

F4 0 0 0 0 .257 .187 .200

F5 0 0 0 0 0 .172 .150

F6 0 0 0 0 0 0 .160

!

Reproduced from Reinhold and Ellingwood 1983.
Table 4.2-8

NRC Standard Review Plan Spectrum of Tornado Missile

Velocity (m/sec) Missile Mass (Kg) Dimensions (m) Region I Region II Region III

A Wood plank 52 .092 x .289 x 3.66 83 70 58

B 6" Sch 40 pipe 130 .168 D x 4.58 52 42 10

C 1" Steel rod 4 .0254D x .915 51 40 8

D Utility pole 510 .343D x 10.68 55 48 26

E 12" Sch 40 pipe 340 .32 D x 4.58 47 28 7

F Automobile 1810 5 x 2 x 1.3 59 52 41

!

tu
Table 4.2-9

Severe Tornado Event Tree Accident Sequences (Oconee PRA)

Sequence Bin Frequency Description

TQABCD

T0 ABCD

T0ABCDE

T0 ABCDE

T0ABdF

TOABC152F

I

I

III

III

III

III

1. 1-6a

1.1-6

5.0-6

5.0-6

6.5-7

5.0-7

!

Tornado, loss of offsite power, reactor trip

and loss of main feedwater, failure of

emergency feedwater, failure of SRV to close.

HPI unavailable due to tornado failing BWST.

Tornado, loss of offsite power, reactor trip

and loss of main feedwater, failure of EFW,

successful cycling of SRVs, but failure to

obtain ASW feedwater; loss of RCS inventory

through cycling relief valves leads to uncovering of core before any significant chance

of recovery

Tornado, loss of offsite power, reactor trip

and loss of main feedwater, successful EFW or

successful cycling of SRVs and ASW, failure to

recover RCS makeup in time to prevent uncovering of the core.

aNotation: 1.0-7 = i.i x 10-7.

aNotation: 1.0-7 = 1.1 x 10-7.

Summarized from the Oconee PRA.
lop

spa~

U'J

I#mass"

Figure 4.2-1. Tornado Risk Regionalization Scheme Proposed by WASH-1300, Markee,

et al. (1975)

Reproduced from Reinhold and Ellingwood, 1983.
Figure 4.2-2. Tornado Risk Regionalization Scheme Proposed by Twisdale and Dunn

(1983) with permission. Permission to use this copywrighted material

was granted by W. R. Sugnet.
°

Permission to use this copywrighted material was granted by MIT.

STRUCTURE

W

TOR NADO

I\

T :TORNADO AREA:WL

P PROJECTED AREA : HL

BA v BUILDING AREA : AB

E a EDGE AREA: WG

Figure 4.2-3. Tornado Parameters and Damage Origin Area

Definition

4-37
Reproduced from Reinhold and Ellingwood 198A

Figure 4.2-4. Sketch of Hypothetical 

F4 Tornado Illustrating 

Variation 

of Intensity

4-38
10-3 mlb

LaD

LC=

0D

CCJ

10 "5

H= 500'

H=300'

H=100'

10-8 I I I I a a I - -- -1

0 50 100 150 200 250 300 350

MAXIMUM TORNADO WIND VELOCITY (mph)

Figure 4.2-5. Typical Tornado Hazard Curves for a Site

in Region A

4-39
Reproduced from the Oconee PRA with permission.

Tornado

with Wind 4 kV

missiles >150 power

To A B

SRV

EFW close

C D

12-hr

ASW rec

E F

End

state Frequency Sequence

NCM

NCM

CM-111 50 x 10.6 ToABC5E

CM-I 11 x 10-6 ToAFCD

NCM

CM-11165 x 10-7ToABtF

NCM

CM-111150 x 10-7 ToABCD'EF

CM--11150 x 10-6 TcABC5E

CM-I 11 x 10-6 T0 ABCD

Figure 4.2-6. Event Tree for

Severe Tornado Sequences Initiated by a

4-40
4.3 Aircraft Impacts

4.3.1 Collection of Information

A nuclear power plant FSAR usually includes a description of

airports and aircraft activity near the site. This

information includes the locations of commercial airports and

private airstrips near the site. Although nuclear power

plants are generally built away from major airports, there may

be smaller commercial airports or private airstrips in the

vicinity of nuclear plants. If a plant is close to a

commercial airport, aircraft impact risk may be dominated by

the risk due to aircraft landing and take-off accidents.

Since the risk due to aircraft landings and take-off accidents

is much higher than the risk due to in-flight accidents, a

relatively low rate of activity at a commercial airport near a

plant site may result in a high contribution to the aircraft

risk. In addition to the airports near a site, the Federal

Aviation Administration (FAA) airways and military air routes

near the site should be identified. If this information is

not available in the plant FSAR, it may be obtained from the

FAA regional office or the military airbase near the site.

The number and size of aircraft using the airports, airways or

military air routes should also be obtained.

The probabilistic bounding analysis which is presented in

Section 4.3.3 uses accident rates for different types of

aircraft, e.g., single-engine, twin-engine, and commercial

aircraft. Historical data on aircraft accident rates are

available in the FAA Statistical Handbook of Aviation (1979)

which is published each year. The same type of data is also

available for military aircraft from the Air Force. Also, the

probabilistic bounding analysis should account for projected

changes in aircraft operations near the site during the plant

lifetime.

4.3.2 FSAR Analysis

Aircraft risk is usually considered in a plant FSAR as it

relates to meeting the requirements of 10 CFR Part 100

guidelines and the USNRC Standard Review Plan. According to

the Standard Review Plan, the probability of aircraft

accidents resulting in unacceptable radiological consequences

is less than about 10-7 per year if the following requirements

are met:

4-41
1. The plant-to-airport distance D is between 5 and 10

statute miles, and the projected annual numbers of

operations is less than 500*D2 , or the plant-toairport distance D is greater than 10 statute miles,

and the projected annual number of operations is less

than 1000*Dz,

2. The plant is at least 5 statute miles from the edge

of military training routes, including low-level

training routes, except for those associated with a

usage greater than 1000 flights per year, or where

activities (such as practice bombing) may create an

unusual stress situation,

3. The plant is at least 2 statute miles beyond the

nearest edge of a federal airway, holding pattern, or

approach pattern.

The Standard Review Plan requires that a detailed review of

aircraft impact risk be performed if the above requirements

are not met or if sufficiently hazardous military activities

are identified. Therefore, if the SRP requirements are met in

plant design and there are no projected changes to the

airports and aircraft activity near plant site, then there

would be no need for a probabilistic bounding analysis. In

effect, the SRP requirements are judged to be sufficient to

insure that the risk due to aircraft accidents remains

acceptably low (i.e., less than 10-7 per year).

4.3.3 Methods of Bounding Analysis

The following method for bounding analysis for aircraft risks

was developed in the Seabrook PSS (1984). In this method, the

probability of an aircraft impact on the plant structures may

be written as:

fk ZNj AZ d Ak (4.3-1)

where

Nij= Number of aircraft operations of type j along

airway i,

Aj = Crash rate of aircraft type j,

4-42
dj = Distance traveled by aircraft type j where the

site is within striking distance,

AkJ = Crash area of the structures,

Apj = Area where the aircraft may crash.

The term Ak /Apj in Equation 4.3-1 represents the probability

of an impact given a crash in the vicinity of the site. This

probability and also the distance dj are determined

geometrically. The other variables in the above equation are

assigned probability distributions representing the

uncertainty in the state of knowledge about their values.

Figure 4.3-1 shows the geometry of an aircraft accident.

Assuming that the aircraft is disabled at an elevation h, the

distance that it would travel before the crash occurs is gh where g is the glide distance per unit of altitude lost. It

may be conservatively assumed that there is an equal

probability of crash termination anywhere in the sector of

radial length gh and angle ý = 1800 in front of the aircraft.

