NUREG/CR-4840

SAND88-3102

Procedures for the External

Event Core Damage Frequency

Analyses for NUREG-1 150

Prepared by

M. P. Bohn, J. A. Lambright

Sandia National Laboratories

Operated by

Sandia Corporation

Prepared for

U.S. Nuclear Regulatory Commission
AVAILABILITY NOTICE

Availability of Reference Materials Cited in NRC Publications

Most documents cited In NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 2120 L Street. NW, Lower Level. Washington. DC 20555

2. The Superintendent of Documents, U.S. Government Printing Office. P.O. Box 37082. Washington.

DC 20013-7082

3. The National Technical Information Service. Springfield, VA 22161

Although the listing that follows represents the majority of documents cited in NRC publications, It is not

intended to be exhaustive.

Referenced documents available for Inspection and copying for a fee from the NRC Public Document Room

Include NRC correspondence and Internal NRC memoranda: NRC Office of Inspection and Enforcement

bulletins, circulars, Information notices, Inspection and Investigation notices; Licensee Event Reports; vendor reports and correspondence: Commission papers; and applicant and licensee documents and correspondence.

The following documents In the NUREG series are available for purchase from the GPO Sales Program:

formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and NRC booklets and

brochures. Also available are Regulatory Guides. NRC regulations in the Code of Federal Regulations, and

Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service Include NUREG series reports and

technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission. forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries Include all open literature items, such as

books. journal and periodical articles, and transactions. Federal Register notices, federal and state legislalion. and congressional reports can usually be obtained from these libraries.

Documents such- as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free. to the extent of supply, upon written request to the

Office of information Resources Management. Distribution Section. U.S. Nuclear Regulatory Commission.

Washington. DC 20555.

Copies of industry codes and standards used In a substantive manner In the NRC regulatory process are

maintained at the NRC Library. 7920 Norfolk Avenue. Bethesda. Maryland, and are available there for reference use by the public. Codes and standards are usually copyrighted and may be purchased from the

originating organization or. If they are American National Standards, from the American National Standards

institute. 1430 Broadway. New York, NY 10018.

DISCLAIMER NOTICE

This report was prepared as an account of work sponsored by an agency of the United States Government.

Neither the United States Government nor any agency thereof. or any of their employees, makes any warranty,

expresed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of

such use, of any information, apparatus, product or process disclosed in this report, or represents that its use

by such third party would not infringe privately owned rights.
NUREG/CR-4840

SAND88-3102

Procedures for the External

Event Core Damage Frequency

Analyses for NUREG-1150

Manuscript Completed: October 1990

Date Published: November 1990

Prepared by

M. P. Bohn, J. A. Lambright

Sandia National Laboratories

Albuquerque, NM 87185

Prepared for

Division of Systems Research

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555

NRC FIN A1384

ABSTRACT

This report presents methods which can be used to perform the assessment

of risk due to external events at nuclear power plants. These methods

were used to perform the external events risk assessments for the Surry

and Peach Bottom nuclear power plants as part of the NRC-sponsored NUREG1150 risk assessments.

These methods apply to the full range of hazards such as earthquakes,

fires, floods, etc. which are collectively known as external events. The

methods described in this report have been developed under NRC

sponsorship and represent, in many cases, both advancements and simplifications over techniques that have been used in past years. They also

include the most up-to-date data bases on equipment seismic fragilities,

fire occurrence frequencies and fire damageability thresholds.

The methods described here are based on making full utilization of the

power plant systems logic models developed in the internal events

analyses. By making full use of the internal events models one obtains

an external event analysis that is consistent both in nomenclature and in

level of detail with the internal events analyses, and in addition,

automatically includes all the appropriate random and tests/maintenance

unavailabilities as appropriate.

Hallmarks of the methods described here include, first, the use of

extensive computer-aided screening prior to the detailed analysis of each

external event hazard to which the plant might conceivably be exposed.

These screening procedures identify those external events which could

contribute to the risk at the plant and thus, significantly reduce the

number of events for which subsequent detailed analysis is required.

Both qualitative and quantitative screening steps are applied

sequentially. Secondly, for the detailed analysis of fires, floods and

other location-dependent scenarios, critical area analysis techniques

(heavily dependent on computer analyses) are utilized to identify those

areas within the plant for which such events could have a risk

significant impact on the plant. Experience has shown that the use of

such critical area analysis techniques drastically reduces the number of

areas which must be considered.

Taken together, these techniques provide a relatively straightforward

and, in some cases, simplified set of techniques for the analysis of the

full range of external events and provides for both scrutability and

reproducibility of the final results. Furthermore, these techniques have

been applied to a number of power plants in a considerably reduced

timeframe as compared with external event analyses performed in the past.

-iii/iv-

TABLE OF CONTENTS

Section Page

ABSTRACT iii/iv

EXECUTIVE SUMMARY xiv

1.0 INTRODUCTION 1-1

1.1 Scope 1-1

1.2 Overview of Procedures and Bases for

Simplifications 1-1

1.3 References 1-5

2.0 PLANT VISITS AND EXTERNAL EVENT SCREENING ANALYSES 2-1

2.1 The Plant Visits 2-1

2.2 Screening of Other External Events 2-9

2.3 References 2-10

3.0 SEISMIC ASSESSMENT PROCEDURES 3-1

3.1 Overview of Seismic PRA Procedures 3-2

3.2 Determine the Earthquake Hazard 3-5

3.2.1 General Considerations 3-8

3.2.2 Procedures for Developing Hazard Curves

and Spectra 3-8

3.3 Identify Accident Scenarios 3-12

3.3.1 Procedures for Initiating Events 3-12

3.3.2 Seismic Accident Sequences (Event Trees) 3-17

3.4 Seismic Failure Modes of Safety Systems (Fault Trees) 3-20

3.4.1 General Considerations 3-20

3.4.2 Procedures for Seismic Fault Trees 3-20

3.5 Seismic Response of Structures and Components 3-22

3.5.1 Response Calculation Methods Used in Past PRAs 3-22

3.5.2 Procedures for Determining Responses 3-23

3.6 Fragility Analysis 3-27

3.6.1 Procedures for Fragilities 3-27

3.6.2 Special Fragility Issues 3-32

3.7 Seismic Core Damage Frequency Computations 3-34
TABLE OF CONTENTS (Continued)

Section fage

3.7.1 Quantitative Screening for Dominant

Accident Sequences 3-34

3.7.2 Accident Sequence Quantification 3-35

3.7.3 Presentation of Results 3-42

3.8 Summary 3-43

3.9 References 3-44

4.0 FIRE ASSESSMENT PROCEDURES 4-1

4.1 Identification of Relevant Fire Zones 4-2

4.2 Initiating Event Frequencies 4-3

4.3 Determination of Fire-Induced "Off-Normal" Plant States 4-6

4.4 Detailed Description of the Screening Analysis 4-6

4.5 Fire Propagation Modeling 4-8

4.6 Barrier Failure Analysis 4-14

4.7 Recovery Analysis 4-14

4.8 Uncertainty Analysis 4-16

4.9 Conclusion 4-19

4.10 References 4-21

Appendix A Fire Event Data Tables A-1

-vi-
LIST OF FIGURES

Figpure Page

3.1 Example Seismic Hazard Curve 3-6

3.2 Example of Site Ground Motion Spectra 3-7

3.3 LLNL Surry Hazard Curve 3-10

3.4 EPRI Surry Hazard Curve 3-11

3.5 Surry Primary Coolant System Layout 3-14

3.6 Distributions of Pipe Failures Causing KLOCA and

SLOCA Developed From SSRMP Piping Calculations 3-16

3.7 Initiating Event Hierarchy Tree 3-18

3.8 The Powers nz, n3 , and n 4 as a Function of the

Correlation Coefficient 3-39

4.1 Fire Zone Geometry Considered in the COMPBRN Code 4-9

-vii-
LIST OF TABLES

Table Page

1.1 List of External Events 1-4

2.1 Items to Examine During Plant Visit 2-2

2.2 Data Required for External Event Core Damage Frequency

Assessments 2-8

3.1 Rules for Assigning Response Correlation PRMR 3-28

3.2 Generic Component Categories 3-30

3.3 Generic Component Fragilities 3-31

4.1 Statistical Evidence of Fires in LWRs 4-4

4.2 Modified COMPBRN III Input Parameters 4-12

4.3 Approximate Number of Barriers at a Plant 4-15

4.4 Estimates of Single Barrier Failure Rate 4-15

4.5 Automatic Suppression System Failure Rates (On Demand) 4-17

-viii-
FOREWORD

This is one of numerous documents that support the preparation of the

NUREG-1150 document by the NRC Office of Nuclear Regulatory Research.

Figure 1 illustrates the front-end documentation. There are three

interfacing programs performing this work: the Accident Sequence

Evaluation Program (ASEP), the Severe Accident Risk Reduction Program

(SARRP), and the Phenomenology and Risk Uncertainty Evaluation Program

(PRUEP). The Zion PRA was performed at the Idaho National Engineering

Laboratory and at Brookhaven National Laboratory.

Table 1 is a list of the original primary documentation and the

corresponding revised documentation. There are several items that should

be noted. First, in the original NUREG/CR-4550 report, Volume 2 was to

be a summary of the internal analyses. This report was deleted. In

Revision 1, Volume 2 now is the expert judgment elicitation covering all

plants. Volumes 3 and 4 include external events analyses for Surry and

Peach Bottom, respectively.

The revised NUREG/CR-4551 covers the analysis included in the original

NUREG/CR-4551 and NUREG/CR-4700. However, it is different from NUREG/CR4550 in that the results from the expert judgment elicitation are given

in four parts to Volume 2 with each part covering one category of issues.

The accident progression event trees are given in the appendices for each

of the plant analyses.

Originally, NUREG/CR-4550 was published without the designation "Draft

for Comment." Thus, the final revision of NUREG/CR-4550 is designated

Revision 1. The label Revision 1 is used consistently on all volumes

except Volume 2, which was not part of the original documentation.

NUREG/CR-4551 was originally published as a "Draft for Comment" so, in

its final form, no Revision 1 designator is required to distinguish it

from the previous documentatation.

There are several other reports published in association with NUREG-1150.

These are:

NUREG/CR-5032, SAND87-2428, Modeling Time to Recovery and Initiating

Event Frequency for Loss of Off-site Power Incidents at Nuclear Power

Plants, R. L. Iman and S. C. Hora, Sandia National Laboratories,

Albuquerque, NH, January 1988.

NUREG/CR-4840, SAND88-3102, Procedures for External Event Core Damage

Freouency Analyses for NUREG-1150, M. P. Bohn and J. A. Lambright,

Sandia National Laboratories, Albuquerque, NM, November 1990.

-ix-
SUPPORT DOCUMENTS TO NUREG - 1150

PEACH GRAND

SURRY BOTTOM SEQUOYAH GULF ZION

VoLtI Vol. 2 Vol.3 Vol. 4 VoL 5 VoL.6 VoL 7

ol od61 A

x

0p

0

0

la

09

%ft

0

z

49

W6

Q.,

a

IW

0

If.

U)

a

Wz.

W

CD 0

uWW

CC-C

lB

ujw >0~. iu

0.

4j

i J1

w -c

AwWus

al

a.

qc

Wi

cc

0.

CA

ai

W

x

2l

w

U)

t

ý oor

ti

2'

I a

121WI,

4

0

d A A A A A

z

0

44

0

/ / J I

/ L/ 0Z ~1

CORE DAMAGE FREWUENCY

NUREG/CR-4550, REVISION 1

EVALUATION OF SEVERE

ACCIDENT RISKS

NUREG/CR-4551

FIGURE 1. DOCUMENTATION FOR NUREG-1150.
Table 1.

IUREC-1ISO Analysis Docume.ntation

Original DotVetatlon

YMM/CaC-6550

Analysis of Core Dmgeg Frequency

From Internal Events

MUEC/CR-4551

Evaluation of Severe Accident

Risks and the Potential for

Risk Reduction

URC/fCR-4700

Containment Event Analysis

for Potential Severe Accidents

Volume 1 Surry Unit 1

2 Sequoyah Unit 1

3 Peach Bottom Unit 2

4 Grand Gulf Unit I

volume 1

2

3

4

5

6

7

Methodology

Sumery (Net Published)

Strry Unit I

Peach Bottom Unit 2

Sequeyah Unit I

Crand Gulf Unit 1

Zion Unit I

Volme 1

2

3

4

5

Surry Unit I

Sequoyah Unit I

Peach Bottom Unit 2

Crand Gulf Unit I

Zion Unit I

•, A IURtZoCR455O, Revision I

i Analysis .f Core Ding. Frequency NURfl/CR-4551, Evaluation

of Severe Accident Risks

Volmm 1 Methodology

2 Part I Expert Judgment Elicit. Expert Panel

Part 2 Expert Judgment Elicit.--Project Staff

3 Part I Surry Unit I Internal Events

Part 2 Surry Unit I Internal Events App.

Part 3 Surry Unit 1 External Events

4 Part I Peach Bottom Unit 2 Internal Events

Part 2 Peach Bottom Unit 2 Internal Events App.

Part 3 Peach Bottom Unit 2 External Events

5 Part I Sequeoyh Unit I Internal Events

Part 2 Sequeyah Unit 1 Internal Events App.

6 Part I Grand Gulf Unit I Internal Events

Part 2 Grand Gulf Unit 1 Internal Events App.

7 Zion Unit 1 Internal Events

Volume 1

2

Methodology

Part I Expert Judgment

Part 2 Expert Judgment

Part 3 Expert Judgment

Part 4 Expert Judgment

Part 5 Expert Judgment

Part 6 Expert Judgment

Part 7 Expert Judgment

Part 8 Expert Judgment

Ellett..-In-vessel

Elicit. .-Contatuen

Elicit.--Structurai

Elicit.--Seorce-Term

zlicit.--Supp. Cale.

Eiicit.--ProJ. Staff Elicit.--.Supp. Calc.

tliclt.--MACCS Input

3 Part

Part

4 Part

Part

5 Part

Part

6 Part

Part

7 Part

Part

i

2

1

2

1

2

1

2

1

2

Surry Unit 1 Anal. and Results

Surry Unit I Appendices

Peach Bottom Unit 2 Anal. and Results

Peach Bottom Unit 2 Appendices

Soquoyah Unit 2 Anal. and Results

Sequoyah Unit 2 Appendices

Graid Culf Unit I Anal. and Results

Grand Culf Unit I Appendices

Zion Unit I Anal. and Results

Zion Unit I Appendices
NUREG/CR-4772, SAND86-1996, Accident Sequence Evaluation Program Human

Reliability Analysis Procedure. A, D. Swain III, Sandia National

Laboratories, Albuquerque, NM, February 1987.

NUREG/CR-5263, SAND88-3100, The Risk Management Implications of NUREG1150 Methods and Results., A. C. Camp et al., Sandia National

Laboratories, Albuquerque, NM, December 1988.

A Human Reliability Analysis for the ATWS Accident Sequence with MSIV

Closure at the Peach Bottom Atomic Power Station, A-3272, W. J. Luckas,

Jr. et al., Brookhaven National Laboratory, Upton, NY, 1986.

Any related supporting documents to the back-end NUREG/CR-4551 analyses

are delineated in NUREG/CR-4551. A complete list of the revised NUREG/CR4550, volumes and parts is given below.

General

NUREG/CR-4550, Volume 1, Revision 1, SAND86-2084, Analysis of Core

Damage Frequency: Methodology Guidelines for Internal Events,

NUREG/CR-4550, Volume 2, SAND86-2084, Analysis of Core Damage Frequency

from Internal Events: Expert Judgment Elicitation on Internal Events

Issues - Part 1: Expert Panel Results, Part 2: Project Staff Results,

Part 1 and 2 of Volume 2, NUREG/CR-4550 are bound together. This volume

was not part of the original documentation and was first published in

April 1989 and distributed in May 1989 with the title: Analysis of Core

Damage Frequency from Internal Events: Expert Judgment Elicitation. In

retrospect, a more descriptive title would be: Analysis of Core Damage

Frequency: Expert Judgment Elicitation on Internal Events Issues.

SUR

NUREG/CR-4550, Volume 3, Revision 1, Part 1, SAND86-2084, Analysis of

Core Damage Frequency: Surry Unit I Internal Events,

NUREG/CR-4550, Volume 3, Revision 1, Part 2, SAND86-2084, Analysis of

Core Damage Frequency: Surry Unit I Internal Events Appendices,

NUREG/CR-4550, Volume 3, Revision 1, Part 3, SAND86-2084, Analysis of

Core Damage Frequency: Surry Unit 1 External Events,

xii
Peach Bottom

NUREG/CR-4697, EGG-2464, Containment Venting Analysis for the Peach

Bottom Atomic Power Station., D. J. Hansen et al., Idaho National

Engineering Laboratory (EG&G Idaho, Inc.) February 1987.

NUREG/CR-4550, Volume 4, Revision 1, Part 1, SAND86-2084, Analysis of

Core Damage Frequency: Peach Bottom Unit 2 Internal Events.

NUREG/CR-4550, Volume 4, Revision 1, Part 2, SAND86-2084, Analysis of

Core Damage Frequency: Peach Bottom Unit 2 Internal Events Appendices.

NUREG/CR-4550, Volume 4, Revision 1, Part 3, SAND86-2084, Analysis of

Core Damage Frequency: Peach Bottom Unit 2 External Events.

Seguoyah

NUREG/CR-4550, Volume 5, Revision 1, Part 1, SAND86-2084, Analysis of

Core Damage Frequency: Seguoyah Unit 1 Internal Events.

NUREG/CR-4550, Volume 5, Revision 1, Part 2, SAND86-2084, Analysis of

Core Damage Frequency: Secuoyah Unit 1 Internal Events Appendices.

Grand Gulf

NUREG/CR-4550, Volume 6, Revision 1, Part 1, SAND86-2084, Analysis of

Core Damage Frequency: Grand Gulf Unit 1 Internal Events.

NUREG/CR-4550, Volume 6, Revision 1, Part 2, SAND86-2084, Analysis of

Core Damage Frequency: Grand Gulf Unit I Internal Events Appendices.

Zion

NUREG/CR-4550, Volume 7, Revision 1, EGG-2554, Analysis of Core Damage

Freguency: Zion Unit I Internal Events.

xiii
EXECUTIVE SUMMARY

The U.S. Nuclear Regulatory Commission (NRC) is sponsoring probabilistic

risk assessments (PRAs) of five operating commercial nuclear power plants

as part of a major update of the understanding of risk as provided by the

original WASH-1400 risk assessments (Ref. 1). Collectively, the five

risk assessments are known as the NUREG-1150 risk assessments (Ref. 2).

In contrast to the WASH-1400 studies, at least two of the NUREG-1150 risk

assessments have included a detailed analysis of risks due to

earthquakes, fires, floods etc. which are collectively known as "external

events." This report summarizes the methods used in the external event

analyses for NUREG-1150, and presents these methods in terms of

recommendations for future applications.

The two NUREG-1150 plants for which external events have been considered

(to date) are Surry and Peach Bottom, a pressurized water reactor (PWR)

and boiling water reactor (BWR), respectively. The external event

analyses (through core damage frequency calculations) for these two

plants were performed using the methods in this report.

In keeping with the philosophy of the internal events analyses for NUREG1150, which are intended to be "smart" PRAs making full use of all

insights gained during the past ten years developments in risk assessment

methodologies, the corresponding external event analyses were also

performed by newly developed methods. These methods have been developed

at Sandia National Laboratories (SNL) under the sponsorship of the NRC's

Office of Nuclear Regulatory Research as part of their Dependent Failure

Methodology Development Program. The first application of these new

methods was in the seismic analyses of six power plants as part of the

NRC's program for the resolution of Unresolved Safety Issue A-45,

Adequacy of Decay Heat Removal Systems (Ref. 3). Extension of these

methods to fire, flood, etc. has been continuing during the past two

years.

In contrast to most past external event analyses, wherein rudimentary

systems models were developed reflecting each external event under

consideration, the NUREG-1150 analyses are based on the availability of

the full internal event PRA systems models (event trees and fault trees)

and make use of extensive computer-aided screening to reduce them to the

accident sequence cut sets important to each external event. This

provides two major advantages in that consistency and scrutability with

respect to the internal events analysis is achieved, and the full gamut

of random and test/maintenance unavailabilities are automatically

included, while only those probabilistically important survive the

screening process. Thus, full benefit of the internal event analysis is

obtained by performing the internal and external event analyses

sequentially.

Each external event analysis begins with a review of the Final Safety

Analysis Report (FSAR), related design documents and the plant safety

systems descriptions in the internal events PRA documentation. Physical

locations of important components are determined from the general

arrangement drawings. The plant fire protection Appendix R submittals

-xiv-
form the basis for the initial identification of fire and flood zone

boundaries and barriers. Shortly thereafter, a plant visit of 2 to 3

days duration is made involving an integrated team of six to eight

specialists in the various external events and at least one systems

analyst from the internal events PRA team.

The initial step in the external events analysis consists of a screening

analysis of essentially all external events to which the plant could

conceivably be exposed. Many hazards can be excluded from further

analysis by virtue of their inapplicability to the site in question.

Others can be excluded from consideration based on the fact that these

events are a subset of more general events already considered (and

excluded) in the plant design safety analysis events as documented in the

plant FSAR. Finally, a number of the remaining events can usually be

excluded based on simple quantitative screening arguments (often based on

the frequency of the hazard itself) which demonstrate that the event in

question could contribute an increment to core damage frequency

substantially less than that already computed for the internal events

analysis for the plant. The use of these screening techniques reduces

the number of events which must be considered subsequently. In general,

both fire and seismic events would always be considered for any plant.

Other events are included only if they cannot be screened from further

consideration.

The seismic assessment is the critical path item due to the time required

to assemble the structural drawings and models. To determine the

important buildings' responses to an earthquake, a best estimate

structural dynamic response calculation is made by coupling design beamelement models with a realistic model of the underlying soil column and

using a soil-structure interaction code. The result is statistical

distributions for floor slab accelerations, and estimates of variability

and correlations. Component fragilities are obtained either from a

generic data base or derived on a plant-specific basis as determined on

the initial plant walkdown. A generalized probabilistic screening method

is used to determine important cut sets while allowing for explicit

incorporation of correlation. The seismic hazard is obtained from the

results of two extensive seismic hazard characterization studies, one

sponsored by the NRC and the other by the Electric Power Research

Institute (EPRI). The hazard curve family, the seismic responses and the

seismic fragilities are then combined and utilized with a Monte Carlo

analysis to obtain mean frequencies of the accident sequences and core

damage as well as uncertainties associated with these mean frequencies.

The fire and internal flooding analysis tasks proceed in a parallel

fashion. Fire initiator frequencies are obtained from a historical fire

occurrence data base developed at Sandia National Laboratories.

Partitioning of building fire frequencies down to sub-area frequencies is

based on cable loading, electrical cabinet distributions and transient

combustible estimates based on walkdown observations and a transient

-xv-
combustible data base developed at SNL. Component damage temperatures

(rather than auto-ignition temperatures) are based on SNL fire tests. A

compartment fire growth code is used to predict component temperatures in

fire areas where fire growth and equipment separation are important

considerations. Critical area analyses using the SETS code provides

accident sequence cut sets for quantification, including barrier failure

and random failures as appropriate. A fire detection/ suppression

histogram developed at SNL is used to incorporate fire fighting timing

into the analysis.

Similar approaches are used for internal and external floods, tornadoes,

winds, etc. A major economy is achieved by analyzing fire and flood

events together and seismic, wind and tornado events together due to the

commonality of the analysis processes. For example, it is a minor task

to extend the seismic fragility derivations to be applicable to wind

fragilities. Similar economies arise in the screening steps for fire and

flood.

Taken together, the methods presented in this report present a

straightforward and often simplified approach to the analysis of external

events. The methods described enhance both the scrutability and

reproducibility of each individual analysis. Further, the manner of

displaying the results lends itself to enabling the reader to reproduce

point estimate calculations and hence, understand both the input to the

analysis as well as important aspects which lead to the final result.

Finally, since these techniques are based on the internal events system

analysis models, the results are consistent both in form and nomenclature

with the internal events analysis and hence, the accident scenario

results can be compared with those from the internal events analysis in a

relatively simple fashion. Finally experience has shown that these

techniques can be applied at a considerable savings in time and cost over

similar analyses performed in the past.

-xvi-
References

1. U.S. Nuclear Regulatory Commission, Reactor Safety Study: An

Assessment of Accident Risks in U.S. Nuclear Power Plants, WASH-1400,

NUREG-75/014, 1975.

2. U.S. Nuclear Regulatory Commission, Severe Accident Risks: An

Assessment for Five U.S, Nuclear Power Plants, NUREG-1150, June 1989.

3. Ericson, D. M., et al, Shutdown Decay Heat Removal Analysis: Plant

Case Studies and Special Issues, NUREG/CR-5230, April 1989.

-xvii-

1.0 INTRODUCTION

1. 1 Scone

This report summarizes the procedures used in performing external event

core damage frequency (CDF) analyses for two commercial nuclear power

plants (Surry and Peach Bottom) as part of the NRC-sponsored Accident

Sequence Evaluation Program power plant risk reevaluations, often

referred to as the NUREG-1150 program (after the principal document

summarizing the results of the program). In this program, both internal

and external events risk analyses are being performed. Although these

risk assessments are intended to be complete and to capture the large

majority of plant risk, the NUREC-1150 PRAs are intended to be "smart"

PRAs making full use of past experience, generic data bases and other

defensible simplifications to the maximum extent possible. However, a

number of the analysis procedures described herein represent improvements

in the state-of-the-art and result in enhanced defendability of the

results even though the actual computational procedures have been

simplified. This report describes the procedures and data bases used for

performing such external event core damage frequency analyses.

Besides simplification in terms of cost reduction and minimization of

execution time, the procedures presented here also meet the following

additional objectives, i.e. , the simplified external event CDF

assessments are:

a. Consistent with internal event failure analyses: The same event

trees/fault trees and random failure data will be used.

b. Transparent: A standard report format should enable the reader

to reproduce most of the results.

c. Realistic: Best estimate data and models will be used as much

as possible. All important plant specific failure modes will be

analyzed.

Experience has shown that, given the availability of appropriate risk

assessment personnel and cooperation of the plant owner/utility, these

analyses can be completed in eight to twelve calendar months per plant.

The methodology presented here is suitable for a wide range of nuclear

safety applications, and is currently being applied to the resolution of

several generic unresolved safety issues as part of on-going NRC

programs.

1.2 Overview of Procedures and Bases for Simplifications

The procedures described in this report are based on the following

general concepts:

1-i
a. The external event analyses are based on the internal event CDF

assessment plant system models and fault trees, and (other than

preliminary data gathering) should not be started until the

internal events systems analysis (event trees and fault trees)

has been finalized.

b. A systematic screening of the full range of external events to

which the plant could conceiveably be exposed (e.g., aircraft

crash, external flooding, tornado, extreme wind, etc.) is

performed early in the process to eliminate all unimportant

hazards.

c. A simultaneous and coordinated evaluation of all (nonnegligible) external events is performed to minimize data

gathering efforts and prevent duplication of effort. Also,

simultaneous evaluation produces insights into hazard

interactions (for example, seismic-fire interactions) not

otherwise readily available.

d. Computer-aided screening techniques and conservative failure

probabilities based on generic failure data are utilized prior

to any detailed component failure analysis calculations to

minimize overall effort without sacrificing accuracy.

After the screening analysis of all applicable site hazards has been

performed, the general steps in the CDF analysis of each remaining

external event are:

a. Determine the hazard non-exceedance frequency.

b. Model plant and systems.

c. Solve fault trees with screening techniques to determine nonnegligible accident sequences and cut sets.

d. Determine responses, fragilities, and correlation for each basic

event in the (non-negligible) cut sets.

e. Evaluate mean values and uncertainty distributions for all

accident sequence and core damage frequencies.

f. Perform sensitivity studies on contributors to CDF and to

uncertainty.

It is only the details of the individual steps that are different for the

different types of external events. They all have, in common, the

internal events plant safety system logic models. These logic models are

then specialized to each applicable hazard using computer-aided

techniques. However, the general analysis procedure is the same for any

individual event.

