ML003771535

Affidavit of Gareth W. Parry, Stephen F. Lavie, Robert L. Palla and Christopher Gratton in Support of NRC Staff Brief and Summary of Relevant Facts, Data and Arguments Upon Which the Staff Proposes to Rely at Oral Argument on Environmental

ML003771535
Person / Time
Site:	Harris  (NPF-063)
Issue date:	11/20/2000
From:	Gratton C, Lavie S, Palla R, Parry G NRC/OGC
To:
Cater C, SECY
Shared Package
ML003769831	List: ML003677142 ML003771530 ML003771535
References
+adjud/rulemjr200506, +kBR1SISP20060712, -nr, 50-400-LA, ASLBP 99-726-02-LA, RAS 2403
Download: ML003771535 (125)

Text

RAS 2403 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION DOCKETED 11/21/00 BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of CAROLINA POWER & LIGHT COMPANY (Shearon Harris Nuclear Power Plant)

)

)

Docket No. 50-400-LA

)

)

ASLBP No. 99-762-02-LA

)

)

)

AFFIDAVIT OF GARETH W. PARRY, STEPHEN F. LAVIE, ROBERT L. PALLA AND CHRISTOPHER GRATTON IN SUPPORT OF NRC STAFF BRIEF AND

SUMMARY

OF RELEVANT FACTS, DATA AND ARGUMENTS UPON WHICH THE STAFF PROPOSES TO RELY AT ORAL ARGUMENT ON ENVIRONMENTAL CONTENTION EC-6 Gareth W. Parry, Robert L. Palla, Stephen F. LaVie and Christopher Gratton, being duly sworn, do hereby state as follows:

1.

My name is Gareth W. Parry. I have been employed by the U.S. Nuclear Regulatory Commission (NRC) since 1996 as the Senior Level Advisor on Probabilistic Safety Assessment for the Division of System Safety and Analysis in the Office of Nuclear Reactor Regulation.

My responsibilities are primarily to support the development of the use of risk assessment methods and results in regulatory processes associated with the operation of nuclear power reactors. Prior to working for NRC I worked for more than fifteen years for NUS, a consulting engineering company. While at NUS I participated in various capacities in the performance of more than 20 PRAs of nuclear power plants in the USA and also in Taiwan, Korea, Spain, the Czech Republic and the United Kingdom. I managed two full scale PRA projects, and contributed in a major way as task leader for several tasks in others. I contributed to the development of methods for the analysis of human reliability, common cause failures and uncertainty analysis as a contractor to both NRC and also the Electric Power Research Institute, and have published a large number of papers in areas related to probabilistic risk assessment. I have a Ph.D. degree in Theoretical Physics from the Imperial College of Science and Technology, the University of London, England, and a Bachelor of Science degree in Physics also from Imperial College. I have more than 25 years of experience in the analysis of safety of nuclear reactors. My resume, including a list of publications is attached (Exhibit 1-Resume of Gareth W. Parry).

2.

My name is Stephen F.

LaVie.

I am employed by the Nuclear Regulatory Commission as a Health Physicist in the Licensing Section, Probabilistic Safety Analysis Branch, Division of Systems Safety and Analysis in the Office of Nuclear Reactor Regulation.

I am responsible for reviews of licensee submittals involving assessments of the radiological consequences of design basis accidents, and for the preparation of regulatory guidance for performing these analyses. In addition, I have twenty years of experience in the commercial nuclear power field, including radiation protection, radiological emergency preparedness, atmospheric dispersion, radiation shielding, analyses of the radiological consequences of design basis accidents, including development of assessment methodologies and computer codes. I have fifteen years of direct involvement in providing radiological engineering support to the operating and engineering departments at a commercial pressurized water reactor.

A statement of my professional qualifications is attached hereto. (Exhibit 2-Resume of Stephen F. LaVie).

3.

My name is Robert L. Palla.

I am employed by the U.S. Nuclear Regulatory Commission as a Senior Reactor Engineer in the Safety Program Section, Probabilistic Safety Assessment Branch, Division of Systems Safety and Analysis in the Office of Nuclear Reactor Regulation. I am responsible for technical evaluations of license applications and policy issues in the areas of severe accident progression and phenomena, containment performance, offsite consequences, and risk management, including risk evaluation of spent fuel pools at decommissioning plants.

I have been conducting such evaluations at NRC since 1981.

A statement of my professional qualifications is attached (Exhibit 3-Resume of Robert L. Palla).

4.

My name is Christopher Gratton. I am employed as a Reactor Systems Engineer for Plant Systems Branch, Division of Systems Safety and Analysis in the Office of Nuclear Reactor Regulation. I am responsible for reviews involving the design of spent fuel storage systems, including spent fuel pool cooling, under 10 CFR Part 50, and for the preparation of regulatory guidance for performing these analyses. I have twenty-one years of experience in the nuclear field; the past seven years have been directly involved in evaluating the designs of spent fuel storage systems. This includes a two year study of the design features of spent fuel storage systems at boiling and pressurized water reactor plants. I also have seven years of experience operating and testing reactor plant systems. A statement of my professional qualifications is attached. (Exhibit 4-Resume of Christopher Gratton).

5.

The purpose of this affidavit is to address the Board of Commissioners of Orange Countys (BCOC) environmental contention, EC-6, as admitted by the Atomic Safety Licensing Board (Board) in its August 7, 2000, Memorandum and Order (Ruling on Late-Filed Contentions).

Carolina Power & Light Co (Shearon Harris Nuclear Power Plant), LBP-00-19, 52 NRC 85 (2000).

6.

BCOCs Contention EC-6 states:

In the Environmental Assessment (EA) for CP&Ls December 23, 1998, license amendment application, the NRC Staff concludes that the proposed expansion of spent fuel storage capacity at the Shearon Harris nuclear power plant will not have a significant effect on the quality of the human environment....

Therefore, the Staff has decided not to prepare an Environmental Impact Statement (EIS) for the proposed license amendment. The Staffs decision not to prepare an EIS violates the National Environmental Policy Act (NEPA) and NRCs implementing regulations, because the Finding of No Significant Impact (FONSI) is erroneous and arbitrary and capricious. In fact, the proposed expansion of spent fuel storage capacity at Harris would create accident risks that are significantly in excess of the risks identified in the EA, and significantly in excess of accidents risks previously evaluated by the NRC Staff in the EIS for the Harris operating license.

These accident risks would significantly affect the quality of the human environment, and therefore must be addressed in an EIS.

There are two respects in which the proposed license amendment would significantly increase the risk of an accident at Harris:

(1)

CP&L proposes several substantial changes in the physical characteristics and mode of operation of the Harris plant. The effects of these changes on the accident risk posed by the Harris plant have not been accounted for in the Staffs EA. The changes would significantly increase, above present levels, the probability and consequences of potential accidents at the Harris plant.

(2) During the period since the publication in 1979 of NUREG-0575, the NRCs Generic Environmental Impact Statement (GEIS) on spent fuel storage, new information has become available regarding the risks of storing spent fuel in pools.

This information shows that the proposed license amendment would significantly increase the probability and consequences of potential accidents at the Harris plant, above the levels indicated in the GEIS, the 1983 EIS for the Harris operating license, and the EA. The new information is not addressed in the EA or the 1983 EIS for the Harris operating license.

Accordingly, the Staff must prepare an EIS that fully considers the environmental impacts of the proposed license amendment, including its effects on the probability and consequences of accidents at the Harris plant. As required by NEPA and Commission policy, the EIS should also examine the costs and benefits of the proposed action in comparison to various alternatives, including Severe Accident Mitigation Design Alternatives (SAMDAS) and the alternative of dry storage.

The Board confined consideration of the contention to the seven-step accident sequence proposed in Basis F.1 and the associated probability analysis. The sequence, as admitted, involves:

(1) a degraded core accident; (2) containment failure or bypass; (3) loss of all spent fuel cooling and makeup systems; (4) extreme radiation doses precluding personnel access; (5) inability to restart any pool cooling or makeup systems due to extreme radiation doses; (6) loss of most or all pool water through evaporation; and (7) initiation of an exothermic oxidation reaction in pools C and D.

The Board also requested the parties to address the following three questions in their written presentations:

1.

What is the submitting partys best estimate of the overall probability of the sequence set forth in the chain of seven events in the CP&L and BCOCs filings, set forth on page 13 supra? The estimates should utilize plant-specific data where available and should utilize the best available generic data where generic data is relied upon.

2.

The parties should take careful note of any recent developments in the estimation of the probabilities of the individual events in the sequence at issue.

In particular, have new data or models suggested any modification of the estimate of 2 x 10-6 per year set forth in the executive summary of NUREG-1353, Regulatory Analysis for the Resolution of Generic Issue 82, Beyond Design Basis Accidents in Spent Fuel Pools (1989)? Further, do any of the concerns expressed in the ACRSs April 13, 2000 letter suggest that the probabilities of individual elements of the sequence are greater than those previously analyzed (e.g., is the chance of occurrence of sequence element seven, an exothermic reaction, greater than was assumed in the decade-old NUREG-1353)?

3.

Assuming the Board should decide that the probability involved is of sufficient moment so as not to permit the postulated accident sequence to be classified as remote and speculative, what would be the overall scope of the environmental impact analysis the Staff would be required to prepare (i.e., limited to the impacts of that accident sequence or a full blown EIS regarding the amendment request)?

7.

This affidavit contains the Staffs discussion and analysis of the seven-step accident sequence, the Staffs analysis of the probability of the occurrence of the sequence and the Staffs answers to questions 1 and 2.

8.

In preparation for this affidavit, we reviewed the documents identified in the discussions below.

A Discussion on PRA and Why it is Applicable to this Affidavit 9.

A degraded core accident in a nuclear power plant is one in which the normal and emergency methods for removing the heat generated by nuclear fission in the reactor core fails so that the core overheats. If the function is not restored in time, the core will melt, potentially leading to failure of the reactor pressure vessel. Such an accident challenges the containment and may lead to failure of the containment.

For some degraded core accidents the containment is bypassed, meaning that there is a pathway from the reactor pressure vessel directly outside containment. Both of these mechanisms of failure of the containment function allow radionuclides from the degraded core to be released into the environment posing a threat to public health and safety. An analytical approach, known as Probabilistic Risk (or Safety) Assessment or PRA (or PSA), has been developed and used worldwide for the analysis of such accidents. The results of a PRA or PSA include an identification of the ways in which such accidents can occur, and also produce estimates of the probability of such accidents.

10.

An analysis of degraded core accidents and containment failure at the Shearon Harris Nuclear Power Plant (Harris) using a PRA has been performed by Carolina Power &Light (CP&L, or Licensee) in response to Generic Letter 88-20 (Exhibit 5-Individual Plant Examination for Severe Accident Vulnerabilities, Generic Letter 88-20, November 23, 1988) which requested that licensees perform an individual plant examination (IPE) to identify vulnerabilities with respect to safety. The PRA is contained in CP&L's IPE for the Harris plant (Exhibit 6-Shearon Harris Nuclear Power Plant, Individual Plant Examination (IPE) Submittal, August 1993). Further, an individual plant examination for external events (IPEEE) (Exhibit 7-Shearon Harris Nuclear Power Plant, Individual Plant Examination for External Events (IPEEE) Submittal, June 1995) was performed in response to Supplement 4 of GL 88-20 (Exhibit 8-Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, Generic Letter 88-20, Supplement 4). The IPE has since been updated and is maintained as the Shearon Harris Probabilistic Safety Study (PSA) (Exhibit 9-Shearon Harris Nuclear Plant Probabilistic Safety Assessment (PSA), Rev.

0, 1995). These documents contain information to address the first two events in the seven step sequence directly.

An analysis of the complete sequence of events has not previously been performed for the Harris plant, or, to our knowledge, for any plant.

11.

PRAs are analytical models used to investigate the potential for the occurrence of events that, if indeed possible, are extremely unlikely, and for which, therefore, there is no, (nor is there expected to be any), actuarial data.

A PRA model represents these rare events as combinations and sequences of more elementary events for which experience is more likely to be available and which are amenable to analysis.

12.

A level 1 PRA is used to analyze the causes and likelihoods of potential degraded core accidents. The model itself consists of logic models called event trees that identify the various scenarios that can occur following a challenge to normal operation and that result from combinations of successes and failures of the functions or systems that are required in response to those challenges. The different scenarios correspond to either successful mitigation of the challenge or degraded core accidents that have a different character depending on which functions or systems failed. The event trees are supported by other logic models called fault trees that identify the various combinations of equipment and personnel failures that lead to function or system failure.

The fault trees in combination with the event trees are used to identify the combinations of equipment and personnel failures that result in each of the degraded core accidents.

13.

The consequences of the hypothesized degraded core accidents in terms of their impact on containment are explored in what is called a Level 2 PRA, using a containment event 1 Feed and bleed is a term used to describe an approach to providing core cooling by opening the valves in the reactor pressure boundary that allows coolant to escape into the containment (bleed). The coolant is then cooled by the decay heat removal system and returned to the pressure vessel (feed).

tree, which is supported by calculations using models of severe accident progression and severe accident phenomena such as hydrogen combustion and core concrete interactions.

14.

The estimation of the probabilities of degraded core accidents requires estimating the probabilities of equipment failures and errors on the part of the plant staff. While equipment failures are in principle amenable to the use of actuarial data, because of the high reliability of nuclear power plant equipment, such data is often not attainable, and engineering judgement is required to estimate the probabilities. The likelihood of operator error is very much a function of the context in which the operator is performing. Since, very few, if any, of the situations addressed in the PRA models, such as the need to initiate the feed and bleed procedure1 in response to a complete loss of secondary side heat removal, have actually occurred, again, the likelihood of such errors must be based on judgement, extrapolating from more common situations. This requires the use of models. As mentioned above, the estimation of containment failure probabilities requires the use of analytical models that represent the analysts best current understanding of how severe accidents would progress. Because engineering judgement is used in all phases of the analysis, it is fair to describe a PRA as a structured approach to the use of judgement. There are areas of the analysis where there is no consensus on what judgements should be made, and because of this, there can be variability in the results of PRAs performed by different analysts. This does not imply that one analyst is wrong, but generally means that different assumptions or judgements were made. This variability is a source of uncertainty in the results of the PRA. The uncertainties resulting from limitations in our understanding exist whether or not use is made of a PRA. The structure of the PRA, however, provides a context for assessing the impact of uncertainties on the results.

15.

The Staff recognizes variability as a source of uncertainty and is aware that reliance on the results of one study may result in a bias. In the recently issued Regulatory Guide (RG) 1.174 (Exhibit 10-Regulatory Guide RG 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, July 1998), the Staff has recognized this by requiring that when PRA is used in support of license amendments, sources of uncertainty should be identified and their impact on the decision evaluated. The Staff recognizes that one factor that increases confidence in the results of a PRA is whether a peer review has been performed. A peer review is a process in which an unbiased group judges the scientific and technical validity of the work of members of its own community. In the context of a PRA, the peer review would be aimed at assuring that the model is constructed correctly, and in particular assessing the appropriateness of the assumptions made as they reflect current understanding. A peer review would also check whether the results make sense given the design and operational practices at the plant.

16.

PRAs have been performed for all the nuclear power plants in the US and many others worldwide. The degree of detail in the studies varies widely, and there is variability in the detailed results in terms of the contributions to core damage frequency and containment failure probability from different scenarios. However, there is general consensus on the types of accidents that can cause degraded core conditions, and on the fact that it is necessary to perform plant specific analyses to identify contributions that result from unique plant design and operational features. While the best source for plant specific information is the plant specific PRA, the industry 2 An issue for which PRAs are sometimes criticized is their lack of completeness in addressing contributions to risk from sabotage. Sabotage as an issue has been excluded from this proceeding.

wide experience also provides a resource that can be used to check the reasonableness of the conclusions.

17.

When assessing the risk from a nuclear power plant, all significant initiating events and all plant operating modes should be addressed. PRAs have been performed for the so-called internal initiating events, i.e., those that originate because of failures in, or disturbances of, the plant systems themselves. Some PRAs have been performed for initiating events that originate from events outside the plant systems boundaries. These are called external initiating events and include such events as earthquakes, high winds, and fires internal and external to the plant. The contributions from external initiating events tend to be a function of when the plant was designed, with the newer plants, such as Harris, being less vulnerable. Relatively few PRAs have been performed for initiating events occurring while the plant is in a non-power mode of operation, but those that have been performed tend to demonstrate that the risk can be on the same order as that from initiating events at full power. There is neither a shutdown PRA nor a seismic PRA for the Harris plant. However, the shutdown and seismic PRAs that have been performed for other plants provide a basis for an estimate of the contributions to CDF at Harris.

18.

PRAs have been criticized for not being complete in addressing all issues that could have an impact on risk2. One particular issue commonly raised is that of design and construction errors. The occurrence of design or construction errors is not a probabilistic issue; they either exist at a plant or they do not.

Therefore, it makes little sense to estimate the probability that a significant design or construction error exists at a particular plant. PRAs assume that the plant is constructed in accordance with the design basis. Nevertheless, several hundred LERs are issued every year that address design basis issues. However, it has been shown that very few, only about 1% in 1998, have any safety significance (Exhibit 11-Advisory Committee on Reactor Safety (ACRS) Letter, Union of Concerned Scientists Report, Nuclear Plant Risk Studies: Failing the Grade, October 11, 2000 ).

19.

NRC Staffs approach to the use of PRA in regulatory decision-making is discussed in detail in Regulatory Guide 1.174 (Exhibit 10). While the focus of that Regulatory Guide is on the use of PRA in support of license amendments, the principles apply more generally. The NRC has adopted a risk-informed approach to regulation which uses PRA information, but does not rely on it alone. Any assessment of risk must be accompanied by both an assessment of the impact of the identified uncertainties, and qualitative arguments that justify the case. Hence, in this affidavit, the argument whether a scenario is remote and speculative will not be based on a number alone, but on an understanding of the reasoning behind that number.

20.

When probabilities are used in this document they will generally be best estimates in the sense that they correspond to the mean values of distributions representing uncertainties in those values. This is appropriate given the use of mean values of the Core Damage Frequency and Large Early Release Frequency in RG 1.174 as the figures of merit in regulatory decision-making (Exhibit 10, page 14).

General Approach to the Analysis 21.

This section describes the approach taken by the Staff to the estimation of the probability of the seven step accident sequence identified in Paragraph 6. The estimation of the probability of this chain of events is not simply the product of the probabilities of the seven events.

In fact, as will be discussed below, steps 4 and 6 in the sequence are not random events for which probabilities may be assessed, but rather they represent conditions that are used to evaluate the probability of step 5. As will be seen in the later discussions the timing of the steps in the sequence plays a significant role in the determination of the overall probability of the sequence.

22.

As shown by the PRAs performed to date, there are many postulated degraded core accidents, each having its own characteristics and its own frequency of occurrence. What the characteristics of the sequences are will be discussed as necessary later.

The conditional probability of containment failure or bypass given a degraded core accident is dependent on the characteristics of the accident sequence.

23.

In Orange Countys Request for Admission of Late-Filed Environmental Contentions (Request for Admission), dated January 31, 2000, BCOC makes the statement that a degraded core accident at the Harris, reactor, with containment failure or bypass, would almost certainly lead to interruption of cooling of the Harris pools.

The Staff has identified that there are some core damage accident sequences for which the spent fuel pool cooling is interrupted. It also recognizes that there is a potential, for those sequences in which spent fuel pool cooling is not interrupted, for the spent fuel pool cooling to be interrupted following the failure of containment. Thus the estimate of the joint probability of the first three steps in the seven-step sequence may contain contributions in which spent fuel pool cooling is lost before containment failure, and also contributions in which containment failure precedes loss of pool cooling.

24.

If the pool cooling is interrupted for a sufficient length of time, then, because of the heat generated by the decay of fission products in the spent fuel, the water in the pools would heat up and evaporate or boil off, leading to uncovery of the fuel elements. Therefore, should pool cooling be interrupted, it is essential that it be restored before the fuel becomes uncovered. Event 6, the loss of all pool water through evaporation, is guaranteed if those functions are not restored.

Stated another way, if the pool cooling and makeup functions can be restored before the fuel has been uncovered, the scenario is terminated. The length of time it takes for the water heat up and boil off is a function of the total heat load (which is a function of both the age and quantity of fuel),

and the amount of water present.

25.

For many of the scenarios of concern, the pool cooling function is recoverable.

However, a prolonged interruption of the cooling will require makeup to establish an appropriate flow through the cooling system. There are several methods of providing makeup.

26.

In the Request for Admission, on pages 8-9, BCOC writes, Restoration of cooling water lost by evaporation would be precluded because onsite radiation levels would prevent access by personnel. There are two events in the seven step sequence that relate to this, namely event 4, extreme radiation doses precluding personnel access, and event 5, inability to restart any pool cooling or makeup systems due to extreme radiation doses. Event 4" is not an event as such, but, for the purposes of this analysis, represents the necessity, for each scenario included in the combination of events 1, 2, and 3, to assess whether that scenario can lead to sufficient contamination dose level to prevent access to areas where corrective or restorative actions are to be taken at the time that such actions have to be taken. The location and severity of dose is a function of the nature of the degraded core accident, and particularly of the containment failure mode and location. Furthermore, the dose to personnel in contaminated areas is both a function of time from the release, and of the time spent in the contaminated area.

27.

If the age of the fuel is such that an exothermic reaction of the fuel clad is possible once the fuel is uncovered, the onset of the fire would be later than the time it takes for the water in the pools to evaporate to the point of uncovery of the fuel. However, the additional time, while uncertain, is assumed to be small. Therefore, the time to fuel uncovery is assumed to be the time available to perform remedial actions to prevent the occurrence of an exothermic reaction. The condition represented by event 6 is used to determine the time available to perform the necessary actions.

28.

The probability associated with event 5 is interpreted for this analysis to be the probability of failure to restart any pool cooling or makeup systems given the constraints imposed by the radiological contamination following the degraded core accident. The more methods that are not precluded by the radioactive release the better from the point of view of assuring that at least one of them succeeds. The more time that is available the more the likelihood of success.

29.

The consequence of the loss of most or all pool water is most likely an exothermic reaction of the fuel in the pools if the fuel is not so old that the decay heat can be removed by air cooling. Precisely how old the fuel has to be to prevent a fire is still not resolved.

Therefore, rather than estimate the probability of an exothermic reaction in pools C and D (event 7 in the seven step sequence), it is assumed conservatively that the probability is 1, given that the sequence has progressed to the point that the water in the pools has been lost through evaporation.

However, there will be fuel in pools A and B that is less than five years old and loss of water in pools A and B would almost certainly result in an exothermic reaction. At that point, it is not likely that cooling could be restored to pools C and D. Thus the time available to effectively recover the pool cooling and/or makeup functions is conservatively assumed to be the time taken to uncover the fuel in pools A and B.

30.