Therefore, Apj is the half circle defined by radius gh where g

is the maximum glide ratio which may be assumed to be equal to

17. AkI is the impact area of structures which should include

the following:

1. A shadow area of the plant elevation upon the

horizontal plane based on the assumed glide ratio for

different kinds of aircraft and failure modes.

2. A skid area around the plant as determined by the

characteristics of the aircraft under consideration.

3. The areas of those safety-related structures, systems,

and components which are susceptible to impact or fire

damage as a result of aircraft crashes.

The aircraft impact frequency in Equation (4.3-1) should be

calculated for different types of aircraft. Three types of

aircraft are identified for these calculations, i.e., single

engine, twin engine and commercial aircraft. Also, a

fragility analysis may be performed as described below to

determine whether these aircraft types are capable of inducing

damage to the Category I structures in case of an impact. The

fragility calculations are needed only if the probability of

impact is greater than 10-7 per year, since the conditional

probability of core damage is estimated to be less than 0.1.

Capacities of Category I structures against aircraft impact

can be determined using the formulas which have been developed

4-43
for impact of nondeformable missiles on reinforced concrete

walls and panels. It may be assumed that the engine and part

of the aircraft body represent the nondeformable missile.

Information regarding the characteristics of single-engine and

twin-engine aircraft may be obtained from Niyogi et al.

(1977). Also, it may be conservatively assumed that if an

aircraft impacts one of the Category I structures and causes

back face scabbing, it would lead to a plant damage state.

The formulas which have been developed to predict the minimum

scabbing thickness all indicate that the concrete wall

thickness required to prevent scabbing is independent of the

amount of steel reinforcement for low to moderate steel

ratios. Chang's formula (1981) which is based on full-scale

and model impact tests of tornado missiles may be used to

examine if scabbing occurs. According to Chang, the minimum

wall thickness (inches) which is required to prevent scabbing

(t.) is given by Equation (4.2-12).

Although most nuclear power plants in the U.S. have not been

designed for any aircraft impact design requirements, design

for the spectrum of tornado generated missiles in the USNRC

Standard Review Plan provides some structural resistance

against aircraft impacts. Typically, if a plant has been

designed against an automobile impact as a result of

tornadoes, it can withstand a single-engine aircraft impact.

Reinforced concrete structures with walls at least 18 inches

thick may be excluded from the impact analysis for singleengine aircraft.

4.3.4 Bounding Analysis Based on System Considerations

If the annual frequency of aircraft impacts damaging any one

of the safety-related structures is considered to be

unacceptably high, a refined estimate of the core damage due

to aircraft impacts may be obtained from system

considerations. For example, the crash of a general aviationtype aircraft can cause damage to the safety-related equipment

which are located outdoors and which have inadequate missile

(aircraft) barriers. However, such impacts do not directly

lead to core damage. It is discussed in the Seabrook PSS

(1982), that the mean annual frequency of refueling water

storage tank (RWST) being hit by all types of aircraft is less

than 4.3 x 10-8. Such an impact may cause the operators to

trip the plant, but by itself will not produce core damage.

With additional system unavailabilities, any resulting

scenario has a frequency much smaller than for scenarios

involving a transient initiating event (about 13 per year)

combined with the unavailability of RWST (about 10-7), which

lead to the same plant damage states. Similarly, damage to a

diesel generator building by aircraft impact may not lead to

core damage since offsite power is also not lost. The loss of

the service water system in an aircraft crash accident may not

4-44
be a significant contributor to the risk if a cooling tower is

available as a redundant source.

By this process, the structures housing critical systems whose

single failure would lead to core damage or serious release,

are identified. The annual frequency of aircraft damage to

any one of these structures can be calculated. This frequency

is typically less than the value obtained by considering all

safety-related structures.

4-45
0!

AIRCRAFT

TRAJECTORY - H - - - - - -aw.

b

PLANT LOCATION

ALONG THIS LINE

Figure 4.3-1. Geometry for Aircraft Impact Probabilistic Model
4.4 Turbine Missiles

4.4.1 Collection of Information

Failures of large steam turbines in both nuclear and fossilfueled power plants, although rare, have occurred occasionally

in the past. These failures have occurred because of one or

more of the following broad classes of reasons: (1) metallurgical and/or design inadequacies, (2) environmental

effects, (3) out-of-phase or generator field failures, and

(4) failures of overspeed protection systems. The failures

have resulted in loss of blades, disk cracking, rotor and disk

rupture, and even missiles. Turbine missiles are highly

energetic and have the potential to damage safety-related

structures housing critical components. Therefore, protection

of nuclear power plants from turbine missiles is an important

safety consideration. Also, rupture of the turbine casing in

a boiling water reactor plant may lead to release of primary

coolant steam and radioactivity to the environment. Hence,

the plant owners aim to minimize the frequency of turbine

failures resulting in casing rupture even if there are no

significant turbine missile strikes on safety-related

components.

In a total of 2,500 years of turbine operation in nuclear

power plants in the free world, only four failures have

occurred: Calder Hall (1958), Hinkley Point (1969),

Shippingport (1974), and Yankee Rowe (1980). External

missiles were produced in the Hinkley Point and Calder Hall

failures. Although the causative mechanisms of these failures

have been identified and are generally corrected in the modern

nuclear turbines, there is no assurance that turbine failures

will not occur in the future. Recent discovery of widespread

stress corrosion cracking in the disks and rotors of operating

nuclear turbines has revived the industry's interest in the

issue of turbine failures.

Nuclear plant turbines rotate at 1800 rpm with the lowpressure (LP) and high-pressure (HP) sections on a contiguous

shaft. The LP sections have blade hubs (called "wheels" or

"disks") shrunk onto the rotor. Depending on the manufacturer

and rated capacity of the turbine, there could be 10 to 14

disks on each LP section. The disks are massive components

each weighing between 4 and 8 tons. These disks, because of

their relatively large radius, are the most highly stressed

spinning components in the turbine. With the turbine unit

running at less than 120 percent of the rated speed, the disks

are stressed well below the yield strength of material so that

failures can be caused only by undetected material flaws that

may be aggravated by stress corrosion and fatigue. At 180

percent of the rated speed, the disks are stressed at or above

4-47
their ultimate strength so that they burst into fragments. At

intermediate speeds (i.e., 120 to 180 percent), rupture of

disks may be caused by a combination of flaws and weaker

material in the disks.

Turbine missiles are spinning, irregular fragments with

weights in the range of 100 to 8,000 pounds, and velocities in

the range of 30 ft/sec to 800 ft/sec. It is conventional to

discuss two types of turbine missile trajectories: low

trajectory missiles (LTM) and high trajectory missiles (HTM).

The low trajectory missiles are those which are ejected from

the turbine casing at a low angle toward a barrier protecting

an essential system. High trajectory missiles are ejected

vertically (almost) upward through the turbine casing and may

strike critical targets by falling on them. The customary

ballistic distinction between LTM and HTM is the initial

elevation angle (q) of the missile (LTM is for 0 < 450 and HTM

is for 0 z 45°). Turbine manufacturers have specified that

the maximum deflection angle for the missiles produced in the

burst of the last disk on the rotor is 250. Based on this,

the NRC has defined a low trajectory missile strike zone in

the Regulatory Guide 1.115 (USNRC) and recommends that the

essential systems be located outside this LTM strike zone

(Figure 4.4-1). The plants with essential systems outside the

LTM strike zone are known to be "favorably oriented" with

respect to turbine generators. If a turbine missile impacts a

barrier enclosing a safety-related component, interest lies in

knowing if the missile perforates or scabs the barrier to

cause sufficient damage to the component. Using empirical

formulas for scabbing derived on the basis of the full scale

and model tests, it is estimated that concrete barriers should

be at least 4 feet thick to prevent scabbing. The need for

providing such barriers depends on the frequency of turbine

failure and the arrangement of safety-related components with

respect to turbine missile trajectories. In the design of a

nuclear power plant, the designers have many alternative

approaches for treating the potential effects of turbine

failures (Sliter, Chu and Ravindra, 1983). These approaches

can be grouped as: (1) prevention of turbine failure,

(2) prevention of missiles, (3) prevention of strike on

critical components, and (4) performance of probabilistic

analysis to demonstrate that the probability of turbine

missile damage is acceptably low.