1-2
Table 1.1 presents a list of the external hazards which are considered

for each site. Past PRA experience shows that only a very few of these

are significant contributors to risk at any particular plant. In fact,

all past PRAs show that the seismic and fire events are far and away the

most important external event risk contributors. In addition, internal

or external flooding, tornado or aircraft crashes are infrequent (and

less significant) contributors. Detailed descriptions of the initial

screening procedures have already been presented in an earlier report

(Ref. i). Application of these procedures to the Surry and Peach Bottom

plants are given in References 2 and 3.

This report focuses on the fire and seismic procedures, for it is these

events for which significant advances and simplifications have been

made. If one of the "other" external events is found to be nonnegligible, its effect is typically not pervasive and its impact easily

modeled. In fact, the main difficulty for these "other" events is

estimating the associated hazard, which is primarily a site-specific data

gathering task. Detailed descriptions of procedures for such "other"

events as flooding, tornadoes, etc., have been previously presented in

the PRA Procedures Guide (Ref. 4). No significant simplifications were

identified for the analysis of these events. Thus, it is fire and

seismic methods which are the primary focus of this report. Furthermore,

since good descriptions of the basic methodologies used in past seismic

and fire PRAs are already available in existing documents (Refs. 4 and

5), this report focusses on the improvements and simplifications which

have been developed for the seismic and fire methods, and does not

attempt a tutorial presentation.

1-3
Table 1. 1

List of External Events

Maior PRA Consideration

Seismic

Fire

Internal Flood

Minor PRA Consideration

Lightning

Low Lake/River Level

Ice Cover

Avalanche

Forest Fire

Industrial Facility Accident

Landslide

Meteorite

Volcanic Activity

Hail

Occasional PRA Consideration

External flood

Transportation accidents

Pipe line accidents

Aircraft Impact

Extreme Winds

Tornado

1-4
1.3 References

1. Ravindra, M. K. and Banon, H., Methods for External Event Screening

Quantification, NUREG/CR-4839, August 1990.

2. Bohn, M. P., et al., Analysis of Core Damage Frequency: Surry Power

Station External Events, NUREG/CR-4550, Volume 3, Revision 1, Part 3,

December 1990.

3. Lambright, J. A., et al., Analysis of Core Damage Frequency: Peach

Bottom Unit 2 External Events, NUREG/CR-4550, Volume 4, Revision I,

Part 3, December 1990.

4. U.S. Nuclear Regulatory Commission, PRA Procedures Guide, NUREG/CR2330, January, 1983.

5. Bohn, M. P., et al., Application of the SSMRP Methodology to the

Seismic Risk at the Zion Nuclear Power Plant, Lawrence Livermore

National Laboratory, Livermore, CA., NUREG/CR-3428, 1983.

1-5

2.0 PLANT VISITS AND EXTERNAL EVENT. SCREENING ANALYSES

As described in Chapter 1, a significant amount of effort is saved by

performing a systematic and vigorous screening analysis for all external

events which could potentially affect the plant. This screening is based

on data from the Final Safety Analysis Report and related documents,

historical data gathered for the site under consideration (aircraft

flight frequencies, flood occurrences, etc.) and on a detailed walk-down

of the plant and its surroundings. These aspects are described below.

2.1 The Plant Visits

In general, a minimum of four plant visits are required. The initial

visit, involving the full team of analysts, should take place as early as

possible, for it serves as the basis for the initial plant information

request submittal and the initial hazard screening process. Prior to the

first plant visit, the external events team should be briefed by the

internal events systems analysts as to the general character of safety

systems, support systems, system success criteria and critical

interdependencies identified to date. In addition, applicable FSAR

sections should be reviewed, and a basic set of plant general arrangement

drawings should be available to each team member.

Ideally, the team would consist of the following personnel:

Team Leader - PRA Project Manager

Seismic Component Fragility Analyst

Seismic Structural Fragility Analyst

Fire PRA Analyst

Flood PRA Analyst

External Event Screening Analyst

Internal Events Systems Analyst

Experience has shown that fewer team members cannot effectively assimilate the information which must be obtained on the initial visit. In

addition, data questionnaires, standard data sheets and a flash camera

(requiring advance plant notification) are essential. For example, a list

of seismic aspects which have often been found to be risk contributors in

past seismic PRAs is shown in Table 2.1. Examples of fire and flood data

recording sheets are given in Figure 2.1. Tape measures, flash- lights,

small rule (for scale in photographs) and a thin, flexible metal rule for

checking cabinet anchorage are all necessary and should be available.

The initial walkdown would visit all areas containing safety or essential

support equipment. (For these simplified analyses, an in-containment

walkdown is usually not possible.) In our experience, two full days are

adequate for this initial visit. At the completion of this initial

visit, the following should have been obtained:

a. A list of components suspected of being vulnerable to seismic

damage and requiring site-specific fragility analysis.

b. A list of potential secondary seismic structural failures

(masonry walls, etc.) and components with the potential to be

damaged by these secondary failures.

2-1
Table 2. 1

Items to Examine During Plant Visit Based On

Common Vulnerabilities Found in Past Seismic PRAs

1. Look for masonry block walls near critical equipment, e.g., battery

room enclosures, in diesel generator rooms, near AFWS pumps, etc.

2. Examine switchgear and motor control centers (especially 4160 V

emergency switchgear). Are anchorages to floor (welds or bolts)

adequate? Are adjacent cabinets tied together so they would not

"hammer" each other during an earthquake. Is there sufficient slack

in cables exiting the cabinet?

3. Look for suspended ceilings or hanging light fixtures in the control

room or other critical areas which might fall in an earthquake.

4. Examine pipe runs between buildings (especially between auxiliary

and reactor buildings in PWRs). Estimate span length between

nearest anchors in each building. Could relative motion between

buildings cause large strains in pipes?

5. Examine battery racks and batteries. Check for proper bolting to

floor and walls, adequacy of rack configuration and presence of

spacers between batteries.

6. Examine important AOV's to see that sufficient slack exists in air

lines and that air tanks are properly bolted down. Could valves or

operators impact against adjacent pipes, walls, etc?

7. Examine important MOV's for support of motor operators. Are

electrical cables sufficiently slack? Could valves or operators

impact against adjacent pipes, walls, etc.

8. Examine cable trays. At penetrations through walls, could cables

shear if trays shift? Are floor supports adequate? Are hangers and

bolts or embedded anchors adequate?

9. Examine motor-driven safety-related pumps. Are floor anchorages

adequate? Is there slack in feed lines and electrical cables. Are

ancillary lube oil pumps and oil tanks tied down?

10. Examine condensate storage tank(s) and refuelling water storage

tank. Are they adequately bolted to concrete pad. Are other

(secondary) storage tanks (e.g., demineralized water tank, pretreated water tank, etc.) bolted down? Is outlet pipe from CST or

RWST anchored so relative motion of tank could cause large strain?

Could outlet pipes fail at the building penetration due to relative

motion?

2-2
Equipment Summary

Area Bldg. El.

Equipment Description Location and Evaluation

Off Floor

Switchgear (4.16 KV/480 VAC)

Spray Protected?

Likely to be sprayed?

Penetrations sealed?

Motor Control Center

Motor-operated valve

125/250 VDC Bus

Battery

PUMP

Fan

Cables/

Junction/Boxes

Fire Detectors

Flood Alarms

Sump Pumps

Fire Suppression Systems

Automatic, manual?

Figure 2.1. Sample Fire/Flood Data Recording Sheets (1 of 4)
Flood Water Sources

Area Bldg El.

Flood Hi/Low Orifices or

Sources System Size Pressure Isolation Valves (#) Description

PiTes

Tanks

Figure 2.1. Sample Fire/Flood Data Recording Sheets (2 of 4)
Fire Combustibles

Area Bldg El.

Fire Fixed

Sources or Transient Location Combustible Loading Description

'I

Figure 2.1. Sample Fire/Flood Data Recording Sheets (3 of 4)
Area Penetrations

Area Bldg. El.

Adjacent Floor North East South West Areas

Pipe/Cable/Dampers Drains/ Pipe/Cable/Dampers Door Pipe/Cable/Dampers Door Pipe/Cable/Dampers Door Pipe/Cable/Dampers Door El. Openings El. Nos. El. Nos. El. Non. El. Nos

tN

I

ON

Doors

(a) watertight?

(b) alarmed?

(c) raised sill?

(d) non-watertight-gap?

Penetrations

(a) sealed?

(b) unsealed

Drains

(a) check valve or anti-siphon device?

(b) number, size, location?

Figure 2.1. Sample Fire Flood Data Recording Sheets (4 of 4)
c. A copy of the civil/structural drawing index for the plant

(usually a 10 to 20 page list) from which needed drawings may be

identified.

d. Sketches of typical anchorage details for important tanks, heat

exchanges, electrical cabinets, etc.

e. A visual evaluation of structural connectivity of floor slabs,

wall-to-ceiling connections, location of diaphragm cut-outs

etc., which define load carrying paths. (These are to be

compared with structural drawings later.)

f. For each room or compartment containing essential safety

equipment, an identification of fire sources (power cables,

pumps, solvents etc.), locations of fire barriers, fire/smoke

detectors, separation of cable trains etc. and a list of

equipment in the room.

g. For each room or compartment, an identification of flooding

sources (tanks, high or low pressure piping), floor drains,

sumps, flood walls, flood detectors etc.

h. A brief list of key plant personnel or utility

engineering/licensing personnel to be contacted later if

specific questions arise.

As soon as possible following the initial plant visit, a list of needed

drawings and documentation should be prepared and sent to the designated

NRC or plant contact. A list of the information typically required is

shown in Table 2.2. (Note that no emergency procedures guidelines,

technical specifications, maintenance procedures, or maintenance request

data are shown on this table, as this information is used primarily by

the internal events analysts, and should already be available.)

At the end of the first month, a second visit by the external events

screening analyst is usually required. During this visit the analyst

resolves screening issues that have arisen during the preliminary

screening of all external event hazards. In addition, he gathers

further data required to aid in eliminating as many external events as

possible and also reviews the current configuration of the plant to

determine if any of the assumptions made in the FSAR have changed since

the plant began operation.

A visit to the plant by fire analysis personnel is later needed to allow

for cable path tracing or verification. This is usually not undertaken

until the preliminary fire screening analysis has been performed based on

a review of the plant fire protection Appendix R submittal.

Sometime around the fifth month, a final plant visit is made. During this

final visit, initial conclusions as to plant vulnerabilities

2-7
Table 2.2

Data Required for External Event Assessments

Systems

FSAR and amendments

Fire Protection Appendix R Submittal

General arrangement drawings

Licensee event reports

PRAs performed on plant or plant systems, including

random event fault trees

System descriptions (of type found in plant/operator

training manuals)

Equipment lists

Fire Brigade Procedures

Site Soil Conditions

Geologic data on site

Soil configurations

Boring information

Ground water data

Static and dynamic soil properties

" Laboratory tests

* In-situ field test results

Structures

Results of dynamic seismic analysis

Dynamic design models

Structural drawings

Slab and wall geometries & reinforcement schedules

Masonry wall specifications

Steel detailing drawings

Beam/column schedules

Containment wall geometry

Concrete cylinder test results

Re-bar test results

Field-erected tank (vendor) drawings civil drawings

showing foundation, ring girder and anchor bolt details

Equipment

Safety-Related Components List (Location and Qualification Basis)

Power and Control Cable Routing Diagrams

Ventilation Layout Drawings

Fire Protection System Component Descriptions

2-8
are reviewed with plant personnel, assumptions verified and any final

data required should be obtained. Again, a two-day visit is usually

adequate.

2.2 Screening of Other External Events

As mentioned in Section 1.2, the full range of possible external events

is considered, but based on the FSAR and the initial plant visit, the

vast majority can usually be shown to make negligible contributions to

risk. General criteria for screening the various hazards have been

given in the PRA Procedures Guide (Ref. 1):

An external event is excluded if:

a. The event is of equal or lesser damage potential than the events

for which the plant has been designed. This requires an

evaluation of plant design bases in order to estimate the

resistance of plant structures and systems to a particular

external event. For example, it is shown by Kennedy, Blejwas

and Bennett (Ref. 2) that safety-related structures designed for

earthquake and tornado loadings in Zone 1 can safely withstand a

3.0 psi static pressure from explosions. Hence, if the PRA

analyst demonstrates that the overpressure resulting from

explosions at a source (e.g., railroad, highway or industrial

facility) cannot exceed 3 psi, these postulated explosions need

not be considered.

b. The event has a significantly lower mean frequency of occurrence

than other events with similar uncertainties and could not

result in worse consequences than those events. For example,

the PRA analyst may exclude an event whose mean frequency of

occurrence is less than some small fraction of those for other

events. In this case, the uncertainty in the frequency estimate

for the excluded event is judged by the PRA analyst as not

significantly influencing the total risk.

c. The event cannot occur close enough to the plant to affect it.

This is also a function of the magnitude of the event. Examples

of such events are landslides, volcanic eruptions and earthquake

fault ruptures.

d. The event is included in the definition of another event. For

example, storm surges and seiches are included in external

flooding; the release of toxic gases from sources external to

the plant is included in the effects of either pipeline

accidents, industrial or military facility accidents, or

transportation accidents.

These criteria are usually sufficient to exclude all but a few external

hazards. For those remaining, a simple bounding analysis will often

provide sufficient justification for exclusion. Procedures for these

screening analyses have been documented previously in this program as

given in Reference 3 and will not be repeated here. Detailed examples of

applications of these methods are given in References 4-6.

2-9
2.3 References

1. U.S. Nuclear Regulatory Commission, PRA Procedures Guide, NUREG/CR2300, January, 1983.

2. Kennedy, R. P. et al., Capacity of Nuclear Power Plant Structures to

Resist Blast Loading, NUREG/CR-2462, September 1983.

3. Ravindra, M. K. and Banon, H., Methods for External Event Screening

Quantification, NUREG/CR-4839, to be published.

4. Ravindra, M. K. and Banon, H., Analysis of the LaSalle Unit 2

Nuclear Power Plant: Risk Methods Integration and Evaluation Program

(RMIEP) Volume 7: External Event Scoping Quantification, NUREG/CR4832, August 1990.

5. Bohn, M. P., et al., Analysis of Core Damage Frequency: Surry Power

Station External Events, NUREG/CR-4550, Revision I/Volume 3,

December 1990.

6. Lambright, J. A., et al., Analysis of Core Damage Frequency: Peach

Bottom Unit 2 External Events, NUREG/CR-4550, Revision 1/Volume 3,

December 1990.

2-10
3.0 SEISMIC CORE DAMAGE FREQUENCY ASSESSMENT PROCEDURES

A seismic analysis must simultaneously consider all the interrelated

factors that determine the probability of radioactive release and

exposure to the public. These closely-coupled factors are:

a. The likelihood and magnitude of potential earthquakes.

b. The transfer of earthquake energy from the fault source to the

power plant site, a phenomenon that varies with the magnitude of

an earthquake.

c. The interaction between the soil underlying the power plant and

the structural response, a phenomenon that depends on the soil

composition under the plant and the location of the fault source

relative to the plant.

d. The coupling of responses between the power plant's buildings and

the massive reactor vessels, piping systems, and emergency safety

systems within.

e. The numerous accident scenarios which vary according to the types

of failures assumed and the success or failure of the engineered

safety features intended to mitigate the consequences of an

accident.

At some level of detail, all these aspects must be addressed in any

seismic PRA.

In general, a nuclear power plant is designed to ensure the survival of

all buildings and emergency safety systems in a design basis or a safe

shutdown earthquake. The assumptions underlying this design process are

deterministic and subject to considerable uncertainty. It is not

possible, for example, to accurately predict the worst earthquake that

will occur at a given site. Soil properties, mechanical properties of

buildings, and damping in buildings and internal structures also vary

significantly. To model and analyze the coupled phenomena that

contribute to the frequency of radioactive release, it is therefore

necessary to consider all significant sources of uncertainty as well as

all significant interactions. Total risk is then obtained by considering

the entire spectrum of possible earthquakes and integrating their

calculated consequences. This point underscores an important requirement

for a seismic PRA; the nuclear power plant must be examined in its

entirety, as a system.

A second important aspect which must be addressed is that, during an

earthquake, all parts of the plant are excited simultaneously. This

means that there may be significant correlation between component

failures, and hence, the redundancy of safety systems could be

compromised. For example, in order to force emergency core cooling water

into the reactor core following a pipe leak or break, certain valves must

3-1
open. To ensure reliability, two valves are located in parallel so that

should one fail to open, the second valve would provide the necessary

flow path. Since valve failure due to random causes (corrosion,

electrical defect, etc.) is an unlikely event, the provision of two

valves provides a high degree of reliability. However, during an

earthquake both valves would be shaken simultaneously, and there is a

high likelihood that both valves would be damaged if one is damaged.

Hence, the planned-for redundancy would be compromised. This "commoncause" failure possibility represents a potentially significant risk to

nuclear power plants during an earthquake.

Under NRC sponsorship, a detailed seismic risk assessment methodology was

developed in the Seismic Safety Margins Research program (SSMRP) as

described in Reference 1. That program culminated in a detailed

evaluation of the seismic risk at the Zion nuclear power station (Ref.

2). In this evaluation, the attempt was made to accurately compute the

responses of all walls and floor slabs in the Zion structures, all

moments in the important piping systems, accelerations of all important

valves, and the spectral accelerations at each safety system component

(pump, electrical bus, motor control center, etc.). Correlation between

the responses of all components was computed from the detailed dynamic

response calculations. All important safety and auxiliary systems

functions were analyzed, and fault trees were developed which traced

failure down to the individual component level. Event trees related the

system failures to accident sequences and radioactive release modes.

Using these detailed models and calculations, it was possible to evaluate

the seismic CDF at Zion in a level of detail not previously available,

and determine quantitatively the CDF importance of the components,

initiating events, and accident sequences. The methods used for and the

results obtained from the SSMRP seismic assessment for the Zion plant

form the basis for many of the simplifications used in the NUREG-1150

seismic PRA procedures described in this report.

3.1 Overview of Seismic PRA Procedures

There are seven steps required for calculating the seismic risk of core

damage at a nuclear power plant:

a. Determine the local earthquake hazard (hazard curve and site

spectra or suite of time histories).

b. Identify accident scenarios for the plant which lead to

radioactive release (initiating events and event trees).

c. Determine failure modes for the plant safety and support systems

(fault trees).

d. Determine fragilities (probabilistic failure criteria) for the

important structures and components.

e. Determine the responses (accelerations or forces) of all

structures and components (for each earthquake level).

3-2
f. Compute the mean values and probability distributions of the

accident sequence and the core damage frequencies using the

information from Steps 1 through 5.

g. Perform sensitivity studies to identify the dominant

contributors to seismic risk and the relative contributions of

the hazard curve, fragility and response uncertainties to the

overall uncertainty in core damage frequency.

Procedures for performing the seven steps of the seismic risk analysis

procedure are summarized below. More detailed descriptions and

references for each step are presented in following sections.

Step 1 - Seismic Hazard Characterization

a. For sites in the eastern and central United States, hazard curves

developed in the NRC sponsored Eastern United States Hazard

Characterization Program (Ref. 3) and the EPRI Sponsored Seismic

Hazard Methodology Program (Ref. 4) should be used.

b. For plants west of the Rocky Mountains, site-specific hazard curves

must be developed due to the high levels of seismic activity and the

influence of identifiable active faults. However, for existing

western U. S. commercial power plant sites, such hazard curves are

already available.

c. Site-specific ground motion spectra and time histories must be

developed for each site. These can be obtained by selecting an

ensemble of recorded earthquake time histories at similar sites and

computing a median spectra from these time histories.

Step 2 - Initiating Events and Event Trees

The seismic event trees should be taken directly from those developed for

the internal events analysis, with modifications to include any

seismically-induced systems level structural failures. Both loss of

coolant accidents (vessel rupture, large, medium and small LOCAs) and

transient events should be included. In general, two types of transients

should be considered; those in which the power conversion system (PCS) is

initially available (denoted T3 transients) and those in which the PCS is

failed as a direct consequence of the initiating event (denoted T,

transients).

The frequencies of vessel rupture (RPV) and large LOCA events can be

determined from the probability of failure of the major reactor coolant

system component supports. The medium and small LOCA initiating event

frequencies can be computed based on a statistical distribution of pipe

failures computed as part of the SSMRP program.

The probability of T, transients is based on the probability of loss of

offsite power (LOSP). This will always be the dominant cause of these

transients (for the majority of plants for which LOSP causes loss of main

3-3
feedwater). The probability of the T3 initiating event is computed from

the condition that the sum of all the initiating event probabilities

considered must be unity. The hypothesis is that, given an earthquake of

reasonable size, at least one of the initiating events will occur.

Step 3 - Fault Trees

The fault trees developed for the internal events analysis are used

directly although they require modification to include basic events with

seismic failure modes and re-solving the trees for pertinent cut sets to

be included in the seismic PRA calculations. In solving the fault trees

for the seismic cut sets, conservative basic event probabilities (based

on the seismic failure probabilities evaluated at a high earthquake peak

ground acceleration level combined with the random failure probabilities)

are used. Probabilistic culling is used in solving these trees in such a

way as to assure that important correlated cut sets (involving dependent

seismic failure modes) are not lost.

Step 4 - Component and Structure Failure Descriptions

Component seismic fragilities are obtained either from a generic

fragility data base or developed on a plant-specific basis for components

not fitting the generic component descriptions. Two sources of fragility

data are available.

The first is a data base of generic fragility functions for seismicallyinduced failures originally developed as part of the SSMRP (Ref. 5).

Fragility functions for the generic categories were developed based on a

combination of experimental data, design analysis reports, and an

extensive expert opinion survey. The experimental data utilized in

developing fragility curves were obtained from the results of component

manufacturer's qualification tests, independent testing lab failure data

and data obtained from an extensive U.S. Corps of Engineers testing

program. These data were statistically combined with the expert opinion

survey data to produce fragility curves for the generic component

categories.

A second useful source of fragility information is a compilation of sitespecific fragilities (Ref. 6) derived from past seismic PRAs prepared by

Lawrence Livermore National Laboratory (LLNL). By selecting a suite of

site-specific fragilities for any particular component, one can obtain an

estimate of a generic fragility for that component.

Finally, following the probabilistic screening of the seismic accident

sequences, plant specific fragilities are developed for components not

fitting in the generic data base categories as determined during the

plant visit. These are developed based either on analysis or an

extrapolation of the seismic equipment qualification tests.

Step 5 - Seismic Response of Structures and Components

Building and component seismic responses (floor slab spectral

accelerations as a function of acceleration) are computed at several peak

ground acceleration values on the hazard curve. Three basic aspects of

3-4
seismic response (best estimates, variability, and correlation) must be

estimated. SSMRP Zion analysis results and simplified methods studies

form the basis for assigning variability and correlation of responses.

For soil sites, SHAKE code calculations (Ref. 7) are performed to assess

the effect of the local soil column (in any) on the surface peak ground

acceleration and to develop strain-dependent soil properties as a

function of acceleration level. This permits an appropriate evaluation

of the effects of nonhomogeneous underlying soil conditions which can

strongly affect the building responses.

Building loads, accelerations and in-structure response spectra are

obtained from multiple time history analyses using the plant design

fixed-base beam element models for the structures combined with a bestestimate model of the soil column underlying the plant. Variability in

responses (floor slab spectral accelerations) can be assigned based on

the SSMRP results. Although any structural dynamic analysis code can be

used, the CLASSI code (Ref. 8) has been shown to be particularly

convenient for these calculations.

Step 6 - Accident Seguence and Core Damage Frequency Uncertainty Analysis

A simple and direct evaluation of accident sequence and core damage

frequencies using Monte Carlo sampling is recommended. This has proven

to be efficient and much more direct than other competing methods.

Step 7 - Sensitivity Studies

Sensitivity studies should be performed to determine the dominant

contributors to risk as well as dominant contributors to the uncertainty

in the final risk estimate. One-at-a-time calculations of risk reduction

potential for each component provides a measure of relative contribution

to the mean frequencies. Recalculation of the core damage frequency with

component modelling uncertainties set to zero provides a measure of the

relative contribution of each basic event to the total uncertainty in the

final result.

In the following, recommendations and their basis for each step above are

provided in more detail.

3.2 Determine the Earthquake Hazard

The earthquake hazard at a given power plant site is characterized by a

hazard curve and either a suite of earthquake time histories or a site

ground motion spectra. The hazard curve is a frequency plot which gives

the probability of exceedance (per year) of different peak ground

accelerations. Figure 3.1 shows a sample hazard curve. The ordinant of

this plot (for a given peak ground acceleration) gives the frequency (per

year) of the occurrance of one or more earthquakes having peak ground

acceleration greater than the abcissa. Figure 3.2 shows a typical site

ground motion response spectra which describes the relative frequency

content of the earthquake motions expected at the site, and also reflects

the influence of the local soil column and layering in modifying the

earthquake frequencies transmitted to the plant foundations.

3-5
10-1

I 0-3 Median hazard curve

10--

0 Lower bound

1 0 -7 - -.-

0 0.2 0.4 0.6 0.8

Rock outcrop acceleration (g)

Figure 3.1. Example Seismic Hazard Curve

3-6
X 100

a

C

14

'.4I

Frequency (Hz)

Figure 3.2 Example of Site Ground Motion Spectra

3-7
3.2.1 General Considerations

For a given site, the hazard curve is derived from a combination of

recorded earthquake data, estimated earthquake magnitudes of known events

for which no data are available, review of local geological

investigations, and use of expert judgment from seismologists and

geologists familiar with the region in question. The region around the

site (say within 100 km) is divided into zones, each zone having an

(assumed) uniform mean rate of earthquake occurrence. This mean

occurrence rate is determined from the historical record, as is the

distribution of earthquake magnitudes. Then, for the region under

consideration, an attenuation law is determined which relates the ground

acceleration at the site to the ground acceleration at the earthquake

source, as a function of the earthquake magnitude. The uncertainty in

the attenuation law is specified by the standard deviation of the data

(from which the law was derived) about the mean attenuation curve.

These four pieces of information (zonation, mean occurrence rate and

magnitude distribution for each zone, and attenuation law) are then

combined statistically to compute the hazard curve.

The low level of seismic activity and the lack of instrumental records

make it difficult to carry out seismic hazard analyses for the central

and eastern United States using historic data alone. To augment the data

base, current methodologies make use of the judgement of experts familiar

with the area under consideration.

Expert opinion is solicited on input parameters for both the earthquake

occurrence model and the ground motion (attenuation) model. Questions

directed to experts cover the following areas: (a) the configuration of

seismic source zones, (b) the maximum magnitude or intensity earthquake

expected in each zone, (c) the earthquake activity rate and occurrence

statistics associated with each zone, and (d) methods for predicting

ground motion attenuation in the zones from an earthquake of a given size

at a given distance.

Using the information provided by the experts, seismic hazard evaluations

for the site are performed. The hazard results thus obtained using each

expert's input are combined into a single hazard estimate using a

weighting method. Approaches used to generate the subjective input, to

assure reliability by feedback loops and cross-checking, and to account

for biases and modes of judgment are described in detail in Reference 9.

3.2.2 Procedures for Developing Hazard Curves and Spectra

To perform the seismic PRA, a family of hazard curves and either

ensembles of time histories or a site ground motion spectra must be

available. To obtain these for a site with no previous investigation

usually involves 6 to 12 months effort to develop and process a data base

on earthquake occurrences and attenuation relations as described above.

For plant sites in the western United States, where the hazard curves are

closely tied to local tectonic features which can be identified and for

which a significant data base of recorded earthquake time histories

3-8
exists, it is usually necessary to go through this process for each

individual plant site. However, for sites in the eastern and central

United States, there are existing data bases and seismic hazard

characterization programs which can be utilized to obtain hazard curves

in a very time and resource efficient manner.

Two recently-completed programs provide extensive data bases on

earthquake occurrences, magnitude distributions, and appropriate

attenuation laws from which hazard curves can be developed for any

location in the east or central United States, based on the procedures

described above. These two programs are the NRC-sponsored Eastern United

States Seismic Hazard Characterization Program (Ref. 3) performed by

Lawrence Livermore National Laboratory (LLNL) and the corresponding

industry-sponsored EPRI Seismic Hazard Methodology Development Program

(Ref. 4). These two programs have developed hazard curves and site

spectra for every commercial reactor site in the central and eastern

United States. Further, using the data bases developed and the computer

programs utilized, it is possible to obtain a hazard curve for any other

geographical site in the central or eastern United States which has not

already been published. Thus, these two programs provide a convenient

and well-documented source from which hazard curves can be obtained.