In this affidavit, the Staff presents its assessment of the probability of the seven-step scenario identified in paragraph 6 above. This analysis was subjected to a peer review by Dr.

Nathan Siu and Mr. Charles Tinkler of the Office of Research. The Staff did not identify any sequences where the ability to restart spent fuel pool cooling or provide makeup, following a severe core damage accident that failed containment and led to an interruption of spent fuel pool cooling, was precluded by severe doses. The Staffss conclusion therefore, is that the probability of this sequence as written is very low, and as discussed in paragraphs 234 to 255, is bounded by 2E-07/reactor year.

Probability of Degraded Core Accident at the Harris Nuclear Plant 31.

In the following sections, the Staff discusses in turn its estimate of the probability of a degraded core accident at the Harris Nuclear Plant; its estimate of the joint probability of a degraded core accident and an interruption of spent fuel pool cooling; its assessment of the containment failure modes, their probabilities conditional on core damage, and the characteristics of the release of radioactivity; an assessment of the impact of the releases on continued operation of the spent fuel pool cooling for those accident sequences that do not directly lead to an interruption of that function; its estimate of the joint probability of the first three events in the seven-step sequence; a discussion of the methods available for makeup to the spent fuel pools; its assessment of which of the methods are precluded because of severe doses from the release; a discussion on the likelihood of success in implementing these methods for the most limiting situations; and a summary of its conclusions that the probability of the seven-step scenario as described is indeed remote and speculative.

32.

The probability of a degraded core accident is usually presented as a core damage frequency, or CDF, which is the probability that a core damage accident occurs in one year. For the purposes of this affidavit, the assessment of the CDF should include contributions from all initiating events in all phases of reactor operation with fuel in the reactor. An initiating event is an event that disrupts normal operation and requires safety systems to operate to stabilize the situation.

33.

There are several estimates of contributions to the CDF at the Harris Nuclear Plant given in various documents provided by CP&L, as discussed in the following paragraphs.

34.

The estimate given in the Individual Plant Examination (IPE) submittal, which includes contributors from internal initiating events and internal floods for the full power mode of plant operation, is 7E-05/reactor year ( or 7 occurrences in100,000 years) (Exhibit 6-page 3-242).

An internal initiating event in the full power mode of operation is an event caused by a failure in one of the operating systems that results in a reactor trip. An internal flood is caused by a failure of the integrity of one of the plant systems that releases water or steam. The IPE submittal was subjected to a peer review and was also reviewed by NRC Staff and its contractors (Exhibit 12-NRC Staffs Evaluation of the Shearon Harris Nuclear Plant Individual Plant Examination (IPE Submittal) (SER IPE), January 26, 1996). The NRC Staff review concluded that the IPE met the intent of Generic Letter 88-20, which was to determine whether the plant had any vulnerabilities.

In the IPE submittal, about 75% of the core damage frequency is a result of sequences initiated by a loss of coolant accident or LOCA, which is a breach of the reactor pressure boundary inside the containment leading to a loss of coolant from the reactor vessel, or a transient-induced LOCA. The latter is an accident caused by a reactor trip and a subsequent failure of the pressure boundary, and the contributors are primarily station blackout events, i.e., losses of all station power, leading to reactor coolant pump seal LOCAs.

35.

An external initiating event is an event external to the plant systems that causes a disruption of normal plant operation. The events considered are earthquakes, fires, both internal and external to the plant structures, transportation accidents such as aircraft crashes, and high winds. The Individual Plant Examination for External Events (IPEEE) estimates the contribution from internal fires to have a frequency of 1.1E-05/per reactor year (Exhibit 7, page 4-49). The contributions from all other external events, with the exception of seismic events, were judged to be minor and could be screened from consideration (Exhibit 7, page 1-7).

The IPEEE was performed largely by contractors, and peer reviewed by CP&L staff. The NRC Staff review of the IPEEE concluded that the external events were adequately addressed (Exhibit 13-NRC Staffs Evaluation of the Shearon Harris Nuclear Power Plant, Unit 1, Individual Plant Examination of External Events (SER IPEEE), January 14, 2000) and that the IPEEE was capable of identifying the most likely severe accidents and severe accident vulnerabilities.

36.

The Shearon Harris Nuclear Plant Probabilistic Safety Assessment (PSA) Revision 1, dated October 1995 gives an estimate of the total CDF from full power operations of 5.5E-05/reactor year (Exhibit 9, page 6).

This includes contributions from seismic events of approximately 8E-06/reactor year and fires of approximately 1E-05/reactor year (Exhibit 9, page 5). The seismic contribution to CDF presented in the report was estimated using a method that the licensee has since judged to be too conservative (Exhibit 14-Applicants Response to NRC Staffs Second Set of Interrogatories Directed to the Applicant Regarding Contention EC-6, October 19, 2000).

37.

The PSA estimate of CDF from internal initiating events, which is on the order of 3E-05/reactor year, is considerably lower than that given in the IPE. It is difficult to make a direct comparison between the IPE and the PSA, since the results are presented differently. However, again, about 75% of the sequences are LOCAs or transient induced LOCAs, with a significant contribution from station blackout.

Therefore, while the CDF estimate has changed, the contributions appear to be in the same proportion. There have been several revisions to the PRA model as discussed in Applicants Response to NRC Staffs First Set of Interrogatories and Requests for Production of Documents Directed to the Applicant Regarding Contention EC-6, dated September 26, 2000, response to specific interrogatory no. 6, page 19. (Exhibit 15-Applicants Response to NRC Staffs First Set of Interrogatories and Requests for Production of Documents Directed to the Applicant Regarding Contention EC-6, September 26, 2000). One significant change included in the 1995 PSA is the reduction in initiating event frequencies, based on more recent plant specific data (Exhibit 9-Table 3-17; and Exhibit 6-Table 3-4). These changes in frequencies are reasonable and in agreement with the general trend that initiating event 3 The HCLPF value is the peak ground acceleration at which there is a high confidence of low probability of failure due to the earthquake.

frequencies at US nuclear power plants, have been decreasing (Exhibit 16-NUREG/CR 5750, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, February 1999-selected portion: Executive Summary). However, for the purposes of this analysis, the IPE estimate of CDF will be used, even though it is probably conservative, because it has been subject to review by NRC or its contractors, unlike the PSA.

38.

The CDF contributions from earthquakes and low power and shutdown operations have not been evaluated specifically for Harris. These contributions are discussed below.

39.

A seismic PRA was not performed for the IPEEE; instead a margins approach was adopted. The plant, as shown by the IPEEE, has a plant level high-confidence-low-probability-of-failure (HCLPF) capacity of.3g that meets the review level earthquake (Exhibit 7-Appendix A, page 122). In colloquial terms this means that the plant is rugged from a seismic perspective and has no specific vulnerabilities. It should be noted that as part of this evaluation, a loss of offsite power caused by the earthquake is assumed. The seismic hazard at the Harris site is assessed to be very low (Exhibit 17-NUREG 1488, Revised Livermore Seismic Hazard Estimates for Sixty-Nine Nuclear Power Plant Sites East of the Rocky Mountains, page A-14). On the basis of this and the results of seismic PRAs that were performed for other plants (Exhibit 18-An Update of the Preliminary Perspectives Gained from Individual Plant Examinations of External Events (IPEEE)

Submittal Reviews, Nuclear Engineering and Design, Vol. 194 (1999), A.M. Rubin et al.), and taking into account that the plant level HCLPF value3 is higher than that of other PWRs located in the Eastern U.S. (Cook, Kewaunee, Point Beach), we conclude that the seismic core damage frequency is on the order of 1E-05/reactor year (or 1 occurrence in 100,000 years). Such an accident would typically be considered as equivalent to a long term loss of offsite power, since the failure of the electric power distribution system is typically assumed.

40.

None of the estimates of CDF for Harris contain contributions to core damage due to accidents at low power or shutdown. Only a few analyses of the low-power and shutdown contributions to degraded core probability have been performed, though all indicate that the contribution from shutdown states is on the same order as that from full power. The CDF is generally considered to be dominated by contributions from reduced inventory operation, because there is the least margin for recovery. Interruptions of the decay heat removal function are the biggest contributors. Industry PRAs for shutdown states at PWRs have produced CDF estimated in the range of 2 to 3E-05 per reactor year. However, the actual estimate is a strong function of the outage planning, and in particular, the care taken to provide adequate mitigation capability during the mid-loop phase of shutdown (Exhibit 19-SECY-00-0007, Proposed Staff Plan for Low Power and Shutdown Risk Analysis Research to Support Risk-informed Regulatory Decision-Making, January 12, 2000).

41.

For the purposes of this analysis, the Staff estimates the CDF for Harris be the sum of :

ÿ internal events (including floods) 7E-05 (IPE, Exhibit 6)

ÿ fires 1.1E-05 (IPEEE, Exhibit 7)

ÿ seismic 1E-05 (paragraph 38)

ÿ shutdown 3E-05 (paragraph 39),

for a total of 1.2E-04/reactor year (or 1.2 occurrences in 10,000 years).

Identification of Sequences that Directly Result, or Indirectly May Result in Interruptions of Spent Fuel Pool Cooling 42.

In the seven-step sequence identified in the Licensing Boards Memorandum and Order, dated August 7, 2000, page 13, event number 3 is identified as loss of all spent fuel pool cooling and makeup systems.

BCOC in its Request for Admission states on page 8 that a degraded core accident at the Harris reactor, with containment failure or bypass, would almost certainly lead to interruption of cooling of the Harris fuel pools. This is considerably broader than event number 3. The following paragraphs specifically address the interruption of spent fuel pool cooling. The Staff notes that not all the scenarios that interrupt pool cooling will lead to a loss of makeup systems. First, the spent fuel storage system at Harris is described.

43.

The spent fuel storage system is housed in the Fuel Handling Building (FHB), a reinforced concrete, seismically qualified structure located adjacent to the Unit 1 Containment Auxiliary Building, the Reactor Auxiliary Building, and the Waste Processing building ( Exhibit 20-Shearon Harris Final Safety Analysis Report (FSAR) Chapter 9-section 9.1.3, p.2).

The building is designed to protect its contents against natural phenomena, such as tornadoes, hurricanes, and floods (Exhibit 20-section 9.1.2, p.2).

The FHB houses the four fuel pools, the north and south end spent fuel pool cooling water systems, and other systems, structures, and components relied upon to support refueling and fuel storage operations (Exhibit 20-section 9.1.2,

p. 1,2). Spent fuel from the operation of the Harris Unit 1 nuclear reactor is transferred to the FHB through the transfer tube located in the south end transfer canal and stored in the spent fuel pool A or B (Exhibit 20-section 9.1.2, p.2). The Harris fuel storage system also accepts spent fuel from the Robinson and Brunswick nuclear stations, which is currently stored in pools A and B but eventually will be stored in pools C and D (Exhibit 21-CP&L Request for License Amendment, Spent Fuel Storage, December 23, 1998).

44.

The fuel storage system consists of four seismically qualified, reinforced concrete fuel pools and a cask loading pit (Exhibit 20-section 9.1.2, p. 1-2). The fuel pools and the cask pit are lined with stainless steel for compatibility with the pool water (Exhibit 20-section 9.1.2, p.2).

Spent fuel is stored in seismically qualified storage racks at the bottom of the fuel storage pools (Exhibit 20-section 9.1.2, p.2). Transfer canals are provided between the cask pit and the pools so that spent fuel assemblies can be safety transferred underwater from one pool storage location to another (Exhibit 22-CP&L Engineering Drawing, CAR-2165 G-022, General Arrangement Fuel Handling Building Plans Sheet 1).

Isolation gates are provided between each pool and transfer canal (Exhibit 15-Specific Interrogatory #8). The gates are constructed of steel and have inflatable rubber seals to minimize leakage (Exhibit 15-Specific Interrogatory #8). The gates extend from the pool surface to approximately the elevation of the top of the fuel storage racks (Exhibit 23-Deposition of W. Wills, Exhibit #2, Roll #1, Picture 9; Exhibit 24-CP&L Engineering Drawing, CAR-2165 G-025, General Arrangement Fuel Handling Building Sections Sheet 2).

45.

Two spent fuel pool cooling and cleanup systems (SFPCCS) are provided to remove decay heat from the spent fuel stored in the four fuel pools (Exhibit 20-section 9.1.3, p.1). One SFPCCS services the south end pools (pools A and B) and the south transfer canal, while the other system (not currently in use, but to be completed prior to implementation of the license amendment) services the north end pools (pools C and D), the north end transfer canal and the cask pit (Exhibit 20-section 9.1.3, p.1). The systems are designed to seismic Category 1 requirements and the system pumps can be powered from on site emergency power (Exhibit 20-section 9.1.3, p.6). Each SFPCCS consists of two 100% capacity pumps, two heat exchangers, filters, and a purification loop with a demineralizer (Exhibit 20-section 9.1.3, p.2-4). While independent of each other, the cooling water systems can share inventory through the main transfer canal (Exhibit 22). The Unit 1 Component Cooling Water System (CCWS) removes the decay heat from both the north end and south end fuel pool heat exchangers, and transfers the heat to the Service Water System (Exhibit 20-section 9.1.3, p.3).

46.

Each fuel pool cooling water system (north and south) is comprised of redundant cooling loops capable of cooling the stored fuel under design conditions assuming a single active failure (Exhibit 20-section 9.1.3, p.5). The fuel pool cooling pumps are remotely operated from the control room (Exhibit 25-Shearon Harris Nuclear Power Plant, Plant Operating Manual, SD-116, System Description, Fuel Pool Cooling and Cleanup System, p.9). Control room and local alarms are provided to alert operators of abnormal water level and high temperature in the fuel pools (Exhibit 25-p.9). Should a loss of offsite power occur, the fuel pool cooling pumps can be restarted from the control room using emergency power provided by the emergency diesel generators (Exhibit 25-p.9).

47.

Each fuel pool cooling water system includes a non safety-related, non seismically qualified purification loop designed to remove impurities and lower the activity levels in the fuel pool coolant (Exhibit 25-p.4). Valving is provided between the cooling system and cleanup system to permit isolation of this non safety-related system (Exhibit 25-p.4).

48.

Periodically, coolant makeup is required to offset the effects of evaporation, sampling, and fuel transfer activities. Several methods for adding coolant to the spent fuel storage system are available to operators as discussed in paragraphs 140-152.

49.

Four categories of degraded core accident sequences that may lead to interruption of spent fuel cooling can be identified.

They are: (a) those in which equipment failures that contribute to core damage lead directly to loss of pool cooling, for example, failures of the component cooling water (CCW) system and station blackout (discussed in paragraph 51); (b) those resulting from a loss of offsite power with onsite AC power available, in which the spent fuel pool cooling function is interrupted (because the spent fuel pool cooling pumps are not automatically reloaded on the safety bus by the load sequencer) but is recoverable from the control room by simple actions (discussed in paragraph 52); (c) loss of coolant accidents (LOCAs), for which, if it is necessary to employ a means of containment heat removal known as sump recirculation, the operators will be required to interrupt spent fuel pool cooling to maximize heat removal from the containment (paragraph 53); and (d) those for which spent fuel pool cooling is not initially lost, but for which a subsequent containment failure could result in failure of equipment required to maintain the cooling function as a result of the release of steam and radionuclides into the containment auxiliary building and possibly into the reactor auxiliary building (RAB) (Paragraph 114).

50.

The major difference between these groups is one of timing. The extremes are given by the first case, in which the spent fuel pool begins to heat up at the same time as the degraded core accident, and the last, in which the heat up starts at the time of release from containment. In the former case, therefore, there will be less time for recovery of the spent fuel pool function after the release. However, to compensate, there would be time to take preemptive action before the containment fails to line up makeup paths.

51.

The first group of scenarios was addressed by the licensees response to NRC Staffs First Set of Interrogatories, specifically numbers 3, 4, and 5 (Exhibit 15). The scenarios identified, and their frequencies, which were obtained from the current version of the PSA model (which has been updated since the version documented in Exhibit 9) are those initiated by the following events:

ÿ Loss of DC Bus DP-1A, with a contribution to CDF of 1.1E-06

ÿ Loss of offsite power, with a contribution to CDF of 1.3E-05

ÿ Fire in 6.9kv bus 1B-SB, with a contribution to CDF 2.6E-07

ÿ Service water flood scenarios, with a contribution to CDF of 5.2E-06 The first three sets of scenarios, with a total frequency of approximately 1.4E-05, are dominated by station blackout scenarios, i.e., a complete loss of AC power to the reactor. (The fire and loss of DC bus scenarios are not a result of loss of power to the site however, but to failures in the distribution system within the plant). The service water flood scenarios are losses of service water.

It is not the Staffs intent to use these numerical results directly, since they are not directly comparable to those in the IPE, because of the changes in the model. However, the analysis performed by the licensee showed that sequences initiated by equipment failures in the component cooling water system and the service water system are not significant contributors, and that power related issues dominate the frequency of a combined core damage event and loss of pool cooling.

Based on experience with performing and reviewing seismic PRA, the Staff understands that the seismic scenario with a frequency on the order of 1E-05/reactor year can also be assumed to be dominated by station blackout, which also leads directly to a loss of spent fuel pool cooling.

Therefore, in any case, the seismic contribution will be assumed to lead to an interruption of spent fuel pool cooling.

52.

Accidents initiated by a loss of offsite power with onsite emergency AC power available contribute very little to core damage frequency (Exhibit 26-CP&L Response to NRC Request for Additional Information: Review of Individual Plant Examination Submittal, January 16, 1995, page 28) and can be neglected for this affidavit.

53.

A LOCA in and of itself does not directly lead to an interruption of spent fuel pool cooling. However, under certain conditions, the operators are directed to interrupt cooling of the spent fuel pool heat exchangers to maximize decay heat removal from the reactor itself, while maintaining pool temperature below 150 degrees F (Exhibit 20-section 9.1.3, p.5-6). As with all PWRs, the contribution of LOCA and transient induced LOCAs to the degraded core frequency is significant. While it is not clear which LOCA initiated degraded core accident sequences will result in such an interruption of spent fuel pool cooling, it is conservative, from the point of view of the consideration of the timing for recovery of spent fuel pool cooling or initiation of makeup, to assume that they all would lead to an early interruption of spent fuel pool cooling with respect to the time of core damage, even though fuel pool cooling would be recoverable by a relatively simple operator action.

54.

Using the information in the IPE, the fraction of the internal event sequences that could lead to an interruption of spent fuel pool cooling could be as much as 75% (Exhibit 6, Page 1-9). This is based on assuming that all scenarios initiated by LOCAs, a loss of offsite power, and internal floods would lead to an interruption of pool cooling. The internal fire scenario identified above in paragraph 50, and seismic events would also lead to a loss of pool cooling. The fraction of shutdown events leading to loss of pool cooling is judged to be small. Thus the frequency of events that lead to an interruption of pool cooling is estimated to be the sum of:

.75x7E-05 (internal events and flooding) = 5.25E-05 1E-05 (seismic events) 2.6E-07 (fires) giving a total of approximately 6.3E-05/reactor year (or 6.3 occurrences per 100,000 years).

55.

For the majority of accidents that lead to an initial interruption of spent fuel pool cooling, the function is recoverable since the essential equipment has not failed.

For those accidents involving a loss of AC power, once ac power is restored, the pool cooling function could, in principle, be restored even after core damage and containment failure. However, recovery will depend on accessibility of locations and whether the necessary equipment has survived the accident. For the LOCA sequences, as in the case of the blackout sequences, the long term effectiveness of pool cooling will be a function of whether the necessary equipment has survived the accident, and on the accessibility of those locations needed to effect the recovery.

56.

The remaining sequences would only affect the pool cooling function if containment failure were to lead to failure of the necessary equipment.

57.

Thus, whatever the initiating event, to assess the long term viability of the spent fuel pool cooling function, it is necessary to determine: (a) whether the equipment needed to support the function will still be available after containment failure (this equipment is: the CCW pumps, the electrical distribution system (AC and DC), and the service water system), and (b) whether the locations from which the equipment is controlled are accessible.

Containment Failure or Bypass Modes and Release Category Characteristics 58.

Core damage progression and containment response is evaluated in the level 2 portion of the PRA. The level 2 analysis, sometimes referred to as the back-end of the risk study, addresses severe accident phenomena important to accident progression and containment behavior, and provides insights into the mechanisms that could lead to failure or bypass of the containment function, the likelihood (conditional probability) of each relevant containment failure mode, and the associated fission product release characteristics, such as timing and magnitude of release.

59.

Consistent with accepted PRA practice, the licensee evaluated and quantified accident progression through the use of a containment event tree and supporting deterministic calculations and sensitivity analyses. Results of the level 2 analysis were provided in the Harris IPE submitted August 20, 1993 (Exhibit 6).

60.

The Staff and its contractors performed an evaluation of the level 2 IPE, with a focus on whether the licensees method was capable of identifying vulnerabilities to severe accidents.

The review considered the completeness of the information and the reasonableness of the results given the Harris design and operation, but was not intended to validate the accuracy of the licensees detailed findings. The Staff found the IPE to be complete with regard to the information requested by Generic Letter 88-20, and the results reasonable (Exhibit 12).

61.

An updated version of the Harris risk assessment, hereafter referred to as the 1995 PSA, was completed by the licensee in 1995 and submitted during discovery (Exhibit 9). Major changes to the Level 1 analysis are described in the applicants response to Specific Interrogatory No. 6 (Exhibit 15) and include: updated initiating event frequencies; additional fault trees for demineralized water, normal service water, and main feedwater; and model changes to address system and procedure changes. Results from the seismic risk analysis were also integrated into the study as discussed earlier.

Major changes to the level 2 analysis are described in the applicants response (Exhibit 27-Applicants Second Supplemental Response to the NRC Staffs First Set of Interrogatories and Requests for Production of Documents Directed to the Applicant Regarding Contention EC-6, November 7, 2000) to an additional Staff request and include changes to the modeling of fission product scrubbing in steam generator tube rupture (SGTR) sequences, and containment heat removal in sequences when only sprays or only fan coolers are operating.

Based on Staff review of the 1995 PSA, the quantity of hydrogen assumed to be generated following in-vessel recovery, noted to be very conservative in the prior Staff evaluation of the IPE (Exhibit 12, Appendix B, page 9), also appears to have been reduced to more realistic values.

Each of the changes to the Level 2 model are reasonable, and are considered by the Staff to represent improvements over the IPE. Since the level 1 PRA serves as input to the level 2 model, the results from the level 2 PRA are impacted by both the Level 1 and Level 2 changes.

62.

In estimating the likelihood of containment failure or bypass for Harris (i.e., step 2 of the seven-step sequence), the Staff considered the results and insights from the Harris IPE (Exhibit 6), the prior Staff review of the IPE (Exhibit 12), the 1995 version of the Harris PRA (Exhibit 9), and the NUREG-1150 internal events analysis for the Surry and Zion plants (Exhibit 28-NUREG-1150, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, December 1990), together with the current state of knowledge regarding severe accident phenomena and containment performance.