The information required for a turbine missile probabilistic

bounding analysis includes the frequency of missile

generation, properties of missiles (i.e., number, weight,

area, velocity, and ejection angles), geometry of the plant,

thicknesses of roofs and walls of buildings, and locations of

safety-related components. The frequency of missile

generation can be based on historical data as described in

4-48
previous paragraphs. From these data, it is concluded that

the frequency of missile generation is on the order of 10-4

per year. Some turbine vendors have also calculated missile

generation frequencies for their turbines as usually lower

than the 10-4 per year which is based on historical data.

However, recent discoveries of stress corrosion cracking (SCC)

in nuclear plant turbines suggests that the frequency of

turbine missile generation may not be as low as turbine

vendors had predicted in the past.

4.4.2 FSAR Analysis

The frequency of serious damage, P4 , from turbine missiles to

a specific system in the plant is calculated as (Bush, 1973):

P 4 = P1 P2 P3 (4.4-1)

where:

P1 = frequency of turbine failure leading to missile

generation,

P2 = probability of missiles striking a barrier that

encloses the safety system given that the

missile(s) have been generated,

P3 = probability of unacceptable damage to the system given that one or more missiles strike the

barrier.

In practice, the evaluation of P4 should include consideration

of different speed condition, distributions of missiles, and

all the safety-related components and systems in the plant.

Turbine missile damage in the older -plants was usually

considered on the basis of a deterministic safety review

according to RG 1.115 and SRP 2.2.3 (NUREG-0800, USNRC, 1975),

i.e., the probability of unacceptable damage from turbine

missiles (P4 ) was implicitly shown to be less than 10-7 per

year. The new guidelines concerning safety of nuclear power

plants against turbine missile strikes are best summarized in

NUREG-1068 (USNRC, 1984) which is a review of the Limerick

PRA. The following paragraphs have been reproduced from

NUREG-1068 describing the NRC position on calculating the

probability of turbine missile damage.

4-49
"In the past, analyses for construction permit and

operating license reviews assumed the frequency of missile

generation (P1 ) to be approximately 10-4 per turbine year, based on the historical failure rate. The strike

probability (P2 ) was estimated (SRP 3.5.1.3) based on

postulated missile sizes, shapes, and energies, and on

available plant-specific information such as turbine

placement and orientation, number and type of intervening

barriers, target geometry, and potential missile

trajectories. The damage probability (P3 ) was generally

assumed to be 1.0. The overall frequency of unacceptable

damage to safety-related systems (P4 ), which is the sum

over all targets of the product of these frequencies, was

then evaluated for compliance with the NRC safety

objective. This logic places the regulatory emphasis on

the strike probability. That is, having established an

individual plant safety objective of about 10-7 per year,

or less, for the probability of unacceptable damage to

safety-related systems as a result of turbine missiles,

this procedure requires that P2 P3 be less than or equal to 103..

Although the calculation of strike probability (P2 ) is not

difficult in principle, for the most part reducing it to a

straight-forward ballistics analysis presents a problem in

practice. The problem stems from the fact that numerous

modeling approximations and simplifying assumptions are

required to make tractable the incorporation into

acceptable models of available data on the (1) properties

of missiles, (2) interactions of missiles with barriers

and obstacles, (3) trajectories of missiles as they

interact with or perforate (or are deflected by) barriers,

and (4) identification and location of safety-related

targets. The particular approximations and assumptions made tend to have a large effect on the resulting value of

P2- Similarly, a reasonably accurate specification of the

damage probability (P3) is no simple matter because of

difficulty of defining the missile impact energy required

to make given safety-related systems unavailable to

perform their safety function, and the difficulty of

postulating sequences of events that would follow a

missile-producing turbine failure.

Because of the uncertainties involved in calculating P2 , the NRC staff concludes that P2 analyses are "ballpark" or

"order of magnitude" type calculations only. Based on

simple estimates for a variety of plant layouts, the NRC

staff further concludes that the strike and damage

probability product can be reasonably taken to fall in a

characteristic narrow range that is dependent on the gross

features of turbine-generator orientation because (1) for

4-50
favorably oriented turbine generators, P2 P3 tend to lie

in the range 10-4 to 10-3, and (2) for unfavorably

oriented turbine generators, P2 P3 tend to lie in the

range 10-3 to 10-2. For these reasons (and because of

weak data, controversial assumptions, and modeling

difficulties), in the evaluation of P4 , the NRC staff

gives credit for the product of the strike and damage

probabilities of 10-3 for a favorably oriented turbine and

10-2 for an unfavorably oriented turbine, and does not

encourage calculations of them. In the opinion of the NRC

staff, these values represent where P2P3 lie, based on

calculations done by the NRC staff and others.

It is the view of the NRC staff that the NRC safety

objective with regard to turbine missiles is best

expressed in terms of a criterion applied to the missile

generation frequency which requires the demonstrated value

of turbine missile generation frequency (Pl) be less than

10-5 for initial startup and that corrective action be

taken to return P1 to this value if it should become

greater than 10-5 during operation.

It is the staff's view that the frequency of unacceptable

damage to safety-related structures, systems and

components as a result of turbine missiles is acceptably

low (i.e., less than 10-7 per year) provided that the

above criterion on turbine missile generation is met.

This criterion is to be met by the maintenance of an

appropriate in-service inspection and testing program on

the turbine throughout the plant's life as discussed in

detail in the Limerick SER."

From the preceding paragraphs, it is seen that the emphasis is

on turbine maintenance and in-service inspection to assure a

value of the frequency of turbine missile generation (Pl) less

than 10-5 per year. For plants which have favorable turbine

orientation and an in-service inspection program, the

frequency of turbine missile damage is expected to be less

than 10-7 per year. Therefore, a probabilistic bounding

analysis is not required for these plants. Also, if a plant

has an in-service inspection program which assures missile

generation frequency of less than 10-5 per year, then based on

a minimum P2 P3 value of 10-2 per year, turbine missiles can be

excluded from external events analysis. For plants which do

not have an inspection program but have a favorable turbine

orientation, the argument for excluding turbine missiles from

further consideration is as follows. Based on historical

failure data (Bush, 1973), the probability of turbine missile

generation has been calculated to be approximately 10-4 per

year. Also, Patton, et al. (1983) conducted a comprehensive

study which estimated the probabilities of turbine missile

4-51
generation at operating speed and overspeed as 1.2 x 10-4 per

year and 0.44 x 10-4 per year, respectively. Since damage due

to turbine missiles in a favorably oriented turbine is almost

entirely due to the high trajectory missiles, the P2P3

probability estimate of 10-3 per year which was accepted by

the NRC staff is judged to be conservative. Therefore, the

frequency of turbine missile damage in plants which have

favorably oriented turbines is conservatively estimated to be

in the order of 10-7 per year.

Section 4.4.3 describes the method of bounding analysis which

may be used to calculate the annual frequency of damage from

turbine missiles. This method may be applied to the plants

which have an unfavorably turbine orientation and also do not

have in-service inspection for stress corrosion cracking.