Figure 3.3 shows the hazard curve family for the Surry site obtained from

the NRC-sponsored Eastern Seismic Hazard Characterization Study. Figure

3.4 shows the corresponding curves obtained from the EPRI study. On

these curves, the mean hazard as well as the 15th percentile, 50th

percentile, and the 85th percentile hazard curves are shown. Thus, the

uncertainty in the hazard contribution can be estimated from these four

curves. The mean hazard curve is particularly significant as it has been

demonstrated that the mean curve is the predominant factor in the

calculation of the mean core damage frequency.

The two sets of hazard curves shown in Figures 3.3 and 3.4 are

significantly different, both in regard to location of the mean hazard

curve as well as to the range of uncertainty about the median curve.

This is not too surprising inasmuch as the emphasis of the two programs

was somewhat different. The EPRI Program focused on very detailed

geological studies of the sites in question, and resulted in a somewhat

finer zonation of each site. However, only three attenuation (ground

motion) models were used. Further, while a number of teams of

seismological and geological experts were assembled, each team was

proscribed to reach a consensus on the final hazard curve families

developed by that team.

By contrast, in the LLNL program considerable emphasis was placed on the

full range of attenuation models, and rather than a number of teams, a

total of eleven seismicity experts and 5 ground motion experts were

individually polled, and a set of 2750 hazard curves were developed for

each site by considering each expert's input equally likely. The curves

developed in this process encompass somewhat more uncertainty than those

produced by the EPRI process, and the increased uncertainty leads to

higher probabilities of nonexceedance for points on the LLNL mean hazard

curves than are obtained at corresponding peak ground accelerations on

the EPRI mean hazard curves.

3-9
Probability of Exceedance (per year)

1.OE-01

1.OE-02

1.OE-03

1.OE-04

1.OE-05

1.OE-06

1.OE-07

0 0.2 0.4 0.6 0.8

Peak Ground Acceleration (g)

I

Figure 3.3 LLNL Surry Hazard Curve, Mean, Median, 15 Percent

and 85 Percent Curves

3-10
Probability of Exceedance (per year)

1.OE-01

1.OE-02

1.OE-03

1.OE-04

1.0E-05

1.OE-06

1.OE-07

0

Figure 3.4

0.2 0.4 0.6 0.8

Peak Ground Acceleration (g)

1

EPRI Surry Hazard Curve, Mean, Median, 15 Percent

and 85 Percent Curves

3-11
At this time, both sets of hazard curves are viewed by the USNRC as being

equally credible. As such, calculations of the seismic core damage and

plant damage state frequencies can be made for both sets of hazard curves

and the results viewed as a measure of methodological uncertainty in the

hazard curve developmental process.

As will be described later, it is recommended that the calculation of

building responses (floor slab spectral acceleration) be based on

structural dynamic response calculations using time histories as input.

In order to develop this input, it is recommended that recorded

earthquake catalogs be examined and that a suite of time histories

(usually 5 to 10) be selected which are judged to be suitable for the

site in question. That is, these time histories should be recorded at

similar sites to that being considered. As a check on the appropriateness of the suite of time histories selected, the spectra for each time

history should be generated and then the suite of spectra combined to

generate a median spectra. This median spectra can then be compared with

published spectra for various specific site types (eg., rock sites, deep

soil sites, etc.) as given, for example, in References 10 and 11.

3.3 Identify Accident Scenarios

In the event of an earthquake or any other abnormal condition in a

nuclear power plant, the plant safety systems act to bring the plant to a

safe shutdown condition. In this step of the risk analysis process, the

possible paths that a nuclear plant would follow are identified, given

that an earthquake-related event has occurred which causes shutdown.

These paths involve an initiating event and a success or failure

designation for systems affecting the course of events, and are referred

to as accident sequences.

3.3.1 Procedures for Initiating Events

The seismic analysis performed should be based on a subset of the

initiating events and accident sequences developed for the internal event

analyses of the plant. Typically, the minimum set of initiating events

which should be considered is:

Initiator Identifier

Vessel Rupture (ECCS Ineffective) RVR

Large LOCA ALOCA

Medium LOCA MLOCA

Small LOCA SLOCA

Transient with PCS initially inoperative T,

Transient with PCS initially available T3

3-12
In addition, there may be site-specific failure events (usually

structural failures) which also act as initiating events that must be

added to this list. For example, failure of a structure housing the

emergency switchgear rooms (which would thus cause LOSP) or failure of

the turbine building (which would cause loss of the PCS) would be treated

directly as initiating events.

It is recommended that the reactor vessel rupture (RVR) and large LOCA

(ALOCA) events be calculated based on the failure of the supports of the

reactor vessel and other major components in the loops of the primary

coolant system, that is, the steam generators, pressurizers and reactor

coolant pumps for PWRs and the recirculation pumps for BWRs. (Note that

direct failure of the primary coolant system main piping due to the

earthquake ground motion has been shown to have negligible probability

and can be neglected). Specific values for support fragility can be

estimated from References 5 and 6. As an illustrative example, consider

the Surry 3-loop plant as shown in Figure 3.5. The definition of the RVR

event for this plant is the simultaneous failure of at least one steam

generator or reactor coolant pump in at least two of the loops.

Similarly, the definition of the large LOCA for Surry is a failure of at

least one steam generator or one reactor coolant pump in any one of the

three loops. Thus, the Boolean expressions which must be evaluated to

compute the probability of the RVR and the ALOCA initiating events are:

P(RVR) - P[SGl*SG2 or SGI*SG3 or SG2*SG3 or

SGl*RCP2 or SGl*RCP3 or

SG2*RCPI or SG2*RCP3 or

SG3*RCPl or SG3*RCP2 or

RCPl*RCP2 or RCPI*RCP3 or RCP2*RCP3]

P(ALOCA) - P[SGl or SG2 or SG3 or RCP1 or RCP2 or RCP3]

Similar expressions can, of course, be written for any number of loops

depending on the layout of the plant. Since these failures are due to

the same floor response and the component fragilities are expected to be

highly correlated, is necessary to perform an evaluation of these failure

events explicitly including all correlation. In particular, is necessary

to include correlation between cutsets (combinations of component

failures) as well as correlation between the failure events in each cut

set. This can be accomplished by performing a Monte Carlo evaluation of

the Boolean equations for these events at several values of peak ground

acceleration (pga) to obtain the RVR and ALOCA event probabilities as a

function of pga. Interpolation can then be used to obtain the event

probabilities at other pga values as required.

3-13
IRCP2

SG 1 SG3

RCP1 RCP3

Figure 3.5 Surry Primary Coolant System Layout

3-14
The medium LOCA (MLOCA) and small LOCA (SLOCA) initiating events are

based on failure of the reactor coolant pump seals and failure of the

smaller reactor coolant loop pipes. Since calculation of piping motion

and stresses caused by an earthquake is very tedious, and since there are

many small pipes in the primary coolant system (whose failure would lead

to either a medium or small LOCA) which would have to be analyzed, it is

necessary to have some alternative approach to calculating the MLOCA and

SLOCA initiating event probabilities in a simplified seismic PRA. To

this end, use was made of the extensive primary coolant system piping

response calculations performed in the SSMRP. Based on the computed

piping moments for all pipes (and pipe combinations) leading to MLOCA

breaks (3" < Pipe ID < 6") and SLOCA breaks (1.5" < Pipe ID < 3") in the

SSMRP, statistical distributions were generated for these initiating

events as shown in Figure 3.6. These distributions can be used to

compute the medium and small LOCA initiating events due to pipe breaks in

a simplified seismic PRA without the need for extensive (and expensive)

piping calculations. In using these as generic estimates, one is making

the assumption that there are so many small pipes and combinations of

smaller pipes in the primary coolant system at any given plant that all

sizes and geometries are likely to be found at all plants. Given the

large number of such pipes in the SSMRP calculations, such an assumption

seems reasonable.

It is recommended that the T, transient initiating event (wherein the

power conversion system is lost as a direct consequence of the

earthquake) be based on the probability of LOSP as determined by failure

of the ceramic insulators in the switchyard. This has been found to be

the dominant cause of such transients in all seismic PRA's to date (for

the vast majority of plants for which LOSP results in loss of the main

feedwater system).

Finally, the T3 initiating event probability is computed from the

condition that the sum of the initiating event probabilities considered

must be unity. The hypothesis is that, given an earthquake of reasonable

size, at least one of the initiating events will occur. At the very

least, it is assumed that the operator will shut down the plant following

a significant earthquake for inspection purposes (as is currently

required in the United States for any earthquake over the operating basis

earthquake level). Hence the probability of the T3 transient initiating

event is computed from:

n-l

P(T 3 Transient) - 1.0 - E P(IEJ)

where n is the total number of initiating events being considered.

In computing the frequency of the initiating events, a hierarchy between

them must be established. The order of this hierarchy is defined such

that, if one initiating event occurs, the occurrence of other initiating

events further down the hierarchy is of no significance in terms of the

plant's response. Thus, for example, if a large LOCA occurs, we are not

3-15
CcCnditional Probability of Occurrence

1.0E+00 -

1.0E-01

1.0E-02

1.0E-03

1.0E-04

1.0E-05

1.0E-06

1.OE-07 -

0.0 0.2 0.4 0.6 0.8 1.0 1.2 1.4

Peak Ground Acceleration (g's)

Figure 3.6 Distributions of Pipe Failures Causing MLOCA and SLOCA

Initiating Events Developed From SSMRP Piping Calculations

3-16
concerned if a small LOCA or a transient also occurs, as the plant's

response requirements will be dictated by the need to mitigate the large

LOCA. Figure 3.7 shows this hierarchy (for the minimum set of initiating

events discussed above) in event tree format. The most serious

initiating event is the RVR event. The probability of the ALOCA

initiating event is then computed as the probability of the anchorage

failure ALOCA event times the complement of the RVR event, and similarly,

for the MLOCA, SLOCA and T, events. Specific Boolean equations for this

set of initiating events are also shown on this figure. Of course, when

other structural failures are identified as initiating events, they must

be added to the hierarchy as appropriate. An example of this is found in

the Peach Bottom NUREG-1150 seismic PRA (Ref. 12).

Implicit in the defined hierarchy of a set of initiating events is the

requirement that basic events which define one initiating event in the

hierarchy cannot occur in the accident sequences corresponding to

initiating events lower in the hierarchy. For example, LOSP can occur as

a basic event in any of the LOCA sequences in Figure 3.7, but cannot

occur as a basic event in the T3 accident sequence. This limitation is,

of course, directly implied by the tree structure.

3.3.2 Seismic Accident Sequences (Event Trees)

In general, the event trees developed for the internal event analyses

should be used, so as to be able to compare the final core damage

frequencies due to seismic and random events on a common basis. Again,

there may be global failure events (usually structural failures) which

directly fail one or more safety systems which can be added directly to

the event tree structure.

3.3.2.1 Feed and Bleed Considerations for PWRs

One important consideration which must be made for the seismic analysis

of PWRs is the capability of performing feed and bleed cooling for

transients in which the auxiliary feedwater system is normally called

upon to provide heat removal. If the AFWS is not available, the operator

can often perform a heat removal operation called "feed and bleed" in

which either the safety injection pumps or the charging pumps are used

toinject cooling water directly into the primary coolant system. The

resulting steam is then released through the pressurizer relief valves.

If the capability to perform feed and bleed is considered credible, then

a high degree of backup redundancy for the auxiliary feedwater system is

provided.

The ability to perform feed and bleed must be demonstrated on an

individual plant basis and, depending upon the normal alignment of valves

prior to an earthquake, it is possible that a certain amount of timely

operator recognition and intervention is required in order to perform

this feed and bleed operation. In addition, depending upon the flow rate

capabilities of the high pressure pumps and the possibility of two phase

flow through the pressurizer, it may be that feed and bleed may not be

possible.

3-17
RVR ALOCA MLOCA SLOCA Tl(LOSP) IE-T3

EQ

IE-TI(LOSP)

IE-SLOCA

IE-MLOCA

IE-ALOCA

IE-RVR

P[IE(RVR)] - RVR

PIIE(ALOCA)) - RVR * A1.OCA

P[IE(MLOCA)] - RVR * ALOCA * MLOCA

P[IE(SLOCA)] - iVR * ALOCA * RL-A * SLOCA

P[IE(T1 )] - V * ALOCA * M--CA * S * LOSP

P[IE(T3 )] - I - P[IE(RVR)] - P[IE(ALOCA)] - P[IE(MLOCA)j

- P[IE(SLOCA)] - P[IE(T1 )]

Figure 3.7 Initiating Event Hierarchy Tree

3-18
The event trees for a plant will be different, depending on whether or

not feed and bleed is considered a viable option. From a risk viewpoint,

the capability to perform feed and bleed cooling greatly lessens the

importance of the auxiliary feedwater system, and thus can play a

significant role.

3.3.2.2 Seal LOCAs For PWRs

It is usually found, in the case of PWRs, that seal LOCAs contribute

significantly to the overall risk. Thus, in developing the accident

sequences, transfers from the transient event trees to the small LOCA

trees which correspond to the seal LOCA event should be identified and

preserved. Failure events leading to the seal LOCA (usually loss of high

pressure injection and sometimes loss of the component cooling water

system) would be identified in the internal events analysis. Boolean

logic is used to combine the transient accident sequences leading to a

seal LOCA with the appropriate sequences on the SLOCA tree.

3.3.2.3 Stuck-Open Safety Relief Valves For BWRs

One source of loss of coolant accidents (not related to pipe failures)

which should be included in the analysis of BWRs is the situation where

one or more safety relief valves have randomly failed to reclose on

demand. Depending on the number of valves which fail to close, a small,

medium, or large LOCA can result. The exact definition of the resulting

LOCA size is determined in the internal events analysis. However, in

developing the event trees, transfers from the transient event trees to

the LOCA event trees should be identified and preserved so that such

sequences are not lost. (Of course, this same situation can also occur in

a PWR - usually leading to a small LOCA - but such PWR sequences are

usually probabilistically insignificant.)

3.3.2.4 Inclusion of System Successes

When developing the accident sequences from the event trees, it is

necessary to explicitly retain the system successes in the logical

expressions. This is essential since, as the earthquake peak ground

acceleration increases, the probability of system successes decreases

substantially. If these are neglected (as is done in internal events

analyses) a substantial overestimate of the accident sequence frequencies

results. Note that an exact solution of the accident sequences with the

successes directly included is currently beyond the state of the art.

However, it is necessary to numerically include the system success

probabilities in the final accident sequence quantification, since such

system success probabilities are significantly less than unity for the

higher pga levels, and failure to do so would result in a significant

over-estimation of the accident sequence frequencies. In doing this, one

should manually examine the accident failure cut sets so as to assure

that no logical inconsistencies arise with the equations used to compute

the system success probabilities. This consideration applies both to

PWRs and BWRs.

3-19
3.4 Seismic Failure Modes of Safety Systems (Fault Trees)

To determine failure modes for the plant safety systems, fault tree

methodology as described in Reference 13 is used. This methodology

systematically identifies all groups of components in a system which, if

they failed simultaneously, would result in failure of that system. The

fault trees developed for the internal events analysis are used directly,

with certain modifications.

3.4.1 General Considerations

Construction of a fault tree begins by identifying the immediate causes

of system failure. Each of these causes is then examined for more

fundamental causes, until one has constructed a downward branching tree,

at the bottom of which are failures not further reducible, i.e., failures

of mechanical or electrical components due to all causes such as

structural failure, human error, maintenance outage, etc. These lowest

order failures on the fault tree are called basic events. Failures of

basic events due to seismic ground motions, random failures, human error,

and test and maintenance outages should all be included on the seismic

fault trees.

The main difference between a fault tree for an internal events analysis

and the corresponding fault tree for an external events analysis is that

consideration must be given to the physical location of the components,

because the physical location determines to what extent both correlation

between responses and secondary failures become important. Examples of

the latter would be equipment failures due to local masonry wall collapse

or due to a high temperature/steam environment from a broken steam line.

Hence, in performing the seismic analyses, the locations of all important

pieces of equipment must be determined from the general arrangement

drawings for the plant, and then a systematic examination for potential

response correlations (to be described later) and for secondary failure

possibilities must be made during the plant walkdown.

3.4.2 Procedures for Seismic Fault Trees

As stated earlier, the internal event fault trees should form the basis

for the fault trees used in the seismic analysis. This allows for a

common level of detail between internal and external event analyses, and

assures the consistent inclusion of random and test/maintenance outage

unavailabilities in the seismic analysis.

Since the internal event fault trees are assumed to have been previously

developed and finalized in the internal events analysis, the seismic

failure modes must be added by modifying the internal event fault trees

to include:

a. Local structural failures (block walls, cranes, etc.)

b. Failure of critical passive components (tanks, cable tray

failures, and pipes.) if not identified in the internal events

analysis.

3-20
This is accomplished in several ways. First, secondary or passive

failure events can be added directly to the fault trees and the "gate"

definition data file modified. Alternatively, the fragility definition

of a relatively strong component on the tree may be redefined in terms of

the (relatively weaker) associated secondary failure. Finally, events

globally affecting a safety system or an accident sequence (such as

building failure or liquefaction) can be added directly to the Boolean

expression for the accident sequence.

Perhaps the most important aspect of developing fault trees for a seismic

risk analysis is the consideration of dependencies. An evaluation of

such dependencies should already be available if fault trees already

exist for internal events. However, these dependencies must be

reexamined in the light of seismic considerations. In particular, one

must examine dependencies between safety systems and between safety

systems and nonsafety systems. Special consideration should be given to

the electric power system, the service water system, and the instrument

air system, which in previous seismic PRA's have been found to be a

source of pervasive common-mode failures. The dependencies must be

examined so as to assure that important failure dependencies were not

left off the internal events fault trees because they involved only

passive components (tanks, pipes, etc.,) for which the random failure

rates were considered negligible.

A second aspect of system dependencies, which while less formal, is no

less important, is the consideration of physical interaction between

components, especially those not designed for seismic effects.

Consideration should be given to the polar crane falling, to weak

nonstructural ceilings, to masonry and other nonstructural walls, to

small poured concrete panels used for enclosures (such as the pressurizer

enclosure slab), and the supports of all major vessels and components.

Any such secondary-failure induced component failures should be added

directly to the fault trees. (If such a physical interaction were found

to be crucial to the final core damage frequencies, follow-up interaction

with plant personnel or a plant visit might be required to determine the

exact configuration of the components involved.)

Failure of safety systems due to building structural failures is, of

course, an important aspect of any seismic PRA. Typically, in past PRA's,

gross failure (collapse) of structures has not been found to be a

significant cause of core damage. Rather, it is localized failures which

have been found to be significant contributors. (However, a complete

structural fragility analysis for all important structures must be

performed to verify this.) A structural failure may lead directly to

core damage, affect an entire system, or fail only isolated equipment.

Hence such structural failures are added either as seismic initiators, as

top events in the seismic event trees, or as basic events in the system

fault trees depending on the extent of their impact.

3-21
3.5 Seismic Response of Structures and Components

To compute the failure probability of critical components and safety

systems, it is necessary to have a measure of both the maximum load or

acceleration that the component experiences during an earthquake, as well

as a measure of the load or acceleration level at which it fails.

Uncertainties in physical and dynamic characteristics of the soil,

structures, and subsystems as well as inherent variability in the free

field earthquake motion influence the response of safety systems to an

earthquake. All of these uncertainties give rise to uncertainties in

estimates of the response and onset of failure of each building and

component in the power plant. These uncertainties must be explicitly

recognized and propagated through the calculational scheme.

In this section, the response calculations used in past PRAs and the new

methods used for the NUREG-1150 seismic PRAs are discussed. (Strength

and failure calculations are discussed in Section 3.6.)

3.5.1 Response Calculation Methods Used In Past PRAs

Determining estimates of the responses of the walls and floor slabs of

the buildings, and responses of the subsystems themselves, has proven to

be one of the more time-consuming and difficult-to-defend aspects of

seismic risk assessments. Two approaches have been taken in past seismic

PRAs.

(i) Numerical Computer Modeling

This was the approach taken in the very detailed SSMRP analysis of

Zion (Ref. 2). In this analysis the buildings, foundations, major

components, and piping systems were modeled by the finite element

method. Soil-structure interaction and structure response were

calculated by the substructure approach. Piping analysis was

performed by multisupport time history analysis. Responses at over

400 points in the buildings and over 1000 points in the piping

systems were computed for each earthquake time history.

To incorporate variation in input parameters, multiple time history

dynamic response analyses of the entire power plant were made. In

each of these repeated calculations, the magnitudes of the input

parameters describing the physical and dynamic characteristics of

the structures and subsystems were varied in a random fashion, and

each calculation was performed for a different earthquake defined by

a set of three acceleration time histories in the free-field (two

horizontal and one vertical). Thirty calculations were made (at

each earthquake level) with the result that 30 values of response

(ie., zero period acceleration, spectral acceleration or moment)

were computed for each building wall, slab, pipe segment, valve and

component. From these 30 values, a statistical distribution of the

response of each wall, component, etc., was constructed.

3-22
This analysis was the most detailed consideration of structural

response performed to date and the results have been utilized in

identifying generic variabilities and correlation rules as

recommended in this report. However, this overall process is too

expensive and time-consuming to be used routinely in seismic risk

analyses.

(ii) Scaling of Design Calculations

This approach - often called the Factor of Safety method - is the

approach typically taken (Ref. 14) in commercial PRA's when (a) the

structure and foundation are reasonably typical of current building

practices, (b) a reasonably adequate soil structure interaction was

performed, and (c) details of the design calculations are readily

available. Here, the design loads and accelerations computed at the

safe shutdown earthquake (SSE) level are scaled down (or up) to

reflect factors of conservatism (or lack thereof) in the method used

in the design process to compute the responses. Typically, these

factors are derived from structural design reports and component

stress reports, and reflect:

a. Model response to the specified seismic event

b. Combination of modes

c. Combination of earthquake components

d. Soil structure interaction effects

e. Design vs. best estimate damping levels.

In this approach, all structural responses are expressed in terms of

peak ground acceleration. Hence, it is difficult to explicitly

include correlation (other than zero or unity) in the seismic

failures. In addition, this approach is heavily dependent on the

skill and experience of the analyst, and the basis for the results

are difficult to document.

As will be described below, a combination of these approaches - making

full use of insights and results having generic applicability - can be

used to provide a fully defendable and cost-effective means of

determining structural responses.

3.5.2 Procedures for Determining Responses

For the seismic analyses, realistic and best estimate values of floor

slab spectral accelerations must be generated for input to the equipment

failure computations. We cannot, in general, use the existing design

floor spectra as they usually have a high degree of conservatism built

into them (and the degree of conservatism varies widely plant-to-plant).

3-23
In general, three aspects of seismic response must be determined for each

floor slab and component of interest:

a. Median acceleration

b. Variability in acceleration

c. Correlation with other responses.

Procedures for developing each of these aspects are described below.

Median Accelerations

As a first step, it is necessary to obtain (from the FSAR and amendments)

the underlying soil properties and embedment depths. Secondly, it is

necessary to obtain the structural design reports which summarize the

structure's fixed-base natural frequencies and characterize the lateral

load resisting members. These structural reports should contain the

masses, stiffness description, (geometries, material properties,

reinforcing schedule, etc.,) and soil model used in the design structural

analyses. From these data, it is straightforward to construct relatively

simple lumped mass/beam element models of the critical structures using

standard civil engineering methods as described, for example, in

Reference 15. Typical models will contain less than 30 lumped masses,

yet such models have been found to adequately model the important global

dynamic response of such structures (Ref. 1). Note that detailed finite

element models of the structures are not necessary for these

computations.

If the structures are founded on rock or very stiff soil (say having a

soil shear wave velocity greater than 1800 feet per second) then a fixedbase dynamic structural response analysis can be performed. Input time

histories are taken from existing recorded earthquake catalogues, and are

selected so as to be appropriate for the site location and local soil

conditions. Any benchmarked dynamic structural analysis code can be used

for these analyses, and such analyses can usually be performed on a

personal computer.

To incorporate inherent uncertainties in the earthquake ground motions,

soil material properties and structure dynamic properties, a set of 10

(independent) time history response calculations should be made. The

randomness associated with the ground motion is included through the use

of multiple time histories. The randomness in soil and structure

properties is included by sampling the distributions for these

quantities. From Reference 2, these distributions, characterized by

their coefficients of variation (COV), can be taken as:

3-24
Parameter COV

Building Natural Frequencies 0.25

Building Damping 0.35

Piping Natural Frequencies 0.25

Piping Damping 0.35

Soil Shear Modulus 0.40

Soil Material Damping 0.50

The coefficient of variation - defined as the ratio between the standard

deviation and the mean - applies to any form of statistical distribution.

Since the above quantities are always positive, it is appropriate to use

the log normal distribution to model their variations, as was done in

Reference 1. For each of the 10 time history analyses, random

independent samples are chosen for each of the above parameters from

their specified distributions. A systematic scheme for chosing these

samples is the use of Latin Hypercube Sampling (Ref. 16), although any

form of experimental design may be used. (It has been found in Reference

1 that 10 such analyses are adequate to determine the medians of the

responses, while considerably more analyses are required to accurately

estimate the variability. However, response variability can be estimated

separately as described later.)

The result of these multiple time history calculations is a set of 10

values for each response (floor slab spectral or peak acceleration) from

which median responses can be inferred. It has been found (Ref. 1) that

such responses are adequately modeled as log normally distributed random

variables, so this model (see, for example, Reference 14) should be used

in estimating the median responses. Note that one must compute the

spectral acceleration for each component at the equipment damping

corresponding to that used in specifying the equipment fragility so that

consistency is maintained.

If the structures are founded on soil (and cannot be reasonably

approximated as responding in fixed-base modes), a soil-structure

interaction dynamic response analysis must be performed. The effects of

shallow or inhomogeneous soil conditions require analyses using the SHAKE

code (Ref. 7) in conjunction with previously generated results and

approximate rules such as those of Roesset (Ref. 17) to determine the

foundation input motion. Analyses are usually performed for several

earthquake levels (usually I SSE, 2 SSE and 3 SSE), and consistent soil

properties are determined in the process.

Finally, for the soil structure analysis, the floor slab accelerations

are computed using the lumped mass/beam element model of the structure

and foundation using a soil structure interaction code such as the CLASSI

3-25
code (Reference 8). This code (available from the Argonne Code Center)

takes the fixed-base eigensystem model of the structure and inputspecified frequency dependent (or independent) soil impedances and

computes the structural response (as well as variation in structural

response if desired). The cost of running CLASSI is not great, but it is

effectively run only on a main-frame computer.

In order to obtain a model of each median acceleration response as a

function of peak ground acceleration (for use in the component failure

calculations to be described later), analyses for each set of ten time

histories should be performed at three peak ground acceleration levels

(say, I SSE, 2 SSE and 3 SSE) as a minimum. The same set of time

histories - scaled to the different pga values - can be used. From the

resulting median response values at these three peak ground

accelerations, the median response at any other ground acceleration can

be determined by interpolation. It is generally found that the median

responses are linear up to 3 SSE or greater, and that a linear curve fit

is quite adequate for the interpolation, or is, at most, slightly

conservative for higher ground accelerations.

Variability in Responses

As described above, the "exact" variability in the responses could be

determined directly by performing a large number (typically 30 to 60) of

multiple time history analyses while systematically varying the input

parameters. (This would have to be done at multiple peak ground

acceleration levels). However, based on examination of the very large

number of responses calculated in the SSMRP (Ref. 2), a distinct

relationship between magnitude of variability and type of acceleration

was found, and it was further found that the magnitudes of the

variabilities did not vary significantly with acceleration level.

Hence, variability in responses (floor and spectral accelerations) can be

assigned directly based on the SSMRP results, and the number of response

calculations required reduced substantially. In order to compute

confidence bounds for the final core damage frequencies, both random

(irreducible) and systematic (modeling) uncertainties must be considered.