63.

The Staff also considered the likelihood of various containment failure modes reported in the IPEs for other Westinghouse plants with steel-lined reinforced concrete containments similar to Harris. These plants are Comanche Peak, Diablo Canyon, Haddam Neck, Indian Point and Salem (Exhibit 29-NUREG/CR-5640, Overview and Comparison of U.S.

Commercial Nuclear Power Plants, September 1990, page 4-16).

This IPE information was extracted from the IPEdatabase (Exhibit 30-NUREG-1603, Individual Plant Examination Database Users Guide, April 1997; Exhibit 31-Worksheet generated from IPE database (CONT-FM Table)),

and the Staff report on IPE perspectives (Exhibit 32-NUREG-1560, Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance, Volume 2, Section 12.3.1, December 1997).

64.

The percent of core damage frequency resulting in various containment release modes is presented in Table 1 based on available, relevant risk studies (see page 46, infra).

Included in Table 1 are results from the Harris 1995 PRA and IPE (columns 2 and 3), the NUREG-1150 internal events analysis for the Surry and Zion plants, as summarized in the Staffs safety evaluation for the Harris IPE (columns 4 and 5), and the IPEs for the aforementioned plants with containments similar to Harris, as obtained from the IPE database (columns 6 through 8). Also included in the last column is the Staff estimate of the conditional containment failure probability for each release mode assumed for the purposes of the present assessment. The likelihood of containment failure from each release mode is discussed in the paragraphs below.

65.

The Harris containment building is a steel-lined, concrete reinforced containment in the form of a vertical cylinder with a hemispherical dome and a flat basemat. The basemat is a minimum 12 ft thick reinforced concrete slab. The design pressure is 45 psig and the mean failure pressure estimated in the applicants risk studies is 150 psig. The latter value is about 25 psi larger than the containment capacities calculated for the Surry and Zion containments (Exhibit 12, Appendix B, pages 2 and 13), but is comparable to the estimated capacities for other Westinghouse plants with steel-lined, concrete reinforced containments (Exhibit 33-NUREG/CR-6338, Resolution of the Direct Containment Heating Issue for All Westinghouse Plants with Large Dry Containments or Subatmospheric Containments, February 1996, page 66).

66.

The Harris IPE indicates that the containment would remain intact in 85% of the core damage events (Exhibit 6, page 4-175).

The 1995 PSA indicates a similar but slightly lower likelihood of maintaining containment integrity (80%) (Exhibit 9, page 20000886).

The Harris values are comparable to those calculated in NUREG-1150 for the Surry (81%) and Zion (73%)

plants, and are within the range of IPE results for plants with similar containment designs (40 to 85%) (Exhibit 12, Appendix B, page 21) (see Table 1). As discussed in NUREG/CR-1560, the low values for some plants are attributed to a large contribution from sequences involving complete failure of containment heat removal (CHR) (Exhibit 32, page 12-66). The existence of both fan coolers and containment sprays in the Harris design contribute to a low likelihood of complete failure of CHR at Harris. The Staff concludes that the conditional containment failure probability in the Harris risk analyses (15 to 20%) provides a reasonable estimate of the likelihood of containment failure at Harris from all release modes. For purposes of this assessment, the Staff has used a conditional containment failure probability of 20%, and assessed the contribution to this probability from the various containment failure modes as described below.

67.

Releases from containment can occur as a result of early, late, or very late containment failure due to over-pressurization or thermal attack of the containment pressure boundary, bypass of the containment as would occur in a steam generator tube rupture (SGTR) event, failure to isolate the containment at the outset of an event, and containment failure as a result of phenomena associated with system recovery prior to reactor vessel failure.

These containment failure modes are discussed in the following paragraphs.

68.

Early containment failures include failures up to and shortly following the time of reactor vessel failure. The conditional probability of early containment failure for Harris is 0.3% in the IPE (Exhibit 6) and less than 0.1% in the 1995 PSA (Exhibit 12). These values are lower than the values reported in NUREG-1150 for Surry (0.7%) and Zion (0.5%) (Exhibit 12), and in most IPEs for plants with similar containments (see Table 1). They do not include the contribution from early containment failure in events where core damage progression is arrested prior to reactor vessel breach, i.e., events with in-vessel recovery (3.2% and 6.4% in the IPE and 1995 PSA, respectively). When this contribution is included, the conditional probability of early containment failure at Harris is higher than that in the NUREG-1150 study for Surry and Zion, and in IPEs for similar plants.

69.

Phenomena that can lead to early containment failure include hydrogen combustion (deflagrations and detonations), steam explosions (in-vessel and ex-vessel), direct containment heating (DCH), and thermal attack of the containment liner due to contact with expelled molten core debris (i.e., liner melt-through). The Staff review of the Harris IPE indicated that the phenomena leading to early containment failure were treated in considerable detail in the IPE (Exhibit 12, Appendix B, page 27).

The review identified some minor weaknesses in the IPE submittal pertaining to quantification of basic events, however these basic events were not expected to have a large impact on the overall results for containment failure and radionuclide releases (Exhibit 12, Appendix B, page ix).

70.

The results of both the IPE and 1995 PSA indicate that the likelihood of early containment failure is dominated by sequences which involve hydrogen burns (deflagrations) that result in containment over-pressure failure. These sequences all have containment heat removal (CHR) available and low containment steam concentrations which support early hydrogen combustion (Exhibit 9, page 20000887). Thus, the contribution from hydrogen combustion is reasonable.

71.

The IPE and PSA also consider the potential for containment failure as a result of system recovery after core damage but prior to reactor vessel failure.

As modeled in the containment event tree, these containment failures can occur as a result of: (1) hydrogen burn following in-vessel recovery, (2) containment bypass following in-vessel recovery (if no prior hydrogen-related failure), and (3) containment isolation failure following in-vessel recovery (if no prior hydrogen or bypass failure) (Exhibit 9, page 20000792) The relative contribution from each of these failure modes is difficult to discern from the IPE and PSA documentation, but it appears that the major contribution is from hydrogen-related failures and containment bypass failures.

72.

In the review of the IPE, the Staff noted that the treatment of in-vessel hydrogen generation, combustion, and containment failure in the IPE submittal is very conservative and leads to a high probability of containment failure from hydrogen burn after in-vessel recovery. The conservative large fraction of in-vessel oxidation (75%) assumed for reflood was specifically noted (Exhibit 12, Appendix B, page 9). Based on the documentation provided by the licensee, this assumption has been replaced in the PSA with a hydrogen generation distribution with mean and 95th percentile values corresponding to about 30% and 50% oxidation, respectively (Exhibit 9, pages 20000841 and 20000842), which the Staff considers to be more realistic. The conditional probability of containment failure following in-vessel recovery remains about 6% in the PSA, but most of this is believed to be due to containment bypass following recovery, i.e., creation of an SGTR as a consequence of reflood.

73.

The Staff considers the small contribution to early containment failure from severe accident phenomena other than hydrogen deflagrations to be reasonable given the current understanding of the threat from these phenomena, and the robust design and high pressure capacity of the Harris containment. Specifically, hydrogen detonations and steam explosions have not been found to contribute significantly to early containment failure in other IPEs (Exhibit 32, page 12-56) and the NUREG-1150 analyses for similar containments (Exhibit 28). Direct containment heating (sometimes referred to as high pressure melt ejection) was found to be a leading contributor to early containment failure in the IPEs for most of the plants of this type (Exhibit 32,

p. 12-56). However, subsequent research has shown the conditional probability of containment failure from direct containment heating (DCH) for all Westinghouse plants with large dry containments to be extremely small and the Staff considers the DCH issue resolved for these plants on this basis (Exhibit 33, p. xxi). Finally, liner melt-though was identified as a potential failure mode for some sequences in Harris (sequences involving reactor vessel failure at high RCS pressure and no RWST injection), but the Staff does not consider it feasible that the mass of debris that reaches the liner would be large enough to heat the liner to failure (Exhibit 12, Appendix B,

p. 24).

74.

Given the robust containment for Harris, the Staff expects the conditional probability of early containment failure to be small, and comparable to that for plants of similar design. For purposes of this assessment, the Staff has used a conditional probability of 2% to characterize the likelihood of early containment failure at Harris. This value is larger than that from the Harris IPE (0.3%) (Exhibit 6) and 1995 PSA (<0.1%) (Exhibit 9), and the NUREG-1150 study (0.7% and 0.5%

for Surry and Zion, respectively) (Exhibit 12), and provides some margin to account for the small possibility that some recovered sequences might lead to early containment failure.

75.

The applicants assessment of potential containment failure modes included consideration of failure due to basemat shear, wall-basemat junction shear, cylinder membrane failure and dome membrane failure. The applicant concluded that shear failure of the basemat, at the outer radius of the mat where it joins the containment wall, is the most likely failure mode.

They adopted this failure mode as the characteristic response for the Harris containment, and for purposes of source term assessments assumed that it would result in a 0.5 square meter breach in the containment (Exhibit 9, pages 20000942 through 20000946).

76.

The Staff notes that this failure mode is not borne out by results from limited pressure testing of a scaled concrete nuclear reactor containment vessel performed in 1987 and reported in NUREG/CR-5121 (Exhibit 34-NUREG/CR-5121, Experimental Results from Pressure Testing A 1:6-Scale Nuclear Power Plant Containment, January 1992). Specifically, pressure testing of a 1:6 scale model of a steel-lined reinforced concrete PWR containment resulted in tearing of the liner until leakage through the tear and cracked concrete exceeded the capacity of the pressurization system. Liner tearing occurred at several locations near piping and equipment hatch penetrations prior to predicted failures at other locations, such as shear failure at the basemat. Although pre-test predictions of global response compared favorably to the test results, the mechanism which defined the limit state of the model was not recognized prior to the test by many of the analysts. A similar, more recent test of a 1:4 scale model of a pre-stressed concrete PWR containment (Exhibit 35-NUREG/CR-6678, Pretest Round Robin Analysis of a Prestressed Concrete Containment Vessel Model, August 2000) resulted in a similar failure mode.

77.

The Staff acknowledges that while over-pressure failure of the Harris containment due to shear failure is credible, it is also possible that failure would occur at a somewhat lower pressure due to tearing of the steel liner.

In this case, the failure location may be near a penetration, such as a mechanical penetration or equipment hatch, rather than at the basemat-wall junction, and the associated flow areas and rates would be lower than for the 0.5 square meter breach area assumed by the applicant.

78.

Regardless of which of these failure modes occur, the response of the auxiliary building to a hydrogen-related containment failure is expected to be similar. The releases into the building will be a steam/air mixture with no significant hydrogen, since the hydrogen would be burned during the containment pressurization event. The release will be limited by the breach size, high loss coefficients through the concrete/rebar matrix, and choked flow conditions existing during the burn. The release from containment will diminish rapidly consistent with experiments and analyses which show that containment pressure drops quickly following a burn due to heat transfer to cooler surfaces (Exhibit 36-NUREG/CR-2726, Light Water Reactor Hydrogen Manual, August 1983, page I-15). The reactor auxiliary building (RAB) region into which the release occurs will pressurize. However, pressurization will be limited by venting through connecting ductwork and/or failure of doors into adjacent areas.

Because the breach area is substantially less than the interconnecting flow areas between major compartments within the auxiliary building, the differential pressures within the auxiliary building will be small and the building will respond as a large single compartment. The peak pressure in the auxiliary building will gradually increase to a value about half of the pre-burn pressure in containment, since the volumes of the containment and auxiliary buildings are roughly comparable. The pre-burn pressure in containment is expected to be about 10 psig. (Higher steam concentrations are not expected since the heat removal systems would be available, and substantially higher steam over-pressure would prevent combustion by rendering the atmosphere steam-inerted.) Thus, the final pressure in the RAB would be about 5 psig if operation of the building ventilation system is not considered, and substantially lower relief through the ventilation system is considered.

79.

Late containment failures in the Harris IPE and PSA include failures occurring within the first two days following reactor vessel failure. The conditional probability of late containment failure for Harris is 1.0% in the IPE (Exhibit 6) and 2.2% in the 1995 PSA (Exhibit 9). These values are lower than the values reported in NUREG-1150 for Surry (5.9%) and Zion (24%) (Exhibit 12),

and in the IPEs for plants with similar containments (see Table 1). However, the Harris treats late and very late containment failures separately, whereas, the late containment failures reported for the NUREG-1150 and IPE plants include both late and very late containment failures combined.

The total conditional probability of late and very containment failures at Harris (4.6% and 9.1% in the IPE and PSA, respectively), is comparable to that for the NUREG-1150 analysis for Surry and at the low end of the range of IPE results for similar plants (see Table 1).

80.

Phenomena contributing to late containment failure include buildup and late combustion of hydrogen resulting in rapid over-pressurization of containment, and accumulation of steam and non-condensible gases resulting in gradual over-pressurization of containment. The results of both the Harris IPE and 1995 PSA indicate that late containment failures are dominated by sequences which involve hydrogen burns that result in containment over-pressure failure.

Dominant sequences involve loss of offsite power with reactor coolant pump (RCP) seal LOCA, no operating engineered safeguard features, and late recovery of AC power and restoration of containment heat removal (Exhibit 9, page 20000890).

Combustion occurs as the steam concentration in containment is reduced and a hydrogen burn that can fail containment becomes possible when the atmosphere is no longer steam-inerted (Exhibit 9, page 20000891).

81.

The small probability of late containment failure by gradual over-pressurization is attributed to the following two reasons. First, the containment has a large reactor cavity floor.

Therefore it is highly likely that the debris on the cavity floor will be cooled by an overlying pool of water. Second, the concrete type in Harris is a quartz-based aggregate which is similar to basaltic concrete. The generation of non-condensible gases have been found to be very small for this type of concrete.

Thus, the conditional probability of gradual over-pressure is expected to be low (Exhibit 12, Appendix B, page vi).

82.

The likelihood of late containment failure by gradual over-pressurization would also be reduced by manual actions to vent containment in accordance with plant-specific severe accident management guidelines (SAMG) implemented by the licensee in July 1998 (Exhibits 37-Letter from D.B. Alexander, CP&L, to NRC Document Control Desk,

Subject:

Severe Accident Management Closure, July 30, 1999; Exhibit 38-Letter from T.E. Tipton, NEI, to A. Thadani, NRC, transmitting Westinghouse Owners Group Severe Accident Management Guidance, Revision 0, July 11, 1994). The SAMG provide guidance to the Technical Support Center (TSC) on potential recovery actions and measures to be taken in response to accidents that have progressed beyond the scope of the plant-specific emergency operating procedures. Prior to reaching the containment pressure capacity, the Severe Challenge Guideline 2 (SCG-2) in the SAMG will direct the TSC to identify and evaluate available means for depressurizing the containment, including the use of fan coolers, containment sprays, or containment venting, and to direct the control room operators to implement the selected strategy (Exhibit 38, Volume 2 - Guidelines, SCG-2).

In view of the availability of containment pressure information in the control room and technical support center, the significant amount of time available for evaluation and implementation, and the numerous means by which the containment can be depressurized, the Staff considers it highly likely that gradual over-pressurization would be prevented.

83.

Given the robust containment for Harris, the Staff expects that the conditional probability of late containment failure to be small, and comparable to that for plants of similar design. For purposes of this assessment, the Staff has used a conditional probability of 5% to characterize the likelihood of late containment failure at Harris. This value is larger than that from the Harris IPE (1.0%) (Exhibit 6) and 1995 PSA (2.2%) (Exhibit 9), and slightly less than for the NUREG-1150 plants (Exhibit 12). However, when combined with the conditional probability of very late containment failure discussed below (5%), the total conditional probability of late and very late containment failure (10%) is comparable to that for the Harris IPE (4.6%) and 1995 PSA (9.1%),

and the NUREG-1150 plants, and is within the range of IPE results for similar plants (see Table 1).

84.

Very late containment failures in the Harris IPE and PSA involve cases in which the pressure rise is very slow (due mainly to core-concrete interaction) and containment failure is not expected for several days.

85.

The conditional probability of very late containment failure for Harris is 3.6% in the IPE (Exhibit 6) and 6.9% in the 1995 PSA (Exhibit 9). As discussed above, very late containment failures for the NUREG-1150 and IPE plants are reported as part of late containment failures, and the total conditional probability of late and very containment failures at Harris (4.6% and 9.1% in the IPE and PSA, respectively), is comparable to that for the NUREG-1150 analysis for Surry (Exhibit 12) and at the low end of the range of IPE results for similar plants (see Table 1).

86.

Phenomena contributing to very late containment failure include basemat melt-through or gradual over-pressurization of containment, both of which are due to prolonged core concrete interactions on the reactor cavity floor. Failure to cool the ex-vessel core debris, which could occur even with a pool of water overlying the molten core debris, would result in prolonged steam and non-condensible gas generation as the debris attacks the concrete by ablation. Plant-specific calculations for Harris indicate a minimum time to basemat melt-through of about 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br />.

The time of containment over-pressure failure in sequences without Refueling Water Storage Tank (RWST) injection and containment heat removal is also estimated to be about 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br />.

(Sequences with RWST injection result in earlier over-pressure failure and are treated as late rather than very late containment failures) (Exhibit 9, page 20000890). The results of both the Harris IPE and 1995 PSA suggest that very late containment failures are dominated by basemat melt-through (Exhibit 9). Associated releases would be into the subsoil below the basemat and would not be expected to impact the habitability of the auxiliary building or fuel handling building.

87.

As discussed above in the context of late containment failures, a small probability of late containment failure by gradual over-pressurization is reasonable given the Harris cavity design and concrete composition, and Severe Accident Management Guidelines that would direct the operators to depressurize containment prior to reaching the containment pressure capacity.

For purposes of this assessment, the Staff has used a conditional probability of 5% to characterize the likelihood of very late containment failure at Harris. As discussed above under late containment failures, this provides a total conditional probability of late and very late containment failure of 10%

which is comparable to that for the Harris IPE and 1995 PSA, and the NUREG-1150 plants, and is within the range of IPE results for similar plants.

88.

Containment isolation failures involve failures to isolate a major containment penetration prior to core damage, this includes large penetrations, such as personnel airlocks and equipment hatches, and smaller penetrations, such as piping systems that could communicate with the external environment. The conditional probability of isolation failure for Harris is 0.3% in the IPE (Exhibit 6) and 1.6% in the 1995 PSA (Exhibit 9). These values are similar to that estimated in the NUREG-1150 Zion analysis (1%) (Exhibit 12), and in the IPEs for plants with similar containments (see Table 1). Isolation failures were important in a number of plants, especially if no credit is given for manual isolation in the analysis, but releases were generally calculated to be small (Exhibit 32, page 12-56).

89.

In the Harris IPE, a small isolation failure was the dominant contributor and was modeled as a small LOCA with a stuck-open Residual Heat Removal (RHR) relief valve. (All containment safeguards function, the reactor vessel fails and debris is discharged to the reactor cavity, and sprays and water pools provide fission product scrubbing). Large isolation failures were modeled but did not contribute significantly to containment failure (Exhibit 6, p. 4-178). In the 1995 Harris PSA the dominant contribution to isolation failures is a large seismic event which fails containment (Exhibit 9, p. 20000891).

90.

The Staff notes that the isolation failure modes in both the Harris IPE and PSA would result in a similar auxiliary building response, i.e., a gradual pressurization in response to leakage through the penetration/breach as the containment is pressurized. Also, most potential isolation failures would result in releases into the area treated by the reactor auxiliary building ventilation system. However, releases into the auxiliary building could contain unburned hydrogen potentially rendering the building atmosphere flammable late in the event.

91.

For purposes of this assessment, the Staff has used a conditional probability of 2%

to characterize the likelihood of containment isolation failure at Harris. This value is larger than that from the Harris IPE (0.3%) and 1995 PSA (1.6%), and the NUREG-1150 study (1.0% for Zion), and is comparable to that from the IPEs for similar plants (see Table 1).

92.

Containment bypass failures involve direct bypass of the containment due to either a LOCA outside, e.g., an interfacing system LOCA (ISLOCA), or a steam generator tube rupture (SGTR) event. The total conditional probability of interfacing LOCA and SGTR for Harris (7.2%

and 3.0% in the IPE (Exhibit 6) and PSA (Exhibit 9), respectively) is comparable to that for the NUREG-1150 analysis for Surry (12.2%) and the IPE results for similar plants (see Table 1). The major contributors to containment bypass are discussed below.

93.

ISLOCA As part of the Harris risk study, all systems interfacing with the RCS were identified and screened to assess the potential for ISLOCA. The dominant events identified were a large break ISLOCA in the RHR suction line and a medium break ISLOCA in the safety injection lines. The conditional containment failure probability due to an ISLOCA for Harris is 0.7% in the IPE (Exhibit 6) and 0.9% in the 1995 PSA (Exhibit 9). These values and the corresponding event frequencies are similar to that estimated in other IPE submittals (see Table 1) and in the NUREG-1150 analysis for Zion (0.2%) (Exhibit 12). The Staff considers the above conditional probability of ISLOCAs and potential failure locations to be reasonably representative of this class of event.

For purposes of this assessment, the Staff has used a conditional probability of 1% to characterize the likelihood of ISLOCA.

94.

The ISLOCA will result in a rapid steam discharge into the reactor auxiliary building, which would result in substantial building pressurization, on the order of 20 psig for the entire auxiliary building, and potential failure of doors or other portions of the auxiliary building. The initial blowdown will not include significant fission products since core damage would not yet have occurred.

Since the ISLOCA is characterized as a large LOCA, the fission products will be released into the auxiliary building later, at the time and rate at which they are released from the core. By the time of fission product release, the pressures within the auxiliary building will be equilibrated and the release path through the building to the environment will depend on the auxiliary building failure locations.

95.

SGTR The conditional probability of an SGTR for Harris is 6.5% in the IPE (Exhibit

6) and 2.1% in the 1995 PSA (Exhibit 9). These values are comparable to that for the NUREG-1150 analysis for Surry (4.6%) and higher than the NUREG-1150 value for Zion (0.3%) (Exhibit 12).

96.

As noted above in the context of early containment failure, the IPE and PSA also consider the potential for containment failure as a result of system recovery after core damage but prior to reactor vessel failure.

As modeled in the containment event tree, these containment failures can occur as a result of: (1) hydrogen burn following in-vessel recovery, (2) containment bypass following in-vessel recovery (if no prior hydrogen-related failure), and (3) containment isolation failure following in-vessel recovery (if no prior hydrogen or bypass failure). The relative contribution from each of these failure modes is difficult to discern from the IPE and PSA documentation, but it appears that the major contribution is from hydrogen-related failures and containment bypass failures.

97.