4.4.3 Turbine Missile Risk Analysis

A probabilistic bounding analysis for turbine missiles is

usually performed in two stages, i.e., the first step is to

calculate the probability of missile strike (P2), and the

second step is to calculate the probability of barrier damage

P3 - If P2 P3 is found to be less than 10-3, then turbine

missiles may be excluded from a detailed PRA study. This is

based on a P1 probability of 10-4 per year which has been

calculated from historical failure data (Bush, 1973). The

following paragraphs describe the methodology for a turbine

missile bounding analysis. It may be noted that if P2 is

found to be less then 10-3 then the analyst may assume P3 to

be equal to 1.0 and still eliminate turbine missiles from an

external events PRA study.

Probability of Missile Strike P2 - When the fragments produced

in a disk rupture escape the turbine casing, their paths have

to be determined in order to know if they intersect barriers

protecting essential systems of the nuclear power plant. For

this purpose, a description of the parameters of these

missiles is needed. Major turbine manufacturers have

developed their own - generally proprietary - techniques for

assessing whether or not disk fragments exit the turbine

casing and the parameters of resulting missiles. By making a

set of conservative assumptions regarding the disk breakup

mechanism and the impact between the disk fragments and casing

structure, they estimate the missile exit conditions. These

conditions include weight, cross-sectional areas, shape, size,

number of fragments, and exit velocities at different speed

conditions.

The probability of a missile striking a barrier is calculated

as follows: low trajectory missiles are considered to travel

in straight line paths. Their direction is defined in terms

4-52
of two angles, i.e., the ejection angle, 61 , from the

horizontal plane and the deflection angle e2 from the plane of

rotation of the ruptured disk (Figure 4.4-2). The angle e1 ,

could vary from 00 to 900. The limits on 62 are specified by

the turbine manufacturer (e.g., GE specifies -5° to +50 for

interior disks and 00 to 250 for end disks). It is customary

to assume that the angles el and 82 are distributed uniformly

within the specified limits. The probability of a low

trajectory missile strike on a structural barrier protecting

an essential system is calculated as the ratio of the solid

angle the barrier subtends at the missile origin to the total

solid angle within which the missile can be ejected out of the

turbine casing (GE, 1973).

High trajectory missile strikes are analyzed using ballistic

theory (Bush, 1973; General Electric 1973; Semanderes, 1972;

Filstein and Ravindra, 1979). The missile is modeled as a

point mass experiencing no drag forces. Since the initial

velocity of a missile and the ejection and deflection angles

are random variables, there is a finite probability that any

essential system will be struck by high trajectory missiles.

The strike probability density, PA per unit horizontal strike

area, located at a radial distance r from the missile origin

is expressed as (Filstein and Ravindra, 1979)

3 3

PA " 3 - (4.4-2)

48 r g sinA(V2 - V1 )

where

Xmin V2

2V sina

max V1 if r • 1 (4.4-3)

rg sin 2 COS'1 snA Otherwise I Ceose 3

In the above equations, the missile velocity is assumed to

vary between V1 and V2 ; the coordinates of the point along the

missile trajectory are (x,y,z) where x = rsine3 and y. =

rcose3. e3 is given in terms of el and 02 by

cot 83 = Cot e 2 .Cot el. (4.4-4)

4-53
and g is the acceleration due to gravity.

Twisdale, et al. (1983) have developed a Monte Carlo

simulation methodology for tracking the turbine missiles. A

six-degree of freedom (6D) model for predicting the freeflight motion of rigid bodies has been formulated. It

considers drag, lift, and side forces and simulates missile

tumbling by periodic reorientation. A computer code called

TURMIS has been developed to integrate the coupled nonlinear

ordinary differential equations of motion. Sensitivity

studies performed using this sophisticated 6D model clearly

support the use of no-drag ballistic model for low-trajectory

turbine missile calculations. For high trajectory missiles,

the ballistic model introduces prediction errors for

individual trajectories, but these errors may not be

significant (due to compensating effects of reduced speed and

increased impact probability) when statistically averaged for

plant risk analysis.

Probability of Barrier Damaged P3 - When a missile impacts a

structural barrier (i.e., wall or roof) protecting an

essential system, one or more of the following events could

take place: penetration, front-face spalling, perforation, or

back-face scabbing of the barrier, overall response of the

barrier, and ricochet of the missile. All of these events may be important in evaluating the damage potential of turbine

missiles. However, local effects of turbine missiles on

concrete and steel barriers normally provided in nuclear power

plants are particularly important and include penetration, perforation and scabbing. Penetration into a reinforced

concrete barrier that does not produce back-face scabbing may

not constitute a safety-related damage event unless front-face

spalling is of concern. Perforation is the event in which the

missile completely penetrates the barrier and continues its

flight with a residual velocity less than the initial impact

velocity. Scabbing is the failur6 mode of most interest

because the scabbed concrete fragments may damage the enclosed

safety-related component or the piping, electrical cable or

instrumentation attached to it.

The probability of barrier damage P3 is calculated using the

random properties of the missile (i.e., weight, velocity,

impact area, obliquity, and noncollinearity) and empirical

impact formulas (Chang, 1981; Berriaud, et al., 1978;

Twisdale, et al., 1983). The dispersion in the impact test

data about the empirical formulas is used to develop

probability density functions of perforation or scabbing

thickness. For any given missile impacting a structural

barrier of known material and thickness, the probability of

perforation or scabbing is calculated using these probability

density functions (Twisdale, et al., 1983).

4-54
Evaluation of P2 and P3 can be done numerically if the missile

initial conditions are described by a limited set of

parameters and if the plant is assumed to be damaged when the

external barrier of a safety-related structure is breached

(i.e., perforated or scabbed). In general, turbine missiles

are described by a number of random parameters and several

barriers separate the safety-related components from the

missile sources. A Monte Carlo simulation procedure such as

the TURMIS computer code developed by Twisdale et al. (1983)

would be needed to handle the multitude of missile trajectories and possible impact conditions encountered in a nuclear

plant. The nuclear power plant is modeled for this analysis

as follows. A component may be damaged by a missile

physically impacting it, or by the missile damaging the

electrical cables or piping that are needed for the component

to function. Since it is impractical to model all piping,

electrical cables and HVAC ducts for the turbine missile

analysis, the components may be modeled as being enclosed in

fire zones. Each fire zone's boundaries are delineated such

that the component and all its support lines (piping, electrical cables, etc.) are within this zone. Therefore, the

fire zones are independent of each other. By this technique,

the safety-related structures of a plant are divided into a

small number of fire zones (at each elevation in the

structures and/or through different elevations). The

sequences of fire zones which if damaged by missiles in a

single turbine failure may lead to core damage or serious

release (i.e., "cut sets") are obtained by fault tree analysis

(Ravindra, 1982).

4-55
Reproduced from Regulatory Guide 1.115.

Figure 4.4-1. Low-Trajectory Turbine Missile Strike Zone

4-56
eY

V0 INITIAL VELOCITY

61 ANGLE FROM Y AXIS TO Vyz, 0<3., <900

02 ANGLE FROM YZ PLANE TO V0 , -L<_.2 !A, t<5 (INNER DISK);

0<e2<_, &<250 (OUTER DISK)

03 ANGLE ON THE GROUND, 900 <63 <900

C. ANGLE FROM GROUND TO V0, e2-*O,. THEN 4-01

Figure 4.4-2. Variables and Terminology Used in Calculating Missile Strike Probabilities

4-57
4.5 Other External Events

4.5.1 Accidents in Nearby Industrial and Military Facility

The effects of potential accidents in industrial and military

facilities in the vicinity of a nuclear power plant include

explosion-created overpressure, missiles and thermal effects,

and chemical release that may cause the control room to become

inhabitable. The topic of chemical release is discussed in

Section 4.5.3.

If the facility is located farther than the safe distance

defined in Regulatory Guide 1.91, no further analysis of the

explosion effects is necessary. Otherwise, a probabilistic

bounding analysis similar to that described in Section 4.1.3

should be done to estimate the frequency of core damage

induced by industrial and military facility accidents.