The recommended generic uncertainties derived from the extensive response

calculations performed in the SSMRP, expressed as standard deviations of

the logarithms of the responses (/6), are shown below:

Quantity B random B systematic

Peak Ground Acceleration 0.25 0.25

Floor Zero Period Acceleration 0.35 0.25

Floor Spectral Acceleration 0.45 0.25

Correlation Between Responses

In calculating the probability of failure of cut sets involving

components whose seismic failures may be correlated (ie., not

3-26
independent), it is necessary to consider correlation both in the

responses and in the fragilities of each pair of components. Again, the

correlations between the responses could be determined by extensive

multiple time history analyses as was done in the SSMRP. However, in

similar fashion as above, examination of a large number of pairs of

responses calculated in the SSMRP showed a distinct pattern to the values

of correlation that existed between the variuous types of responses.

From these insights, a set of rules were formulated which predicted the

"exact" correlations with adequate accuracy.

Thus, the correlation between pairs of responses can be assigned

according to the rules on Table 3.1 and these rules depend only on the

nature and location of the responses being considered. These rules to be

used for all acceleration levels, and for both BWR and PWR plant

configurations. (Correlations between pairs of fragilities are discussed

later).

3.6 Fragility Analysis

Component failure is taken as either loss of pressure boundary integrity

or loss of operability. Failure (fragility) is characterized by a

cumulative distribution function which describes the probability that

failure has occurred given a value of loading. Loading may be described

by local spectral acceleration or moment, depending on the component and

failure mode. The fragilities should be related to the appropriate local

response to permit an accurate assessment of the effects of common-cause

seismic failures in the evaluation of the accident sequences.

3.6.1 Procedures for Fragilities

Developing fragilities is usually the critical path item in a seismic

risk assessment. The work involved can be substantially reduced through:

a. Screening of the accident sequences using conservative point

estimate values for the seismic failure probabilities to

determine those accident sequences and components which

dominate the risk,

b. Using generic sources of fragility data for most components

(not dominating the final risk value).

c. Developing site-specific fragilities only for those components

critical to the final result which do not fit in the generic

categories.

Taken together, these approaches provide significant reduction in the

amount of time and effort required to develop the necessary fragilities,

and yet provide an easily documentable result.

Two important sources of fragility data exist. The first is the generic

data base developed in the SSMRP, and the second is a compendium of sitespecific component fragility results assembled at Lawrence Livermore

National Laboratory. These are described below.

3-27
Table 3. 1

Rules for Assigning Response Correlation PR12

1. Components on the same floor slab, and sensitive to the same spectral

frequency range (i.e, ZPA, 5-10 Hz, or 10-15 Hz) will be assigned

response correlation - 1.0.

2. Components on the same floor slab, sensitive to different ranges of

spectral acceleration will be assigned response correlation - 0.5.

3. Components on different floor slabs (but in the same building) and

sensitive to the same spectral frequency range (ZPA, 5-10 Hz or 10-15

Hz) will be assigned response correlation - 0.75.

4. Components on the ground surface (outside tanks, etc.) shall be

treated as if they were on the grade floor of an adjacent building.

5. "Ganged" valve configurations (either parallel or series) will have

response correlation - 1.0.

6. All other configurations will have response correlation equal to

zero.

3-28
SSMRP Generic Fragility Data Base

A generic data base of fragility functions for seismically induced

failures was developed in the SSMRP (Ref. 5). As a first step, all

components were grouped into generic categories. For example, all motor

operated valves located on piping with diameters between 2-1/2 and 8

inches were placed into a single generic category, and similarly, all

motor control centers were placed into another generic category.

Fragility functions for the generic categories were developed based on a

combination of experimental data, design analysis reports, and an

extensive expert opinion survey. The experimental data utilized in

developing fragility curves were obtained from the results of component

manufacturer's qualification tests, independent testing lab failure data

and data obtained from the extensive U.S. Corps of Engineers SAFEGUARD

Subsystem Hardness Assurance Program. These data were critically

examined for applicability and then statistically combined with the

expert opinion survey data to produce the fragility curves for the

generic component categories given in Reference 5.

LLNL Site-Specific Fragility Compendium

This report (Reference 6) lists fragility medians, random uncertainties

and modelling uncertainties for a wide variety of components analyzed in

past seismic PRAs. The components are identified as to type but not as

to the source plant. It is usually a simple matter to identify whether

the component is from a BWR or PWR. All fragility medians are expressed

in terms of peak ground acceleration. One can use this to obtain a

generic estimate for a certain component by assembling and averaging the

data for all components of that type listed in the report. This data was

used for the support failures of the Surry steam generator and reactor

coolant pump anchorages and for the support failures of the Peach Bottom

recirculation pumps in the NUREG-1150 analyses.

Recommended Generic Component Fragilities

A review and comparison of the site-specific component fragilities

contained in the Lawrence Livermore data base against the generic

component fragilities was made. Based on this review, the SSMRP generic

fragilities were, in general, found to be appropriate. However,

several of the SSMRP fragilities were updated based on a consensus of

more recent data.

The final recommended generic categories and the corresponding fragility

medians and uncertainties are shown in Tables 3.2 and 3.3. On Table 3.2

are shown estimates of typical fundamental natural frequencies of these

generic components. These frequency estimates should be used to

determine the appropriate response quantity to be computed (in the

building response analyses) for each component whose seismic failure

probability is needed in evaluating the seismic accident sequences. It

is recommended that these fragilities be used as the starting point in a

3-29
Table 3.2

Generic Component Categories

Fragility

Category Component Class Typical Components Frequency (Hz)

0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

LOSP

Relays

Circuit Breakers

Batteries

Battery Racks

Inverters

Transformers

Motor Control Centers

Aux. Relay Cabinets

Switchgear (Inc. Transformers,

Buses and Breakers)

Cable Trays

Control Panels and Racks

Local Instruments

Diesel Generators

Horizontal Motors

Motor-Driven Pumps and

Compressors

Large Vertical, Centrifugal

Pumps (Motor-Drive)

Large Motor-Operated Valves (> 10")

Small Motor-Operated Valves (< 10")

Large Pneumatic/Hydraulic Valves

Large Check and Relief Valves

Miscellaneous Small Valves (< 8")

Ceramic Insulators

4KV to 480V and 480 to 120V

Control for ESF Pumps and Valves

416V and 480V

RPS Process Control

Misc. Pressure and Temperature

Sensors

4160 AC Emergency Power Units

Motor-Generator Sets

AFWS, RHR, SIS, Charging Pumps,

Lube Oil Pumps, Diesel Starting

Compressors

Service Water Pumps

Includes MSIV, ADP, and PORV

ZPA

5-10

5-10

ZPA

ZPA

5-10

10

5-10

5-10

5-10

ZPA

5-10

5-35

22

ZPA

7

5

ZPA

ZPA

ZPA

ZPA

ZPA
Table 3.3

Generic Component Fragilities

Comp Median Beta-r Beta-u Name

1 0.25 0.25 .25 CERAMIC INSULATORS

2 4.00 0.48 .75 RELAY CHATTER

3 7.63 0.48 .74 CIRCUIT BREAKER TRIP

4 2.50 0.40 .39 BATTERIES

5 2.29 0.31 .39 BATTERY RACKS

6 2.00 0.26 .35 INVERTERS

7 8.80 0.28 .30 TRANSFORMERS

8 7.63 0.48 .74 MOTOR CONTROL CENTER

9 7.63 0.48 .66 AUX RELAY CABINET

10 6.43 0.29 .66 SWITCHGEAR

11 2.23 0.34 .19 CABLE TRAYS

12 11.50 0.46 .74 CONTROL PANELS AND RACKS

13 7.68 0.20 .35 LOCAL INSTRUMENTS

14 1.00 0.25 .31 DIESEL GENERATOR

15 12.10 0.27 .31 MOTORS-HORIZONTAL

16 2.80 0.25 .27 MOTOR-DRIVEN PUMPS & COMPRESSORS

17 2.21 0.22 .32 LG. VERT. M-D. CENTRIF PUMP

18 6.50 0.26 .60 LMOV

19 4.83 0.26 .60 SMALL MOV & AOVs

20 6.50 0.26 .34 LG. PNEUM/HYD VALVE

21 8.90 0.20 .35 LG. MANUAL,CHECK,RELIEF VALVE

22 12.50 0.33 .43 MISC. SMALL VALVES

23 3.00 0.30 .53 LG. HORIZ. VESSELS

24 1.84 0.25 .45 SM-MED HEAT EXCHANGERS & VESSELS

25 1.46 0.20 .35 LG. VERT VESSELS w/ FORMED HEADS

26 0.45 0.35 .29 LG. VERT. FIAT BOTTOMED TANKS

27 6.90 0.27 .31 AIR HANDLING UNITS
simplified seismic PRA. As in the use of any generic data base, one must

be cognizant of the source of the data and the equipment to which it

applies. An important aspect of using this data is to examine the

equipment in the plant being analyzed and compare it with the data base

for which the generic fragilities were developed. Any deviation should

be noted and examined carefully, and site-specific fragilities developed

as necessary.

3.6.2 Special Fragility Issues

There are a number of special issues which arise in the course of

performing a seismic PRA. The resolution of these issues depends on the

ultimate use of the seismic PRA. These issues are described below.

Relay Chatter and Circuit Breaker Trip

Fragilities for electrical components represent a special problem in that

there is a wide variety of electrical gear found within a plant.

Typically, all this gear is enclosed in switchgear cabinets or motor

control centers. The two lowest failure modes that were identified in

the SSMRP fragility data base were relay chatter and inadvertent trip of

circuit breakers. Virtually all the electrical switchgear and motor

control centers in a nuclear power plant include these two types of

components. Relay chatter is the weakest failure mode and, if

indiscriminately included in a seismic analysis, would be the dominant

failure. Because, in most cases, circuits are protected by time delay

circuits and because, in most cases, chatter of relays would not cause a

change in the state of a system being controlled, the SSMRP chose not to

include relay chatter as a failure mode for electrical gear but rather

included only circuit breaker trip. (Similarly, the NUREG-1150 seismic

analyses of Surry and Peach Bottom did not include consideration of relay

chatter, as the preliminary data on relay chatter - to be described below

- did not exist at the time the analyses were performed.)

More recently, the commercial power industry, in recognition of the

potential importance of relay chatter in vital control circuits, has

sponsored a detailed investigation of relay types and susceptibilities as

part of the activities of the Seismic Qualification Utilities Group

(SQUG). These investigations, performed by the Electrical Power Research

Institute, reviewed the types of relays currently found in nuclear power

plants and attempted to classify the common types of relays as to their

susceptibility to relay chatter. Certain relays (e.g., mercury switches)

were found to be unacceptably vulnerable and it is the current SQUG

recommendation that these relays be replaced when found. In general, it

was found that control and switching relays were not susceptible to

seismically-induced relay chatter. Rather, it is the over-voltage and

over-current protective relays (as well as certain types of timing

relays) which are susceptible. A preliminary listing of the relay types

and their susceptibilities is contained in Reference 18. (Note that test

data on all types of relays that were identified was not available, so

this data source is not currently complete.)

3-32
This data provides a means of systematically including relay chatter in a

seismic PRA, if desired. This is accomplished by having plant personnel

review all important control circuits in critical safety systems so as to

identify types of relays in the circuits. For those circuits involving

relays known to be susceptible to chatter, the potential for "locking"

behavior in the circuit given that the relay(s) could chatter is

evaluated. If such locking behavior is identified in a circuit involving

a vulnerable relay, then the generic relay chatter fragility should be

applied to the system function controlled by that circuit. (Or, more

likely, the utility may chose to replace the relay with one less

vulnerable to seismic effects.) For the remaining circuits, the circuit

breaker trip generic fragility could be used to model electrical failures

in the affected system function. This would be combined with the

applicable mechanical failure fragility for the components in the system.

In this way, relay chatter effects can be systematically included in a

seismic PRA if desired.

Piping Failure Considerations

Because of the extent and complexity of the many piping systems in a

nuclear power plant, consideration of piping failure presents special

problems in a simplified risk analysis. In general, piping is found to

have a high margin of safety if only seismically-induced inertia loads

are considered. High stresses tend to arise only where piping runs

through walls, or is attached to a large vessel resulting in large

relative displacements. However, in piping design, seismic stresses are

usually held to a small percentage (say 15 percent) of the overall

allowable stress. Hence, our recommendation is not to perform any

dynamic piping analysis and neglect piping failures in general. This

recommendation is supported by an extensive series of tests jointly

sponsored by the NRC and the Electric Power Research Institute (Ref. 19)

which showed that typical piping runs designed to nuclear power plant

standards have margins of safety of 10-25 over the SSE design level.

Of course, during a walk-through of the plant, personnel familiar with

piping design should examine critical pipes in the auxiliary feedwater,

ECCS and the RHR systems to determine whether or not there are points

where piping from one anchor point attaches to a large component or to an

anchor point on a different foundation for which one might anticipate

large relative motions. If such locations are found, it is possible, in

an approximate sense, to analyze these piping segments for displacement

induced stresses and hence develop an appropriate piping fragility for

these locations without the need for a complete dynamic piping analysis.

Interbuilding Piping Failure due to Soil Failure or Liquifaction

One generic aspect of piping failure which should be considered is the

possibility of interbuilding pipe failure due to relative motion -

enhanced by soil failure or soil liquification. This applies primarily

to PWR's because of their typically tall containment building

3-33
configurations and the fact that all safety and shutdown system piping

must run between the auxiliary building (or equivilent) and the

containment. If soil failure occurs under the containment during rocking

motions, large relative displacements between the two buildings could

occur, with the resulting possibility of failure of the interbuilding

piping. Again, an analysis of the piping stresses for the piping running

between the buildings can be performed using quasi-static methods after

the relative building motions have been determined.

3.7 Seismic Risk Computations

Accident sequence frequencies are used in determining the frequencies of

core damage and of radioactive release for a given release category.

Total core damage frequency is defined as the sum of the frequencies of

all accident sequences leading to core damage. In the quantification

process, conditional accident sequence probabilities are determined at a

number of pga values, and then these are de-conditioned by integration

over the seismic hazard curve.

3.7.1 Quantitative Screening For Dominant Accident Sequences

Determination and quantification of the accident sequences is a multi-step

procedure involving several levels of screening. In the first step, the

SETS code (Ref. 20) is used to solve all the system fault trees using mean

point estimate input screening values for all the seismic failure events

(including the internal events point estimate failure values for all random

events). The same fault trees used by the internal events analysis are

solved with additions as noted in Section 3.4.2. The mean point estimate

seismic screening values are taken as some conservative estimate, usually

the component seismic failure probabilities evaluated at three times the

SSE. (Since this step is usually performed early in the analysis - prior to

the completion of the fragility analysis - generic fragilities are used for

the majority of the components. However, for the critical buildings and

those components identified during the initial plant walkddown as requiring

plant-specific fragility development, the failure probabilities are set to

unity.) These values are added to the random failure probabilities, and

the total is used in the numerical screening process.

A dual probabilistic culling criterion is used in the culling process in

this first step. In this process, a cut set is not deleted unless both its

numerical value as well as the minimum value of any component failure

probability in the cut set is less than the prescribed cutoff criterion.

This dual criterion is used in recognition of the fact that potentially

large correlations can exist between basic events in the same cut set due

to the pervasive nature of the seismic input motion. The result of this

screening step is a set of Boolean equations describing the failure modes

of each of the safety and support systems.

In the second step, again utilizing the SETS code, these system Boolean

equations are merged together to form the accident sequences as defined by

the internal events analysis event trees. At this stage, truncation is

3-34
performed based both on the order of the cut sets as well as the

probability of the cut sets. The result of this step is a set of Boolean

equations describing each accident sequence in terms of cut sets which now

contain all the important seismic and random failure events.

Each accident sequence so derived consists of the union of groups of events

(successes or failures of safety systems) which must occur simultaneously

for the accident sequence to occur. The failure of each safety system can

be represented in terms of minimal cut sets, which are groups of component

failure which will cause the safety system to fail. These cut sets and the

accident sequences are combined together so that every accident sequence

can be expressed in a Boolean expression of the form

ACCJ - IEJ [C 1 C2C3 or C•C 5 or ... or CiCjCk]

in which IEJ is the initiating event and the Ci are basic events (i.e.,

failure of individual components) identified on the system fault trees. If

at least one of the component failure groups CiCjCk occurs, then the

accident sequence occurs.

3.7.2 Accident Sequence Quantification

The final step involves the actual quantification of the accident sequences

(using best-estimate seismic failure probabilities from the final fragility

evaluations) for each earthquake level being evaluated. The same accident

sequence expressions are utilized both to compute the mean point estimates

of the accident sequence frequencies and to perform the uncertainty

analysis calculations. To facilitate computations as well as

documentation, a cross reference table should be set up which relates each

component to a component identification number, its random point estimate

failure rate and error factor, and to its associated seismic fragility

category and seismic response category. This cross reference table thus

provides all the information required to compute the probability of failure

of any basic event (random or seismic or combined) at any peak ground

acceleration level.

Computation of each accident sequence probability consists of determining

the probability of each cut set, and then combining them to get the

accident sequence probability. Finally, the accident sequence probability

is computed using the expression

P(ACC) - I - 11 [1 - P(cutset j)]

This expression represents an upper limit to the accident sequence

probability (assuming nonnegative correlations), and has been found to be a

close approximation to the accident sequence probability (Ref. 1). This is

true since the exact correlation can be considered in evaluating each cut

set, while only the correlation between cut sets is neglected. However,

3-35
correlation between "or-ed" events (such as between cut sets) has only a

minor effect while correlation between "and-ed" events (such as joint

component failures within a cut set) has a major impact on the resulting

probability.

These accident sequences are a function of (conditional upon) the peak

ground acceleration (pga) used to evaluate the basic event failure

probabilities. These must be de-conditioned by integrating each accident

sequence (and the expression for core damage frequency) over the hazard

curve using:

ACCj - fP(ACCj,pga)feq(pga)d(pga)

where

P(ACCj,pga) is the conditional accident sequence

frequency as a function of pga, and

feq(pga) is the probability distribution function

for the hazard curve,

Any reasonably accurate numerical integration scheme may be used. In

evaluating this integral, a lower limit of 0.05g is appropriate, and the

upper limit should be chosen so that the computed estimate of risk can be

shown to have converged. This depends very much on the slope of the

hazard curve for higher accelerations and must be identified in an

iterative fashion. The calculation of basic event failure probabilities,

inclusion of correlation and uncertainty analysis are described below.

3.7.2.1 Basic Event Seismic Failure Probability Calculation

The probability of seismic failure of each component is computed using the

so-called "interference theory" equation (Ref. 21) given by:

Pf 8il(pga) - f Ffra&(r)fresp(r;pga)dr (1)

where Ffras is the cumulative probability function for the fragility in

terms of local response r and fresp is the response probability density

function on r conditional on pga.

However, it is recommended that each basic event seismic failure

probability be computed assuming that the response and fragility

distributions are lognormal in form. Calculations in the SSMRP showed that

responses were reasonably fit by lognormal distributions. The limited data

on fragilities can be fit with lognormal distributions as well as any other

type. Hence, for convenience the lognormal distribution is used for both.

The above general equation used to calculate seismic failure frequencies

then simplifies to:

3-36
Pfail - l 2 rr +" a ] (2)

O2r r + -62 f r

where

d> is the standard normal cumulative distribution function and

Hr(pga) is the median of the component response

Mf is the median of the component fragility

ýrr, Of, are the random logarithmic standard deviations of the

response and fragility, respectively.

Note that the use of lognormal distributions is not essential to the

calculational process, and, in fact, any arbitrary pair of distributions

could be used for the responses and fragilities provided they are

physically meaningful.

3.7.2.2 Calculation of Correlated Basic Event Probabilities

When the individual basic failure events in a cutset CICjCk are not

independent, correlation between the basic events must be explicitly

included. Correlation can be due both to correlation in the responses

(which arises due to the common ground shaking which is exciting the

plant) and may also be due to correlation in the fragility estimates of

the components. If the correlations between the responses and the

correlations between the fragilities are known for two correlated

components, then the correlation coefficient between the failure of these

two components can be computed (Ref. 2) from:

PRl•R2 0 FIAF2

pRIR2 + jFIF2 (3)

2 + F l R2 + F2 2Fýj +1 "R2 + 6F2

JP P 221 2PR +F 2l~

in which

p - correlation coefficient between the failures of components I

and 2

&R1, R2 - standard deviation of the logarithms of the responses of

components 1 and 2

4F1,iF2 - standard deviations of the logarithms of the fragilities of

components 1 and 2

PR1R - correlation coefficient between responses of components 1 and 2

PF1F2 - correlation coefficient between the fragilities of components 1

and 2.

3-37
This relation shows that the correlation between the failures of

components I and 2 depends not only on the correlations between the

respective responses and the respective fragilities, but also on the

variances in these responses and fragilities. Inasmuch as there are no

data as yet which show correlation between fragilities, it is recommended

that the fragility correlations between like components be taken as zero

and 1, and the possible effect quantified. The correlation between the

responses is computed according to the rules of Table 3.1.

In general, the probability of a cutset involving correlated seismic

failures must be computed by evaluating the multi-variate probability

distribution for the dependent failure events (Ref. 2). When the

responses and the fragilities are log normal variables, the multivariate

normal probability distribution can be used to compute the joint failure

probabilities. The computer code SEISIM (Ref. 1) developed in the SSMRP

was written expressly to calculate the probability of such correlated

cutsets. Given the individual component responses and fragilities (in

terms of the medians and variances of their distributions) and given the

correlations between the responses and the fragilities, the code

constructs a multivariate lognormal distribution for each minimal cutset,

and then uses n-dimensional numerical integration to compute the

probability of the minimal cutset.

For many common situations in seismic analysis, simplified methods for

computing such correlated seismic joint failure probabilities exist. For

example, when identical components are affected by the same response

(e.g., are located on the same floor slab), the calculation of their

correlated joint failure probability can be performed in simple fashion

using Figure 3.8 as obtained from Reference 22. This allows

consideration of up to four identical components having arbitrary failure

correlation coefficient. The ordinant on this figure gives the exponent

nk to which the failure probability of a single component P, must be

raised to obtain the correlated failure probability for joint failure of

all k components. The abcissa p is the correlation coefficient as

computed from equation 3. For example, if three components have an

individual failure probability of 0.05, and if the correlation cofficient

p between the failures is 0.5, then the coefficient n3 is seen to be

about 1.85 and thus the joint failure probability of the three components

is

P(CIC2 P3 ) - (0.05)1-85 - 0.00392

(which is quite a bit higher than the failure probability for the cut set

assuming the three events are independent, which is 0.000125).

For the case where two unlike basic events in a cutset are assumed to be

correlated, the joint probability for the pair may be computed directly

by the use of tables and formulae for the bi-variate normal probability

3-38
CL I

01

0.5

PRS

Figure 3.8 The Powers n2 , n3 and n4 as a Function of the Correlation

Coefficient and the Single Component Failure Probability P1

3-39
distribution B(h,k,p) as given in Reference 23. Again, p is computed

from equation 3. (The remaining failure probabilities in the cut set,

being independent, are multiplied in at the end).

A further savings in effort can be achieved by considering the magnitude

of the correlation coefficient itself. In general, when the correlation

coefficient between two components is less than 0.25, little error is

made in assuming that they are independent. Similarly, when the

correlation coefficient is greater than 0.75, it is reasonable to assume

that they are fully dependent. These assumptions significantly reduce

the labor in computing correlated joint failure probabilities with little

loss in accuracy.

3.7.2.3 Uncertainty Analysis

Finally, a complete uncertainty analysis is performed on the dominant

accident sequences (and on the dominant cutsets in each accident

sequence). A true Monte Carlo analysis is recommended for the NUREG-1150

studies. Thus, the expression for the unconditional accident sequence

frequencies (and for core damage frequency), shown below:

P (ACC.) = f P(ACCj, pga)feq (pga)d(pga)

where

P(ACCj,pga) is the conditional accident sequence

frequency as a function of pga, and

feq(pga) is the probability distribution function

for the hazard curve,

is randomly sampled varying the hazard curve parameters, the random

failure frequencies, and the seismic response and fragility parameters.

From the accumulated values of accident sequence frequency and core

damage frequency, exact statistics on their distributions are directly

obtainable.

The sampling should be performed as follows. For each sample, a random

hazard curve should be selected from the family of hazard curves and

random values of the response median and the fragility median should be

computed. For each of these three quantities, a random variable from a

uniform distribution on [0, 1] is chosen and this is used to determine a

new median using the known modelling uncertainties and the inverse of the

standard normal probability distribution function. Note that new medians

are computed for each response quantity and for each fragility category.

The same "new" median must be used for every basic event assigned to

either that response or that fragility.

3-40
Thus, in performing the uncertainty analyses, full correlation between

random samples taken from each response category and from each fragility

category is enforced. This is both theoretically correct and consistent

with the philosophy utilized in the internal event NUREG-1150 uncertainty

calculations.

3.7.2.4 Mean Point Estimate Calculations

In addition to the full uncertainty analysis (which produces exact mean

values and exact percentiles of the distributions of the accident

sequences and total core damage frequency) a "mean point estimate" should

be computed. The mean point estimate is useful for illustrating various

intermediate results (conditional accident sequences frequencies,

initiating event frequencies, etc.) which explain the flow of the

calculations, for demonstrating convergence of the numerical integration,

and for performing sensitivity studies in a cost effective manner.

Specifically, the mean point estimate is used to understand the

contributions of the various basic events to the total frequencies and to

understand the contributions to the total uncertainty bands.

The mean point estimate is computed by using the mean random failure

frequencies, the mean seismic hazard curve, and the mean values for the

seismic failure event frequencies in evaluating the accident sequences.

The mean seismic failure probabilities are computed using both random and

systematic uncertainties for the responses using:

E[Pfail] - In (Mr (pga)/Mf)1

2rr + 8 ru + fr + 2fu

where

4ý is the standard normal cumulative distribution function,

Mr(pga) is the median of the component response,

Mf is the median of the component fragility,

Prr, 6fr are the random logarithmic standard deviations of the

response and fragility, respectively, and

fru, fiu are the systematic logarthmic standard deviations of the

response and fragility, respectively.

Only one evaluation of the accident sequences is required to compute the

mean point estimate. This mean point estimate will be seen to be nearly

equal to the exact mean values of the accident sequence and core damage

frequencies as obtained from the uncertainty analysis. This is to be

expected because mean values probabilistically add to yield the mean

value of each accident sequence (conditional on the hazard), and the only

3-41
difference between the true mean and the mean point estimate has to do

with sampling error in the Monte Carlo uncertainty analysis. Experience

has shown, however, that the difference between these is small.

3.7.2.5 Sensitivity Studies

In particular, the mean point estimate calculation is particularly useful

in performing sensitivity studies. As a minimum, a sensitivity study on

basic event importance to the overall mean core damage frequency and a

sensitivity study on the relative importance of the hazard curve

uncertainty as compared to the response/fragility uncertainties should be

made.

The basic event importance can be ascertained by evaluating the "risk

reduction potential" for each component. This is accomplished by setting

the failure probability of each component (one at a time) to zero and

reevaluating the mean (point estimate) core damage frequency. The

percentage reduction in core damage frequency is thus a measure of its

importance and a direct indication of the decrease in risk which would

result if the component were strengthened so that it would never fail in

a seismic event. It is clearly a means of ranking components as to the

cost-effectiveness of any retrofit to strengthen a component.

The uncertainty importance study can be accomplished by setting the

modelling uncertainties for each of the hazard, response and fragilities

to zero (one at a time) and reevaluating the Monte Carlo uncertainty

analysis to determine changes in the distributions of the accident

sequence frequencies and the total core damage frequency. A convenient

measure often used as an indication of the degree of uncertainty in any

probability distribution is the Error Factor (EF) defined as the ratio

between the 95th percentile and the 50th percentile of the distribution.

Changes in the computed error factor as the hazard, response and

fragility uncertainties are set to zero directly indicate their

importance to the overall uncertainty. Examples of both types of

sensitivity studies are included in the Surry and Peach Bottom NUREG-I1SO

seismic PRAs.