Both Harris risk studies considered spontaneous SGTR events (i.e., SGTR-initiated events lead to core damage) as well as temperature-induced SGTR events (i.e., events that proceed to core damage for reasons other than a SGTR, but result in an induced-SGTR as a consequence of higher steam generator temperatures associated with core damage). Fission product releases to the environment would generally occur coincident with core damage for both types of events (about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> for temperature-induced SGTR events, and 10 to 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for SGTR-initiated core damage events), and would enter the environment via pipe risers attached to the discharge port of steam generator relief valves (above the roof at the 305' elevation).

98.

The IPE indicates a high conditional probability of temperature-induced SGTR events based largely on the emergency operating procedures (EOPs) in place at that time. The EOPs required the plant operators to restart the reactor coolant pumps, if available, when there is inadequate core cooling. This results in clearing of the reactor cooling pump (RCP) loop seal, and establishes a path for natural circulation to the steam generators. Accordingly, there is a high probability of induced SGTR in the IPE due to natural circulation of hot gases (Exhibit 12, Appendix B, page 22).

99.

Subsequent to the IPE, the Harris EOPs were modified to address concerns related to temperature-induced SGTR.

This included changes to preclude steam generator depressurization in cases where the potential for induced SGTR might be increased by depressurization (Exhibit 15, Specific Interrogatory No. 6). The lower conditional containment failure probability for SGTR events in the 1995 PSA (2.1%) reflects incorporation of these procedure changes.

100.

An NRC staff risk assessment of severe accident-induced SGTR completed in 1998 indicates that degradation of the steam generator tubes and presence of pre-existing flaws could impact the likelihood of temperature-induced SGTR events (Exhibit 39-NUREG-1570, Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture, March 1998). This should not be a significant factor for Harris since the applicant is planning to replace the Harris steam generators during a future outage. Furthermore, as discussed in Paragraph 103, releases from SGTR events will not preclude access into areas required to establish SFP makeup, and hence do not impact the Staffs assessment of the seven-step sequence.

101.

For purposes of this assessment, the Staff has used a conditional probability of 5%

to characterize the likelihood of containment bypass due to SGTR at Harris.

This value is comparable to the NUREG-1150 study for Surry (4.6%), and larger than the Harris 1995 PSA (2.1%) to account for the possibility that some recovered sequences might lead to induced SGTR.

TABLE 1 Percent of Core Damage Frequency Resulting in Various Containment Release Modes Containment Release Mode Harris -- All Analyzed Sequences NUREG-1150 IPE Results for Other Westinghouse Plants with Large Dry, Reinforced Containments Staff Estimate for Harris SFP Analysis 1995 PSA IPE (1993)

Surry, Unit 1 Zion, Unit 1 Low Mean High Early CF

<0.1 0.3 0.7 0.5 0.1 2.4 4.8 2

Late CF 2.2 1.0 5.9 24.0 9.0 37.8 53.9 5

Very Late CF 6.9 3.6 N/A 1 N/A 1 N/A 1 N/A 1 N/A 1 5

Isolation Failure 1.6 0.3 N/A 2 1.0 0.0 1.6 7.0 2

Bypass 1.3 4.4 8.2 SGTR 2.1 6.5 4.6 0.3 5

ISLOCA 0.9 0.7 7.6 0.2 1

CF after recovery 6.4 3.2 N/A 2 N/A 2 N/A 3 Intact 79.9 84.4 81.2 73.0 39.4 53.8 84.7 80 CDF 5.4E-5 7.0E-5 4.1E-5 6.2E-5 1

included as part of late containment failure 2

included as part of early containment failure 3

Not treated as a separate contributor -- considered to be included within the probability values assigned to early containment failure and bypass failure Containment Release Mode Failure Mechanism Dominant Contributor Release Location Time of Release Release Characteristics Early Containment Failure rapid over-pressure large H2 burn lack of other contributors is consistent with state of knowledge. Specifically, DCH and alpha mode failures no longer considered to be significant contributors to early failure, and liner melt-thru failures are not relevant for Harris outer radius of basemat where it joins containment wall IPE and PSA indicate that gross failure rather than leak-before-break would occur, and assumed a 0.5 meter breach at/near time of reactor vessel breach steam air mixture with no significant H2 (since H2 would be burned during containment pressurization event) puff-type release upon exceeding containment pressure capacity release rate into auxiliary building will be limited by breach size, high loss coefficients through concrete/rebar, and choked flow conditions, and will diminish rapidly since containment pressure drops quickly following a burn due to heat transfer to cooler surfaces breach area is substantially less than flow areas between auxiliary building compartments, thus differential pressures within the auxiliary building would be small, and the building will respond as a single compartment peak pressure in auxiliary building will gradually increase until the pressure boundary is breached Late Containment Failure rapid over-pressure due to H2 burn (at recovery),

or gradual over-pressure due to steam/non-condensibl e gas accumulati on (in unrecovere d

sequences) large H2 burn at recovery gradual over-pressure may also contribute to late failures. However, it is expected that steps would be taken by the TSC in accordance with the plant-specific SAMG to depressurize the containment (by manual venting) prior to reaching the containment failure pressure. Thus, the contribution from gradual over-pressure is expected to be small for rapid over-pressure failures, failure is expected to occur at outer radius of basemat where it joins containment wall for gradual over-pressure sequences, releases are expected to be in the same location, unless actions to manually vent containment are taken, in which case the release location will depend on the vent line selected at time of recovery in recovered sequences (due to H2 burn) at 24-90h in unrecovered sequences (due to gradual over-pressure failure or manual venting) puff-type release of steam/air mixture in recovered sequences (due to H2 burn) more sustained release of steam/air/hydrogen mixture in unrecovered sequences (due to gradual over-pressure or manual venting) auxiliary building pressure response will be similar to that for early containment failure (see above)

Very Late Failure basemat melt-thru or gradual over-pressure due to steam/non-condensibl e gas accumulati on basemat melt-thru over-pressure failures are considered to have negligible contribution relative to basemat melt-through releases would be into subsoil below basemat, and would not impact habitability of auxiliary or SFP buildings at about 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br /> following reactor vessel breach N/A Isolation Failure failure to isolate a major containmen t

penetration prior to core damage.

Both large penetration s (e.g.,

containmen t purge

lines, personnel

airlocks, and equipment hatches) and small penetration s (e.g.,

in PSA, dominant contributor is large isolation failure due to a seismic event that fails containment in IPE, dominant contributor is small isolation failure, modeled as a small LOCA with a stuck open RHR relief valve the PSA (and IPE) also models the potential for containment failure following recovery.

Associated releases are modeled as a small isolation failure involving failure to reseat RHR relief valve for seismic failure of containment, releases would be expected to occur at outer radius of basemat where it joins containment wall (need to confirm this) for all other events, releases would be into the compartment in which the RHR relief valve would discharge although not identified as a dominant isolation failure path in the PSA, failure of containment purge valves may represent an additional release location coincident with core damage gradual release of steam/hydrogen mixture -- blowdown would not be expected to result in significant pressurization of the auxiliary building. H2 concentrations in reactor building could potentially be flammable depending on size of RCS break relative to RHR relief valve/line Bypass Failure direct bypass of the containmen t due to either a LOCA outside containmen t (ISLOCA) or a SGTR ISLOCA, SGTR with failed open SRVs, and SGTR with cycling SRVs contribute about equally in the PSA releases for ISLOCA would occur somewhere within the low pressure piping boundary. Break may or may not be submerged depending on break location.

If submerged, releases will be scrubbed by overlying pool resulting in substantially less contamination in other areas of the building releases for SGTR events would be via the steam generator secondary side relief valves steam blowdown (clean release) at event initiation followed by a later, gradual release of fission products coincident with core damage initial steam blowdown in ISLOCA could result in auxiliary building pressurization sufficient to fail doors and weak structures in the building pressure boundary (about 10 to 20 psig, but would need to confirm). At the time of fission product release, pressures will be equilibrated thereby reducing dispersion in the building Intact Containment containmen t integrity is maintained.

releases are limited to leakage at or below the design basis leak rate N/A mechanical and electrical penetration areas, personnel airlock, equipment hatches coincident with core damage leakage at design basis leak rate. Substantial fission product removal by sprays and natural processes Assessment of the Impact of Containment Failure on Spent Fuel Pool Cooling 102.

The Staff evaluated the likelihood that releases from the postulated containment failure could cause the concomitant failure of spent fuel pool cooling. This evaluation focuses on two possible failures. The first involves the component cooling water (CCW) system. Since CCW is the cooling medium for the spent fuel pool heat exchangers, such a failure would make it difficult to restore normal cooling to the spent fuel pools. The CCW pumps and heat exchangers are located on the 236 elevation of the reactor auxiliary building (RAB) along the far wall of Area D.

The two CCW trains are located at opposite ends of the RAB (Exhibit 40-CP&L Engineering Drawing CAR-2165 G-016, General Arrangement Reactor Auxilliary Building Plan EL. 236.00').

The second area of interest is the emergency and normal switchgear area located on the 286 elevation (in Area D). Battery rooms are also located in this area (Exhibit 41-CP&L Engineering Drawing CAR-2165 G-018, General Arrangement Reactor Auxilliary Building Plan EL. 286.00').

(To facilitate the following discussion, the areas of the RAB will be designated as shown on the following figure.

This plan does not represent any particular elevation.

Not all areas will be applicable to all elevations.)

A B

C D

E F

G H

103.

The containment is the last of the three barriers to the release of fission products to the environment. The other two barriers are the reactor fuel and the reactor coolant system.

Failures of the containment barrier are grouped as (1) containment bypasses, (2) containment isolation failures, (3) interfacing system LOCAs (ISLOCA), and (4) failure of the containment structure. The applicant considered containment failure and bypasses in the IPE (Exhibit 6) and PSA (Exhibit 9). The Staff considered these failure mechanisms in performing this evaluation, as discussed in the following paragraphs.

104.

The containment bypass sequence considered by the licensee is a steam generator tube rupture in which the affected steam generator cannot be isolated from the reactor coolant system due to a steam relief valve that failed to shut. The steam relief valves are located on the main steam lines and serve to relieve over-pressure conditions by exhausting steam to the environment. The steam generator relief valves are located within the main steam valve area.

Pipe risers attached to the discharge port of these valves extend beyond the roof at the 305 elevation (Exhibit 42-CP&L Engineering Drawing CAR-2165 G-019, General Arrangement Reactor Auxilliary Building Plan EL. 305.00'). Since these releases are direct to the environment, the Staff concludes that this pathway cannot reasonably affect the CCW components on the 236 elevation or the switchgear on the 286 elevation.

105.

Numerous piping systems penetrate the containment to provide needed functions during normal operations. Many of these functions are not needed or are otherwise undesirable during an accident and the associated piping penetrations are automatically isolated when containment isolation is actuated. A containment isolation failure occurs when one or more of these valves fail to shut, providing a path for the release of radioactive material from the containment. The majority of these penetrations, and the systems to which they are connected, are located within areas of the RAB that are exhausted by the RAB normal ventilation system (RABNVS) or the RAB emergency exhaust system (RABEES) (Exhibit 43-Shearon Harris Nuclear Power Plant Final Safety Analysis Report (FSAR) Chapter 6-section 6.5.1.2.2; Exhibit 20, section 9.4.3).

106.

The RABNVS draws in and conditions outside air, distributes the air throughout the RAB, and exhausts the air to the environment via the main plant stack. The RABNVS is not required to operate during an accident condition. The RABNVS is not powered from emergency buses. On receipt of a safety injection signal (which is expected on high containment pressure for the accident sequences that are the subject of this affidavit), the RABNVS supply and exhaust are shutdown and selected dampers are re-aligned to allow selected areas and cubicles within the RAB to be exhausted by RABEES to the environment via the main plant stack.

RABEES is an engineered safeguards feature that collects, filters, and releases processed contaminated exhaust via the main plant stack. RABEES maintains a slight negative pressure in the affected areas. The post-accident alignment of the RABNVS and the RABEES provides for the removal of airborne radioactive material released to the RAB while minimizing the re-introduction of the radioactive materials via the RAB outside air intakes (Exhibit 43, section 6.5.1.2.2; Exhibit 20, section 9.4.3).

107.

Should the event involve a station blackout, the RABNVS and RABEES would not be operational since the fans would not be energized. However, the boundary between areas exhausted by RABEES and those areas that are not exhausted by RABEES must be reasonably leak tight in order for the RABEES to maintain the required slight negative pressure with the relatively small design exhaust flow rate (6,600 cubic feet per minute (cfm) each train) (Exhibit 43, Table 6.5.1-3). Although the RABEES fans would be de-energized during a station blackout, the RABEES ductwork provides a means for steam and radioactive material releases to be vented from the affected areas to other areas and even to the main plant stack. The Staff assumes that such flow would be driven by pressure differentials caused by the containment failure since the fans would not be operating. Although the pressure differential may exceed the pressure capability of the RABEES ductwork and cause a duct rupture, the Staff believes that it is likely the pressure could still be dissipated as the duct, intact or ruptured, would still provide a path through walls or floors to adjacent areas.

108.

There are some significant penetrations that are not located in areas exhausted by RABEES:

First, the normal personnel containment access airlock opens into an area on the RAB 236 elevation that provides a relatively unimpeded pathway to one of the CCW pumps (Exhibit 40; Exhibit 44-Shearon Harris Nuclear Power Plant Final Safety Analysis Report (FSAR) Chapter 3-section 3.8.1.1.3.3).

Second, an emergency exit airlock opens out into the 261 elevation (Exhibit 45-CP&L Engineering Drawing CAR-2165 G-017, General Arrangement Reactor Auxilliary Building Plan EL. 261.00';

Exhibit 44, section 3.8.1.1.3.3). Both of these airlocks have two interlocked doorsone inside containment, one outside containment. The inside airlock door seats with increasing containment pressure, thereby minimizing potential leakage. Leakage through these airlocks is monitored by periodic surveillances (Exhibit 43, section 6.2.6). The Staff concludes that no significant leakage would be expected via these penetrations.

Third, an equipment hatch opens into an enclosed area located on the 286 elevation (Exhibit 41; Exhibit 44, section 3.8.1.1.3.3).

This equipment hatch is welded closed.

There is a smaller opening in this hatch cover that is sealed by a gasketed bolted flange. Leakage via this hatch is periodically monitored (Exhibit 43, section 6.2.6). The Staff concludes that no significant leakage would be expected via this penetration. In addition, the enclosed area is separated from other areas on the 286 elevation, including the emergency and normal switchgear areas by two airlocks.

Fourth, the containment purge supply and exhaust ducts penetrate the containment through two motor operated isolation valves. The 42 diameter ducts are closed during normal operation and would remain closed during an accident condition.

An 8 purge line connects inside the 42 isolation valves that provides a purge capability used during normal operations. This purge line isolates automatically on a safety injection signal and the isolation dampers fail closed. This purge line connects with the ventilation system and is exhausted via the main plant stack (Exhibit 20, section 9.4.7). As such, releases from these penetrations cannot reasonably impact CCW.

Fifth, the main steam lines and the feed water lines penetrate the containment within the main steam valve area. This area, which extends from the 261 elevation to the 318 elevation and ends in an enclosure located above the 305 elevation roof, is designed to withstand high-energy line breaks (Exhibit 46-CP&L Engineering Drawing CAR-2165 G-021, General Arrangement Reactor Auxilliary Building Sections Sheet 2). This area is enclosed by 4-5 thick poured concrete walls.

Releases and energy from failures in this area would rise in this area and be exhausted to the environment. As such, there would be no impact on the CCW components on the 236' elevation or the normal and emergency switchgear on the 286' elevation.

109.

There are various emergency core-cooling systems that interconnect with the reactor coolant system. These systems are designed to operate at pressures that are less than the normal operating pressure of the reactor coolant system. A check valve is often used to block flow from the high-pressure system to the low-pressure system.

When the reactor coolant pressure is reduced (e.g., as the result of a LOCA), the check valve allows the intended flow into the reactor coolant system. An ISLOCA occurs when one of these check valves fail and result in the over pressurization and failure of the low-pressure piping. The affected piping and systems are located in areas exhausted by RABEES and the conclusions drawn earlier in Paragraphs 105 through 108 regarding isolation failures would apply (Exhibit 40; Exhibit 41; Exhibit 42; Exhibit 45; Exhibit 47-CP&L Engineering Drawing CAR-2165 G-015, General Arrangement Reactor Auxilliary Building Plan EL. 190.00' & 216.00'; Exhibit 43, section 6.5.1.2.2).

110.

Containment overpressure failures were postulated by the licensee in the Harris IPE and PSA to result in a 0.5 meter breach at the intersection of the containment wall with the containment basemat due to an overpressure caused by a hydrogen burn. The overpressure event will vent through the breach into the RAB 216' elevation. Although the pressure pulse inside the containment will be rapid, the containment pressure will quickly decay to the pressure that existed prior to the combustion. Given the volume for expansion afforded by the RAB, the size of the postulated break, and the extensive surfaces for steam condensation, the Staff concludes that there would be a gradual buildup of pressure in the RAB rather than a pressure spike.

The postulated containment breach could occur anywhere on the circumference of the containment on the 216' elevation (Paragraph 112).

111.

The RAB is largely constructed of poured concrete. Exterior walls vary, but are at least 4' thick to 305' elevation and 3' thick above there. The areas are separated by internal walls that vary in thickness. Fire doors, stairwells, and some open passageways connect adjacent areas.

The interior walls that separate areas D, E, F, G, and H are at least 3-4 thick. Floor slabs and the roof are 2' thick. These configuration details can be viewed on the plant arrangement drawings (Exhibit 40; Exhibit 41; Exhibit 42; Exhibit 45; Exhibit 46). The Staff concludes that floors and walls will not be challenged as the containment release will dissipated throughout the RAB via the doors and ventilation ducts. The Staff bases this qualitative conclusion on (1) the postulated gradual pressure buildup (See Paragraph 110), (2) the thickness of floor slabs and the interior walls, (3) the existence of comparably weaker fire doors and open passageways, (4) the RABEES ductwork (See Paragraph 106), and (5) the mass of surfaces (e.g., piping and components, structural steel, concrete walls and floors) available as a heat sink to reduce steam energy.

112.

A containment breach on the RAB 216 elevation could occur in Areas E, F, G, and H. These areas are separated by standard fire doors. Given the relative strength of the reinforced concrete walls as compared to the fire doors into adjacent areas, such as the waste processing building, and to the 190', 216', 236', and 261' elevations of Areas E and F of the RAB via one of two stairwells.

These stairwells are open between elevations but are separated from each elevation by a fire door. The release could also be transported via the RABEES ductwork to the other elevations served by RABEES (as well as expanding up through the plant main stack).

Although the pressure surge might collapse or rupture a run of ductwork, the Staff believes that such a failure will still provide a pathway for pressure to dissipate. This dissipation of energy is expected to reduce the overall pressure in the RAB, reduce the challenge to the walls and floors, and reduce the steam energy that reaches the area containing the CCW pumps. The release from a breach into Area H of the 216 elevation would be expected to expand via failed fire doors into Areas E, F, or G, or the 216 elevation of the FHB and not affect CCW components on the RAB 236' elevation. A breach in Area G on the RAB 216 elevation will not affect the CCW components on the 236' elevation or the switchgear on the 286' elevation as the release will likely expand into the waste processing building (WPB) via the open passageways.

113.

Since the two stairwells do not extend to the RAB 286 elevation, and since RABEES does not serve the 286 elevation, it is unlikely that the release from a breach in the containment would impact the normal and emergency switchgear areas, which are located on the 286' elevation in Area D.

114.

Assuming the release from the containment breach does reach Areas E and F of the RAB 236 elevation, the release must fail an additional fire door on the RAB 236 elevation in order for the release to expand from Areas E and F to environs of the CCW pump and heat exchangers, which are located in Area D on the 236' elevation. The Staff believes that it is unlikely, given the pressure relief into other areas, that the release would reach the CCW pumps with sufficient energy to cause damage. While the release might have the potential to increase local area temperature and humidity, the CCW pump areas are ventilated by the RAB engineered safeguards features equipment cooling system (Exhibit 20, section 9.4.5.2).

115.

Although the above evaluation is largely qualitative, the Staff concludes with reasonable assurance that a release from the containment will either not reach the CCW components and the switchgear, or will reach the components and switchgear with insufficient latent energy to have an adverse impact on this equipment or create an environmental condition that would lead to subsequent failure of CCW.

116.

Therefore, the probability of a severe core damage accident and an interruption of spent fuel pool cooling is estimated to be 6.3E-05/reactor year (or 6.3 occurrences per 100,000 years).

Assessment of Possibility of Restart of Spent Fuel Pool Cooling or Makeup Systems 117.

The assessment of the possibility of restart of spent fuel pool cooling or makeup systems takes into consideration the following: the time available to perform the recovery actions; the timing of containment failure; and the doses expected in areas required to be accessible. The next section discusses the time available to take action to prevent fuel uncovery.

Timing for Spent Fuel Pool Heat Up 118.

The time available to plant operators to take mitigating actions in the event of a loss of cooling to the spent fuel storage pools is a function of the decay heat of the stored fuel and the capacity of the fuel storage system heat sink. Decay heat is a function of the fuels operating history and amount of time since the fuel was last used to generate power. Spent fuel decay heat decreases with time from the last reactor shutdown. The credited heat sink is conservatively comprised of the available coolant to be heated and evaporated in the fuel pools once forced cooling is lost. For conservatism, it is also assumed that all decay heat is transferred from the stored fuel to the fuel pool coolant.

119.

Although the subject of this proceeding is the effects of the postulated accident sequence on the safe storage of spent fuel in spent fuel pools C and D, the largest heat loads in the spent fuel storage system will reside in spent fuel pools A and B, which are not under consideration here, but where the most recently discharge fuel from the Harris Unit 1 reactor is stored (Exhibit 27, Specific Interrogatory #7, heatload spreadsheet). The higher heat loads in pools A and B will result in more rapid pool heat up rates and evaporation rates and will provide a more conservative result than assessing the effects of losing forced cooling and makeup to spent fuel pools C and D.

The affects of a sustained loss of cooling on all four fuel storage pools are discussed in the following paragraphs.

120.

Spent fuel storage pools C and D are currently not authorized to store spent fuel.

The licensee initially plans to store spent fuel with decay heat levels up to 1,000,000 BTU/hr in fuel pool C with fuel pool D isolated (Exhibit 21, p.5 of Encl. 1; Exhibit 27, Specific Interrogatory #7, heat load spreadsheet). In the future, the licensee plans to operate fuel pools C and D as a system by removing isolation gates 7 and 9 to transfer canal 2/3 (north transfer canal), along with gate 8 that isolates the cask loading pit (Exhibit 48-Applicants First Supplemental Response to the NRC Staffs First Set of Interrogatories and Requests for Production of Documents Directed to the Applicant Regarding Contention EC-6, October 20, 2000, Specific Interrogatory #8, p.2). See Fig

1. With the gates 7, 8, and 9 removed, fuel pool coolant can flow freely between pools C and D, the north transfer canal, and the cask pit, with the system of interconnecting pools acting as a single heat sink.