4.5.2 Pipeline Accidents

If there are pipelines transporting natural gas, propane or

other flammable explosive or toxic gases near the nuclear

power plant, a scoping analysis of the hazard posed by the

pipelines should be performed.

The annual frequency of failure of a large pipeline near the

plant, PF is calculated as:

PF = NFD fs fW ft fd/L

where

NF - number of gas transmission line failures per

year in the United States,

D = distance of pipe near site (miles),

fs = fraction of failures that are large,

fw = fraction of time wind will blow toward plant

from pipeline,

ft = fraction of failures due to construction-related

failures and corrosion,

fd = fraction of leaks going undetected,

L = miles of transmission pipeline in the United

States.

4-58
In the Indian Point PSS, the frequency is estimated as

4.5 x 10-7 per year. It is judged that the frequency of core

damage due to pipeline failure is much lower than 4.5 x 10-7

per year. For further details, see the Indian Point PSS.

4.5.3 Chemical Release

The accidental release of a chemically toxic-vapor cloud from

any railroad, highway, or fixed installations in the vicinity

of the nuclear power plant could lead to core damage and

serious radioactive release to the atmosphere only if the

plant operators are affected in such a way that they cannot

respond to an emergency when required to do so, or if they are

affected in such a way as to set in motion a series of events

that lead to damage of the plant. Some of these toxic vapors

can be detected by smell (e.g., acetaldehyde, fluorine,

hydrogen sulfide, and vinyl acetate); some vapors require

automatic detection (e.g., ammonia, vinyl chloride, and

phosgene); chlorine is the only vapor for which automatic

detection and isolation are required. When the toxic vapor is

detected, the operators are expected to don their breathing

masks.

In an NRC-sponsored research program, Sandia National

Laboratories has studied the principal threats to nuclear

power plants from offsite transport or storage accidents

involving hazardous materials (Bennett and Finley, 1981; Smith

and Bennett, 1980; Bennett and Heath, 1982; Kennedy, Blejwas and Bennett, 1983; Bennett, 1985). The threats include toxic

chemical release, overpressure from explosions, and thermal

effects from large fires. For offsite accidents releasing

large quantities of a toxic material, the concern lies in its

potential for incapacitating the control room operators.

Smith and Bennett (1980) have developed models to estimate the

incapacitation times for arbitrary personnel exposure profiles

in terms of exposure concentration and exposure dose. The

models are summarized as follows:

1. Concentration dependent - immediate sensory irritant

(e.g., chlorine, ammonia).

2. Dual concentration/dose dependency - immediate sensory

irritant and/or delayed pulmonary effects (e.g.,

phosgene, nitrogen dioxide).

3. Dose dependent - related to concentrations exceeding

the Threshold Limit Value (e.g., carbon monoxide,

styrene).

4-59
4. Dose dependent - related to concentrations above an

onset level for significant and immediate

incapacitating response (e.g., benzene, vinyl

chloride).

5. Dose dependent - derived from mortality data (e.g.,

acetonitrile).

In Bennett and Heath (1982), the probabilities of operator

incapacitation given a release along a transportation route

near a nuclear plant are estimated for different chemicals.

The study considers different dispersion models, types of

control room ventilation systems and the effect of chemicals

for relatively short exposure durations (e.g., 2 to 5

minutes). The results are presented in terms of the number of

shipments of a specific chemical that could pass near the

plant such that the probability of operator incapacitation

does not exceed certain regulatory guidelines (e.g., 10-6 per

year). The results also include combinations of various

parameters (truck or rail, standoff distance, ventilation

system time, exposure duration, and concentration or dose

incapacitation). These could be used to perform a scoping

quantification study for chemical releases in an external

event PRA. Where the particular release event cannot be

screened out, further bounding analysis is required as

described below:

Figure 4.5-1 is a fault-tree-like representation of toxicvapor release reproduced from the Limerick SARA. For

excessive concentrations of toxic vapor to occur at control

room intake, the following events must take place:

1. A release of toxic vapor, and

2. the wind blows from the point of the release toward

the plant, and

3. that there is insufficient dilution by the action of

atmospheric turbulence, i.e., the plume travel towards

the plant and remains above the level of acceptable

concentration.

The three possible sources for accidental release of toxic

vapors are onsite storage, nearby industrial facilities (e.g.,

Hooker chemical plant near Limerick), and transportation of

chemicals on railroad, river barges and highways.

Given the arrival of toxic gas in excessive concentration at

the control-room air intake, there are several possible

4-60
effects that toxic vapors could have on operators. Figure

4.5-2 illustrates the effect of chlorine on the operators

(Limerick SARA). The first branch of the tree asks whether

the detection and isolation capability functions as intended.

If not, calculations show that the operators will be

incapacitated within one minute after the toxic vapor has

reached the control room. If the control room is successfully

isolated, the operators have about 10 minutes to put on their

breathing masks before the chlorine leak incapacitates them.

Finally, even if the operators are incapacitated, core damage

does not necessarily follow; the reactor may continue to run

unattended until relief operators arrive; or, if there is a

transient, the reactor will most likely shut itself down.

4.5.3.1 Onsite Storage

Regulatory Guide 1.78 gives the maximum quantities of

different chemicals that can be stored onsite at specified

distances from the control room based on the leaktightness of

the control room. If the quantity stored exceeds the limits

of the regulatory guide, automatic detectors have to be

installed so that the control room is isolated, should

accidental release occur.

If the plant design meets the regulatory guide requirements,

it is judged that the probability of chemical release in

excessive concentrations combined with the malfunction of the

detectors (if any) is very small. In this case, no detailed

analysis is needed. If the regulatory guide limits are

exceeded, a detailed risk assessment such as that described in

the Limerick SARA needs to be performed. The models and

methodology developed in the research program at Sandia

National Laboratories could be used to estimate the

probability of operator incapacitation (see previous

references in Section 4.5.3).

4.5.3.2 Offsite Storage and Handling of Chemicals

In this category are included industrial facilities and

transportation of chemicals on railroad, river barges, and

highways.

Regulatory Guide 1.78 states that if the source of chemical

release is situated at a distance greater than 5 miles, its

potential impact on the control room habitability needs not be

assessed. This is due to the fact that if a release occurs at

such a distance, atmospheric dispersion will dilute and

disperse the incoming plume to such a degree that there should

be sufficient time for the control room operators to take

appropriate action.

4-61
If the source is located within 5 miles and if the maximum

quantity of the chemical stored at the facility or frequency

shipped on transportation routes exceeds the R.G. 1.78 limits,

further analysis of the risk due to chemical release is

needed. Shipments are defined as being frequent if there are

10 per year for truck traffic, 30 per year for rail traffic or

50 per year for barge traffic.

For an example of detailed risk analysis of chemical releaseinduced accidents, see the Limerick SARA. The results of the

research program at the Sandia National Laboratories may be

used to estimate the effects of release on control room

operators.

4-62
EXCESSIVE

CONCENTRATI7OS

AT CONTROL ROO"

AIR INTAKE

DIRECTION TOXIC VAPOR AND DILUTION

O -SITE OOKER

I

HWAY

RAILROA

Figure 4.5-1. Fault-Tree-Like Representation of Toxic-Vapor Release

Reproduced from Limerick SARA.
Au~imata

daecMOwn

and 00610mn

Beeath4ng

masks

Adveow m~pwl an "Worao leading to

cote "witl

A, Cm

OK

OK

Ekenuawe chkwnuw

conw"nRairsaw at am intake

Be

0% Cmo Exes.C

OK

, CFigure 4.5-2. Event Tree Illustrating Effect of Chlorine on Operators

Reproduced from Limerick SARA.
5.0 SUMMARY AND CONCLUSIONS

In this report, the scoping quantification procedures for

external events in probabilistic risk assessments of nuclear

power plants are described. External event analysis in a PRA

has three important goals:

1. The analysis should be complete in that all events are

considered.