3.7.3 Presentation of Results

In order that the assumptions and input be traceable and that the output

be relatively transparent, the following set of figures and tables should

be provided for each seismic analysis:

a. Figures showing the mean and median hazard curves at the site,

the upper and lower bounds assumed, and a figure showing the

site ground motion spectra.

b. Tabulation of mean and median annual probabilities of exceedance

of each discretization point of the hazard curve used in the

numerical integration of the accident sequences.

c. Listing of all earthquake time histories used in the analysis.

3-42
d. Figures showing the event trees as modified for the seismic

analysis.

e. Tables listing the dominant cutsets for all important accident

sequences.

f. Table listing the basic events, their definition, random and

test/maintenance probabilities, and corresponding seismic

response and fragility categories.

g. Table listing response points, description of location and

elevation of each point, and the response pga multiple.

h. Table showing the mean initiating event probabilities at each

earthquake level.

i. Table listing the mean conditional accident sequence

frequencies/year for each earthquake level.

J. Table listing the total (unconditional) mean accident sequence

contributions for each interval on the hazard curve.

k. Table listing the mean, variance, 5, 15, 35, 50, 65, 85 and 95

percentiles of the accident sequence and total core damage

frequency distributions.

This data will provide the necessary input to allow the reader to

reproduce any of the point estimate results.

3.8 Summary

The procedures described in this chapter describe a straightforward

approach to the evaluation of seismic CDF which is minimally dependent on

analyst judgement. The simplified building response calculation approach

provides detailed and accurate results at a level of effort significantly

less than that performed in the SSMRP and yet the results are totally

defendable. The approach using conservative component failure

probabilities in the initial screening minimizes the effort required to

develop component fragilities. The use of a Monte Carlo analysis of the

accident sequences and total core damage frequency allows for rigorous

incorporation of arbitrary response functions and any degree of

correlation. Taken together, this approach represents a reasonable and

efficient, yet fully documentable and defendable, means of calculating

seismic core damage frequency.

3-43
3.9 References

1. Smith, P. D., Chuang, T. Y., Bernreuter, D. L., Sheih, L. C., Bohn,

M. P., Wells, J. E., Johnson, J. J., Seismic Safety Margins Research

Program - Phase I Final Report, NUREG/CR-2015, 10 Volumes, September

1981.

2. Bohn, M. P., et al., Application of the SSMRP Methodology to the

Seismic Risk at the Zion Nuclear Power Plant, Lawrence Livermore

National Laboratory, Livermore, CA, NUREG/CR-3428 (1983).

3. Bernreuter, D. L., et al., Seismic Hazard Characterization of 69

Nuclear Plant Sites East of the Rocky Mountains, NUREG/CR-5250,

October 1988.

4. Electric Power Research Institute, Seismic Hazard Methodology for

the Central and Eastern United States, EPRI NP-4726, Vol. 1-10, July

1986.

5. Cover, L. E., et al., Handbook of Nuclear Power Plant Seismic

Fragilities, NUREG/CR-3558, December 1983.

6. Campbell, R. D., et al., Compilation of Fragility Information From

Available Probabilistic Risk Assessments, Lawrence Livermore

National Laboratory Report UCID-20571 Rev. 1, September 1988.

7. Schnabel, P. B., Lysmer, J. and Seed, H. B., SHAKE -- A Computer

Propram for Earthquake Response Analysis of Horizontally Layered

Sites, Earthquake Engineering Research Center, University of

California, Berkeley, CA, EERC 72-12, 1972.

8. Wong H. L. and Luco, J. E., Soil-Structure Interaction: A Linear

Continuum Mechanics Approach (CLASSI). Dept. of Civil Engineering,

University of Southern California, Los Angeles, CA, CE79-03, 1980.

9. Bernreuter, D. L., Seismic Hazard Analysis: Application of

Methodology, Results and Sensitivity Studies, Lawrence Livermore

National Laboratory, NUREG/CR-1582, October 1981.

10. Seed, H. B., Ugas, C. and Lysmer, J., Site Dependent Spectra for

Earthauake Resistant Design, Earthquake Engineering Research Center,

University of California, Berkeley, CA, EERC 74-12m, 1974.

11. Newmark, N. M., A Study of Vertical and Horizontal Earthquake

Spectra, WASH-1255, 1973.

12. Lambright, J. A., et al, Analysis of Core Damage Frequency: Peach

Bottom Unit 2 External Events, NUREG/CR-4550, Vol. 4, Rev. 1, Part

3, December 1990.

13. Vesely, W. E., et al., Fault Tree Handbook, NUREG-0492, January

1981.

3-44
14. Kennedy, R. P., et al., "Probabilistic Seismic Safety Study of an

Existing Nuclear Power Plant, in Proceedings of 5th International

Conference on Structural Mechanics In Reactor Technology, August

1979.

15. Cook, R. D., Concepts and Applications of Finite Element Analysis,

John Wiley and Sons, New York, 1974.

16. Iman, R. L. and Shortencarier, M. J., A Fortran 77 Program and

User's Guide for the Generation of Latin Hypercube and Random

Samples for Use with Computer Models, NUREG/CR-3624, SAND83-2365,

March 1984.

17. Roesset, J. M., "The Use of Simple Models in Soil-Structure

Interaction," Proceedings of the Second ASCE Conference on Civil

Engineering and Nuclear Power, Vol. II, Knoxville, TN, September 15-

17, pp. 10-3-1 to 10-3-25.

18. Betlack, J. and Kassawara, R., "Evaluating Seismic Functionality of

Relays in Operating Nuclear Power Plants" in Proc. of Tenth

Structural Mechanics in Reactor Technology Conference, Anaheim, Ca.,

August 14-18, 1989.

19. Guzy, D. J., et al., "Piping and Fitting Dynamic Reliability

Program" in Proc. Sixteenth Water Reactor Safety Information

Meetin , NUREG/CP-0097, October 1988.

20. Worrell, R. B., SETS Reference Manual, NUREG/CR-4213, May 1985.

21. Kapur, K. C. and Lamberson, L. R., Reliability In Engineering

Design, John Wiley and Sons, New York, 1977.

22. Mankamo, T., Common Load Model: A Tool for Common Cause Failure

Analysis, Electrical Engineering Laboratory Report 31, Technical

Research Center of Finland, December 1977.

23. National Bureau of Standards, Tables of the Bivariate Normal

Distribution Function and Related Functions, NBS Applied Mathematics

Series 50, U.S. Government Printing Office, 1959.

3-45

4.0 FIRE ASSESSMENT PROCEDURES

Based on plant operating experience over the last 20 years, it has been

observed that typical nuclear power plants will have three to four

significant fires over their operating lifetime. Previous probabilistic

risk assessments (PRAs) have shown that fires are a significant

contributor to the overall core damage frequency, contributing anywhere

from 7 percent to 50 percent of the total (considering contributions from

internal, seismic, flood, fire, and other events). Because of the

relatively high core damage contribution, fires need to be examined in

more detail.

An overview of the simplified fire PRA methodology is as follows:

A. Plant Visit

Based on the internal events and seismic analyses, the general location

of cables and components of systems of interest is known. The initial

plant visit will provide the analyst with a means of seeing the physical

arrangements in each of these areas. The analyst will have a fire zone

checklist which will aid in the screening analysis.

The second purpose of the initial plant visit is to confirm with plant

personnel that the documentation being used is in fact the best available

information and to get clarification about any questions that might have

arisen in a review of the documentation.

Also, a thorough review of fire-fighting procedures will be conducted.

B. Screening

It is necessary to select important fire locations within the power plant

under investigation having the greatest potential for producing riskdominant accident sequences. The objectives of location selection are

somewhat competing and should be balanced in a meaningful risk assessment

study. The first objective is to maximize the possibility that all

important locations are analyzed, and this leads to the consideration of

a potentially large number of candidate locations. The second objective

is to minimize the effort spent in the quantification of event trees and

fault trees for fire locations that turn out to be unimportant. A proper

balance of these objectives is one that results in an ideal allocation of

resources and efficiency of assessment.

The screening analysis is comprised of:

1. Identification of relevant fire zones. Fire zones which have

either safety-related equipment or power and control cables for

that equipment will be identified as requiring further analysis.

2. Screen fire zones on probable fire-induced initiating events.

Determination of the fire frequency for all remaining plant

4-1
locations and determination of the resulting fire-induced

initiating events and "off-normal" plant states is then

accomplished.

3. Screen fire zones on both order and frequency of cut sets.

4. Each fire zone remaining is numerically evaluated and culled on

frequency.

C. Quantification

After the screening analysis has eliminated all but the

probabilistically-significant fire zones, quantification of dominant cut

sets will be completed as follows:

1. Determine temperature response in each fire zone.

2. Compute component fire fragilities. The latest version of the

fire growth code COMPBRN with some modifications will be used to

calculate fire propagation and equipment damage. These fire

calculations are only performed for the fire areas that survive

the screening analysis.

3. Assess the probability of barrier failure for all remaining

combinations of fire zones. A barrier failure analysis is

conducted for those combinations of two adjacent fire zones

which, with or without additional random failures, remain after

the screening analysis.

4. Perform a recovery analysis. In a similar fashion, as in the

internal event analysis, recovery of non-fire-related random

failures will be addressed. Also, credit for either automatic or

manual extinguishment of a fire before the COMPBRN predicted time

to damage will be given.

5. An uncertainty analysis is then performed to estimate error

bounds on the computed fire-induced core damage frequencies. The

TEMAC code will be utilized in the uncertainty analysis.

4.1 Identification of Relevant Fire Zones

Determination of fire areas and the boundaries or barriers between

respective areas will be made based on a review of the Appendix R

submittal, a comprehensive analysis of the plant layout drawings, and

supplemented with a plant walkdown to verify the selections made. Fire

area determinations will then be made along major plant functional area

boundaries (typically 3-hr rated fire barriers) based on the existing

divisions from the general arrangement drawings.

4-2
4.2 Initiating Event Frequencies

Data on fires in light water reactors have been analyzed in several

studies (Ref. 1, 2, 3). Although they have been done independently, they

have some common aspects. For example, almost all studies have used

License Event Report (LER) data from the Nuclear Regulatory Commission

(NRC). All have reported the overall frequency of fires of approximately

0.16 per reactor year on a plant-wide basis.

To determine fire-initiating event frequencies, there are two kinds of

information needed: (1) the number of fire incidents that have occurred

in specific compartments during commercial operation, and (2) the number

of compartment years that the nuclear industry has accumulated. Most of

the data for the first part comes from reports of insurance inspectors to

American Nuclear Insurers (ANI), although other sources are also used,

e.g., the U.S. Nuclear Regulatory Commission. While the NRC requires the

reporting of fires that, in some way, affect the safety of the plant, the

ANI has more stringent requirements in the sense that all fire events

must be reported. Compartment years are computed by adding the age of

all compartments (within a certain category of compartments) of units

that were in commercial operation by the end of June 1985. The age is

defined as the time between first commercial operation and the end of

June 1985 (or date of decommissioning). The combination of specific fire

locations and compartment age is given in Table 4.1. Even though fire

events that occurred when the plant was shutdown are used, an event is

only included if it could be postulated that it also might occur when the

plant was at power. Eight areas are typically found in nuclear power

plants. These are: (1) the control room, (2) cable spreading room, (3)

diesel generator room, (4) reactor building, (5) turbine building, (6)

auxiliary building, (7) electrical switchgear room, and (8) battery room.

In most plants, the first three areas, the electrical switchgear room,

and battery room are single compartments while the other three are

typically large buildings. Appendix A provides a listing of all fire

events for each of these eight plant areas.

To obtain fire zone-specific initiating frequencies, a partitioning

method is required. Partitioning allows the analyst to subdivide the

frequency of fire occurrence from a large building (e.g., auxiliary

building) to a specific room or area within that building. Also, further

partitioning can occur within a specific room or area. One method of

partitioning is comprised of ratioing the areas of fire zones within a

building. The assumption here is that the probability of fire occurrence

is dependent only upon the amount of area a fire zone contains. Another

method of partitioning would look at each fire zone and analyze factors

important to probability of fire initiation. These factors are the

amount of electrical components and cabling, the fire loading, whether

the fire zone is controlled, and how often the fire zone is occupied.

Partitioning by the first method will only be used when there is no

distinguishing characteristics of a fire zone or an area within that

zone.

4-3
Table 4.1

Statistical Evidence of Fires in LWRs

(As of the end of June 1985)

Area

Control Room

Cable Spreading Room

Diesel Generator Room

Reactor Building

Turbine Building

Auxiliary Building

Electrical Switchgear Room

Battery Room

Number

of Fires

r

3

2

37

15

21

43

4

4

Number of

Compartment Years

T

681.0

747.3

1600.0

847.5

654.2

673.2

1346.4

1346.4

4-4
COMPBRN code calculations will also be used to partition fire frequency

within a particular fire zone. For example, if it is known that a

particular cable tray which runs through a fire zone must sustain damage

to make a fire scenario valid then the length of this tray can be readily

determined. COMPBRN calculations can then assess how far away from this

tray a fire can be located and still cause damage. In this way an area

of fire influence within a fire zone can be determined.

The fire events and operating years for the eight plant areas were

obtained using the fire data base developed by Wheelis (Ref. 4). To

determine operating years for electrical switchgear rooms and battery

rooms, auxiliary building operating years are doubled. A survey of all

U.S. light water reactors indicates that there is an average of 2.25

trains of emergency switchgear and their associated batteries per plant.

However, it is known that some plants, such as Surry, locate both trains

of their emergency switchgear in one fire zone. So, it was assumed that

an average number will be close to two per plant for both types of rooms.

To aid partitioning within a large building or within a specific fire

zone in that building, a checklist was used on the initial plant visit to

determine the most probable fire-initiating sources. Also, data on past

fire occurrences was thoroughly reviewed. For instance, control room

data indicate that fires have only occurred in electrical cabinets.

Therefore, area ratios will be developed based on cabinet area within

this respective area. Since transient combustible-initiated fires have

never occurred, they will be eliminated from further consideration for

control room areas.

The generic fire occurrence data will be updated using a method developed

by Iman (Ref. 5) to determine plant-specific fire occurrence frequencies.

This Bayesian approach models the incidence rate for each plant relative

to the incidence rates of all other plants, and the posterior

distribution is found for the incidence rate for each plant.

For this analysis the gamma distribution is used as a model, although

many other distributions could be used. The probability density function

for the two-parameter gamma distribution is:

h(A) - f (AjCap) - #[r(a)] -l Aa-I e-f A 0 a,P > 0

These parameters a and p are unknown, and the noninformative prior is:

p (a,li) f d/(at n ) a,t 1 > 0

The likelihood function of the datum (si, ti) is Poisson

4-5
The posterior density can, therefore, be expressed as:

n

p (a~,P) H [h (,\i) L(Si tit.-IA)] i-0

f f f... .f p(Ck'f) ri [h (A .) L (si It iI x ) I da dfl d\ 0. .dAn

000 0 i-0

In this way plant-specific fire-initiating event frequencies and

distributions will be developed.

4.3 Determination of Fire-Induced "Off-Normal" Plant States

One of the most critical steps in a fire analysis is to determine on a

plant-specific basis which of a wide range of possible initiating events

has the potential to be induced as a result of a fire occurrence.

As in the NUREG-1150 internal events analysis, a comprehensive list of

initiators has been identified for further study. It is known from a

review of previous fire PRAs that only a limited set of initiating events

has the potential to be a significant contributor to fire-induced core

damage frequency. Typically, initiating events such as large or medium

LOCAs caused directly by the fire have not been analyzed because the

vulnerabilities of piping systems or tanks to fire events are considered

insignificant.

A comprehensive look at system drawings will be conducted to determine

the potential for large or small LOCAs caused by spurious valve

actuation. If no probabilistically significant mechanism can be found

during this review, then fire-induced spurious actuation will be removed

from further consideration. Even if spurious actuations would occur, it

is known from past fires (such as at Brown's Ferry) that within

approximately one-half hour spurious actuations terminate in open

circuits.

The same fault trees and event trees that are used in the internal events

analysis will be utilized in the fire analysis. Thus, the level of

analytical detail will be consistent with the level in the internal event

analysis.

4.4 Detailed Description of the Screening Analysis

A comprehensive screening analysis will be required to reduce the number

of potential fire-induced scenarios to only those which have the

potential to be probabilistically significant to core damage frequency.

The screening analysis is composed of the following four steps:

4-6
Step I. Identification of Relevant Fire Zones

Fire zones containing equipment or cables associated with safety-related

systems which mitigate the effects of the unscreened fire-induced "offnormal" plant states are identified. All other fire zones will then be

eliminated from further analysis.

Step 2. Screen Fire Zones Based on a Critical Area Analysis

The remaining fire zones undergo a critical area analysis (location

mapping) of components including control and power cables for a limited

set of "crucial" components located within these areas. This information

is used in conjunction with the SETS computer code (Ref. 6) to solve all

front line systems and all of the identified fire-induced sequences of

Section 4.3 in terms of fire-related and random failures.

Fire occurrence frequency for each zone will be set to 1.0 and, given a

fire, all components within that zone will be assumed to fail. The

output of this process is accident cut sets which include both fire zone

combinations as well as random failures (i.e., not fire-related).

Truncation of cut sets at a random failure probability of 10-4 to 10-5

will be accomplished which is equivalent to truncation of internal event

cut sets at approximately 10-8 since the fire frequency is arbitrarily

set for screening purposes to 1.0.

Cut sets which require three or more fire zones will be eliminated. This

is deemed appropriate since these cut sets imply the failure of two or

more three-hour rated fire barriers. Cut sets which contain two fire

zones will be screened on the following three criteria: (1) no adjacency

between zones, (2) no penetrations in the adjacency between zones, and

(3) if there are penetrations by numerical culling with barrier

penetration failure set to a screening value of 0.1. It is known from

the analysis of many fire barriers that typical failure rates are on the

order of 10-2 to 10-3. Therefore, this screening value will be set high

enough to ensure potentially important fire zone combinations are not

truncated in this screening step.

One additional important piece of information gained from these cut sets

is the identification of the remaining plant locations where zone-to-zone

barriers need to be analyzed. Dominant cut sets which contain adjacent

fire zones are analyzed for barrier failure in the quantification

process.

Step 3. Cull Fire Zones on Frequency

Cut sets not eliminated in the first three screening steps will be

resolved by utilizing fire-zone-specific initiating event frequencies

that are calculated using the method described in Section 4.2.

4-7
Also, operator recovery of non-fire-related random failures will be

included. For screening purposes only all short-term (less than 24 hr)

recovery action failure probabilities (of non-fire failures) will be

increased from their respective internal events probabilities by a factor

of five to allow for the additional confusion of the fire situation

occurring in conjunction with other random failures. If recovery actions

are long term (greater than 24 hr) no modification to internal event

probabilities is deemed appropriate. It is felt that by this time the

fire will be extinguished and any spurious signals will have terminated

in open circuits.

Step 4. Confirmatory Plant Visit

For those remaining fire zones all fire-related failure scenarios are

identified. A scenario can be thought of as a combination of one or more

fire-related equipment failures within a fire zone with or without

additional non-fire-related (random) failures outside of the fire area.

These failure combinations must minimally lead to core damage. Each fire

zone can have one or more scenarios depending on the equipment

combinations which must fail due to the fire in that particular area. A

second plant visit will then be conducted to determine which of these

scenarios are valid based upon cable or equipment locations within a

particular fire zone. For instance, if a given scenario requires the

fire-related failure of cabling for components A and B, and it can be

shown that these cables are always separated by greater than 40 ft and

the area is sufficient size to preclude buildup of the hot gas layer or

one of the component's cabling is in a 3-hr rated fire wrap, then these

types of scenarios can be eliminated from further consideration. Past

experience with fire code calculations (discussed in the following

section) and fire testing provides much of the basis for assessing the

validity of the scenarios.

4.5 Fire Propagation Modeling

The COMPBRN fire growth code (Ref. 7) will be used to calculate fire

propagation and equipment damage. COMPBRN was developed specifically for

use in nuclear power plant fire PRAs. The code calculates the time to

damage critical equipment given that a fire has started. This failure

time is then used in conjunction with information on fire suppression to

obtain the probability that a given fire will cause equipment failure

which leads to core damage before the fire can be suppressed. The latest

version of the code, COMPBRN III (Ref. 8), with some additional

modifications, is used for the calculations.

COMPBRN follows a quasistatic approach to simulate the process of fire

during the preflashover period in an enclosure. COMPBRN uses a zone

model breaking the fire environment into three zones: flame/plume, hot

gas layer, and ambient (see Figure 4.1). Simple fire and heat transfer

models and correlations are employed to predict the thermal environment

as a function of time. The thermal response of various targets in the

fire scenario is modeled to predict the amount of time required for a

4-8
COMPBRN Modeling

I ..

Ceiling

Cable ,7 -IU

Trays I

I 4 4 COMPBRN 4

Modeling 4 0 a 16 0

0 0 6

K4 0

Hot Gas

. -Layer

e

I

Plume

I

I

I

/

I

I

I

I

I

I

Convection

and

Radiation

Modeled

" Fite Modeled as a Cylinder

" Cable Trays Discrelized Into Fuel Elements

" Hot Gas Layer Effects

Figure 4.1 Fire Zone Geometry Considered in the COMPBRN Code

4-9
fire to damage or ignite critical equipment. The critical equipment is

generally taken to be a cable tray carrying cables necessary for safe

shutdown of the plant, although other critical components such as pumps

may be modeled.

The original version of COMPBRN, now referred to as COMPBRN I, has been

used to calculate damage time in the majority of fire PRAs to date.

However, the code calculations are thought to be ultra-conservative due

to the neglect of heat losses from the targets. A critical assessment of

the code containing this and other problems has been performed (Ref. 3).

In response to these problems with COMPBRN I, two later versions of the

code were developed, COMPBRN II and COMPBRN III (Ref. 8). Neither of the

later versions of the code has been extensively validated or compared to

data, but presumably represent various degrees of improvement.

As a part of a recent study (Ref. 3) on nuclear power plant fire risk

assessment, the latest version of the code (COMPBRN III) was selected to

requantify fire damage times from several fire PRAs. Initial attempts to

use COMPBRN III in the requantification resulted in the observation of

problems with and nonphysical behavior of the code. Many of the code

calculations could not be explained on a physical basis. As a result of

the observed nonphysical behavior of the code, an effort was undertaken

to identify problem areas and to suggest and implement modifications to

the code which make the code predictions more reasonable on a physical

basis. It was this modified version of the COMPBRN code which is used to

provide the fire propagation analysis for this methodology. References 3

and 9 provide detailed discussions of the problems which were identified

and addressed in the modified version of the code:

a. An error, and nonconservative assumption, exists in the forced

ventilation hot gas layer model, predicting low hot gas layer

temperatures.

b. Radiative heat transfer directly above the flame is not modeled,

yielding cooler temperatures directly above the flame than off to

the side of the flame.

c. Two errors in the calculation of view factors overpredict the

heat radiated to targets to the side as compared to objects

directly above the flame.

d. Only convective heat transfer, and not the dominant radiative

heat transfer for objects directly engulfed in the flame, is

modeled. Time to ignition is highly nonphysical.

e. The conduction algorithm is unstable, often resulting in

premature termination of the code, especially for cases involving

objects in the flame or thermal response of barriers.

f. The mass burning rate of burning objects is underpredicted due to

lack of thermal feedback modeling.

4-10
g. Cable insulation ignition and damage failure threshold criteria

are not currently well understood and the results are quite

sensitive to the input parameters chosen.

Both small and large fires will be postulated in the fire growth

calculations. If neither of these fire sizes is shown to be capable of

causing damage, fire size will be increased to determine how large a fire

would actually have to be to cause damage. A small fire will be assumed

to be 2 feet (0.61 m) in diameter and consist of I gallon (3.8 1) of oil.

A large fire will be assumed to be 3 feet (0.91 m) in diameter and

consist of 10 gallons (38 1) of oil. Analysis of a data base of

transient combustible fuel sources found at nuclear power plants (Ref.

10) indicates that oil sources less than or equal to I gallon (3.8 1)

were found approximately 70 percent of the time. Oil sources larger than

this were found approximately 30 percent of the time. A similar

partitioning between small and large quantities in terms of heat content

(BTU or KJ) can be made for other credible transient combustible sources

such as solvents or trash paper. Again, analysis indicates that a 70/30

partitioning between small and large fuel sources is appropriate (within

± 10 percent). It can also be shown that 10 gallons (38 1) of oil bounds

any large solvent or trash paper combustible source in terms of heat

content and is, therefore, an appropriate upper bound on transient

combustible fuel source size.

A plant walkdown will be performed to obtain vital information for the

COMPBRN calculations. This information includes the location of critical

equipment and cable trays, separation between redundant trains, types of

cable present, and any shielding of fire barriers that may be present.

Cable insulation and damage thresholds are currently not well known (Ref.

11). For this study, a cable insulation ignition temperature of 7730K

(932°F) is assumed along with a damage temperature of 6230K (662°F). For

the large fire simulations these thresholds are not as critical to the

fire damage time calculations because of the intensity of the flames.

A list of typical parameters for the COMPBRN calculations is shown in

Table 4.2 These parameters were selected based on past fire analyses at

commercial nuclear facilities to represent typical qualified cable

insulation.

A number of fire scenarios are typically considered for many fire areas.

In most cases, a "zone of influence" will be determined for the equipment

and fire sizes modeled. In other words, the fire location will be varied

in the COMPBRN models to determine the maximum distance the fire could be

away from the critical equipment and still cause damage. This, in

effect, defines a radius on the floor anywhere in which a fire of a given

size could occur and cause damage (although the time to damage, of

course, varies with the distance fromi the target). This sensitivity

study (zone of influence determination) is done for the two fire sizes

described above and, of course, a different radius on the floor is

determined for each of the fire sizes. In general, two situations can

result:

4-11
Table 4.2

Modified COMPBRN III Input Parameters

Cable Insulation Parameters

Density

Specific Heat

Thermal Conductivity

Heat of Combustion

Combustion Efficiency

Critical Temperature

Pilot Ignition

Spontaneous Ignition

Damage

Surface Controlled Burning Rate

Burning Rate Radiation Augmentation

Radiative Fraction

Smoke Attenuation Factor

Reflectivity

Oil Parameters

Density

Specific Heat

Heat of Combustion

Combustion Efficiency

Surface Controlled Burning Rate

Radiative Fraction

Mass of Oil

1715 kg/M3

1045 J/kg-K

0.092 W/m-K

1.85-2.31E-7 J/kg

0.6-0.8

7730K

7730K

6230K

0.0001-0.0075 kg/m3 -S

1.86E-7 kg/J-m2

0.3-0.5

1.4

0.1-0.3

900 kg/m3

2100 J/kg-K

4.67E7 J/kg

0.9

0.06

0.3-0.5

3.4-34.0 kg

4-12
a. If both fire sizes can cause damage to the target a fire cut set is

evaluated for each fire size. The fire occurrence frequency for each

cut set is ratioed down by the conditional probability of the fire

size occurring as well as the size of the floor area over which

damage can result.

b. If the small size fire cannot cause damage (even directly under the

target) but the large f ire can, then only a single cut set need be

evaluated and the total fire frequency is reduced by the ratio of the

floor area over which the large fire can cause damage to the total

fire zone floor area and also by a severity factor to account for the

fact that most fires that will occur will be of insufficient

magnitude to cause damage.

If it is found, however, that even the large pool fire (directly under

the target) cannot cause damage, then the fire pool size is increased (up

to six feet) and COMPBRIN is rerun again to see if any damage can occur.

This is done so that no cut set is lost due to the fact that only two

discrete pool sizes are used. If, for example, a large pool fire of

diameter of four feet is found to cause damage (whereas the initial large

fire of three foot diameter did not cause damage) then the cut set is

retained and the fire frequency is partitioned even further. This

assures that cut sets are not lost due to the discrete nature of the

calculations being performed by COMPBRN and the discrete fire sizes

recommended.

The times to damage increase exponentially as the fire distance

increases. Using these results, the floor area in which a fire would

have to occur to damage critical cables can be estimated. An area ratio

can then be calculated by dividing this area by the total floor area of

the room, fire area, or building (as appropriate). This reduction factor

can then be multiplied by the initiating frequency to estimate the

frequency of fires which occur in a critical portion of a given room.

It should be noted that a small fire, except for zone of influence cases,

does not yield damage in most fire areas. Prior experience with COMPBRN

shows that a small fire must be very close to its target to yield damage.