Figure 1 - FHB Bulkhead Gate Configuration After Activation of Fuel Pools C and D (Exhibit 48, Specific Interrogatory #8, FIG. 2) 121.

Likewise, for the fuel stored in pools A and B, CP&L will operate with gates 3 and 4 to transfer canal 1/4 (south transfer canal) removed, allowing those storage locations to share inventory (Exhibit 48, Specific Interrogatory #8, FIG. 2). A main transfer canal runs the length of the FHB, connecting the north end fuel pools to the south end fuel storage systems. CP&L plans to align the main transfer canal with pools A and B by removing gate 1 during normal operations (Exhibit 48, Specific Interrogatory #8, FIG. 2). In this configuration, the coolant available in the main transfer canal is available to pools A and B as a makeup source. It is reasonable to expect that the four pools would be in the configuration shown in Figure 1 at the beginning of the postulated event sequence (Exhibit 48, Specific Interrogatory #8, Table 4).

122.

CP&Ls supplemental response (Exhibit 27, Specific Interrogatory #7) includes a heat load analysis for the four fuel storage pools, calculating the time it would take to boil the coolant in the fuel pools given a complete loss of forced cooling, and the coolant makeup requirements to the fuel pools to offset the effects of evaporation. The NRC reviewed the calculations as part of this proceeding and found them to be acceptable for the purpose of estimating the time to boil and the required makeup capacity to offset losses in pool coolant due to boiling.

123.

The results of the calculations indicate that more than 384 hrs would be available from the time forced cooling is lost until the fuel pool C would reach boiling, assuming the maximum expected heat load of 1 MBTU/hr in the fuel pool C (Exhibit 27, Specific Interrogatory

1. 7). The time to boil assumes the pool is at an initial operating temperature of 95 °F, with fuel pool D isolated (Exhibit 27, Specific Interrogatory #7).

124.

Once the pool reaches boiling temperatures, operators must reestablish forced cooling or provide makeup at a rate that prevents a loss of coolant level in the fuel pools. If no mitigative actions are taken to provide coolant makeup to the fuel pools, it would take an additional 2399 hours0.0278 days <br />0.666 hours <br />0.00397 weeks <br />9.128195e-4 months <br /> for a total of 2783 hours0.0322 days <br />0.773 hours <br />0.0046 weeks <br />0.00106 months <br /> (116 days) to boil the coolant from fuel pool C and the north transfer canal down to a level equivalent to the top of the spent fuel storage racks (Exhibit 27, Specific Interrogatory #7). For conservatism, the NRC did not attempt to credit the coolant in the spent fuel storage racks, the coolant between the fuel storage racks and spent fuel pool walls, or the coolant below the fuel storage racks. Rather, the NRC assumes that if the coolant level decreases to the top of the fuel storage racks, it is unlikely that the level will be recovered before the pool boils dry.

125.

If operators are to be successful in maintaining fuel pool level constant, they must provide makeup water to the fuel pools at a rate that is equivalent to the evaporation rate.

With the maximum heat load in fuel pool C, a makeup flow rate of 2 gallons per minute (gpm) would have to be established to maintain fuel pool level (Exhibit 27, Specific Interrogatory #7).

126.

CP&L has plans in the future to operate fuel pools C and D and the north fuel transfer canal as a single heat sink and increase the allowable heat load to be stored in fuel pools C and D to 15.6 MBTU/hr. This heat load limit has not been reviewed and approved by the NRC. For the purpose of this proceeding, however, the effect of this heat load increase in fuel pools C and D was evaluated for the postulated accident sequence. Under these heat load conditions and assuming forced cooling was lost to pools C and D, the pools would heat up from their normal operating temperature of 95 °F, reach boiling in approximately 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br />, and boil down to the top of the fuel storage racks in 211 hours0.00244 days <br />0.0586 hours <br />3.488757e-4 weeks <br />8.02855e-5 months <br />, a total of 245 hours0.00284 days <br />0.0681 hours <br />4.050926e-4 weeks <br />9.32225e-5 months <br /> or 10 days, assuming no operator actions to restore cooling or align makeup water (Exhibit 27, Specific Interrogatory #7). Under these increased decay heat load conditions, coolant makeup requirements for pools C and D would increase from 2 gpm to 34 gpm (Exhibit 27, Specific Interrogatory #7).

127.

Comparing the effects of losing cooling to pool C with a 1,000,000 Btu/hr heat load (the maximum allowable if the proposed licensing action were approved) with the higher heat loads in pools A and B, it would take more than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> to heat pools A and B from their initial temperature of 95 °F to boiling, and then an additional 173 hours0.002 days <br />0.0481 hours <br />2.86045e-4 weeks <br />6.58265e-5 months <br /> for a total of 193 hours0.00223 days <br />0.0536 hours <br />3.191138e-4 weeks <br />7.34365e-5 months <br /> (8 days) to boil the coolant level down to the top of the fuel storage racks, assuming no operator actions to add makeup to the pools or restore forced cooling (Exhibit 27, Specific Interrogatory #7, spreadsheet). The decay heat load in fuel pools A and B conservatively assumes that the postulated accident sequence occurs at the beginning of the operating cycle when the decay heat of the previous refueling offload is at its highest (Exhibit 27, Specific Interrogatory #7, spreadsheet). By comparison, if the postulated accident sequence were to occur at the end of the operating cycle, the time-to-boil would increase from 20 to 38.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, and the time to boil off the inventory of the fuel pools and south and main transfer canals would increase from 173 to 325 hours0.00376 days <br />0.0903 hours <br />5.373677e-4 weeks <br />1.236625e-4 months <br /> (Exhibit 27, Specific Interrogatory #7, spreadsheet). The total time for operators to take action to restore cooling or initiate makeup to the fuel storage system under these heat load conditions would be 364 hours0.00421 days <br />0.101 hours <br />6.018518e-4 weeks <br />1.38502e-4 months <br />, or 15 days.

128.

To maintain level in pool A and B, operators must supply makeup coolant at a rate at least as great as the boil off rate. At the beginning of the cycle, a makeup flow rate of 54 gallons per minute (gpm) would have to be established to maintain level in fuel pools A and B. At the end of the operating cycle, due to the lower decay heat load of the stored fuel, only 29 gpm of coolant makeup would be necessary to maintain inventory level (Exhibit 27, Specific Interrogatory #7, spreadsheet).

129.

Therefore, the total makeup requirements for a sustained loss of cooling event for all four pools at the beginning of the operating cycle would be 56 gpm, and would decrease to 31 gpm at the end of the operating cycle, assuming a 1 MBTU/hr decay heat load limit in fuel pools C and D (Exhibit 27, Specific Interrogatory #7, spreadsheet). If the licensee were authorized to increase their decay heat load limit in pool C and D to 15.6 MBTU/hr, makeup requirements would proportionally increase from 56 to 88 gpm at the beginning of the operating cycle, and then decrease to 63 gpm by the end of the operating cycle (Exhibit 27, Specific Interrogatory #7, spreadsheet).

130.

If the postulated accident sequence occurs at the beginning of an operating cycle and includes a loss of offsite power, operators would expect to receive control room alarms indicating a loss of spent fuel pool cooling. With an initial coolant temperature of 95 °F, and assuming the beginning of cycle heat load assumed in Exhibit 27, Specific Interrogatory

1. 7, spreadsheet, a fuel pool high temperature alarm would annunciate within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

Annunciator response procedure ALB-023-4-16 (Exhibit 49-Shearon Harris Nuclear Power Plant, Plant Operating Manual, Annunciator Response Procedure, APP-ALB-023) directs the operator to check the status of the spent fuel pool cooling water pumps, and to start a pump if none is running (Exhibit 49, 4-16, p.1). Pump operation is controlled from the main control room (Exhibit 25, p.9). If the operators acknowledge this alarm, but take no action at this time, the pools will continue to heat up (pools A and B faster than pools C and D), and after approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />, pools A and B will reach boiling (Exhibit 27, Specific Interrogatory #7, spreadsheet). Due to evaporation, the level of pools A and B will decrease at a rate of 1.69 inches per hour, and reach the fuel pool low level alarm after approximately 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (23.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after the initial loss of cooling to the fuel pools) (Exhibit 27, Specific Interrogatory #7, spreadsheet; Exhibit 25, p. 7). Annunciator response procedure ALB-023-4-17 directs operators to check the level in the fuel pools and to increase level in the pool to clear the alarm.

(Exhibit 49, 4-17, p.2). Fuel pools C and D would be heating up more slowly and would not have begun to boil at this time.

131.

If the postulated accident sequence were to occur closer to the end of the cycle, the reduced decay heat load in the fuel pools would extend the time available for operators to take mitigating actions by approximately a factor of two from those stated in the previous two paragraphs, and reduce the makeup requirements by approximately one-third.

Identification of Containment Failure Modes of Concern for the Scenario of Interest 132.

Step (5) in the seven step sequence is inability to restart any pool cooling or makeup systems due to extreme radiation doses. Those scenarios in which the pool cooling system can be restarted, including provision of makeup, if required, before the containment fails, are excluded from contributing to this event.

133.

For the majority of accidents that result in an interruption of the spent fuel pool cooling function, the function itself is recoverable once the cause of the interruption has been rectified. In other words, a very small fraction of the interruptions of cooling are caused by mechanical failure of the spent fuel pool cooling system and the supporting CCW system.

Thus, given that failure of containment is not expected to fail the equipment required for spent fuel pool cooling (paragraphs 102-115) the fraction of scenarios in which the function can be restored before containment failure do not contribute to the seven step scenario.

134.

The likelihood of recovering the cooling function before containment failure depends on the precise timing of events. Because there is a very large number of possible scenarios representing different time sequences of events, the Staff has not focused on assessing the probability of restoration. However for the very late containment failures, a good case can be made that makeup or cooling would be restored before containment failure.

135.

The very late containment failures are assessed to occur after about 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br />.

At this stage, for all non-blackout sequences, if cooling has not already been restored, which in itself is considered a remote possibility, low level pool alarms will have sounded in the control room, requiring pool makeup. For these sequences, since there is no significant radiological contamination at this time, all makeup methods are available. Even if the pool were boiling, the FHB ventilation system would be operating, and therefore there would be no impediment to accessing the operating floor.

136.

For those accidents involving a loss of station power, the likelihood that power has not been restored is again remote, and again, indications would be available to alert the operators to the need to fill the pools. The likelihood of a prolonged loss of offsite power is very small. NUREG/CR-5496, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants:

1980 - 1996 (Exhibit 50-NUREG/CR-5496, Evaluation of Loss of Offsite Power Events at Nuclear Power Plants: 1980-1996, November 1998) records the longest duration for loss of offsite power as about 5 days (for a severe weather related LOSP), with average times being much less, and on the order of 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for severe weather related losses, six hours for grid related events, and just over an hour for the plant centered LOSP.

137.

Thus, for the very late containment failure modes, the likelihood that the pool cooling function has not been restored is judged to be very low. Therefore, for the purposes of this analysis, the containment failure modes of interest are the early, late, and isolation failure modes. It could be argued that a good portion of the late containment failure modes also should be excluded since there is a possibility that the pool cooling could have been restored before containment failure.

138.

With the conservative assumption that all the late failures occur before an attempt is made to provide makeup or restore cooling to the spent fuel pools, the probability of the first three steps in the seven step scenario is 6.3E-5x.09, i.e., the probability of a severe core damage accident and an interruption of spent fuel pool cooling, multiplied by the failure containment probability in the early (.02), late (.05) and isolation failure (.02) modes. This is approximately 6E-06/reactor year (or 6 occurrences per 1,000,000 years).

139.

To analyze the scenario further, it is necessary to make an assessment of whether the methods for restoring pool cooling or providing makeup are precluded by dose concerns. This is discussed in the next sections. It is assumed conservatively that some makeup will be required in order to establish pool cooling. For the early containment failure modes in particular this would not necessarily be the case, as the water in none of the pools, including pools A and B, would not have reached boiling point before containment failure. First the methods for providing makeup are discussed. Second the impact of the releases from the various failure modes on the accessibility of locations where personnel actions are required to implement the makeup methods is discussed.

Methods for Spent Fuel Pool Makeup 140.

In the following paragraphs, the methods available to provide makeup to the spent fuel pools identified by the licensee in their responses to the NRC Staffs first set of interrogatories, dated September 26, 2000 are discussed (Exhibit 15).

141.

Demineralized Water System (DWS)

The DWS is a nonsafety-related, nonseismically qualified system that performs no safety function (Exhibit 20, section 9.2.3-4). Under accident conditions, DWS receives its power from offsite sources. If the postulated accident sequence includes a loss of offsite power (LOOP),

power will be interrupted to DWS components, including the demineralized water transfer pumps which supply demineralized water to all users. Upon restoration of offsite power, the transfer pumps will restart automatically without any additional operator action, returning the system to an operable status (Exhibit 51-E-mail from D. Rosinski, Shaw Pittman, to S. Uttal, NRC,

Subject:

Additional Information, November 7, 2000). The demineralized water storage tank, the filtered water storage tank, and the pumps and power supplies are located in or adjacent to the Water Treatment Building (Exhibit 52-E-mail from D. Rosinski, ShawPittman, to S. Uttal, NRC,

Subject:

Additional Information, November 6, 2000; Exhibit 50). Currently, the DWS supplies normal makeup to the south end spent fuel storage system through connections in the south end SFPCCS purification system piping. Following the installation of plant modifications associated with fuel pools C and D, completely redundant spent fuel pool cooling system, purification systems, and skimmer will be installed in the north end of the FHB (Exhibit 20, sections 9.2.3-1 through 4; Exhibit 15, p. 29).

142.

To add makeup coolant to SFP B, a single valve is manually opened at the south end SFPCCS purification station (south end FHB at the 216' level). The DWS is supplied by a 500,000 gallon storage tank and can deliver 100 gpm in this configuration. CP&L estimates that this valve alignment can be completed in approximately 5 minutes. Although this procedure assumes the spent fuel purification pump is running, the DWS will deliver at least 100 gpm in this configuration regardless of whether the purification pump is operating (Exhibit 15; Exhibit 53-Memorandum, Ed Burns to Bruce Morgan, C1100002.070-4318,

Subject:

Information Request, October 3, 2000, cover letter). [Normal Makeup]

143.

The DWS can also supply water to other components in the fuel pool storage system (e.g., transfer canal, fuel pool A) by aligning additional valves in the FHB. Access to the 216' and 236' levels of the FHB is necessary to align the system. To operate the purification system pumps, access to the 261' level is also necessary (Exhibit 54-Shearon Harris Nuclear Power Plant, Plant Operating Manual, OP-116, Fuel Pool Cooling and Cleanup, Operating Procedure, Section 8.5). Although this procedure assumes a spent fuel purification pump is running, the DWS will deliver at least 100 gpm in this configuration regardless of whether the purification pump is operating (Exhibit 53). CP&L estimates that this valve alignment can be completed in approximately 30 minutes (Exhibit 15, p. 26). [Alternate #1]

144.

The DWS system can also deliver makeup water to the fuel storage system through the skimmer system. The skimmer system removes any floating debris from the surface of various pools. Fuel pools A, B, the south transfer canal, the north transfer canal, the main transfer canal, and the cask pit have skimmer system connections. For this alignment, the fuel pool skimmer system must be in service. Access to the 236' level of the FHB and operation of a single manual valve is necessary to establish the estimated flow rate of 100 gpm (Exhibit 15, p.27; Exhibit 54, section 8.6). [Alternate #3]

145.

The FHB also has DWS hose stations on the 286' level that can be used to add water directly to the fuel storage pools and transfer canals on the FHB operating deck via hoses, and each fuel pool wall contains a valve box with a DWS supply valve where makeup water can be added directly to that pool. Although the hose station and valve boxes are not identified as normal, alternate, or emergency supplies of makeup for the fuel storage system, these DWS headers are normally pressurized and can be quickly aligned to supply water to the pools at a rate of approximately 100 gpm (Exhibit 15). [Unproceduralized Alternate DWS]

146.

Refueling Water Storage Tank (RWST)

The RWST is a safety-related, seismically qualified source of makeup water for the spent fuel storage system. The tank is also the primary source of water for the low pressure injection system during the injection phase of a loss of coolant accident. The 490,000 gallon storage tank can be aligned to the fuel pool purification system by opening two valves, one in the reactor auxiliary building (RAB) on the 236' level, and one at the purification station on the 216' level of the FHB. In addition, a pressure gauge is installed at the purification system pump suction on the 216' level of the FHB. Access to the 261' level of the FHB is also required to start the purification pumps. The RWST is capable of supplying 100 gpm in this configuration.

The SFPCCS purification pumps receive their power under accident conditions from offsite sources. CP&L estimates that this valve alignment can be completed in approximately 30 minutes (Exhibit 15, p. 27;Exhibit 54, Section 8.5). [Alternate #2]

147.

The RWST can also be manually aligned to the suction of the spent fuel pool cooling pumps to deliver water to the south transfer canal, the main transfer canal, or the cask pit. Eleven valves must be manually operated, eight on the 236' level and two on the 216' level of the FHB and one on the 236' level of the RAB. A 5000 gpm flow rate can be established using the spent fuel pool cooling pumps. Makeup water will also transfer from the RWST to the fuel pools by gravity flow, if the RWST level is sufficiently high. CP&L estimates that this valve alignment can be completed in approximately 30 minutes (Exhibit 15, p. 28;Exhibit 54, Section 8.12). [Alternate #4]

148.

During postulated accident sequences involving large break LOCAs, the RWST is needed to support the injection function. FSAR Section 6.3.2.8 provides the results of calculations that show at least 20,000 gallons of coolant would remain in the RWST after the operators transferred the suction of the RHR system from the RWST to the containment recirculation lineup. This coolant would then be available to be transferred to the fuel pools by the means described above in paragraphs 146 and 147. In other sequences where injection was not necessary or had failed, an RWST inventory of at least 436,000 gallons would be available to transfer to the spent fuel storage system (Exhibit 43, section 6.3.2.8).

149.

Reactor Makeup Water Storage Tank (RMWST)

The RMWST can also be aligned to supply makeup water to the fuel pools. Operators must manually align four valves to connect the 80,000 gallon RMWST to the purification system.

Two valves are located on the 261' elevation of the RAB, the other two are located on the 216' elevation of the FHB in the vicinity of the south end fuel pool purification components. The reactor water makeup system is normally operating with at least one pump running to supply water for it is designed to service. Power for this system under postulated accident conditions is supplied from offsite sources. Portions of the reactor water makeup system that can be aligned to supply water to the fuel storage pools are not safety-related or seismically qualified.

The RMWST can supply makeup water to the fuel pool purification system at a rate of 75 to 100 gpm. CP&L estimates that this system can be aligned to supply makeup water in approximately 30 minutes (Exhibit 15, p. 29;Exhibit 54, Section 8.26). [Alternate #6]

150.

Emergency Service Water System (ESW)

Provisions are also made during emergencies to supply the fuel pools with water from the safety-related, seismically qualified ESW system through a temporary jumper installed on the 236' level of the RAB. Pumps in the ESW system are supplied power from offsite or onsite emergency sources during the postulated accident sequence. Operators must install the jumper using tools and material stored on the 236' level of the RAB. Two valves on the 236' level of the RAB must also be opened to initiate flow to the fuel pools. Makeup water is supplied from Harris lake through the ESW system, which is considered unlimited. The flow rate from the ESW system is 50 to 75 gpm in this configuration. CP&L estimates that the temporary hose can be installed and the valves opened in approximately 30 minutes (Exhibit 20, section 9.1.3, p. 9.1.3-6b; Exhibit 15, p. 25; Exhibit 54, Section 8.13). [Alternate #5]

151.

Other systems are also located in the FHB and available to provide makeup water to the fuel pools, but are not specifically described in Harris plant procedures. These systems are addressed in the following paragraphs.

152.

Fire Protection System (FPS)

The plant FPS draws water from Harris Lake using a non safety-related motor driven fire pump and a redundant diesel driven fire pump. The motor driven pump receives its power from offsite sources during the postulated accident sequence (Exhibit 20, section 9.5). The system is designed to remain pressurized at all times. Seven non seismically qualified hose stations are located along the operating deck of the FHB (286' level) (Exhibit 22). To initiate filling of a fuel pool or transfer canal, an operator would direct the end of the fire hose in the direction of the fuel storage system location and open a single valve at the hose station located on the FHB operating deck (Exhibit 15, p. 29). [Unproceduralized Alternate FPS]

153.

Gate Seal Features Under emergency conditions where access to all locations of the site may not be possible, such as those in the postulated accident sequence, the pneumatic seals on the isolation gates can be deflated to aid in the delivery of coolant inventory or makeup water to all locations in the fuel storage system (Exhibit 15, p. 24). Deflating the gate seals allows the coolant to bypass the gate and flow into the adjacent storage location (e.g., pool or transfer canal) (Exhibit 15, p. 24).

If all seals in the fuel storage system were deflated, inventory could flow to any location in the fuel storage system. In the same manner, coolant makeup added to one pool would be available to all pools through leakage in the gate seals. Therefore, with the seals deflated it would not be necessary to add makeup water directly to the boiling spent fuel pool (Exhibit 15,

p. 24).

154.

If the operators choose not to deflate the gate seals, coolant makeup can be still added to any pool location using any of the available methods described above until the level in the location receiving the makeup water exceeds the top of the associated pool gate, which is approximately one foot below the FHB operating deck level (286'). Fuel pool coolant would then spill over into the adjacent storage location and continue to fill that location until the level reached to the top of the next gate. In this manner, under accident conditions, operators would be able to add makeup to all pools by initiating makeup to a single pool or transfer canal without removing the isolation gates or deflating the seals (Exhibit 23; Exhibit 24).

An Assessment of Accessibility of Areas Containing Equipment Required to Establish Makeup 155.

The Staff has evaluated the potential impact of the postulated sequence on the accessibility of various areas within the reactor auxiliary building (RAB) and the fuel handling building (FHB). The Staff also evaluated the impact of associated radioactive material releases on the accessibility of the FHB from areas external to the building.

156.

The accessibility of plant areas, and the plant site, is dependent on the magnitude and form of the radioactive materials released by the postulated containment failure, and the transport and dispersion of these materials once released from the containment. A

4. The EPA dose guidelines are expressed as the sum of the external effective dose equivalent and committed effective dose equivalent. The total effective dose equivalent (TEDE) is defined in 10 CFR 20.1003 as the sum of the deep-dose equivalent (for external exposures) and the committed effective dose equivalent (for internal exposures). The deep-dose equivalent is comparable to the external effective dose equivalent for uniform exposures over the entire body.

large number of calculation cases would be necessary to quantify the radiation environment of the plant and its environs due to the number of potential containment failure modes, the timing of these failures, the location of these failures within the plant, meteorological conditions, and the availability of offsite and emergency power. This evaluation is largely qualitative. However, insights into the post-accident accessability can be developed through a qualitative assessment of potential release pathways in the context of plant and systems configurations and site meteorology. In performing this evaluation, the Staff considered material submitted by the applicant in support of the amendment, the FSAR (specific citations are provided in the text ),

and information obtained during discovery. The Staff also had the benefit of a tour of the Harris site on September 29, 2000.