2. By following some selected screening criteria, the

more significant events are identified for detailed

analysis.

3. The selected events are analyzed in depth by taking

into account the unique feature of the events:

hazard, fragility of structures and equipment,

external-event initiated accident sequences, etc.

Based on the above goals, external event analysis may be

considered as a three-stage process.

Stage I Identification and Initial Screening of

External Events.

Stage II Bounding Analysis

Stage III Detailed Risk Analysis

The scoping quantification methods and the methodology for

external event risk analysis have been described in the PRA

Procedures Guide (USNRC, 1983). The scoping quantification

methods have been applied to the LaSalle County Station in the

Risk Methods Integration and Evaluation Program (RMIEP) at

Sandia National Laboratories (Ravindra and Banon, 1992). The

Procedures Guide and the RMIEP-! reports also describe

procedures for detailed risk analyses of seismic, fire, and

flooding initiated events.

In the present report, a review of published PRAs is given to

focus on the significance and treatment of external events in

full-scope PRAs. Except for seismic, flooding, fire and

extreme wind events, the contributions of external events to

the plant risks were insignificant. Scoping methods for

external events not covered in detail in the Procedures Guide

are also provided. For this purpose, bounding analyses for

transportation accidents, extreme winds and tornadoes,

aircraft impacts, turbine missiles, and chemical release are

described.

5-1
It is suggested that the PRA analyst and the PRA reviewer use

the methods described in this document to augment the

methodology discussed in the PRA Procedures Guide.

5-2
REFERENCES

Abbey, R. F., "Risk Probabilities Associated with Tornado Wind

Speeds," Proceedings, Symposium on Tornadoes, Lubbock, TX,

June 1976.

Abbey, R. F., and T. T. Fujita, "Use of Tornado Path Length

and Gradations of Damage to Assess Tornado Intensity

Probabilities," 9th Conference on Severe Local Storms,

American Meteorological Society, Boston, MA, October 1975.

ASCE Committee on Impact and Impulse, Committee Report

presented at the ASCE Specialty Conference in Knoxville,

TN, August 1980.

Bennett, D. E., "Analysis Methods for Offsite Transport

Hazards," Proc. ANS/ENS International Topical Meeting on

Probabilistic Safety Methods and ARplications, Vol. 1,

Paper 57, San Francisco, CA, February 1985.

Bennett, D. E., and N. C. Finely, "Hazards to Nuclear Power

Plants from Nearby Accidents Involving Hazardous

Materials - A Preliminary Assessment," Sandia National

Laboratories, Albuquerque, NM, NUREG/CR-1748, SAND80-2334,

April 1981.

Bennett, D. E., and D. C. Heath, "Allowable Shipment

Frequencies for the Transport of Toxic Gases Near Nuclear

Power Plants," Sandia National Laboratories, Albuquerque,

NM, NUREG/CR-2650, SAND82-0774, October 1982.

Berriaud, C., Sokolovsky, A., Gueraud, R., Dulac, J., Labrot,

R. and R. Avet-Flancard, "Local Behavior of the Reinforced

Concrete Walls Under Missile Impact," Nuclear Engineering

and Design, pp. 457-469, Vol. 48, 1978.

Biggs, J. M., Introduction to Structural Dynamics, McGraw-Hill

Book Company, 1964.

Bush, S. H. , "Probability of Damage to Nuclear Components due

to Turbine Failure," Nuclear Safety, Vol. 14, No. 3, MayJune 1973.

Chang, W. S., "Impact of Solid Missiles on Concrete Barriers,"

Journal of the Structural Division, ASCE, Vol. 107, No.

ST2, pp. 257-271, February 1981.

Changery, M. J., "Historical Extreme Winds for the United

States - Great Lakes and Adjacent Regions," National

Oceanic and Atmospheric Administration, NUREG/CR-2890,

August 1982.

R-1
Commonwealth Edison Company, Zion Probabilistic Safety Study,

Chicago, IL, 1981.

Eichler, T. V. and H. S. Napadensky, "Accidental Vapor Phase

Explosions on Transportation Routes Near Nuclear Power

Plants," IIT Research Institute, Chicago, IL, NUREG/CR0075, May 1978.

Eichler, T., Napadensky, H. and J. Mavec, "Evaluation of the

Risks to the Marbile Hill Nuclear Generating Station from

Traffic on the Ohio River," Engineering Division, IIT

Research Institute, Chicago, IL, October 1978.

Electric Power Research Institute, Nuclear Safety Analysis

Center, Oconee PRA. A Probabilistic Risk Assessment of

Oconee Unit 3, NSAC-60, Palo Alto, CA, June 1984.

"FAA Statistical Handbook of Aviation, Calendar Year 1979,"

U.S. Department of Transportation, Federal Aviation

Administration, December 1979.

Filstein, E., and M. K. Ravindra, "Probability Analysis of

Turbine Missile Hazard," Proceedings of ASCE/EMD Specialty

Conference, Austin, TX, September 1979.

Fujita, T. T., and A. D. Pearson, "Results of the FPP

Classification of 1971 and 1972 Tornadoes," Paper at the

Eighth Conference on Severe Local Storms, October 1973.

Garson, R. C., Catalan, J. M. and C. A. Cornell, "Tornado

Design Winds Based on Risk," Department of Civil

Engineering, MIT, August 1974.

General Electric Company, "Memo Report - Hypothetical Turbine

Missiles - Probability of Occurrence," March 14, 1973.

Kennedy, R. P., Blejwas, T. E. and D. E. Bennett, "Capacity of

Nuclear Power Plant Structures to Resist Blast Loadings,"

Sandia National Laboratories, Albuquerque, NM, NUREG/CR2462, SAND83-1250, September 1983.

Markee, E. J., Beckerley, J. G. and K. E. Sanders, "Technical

Basis for Interim Regional Tornado Criteria," WASH 1300,

U.S. Government Printing Office, Washington, May 1974.

McDonald, J. R., "A Methodology for Tornado Hazard Probability

Assessment," Texas Tech University, Lubbock, TX, NUREG/CR3058, October 1983.

"Midland Probabilistic Risk Assessment," Consumer Power

Company, Midland, MI, 1984.

R-2
Niyogi, P. K., et al., "Safety Design of Nuclear Power Plants

Against Aircraft Impacts," Proceedings of Topical Meeting

on Thermal Reactor Safety, Sun Valley, ID, July 31 -

August 4, 1977.

Northeast Utilities, Millstone Unit 3 Probabilistic Safety

Study, Hartford, Connecticut, 1983.

Patton, E. M., et al., "Probabilistic Analysis of Low-Pressure

Steam Turbine-Missile Generation Events," Battelle Pacific

Northwest Laboratories, EPRI NP-2749, August 1983.

Philadelphia Electric Company, Severe Accident Risk

Assessment, Limerick Generating Station, Philadelphia, PA,

1983.

Port Authority of State of New York, Indian Point

Probabilistic Safety Study, New York, NY, 1982.

Ravindra, M. K., "Identification of Critical Targets for

Turbine Missile Analysis," Proc. EPRI Seminar on Turbine

Missile Effects in Nuclear Power Plants, Palo Alto, CA,

October 25-26, 1982.

Ravindra, M. K. and H. Banon, "Analysis of the LaSalle Unit 2

Nuclear Power Plant: Risk Methods Integration and

Evaluation Program (RMIEP) Volume 7: External Event

Scoping Quantification," Sandia National Laboratories,

Albuquerque, NM, NUREG/CR-4832/7 of 10, SAND92-0537, March

1992.

Reinhold, T. A. and B. Ellingwood, "Tornado Damage Risk

Assessment," National Bureau of Standards, Washington, DC,

NUREG/CR-2944, September 1982.

"Seabrook Probabilistic Safety Study," Pickard, Lowe and

Garrick, Inc., Newport Beach, CA, 1983.