Large fires, however, can and do yield damage in most cases. The major

exception is in small closed rooms (like a battery room) in which a hot

gas layer rapidly develops. In such cases, the hot gas layer effects

become quite significant. Thus, for some of the COMPBRN runs, room

parameters are used in order to simulate a model of the hot gas layer.

For these cases, damage occurs sooner due to the increased thermal input

from the hot gases.

It has been found in past experience with COMPBRN and in some of the

simulations for Peach Bottom that the COMPBRN results can be quite

sensitive to fires located adjacent to walls which are in close proximity

to the target cable trays. Using the typical model of the wall as one

section results in unrealistic radiative heat fluxes from the wall to the

4-13
cable trays of interest. For these cases, the wall is divided into

several sections to more realistically calculate the wall thermal

response. It is recommended that the wall area be divided into three

vertical sections with the section closest to the fire having the same

horizontal dimension as the fire diameter. The other two sections

equally divide the remaining wall area. Without this division, COMPBRN

will predict a constant temperature along the entire wall surface in the

horizontal direction. The predicted temperature is thus overestimated

for all points except that with the closest distance to the fire. The

effect is that re-radiation from the wall at a higher temperature

predicts damage in shorter time frames than a more realistic temperature

profile would.

4.6 Barrier Failure Analysis

In the unscreened cut sets where a potential for barrier failure has been

identified, barrier failure probability will be estimated using barrier

failure rates developed as described below.

Barriers are grouped into three types: (1) fire doors, security doors,

water-tight doors, and fire curtains, (2) fire dampers and ventilation

dampers; and (3) penetration seals and fire walls. The data base

contains 628 records from when construction began on any given plant to

the end of June 1985. The number of barriers of each type at a plant is

required to estimate the rate at which a specific component fails. The

number is not known precisely for each plant, but a nominal figure that

has been estimated for each barrier type is given in Table 4.3.

The generic barrier failure rates are determined based on estimates of

barrier failure rates for each individual type of barrier, i.e., fire

damper, door, etc. For a given fire zone, the total barrier failure rate

is determined as the union of the probabilities of the individual barrier

failure rates. Thus, this is entirely plant specific, as the number and

type of barriers in any given zone is plant specific.

The statistical uncertainty of each estimate, reflecting sampling

variation and plant-to-plant variation, is represented by 90 percent

confidence bounds. These estimates and confidence bounds are given in

Table 4.4 where units of both estimates and bounds are failures/year.

During the confirmatory plant visit scenarios require barrier failure

will have those barriers inspected. If no plant-specific vulnerabilities

(i.e. , barriers missing or not intact in its normal configuration) are

noted as a result of this inspection, no modification of generic barrier

failure rates will be performed.

4.7 Recovery Analysis

For those remaining cut sets which survive the screening process and

where the COMPBRN code predicts fire damage will occur, recovery of

random failures and credit for extinguishment of the fire before the

COMPBRN predicted time to fire damage will be applied.

4-14
Table 4.3

Approximate Number of Barriers at a Plant

Tvpe Nominal

1 150

2 200

3 3000

Table 4.4

Estimates of Single Barrier Failure Rate

5% 90%

Barrier Barrier/ Confidence Confidence

Type Unit Estimate Bound Bound

1 150 7.4E-3 0.0 2.4E-I

2 200 2.7E-3 0.0 2.2E-1

3 3000 1.2E-3 0.0 3.7E-2

An important component in determination of the frequency of fire-induced

core damage scenarios is the ability of the plant fire brigade to respond

to and extinguish fires in a timely fashion before damage can occur to

plant systems and components important to safety. The COMPBRN fire

propagation code predicts the time to ignition or damage of critical

cables and components. The COMPBRN predicted fire-induced equipment or

cable damage times are used in conjunction with a distribution on time to

suppression of fires to obtain the probability that a given fire will

damage critical safety equipment before it can be suppressed.

The probability of nonsuppression of a given fire has been determined

from a data base on fire suppression times (Ref. 4) and developed in the

Fire Risk Scoping Study (Ref. 3). The result is a cumulative probability

distribution function which gives the probability that a fire has not

been suppressed as a function of time. This distribution function is

used in conjunction with the results of the COMPBRN code calculations,

4-15
which predict the time to failure for a given piece of equipment in a

given fire zone. The time to failure is input into the nonsuppression

probability distribution and the result is the probability that the fire

has not been extinguished prior to the time that the component will fail

due to the fire. This term is in every fire cut set. Given the COMPBRN

results which typically predict fire damage in 2 to 15 minutes an

adequate bound on the uncertainty is assumed to be +15 minutes. This

uncertainty estimate was determined based on consultation with fire code

and testing experts.

Recovery of random failures (non-fire related) is treated in a similar

fashion as in the internal events analysis (Ref. 10). All operator

recovery actions that are used in the internal events analysis will be

inspected for use where appropriate in the remaining cut sets. If a

sequence is long term (greater than 24 hrs), two recovery actions will be

allowed. In short-term (less than 24 hrs) sequences only one recovery

action will be allowed. A particular recovery action will be chosen if

the possibility of multiple recovery actions is present on a hierarchy

(based on the highest likelihood of successful recovery) established by

the internal events analysts.

In the areas where fire-fighting activity takes place, no credit will be

given for local recovery actions until after the fire is extinguished.

In non-affected areas, local recovery is allowed for valve manipulation

or pump operation when damage to power cabling of an applicable component

has not occurred.

The recovery analysis will also give credit for automatic extinguishment

of a fire before damage occurs. As part of the plant walkdown, plantspecific aspects such as (1) type of detection and actuation, (2)

detector spacing, (3) actuation delay times, (4) required fire location,

(5) predicted fire damage times, and (6) type of suppression will be

utilized to determine if generic system reliability data will be applied.

Failure rates (on demand) for the three types of fire systems (water

deluge, CO2 and Halon) were developed based on a literature review (Refs.

11 through 14). Table 4.5 lists the failure probabilities given a system

demand for each of the three system types.

Based on this literature search best estimate values for system

reliability for water, Halon, and CO2 were taken to be 96%, 94%, and 96%

respectively.

4.8 Uncertainty Analysis

Distributions on fire frequency, fire suppression probability, fire code

calculations, random failure probability, barrier failure probability,

and operator recovery actions generate uncertainties on fire-induced core

damage frequencies.

4-16
Table 4.5

Automatic Suppression System

Failure Rates (On Demand)

System Failure Rate

Water Deluge 0.04911

O.03814

0.006312

Halon 0.2011

0.059*

0.053614

CO2 0.11611

0. 0413

0. 00212

The uncertainty of these values is propagated through the kccident

sequence models using two computer codes. A Latin Hypercube Sampling

(LHS) algorithm is used to generate the samples for all of the parameter

values (Ref. 15) while the Top Event Matrix Analysis Code (TEHAC) is used

to quantify the uncertainty of the accident sequence equation using the

parameter value samples generated by the LHS code (Ref. 16).

LHS is a constrained Monte Carlo technique which forces all parts of the

distribution to be sampled. The LHS code is also flexible in that it can

sample a variety of random variable distributions. Furthermore,

parameter distributions for similar events can be correlated. For

example, if two similar components (e.g., MOV XX-FTO and MOV YY-FTO) are

modeled from the same probability distribution, then the sampling of

these two distributions is perfectly correlated, meaning the same value

is used for both events in a given sample member. For basic events which

are modeled with very similar but slightly different distributions (e.g.,

MOV XX fails to remain closed for 100 hrs and MOV YY fails to remain

closed for 200 hrs), the LHS code permits an induced correlation between

the samples. However, LHS does not allow the correlation coefficient for

this case to be equal to 1.0. LHS does permit sampling with a

coefficient of 0.99 in these cases.

* Letter from SAIC Senior Staff Scientist Bill Parkinson to John

Lambright, Dated May 3, 1988.

4-17
TEMAC uses the LHS parameter samples and the accident sequence equations

(cut sets) as input to quantify the core damage estimates. TEMAC

generates a sample of the accident sequence frequency, a point estimate

of the frequency, and various importance measures and ranking for the

base events.

Uncertainty on fire-initiating event frequency will be developed when the

generic fire frequencies are updated using plant data. This process

which is briefly discussed in Section 4.2 is covered in more detail in

Reference 5.

Uncertainty on fire nonsuppression probabilities (Q(tG)) will be

addressed by modification of COMPBRN predicted time to damage. The

COMPBRN predicted time to damage and its associated non-suppression curve

probability are taken to be a best estimate of a maximum entropy

distributed variable. Fifteen minutes will be added and subtracted from

the COMPBRN predicted time to allow for uncertainty in its result and the

uncertainty in the probability of nonsuppression distribution. These

probabilities are then taken as a minimum and maximum of a maximum

entropy distribution, respectively. The maximum entropy distribution is

the simplest distribution one can envision for a random variable for

which a lower bound, an upper bound and a mean value are known or

estimated and its use is appropriate when nothing else is known about the

distribution.

Uncertainty associated with the fire size estimate factor (f.) can be

developed utilizing information associated with plant inspection reports

which survey different types of combustibles and their amounts found in

nuclear power plants. Two fire sizes, a large and small fire, are

modeled as described in Section 4.5. These fire sizes (BTU content) are

compared to the distributions on possible fire sizes developed for the

different combustibles from the I&E data. The best estimate percentage

of fires that were either large or small is taken from an average of the

different types of combustibles for an equivalent BTU level fire modeled

by COMPBRN. This probability is assumed to be the best estimate value of

a maximum entropy distribution. Maximum and minimum probabilities for

this distribution are assumed to be based on one individual type of

combustible with either the maximum or minimum percentage corresponding

to applicable fire size (BTU rating).

Uncertainties in random failure events and operator recovery actions will

be treated identically as in the NUREG-1150 internal events analysis. No

modification needs to be made for the fire analysis.

Uncertainty in probability of automatic suppression system reliability

were developed using the data referenced in Table 4.5. For each type of

suppression system the upper and lower bounds were assigned based on the

additional data values not assigned as best estimate probabilities.

These data values were then represented by a maximum entropy

distribution.

4-18
The fire zone partitioning factor (fa) reduces the building fire

frequency down to that portion applicable to the fire zone in question.

Uncertainty in this factor is obtained by computing the partitioning

factor three ways; based on floor area, based on number of electrical

components in the zone versus total in the building, and by amount of

cable in the zone versus the total. -Typical bands are multiplicative

factors of 5.0.

The local area partitioning factor reduces the fire zone fire initiating

frequency by the ratio of the floor area within the room over which the

fire must occur to the total zone floor area, and as described previously

is based on COMPBRN sensitivity runs. The uncertainty in this parameter

is due to uncertainties in COMPBRN input parameters, uncertainties in the

COMPBRN models themselves, and uncertainties in the physical location of

the target components. This latter uncertainty often turns out to be the

most important source of uncertainty. Our experience leads us to

recommend a multiplicative factor of 5, but this could be reduced by

greater knowledge of component and cable locations.

Some additional potential areas of risk which could be analyzed by use of

this critical area methodology are identified as follows:

a. Effects due to suppression activities (both automatic and

manual) on safety equipment. This includes suppression effects

in the zone where the fire is as well as the effects in other

areas.

b. Effects due to smoke, corrosive gases and humidity changes

caused by a fire on safety-related equipment.

c. Electrical independence between control room circuits and remote

shutdown type panels (either one central panel or several small

panels located in different zones) that allow for control of

safety equipment if the control room is evacuated.

Sensitivity analyses will be performed as identified on a plant-specific

basis. Plant-specific sensitivity studies should be conducted on those

assumptions in the fire analysis that are the most dominant contributors

to the overall results. Such factors can be readily identified during

the cut set quantification process.

4.9 Conclusion

By use of this methodology, the frequency of significant fire threats to

a nuclear power plant can readily be quantified. Significant reductions

in time and cost of analysis are accomplished with the aid of a

previously completed internal events analysis.

4-19
This methodology results in a similar level of detail to that of the

internal events and seismic studies. By use of the same fault trees and

event trees, these results can be compared directly to core damage

estimates from either internal events or seismic initiators. This allows

any given nuclear power plant to have a consistent basis on which to make

any decisions as to the relative effect of any potential plant

modifications. Studies based on engineering judgment alone (without the

aid of a computer-based critical area analyses) have been shown to miss

many significant fire area contributors to fire-induced core damage

frequency. Fire threat analysis supports the NUREG-1150 document as part

of a comprehensive external events risk profile.

4-20
4.10 References

1. Seabrook Station Probabilistic Safety Assessment, Section 9.4, Public

Service Company of New Hampshire and Yankee Atomic Electric Company,

December 1983.

2. Severe Accident Risk Assessment Limerick Generating Station, Chapter

4, Main Report, Philadelphia Electric Company, Report #4161, April

1983.

3. Lambright, J. A., et al., Fire Risk Scoping Study: Current

Perception of Unaddressed Fire Risk Issues, Sandia National

Laboratories, Albuquerque, NM, SAND88-0177, NUREG/CR-5088, December

1988.

4. Wheelis, T., Users Guide for a Personal-Computer-Based Nuclear Power

Plant Fire Data Base, Sandia National Laboratories, Albuquerque, NM,

SAND86-0300, NUREG/CR-4586, August 1986.

5. Iman, R. L., and Hora, S. C., Modeling Time to Recovery and

Initiating Event Frequency for Loss of Off-Site Power Incidents at

Nuclear Power Plants, Sandia National Laboratories, Albuquerque, NM,

SAND87-2428, NUREG/CR-5032, January 1988.

6. Worrell, R. B., SETS Reference Manual, Sandia National Laboratories,

Albuquerque, NM, SAND83-2675, NUREG/CR-4213, May 1985.

7. Siu, N.O., COMPBRN - A Computer Code for Modeling Compartment Fires,

University of California, UCLA-ENG-8257, NUREG/CR-3239, May 1983.

8. Ho, V., Siu, N. 0., and Apostolakis, G., COMPBRN III - A Computer

Code for Modeling Compartment Fires, University of California, UCLAENG-8524, November 1985.

9. Ruger, C., Boccio, J. L. and Azarm, M. A., Evaluation of Current

Methodology Employed in Probabilistic Risk Assessment (PRA) of Fire

Events at Nuclear Power Plants, Brookhaven National Laboratory,

NUREG/CR-4229, May 1985.

10. Swain, A. D. and Guttman, H.E., Handbook of Human Reliability

Analysis with Emphasis on Nuclear Power Plant Applications, Sandia

National Laboratories, Albuquerque, NM, SAND80-0200, NUREG/CR-1278,

August 1983.

11. Northeast Utilities, Millstone 3 PRA, Appendix 2-K, 1983.

12. Galluci, R. A Methodology for Evaluating the Probability for Fire

Loss of Nuclear Power Plant Safety Functions, PhD. Thesis, Rensselaer

Polytechnic Institute, Troy, NY, May 1980.

4-21
13. Taiwan Power Company, Maanshan Fire PRA, Appendix D, 1987.

14. Levinson, S. and Yeater, M., Methodology to Evaluate the

Effectiveness of Fire Protection Systems at Nuclear Power Plants,

Nuclear Engineering and Design, 1983.

15. Iman, R. L. and Shortencarrier, M. J., A FORTRAN 77 Program and

User's Guide for the Generation of Latin Hypercube and Radom Samples

for Use with Computer Models, Sandia National Laboratories,

Albuquerque, NM, SAND83-2365, NUREG/CR-3024, March 1984.

16. Iman, R. L. and Shortencarrier, M. J., A User's Guide for the Top

Event Matrix Analyses Code (TEMAC), Sandia National Laboratories,

Albuquerque, NM, SAND86-0960, NUREG/CR-4598, August 1986.

4-22
APPENDIX A

FIRE EVENT DATA TABLE

A-1
Table A. 1

Auxiliary Building Fires

Plant

Name

San Onofre 1

San Onofre 1

Date of

Occurrence

2/7/68

3/9/68

6/25/71

Plant

Status

Power

Operation

Power

Operation

Cold

Shutdown

Power

Operation

Power

Operation

Fire

TvXe

Cable

Cable

>I Palisades Air Dryer

Filter

Circulation

Pump

LaCrosse 7/15/72

12/16/72

Remarks

Thermally overloaded 480 V

cables caught fire--55 cables

damaged.

Thermally overloaded cables

in switchgear room.

Low flow of air through air

dryer resulted in temperature

buildup and ignition of filter.

Oil on pump lagging ignited

by hot pump casing.

Battery charger overheated

and a small fire occurred in

the transformer winding

insulation.

Cigarette or welding slag

from construction workers

ignited combustible expansion

Joint material.

Same type of event as

previous event--occurred one

week apart.

Turkey Point 3 Battery

Charger

Robinson 2

Robinson 2

4/19/74

4/19/74

Power

Operation

Power

Operation

Expansion

Joint

Expansion

Joint
Table A. 1

Auxiliary Building Fires (Continued)

Plant

Name

Turkey Point 3

Date of

Occurrence

5/75

Millstone 2

Dresden 2

3/24/76

4/76 Ii

Plant

Status

Power

Operation

(100%)

Hot

Shutdown

Cold

Shutdown

Power

Operation

(93%)

Hot

Shutdown

Hot

Shutdown

Power

Operation

(88%)

Fitzpatrick

Fire

Twe

6/11/76

11/15/76

.. 3/77

Battery

Charger

Motor

Control

Center

Circuit

Breaker

Circuit

Breaker

Relay--

MCC

Circuit

Breaker

Circuit

Breaker

Overload in HPCI

circuit breaker.

by d&-energizing

Remarks

Transformer overheated igniting

insulation. Similar to

previous event on 12/14/72.

Fire resulted from arcing of

a supply lead. Extinguished

by de-energizing MCC.

ECCS Jockey Pump control feed

breaker caught fire from a

burned-out contacter coil.

valve

Extinguished

breaker.

Millstone 2

Pilgrim 1

Relay fire in motor control

center.

Circuit breaker under-voltage

coil burnt due to high floating charge on station battery.

Coil failed by fire in HPCI

test valve breaker and extinguished by de-energizing.

Similar to 7/28/75 event.

Fitzpatrick 4/4/77
Table A. 1

Auxiliary Building Fires (Continued)

Plant

Name

Date of

Arnold

Salem 1

5/7/77

6/30/77

4/13/78

7/16/78

I

Unknown

Robinson 2

Plant

status

Refueling

Outage

Power

Operation

Power

Operation

Power

Operation

Power

Operation

Cold

Shutdown

Fire

Tume

Circuit

Breaker

Relay- -

Cabinet

Circuit

Breaker- -

MCC

Battery

Remarks

Breaker relay failed, burning

open and starting phase

burner material above it on

fire.

Fire detection instrumentation

panel fire due to relay failure.

Failure breaker contact due to

improper maintenance--occurred

in motor control center.

Resistance heating of terminal

connection ignited plastic tops

of two cells of a battery.

Defective terminal or connections not secured.

LPSI pump motor on fire (being

used for shutdown cooling) due

to incorrect installation of

motor bearings resulting in

shorting of rotor with the

stator.

Unknown

Arkansas

Nuclear

One 1

7/27/78

8/16/78

Battery

Terminal

Pump

Motor

Salem 1 1/79 Power

Operation

(95%)

Trans former Moisture in the windings

resulted in a short and

subsequent fire.
Table A. 1

Auxiliary Building Fires (Continued)

Plant

Name

Date of

Occurrence

Palisades 4/4/79

San Onofre 1 11/27/79

!' Hatch 2 4/80

Plant

Status

Power

Operation

(100%)

Power

Operation

(100%)

Cold

Shutdown

Power

Operation

Power

Operation

(100%)

Power

Operation

Fire

Type

Battery

Switchgear

Cable

Remarks

Battery burst due to internal

explosion of hydrogen ignited

by a test lead being used to

measure voltage.

Rodents shorted two phases of a

480-V bus in the switchgear room.

A loose connection resulted in

a wire of an RPS motor

generator set breaker burning.

Fire involving-supply bus

occurred in switchgear room.

A filtering capacitor in a vital

bus transformer'caught fire

damaging the transformer.

Circuit breaker caught fire when.,

it failed to close properly

because contacts were out of

adjustment.

Air sample inlet valve motor

issued smoke. Power was removed

from motor.

Unknown BWR 4/15/80

6/3/80

Bus

Peach Bottom 1 Transformer

Unknown PWR 7/6/80 Circuit

Breaker

Unknown PWR 10/2/80 Power

Operation

Valve Motor
Table A. 1

Auxiliary Building Fires (Continued)

Plant

Name

Date of

Occurrence

Trojan

Palisades

12/31/80

1/24/81

San Onofre 1

Indian Point 2

North Anna 1

7/17/81

8/10/81

11/11/81

11/23/81

Plant

Status

Power

Operation

(100%)

Power

Operation

(98%)

Cold

Shutdown

Power

Operation

(100%)

Power

Operation

Cold

Shutdown

Power

Operation

(78%)

Circuit

Breaker

Pump

Motor

Fire

Tvoe

Gas Decay

Tank

Remarks

Breaker stab misaligned causing

ignition of plastic dust

collector by arcing.

Component cooling water pump

motor caught fire due to

bearing failure from loss of

lubricating oil.

Explosion of H, in recombiner.

Short circuit within SI pump

caused fire and an overload

trip of its supply breaker.

Main feedwater pump fire.

Insulation breakdown caused

fire in a reactor low-low RPS

relay.

Supply breaker for MG set

caught fire.

Pump

Motor

Pump

Hatch 1 Relay

Point Beach 1 10/15/82 Circuit
Table A. 1

Auxiliary Building Fires (Continued)

Plant

Name

Date of

Occurrence

Salem 1

Brunswick 1

11/9/82

11/27/82

>,I

Plant

StatusCold

Shutdown

Power

Operation

(68%)

Power

Operation

(100%)

Refueling

Power

Operation

(100%)

Relay

Battery

Charger

Fire

Type Remarks

Relay failure resulted in a

fire in a fire detection

instrumentation panel. Fire

detectors for switchgear

rooms, battery room, and DC

area were rendered inoperable.

Resistor on charger amplifier

board opened causing a voltage

increase and capacitor failure.

Loss of lubrication oil

resulted in high bearing

temperature and smoke.

Following a loss of offsite

power, a fire occurred in a

transformer between emergency

buses.

Welding operation started a

fire in conduit surrounding a

cable (letdown valve).

Oconee 2 2/3/83 Pump

Motor

Brunswick 1

Oconee 3

4/26/83

5/25/83

Transformer

Cable and

Conduit
Table A. 1

Auxiliary Building Fires (Concluded)

Fire

Plant

Name

Date of

Occurrence

Plant

Status

Cold

Shutdown

Fire

Tvr e

Transformer Salem 2 6/20/83

Peach Bottom 1

Yankee Rowe

9/9/83

8/2/84

Power

Operation

(100%)

Power

Operation

(100%)

Control

Panel

Circuit

Breaker

Remarks

Transformer breaker tripped on

overcurrent and was reclosed.

Fire occurred immediately

thereafter.

Water entered a control room

ventilation chiller control

panel shorting motor starter

contacters.

High resistance in the main

disconnecting contacts of the

center phase of the breaker

caused an arc to propagate to

outside phases.
Table A. 2

Reactor Building Fires

Plant

NQame

Quad Cities 1

Date of Plant

Power

Operation

Fire

Ixge

Oil,

Insulation

12/10/72

Peach Bottom 1 12/22/72 Power

Operation

I0

Monticello 5/15/74 Hot

Shutdown

Hydrogen

Remarks

A small open flame was observed

within a RHR service-water pump

housing. Fire was set by

welding sparks on oil-soaked

insulation.

The motor on a residual heat

removal pump burst into flames

due to insufficient lubrication

to the lower bearing.

An off-gas ignition occurred

resulting in the rupture of

both air ejector discharge line

rupture discs.

An off-gas explosion occurred

when the 3A recombiner outlet

valve was opened.

A small oil fire occurred

underneath a reactor coolant

pump motor stand.

A hydrogen flame was in the

off-gas system burning at the

flow orifice or in the jet air

ejector.

Dresden 3 11/15/74

Oconee 2

Brunswick 2

1/31/75

4/14/77

Power

Operation

Hot

Shutdown

Power

Operation

Hydrogen

Oil

Hydrogen
Table A.2

Reactor Building Fires (Continued)

Plant

Name

Date of

Occurrence

Plant

Status

Power

Operation

Fire

Tyre

Hydrogen Brunswick 2 6/15/77 Following an off-gas overpressurization, a hydrogen fire

was detected downstream of the

steam jet air ejectors.

Smoke was noticed coming from

a supply breaker. Unknown BWR 2/10/78

9/4/79

Power

Operation

Power

Operation

Electrical

Oil,

Insulation Indian Point 2

I

0

A fire occurred in

coolant pump tube.

was saturated with

ignited.

the reactor

Insulation

oil and

Robinson 2 9/30/79 Power

Operation

Hot

Shutdown

Oil

San Onofre 1 ?/16/80 Oil,

Insulation

Lagging fire on cold leg

piping. Fire caused by

lubricating oil leak.

Oil from leaking reactor

coolant pump oil filter came

in contact with the hot pump

casing and ignited.

Fire resulted from lube oil

that leaked from a main

turbine shaft-driven feed

water pump.

Nine Mile

Point 1

4/22/80 Power

Operation

Oil
Table A. 2

Reactor Building Fires (Concluded)

Plant

Name

Date of

Occurrence

Pilgrim

Unknown IWR

2/24/81

11/7/81

Plant

Power

Operation

Power

Operation

Cold

Shutdown

Fire

Insulation

Electrical

[%=IUOL 9.

A fire was ignited by welded

sparks falling on temporary

foam rubber insulation.

Wiring harness was pinched off

inside a cabinet and

electrically shorted out.

Pipe vibrating loose leaked

onto a hot turbine casing.

Unknown BWR 2/12/82 Oil
Table A. 3

Control Room Fires

Plant

Name

Date of

Occurrence

Unknown 7/4/78

7/12/79

Plant

Status

Power

Operation

Cold

Shutdown

Fire

Type

Diode

Three Mile

Island 2

Circuit

Board

>!

Hatch 1*

Hatch 1*

3/12/83

3/30/83

Power

Operation

(94%)

Power

Operation

(34%)

Relay

Relay

Zener diode failed in an RPS

circuit.

Overheated resistor caused fire

in a radiation-monitoring

readout panel. Extinguished

immediately.

Low reactor water level RPS

relay burned causing a 1/2

scram (failed safe).

Extinguished by operators.

Scram discharge volume highlevel RPS relay burned a 1/2

scram (failed causing safe).

Extinguished by operators.

Same type of relay as in

previous event.

*Counted as one event for quantification of fire frequency.
Table A.4

Cable Spreading Room Fires

Plant

Name

Date of

Occurrence

Browns

Ferry 1 and 2

Peach Bottom 3

3/22/75

4/18/77

Plant

Status

Power

Operation

(100%)

Power

Operation

(25%)

Cable

Fire

Relay

Fire

Fire

Remarks

Spread from cable spreading

room to reactor building in

Unit 1 and affected Unit 2.

Fire in PCIS logic and RHR

valve relay.
Table A. 5

Switchgear Room Fires

Plant

Name

Date of

Occurrence

Unknown PWR 11/7/79

!

Unknown BWR

Unknown PWR

Yankee Rowe

4/15/80

7/6/80

8/2/84

Plant

Status

Power

Operation

Power

Operation

Power

Operation

Power

Operation

(100%)

Bus

Fire

40Ve

480-V Bus

Circuit

Breaker

Circuit

Breaker

Remarks

Fire involved 480-V bus; short

circuit caused by rodent

bridging two energized phases.

Fire involved supply bus in

switchgear room.

Fire involving switchgear room

breaker. Out of adjustment

control circuit completed.

A fault occurred in the 480-V

supply ACB to bus 4-1; high

resistance in the main disconnecting contacts caused an

arc to propagate from the

center phase to the outside

phases.
Table A. 6

Battery Room Fires

Plant

Name

Date of

Occurrence

"I

Robinson 2

Unknown

Palisades

7/16/78

7/27/78

4/4/79

Plant

Status

Power

Power

Operation

Power

Operation

(100%)

Battery

Battery

Battery

Fire

Mye Remarks

Plastic tops of two operation

cells of a station battery

caught fire; caused by resistance heating of a terminal

connection during the heavy dc

load of the emergency oil pump.