157.

Section 10 CFR 20.1201(a)(1) limits the annual occupational dose to 5 rem TEDE. However, 10 CFR 20.1001(b) states that nothing in this part shall be construed as limiting actions that may be necessary to protect health and safety. Section 10 CFR 50.47(b)(11) requires licensees to have in place means to control emergency exposures, including exposure guidelines consistent with the EPA Emergency Worker and Lifesaving Activity Protective Action Guides. The EPA guidance provides a dose limit of 25 rem4 for actions involving life-saving or the protection of large populations when lower doses are not practicable. The EPA guidance also provides for doses greater than 25 rem for actions involving life-saving or the protection of large populations when lower doses are not practicable and when the exposed individuals are volunteers and have been briefed of the risks involved.

The EPA considers these exposures to be justified if the maximum risks permitted to workers are acceptably low, and the risks or costs to others that are avoided by their actions outweigh the risks to which workers are subjected (Exhibit 55-USEPA, Manual of Protective Action Guides and Protective Actions for Nuclear Incidents, EPA 400-R-92-001, May 1992, pp. 2-9 to 2-13). While the EPA guidance would allow exposures greater than 25 rem, there is uncertainty regarding the availability of volunteers. As a result of these considerations, the Staff has assumed an exposure criterion of 25 rem total effective dose equivalent (TEDE) for this evaluation.

158.

The methods for providing makeup to the pools have been discussed in paragraphs 140 through 154. The estimated time to complete the various alternatives range from 5 to 30 minutes. The applicant has indicated that the same methods are applicable to pools And B, and pools C and D (Exhibit 15, Specific Interrogatory #9, p.31). Performing these methods requires access to the FHB, or the FHB and RAB, from within the plant and from the site yard. Access to the FHB is discussed first (see Paragraph 161), followed by access to the RAB (see Paragraph 182), and access from the site yard (see Paragraph 194). Habitability of the control room is addressed starting with Paragraph 183.

159.

The configuration of the spent fuel pools, the transfer canals, and the interconnecting gates was described in paragraphs 118 through 121. Although sealed gates separate the pools and the main transfer canal, the gate seals can be depressurized readily without tools or other equipment by personnel on the operating floor (Exhibit 15, Specific Interrogatory #8). When depressurized, water on either side of the gate will seek an equal level. The configuration of the gates also allows water to overflow from one pool to another

5. As used in this affidavit, radiation shine refers to the emission of energy in the form of electromagnetic radiation from radioactive material held in an enclosure, such as the reactor containment or piping systems. Used to denote exposure situations in which the radiation, but not the radioactive material that emitted it, penetrates the walls of the enclosure.

without overflowing on to the floor, should depressurization not be possible, so that filling one pool will provide water to the other pools (Exhibit 24; Exhibit 23).

160.

In evaluating the accessability of the FHB, the Staff considered six primary radiation and contamination sources. These are (1) direct radiation shine5 from the radioactive material held up in the reactor containment (see Paragraph 161); (2) direct radiation shine from contamination in piping systems outside of the containment (see Paragraph 163); (3) the introduction of contaminated air to the FHB by ventilation systems (see Paragraph 164); (4) infiltration of contamination from the RAB (see Paragraph 169); (5) radiation from fission products released from the fuel in spent fuel pools as a result of the heatup prior to fuel uncovery (see Paragraph 178); and (6) increase in radiation shine dose from stored fuel as a result of pool water level decrease (Paragraph 174).

161.

The containment wall is 4.5' thick reinforced concrete up to about the 376' elevation, and 2.5' thick in the dome (Exhibit 56-CP&L Engineering Drawing CAR-2165 G-013, General Arrangement Containment Building Plan EL. Sections Sheet 1). At 376', the containment wall is higher than the adjacent buildings (Exhibit 24; Exhibit 46; Exhibit 57-CP&L Engineering Drawing CAR-2165 G-002, General Arrangement Plot Plan). In Section 12.3.2.16 of the FSAR, the applicant reported estimated post-accident dose rates in various plant areas (Exhibit 58-Shearon Harris Nuclear Power Plant Final Safety Analysis Report (FSAR) Chapter 12, section 12.3.2.16). These doses were calculated in response to post-TMI requirements and were based on the assumption that 100% of the core inventory of noble gases, 50% of iodines, and 1% of other particulates are released to the intact containment (Exhibit 58, section 12.3.2.16). The FSAR reported that the maximum radiation level in the vicinity of the containment wall in the WPB was 8 rem (Exhibit 58, section 12.3.2.16). Since there are no post-accident radiation sources outside of the containment in this area, the 8 rem estimate represents the radiation shine from activity within the containment. Assuming a 25 rem emergency worker exposure criterion (see Paragraph 157), a stay time of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> would be feasible, assuming no other sources. Although access to these areas may not be necessary, the estimated dose rates represent the limiting case. At increased distances from the containment wall with additional intervening concrete walls, the postulated dose will be less.

162.

The FHB construction (including the roof) is poured concrete. The FHB has four elevations: 216', 236', 261' and 286'. The 216' elevation is arranged in two sections--south and north--with the intervening space being unexcavated. The FHB is open from the 286' elevation (operating floor) to the building roof. The exterior walls facing the reactor containment are a minimum of 3' thick above the operating floor (286' el) with a maximum thickness of 4'. Below the operating floor the walls are thicker and range up to 9'. The minimum thickness of the roof is 18 inches. Floor slabs are 2' and thicker (Exhibit 24; Exhibit 59-CP&L Engineering Drawing CAR-2165 G-023, General Arrangement Fuel Handling Building Plan Plans Sheet 2; Exhibit 22). In addition to the FHB and containment walls, there are several concrete walls and floors internal to the RAB that provide additional shielding (Exhibit 46, Exhibit 47; Exhibit 40; Exhibit 45; Exhibit 41). The Staff concludes that radiation shine from the containment will be adequately attenuated by the intervening walls and floors and that containment radiation shine dose rates will not be significant in areas where actions will be taken to makeup pool water.

163.

The Staff evaluated the impact of contaminated piping on the accessibility to areas where actions will be taken to makeup pool water. Within the FHB there are no piping or components that would contain fission products following a reactor accident (Exhibit 59; Exhibit 22). Although the spent fuel pool water, associated piping, and demineralizers may be contaminated, the design of these systems is such that general area dose rates would be less than 5 mrem/hr (Exhibit 58, section 12.3-9). While there are some equipment cubicles that have higher dose rates, access to these cubicles is not required.

164.

The Staff evaluated the impact that ventilation systems might have on the accessability and habitability of the areas where actions would be taken to makeup pool water.

The FHB and RAB have independent ventilation systems with outside air intakes that could draw in contaminated air from a radioactive plume released by the accident sequence (Exhibit 20, section 9.4.3; Exhibit 43, section 6.5.1.2.2 and 6.5.1.2.1; Exhibit 20, section 9.4.2). The impact of these systems is dependent on the availability of offsite and onsite power, meteorological conditions such as wind direction, and the timing of the release. In some of the accident sequences considered, the containment failure is delayed, providing a window of time to implement pool makeup actions in advance of the radioactive material release, as discussed in paragraphs 132 through 139. In these cases, the operation of the ventilation systems would not have an impact on accessibility or habitability. For some early containment failures (e.g.,

failures within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), the release plume may begin, end, and clear the site environs before makeup is required. These events are discussed in the following paragraphs.

165.

The FHB normal ventilation systems draws in and conditions outside air, distributes the air in the FHB and exhausts the air via the main plant stack. There are three separate subsystems, each with its own intake fans and exhaust fans. One subsystem services the areas above the operating floor while the remaining subsystems serve the areas beneath the operating floor, with a subsystem each for the north and south ends. These subsystems are not considered ESF systems and are not powered from emergency buses (Exhibit 20, section section 9.4.2). If offsite power is lost as part of the accident sequence, the fans cannot draw contaminated air into the FHB.

166.

On receipt of a high radiation monitor alarm on any one of the 24 detectors located above the operating floor, the normal supply and exhaust fans for the operating floor are stopped and the intake and exhaust dampers are closed. These actions isolate the operating floor from the environment. In addition, safety-related dampers in the supply and return ducts for the north end rail / truck lock close. The FHB emergency exhaust fans start and exhaust the area above the operating floor to the main plant stack (Exhibit 20, section 9.4.2). There is no forced ventilation supply to the operating floor under these conditions. The radiation detectors are set to alarm with a short response time whenever the dose rate in the FHB operating floor area exceeds 100 mrem/hr (Exhibit 43, section 6.5.1.2.1; Exhibit 20, section 9.4.2). While radioactive material would be admitted to the FHB prior to reaching this radiation level, the radiation level trend will level out and start to decrease once the switchover to emergency ventilation has occurred. A dose rate of 100 mrem/hr would require a stay time of about 250 hours0.00289 days <br />0.0694 hours <br />4.133598e-4 weeks <br />9.5125e-5 months <br /> to reach the emergency worker exposure limit of 25 rem. If the dose rate were to be higher, the stay times would be reduced proportionally. Since the transition to emergency exhaust occurs in less than one minute (Exhibit 43, section 6.5.1.2.1), the Staff expects that the peak dose rate will not be greater than the alarm setpoint by more than an order of magnitude. However, even with a dose rate ten times greater, the Staff concludes that

6. The north direction shown on CP & L engineering drawings represents north on the plant coordinate scheme. The true North is 25 degrees clockwise from the plant coordinate North (Exhibit 61-Shearon Harris Nuclear Power Plant Final Safety Analysis Report (FSAR)

Chapter 1-Figure 1.2.2-1). True North is the basis for meteorological measurements (Exhibit 62-USNRC Regulatory Guide 1.145, Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants, Revision 1; 1982, Position C.1.1).

the resulting stay time periods would continue to provide adequate time to take actions on, or transit, the operating floor to restore spent fuel pool makeup.

167.

The normal supply and exhaust fans for the areas beneath the operating floor of the FHB continue to operate if offsite power is available unless manually isolated since they do not isolate on high radiation level alarms (Exhibit 20, section 9.4.2). Thus, these supply systems could be a source of contamination for areas below the operating floor. This condition could limit access to the south and north end of the FHB 216' elevation where actions associated with some of the means to restore makeup are located. The outside air intake for the north end supply is located on the north end of the FHB at grade level (261') (Exhibit 20, section 9.4.2; Exhibit 22). In order for a plume released from the containment or RAB to reach the outside air intake at the north end of the FHB, the winds must be coming from SSE to ESE (Exhibit 57; Exhibit 60-Drawing Generated by Staff using CP&L drawings G-002 and G-003, depicting air intake wind direction impact, November 2000).6 The Staff performed analyses on meteorological data supplied by CP & L (Exhibit 15, Specific Interrogatory #1) to determine atmospheric dispersion coefficients. Worksheets from these analyses are provided in Exhibit 63 (Staff Analysis of Harris Site Meteorology, November 2000, prepared by S.F. LaVie). Only 10.1% of the annual wind direction observations between 1995 and 1999 were from these sectors. The Staff believes that the configuration of the FHB intake is such that building wake effects at the north end of the FHB could minimize the actual intake during these periods.

Given the considerations above, and the potential timing of the radioactivity release, the Staff is of the opinion that the continued operation of the normal supply fans would not preclude access to the FHB 216' elevation north end for the large majority of the postulated sequences.

168.

The purification system equipment on the south end of FHB 216' elevation is redundant to the equipment at the north end (Exhibit 59). The outside air intake for the south end supply is located in a small enclosure on the RAB 286' elevation roof between the RAB 305' elevation exterior wall and the containment (Exhibit 20, Table 9.4.0-2). The intake is located south of the plant stack, south of the RAB, east of the containment, and west of the main steam relief valve risers. As this outside air intake is located well within the wake cavity of the RAB and the containment building (Exhibit 41), the Staff believes that the intake of contaminated air cannot be discounted on the basis of wind direction. The FHB 216' elevation south end could be accessible prior to or after the start of the radioactivity release. However, the Staff does not have sufficient assurance to conclude that this area would be accessible during a release to the environment.

169.

There are doors that connect the FHB 216', 236', and 261' elevations with the corresponding elevations in the RAB (Exhibit 59; Exhibit 22; Exhibit 47; Exhibit 40; Exhibit 45).

These doors provide pathways for infiltration of contamination from the RAB. In order to assist understanding the discussion, the following figure divides the RAB into several areas, identified by letter for further reference.

A B

C D

E F

G H

170.

On the 216' elevation, there are two fire doors that connect the south end of the FHB to Area H in the RAB (Exhibit 59; Exhibit 47). On the 236' elevation there is a door that connects the FHB pump room with Area A in the RAB (Exhibit 59; Exhibit 40). On the 261' elevation there are two doors that connect the FHB and RAB. The first connects a valve gallery in the FHB with Area H of the RAB. The second connects the ventilation equipment room with Area A of the RAB (Exhibit 22; Exhibit 45).

171.

Within the FHB, there are two equipment hatches on each of the 236', 261', and 286' elevation floors that provide an opening to the elevation below (Exhibit 22; Exhibit 59).

These hatches are normally closed during plant operations. While the hatches cover the entire opening, they are not considered to be airtight. If there were to be a sufficient pressure differential, the Staff believes it might be possible for contamination to migrate to other elevations in the FHB. However, if the normal ventilation system is operable, the Staff believes that the contamination that infiltrates from the RAB would be collected and exhausted to the environment, rather than migrate to another elevation. Even if the ventilation systems were not powered, the Staff believes that the open ductwork would provide a path of least resistance that could be expected to minimize differential pressures and migration via the equipment hatches.

Although pressure might collapse or rupture a run of ductwork, the Staff believes that such a failure will still provide a pathway for the pressure to dissipate.

172.

Due to the physical arrangement of the FHB elevations and the configuration of the ventilation systems, there is no communication of air between the north and south ends of the FHB below the operating floor. (While there is a pipe tunnel between the 216' and 236' elevations that connects both ends, sealing features minimize air flow.) (Exhibit 59; Exhibit 24; Exhibit 64-CP&L Engineering Drawing CAR-2165 G-024, General Arrangement Fuel Handling Building Sections Sheet 1). Contamination that enters the FHB via the fire doors on the south end cannot impact the accessibility of the areas at the north end. For this reason, the Staff concludes that the accessability of the FHB 216' elevation north end will not be impacted by contamination infiltration from the RAB. The Staff is not able to make a similar conclusion for the FHB 216' elevation south end.

173.

Since the FHB above the operating floor is designed to be maintained at a slight negative pressure by the FHB emergency exhaust system during fuel handling accidents (Exhibit 43, section 6.5.1.2.1), the Staff believes that the physical boundary between the operating floor and other areas must be reasonably leak tight for the system to maintain the required slight negative pressure with the relatively small design exhaust flow rate of 6000 cfm per train (Exhibit 43, Table 6.5.1-1). There are no doorways to the RAB on or above the

7. Although the focus of this proceeding is on the expansion of the spent fuel facility into pools C and D, the largest heat loads in the storage system reside in pools A and B. While pools A and B are outside the scope of this proceeding, the higher heat loads in these pools results in shorter time estimates that could have an impact on the access the pools C & D.

operating floor (Exhibit 22). Since this configuration minimizes the possible migration of contamination from lower elevations of the FHB to the operating floor, the Staff concludes that the accessability of the operating floor will not be impacted by contamination infiltration from the RAB.

174.

The Staff considered the impact that steam and radioactive material released due to pool boiling could have on personnel access to the operating floor, as well as the impact of reduced pool water level on radiation shine doses from the stored fuel. The radiation release addressed here is that from the accelerated leakage of fuel gap activity due to fuel rod heating following the loss of pool cooling.

175.

The applicant has estimated that 16 days would elapse from the time of the loss of forced spent fuel pool cooling and the onset of boiling in pool C. The applicant estimated that it would take an additional 100 days for the water in pool C to boil down to the top of the fuel racks. Only pool C is being considered in this evaluation. While the applicant would be licensed to store fuel in pools C and D with a total heat load no greater than 1 million BTU for both pools, the applicant does not intend to put pool D into use at the present time. Since pool D would be isolated, its water mass is not credited in these time estimates. The applicant has estimated 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> for the onset of boiling in pool A & B, and an additional 173 hours0.002 days <br />0.0481 hours <br />2.86045e-4 weeks <br />6.58265e-5 months <br /> for the water in pool A & B to boil down to the top of the fuel racks (based on the beginning of cycle, which is the most limiting case).7 The basis of these estimates was described in detail earlier in this affidavit (see Paragraphs 118-131).

176.

If the plant personnel were not successful in restoring pool cooling or aligning pool makeup prior to the onset of pool boiling, steam emanating from the affected pool(s) would increase the temperature and humidity of the FHB. If offsite power is available, the normal ventilation supply and exhaust system would be expected to maintain the FHB temperature and steam concentration to levels that would not preclude personnel intermittent access. If power is not available, this generation of steam could create conditions in which normal personnel access could be impeded due to temperature and humidity.

Since the steam will be at saturation conditions (i.e., 212 degrees F and 14.7 psia), actions such as opening the south end stairwell and truck lock doors to allow steam to exhaust, the use of smoke clearing fans, and (in localized areas) fire-fighting hose fog nozzles could restore personnel access. The Staff also believes that personnel protective equipment such as commercially available steam suits and respiratory equipment could be utilized to provide a means of access to the FHB operating deck.

177.

The configuration of the spent fuel pools, the transfer canals, and the interconnecting gates was described earlier in this affidavit (See Paragraph 120). Although sealed gates separate the pools and the main transfer canal, the seals can be depressurized readily without tools or other equipment by personnel on the operating floor. When depressurized, water on either side of the gate will seek an equal level (Exhibit 15, Specific Interrogatory #8). However, should it not be possible to approach a gate due to boiling or radiation shine from the adjacent pool, the configuration of the gates allows water to overflow from one pool to another without overflowing on to the floor (Exhibit 24; Exhibit 23). Because of this configuration, the Staff concludes that it is possible to take actions to makeup water to the cask loading pool and have it overflow to the boiling pool. The minimum distance from the closest edge of pool B and furthest edge of the cask loading pool is about 60 feet (Exhibit 22) providing additional separation between the boiling pool and locations at which makeup water can be added.

178.

The Staff evaluated the potential release of fission products from the fuel due to boiling. The analysis worksheets are provided as Exhibit 65 (Staff Analysis of Radioactivity Release Due to Spent Fuel Pool Boiling, November 2000, S.F. LaVie). The Staff estimated the dose rate in the FHB from the fission product release at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following the onset of boiling.

Based on this analysis, the Staff concluded that the radiation release from the fuel in pool C would not be limiting due to the age of the fuel in this pool. For pool A & B, the Staff determined that the dose rate at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> provided a maximum stay time of about 40 minutes based on the 25 rem emergency work exposure limit (See Paragraph 157). The Staff concludes that this stay time is sufficient to initiate pool makeup via demineralized water hose bibs or fire hose stations, or to pass through the north end to gain access to the FHB 216' elevation makeup station. As noted in Paragraph 176, protective measures may need to be taken for steam. This conclusion is based on the radiation dose from inhalation of radioiodine.

No credit was taken in the analysis for the use of respiratory protection equipment or thyroid prophylaxis. The use of either of these two protective measures would increase stay time.

179.

In addition to serving as a cooling medium, the spent fuel pool water provides radiation shielding for the stored fuel. The water depth is 23.7 feet above the top of the fuel racks (Exhibit 64).

This depth of water is predicated on the ability of the pool to scrub fission gases released during a fuel handling accident (Exhibit 66-Safety Guide 25, Assumptions

8. When a beam of radiation interacts with the atoms in materials, the path of radiation is often changed with the beam emerging in a different direction at a lower energy. This mechanism is referred to as scattering. In a spent fuel situation, an individual standing away from the edge of the pool could be adequately shielded from the direct radiation from the spent fuel, but still be exposed to radiation that reflects off of the opposite pool walls.

Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors, March 23, 1972, Footnote 2 to Position C.1.c), rather than on its shielding capabilities. During normal operations, the dose rate at the pool surface is typically on the order of a few mrem/hour (Exhibit 58, section 12.3.2.13). Since the attenuation of radiation by the pool water is exponential in nature, a significant decrease in pool level is necessary to increase ambient dose rates to levels that impede accessability.

During routine fuel movement, individual fuel assemblies are raised to within approximately 10 feet of the water surface (Exhibit 24) with personnel exposure rates maintained on the order of a few mrem/hour. Although the fuel racks contain more than one fuel assembly, the Staff believes that (1) the increased fuel to receptor distance while the fuel is in the racks, (2) the self-shielding afforded by the fuel assemblies, the fuel racks, and the interstitial water, and (3) the margin between the routinely observed exposure rates (with the fuel element raised) and the emergency worker exposure limits supports a conclusion that the pool level would need to decreased more than 10 feet in order to create personnel access restrictions during emergency conditions. Since the pool walls form a vertical collimator, the maximum dose rate would be directly above the pool. Radiation scatter8 off pool walls and in the pool water could increase radiation doses at locations away from the periphery of the pool. Generally, the radiation dose decreases by about a factor of 10 for each scatter (Exhibit 67-Principles of Radiation Shielding, 1984 Prentice-Hall, NJ, Chilton, A.B. et al.-section 9.1.5). Even with the scatter, the Staff concludes that, the dose rates beyond the immediate periphery of the pool will be significantly less than those directly over the pool.

180.

The pool heat-up rates discussed earlier in this affidavit correspond to a boil-off of about 0.1 inch per hour from pool C. The corresponding boil off for pools A and B is approximately 2 inches per hour. Using the analysis in Paragraph 179, it would take about 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> to reduce the pool water level by 10 feet at the pool A & B boil off rate of 2 inches per hour and 1200 hours0.0139 days <br />0.333 hours <br />0.00198 weeks <br />4.566e-4 months <br /> for pool C. Given (1) the collimating by the pool walls, (2) the significant decrease in pool water level necessary to create dose rates that would impede personnel access, (3) the slow decrease in pool depth by boiling, (4) the distances separating the A & B and C pools, and (5) the ability to add water to the C pool and have it overflow to the A & B pools, the Staff concludes that the reduction in pool A & B water level will not impact the accessability of the north end of the FHB.

181.

Based on the considerations in paragraphs 174 through 180, the Staff concludes that the onset of pool boiling will not preclude personnel access to the FHB operating floor.

182.

The Staff considered the habitability of the main control room as a result of the accident. This included consideration of radiation shine and infiltration. The control room is located on the 305' elevation of the RAB (Area C) (Exhibit 43, section 6.4.2; Exhibit 42). The shielding design of the control room envelope was based on two direct radiation sources: (1) direct radiation shine from the containment, and (2) direct radiation shine from radiation leakage external from the containment (Exhibit 58, section 12.3.2.14). The first source of radiation shine is comparable to that expected for the postulated accident sequence for this proceeding.