Semanderes, S. N., "Methods for Determining the Probability of

a Turbine Missile Hitting a Particular Plant Region,"

Westinghouse Topical Report WCAP-7861, February 1972.

Schaefer, J. T., Kelley, D. L. and R. F. Abbey, "Tornado Track

Characteristics and Hazard Probabilities," Proceedings of

the Fifth International Conference on Wind Engineering,

Pergamon Press, New York, NY, 1980.

Sliter, G. E., Chu, B. B. and M. K. Ravindra, "EPRI Research

on Turbine Missile Effects in Nuclear Power Plants,"

Transactions of 7th International Conference on Structural

Mechanics in Reactor Technology, Paper J8/5, Chicago, IL,

pp. 403-409, 1983.

R-3
Smith, G. J., and D. E. Bennett, "Models for the Estimation of

Incapacitation Times Following Exposures to Toxic Gases or

Vapors," Sandia National Laboratories, Albuquerque, NM,

NUREG/CR-1741, SAND80-2226, December 1980.

Stephenson, A. E., "Full Scale Tornado-Missile Impact Tests,"

Electric Power Research Institute, RP-399, August 1976.

Twisdale, L. A. and W. L. Dunn, "Tornado Missile Simulation

and Design Methodology," Research Triangle Institute, NP2005, Vol. 1, August 1981.

Twisdale, L. A., Dunn, W. L. and Cho, J., "Tornado Missile

Simulation and Risk Analysis," Meeting on Probabilistic

Analysis of Nuclear Safety, American Nuclear Society,

Newport Beach, CA, May 1978.

Twisdale, L. A. et al., "Probabilistic Analysis of TurbineMissile Risks," Report prepared for the Electric Power

Research Institute, EPRI NP-2749, February 1983.

USNRC, "PRA Procedures Guide," NUREG/CR-2300, January 1983.

USNRC, Regulatory Guide 1.115, "Protection Against LowTrajectory Turbine Missiles."

USNRC, Regulatory Guide 1.91, "Evaluations of Explosions

Postulated to Occur on Transportation Routes Near Nuclear

Power Plants."

USNRC, Regulatory Guide 1.78, "Assumptions for Evaluating the

Habitability of a Nuclear Power Plant Control Room During

a Postulated Hazardous Chemical Release."

USNRC, Regulatory Guide 1.76, "Design Basis Tornado for

Nuclear Power Plants."

USNRC, "Review Insights on the Probabilistic Risk Assessment

for Limerick Generating Station," NUREG-1068, August 1984.

USNRC, "Standard Review Plan for the Review of Safety Analysis

Reports for Nuclear Power Plants," NUREG-0800-75/087,

1975.

R-4
Distribution

James Abel

Commonwealth Edison Co.

35 1st National West

Chicago, IL 60690

Kiyoharu Abe

Department of Reactor Safety

Research

Nuclear Safety Research Center

Tokai Research Establishment

JAERI

Tokai-mura, Naga-gun

Ibaraki - ken,

JAPAN

Bharat B. Agrawal

USNRC-RES/PRAB

MS: NLS-372

J. Alman

Commonwealth Edison Co.

LaSalle County Station

RR1, Box 220

2601 North 21st Rd.

Marsielles, IL 61341

George Apostolakis

UCLA

Boelter Hall, Room 5532

Los Angeles, CA 90024

Vladimar Asmolov

Head, Nuclear Safety Department

I. V. Kurchatov Institute

of Atomic Enegry

Moscow, 123182

U.S.S.R.

H. Banon

Exxon Production Research

P.O. Box 2189

Houston, TX 77252-2189

Patrick W. Baranowsky

USNRC-AEOD/TPAB

MS: 9112

Dist-I
Robert A. Bari

Brookhaven National Laboratories

Building 130

Upton, NY 11973

Richard J. Barrett

USNRC-NRR/PD3-2

MS: 13 D1

William D. Beckner

USNRC-NRR/PRAB

MS: 10 E4

Dennis Bley

Pickard, Lowe & Garrick

2260 University Drive

Newport Beach, CA 92660

Gary Boyd

Safety & Reliability Optimization

Services

9724 Kingston Pike, Suite 102

Knoxville, TN 37922

Robert J. Budnitz

Future Resources Associates

734 Alameda

Berkeley, CA 94707

Gary R. Burdick

USNRC-RES/RPSIB

HS: NLS-314

Arthur J. Buslik

USNRC-RES/PRAB

HS: NLS-372

Annick Carnino

Electricite de France

32 Rue de Monceau 8EME

Paris, F5008

FRANCE

S. Chakraborty

Radiation Protection Section

Div. De La Securite Des Inst. Nuc.

5303 Wurenlingen

SWITZERLAND

Dist-2
Michael Corradini

University of Wisconsin

1500 Johnson Drive

Madison, WI 53706

George Crane

1570 E. Hobble Creek Dr.

Springville, Utah 84663

Mark A. Cunningham

USNRC-RES/PRAB

MS: NLS-372

G. Diederick

Commonwealth Edison Co.

LaSalle County Station

RR1, Box 220

2601 North 21st Rd.

Marsielles, IL 61341

Mary T. Drouin

Science Applications International

Corporation

2109 Air Park Road S.E.

Albuquerque, NM 87106

Adel A. El-Bassioni

USNRC-NRR/PRAB

MS: 10 E4

Robert Elliott

USNRC-NRR/PD3-2

MS: 13 Dl

Farouk Eltawila

USNRC-RES/AEB

MS: NLN-344

John H. Flack

USNRC-RES/SAIB

MS: NLS-324

Karl Fleming

Pickard, Lowe & Garrick

2260 University Drive

Newport Beach, CA 92660

James C. Glynn

USNRC-RES/PRAB

MS: NLS-372

Dist-3
T. Hammerich

Commonwealth Edison Co.

LaSalle County Station

RRl, Box 220

2601 North 21st Rd.

Marsielles, IL 61341

Robert A. Hasse

USNRC-RGN-III

MS: RIII

Sharif Heger

UNM Chemical and Nuclear

Engineering Department

Farris Engineering

Room 209

Albuquerque, NM 87131

P. M. Herttrich

Federal Ministry for the

Environment, Preservation of

Nature and Reactor Safety

Husarenstrasse 30

Postfach 120629

D-5300 Bonn 1

FEDERAL REPUBLIC OF GERMANY

S. Hirschberg

Department of Nuclear Energy

Division of Nuclear Safety

International Atomic Energy Agency

Wagramerstrasse 5, P.O. Box 100

A-1400 Vienna

AUSTRIA

M. Dean Houston

USNRC-ACRS

MS: P-315

AleJandro Huerta-Bahena

National Commission on Nuclear

Safety and Safeguards (CNSNS)

Insurgentes Sur N. 1776

C. P. 04230 Mexico, D. F.

MEXICO

Peter Humphreys

US Atomic Energy Authority

Wigshaw Lane, Culcheth

Warrington, Cheshire

UNITED KINGDOM, WA3 4NE

Dist-4
W. Huntington

Commonwealth Edison Co.

LaSalle County Station

RR1, Box 220

2601 North 21st Rd.

Marsielles, Ii 61341

Brian Ives

UNC Nuclear Industries

P. 0. Box 490

Richland, WA 99352

William Kastenberg

UCLA

Boelter Hall, Room 5532

Los Angeles, CA 90024

George Klopp [10]

Commonwealth Edison Company

P.O. Box 767, Room 35W

Chicago, IL 60690

Alan Kolaczkowski

Science Applications Int. Corp.

2109 Air Park Rd. SE

Albuquerque, NM 87106

Jim Kolanowski

Commonwealth Edison Co.