Fire caused by defective

terminal or unsecured

connections.

A test lead being used to take

battery voltage readings fell

and struck a battery connector,

causing a spark which ignited

hydrogen gas.

Battery charger capacitor

caught fire for unknown reason.

Brunswick 1 11/27/82 Power

Operation

(68%)

Capacitor
Table A.7

Turbine Building Fires

Plant

Name

Nine Mile

Point

Yankee Rowe

Date of

Occurrence

9/13/72

6/15/73

Plant

Status

Power

Operation

Power

Operation

Fire

Tvve

Oil,

Insulation

Oil,

Insulation

0' Unknown PWR

Unknown PWR

8/15/73

9/20/74

Power

Operation

Power

Operation

Power

Operation

Power

Operation

Unknown

Ping Pong

Balls

Remarks

Leak in oil supply line soaked

insulation and ignited when it

came in contact with hot pipe.

A fire started in oil-soaked

insulation around the highpressure turbine bearing

casing.

Fire around turbine areaunknown cause.

Cigarette ignited box of ping

pong balls--automatic deluge

system initiated.

Bus fault resulted in cable

insulation damage.

Leaking oil from a turbine oil

purifier ignited when it

contacted purifier heaters.

Cables above the fire charred.

Oil-soaked insulation.

Insulation fire on gland steam

lines under high-pressure

turbine.

Kewaunee

Unknown PNR

4/15/75

6/27/75

Bus

Oil

Haddam Neck 9/75 Power Oil,

Operation
Table A. 7

Turbine Building Fires (Continued)

Plant

Name

Unknown PWR

Saint Lucie 1

Date of

Occurrence

4/3/77

4/3/77

Plant

SStatus

Power

Operation

Power

Operation

Refueling

Fire

Hyd en

Hydrogen

Hydrogen

Cable

Insulation

Oyster Creek 1 5/77

I--

Peach Bottom 3 9/77 Power

Operation

Relays

LXcuIaL Mo

Leaking hydrogen at the

generator ignited. Purged with

CO2 by shift personnel.

Hydrogen leaked from turbine

and ignited. Generator inerted

with CO2.

Aluminum-to-copper bus terminal

connecters resulted in high

resistance and burned cable

insulation.

Three relays in feedwater

pump relay cabinet ignited.

Since flame retardant cables

were used in cabinet, fire did

not propagate.

Class B fire including the

auxiliary boiler.

Hydrogen fire under generator.

Purged with CO2 .

Fire in cable tray beneath the

turbine building operating

floor.

Unknown PuR

Cook 2

7/5/78

11/13/78

1/21/80

Power

Operation

Power

Operation

Power

Operation

Auxiliary

Boiler

Hydrogen

Cable

Insulation

Browns Ferry I
Table A. 7

Turbine Building Fires (Concluded)

Plant

Name

Date of

Occurrence

Cook 2

Unknown BWR

Sequoyah 1

Unknown PWR

Rancho Seco

12/15/80

7/24/81

1/19/82

2/4/82

3/19/84

00

Plant

-Status

Power

Operation

Power

Operation

Cold

Shutdown

Power

Operation

Power

Operation

Power

Operation

Power

Operation

Fire

TYl e

Electrical

LXVIIIG L E%~

Pump

Transformer

Hydrogen

Hydrogen

Fire in generator pilot

exciter.

Condensate booster pump binding

overheated and caught fire.

Neutral ground transformer

exploded activating deluge

system.

Hydrogen leaked from a bad seal

into the generator.

Hydrogen explosion occurred

following loss of H2 side seal

oil pump.

Fire in insulation at the

governor end of the highpressure turbine.

Transformer fire in yard

propagated to the turbine

building.

Indian Point 2

Arnold

10/22/84

11/4/84

Insulation

Transformer
Table A. 8

Diesel Generator Room Fires

Plant

Name

Duane Arnold

Duane Arnold

Millstone 2

Date of

Occurrence

3/17/76

4/17/76

9/15/76 I0

Plant

Status

Refueling

Outage

Power

Operation

Power

Operation

Power

Operation

Power

Operation

Power

Operation

Oil

Oil

Fire

Type

Oil,

Insulation

Remarks

The diesel flange gasket

leaked exhaust gases with

traces of oil onto the exterior

of the flange. The oil was

ignited by exhaust heat.

Oil leaked onto the diesel

exhaust manifold and caught

fire.

A small fire occurred on the

exhaust manifold at the control

end of the engine.

An operator disconnected a dc

tie breaker, tripping the

reactor and initiating safe

injection. The ma generator

was overloaded resulting in a

fire.

During testing a fire was

discovered in the exhaust the

emergency diesel generator.

A hairline fracture in a fuel

line fitting caused fuel to

spray out and be ignited by

heat from the exhaust header.

Zion 2

Fitzpatrick

Duane Arnold

9/15/76

10/15/76

11/4/76

Oil

Oil
Table A. 8

Diesel Generator Room Fires (Continued)

Plant

Name

Date of

Occurrence

0-

Unknown PWR

Calvert

Cliffs 1

Kewaunee

Unknown

Arkansas

Nuclear

One I

12/4/76

7/11/77

9/20/77

12/28/77

3/20/78

Plant

Status

Power

Operation

Power

Operation

Power

Operation

Power

Operation

Refueling

Outage

Oil

Oil

Fire Type

Carbon

Buildup

Remarks

During maintenance on the

emergency diesel, a filter was

ignited due to overheated oil.

A small fire developed when

lube oil sprayed from the lube

oil strainer and ignited on

contact with the exhaust

manifold.

A fire was caused by carbon

residue buildup in the

exhaust path through the

turbocharger.

Probable cause of fire was

combustible materials left in

close proximity to the diesel

exhaust stack.

Failure of bearing oil seal

allowed lubricating oil in the

turbocharger of the diesel

generator.

Oil

Arkansas

Nuclear

One 1

11/15/78 Refueling

Outage

Oil Fire in a diesel exhaust

manifold during a test.
Table A.8

Diesel Generator Room Fires (Continued)

Crystal

Plant

Name

Date of

Occurrence

Crystal

River 3

Unknown PWR

7/24/79

7/24/79

Crystal

River 3

Naine Yankee

Calvert

Cliffs 2

DavisBesse 1

10/15/79

10/15/79

3/7/80

7/15/80

9/23/80

Plant

Status

Hot

Shutdown

Power

Operation

Hot

Shutdown

Power

Operation

Power

Operation

Power

Operation

Cold

Shutdown

Fire

Oil,

Carbon

Electrical

A fire was caused in the

exhaust manifold of an

emergency diesel generator an

excessive fuel-rich mixture

aided by oil and carbon

accumulation.

A fire involved the excite

control cabinet of a diesel

generator.

Fire in the exhaust manifold

fuel-oil mix rich on start-

(test).

A diesel turbocharger failed

which resulted in a fire

within the exhaust system.

A small fire occurred in a

diesel generator room.

Oil

Oil

Fire in a turbocharger.

DavisBesse 1

Oil A diesel turbocharger failure

which resulted in a fire in

the exhaust pipe.
Table A. 8

Diesel Generator Room Fires (Continued)

Plant

Name

Unknown PWR

North Anna 1

Date of

Occurrence

3/9/81

4/15/81

Unknown BWR

Arkansas

Nuclear

One 2

5/15/81

6/30/81

Plant

Status

Power

Operation

Power

Operation

Power

Operation

Hot

Shutdown

Power

Operation

Power

Operation

Power

Operation

Fire

TXve

Oil,

Insulation

Oil

Electrical

Oil,

Insulation

LwppL .~p

Fire involved exhaust

manifold insulation.

An oil leak in the area of the

exhaust manifold started a small

fire.

Smoke filled diesel generator

building.

Oil leaked through a diesel

gasket onto insulation,

igniting a fire.

Lube oil spraying from a

cracked instrument line was

ignited by hot exhaust pipe

above the diesel engine.

An oil leak in the diesel

exhaust manifold caused the

fire.

Fire on oil-soaked insulation

on a diesel engine.

San Onofre 1

North Anna 1

7/14/81

7/16/81

Oil

Oil

Arkansas

Nuclear

One 1

7/27/81 Oil,

Insulation
Table A. 8

Diesel Generator Room Fires (Concluded)

Plant

Name

Date of

Occurrence

Zion 1 8/15/81

Plant

Status

Power

Operation

Power

Operation

Maintenance

Outage

Fire

Lmpe

Oil

w

Praire

Island 1

.Peach

Bottom 2

8/15/82

9/7/83

Oil

Remarks

Lube oil sprayed passed a

operation o-ring seal onto hot

exhaust manifold caused fire.

Turbocharger oil gasket filter

failure sprayed lube oil onto

hot exhaust manifold and ignited.

A diesel governor increased fuel

flow as a result of a turbocharger failure. Excess fuel

ignited in the exhaust.

A diesel fire was caused by a

leaking fitting on a fuel

injector line.

Oil

Peach

Bottom I

12/18/84 Cold

Shutdown

Oil

DISTRIBUTION:

Frank Abbey

U. K. Atomic Energy Authority

Wigshaw Lane, Culcheth

Warrington, Cheshire, WA3 4NE

ENGLAND

Kiyoharu Abe

Department of Reactor Safety

Research

Nuclear Safety Research Center

ToKai Research Establishment

JAERI

Tokai-mura, Naga-gun

Ibaraki-ken,

JAPAN

Ulvi Adalioglu

Nuclear Engineering Division

Cekmece Nuclear Research and

Training Centre

P.K.1, Havaalani

Istanbul

TURKEY

Bharat Agrawal

USNRC-RES/AEB

MS: NL/N-344

Kiyoto Aizawa

Safety Research Group

Reactor Research and Development

Project

PNC

9-13m 1-Chome Akasaka

Minatu-Ku

Tokyo

JAPAN

Oguz Akalin

Ontario Hydro

700 University Avenue

Toronto, Ontario

CANADA M5G lX6

David Aldrich

Science Applications International

Corporation

1710 Goodridge Drive

McLean, VA 22102

Agustin Alonso

University Politecnica De Madrid

J Gutierrez Abascal, 2

28006 Madrid

SPAIN

Christopher Amos

Science Applications International

Corporation

2109 Air Park Road SE

Albuquerque, NM 87106

Richard C. Anoba

SAIC

4900 Motors Edge Drive,

Raleigh, NC 27606

Suite 255

George Apostolakis

UCLA

Boelter Hall, Room 5532

Los Angeles, CA 90024

James W. Ashkar

Boston Edison Company

800 Boylston Street

Boston, MA 02199

Donald H. Ashton

Bechtel Power Corporation

P.O. Box 2166

Houston, TX 77252-2166

J. de Assuncao

Cabinete de Proteccao e Seguranca

Nuclear

Secretario de Estado de Energia

Ministerio da Industria

av. da Republica, 45-6*

1000 Lisbon

PORTUGAL

Mark Averett

Florida Power Corporation

P.O. Box 14042

St. Petersburg, FL 33733

Raymond 0. Bagley

Northeast Utilities

P.O. Box 270

Hartford, CT 06141-0270

Dist-1
Juan Bagues

Consejo do Seguridad Nucleare

Sarangela de la Cruz 3

28020 Madrid

SPAIN

George F. Bailey

Washington Public Power Supply

System

P. 0. Box 968

Richland, WA 99352

H. Bairiot

Belgonucleaire S A

Rue de Champ do Mars 25

B-1050 Brussels

BELGIUM

Louis Baker

Reactor Analysis and Safety

Division

Building 207

Argonne National Laboratory

9700 South Cass Avenue

Argonne, IL 60439

H-P. Balfanz

TUV-Norddeutschland

Grosse Bahnstrasse 31,

2000 Hamburg 54

FEDERAL REPUBLIC OF GERMANY

Patrick Baranowsky

USNRC-NRR/OEAB

MS: 11E-22

H. Bargmann

Dept. de Mecanique

Inst. de Machines Hydrauliques

et do Mecaniques des Fluides

Ecole Polytechnique do Lausanne

CH-1003 Lausanne

M.E. (ECUBLENS)

CH. 1015 Lausanne

SWITZERLAND

Kenneth S. Baskin

S. California Edison Company

P.O. Box 800

Rosemead, CA 91770

J. Basselier

Belgonucleaire S A

Rue du Champ do Mars 25, B-1050

Brussels

BELGIUM

Werner Bastl

Gesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

Anton Bayer

BGA/ISH/ZDB

Postfach 1108

D-8042 Neuherberg

FEDERAL REPUBLIC OF GERMANY

Ronald Bayer

Virginia Electric Power Co.

P. 0. Box 26666

Richmond, VA 23261

Eric S. Beckjord

Director

USNRC-RES

MS: NL/S-007

Bruce B. Beckley

Public Service Company

P.O. Box 330

Manchester, NH 03105

William Beckner

USNRC-RES/SAIB

MS: NL/S-324

Robert M. Bernero

Director

USNRC-NMSS

MS: 6A-4

Ronald Berryman [21

Virginia Electric Power Co.

P. 0. Box 26666

Richmond, VA 23261

Robert A. Barn

Brookhaven National

Building 130

Upton, NY 11973

Laboratory

Richard Barrett

USNRC-NRR/PRAB

MS: 1OA-2

Dist-2
Robert C. Bertucio

NUS Corporation

1301 S. Central Ave, Suite 202

Kent, WA 98032

John H. Bickel

EG&G Idaho

P.O. Box 1625

Idaho Falls, ID 83415

Gary J. Boyd

Safety and Reliability Optimization

Services

9724 Kingston Pike, Suite 102

Knoxville, TN 37922

Robert J. Breen

Electric Power Research

3412 Hillview Avenue

Palo Alto, CA 94303

Institute

Peter Bieniarz

Risk Management

2309 Dietz Farm

Albuquerque, NH

Association

Road, NW

87107

Adolf Birkhofer

Gesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

James Blackburn

Illinois Dept. of Nuclear Safety

1035 Outer Park Drive

Springfield, IL 62704

Dennis C. Bley

Pickard, Love & Garrick, Inc.

2260 University Drive

Newport Beach, CA 92660

Roger H. Blond

Science Applications Int. Corp.

20030 Century Blvd., Suite 201

Germantown, MD 20874

Simon Board

Central Electricity Generating

Board

Technology and Planning Research

Division

Berkeley Nuclear Laboratory

Berkeley Gloucestershire, GL139PB

UNITED KINGDOM

Mario V. Bonace

Northeast Utilities Service Company

P.O. Box 270

Hartford, CT 06101

Charles Brinkman

Combustion Engineering

7910 Woodmont Avenue

Bethesda, MD 20814

K. J. Brinkmann

Netherlands Energy Res. Fdtn.

P.O. Box 1

1755ZG Petten NH

NETHERLANDS

Allan R. Brown

Manager, Nuclear Systems and

Safety Department

Ontario Hydro

700 University Ave.

Toronto, Ontario M5GlX6

CANADA

Robert G. Brown

TENERA L.P.

1340 Saratoga-Sunnyvale Rd.

Suite 206

San Jose, CA 95129

Sharon Brown

E1 Services

1851 So. Central Place, Suite 201

Kent, WA 98031

Ben Buchbinder

NASA, Code QS

600 Maryland Ave. SW

Washington, DC 20546

R. H. Buchholz

Nutech

6835 Via Del Oro

San Jose, CA 95119

Dist-3
Robert J. Budnitz

Future Resources Associates

734 Alameda

Berkeley, CA 94707

Gary R. Burdick

USNRC-RES/DSR

MS: NL/S-007

Arthur J. Buslik

USNRC-RES/PRAB

MS: NL/S-372

H. Bustraan

Netherlands Energy Res. Fdtn.

P.O. Box 1

1755ZG Petten NH

NETHERLANDS

Nigel E. Buttery

Central Electricity Generating

Board

Booths Hall

Chelford Road, Knutsford

Cheshire, WA168QG

UNITED KINGDOM

Jose I. Calvo Molins

Probabilistic Safety Analysis

Group

Consejo de Seguridad Nuclear

Sor Angela de la Cruz 3, P1. 6

28020 Madrid

SPAIN

Annick Carnino

Electricite de France

32 Rue de Monceau 8EHE

Paris, F5008

FRANCE

G. Caropreso

Dept. for Envir. Protect. & Hlth.

ENEA Cre Casaccia

Via Anguillarese, 301

00100 Roma

ITALY

James C. Carter, III

TENERA L.P.

Advantage Place

308 North Peters Road

Suite 280

Knoxville, TN 37922

Eric Cazzoli

Brookhaven National Laboratory

Building 130

Upton, NY 11973

John G. Cesare

SERI

Director Nuclear Licensing

5360 1-55 North

Jackson, MS 39211

S. Chakraborty

Radiation Protection Section

Div. De La Securite Des Inst. Nuc.

5303 Wurenlingen

SWITZERLAND

Sen-I Chang

Institute of Nuclear Energy

Research

P.O. Box 3

Lungtan, 325

TAIWAN

J. R. Chapman

Yankee Atomic Electric Company

1671 Worcester Road

Framingham, MA 01701

Robert F. Christie

Tennessee Valley Authority

400 W. Summit Hill Avenue, WlOD190

Knoxville, TN 37902

J. F. Campbell

Nuclear Installations

St. Peters House

Balliol Road, Bootle

Merseyside, L20 3LZ

UNITED KINGDOM

Kenneth S. Canady

Duke Power Company

422 S. Church Street

Charlotte, NC 28217

Lennart Carlsson

IAEA A-1400

Wagramerstrasse 5

P.O. Box 100

Vienna, 22

AUSTRIA

Inspectorate

Dist-4
T. Cianciolo

BWR Assistant Director

ENEA DISP TX612167 ENEUR

Rome

ITALY

Thomas Cochran

Natural Resources Defense Council

1350 New York Ave. NW, Suite 300

Washington, D.C. 20005

Frank Coffman

USNRC-RES/HFB

MS: NL/N-316

Larry Conradi

NUS Corporation

16835 W. Bernardo Drive

Suite 202

San Diego, CA 92127

Peter Cooper

U.K. Atomic Energy Authority

Wigshaw Lane, Culcheth

Warrington, Cheshire, WA3 4NE

UNITED KINGDOM

C. Aiin Cornell

110 Coquito Way

Portola Valley, CA 94025

Michael Corradini

University of Wisconsin

1500 Johnson Drive

Madison, WI 53706

E. R. Corran

Nuclear Technology Division

ANSTO Research Establishment

Lucas Heights Research Laboratories

Private Hail Bag 7

Menai, NSW 2234

AUSTRALIA

James Costello

USNRC-RES/SSEB

MS: NL/S-217A

George R. Crane

1570 E. Hobble Creek Dr.

Springville, UT 84663

Mat Crawford

SERI

5360 1-55 North

Jackson, MS 39211

Michael C. Cullingford

Nuclear Safety Division

IAEA

Wagramerstrasse, 5

P.O. Box 100

A-1400 Vienna

AUSTRIA

Garth Cummings

Lawrence Livermore Laboratory

L-91, Box 808

Livermore, CA 94526

Mark A. Cunningham

USNRC-RES/PRAB

MS: NL/S-372

James J. Curry

7135 Salem Park Circle

Mechanicsburg, PA 17055

Peter Cybulskis

Battelle Columbus Division

505 King Avenue

Columbus, OH 43201

Peter R. Davis

PRD Consulting

1935 Sabin Drive

Idaho Falls, ID 83401

Jose E. DeCarlos

Consejo de Seguridad Nuclear

Sor Angela de la Cruz 3, P1. 8

28016 Madrid

SPAIN

M. Marc Decreton

Department Technologie

CEN/SCK

Boeretang 200

B-2400 Mol

BELGIUM

Richard S. Denning

Battelle Columbus Division

505 King Avenue

Columbus, OH 43201

Dist-5
Vernon Denny

Science Applications Int. Corp.

5150 El Camino Real, Suite 3

Los Altos, CA 94303

J. Devooget

Faculte des Sciences Appliques

Universite Libre de Bruxelles

av. Franklin Roosevelt

B-1050 Bruxelles

BELGIUM

R. A. Diederich

Supervising Engineer

Environmental Branch

Philadelphia Electric Co.

2301 Market St.

Philadelphia, PA 19101

Raymond DiSalvo

Battelle Columbus Division

505 King Avenue

Columbus, OH 43201

Mary T. Drouin

Science Applications International

Corporation

2109 Air Park Road S.E.

Albuquerque, NM 87106

Andrzej Drozd

Stone and Webster

Engineering Corp.

243 Summer Street

Boston, MA 02107

N. W. Edwards

NUTECH

145 Martinville Lane

San Jose, CA 95119

Ward Edwards

Social Sciences Research Institute

University of Southern California

Los Angeles, CA 90089-1111

Joachim Ehrhardt

Kernforschungszentrum Karlsruhe/INR

Postfach 3640

D-7500 Karlsruhe 1

FEDERAL REPUBLIC OF GERMANY

Adel A. El-Bassioni

USNRC-NRR/PRAB

MS: lOA-2

J. Mark Elliott

International Energy Associates,

Ltd., Suite 600

600 New Hampshire Ave., NW

Washington, DC 20037

Farouk Eltawila

USNRC-RES/AEB

MS: NL/N-344

Mike Epstein

Fauske and Associates

P. 0. Box 1625

16W070 West 83rd Street

Burr Ridge, IL 60521

Malcolm L. Ernst

USNRC-RGN II

F. R. Farmer

The Long Wood, Lyons Lane

Appleton, Warrington

WA4 5ND

UNITED KINGDOM

P. Fehrenback

Atomic Energy of Canada, Ltd.

Chalk River Nuclear Laboratories

Chalk River Ontario, KOJiPO

CANADA

P. Ficara

ENEA Cre Casaccia

Department for Thermal Reactors

Via Anguillarese, 301

00100 ROMA

ITALY

A. Fiege

Kernforschungszentrum

Postfach 3640

D-7500 Karlsruhe

FEDERAL REPUBLIC OF GERMANY

John Flack

USNRC-RES/SAIB

MS: NLS-324

Dist-6
George F. Flanagan

Oak Ridge National Laboratory

P.O. Box Y

Oak Ridge, TN 37831

Karl N. Fleming

Pickard, Lowe & Garrick, Inc.

2260 University Drive

Newport Beach, CA 92660

Terry Foppe

Rocky Flats Plant

P. 0. Box 464, Building T886A

Golden, CO 80402-0464

Joseph R. Fragola

Science Applications International

Corporation

274 Madison Avenue

New York, NY 10016

Wiktor Frid

Swedish Nuclear Power Inspectorate

Division of Reactor Technology

P. 0. Box 27106

S-102 52 Stockholm

SWEDEN

John Gaunt

British Embassy .3100 Massachusetts Avenue, NW

Washington, DC 20008

Jim Gieseke

Battelle Columbus Division

505 King Avenue

Columbus, OH 43201

Frank P. Gillespie

USNRC-NRR/PMAS

MS: 12G-18

Ted Ginsburg

Department of Nuclear Energy

Building 820

Brookhaven National Laboratory

Upton, NY 11973

James C. Glynn

USNRC-RES/PRAB

MS: NL/S-372

P. Govaerts

Departement de la Surete Nucleaire

Association Vincotte

avenue du Roi 157

B-1060 Bruxelles

BELGIUM

George Greene

Building 820M

Brookhaven National Laboratory

Upton, NY 11973

James Fulford

NUS Corporation

910 Clopper Road

Gaithersburg, MD 20878

Urho Fulkkinen

Technical Research Centre of

Finland

Electrical Engineering Laboratory

Otakaari 7 B

SF-02150 Espoo 15

FINLAND

J. B. Fussell

JBF Associates, Inc.

1630 Downtown West Boulevard

Knoxville, TN 37919

John Garrick

Pickard, Lowe & Garrick, Inc.

2260 University Drive

Newport Beach, CA 92660

Carrie Grimshaw

Brookhaven National

Building 130

Upton, NY 11973

Laboratory

H. J. Van Grol

Energy Technology Division

Energieonderzoek Centrum Nederland

Westerduinweg 3

Postbus 1

NL-1755 Petten ZG

NETHERLANDS

Sergio Guarro

Lawrence Livermore Laboratories

P. 0. Box 808

Livermore, CA 94550

Dist-7
Sigfried Hagen

Kernforschungzentrum Karlsruhe

P. 0. Box 3640

D-7500 Karlsruhe 1

FEDERAL REPUBLIC OF GERMANY

L. Hammar

Statens Karnkraftinspektion

P.O. Box 27106

S-10252 Stockholm

SWEDEN

Stephen Hanauer

Technical Analysis Corp.

6723 Whittier Avenue

Suite 202

McLean, VA 22101

Brad Hardin

USNRC-RES/TRAB

MS: NL/S-169

R. J. Hardwich, Jr.

Virginia Electric Power Co.

P.O. Box 26666

Richmond, Va 23261

Michael R. Haynes

UKAEA Harwell Laboratory

Oxfordshire

Didcot, Oxon., OX1l ORA

ENGLAND

Michael J. Hazzan

Stone & Webster

3 Executive Campus

Cherry Hill, NJ 08034

A. Hedgran

Royal Institute of Technology

Nuclear Safety Department

Bunellvagen 60

10044 Stockholm

SWEDEN

Sharif Heger

UNM Chemical and Nuclear

Engineering Department

Farris Engineering

Room 209

Albuquerque, NM 87131

Jon C. Helton

Dept. of Mathematics

Arizona State University

Tempe, AZ 85287

Robert E. Henry

Fauske and Associates, Inc.

16W070 West 83rd Street

Burr Ridge, IL 60521

P. M. Herttrich

Federal Ministry for the

Environment, Preservation of

Nature and Reactor Safety

Husarenstrasse 30

Postfach 120629

D-5300 Bonn 1

FEDERAL REPUBLIC OF GERMANY

F. Heuser

Giesellschaft Fur Reaktorsicherheit

Forschurgsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

E. F. Hicken

Giesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

D. J. Higson

Radiological Support Group

Nuclear Safety Bureau

Australian Nuclear Science and

Technology Organisation

P.O. Box 153

Rosebery, NSW 2018

AUSTRALIA

Daniel Hirsch

University of California

A. Stevenson Program on

Nuclear Policy

Santa Cruz, CA 95064

H. Hirschmann

Hauptabteilung Sicherheit und

Umwelt

Swiss Federal Institute for

Reactor Research (EIR)

CH-5303 Wurenlingen

SWITZERLAND

Dist-8
Mike Hitchler

Westinghouse Electric Corp.

Savanna River Site

Aiken, SC 29808

Richard Hobbins

EG&G Idaho

P. 0. Box 1625

Idaho Falls, ID 83415

Steven Hodge

Oak Ridge National Laboratory

P.O. Box Y

Oak Ridge, TN 37831

Lars Hoegberg

Office of Regulation and Research

Swedish Nuclear Power Inspectorate

P. 0. Box 27106

S-102 52 Stockholm

SWEDEN

Lars Hoeghort

IAEA A-1400

Wagranerstraase 5

P.O. Box 100

Vienna, 22

AUSTRIA

Edward Hofer

GLesellschaft Fur Reaktorsicherheit

Forschurgsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

Peter Hoffmann

Kernforschingszentrum Karlsruhe

Institute for Material

Und Festkorperforsching I

Postfach 3640

D-7500 Karlsruhe 1

FEDERAL REPUBLIC OF GERMANY

N. J. Holloway

UKAEA Safety and Reliability

Directorate

Wigshaw Lane, Culcheth

Warrington, Cheshire, WA34NE

UNITED KINGDOM

Stephen C. Hora

University of Hawaii at Hilo

Division of Business Administration

and Economics

College of Arts and Sciences

Hilo, HI 96720-4091

J. Peter Hoseman

Swiss Federal Institute for

Reactor Research

CH-5303, Wurenlingen

SWITZERLAND

Thomas C. Houghton

KHC, Inc.

1747 Pennsylvania Avenue, NW

Washington, DC 20006

Dean Houston

USNRC-ACRS

MS: P-315

Der Yu Hsia

Taiwan Atomic Energy Council

67, Lane 144, Keelung Rd.