As such, it can be concluded that the control room shielding design would continue to be adequate for this source. The second source is based on a design basis LOCA in which the fission products are held up in the containment and released at a rate of 0.1% volume per day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and 0.05% volume per day for the subsequent 29 days. With these assumptions, the postulated dose is 0.1 rem for 30 days (Exhibit 58, section 12.3.2.14). The release rates associated with some containment failure modes may significantly exceed the assumed design basis rates. However, the duration of these releases will be less. The concrete shielding of the control room is 4' thick (Exhibit 42; Exhibit 46). The Staff believes that it is likely that the dose rates inside the control room from this source, albeit increased, will allow access and residence in the control room.

183.

The control room air conditioning system (CRACS) consists of a supply system with two 100% capacity air handling units and an exhaust system with two 100% capacity exhaust fans. Outside air intake and exhaust lines have two motor-operated isolation valves in series. There is an emergency filtration system consisting of two 100% capacity filtration trains.

Components are safety-grade and are powered from emergency sources (Exhibit 43, section 6.4.2; Exhibit 20, section 9.4.1).

184.

The configuration and operation of the Harris control room is described in the FSAR (Exhibit 43, section 6.4.2; Exhibit 20, section 9.4.1) and is summarized in this paragraph.

In the event of a safety injection signal or a high radiation alarm on the normal outside air intake, a control room isolation signal is generated. This results in the following automatic actions: all isolation valves on the normal intake and exhaust system shut, and both emergency filtration systems start in the full-recirculation model (i.e., no outside air makeup). Once these automatic functions are completed, the operator will manually place one of the filtration trains in standby, and will select and open one emergency outside air intake to pressurize the control room. There are two outside air intakes on either side of the RAB at the 323' elevation.

Radiation monitors in these intakes allow the operator to select the least contaminated intake.

Based on a review of the release points in relation to the control room outside air intakes (Exhibit 20, Table 9.4.1-1; Exhibit 57), the Staff concludes that both intakes could be within the plume for some combinations of release points and wind directions.

185.

Although the control room is isolated, the Staff concludes that pressurization is necessary to maintain the control room at a positive pressure against infiltration of contamination via control room boundary penetrations, such as cable penetrations and doors.

During this pressurization period, 400 cfm of outside air is drawn in, filtered, and discharged to the control room volume. There is no forced exhaust during this period. Although the filter is highly efficient, some contamination would still be discharged into the control room. The design of these systems is predicated on not exceeding the 5 rem whole body or equivalent to any organ criterion of 10 CFR 50, Appendix A, GDC-19 for design basis events. The whole body dose was estimated to be 0.6 rem and the thyroid dose was estimated to be 7 rem for a design basis LOCA (Exhibit 68-Shearon Harris Nuclear Power Plant Final Safety Analysis Report (FSAR) Chapter 15-Table 15.6.5-12, Table 15.6.5-12).

186.

During station blackout conditions, the control room pressurization and filtration systems would be inoperable, potentially allowing for the infiltration of contamination. The Staffs experience in reviewing control room designs for design basis events suggests that the Harris control room may not be habitable under these conditions. However, it must be noted that under station blackout conditions, there are few if any plant operations that can be performed from the control room. Command and control of the event would transfer to the technical support center which has its own filtration system and emergency diesel generators.

However, the control room would continue to be manned until it is no longer habitable. A review of the meteorology joint frequency data for 1995-1999 indicates that 60.3% of the time the wind is blowing such that the plume would be directed away from the control room intakes (Exhibit 57; Exhibit 60) (See Paragraph 167). There would be no impact on the control room during these periods. With the information available and based on these considerations, the Staff cannot conclude that the control room would be habitable for all combinations of accident sequences and wind directions following core damage and containment failure.

187.

In evaluating the accessability of the RAB, the Staff limited its evaluation to Areas G and H on the RAB 216' elevation (See the figure following Paragraph 169), Areas A, B, and C on the RAB 236' elevation, and Areas A and B on the 261' elevation since these areas contain valves which need to be operated for some spent fuel pool makeup alternatives. The Staff considered two primary radiation and contamination sources. These are (1) direct shine from the radioactive material held up in the reactor containment and in piping systems outside the containment; and (2) the spread of containment failure releases in the RAB.

188.

Section 12.3.2.16 of the FSAR, discusses estimated post-accident dose rates in various plant areas (Exhibit 58, section 12.3.2.16). These doses were calculated in response to post-TMI requirements and were based on the assumption that 100% of the core inventory of noble gases, 50% of iodines, and 1% of other particulates are released to the containment.

Dose rates estimated using this source term are expected to be comparable to those that would be obtained using the most likely severe accident source terms (Exhibit 15, Specific Interrogatory #4). A review of the data provided in the FSAR indicates that the shine doses would not be limiting in gaining access to RAB areas to perform valve operations associated with spent fuel pool makeup, or to gain access to the FHB.

189.

The containment is the last of the three barriers to the release of fission products to the environment. The other two barriers are the reactor fuel and the reactor coolant system.

Failures of the containment barrier are grouped as (1) containment bypasses, (2) containment isolation failures, (3) interfacing system LOCAs (ISLOCA), and (4) failure of the containment structure. The impact of steam and fission product releases from containment failures on the operability of the CCW components was addressed in Paragraphs 102 through 116. The evaluation contained in those paragraphs is applicable to accessability concerns as well. In the following paragraphs, those evaluations will be summarized in the context of personnel accessability to the RAB.

190.

The containment bypass sequence (steam generator tube rupture) was addressed in Paragraph 100, where it was stated that releases would be to the environment and that the ventilation alignment prevents the steam generator release from being drawn back into the RAB. As such, the Staff concludes that this failure mode is not expected to affect accessibility of the areas of interest within the RAB.

191.

Paragraphs 105 through 108 addressed containment isolation failures and the normal and emergency operation of the ventilation systems in the RAB. In those paragraphs it was concluded that, if the RABEES were operating. the release would be exhausted to the environment while minimizing the re-introduction of the radioactive materials via the RAB outside air intakes. The Staff believes that releases to the RABEES areas during system de-energization will largely be held up within the area and will slowly infiltrate through the RAB.

During the hold-up, deposition and plateout of a significant fraction of aerosols and particulates would be expected (Exhibit 69-NUREG/BR-0150, RTM96: Response Technical Manual, Vol.

1, Rev. 4, March 1996, McKenna, T., et al., Table C-5). As a result, the Staff believes that the contamination of floors and surfaces outside of the RABEES boundary would not create accessability concerns. Re-energization of RABEES, when possible, could be expected to purge airborne contamination and allow access to the areas of interest.

192.

The containment structural failure pathway was evaluated in Paragraphs 110 through 114. In that evaluation, the Staff concluded that the containment breach would be dissipated throughout the RAB. The Staff concludes that this breach would likely spread contamination throughout the RAB. If the RABEES is operating, a significant amount of the contamination would be exhausted from the RAB. If RABEES is not operating (e.g., station blackout), the Staff believes that access may not be possible until the RAB atmosphere could be purged on restoration of AC power.

193.

Based on the considerations addressed in paragraphs 187 through 192, the Staff concludes that access should be possible to areas in the RAB where operations related to making up spent pool water need to be performed. For events involving the release of significant pressure from the containment failure or involving station blackout, this access might be delayed until the RAB could be purged.

194.

The Staff considered the accessability of the FHB from site buildings other than the RAB and from the site yard. The operating floor of the FHB can be accessed from (1) a stairwell from the waste processing building (WPB) at the south end of the FHB (Exhibit 22); (2) the roof of the WPB via an exterior door to the south end stairwell (leading to the incomplete Unit 2 excavation) (Exhibit 22); (3) the grade level access door at the east side of the north end of the FHB (Exhibit 22); (4) the grade level truck lock at the north end of the FHB; and (5) an exterior door on the west side of the north end of the FHB leading to the FHB 236' elevation (Exhibit 59). The location of these FHB access points in relation to the expected release points (Exhibit 57) is such that one or more access points would be available regardless of wind direction. With the exception of access via the WPB stairwell, these access points are located in such a manner as outside equipment, such as pumper trucks, could be positioned to transfer water via hoses, without reliance on site equipment that may have been rendered inoperable.

195.

The Staff performed an evaluation of the potential radiation dose rates that could exist on the Harris site following the accident sequence postulated in this proceeding and the impact that these radiation doses might have on the accessability of the reactor site. The Staff considered the following exposure pathways to the overall dose rate to an individual present in the environs: (1) the external dose rate from exposure to radiation shine from contamination in the plume, (2) the internal dose rate from the inhalation of contamination in the plume, and (3) the external dose rate from exposure to radiation shine from plume fallout on the ground. A fourth exposure pathway, internal dose rate from ingestion of contaminated foodstuffs, was deemed to be irrelevant by the Staff for this particular evaluation since it is expected that plant personnel will not partake of food or water in radioactively contaminated areas. The Staff focused its evaluation on access to the FHB from the yard and the WPB. Although the Staff expects that access to the FHB via the RAB could be possible for certain containment failure sequences, for this evaluation the Staff assumed that access via the RAB is not possible due to high general area dose rates.

-100-196.

Although the Staff expects that protective clothing, respiratory protection, or thyroid prophylaxis would be used, the Staff has assumed no analysis credit for the use of such protective measures.

197.

The Staff calculated dose rates for only the ground exposure pathway. The Staff did not calculate dose rates for the plume exposure or inhalation exposure pathways, as the Staff has assumed that the dose rates from these latter two pathways would preclude personnel access while the plume was present. The Staff concludes that the plume would not be present and, therefore, not a source of radiation exposure in either of two situations: (1) the containment failure is categorized as very late and the release of fission products has not started; or (2) the wind direction at the time of release is such that the plume is not being directed towards one or more the FHB access points.

198.

The applicant has projected failure times ranging from 71.4 to 89.6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> for the various very late containment failures, and 40.9 to 56.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for the various late containment failures (Exhibit 9, Table 9-1). The applicant has estimated times to perform various actions to restore spent fuel cooling or provide spent fuel pool makeup, the longest of which was 30 minutes (Exhibit 15, Specific Interrogatory #9). The Staff believes that it is likely that adequate actions can and will be taken to prevent fuel uncovery in the spent fuel pools in these late and very late failure sequences.

199.

For early containment failures, the Staff assumes that the fission product release will start before actions can be taken to restore cooling or provide makeup to the spent fuel pools, and that actions will be delayed until access can be gained, either after the plume has

-101-

9. The EPA dose guidelines are expressed as the sum of the external effective dose equivalent and committed effective dose equivalent. The total effective dose equivalent (TEDE) is defined in 10 CFR 20.1003 as the sum of the deep-dose equivalent (for external exposures) and the committed effective dose equivalent (for internal exposures. The deep-dose equivalent is comparable to the external effective dose equivalent for uniform exposures over the entire body.

cleared the area or a change in wind direction has made access to a FHB access point possible.

200.

The operating floor of the FHB can be accessed from (1) a stairwell from the WPB at the south end of the FHB (Exhibit 22); (2) the roof of the WPB via an exterior door to the south end stairwell (leading to the incomplete Unit 2 excavation) (Exhibit 22); (3) the grade level access door at the east side of the north end of the FHB (Exhibit 22); (4) the grade level truck lock at the north end of the FHB (Exhibit 22); and (5) an exterior door on the west side of the north end of the FHB leading to the FHB 236' elevation (Exhibit 59). The Staff concludes that the location of these FHB access points in relation to the expected release points (Exhibit

57) is such that one or more access points would be available regardless of wind direction. As discussed in Paragraph 167, the wind blew towards the north end of the FHB only 10.1% of the time between 1995 and 1999. The three access points at the north end would likely be available about 90% of the time.

201.

Section 10 CFR 20.1201(a)(1) limits the annual occupational dose to 5 rem TEDE. However, 10 CFR 20.1001(b) states that nothing in this part shall be construed as limiting actions that may be necessary to protect health and safety. Section 10 CFR 50.47(b)(11) requires licensees to have in place means to control emergency exposures, including exposure guidelines consistent with the EPA Emergency Worker and Lifesaving Activity Protective Action Guides. The EPA guidance provides a dose limit of 25 rem9 for actions involving life-saving or the protection of large populations when lower doses are not

-102-practicable. The EPA guidance also provides for doses greater than 25 rem for actions involving life-saving or the protection of large populations when lower doses are not practicable and when the exposed individuals are volunteers and have been brief of the risks involved. The EPA considers these exposures to be justified if the maximum risks permitted to workers are acceptably low, and the risks or costs to others that are avoided by their actions outweigh the risks to which workers are subjected (Exhibit 55, pp.2-9 to 2-13). While the EPA guidance would allow exposures greater than 25 rem, there is uncertainty regarding the availability of volunteers. As a result of these considerations, the Staff has assumed an exposure criterion of 25 rem total effective dose equivalent (TEDE) for this evaluation.

202.

The Staff calculated the dose rate from exposure to the ground contamination due to plume fallout. While the plume exposure would cease once the plume had cleared the area, the ground contamination would continue to be a source of radiation after this. The Staff based its analysis on a core inventory based on the Harris rated thermal reactor power, the release category source terms tabulated by CP & L in response to the Staffs specific interrogatory #4 (Exhibit 15, Specific Interrogatory #4), atmospheric dispersion coefficients calculated using the meteorological data obtained in the Staffs specific interrogatory #1 (Exhibit 15, Specific Interrogatory #1), and dose conversion factors from EPA Federal Guidance Report No. 12 (Exhibit 70-External Exposure to Radionuclides in Air, Water, and Soil, Federal Guidance Report 12, EPA-402-R-93-081, 1993-Table III.3, September 1993, Eckerman, K.F.,

Ryman, J.C.). While the Staffs analysis conservatively assumes an instantaneous ground-level puff release, the applicants release category source terms were used to establish the magnitude and mix of the fission products in the instantaneous releases. As such, the Staff concludes that the magnitudes and mixes assumed in this evaluation reflect the release holdup

-103-times, duration times, and release energies, and the other parameters that characterize the release category source terms.

203.

Particulate and aerosol materials in the plume are projected to fall out with a deposition velocity of 0.3 cm/sec (Exhibit 69, Footnote a to Table F-11). The Staffs analysis considered 48 radionuclides, selected for their importance to reactor accident consequence assessment (Exhibit 71-Reactor Safety Study, An Assessment of Accident Risks in U.S.

Commercial Nuclear Power Plants-Calculation of Reactor Accident Consequences, Appendix VI, WASH-1400, 1975-Table VI.3-1). The Staff selected several receptor locations surrounding the FHB, generally at points of access. Worksheets for the Staffs analyses are provided as Exhibit 63 and Exhibit 72 (Staff Analysis of Post-Accident Ground Deposition Dose Rate, November 2000, S.F. LaVie). The results of the Staffs analyses are presented in Exhibit 72.

204.

In assessing the likelihood of gaining access through a contaminated area following plume transit, the Staff assumed that a dose rate of about 25 rem/hour and higher would likely preclude access. At a dose rate of 25 rem/hour, the available stay time before which the dose would exceed the assumed criterion of 25 rem (Paragraph 201), would be one hour. Two of the FHB access locations can be approached within feet by a motor vehicle, affording a minimum exposure time. The Staff estimates that other access locations would involve 5-10 minutes of walking after being approached by a motor vehicle (Exhibit 22). The ingress and egress time would expend 20-30% of the available stay time of one hour, leaving about 18 rem for the performance of the restoration or makeup actions.

-104-205.

The analysis results indicate that, for accident sequences other than the large early containment failure (in which no credit is taken for scrubbing by the pool overlaying core debris or by containment sprays), the postulated dose rate would be less than the assumed criterion of 25 rem/hour for one or more access points after various periods of decay up to five days (Exhibit 72, pp.1-3). The postulated dose from ground contamination can occur only if the fission product plume has passed over the access area. The Staff has determined that the location of the FHB access points in relation to the expected release points (as discussed in Paragraph 205) makes it unlikely that fallout from the plume would affect all available access points. Although it is expected that wind directions would change over the course of the event, the Staff expects such changes to reduce the ground level concentration at any given access point due to the larger surface area upon which the plume fallout is deposited. Based upon these considerations, the Staff has concluded, with reasonable assurance, that access would likely be available to the FHB from the site yard.

206.

The Staff believes that several of the assumptions used in this analysis are conservative and that it is likely the actual dose rates would be much lower. First, all of the fission product releases were assumed to be ground level releases. This was assumed since the Staff could not discount (with certainty) a portion of the release occurring from a building opening and the fact that the main plant stack does not meet the Staffs criterion for an elevated release point (i.e., vent height 2.5 times the height of adjacent buildings) (Exhibit 62, Position C.1.3.2). For a ground level release, the ground level contaminant concentrations are at their maximum value at the release point and decrease with increasing distance. For an elevated release, the ground level contaminant concentrations are at a minimum value near the release, and initially increase with increasing downwind distance until a maximum concentration is reached, after which the concentration decreases with increasing distances (Exhibit

-105-73-Meteorology and Atomic Energy, TID24190, July 1968, Slade, D.F., edit, Figure A.4).

Wind speed generally increases with increasing elevation (Exhibit 73, section 3-1.2.6). Since atmospheric dispersion is inversely proportional to wind speed (Exhibit 62, Equations 1,2,3, and 4), concentrations will be further reduced. The minimum elevated plume height is the elevation of the top of the stack. However, a plume will rise due to buoyancy effects and mechanical jet forces before it is turned horizontal by the wind (Exhibit 73, section 5-2.1.1). The Staff has ignored these effects in its analysis. The energy associated with a containment failure will impact thermal energy to the fission product release, adding to the buoyancy rise. Regulatory Guide 1.111 (Exhibit 74-USNRC Regulatory Guide 1.111, Methods for Estimating Atmospheric Transport and Dispersion of Gaseous Effluents in Routine Releases from Light Water Cooled Reactors, Revision 1; 1977, C.2.a) provides guidance for addressing release points that are greater than the height of adjacent structures but less than the 2.5 criterion. The guide suggests that if the vertical exit velocity is at least five times the horizontal wind speed, the plume should be treated as an elevated release. The main plant stack exit velocity of 2950 ft/min with all fans running (Exhibit 20, section 9.4.0-10) is 5.8 times the maximum wind speed of 5.8 mph (Exhibit 75-Shearon Harris Nuclear Power Plant Final Safety Analysis Report (FSAR) Chapter 2-section 2.3.3-91). Thus, it is likely than the plume would be elevated for accident sequences in which offsite power was not lost. The Staff used the ARCON96 computer code for generating the atmospheric dispersion coefficients. ARCON96 generates 95%-tile values (i.e., the actual dispersion coefficient will not exceed the calculated value more than 5% of the time) (Exhibit 76-NUREG/CR-6331, Atmospheric Relative Concentrations in Building Wakes, Rev. 1, Ramsdell, J.V., section 3.1). Based on the above considerations, the Staff believes that the atmospheric dispersion coefficients used in this evaluation are conservative and that the actual dispersion during an accident would likely be less by a factor of 5-10 or more.

-106-207.

The Staffs method of analysis assumed that the fission products projected to be released during the entire accident sequence were instantaneously released, transported, and deposited at the receptor. The Staff believes that this time compression results in conservative estimates of fallout in that (1) no credit was taken for contaminant depletion by deposition into upwind areas; and (2) for longer term release durations, changes in wind direction would result in a wider spread of the deposition. In the latter, while the total amount of fallout would be the same, the amount at the postulated receptors would be less, resulting in dose rates lower than those projected here.

Assessment of Impact of Accessibility Concerns on Makeup 208.

The methods for providing makeup are summarized in Table 2, which identifies the locations for associated personnel actions, and support requirements.

209.

From the forgoing discussions, the following conclusions are drawn. In all degraded core scenarios that leads to an interruption of spent fuel pool cooling, and early, late or containment isolation failure, access to the lower floors of the south end of the FHB cannot be guaranteed (paragraph 168). Thus the following methods for providing makeup to the pools A and B are not guaranteed to be available: the normal method (paragraph 142), and alternate makeup methods 1, 2, 3, 4, 5, and 6 (paragraphs 142, 143, 145, 146, 148, 149). Only the use of the fire protection system and the DWS to directly fill pools A and B are not precluded.

210.

If offsite power is available, the lower elevations of the north end of the FHB could be inaccessible for the 10% of the time that the wind blows the plume in that direction

-107-following the release (paragraph 167). For the 90% of the time that the wind is in a favorable direction and offsite power is available, all methods of makeup to pools C and D are available with operator actions taking place in the north end of the FHB and in the RAB. The availability of offsite power is assessed to preclude significant contamination in those areas of the RAB to which access is required to implement the makeup methods. The makeup from any of the methods is far in excess of that needed for the heat load in pools C and D (paragraph 125, 126), and the excess would flow into pools A and B (paragraphs 153, 154), whether or not the gate seals have been deflated.

211.

If offsite power is not available at the time of the passing of the plume, the lower elevations of the north end of the FHB would not become contaminated regardless of wind direction (paragraph 167). However, those methods that require access to the RAB, namely alternate methods 2, 4, 5, and 6 may be compromised, because of possible contamination (paragraph 193). Alternate method 3 requires off site power and so is unavailable until the power is restored. The normal makeup and alternate method #1 are still available to be used, both in their gravity feed modes. For the 10% of these scenarios in which the wind is in an unfavorable direction, the yard in the vicinity could be contaminated. This is discussed further in paragraph 216 below.

212.

Therefore, for 90% of all scenarios that lead to a degraded core accident, interruption of spent fuel pool cooling and a containment failure, the locations for operator actions to implement at least two simple methods for providing makeup, namely the normal makeup and alternate #1, are fully accessible. The environmental conditions at the lower elevations of the north end of the FHB would not be challenging to the operators, and there are procedures for implementation.

-108-213.

Furthermore, for all the scenarios discussed in paragraphs 210 and 211 above, there is no contamination of the operating floor, and access can be gained from the yard (paragraph 205), so makeup using the unnumbered alternative methods (i.e., direct addition to the fuel storage pools from DWS and FPS) is possible.

214.

For the 10% of the scenarios for which offsite power is available and the wind is in an unfavorable direction, none of the methods relying on access to the lower elevations of the FHB at either the north or south end can be relied upon. However, access from the yard to the operating floor of the FHB would still be possible (paragraph 205). Thus the unnumbered alternate makeup methods, using the FPS and DWS at the operating floor would be available.

With offsite power available, both the electric and diesel driven fire pumps are available.