35 1st National West

Chicago, IL 60690

S. Kondo

Department of Nuclear Engineering

Facility of Engineering

University of Tokyo

3-1, Hongo 7, Bunkyo-ku

Tokyo

JAPAN

Jose A. Lantaron

Cosejo de Suguridad Nuclear

Sub. Analisis y Evaluaciones

Justo Dorado, 11

28040 Madrid

SPAIN

Dist-5
Josette Larchier-Boulanger

Electricte de France

Direction des Etudes Et Recherches

30, Rue de Conde

65006 Paris

FRANCE

Librarian

NUMARC/USCEA

1776 1 Street NW, Suite 400

Washington, DC 80006

Bo Liwnang

IAEA A-1400

Swedish Nuclear Power Inspectorate

P.O. Box 27106

S-102 52 Stockholm

SWEDEN

Peter Lohnberg

Expresswork International, Inc.

1740 Technology Drive

San Jose, CA 95110

Steven M. Long

USNRC-NRR/PRAB

MS: 10 E4

Herbert Massin

Commonwealth Edison Co.

35 1st National West

Chicago, IL 60690

Andrew S. McClymont

IT-Delian Corporation

1340 Saratoga-Sunnyvale Rd.

Suite 206

San Jose, CA 95129

Jose I. Calvo Molins

Head, Division of P.S.A. and Human Factors

Consejo De Seguridad Nuclear

Justo Dorado, 11

28040 Madrid

SPAIN

Joseph A. Murphy

USNRC-RES/DSR

MS: NLS-007

Dist-6
Kenneth G. Murphy, Jr.

US Department of Energy

19901 Germantown Rd.

Germantown, MD 20545

Robert L. Palla, Jr.

USNRC-NRR/PRAB

MS: 10 E4

Gareth Parry

NUS Corporation

910 Clopper Rd.

Gaithersburg, MD 20878

G. Petrangeli

ENEA Nuclear Energy ALT Disp

Via V. Brancati, 48

00144 Rome

ITALY

Ing. Jose Antonio Becerra Perez

Comision Nacional De Seguridad

Nuclear Y Salvaguardias

Insurgentes Sur 1806

01030 Mexico, D. F.

MEXICO

William T. Pratt

Brookhaven National Laboratory

Building 130

Upton, NY 11973

William Raisin

NUMARC

1726 M. St. NW

Suite 904

Washington, DC 20036

D. M. Rasmuson

USNRC-RES/SAIB

MS: NLS-372

M. K. Ravindra [10]

EQE Inc.

2150 Bristol St., Suite 350

Costa Mesa, CA 92626

John N. Ridgely

USNRC-RES/SAIB

MS: NLS-324

Dist-7
Richard C. Robinson Jr.

USNRC-RES/PRAB

MS: NLS-372

Denwood F. Ross

USNRC-AEOD

MS: 3701

Christopher P. Ryder [10]

USNRC-RES/PRAB

MS: NLS-372

Takashi Sato

Deputy Manager

Nuclear Safety Engineering Section

Reactor Design Engineering Dept.

Nuclear Energy Group

Toshiba Corporation

Isogo Engineering Center

8, Shinsugita-cho, Isogo-ku,

Yokohama 235,

JAPAN

Martin Sattison

Idaho National Engineering Lab.

P. 0. Box 1625

Idaho Falls, ID 83415

Louis M. Shotkin

USNRC-RES/RPSB

MS: NLN-353

Desmond Stack

Los Alamos National Laboratory

Group Q-6, Mail Stop K556

Los Alamos, NM 87545

T. G. Theofanous

University of California, S. B.

Department of Chemical and Nuclear

Engineering

Santa Barbara, CA 93106

Harold VanderMolen

USNRC-RES/PRAB

MS: NLS-372

Dist-8
Magiel F. Versteeg

Ministry of Social Affairs and Employment

P.O. Box 90804

2509 LV Den Haag

THE NETHERLANDS

Edward Warman

Stone & Webster Engineering Corp.

P.O. Box 2325

Boston, MA 02107

Wolfgang Werner

Gesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

3141 S. A. Landenberger [5]

3151 G. L. Esch

6321 T. A. Wheeler

6400 N. R. Ortiz

6410 D. A. Dahlgren

6411 D. D. Carlson

6411 D. M. Kunsman

6411 R. J. Breeding

6411 K. J. Maloney

6412 A. L. Camp

6412 S. L. Daniel

6412 S. E. Dingman

6412 B. D. Staple

6412 G. D. Wyss

6412 A. C. Payne, Jr. [25]

6412 D. W. Whitehead

6413 F. T. Harper

6413 T. D. Brown

6419 M. P. Bohn

8524 J. A. Wackerly

Dist-9
'NRC Go'.v335 US NUCLEAR REGULATORY COMMISSION " RiE=0,2, •(A lenel NL"B-E= Jbv NRC Aci Vol, Suom P.v

%PC ',.,and A" 1,rendu m Numbers, if aI I

:2 :2* D BIBLIOGRAPHIC DATA SHEET NUREG/CR-4839

(See ins:,.'tcons on The reverse SAND87-7156

2 TITLE AND SDBIITLE

Methods for External Event Screening Quantification:

Risk Methods Integration and Evaluation Program (RMIEP) 3 DATE REPORT PuIzS-E'

Methods Development %Eo"-=

July 1992 4 FIN OR GRANT NUMBER

A1386

5 AUTHORIS, 6 TYPE OF REPORT

M.K. Ravindra, H. Banon Technical

7 PERIOD COVERED . Dat

8 PERFORMING ORGANIZATION - NAME AND ADDRESS f &.RC Dovoe Dison Office or Region US Nucla Refugrorp Commrnwor andn iMdg ad,edrss of coarr. ,o..o

name and mailang .dafdwe /

NTS/Structural Mechanics Associates Under Contract to:

5160 Birch Street Sandia National Laboratories

Newport Beach, CA 92660 Albuquerque, NM 87185

9 SPONSORING ORGANIZATION - NAME AND ADDRESS IetfNsC Ivor .,measao,. ,oco~lmwror Prow.d. NICo~wno, o.ffi e. rleg'o. &5 Iv€.l o. cf~ mmro.t,,n end ma/min addre.,,)

Division of Safety Issue Resolution

Office of Nuclear Regulatory Research

US Nuclear Regualtory Commission

Washington, DC 20555

10 SUPPLEMENTARY NOTES

ABSTRACT /20,., oh lei

In this report, the scoping quantification procedures for external events in probabilistic

risk assessments of nuclear power plants are described. External event analysis in a PRA

has three important goals: (1) The analysis should be complete in that all events are

considered; (2) By following some selected screening criteria, the more significant

events are identified for detailed analysis; (3) The selected events are analyzed in

depth by taking into account the unique features of the events: hazard, fragility of

structures and equipment, external-event initiated accident sequences, etc. Based on the

above goals, external event analysis may be considered as a three-stage process: Stage I:

Identification and Initial Screening of External Events; Stage II: Bounding Analysis;

Stage III: Detailed Risk Analysis. In the present report, first, a review of published

PRAs is given to focus on the significance and treatment of external events in full-scope

PRAs. Except for seismic, flooding, fire, and extreme wind events, the contributions of

other external events to plant risk have been found to be negligible. Second, scoping

methods for external events not covered in detail in the NRC's PRA Procedures Guide are

provided. For this purpose, bounding analyses for transportation accidents, extreme winds

and tornadoes, aircraft impacts, turbine missiles, and chemical release are described.

12 KEY WORDS'DESCR'PTORS (Lost wof, r.liara i., ad, u,? is e.Arr,. w iloc.tinge it r * , AVAILABILI1YSTA'E5I.E,'

External Events Unlimited

PRA Methods 14 SEcURITY CLASs,,,cL-.

Risk Methods Integration and Evaluation Program (RMIEP) ,(Tis P

Screening Procedures Unclassified

(Trds Repo':,

Unclassified

15 NUMBER OF PAGES

16 PRICE

N*C FORM 33E5 12.49