Sec. 4

Taipei

TAIWAN

Alejandro Huerta-Bahena

National Commission on Nuclear

Safety and Safeguards (CNSNS)

Insurgentes Sur N. 1776

Col. Florida

C. P. 04230 Mexico, D.F.

MEXICO

Kenneth Hughey [2]

SERI

5360 1-55 North

Jackson, MS 39211

Won-Guk Hwang

Kzunghee University

Yongin-Kun

Kyunggi-Do 170-23

KOREA

Dist-9
Michio Ichikawa

Japan Atomic Energy Research

Institute

Dept. of Fuel Safety Research

Tokai-Mura, Naka-Gun

Ibaraki-Ken, 319-1

JAPAN

Sanford Israel

USNRC-AEOD/ROAB

MS: MNBB-9715

Krishna R. Iyengar

Louisiana Power and Light

200 A Huey P. Long Avenue

Gretna, LA 70053

Jerry E. Jackson

USNRC-RES

MS: NL/S-302

R. E. Jaquith

Combustion Engineering, Inc.

1000 Prospect Hill Road

M/C 9490-2405

Windsor, CT 06095

S. E. Jensen

Exxon Nuclear Company

2101 Horn Rapids Road

Richland, WA 99352

KJell Johannson

Studsvik Energiteknik AB

S-611 82, Nykoping

SWEDEN

Richard John

SSM, Room 102

927 W. 35th Place

USC, University Park

Los Angeles, CA 90089-0021

D. H. Johnson

Pickard, Lowe & Carrick, Inc.

2260 University Drive

Newport Beach, CA 92660

W. Reed Johnson

Department of Nuclear Engineering

University of Virginia

Reactor Facility

Charlottesville, VA 22901

Jeffery Julius

NUS Corporation

1301 S. Central Ave, Suite 202

Kent, WA 98032

H. R. Jun

Korea Adv. Energy Research Inst.

P.O. Box 7, Daeduk Danju

Chungnam 300-31

KOREA

Peter Kafka

Gesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

Geoffrey D. Kaiser

Science Application Int. Corp.

1710 Goodridge Drive

McLean, VA 22102

William Kastenberg

UCLA

Boelter Hall, Room 5532

Los Angeles, CA 90024

Walter Kato

Brookhaven National Laboratory

Associated Universities, Inc.

Upton, NY 11973

M. S. Kazimi

MIT, 24-219

Cambridge, HA 02139

Ralph L. Keeney

101 Lombard Street

Suite 704W

San Francisco, CA 94111

Henry Kendall

Executive Director

Union of Concerned

Cambridge, MA

Scientists

Frank King

Ontario Hydro

700 University Avenue

Bldg. Hll C5

Toronto

CANADA H5GlX6

Dist-lO
Oliver D. Kingsley, Jr.

Tennessee Valley Authority

1101 Market Street

CN-38A Lookout Place

Chattanooga, TN 37402

Stephen R. Kinnersly

Winfrith Atomic Energy

Establishment

Reactor Systems Analysis Division

Winfrith, Dorchester

Dorset DT2 8DH

ENGLAND

Ryohel Kiyose

University of Tokyo

Dept. of Nuclear Engineering

7-3-1 Hongo Bunkyo

Tokyo 113

JAPAN

George Klopp

Commonwealth Edison Company

P.O. Box 767, Room 35W

Chicago, IL 60690

Klaus Koberlein

Gesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

E. Kohn

Atomic Energy Canada Ltd.

Candu Operations

Mississauga

Ontario, L5K 1B2

CANADA

Alan M. Kolaczkowski

Science Applications International

Corporation

2109 Air Park Road, S.E.

Albuquerque, NM 87106

S. Kondo

Department of Nuclear Engineering

Facility of Engineering

University of Tokyo

3-1, Hongo 7, Bunkyo-ku

Tokyo

JAPAN

Herbert J. C. Kouts

Brookhaven National Laboratory

Building 179C

Upton, NY 11973

Thomas Kress

Oak Ridge National Laboratory

P.O. Box Y

Oak Ridge, TN 37831

W. Kroger

Institut fur Nukleare

Sicherheitsforschung

Kernforschungsanlage Julich GmbH

Postfach 1913

D-5170 Julich 1

FEDERAL REPUBLIC OF GERMANY

Greg Krueger [3]

Philadelphia Electric Co.

2301 Market St.

Philadelphia, PA 19101

Bernhard Kuczera

Kernforschungzentrum Karlsruhe

ILR Safety Project Group (PRS)

P. 0. Box 3640

D-7500 Karlsruhe 1

FEDERAL REPUBLIC OF GERMANY

Jeffrey L. LaChance

Science Applications International

Corporation

2109 Air Park Road S.E.

Albuquerque, NM 87106

H. Larsen

Riso National Laboratory

Postbox 49

DK-4000 Roskilde

DENMARK

Wang L. Lau

Tennessee Valley Authority

400 West Summit Hill Avenue

Knoxville, TN 37902

Timothy J. Leahy

E1 Services

1851 South Central Place, Suite 201

Kent, WA 98031

Dist-ll
John C. Lee

University of Michigan

North Campus

Dept. of Nuclear Engineering

Ann Arbor, HI 48109

Tim Lee

USNRC-RES/RPSB

MS: NL/N- 353

Mark T. Leonard

Science Applications International

Corporation

2109 Air Park Road, SE

Albuquerque, NM 87106

Leo LeSage

Director, Applied Physics Div.

Argonne National Laboratory

Building 208, 9700 South Cass Ave.

Argonne, IL 60439

Milton Levenson

Bechtel Western Power Company

50 Beale St.

San Francisco, CA 94119

Librarian

NUMARC/USCEA

1776 I Street NW, Suite 400

Washington, DC 80006

Eng Lin

Taiwan Power Company

242, Roosevelt Rd., Sec. 3

Taipei

TAIWAN

N. J. Liparulo

Westinghouse Electric Corp.

P. 0. Box 355

Pittsburgh, PA 15230

Y. H. (Ben) Liu

Department of Mechanical

Engineering

University of Minnesota

Minneapolis, MN 55455

Bo Liwnang

IAEA A-1400

Swedish Nuclear Power Inspectorate

P.O. Box 27106

S-102 52 Stockholm

SWEDEN

J. P. Longworth

Central Electric Generating Board

Berkeley Gloucester

GL13 9PB

UNITED KINGDOM

Walter Lowenstein

Electric Power Research Institute

3412 Hillview Avenue

P. 0. Box 10412

Palo Alto, CA 94303

William J. Luckas

Brookhaven National Laboratory

Building 130

Upton, NY 11973

Hans Ludewig

Brookhaven National Laboratory

Building 130

Upton, NY 11973

Robert J. Lutz, Jr.

Westinghouse Electric Corporation

Monroeville Energy Center

EC-E-371, P. 0. Box 355

Pittsburgh, PA 15230-0355

Phillip E. MacDonald

EG&G Idaho, Inc.

P.O. Box 1625

Idaho Falls, ID 83415

Jim Mackenzie

World Resources Institute

1735 New York Ave. NW

Washington, DC 20006

Richard D. Fowler

Idaho Nat. Engineering Laboratory

P.O. Box 1625

Idaho Falls, ID 83415

A. P. Malinauskas

Oak Ridge National Laboratory

P.O. Box Y

Oak Ridge, TN 37831

Giuseppe Mancini

Commission European Comm.

CEC-JRC Eraton

Ispra Varese

ITALY

Dist-12
Lasse Mattila

Technical Research Centre of

Finland

Lonnrotinkatu 37, P. 0. Box 169

SF-00181 Helsinki 18

FINLAND

Roger J. Mattson

SCIENTECH Inc.

11821 Parklawn Dr.

Rockville, MD 20852

Donald McPherson

USNRC-NRR/DONRR

MS: 12G-18

Jim Metcalf

Stone and Webster Engineering

Corporation

245 Summer St.

Boston, MA 02107

Mary Meyer

A-i, MS F600

Los Alamos National Laboratory

Los Alamos, NM 87545

Ralph Meyer

USNRC-RES/AEB

MS: NL/N-344

Charles Miller

8 Hastings Rd.

Momsey, NY 10952

Joseph Miller

Gulf States Utilities

P. 0. Box 220

St. Francisville, LA 70775

William Mims

Tennessee Valley Authority

400 West Summit Hill Drive.

WIODI99C-K

Knoxville, TN 37902

Jocelyn Mitchell

USNRC-RES/SAIB

MS: NL/S-324

James Moody

P.O. Box 641

Rye, NH 03870

S. Mori

Nuclear Safety Division

OECD Nuclear Energy Agency

38 Blvd. Suchet

75016 Paris

FRANCE

Walter B. Murfin

P.O. Box 550

Mesquite, NM 88048

Joseph A. Murphy

USNRC-RES/DSR

MS: NL/S-007

V. I. Nath

Safety Branch

Safety Engineering Group

Sheridan Park Research Community

Mississauga, Ontario L5K IB2

CANADA

Susan J. Niemczyk

1545 l8th St. NW, #112

Washington, DC 20036

Pradyot K. Niyogi

USDOE-Office of Nuclear Safety

Washington, DC 20545

Paul North

EG&G Idaho, Inc.

P. 0. Box 1625

Idaho Falls, ID 83415

Edward P. O'Donnell

Ebasco Services, Inc.

2 World Trade Center, 89th Floor

New York, NY 10048

David Okrent

UCLA

Boelter Hall, Room 5532

Los Angeles, CA 90024

Robert L. Olson

Tennessee Valley Authority

400 West Summit Hill Rd.

Knoxville, TN 37902

Kam

CBI

800

Oak

Mohktarian

Na-Con Inc.

Jorie Blvd.

Brook, IL 60521

Dist-13
Simon Ostrach

Case Western Reserve University

418 Glenman Bldg.

Cleveland, OH 44106

D. Paddleford

Westinghouse Electric Corporation

Savanna River Site

Aiken, SC 29808

Robert L. Palla, Jr.

USNRC-NRR/PRAB

MS: lOA-2

Chang K. Park

Brookhaven National Laboratory

Building 130

Upton, NY 11973

Michael C. Parker

Illinois Department of Nuclear

Safety

1035 Outer Park Dr.

Springfield, IL 62704

Gareth Parry

NUS Corporation

910 Clopper Road

Gaithersburg, MD 20878

J. Pelce

Departement de Surete Nucleaire

IPSN

Centre d'Estudes Nucleaires du CEA

B.P. no. 6, Cedex

F-92260 Fontenay-aux-Roses

FRANCE

G. Petrangeli

ENEA Nuclear Energy ALT Disp

Via V. Brancati, 48

00144 Rome

ITALY

Marty Plys

Fauske and Associates

16W070 West 83rd St.

Burr Ridge, IL 60521

Mike Podowski

Department of Nuclear Engineering

and Engineering Physics

RPI

Troy, NY 12180-3590

Robert D. Pollard

Union of Concerned Scientists

1616 P Street, NW, Suite 310

Washington, DC 20036

R. Potter

UK Atomic Energy Authority

Winfrith, Dorchester

Dorset, DT2 8DH

UNITED KINGDOM

William T. Pratt

Brookhaven National Laboratory

Building 130

Upton, NY 11973

M. Preat

Chef du Service Surete Nucleaire et

Assurance Qualite

TRACTEBEL

Bd. du Regent 8

B-100 Bruxells

BELGIUM

David Pyatt

USDOE

MS: EH-332

Washington, DC

William Raisin

NUMAEC

1726 N St. NW

Suite 904

Washington, DC

20545

20036

Joe Rashid

ANATECH Research Corp.

3344 N. Torrey Pines Ct.

Suite 1320

La Jolla, CA 90237

Dale M. Rasmuson

USNRC-RES/PRAB

MS: NL/S-372

Ingvard Rasmussen

Riso National Laboratory

Postbox 49

DK-4000, Roskilde

DENMARK

Dist-14
Norman C. Rasmussen

Massachusetts Institute of

Technology

77 Massachusetts Avenue

Cambridge, MA 02139

John W. Reed

Jack R. Benjamin & Associates, Inc.

444 Castro St., Suite 501

Mountain View, CA 94041

David B. Rhodes

Atomic Energy of Canada, Ltd.

Chalk River Nuclear Laboratories

Chalk River, Ontario KOJ1PO

CANADA

Dennis Richardon

Westinghouse Electric Corporation

P.O. Box 355

Pittsburgh, PA 15230

Doug Richeard

Virginia Electric Power Co.

P.O.Box 26666

Richmond, VA 23261

Robert Ritzman

Electric Power Research Institute

3412 Hillview Avenue

Palo Alto, CA 94304

Richard Robinson

USNRC-RES/PRAB

MS: NL/S-372

Jack E. Rosenthal

USNRC-AEOD/ROAB

MS: MNBB-9715

Jorma V. Sandberg

Finnish Ctr. Rad. Nucl. and Safety

Department of Nuclear Safety

P.O. Box 268

SF-O0101 Helsinki

FINLAND

C. Saponaro

ENEA Nuclear Engineering Alt.

Zia V Brancati 4B

00144 ROME

ITALY

K. Sarran

United Engineers

P. 0. Box 8223

30 S 17th Street

Philadelphia, PA

Marty Sattison

EG&G Idaho

P. 0. Box 1625

Idaho Falls, ID

19101

83415

George D. Sauter

Electric Power Research

3412 Hillview Avenue

Palo Alto, CA 94303

Institute

Jorge Schulz

Bechtel Western Power Corporation

50 Beale Street

San Francisco, CA 94119

B. R. Sehgal

Electric Power Research Institute

3412 Hillview Avenue

Palo Alto, CA 94303

Subir Sen

Bechtel Power Corp.

15740 Shady Grove Road

Location IA-7

Gaithersburg, MD 20877

S. Serra

Ente Nazionale per l'Energia

Electtrica (ENEL)

via G. B. Martini 3

Rome

ITALY

Denwood F. Ross

USNRC-RES

MS: NL/S-007

Frank Rowsome

9532 Fern Hollow Way

Gaithersburg, MD 20879

Wayne Russell

SERI

5360 1-55 North

Jackson, MS 39211

Dist-15
Bonnie J. Shapiro

Science Applications International

Corporation

360 Bay Street

Suite 200

Augusta, CA 30901

H. Shapiro

Licensing and Risk Branch

Atomic Energy of Canada Ltd.

Sheridan Park Research Community

Mississauga, Ontario L5K 1B2

CANADA

Dave Sharp

Westinghouse Savannah River Co.

Building 773-41A, P. 0. Box 616

Aiken, SC 29802

John Sherman

Tennessee Environmental Council

1719 West End Avenue, Suite 227

Nashville, TN 37203

Brian Sheron

USNRC-RES/DSR

MS: NL/N-007

Rick Sherry

JAYCOR

P. 0. Box 85154

San Diego, CA 92138

Steven C. Sholly

MHB Technical Associates

1723 Hamilton Avenue, Suite K

San Jose, CA 95125

Louis M. Shotkin

USNRC-RES/RPSB

MS: NL/N-353

M. Siebertz

Chef de la Section Suretel des

Reacteurs

CEN/SCK

Boeretang, 200

B-2400 Mol

BELGIUM

Melvin Silberberg

USNRC-RES/DE/WNB

MS: NL/S-260

Gary Smith

SERI

5360 1-55 North

Jackson, MS 39211

Gary L. Smith

Westinghouse Electric Corporation

Hanford Site

Box 1970

Richland, WA 99352

Lanny N. Smith

Science Applications International

Corporation

2109 Air Park Road SE

Albuquerque, NM 87106

K. Soda

Japan Atomic Energy Res. Inst.

Tokai-Mura Naka-Gun

Ibaraki-Ken 319-11

JAPAN

David Sommers

Virginia Electric Power Company

P. 0. Box 26666

Richmond, VA 23261

Herschel Spector

New York Power Authority

123 Main Street

White Plains, NY 10601

Themis P. Speis

USNRC-RES

MS: NL/S-007

Klaus B. Stadie

OECD-NEA, 38 Bld. Suchet

75016 Paris

FRANCE

John Stetkar

Pickard, Lowe & Garrick, Inc.

2216 University Drive

Newport Beach, CA 92660

Wayne L. Stiede

Commonwealth Edison Company

P.O. Box 767

Chicago, IL 60690

Dist-16
William Stratton

Stratton & Associates

2 Acoma Lane

Los Alamos, NM 87544

Soo-Pong Suk

Korea Advanced Energy Research

Institute

P. 0. Box 7

Daeduk Danji, Chungnam 300-31

KOREA

W. P. Sullivan

GE Nuclear Energy

175 Curtner Ave., M/C 789

San Jose, CA 95125

Tony Taig

U.K. Atomic Energy Authority

Wigshaw Lane, Culcheth

Warrington, Cheshire, WA3 4NE

UNITED KINGDOM

John Taylor

Electric Power Research Institute

3412 Hillview Avenue

Palo Alto, CA 94303

Harry Teague

U.K. Atomic Energy Authority

Wigshaw Lane, Culcheth

Warrington, Cheshire, WA3 4NE

UNITED KINGDOM

Technical Library

Electric Power Research Institute

P.O. Box 10412

Palo Alto, CA 94304

Mark I. Temme

General Electric, Inc.

P.O. Box 3508

Sunnyvale, CA 94088

T. C. Theofanous

University of California, S.B.

Department of Chemical and Nuclear

Engineering

Santa Barbara, CA 93106

David Teolis

Westinghouse-Bettis Atomic Power

Laboratory

P. 0. Box 79, ZAP 34N

West Mifflin, PA 15122-0079

Ashok C. Thadani

USNRC-NRR/SAD

MS: 7E-4

Carry Thomas

L-499 (Bldg. 490)

Lawrence Livermore National

Laboratory

7000 East Ave.

P.O. Box 808

Livermore, CA 94550

Gordon Thompson

Institute for Research and

Security Studies

27 Ellworth Avenue

Cambridge, MA 02139

Grant Thompson

League of Women Voters

1730 M. Street, NW

Washington, DC 20036

Arthur Tingle

Brookhaven National Laboratory

Building 130

Upton, NY 11973

Rich Toland

United Engineers and Construction

30 S. 17th St., MS 4V7

Philadelphia, PA 19101

Brian J. R. Tolley

DG/XII/D/1

Commission of the European

Communities

Rue de la Loi, 200

B-1049 Brussels

BELGIUM

David R. Torgerson

Atomic Energy of Canada Ltd.

Whiteshell Nuclear

Research Establishment

Pinawa, Manitoba, ROE 1LO

CANADA

Dist-17
Dr. Alfred F. Torrn

1421 Hymettus Avenue

Leucadia, CA 92024

Klau Trambauer

Cesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FERERAL REPUBLIC OF GERMANY

Nicholas Tsoulfanidis

Nuclear Engineering Dept.

University of Missouri-Rolla

Rolla, MO 65401-0249

Chao-Chin Tung

c/o H.B. Bengelsdorf

ERC Environmental Services Co.

P. 0. Box 10130

Fairfax, VA 22030

Brian D. Turland

UKAEA Culham Laboratory

Abingdon, Oxon OX14 3DB

ENGLAND

Takeo Uga

Japan Institute of Nuclear Safety

Nuclear Power Engineering Test

Center

3-6-2, Toranomon

Hinato-ku, Tokyo 108

JAPAN

Stephen D. Unwin

Battelle Columbus Division

505 King Avenue

Columbus, OH 43201

A. Valeri

DISP

ENEA

Via Vitaliano Brancati, 48

1-00144 Rome

ITALY

Harold VanderMolen

USNRC-RES/PRAB

MS: NL/S-372

C. Bruce Varnado

ERC International

1717 Louisiana Blvd. NE, Suite 202

Albuquerque, NM 87110

Jussi K. Vaurio

Imatran Voima Oy

Loviisa NPS

SF-07900 Loviisa

FINLAND

William E. Vesely

Science Applications International

Corporation

655 Metro Place South, Suite 745

Dubbin, OH 43017

J. I. Villadoniga Tallon

Div. of Analysis and Assessment

Consejo de Seguridad Nuclear

c/ Sor Angela de la Cruz, 3

28020 Madrid

SPAIN

Willem F. Vinck

Kapellestract 25

1980

Tervuren

BELGIUM

R. Virolainen

Office of Systems Integration

Finnish Centre for Radiation and

Nuclear Safety

Department of Nuclear Safety

P.O. Box 268

Kumpulantie 7

SF-00520 Helsinki

FINLAND

Raymond Viskanta

School of Mechanical Engineering

Purdue University

West Lafayette, IN 47907

S. Visweswaran

General Electric Company

175 Curtner Avenue

San Jose, CA 95125

Truong Vo

Pacific Northwest Laboratory

Battelle Blvd.

Richland, WA 99352

Dist-18
Richard Vogel

Electric Power Research Institute

P. 0. Box 10412

Palo Alto, CA 94303

G. Volta

Engineering Division

CEC Joint Research Centre

CP No. 1

1-21020 Ispra (Varese)

ITALY

Ian B. Wall

Electric Power Research Institute

3412 Hillview Avenue

Palo Alto, CA 94303

Adolf Walser

Sargent and Lundy Engineers

55 E. Monroe Street

Chicago, IL 60603

Edward Warman

Stone & Webster Engineering Corp.

P.O. Box 2325

Boston, MA 02107

Norman Weber

Sargent & Lundy Co.

55 E. Monroe Street

Chicago, IL 60603

Lois Webster

American Nuclear Society

555 N. Kensington Avenue

La Grange Park, IL 60525

Wolfgang Werner

Gesellschaft Fur Reaktorsicherheit

Forschungsgelande

D-8046 Garching

FEDERAL REPUBLIC OF GERMANY

Don Wesley

IMPELL

1651 East 4th Street

Suite 210

Santa Ana, CA 92701

Detlof von Winterfeldt

Institute of Safety and Systems

Management

University of Southern California

Los Angeles, CA 90089-0021

Pat Worthington

USNRC-RES/AEB

KS: NL/N-344

John Wreathall

Science Applications International

Corporation

655 Metro Place South, Suite 745

Dubbin, OH 43017

D. J. Wren

Atomic Energy of Canada Ltd.

Whiteshell Nuclear Research

Establishment

Pinawa, Manitoba, ROE 1LO

CANADA

Roger Wyrick

Inst. for Nuclear Power Operations

1100 Circle 75 Parkway, Suite 1500

Atlanta, GA 30339

Kun-Joong Yoo

Korea Advanced Energy Research

Institute

P. 0. Box 7

Daeduk Danji, Chungnam 300-31

KOMEA

Faith Young

Energy People,

Dixou Springs,

Inc.

TN 37057

Jonathan Young

R. Lynette and Associates

15042 Northeast 40th St.

Suite 206

Redmond, WA 98052

C. Zaffiro

Division of Safety Studies

Directorate for Nuclear Safety and

Health Protection

Ente Nazionale Energie Alternative

Via Vitaliano Brancati, 48

1-00144 Rome

ITALY

Mike Zentner

Westinghouse Hanford Co.

P. 0. Box 1970

Richland, WA 99352

Dist-19
Kun-Joong Yoo

Korea Advanced Energy Research

Institute

P. 0. Box 7

Daeduk Danji, Chungnam 300-31

KOREA

Faith Young

Energy People, Inc.

Dixou Springs, TN 37057

Jonathan Young

R. Lynette and Associates

15042 Northeast 40th St.

Suite 206

Redmond, WA 98052

C. Zaffiro

Division of Safety Studies

Directorate for Nuclear Safety and

Health Protection

Ente Nazionale Energie Alternative

Via Vitaliano Brancati, 48

1-00144 Rome

ITALY

Mike Zentner

Westinghouse Hanford Co.

P. 0. Box 1970

Richland, WA 99352

X. Zikidis

Greek Atomic Energy Commission

Agia Paraskevi, Attiki

Athens

GREECE

Bernhard Zuczera

Kernforschungszentrum

Postfach 3640

D-7500 Karlsruhe

FEDERAL REPUBLIC OF GERMANY

6412

6412

6412

6412

6412

6412

6413

6413

6415

6415

6415

6418

6418

6419

6419

6422

6424

6424

6424

6425

6453

6460

6463

6463

6471

6473

6900

8524

L. A. Miller

D. B. Mitchell

A. C. Payne, Jr.

T. T. Sype

T. A. Wheeler

D. W. Whitehead

T. D. Brown

F. T. Harper [2]

R. M. Cranwell

W. R. Cramond [3)

R. L. Iman

J. E. Kelly

K. J. Maloney

M. P. Bohn

J. A. Lambright

D. A. Powers

K. D. Bergeron

J. J. Gregory

D. C. Williams

S. S. Dosanjh

J. S. Philbin

J. V. Walker

M. Berman

M. P. Sherman

L. D. Bustard

W. A. von Riesemann

A. W. Snyder

J. A. Wackerly

1521

3141

3151

5214

6344

6001

6001

6001

6400

6401

6410

6412

6412

6412

J. R. Weatherby

S. A. Landenberger [5]

W. I. Klein

D. B. Clauss

E. D. Gorham

D. D. Carlson

R. J. Breeding

D. M. Kunsman

D. J. McCloskey

D. R. Bradley

D. A. Dahlgren

A. L. Camp

S. L. Daniel

T. M. Hake DIST-20
NRC iooM 3 US. NUCLEAR REGULATORY COMMISSION I. REPORT NUMBER

RC 2.,if e1.111

320.3 BIBUOGRAPHIC DATA SHEET (Si JO on.N 0.rin #w NURG/CR-4840

'sat w'uc~raSAND88-3 102

2. TITLE AND SUBTITLE

PROCEDURES FOR THE EXTERNAL EVENT CORE 3. DATE REPORT PuBLIS-4ED

DAMAGE FREQUENCY ANALYSES FOR NUREG-1150 November 1990

4. FIN OR GRANT NUMBER

A1384

B. AUTHOR(S) 6. TYPE OF REPORT

M. P. Bohn and J. A. Lambright Technical

amrg~7. PE RIOD COVER ED sinaimnootow,5

U. PERFOMING UWiUANIZI IONII - NAPM1; AND Ak1&~itab 11mcotitl PU4 YU "61M f. ficttoW Mq w V4 MMLW ocnn. AILLr udulan. faifUam aW5 POW contractor5 . ainaUf

Sandia National Laboratories

Albuquerque, New Mexico 87185-5800

9. SPONSORING ORGANIZATION - NAME AND ADDRESS fWlIC.-. type -Saa *bw-; ee"pi , RCewd oIgw*i.. sion Oftime t I"**eR',, d4,tv Cmmaaa..

Division of Systems Research

Office of Nuclear Regulatory Research

US Nuclear Regulatory Commission

Washington, DC 20555

10. SUPPLEMENTARY NOTES

11. ABSTRACT EUX m or *esi

This report presents procedures which can be used to assess external hazards at

nuclear power plants. These methods were used to perform the external events risk

assessments for the Surry and Peach Bottom nuclear power plants as part of the

NRC-sponsored NUREG-1150 program. These methods apply to the full range of hazards

such as earthquakes, fires, floods, etc. which are collectively known as external

events and are based on making full utilization of the power plant systems logic

models developed in the internal events analyses.

Hallmarks of the methods described include the use of extensive computer-aided

screening prior to the detailed analysis of each external event hazard to which the

plant might conceivably be exposed. These screening procedures identify those

external events which could contribute to the risk at the plant and significantly

reduce the number of events for which subsequent detailed analysis is required.

Taken together, these techniques provide a relatively straightforward and, in some

cases, simplified set of techniques for the analysis of the full range of external

events and provides for both scrutability and reproducibility of the final results.

12. KEY WORDSJOESCR.PTORS t&t: mm ee. Mar ma mr a iW d pa.u 13. AVAILAILLS? V 51ATUMIIs?

TUnl lnm! te~d

Probabilistic Risk Assessment (PRA) ,.s•cuATlnl C.ASiFC-r O

External Hazards ,t•,

safety analysis TTnelaggifiggc

uncertainty analysis IT"• e

accident sequence analysis Unrla& rfi• i

15. NUMBER OF PAGES

16. PRICE

INRC RM 325 049;
THIS DOCUMENT WAS PRINTED USING RECYCLED PAPER.

UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE, $300

SEIiAL FWTH-C~SSR(WE IPOSTAGE Er FEES PAID

USNFIC.

William Beckner

USNRC-RES/SAIB

MS: NL/S-324

'Ilm"

it ANq