-109-Method Locations of manual actions Support requirements Normal Makeup (Procedure OP-116)

DWS 1 valve on 216' elevation FHB (South end for pools A and B; North end for C and D)

DWS storage tank full for gravity feed; Offsite power (demineralized water system; spent fuel pool purification system)

Alternate # 1 (Procedure OP-116)

DWS 2 valves on 216' of FHB; two on 236' of FHB; close power supply breakers on 261' FHB; turn on purification pump at 236'FHB or operating floor (S for A and B, N for C and D)

DWS storage tank full for gravity feed; Offsite power (spent fuel pool purification system)

Alternate # 2 (Procedure OP-116) 216' FHB, install pressure gauge and open valve; 236' of RAB, open 1 valve; close power supply breakers on 261' FHB; turn on purification pump at 236'FHB or operating floor (S for A and B, N for C and D)

Offsite power (spent fuel pool purification system)

RWST inventory Alternate #3 (Procedure OP-116) 236' FHB align 1 valve (S for A and B, N for C and D)

Offsite power - Spent fuel pool skimmer system in operation Alternate #4 (Procedure OP-116) 236' FHB - 8 valves; 216' FHB 2 valves; (S for A and B, N for C and D) 236'RAB 1 valve RWST full for gravity feed; Spent fuel pool cooling pump (offsite or onsite power)

Alternate # 5 (Procedure OP-116) 236' RAB install jumper; 236' FHB open 2 valves (S for A and B, N for C and D)

ESW system (Offsite or onsite ac power)

Alternate #6 (Procedure OP-116) 261' RAB 2 valves, 216' FHB 2 valves (S for A and B, N for C and D) offsite power; RMWST inventory Demineralized water valve stations on operating floor offsite power; DWS storage tank full for gravity feed; Fire protection system hose stations on operating floor of FHB offsite power for motor driven fire pump; diesel driven fire pump Table 2Makeup Alternatives

-110-215.

The seismic scenario is assumed in this analysis to have resulted from a relatively low magnitude earthquake whose principal impact on the plant is to cause a loss of offsite power due to failure of the ceramic insulators in the switchyard. The very large earthquakes that lead to major structural failures are considered to be very low frequency events. The most likely cause of core damage, given the seismic ruggedness of the plant is a station blackout. The frequency of the first three steps in the sequence therefore is estimated to be on the order of 1E-06/reactor year. This frequency is an integral over a range of earthquakes with increasing ground acceleration. At the lower accelerations, the non-seismically qualified systems such as the fire water system and the demineralized water systems would be expected to remain intact, and as in paragraph 211 above, the normal and alternate #1 makeup methods would be available as would the fire protection system. At the higher accelerations, this could not be guaranteed. However, if all else failed, mobile sources, such as pumper trucks, could be brought to bear, as long as site access is possible (see paragraph 216 below). Because of its potential impact on multiple systems, the seismic scenario is considered to be the most limiting.

216.

The Staff has concluded that even were the access paths to be contaminated by the passing plume, the contamination would not be such as to preclude an approach to the FHB from the yard to gain access, although the stay time might be limited (paragraphs 197 - 207).

Because of the relative size of the FHB and the plume width, a simultaneous contamination of access locations to both the South and North end of the building is very unlikely, and could only result from a significant change in wind direction during the release. Such a change would have the effect of lowering dose rates for any one of the paths, thus allowing more time for access through any one of the paths.

-111-217.

The Staff therefore concludes that there are no scenarios in which all methods of providing makeup to the pools would be precluded as a result of extreme radiation doses. In this case, the probability of step 5 of the seven-step scenario, as written, is essentially zero.

However, the fact that some of the methods for providing makeup are potentially less reliable or more difficult to implement than others, deserves to be addressed.

Assessment of Likelihood of Failure to Provide Makeup or Restore Pool Cooling 218.

This section discusses the assessment of how likely the operating Staff are to restore cooling or initiate makeup to the pool following a severe core damage accident with a failure of the containment function. The analytical method used to assess the likelihood of successful operator actions is known as Human Reliability Analysis, or HRA. The methods developed for HRA have primarily been to assess the likelihood of error associated with routine processes such as restoration of systems following maintenance, with carrying out tasks following a written set of instructions, and also in responding to plant transients or accidents. In the IPE and IPEEE, in general credit was only taken for responses for which there was procedural guidance, typically the emergency operating procedures and functional restoration guidelines.

219.

Once core damage has occurred, mitigation strategies are provided by the severe accident management guidelines. These are not procedures as such but provide guidance for the plant Staff to develop appropriate ad hoc procedures to attempt to mitigate the impact of the core damage accident. At this stage, the responsibility for management of the accident is transferred to the Technical Support Center, or TSC, which has a large staff and facilities for overseeing all aspects of the plant, including the spent fuel pool.

-112-220.

In order to be successful in coping with the interruption of spent fuel pool cooling, there are three basic functions required of the plant operating staff: (a) they must recognize that the cooling has been lost and that it is necessary to recover cooling to prevent a zirconium fire with its accompanying release of fission products; (b) they must formulate plans on how to restore cooling; and (c) they must execute the plans successfully.

221.

If the interruption to pool cooling is a direct result of plant conditions, there will be several indications that the pool cooling has been interrupted, the most obvious being the fuel pool high temperature alsrm. The alarm is actuated from a temperature detector directly reading fuel pool coolant temperature in each pool. At Harris the fuel pool high temperature alarm is set at 105F. If it is assumed that the pool is initially at 95F and will rise at 5.7F/hr, corresponding to the heat load in pools A and B at the beginning of the cycle, operators will receive a pool high temperature alarm in approximately 2 hrs. However, prior to receiving the high temperature alarm, unless there is a station blackout (SBO) the operators will receive other SFP-related alarms. Depending on how the accident progresses, these advance alarms will give the operators notice that cooling has been lost to the pool. For example, if SFPCCS flow is lost due to a loss of offsite power, the control room operators will receive a SFP inlet low flow alarm (<1925 gpm), before the pool begins to heat up.

222.

Similarly, control room operators may receive an alarm on the Auxiliary Equipment panel 1 alerting them to a high SFP HX outlet temperature condition if CCW or ESW is lost due to the postulated accident condition. In this case, SFPCCS flow would not be lost, however, cooling to the SFPCCS heat exchangers would be interrupted. The SFPCCS heat

-113-exchanger temperature alarm is also set at 105F. While this alarm will not give operators advance indication of a loss of pool cooling when compared to the direct reading pool temperature alarm, the heat exchanger high temperature alarm provides operators with a measure of redundancy.

223.

These alarms will "lock in", and they will stay locked in until the condition causing the alarm clears (e.g., flow is restored, temperature is reduced below the alarm setpoint). With a pool heatup rate of 5.7 F/hr, operators have 18 hrs to restore cooling or align makeup from the time the pool high temperature alarm is received before the pools begin boiling. The alarm indicating lights on the annunciator panels will remain illuminated to remind operators of the alarm condition in the system.

224.

In the event operators are directed by procedure to secure cooling to the fuel pool heat exchangers to maximize the heat removal from the containment, the suspension of fuel pool cooling will be a conscious decision by the control room operators. Similarly, the fuel pool high temperature alarm will initiate at about two hours after termination of cooling and will remain locked-in until the condition is addressed by the plant operators.

225.

Thus in all the scenarios of interest there will be several indications to remind operators of the condition of the spent fuel pool. However, there will also be many other competing indications of higher immediate priority in the control room during the course of the accident. So while the alarms are important indications, they cannot be relied on to guarantee that the plant Staff responds early in the course of the accident.

-114-226.

Eventually, if the cooling is not restored, level will decrease due to evaporation, and the fuel pool low level alarm will actuate. At that time, the annunciator procedure directs the operator to makeup to the pool. For the highest heat load, at the beginning of the cycle, the alarm will actuate at 23.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after loss of cooling to the pools (paragraph 130). For the very late containment failure scenarios, in which the containment is assumed to fail in more than 90 hours0.00104 days <br />0.025 hours <br />1.488095e-4 weeks <br />3.4245e-5 months <br /> after the accident initiation, this would be a compelling cue because at this time, things would not be happening quickly in the reactor and the containment. There would be at least 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> to take action before the containment fails, and there is no radiological impediment to taking action. Thus for the very late containment failure scenarios, we assume a high likelihood of success.

227.

For the early and for many of the late containment failure modes, the low level alarm may not occur before containment failure. Since we have assumed that the control room would not necessarily be habitable after a containment failure, the control room low level alarm cannot be relied on to provide a reminder to the operating Staff after the containment has failed.

228.

Even though the indications may not be compelling, particularly if the operating Staff has abandoned the control room, and responsibility for accident management has been transferred to the TSC, the Staff considers that for the plant operating Staff, the TSC, and the NRC incident response center, all to neglect considering the need to address the spent fuel pool cooling over a period of 5 days is not reasonable, particularly in light of the current concern, and the NRC Staffs awareness of the risks posed by spent fuel pools, as characterized by guidance to NRC Emergency Operations Center Staff regarding spent fuel pool damage and consequence assessment (Exhibit 69).

-115-229.

Given that it has been recognized that it is necessary to provide makeup to or restart cooling of the pools, the decision has to be made on how to achieve this goal. Most of the make up methods are addressed in procedure OP-116. Only the use of the fire protection system and the use of the demineralized water tank to directly makeup to the pool at the operating floor of the FHB are unproceduralized. They are however, very simple actions involving, in the one case, opening a single valve, and in the other, opening a valve, running an already installed hose, and starting a fire protection pump. The plant Staff has already considered these actions as they are described in their responses to the Staffs interrogatories.

230.

The final function that must be successfully completed is the execution of these tasks. If there is reason to believe that there is a significant concern about radiological contamination in areas where access is needed to perform the task, no credit has been taken for the method of providing makeup. Other concerns that affect the likelihood of success are those of accessibility, whether there is ample time to perform the tasks, whether there are procedures, and whether special tools are necessary and available. In response to the Staffs request for information, CP&L Staff confirmed that the auxiliary operators who would be called upon to re-position valves to effect spent fuel pool makeup do carry keys to the affected areas (and any intervening fire/security doors), keys to locked valves, and flashlights, all as part of their normal shift duties and responsibilities. Thus physical access is not a concern.

231.

Most of the methods are relatively simple, the simplest requiring the opening of a single valve, the most complex, the installation of a jumper and opening two valves. CP&L has estimated that most can be accomplished locally within 30 minutes. Given that the time available to implement these actions is tens of hours, the time constraints are not limiting.

-116-232.

Procedures exist for most of the makeup methods. The equipment that is required to be manipulated is labeled clearly in the plant as was confirmed during the Staffs site visit. Most of the equipment is readily accessible. The one exception is the connection from ESW system to the spent fuel pool (Alternate makeup #5) where the connection is near the ceiling.

233.

Given the above, once the decision has been made on a method for makeup, the likelihood of success is high. The most likely cause of failure to restore pool cooling or start makeup systems is considered to be a failure in recognizing the need to take action. However, in those accidents in which the containment is likely to have failed before the need to provide makeup is clear, the Staff at the site would already be in the process of damage control, and no longer concerned with protecting the reactor, but of limiting radiological contamination, and the spent fuel pool would likely be an obvious target of concern.

234.

While no HRA method has been constructed and calibrated to provide human error probabilities for such situations, for the purpose of this analysis, a probability of.1 has been assigned to the event that the restoration of pool cooling or provision of makeup is not successful for those cases where the only access is to the operating floor of the FHB. In this case, given the time available, equipment reliability will not be limiting but recovery actions may be hampered by the steam environment on the operating floor.

As discussed in paragraphs 179 and 180, radiation doses are not limiting even if the water level in pools A and B is significantly lowered. This probability represents the Staffs assessment that success is likely, though not guaranteed. For those cases where there are several methods available,

-117-and no access or environmental problems, the likelihood of failure is much lower, but assumed for this purpose to be.01.

Summary 235.

The Staff estimates the core damage probability at the Harris plant, including contributions from both internal and external initiating events from full power and low-power and shutdown states, to be 1.2E-04/reactor year. While there is some uncertainty with this estimate, the Staff believes that this is a reasonably conservative assessment. The contribution from internal initiating events in particular is likely to be conservative, since the frequency of initiating events has been shown, based on plant specific data, to be considerably lower than that assumed in the IPE (Exhibit 9, Table 3-17, and Exhibit 6, Table 3-4).

236.

The conditional probability that the spent fuel pool cooling is interrupted will be dominated by common causes of both core damage and the interruption of spent fuel pool cooling. The joint probability of both events from independent causes will be very low because, the probability of failure of a redundant, normally operating system, such as the spent fuel pool cooling system over a short time is very low. Therefore, this affidavit has focused on dependent causes.

237.

The Staff assesses that many, but by no means all, of the degraded core sequences may lead directly to an interruption of spent fuel pool cooling. The accident sequences initiated by a loss of offsite power, one internal fire scenario, seismic events, and loss of dc bus DP-1 are highly likely to result in a simultaneous loss of spent fuel pool cooling since the dominant contributions are from scenarios that correspond to a complete loss of

-118-station power. The accident sequences resulting from internal floods also lead directly to a loss of spent fuel pool cooling, since the service water system (which is assessed to be the source of the internal flood) is the ultimate heat sink for the pool cooling system. The LOCAs and transient induced LOCAs may result in an interruption of spent fuel pool cooling as a result of operator action to maximize the heat removal from containment during the recirculation phase.

238.

Accident sequences resulting from transients other than those discussed above do not result directly in a loss of spent fuel pool cooling. Interfacing systems LOCAs and Steam Generator Tube Rupture accidents in a similar manner will not lead directly to loss of the spent fuel pool cooling function. Further, it is not expected that a large fraction of the accidents occurring during shutdown will result in a direct loss of the spent fuel pool cooling function.

239.

The Staff has considered the likelihood that should the containment fail, the release of steam and radionuclides into the plant auxiliary buildings might affect equipment necessary to maintain pool cooling, primarily the component cooling water system, and emergency power systems. The Staff has concluded that the likelihood of such a consequential loss of cooling is low (paragraph 115).

240.

Therefore, the Staff concludes that the frequency of accidents that could lead to an interruption of spent fuel pool cooling is less than 1E-04/reactor year, with a best estimate, given the information available, of 6.3E-05 (paragraph 116).

241.

All the sequences that are initiated by a loss of offsite power also result in the interruption of several of the methods of makeup to the pools, since the demineralized water system is not powered by the emergency buses. This is not necessarily true of the accidents

-119-caused by the 6.9kv bus fire nor the loss of dc bus DP-1, since they may not disrupt power to station loads other than the reactor. However, methods that employ gravity feed and the use of the fire protection system with the diesel driven fire pump would still be available. Sequences not initiated by a loss of offsite power will not lead to interruption of the makeup methods.

Therefore, no scenarios have been identified that directly lead to loss of all cooling and makeup systems.

242.

Event number 5 in the sequence of events is inability to restart any pool cooling or makeup systems due to extreme radiation doses. For the majority of accidents that result in an interruption of the spent fuel pool cooling function, the function itself is recoverable once the cause of the interruption has been rectified. In other words, a very small fraction of the interruptions of cooling are caused by mechanical failure of the spent fuel pool cooling system and the supporting CCW system. Thus, the fraction of scenarios in which the function can be restored before containment failure do not contribute to the seven step scenario.

243.

The likelihood of recovering the cooling function before containment failure depends on the precise timing of events. Because there is a very large number of possible scenarios representing different time sequences of events, the Staff has not focused on assessing the probability of restoration for the early and late containment failure mode scenarios. However for the very late containment failures, as discussed in paragraph 137, there is a very high probability that makeup or cooling would be restored before containment failure.

244.

For the other containment failure modes of interest for this sequence, the Staff has considered their impact with respect to radiological contamination of those plant areas to

-120-which plant personnel would need access to reestablish pool cooling or pool makeup. Those releases that bypass the containment, such as those resulting from steam generator tube ruptures are of little concern because such accidents do not interrupt the pool cooling function.

The containment failure modes of concern are primarily the early, late and very late containment failures.

245.

The Staff considers that the containment failure modes of most concern are the early and late containment failures. Their combined probability of failure is less than.1.

Furthermore, it cannot be guaranteed that the control room would be habitable. A very conservative approach is to assume that the control room has been abandoned and that the only recourse is to provide makeup.

246.

The Staff concludes that the probability of a degraded core accident that leads to an interruption of the pool cooling function and a containment failure prior to restoration of pool cooling is bounded by 6.3E-06.

247.

The Staff has identified no scenarios that, in the time available to provide makeup, would prevent access to all the areas where operator action is needed to establish makeup, although the time for access might be restricted because of dose considerations. For most scenarios, access to the plant to initiate several of the methods is possible. Thus, it can be argued that element (5) of the seven step scenario has a probability of essentially zero.

However, as will be discussed below, given the time available and taking into account that, for most of the scenarios there are several easily implemented methods accessible for providing makeup, even taking into account human reliability considerations, the probability of a more broadly defined sequence, namely one in which the degraded core accident leading to a

-121-containment failure and a loss of spent fuel pool cooling for a long enough time that the water is evaporated so that the fuel is uncovered is very low.

248.

For 90% of the non-seismic contributions several methods are available that can be implemented from multiple locations with a likelihood of success of.01. The contribution to the frequency of a the evaporation of pools A and B, which is the more limiting case, is 5.3E-06 (the non-seismic contribution) x.9x.01=5E-08.

249.

Assuming conservatively that if offsite power is available when the plume passes (leading to contamination of the north end of the FHB) only the use of the FPS and DWS at the operating floor of the FHB is possible for the 10% of cases in which the wind is in an unfavorable direction, then the contribution is bounded by 5.3E-06x.1x.1=5.3E-08.

250.

For the seismic contribution, it is conservatively assumed that access to the operating floor is required to provide makeup, with a likelihood of failure of.1, the frequency is 1E-06x.1=1E-07 251.

Thus the total frequency of a sufficiently prolonged loss of cooling to pools A and B resulting in evaporation of the water to the extent of uncovering the fuel is estimated to be on the order of 2E-07/reactor year (5E-08 + 5E-08 + 1E-07). This is an upper bound on the probability of the seven step scenario, since the latter is a more restrictively defined scenario than that for which the frequency is estimated, in that it specifies the dose as being the factor that mitigates against successful initiation of makeup or pool cooling. This basis for, and a characterization of this estimate is discussed in the following paragraphs.

-122-252.

Since it does not have a detailed plant model of the Harris plant, the Staff has used information from the licensees PRA models to estimate the joint probability of the first three steps of the seven step sequence. The IPE, the IPEEE, and the PSA represent a significant effort. The IPE and IPEEE are peer reviewed documents and have also been subject to review by NRC Staff. The PSA has also received peer review at a fairly high level (Exhibit 77-Shearon Harris Nuclear Plant Probabilistic Safety Assessment, Review of Sequence Solution, Revision 0, April 1998). A comparison with results from PRAs for similar plants confirms that the results presented by the licensee are reasonable estimates of core damage probability and containment failure probability.

253.

The estimates used for the seismic and shutdown contributions to the core damage frequency were not based on plant specific studies, but on available information for similar plants. They are believed to be representative, which could be conservative, but would not be expected to be non-conservative by as much as a factor of 2.

254.

Rather than performing a very detailed calculation, the Staff has taken a bounding approach, focusing on the major factors that impact the outcome. In making regulatory decisions when using PSA results, the Staff recognizes the importance of accounting for the uncertainties in the analysis. The conclusion of this analysis is, however, not very sensitive to the uncertainties for the following reasons.

255.

The Staff has taken what it believes to be a conservative approach to estimating the conditional probability of a coincidental interruption of the spent fuel pool cooling function that requires recovery following containment failure. For the containment failure modes that are

-123-such that failure could occur in the same time frame as pool boiling, namely the early and late containment failure modes, no credit has been taken for recovery of pool cooling before containment failure. If credit were taken this could significantly reduce the frequency.

Furthermore, it has taken no credit for assuming that, for 60% of the accidents, the control room would remain habitable (Paragraph 186), which would increase the likelihood of recovery of the spent fuel pool cooling before makeup were necessary.

256.

Because the Staff believes that it has demonstrated that there are no accident sequences in which access to at least one method of pool makeup is precluded, the probability of the scenario as written is essentially zero. In this case, a precise evaluation of the probability is not needed. However, it has also recognized that the successful termination of the sequence is dependent on operator action, given that it is not precluded by severe radiation doses.

For most of the scenarios, the actions are relatively simple. However, there are some scenarios where the only viable method might be entering the operating floor of the FHB, and if this were to happen late in the scenario, there is the potential for the steam environment causing some difficulty for operators. Therefore, the estimate provided above takes into account the likelihood of failure of the operators to successfully implement makeup to the spent fuel pools.

257.

To address the second question posed by the Board, the most recent published study of beyond design basis accidents in spent fuel pools is the Draft Final Technical Study of Spent Fuel Pool Accident Risk at Decommissioning Nuclear Power Plants (TWG), February 2000 (http://www.nrc.gov/NRC/REACTOR/DECOMMISSIONING/SF/index.html). Neither this report nor NUREG-1353 has a direct relevance to this affidavit, since they do not address severe core damage accidents as an initiating event for the loss of spent fuel pool cooling.

However, it should be noted that the TWG report is in substantial agreement with NUREG-1353

-124-in recognizing the very rare, high ground acceleration earthquakes as being the major concern.

Such major earthquakes are not an issue here. The concerns expressed in the Advisory Committee on Reactor Safety (ACRS) April 13, 2000 letter do not impact the estimation of the probability of the seven step sequence. In particular, the Staff has taken the position in this affidavit, that even if the probability of step seven, the chance of an occurrence of an exothermic reaction, given the first six steps of the sequence, is assumed to be 1, the probability of the sequence is low enough that its occurrence is considered remote and speculative. Furthermore, the issue raised by the ACRS in relation to the ignition temperature does not directly impact the probability of the sequence. In the TWG report, the ignition temperature is used to determine the age of fuel for which an exothermic reaction is no longer a concern. In reality, a refinement of the ignition temperature could impact the time to ignition once the fuel is uncovered. However, this has played no role in the assessment contained in this affidavit.

258.

The exhibits attached hereto are true and correct copies of the documents relied upon in this affidavit.

259.

I hereby certify that the information contained in paragraphs 1, 5-8, 9-42, 49-57, 116-117, 132-139, 208-220, and 224-258 is true and correct to the best of my knowledge, information and belief.

Gareth W. Parry

-125-260.

I hereby certify that the information contained in paragraphs 2, 102-115, 155-207, and 258 and in Exhibits 60, 63, 65 and 72 is true and correct to the best of my knowledge, information and belief.

Stephen F. LaVie 261.

I hereby certify that the information contained in paragraphs 3,58-101 and 258, and Table 1 is true and correct to the best of my knowledge, information and belief.

Robert L. Palla 262.

I hereby certify that the information contained in paragraphs 4, 43-48, 118-131, 140-154, 221-223 and 258 is true and correct to the best of my knowledge, information and belief.

Christopher Gratton Sworn and subscribed to before me this ______

day of November, 2000.

My Commission expires

.