ML092640174

MACCS2 Computer Code Application for Documented Safety Analysis, Final Report

ML092640174
Person / Time
Site:	Indian Point
Issue date:	06/30/2004
From:	US Dept of Energy (DOE)
To:	Atomic Safety and Licensing Board Panel
SECY RAS
References
50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01, RAS 284 DOE-EH-4.2.1.4-MACCS2
Download: ML092640174 (19)

Text

DOE-EH-4.2.1.4-MACCS2 Code Guidance MACCS2 Computer Code Application Guidance for Documented Safety Analysis Final Report U.S. Department of Energy Office of Environment, Safety and Health 1000 Independence Ave., S.W.

Washington, DC 20585-2040 June 2004

MACCS2 Guidance Report June 2004 Final Report 2.0

SUMMARY

DESCRIPTION OF THE MACCS2 CODE _

This section provides a summary form description of the MACCS2 code. It assumes an understanding of the principles of source term development from postulated accident conditions, the interface wvith dispersion conditions in the atmosphere, and the overall assessment of radiological dose to receptors. These concepts are discussed in Appendix A to DOE Standard 3009-94 (DOE, 2000).

Users requiring additional background information on dispersion and consequence analysis before reviewing input file preparation are referred to Appendix A in this document, "Overview of Atmospheric Dispersion and Consequence Analysis'".

2.1 MACCS/MACCS2 Summary Description 7

MACCS2 (Chanin, 1998) is a Gaussian plume model for calculation of radiological atmospheric dispersion and consequences. MACCS2 is IBM PC compatible, and is written in FORTRAN 77 and 90. The code is under development at Sandia National Laboratories (SNL) and is an update to'MACCS.1. Since the issuance of DOE-STD-3009-94 for nuclear facility accident analysis, MACCS2 has been used for DOE applications primarily as a tool for deterministic consequence analysis. This information is used to support decision-making on cohtrol selection in nuclear facilities, specifically identification of safety structures, systems, and components (SSCs).

MACCS2 predicts dispersion of radionuclides by the use of multiple, straight-line Gaussian plumes. The direction, duration, sensible heat, and initial radionuclide concentration may be varied from plume to plume. Crosswind dispersion is treated by a multi-step function and both wet and dry depositions features can be modeled as independent processes. For DSA applications, the MACCS2 user can apply either.the stratified random sampling mode or the Latin Hypercube Sampling (LHS) mode to process one year of site-specific meteorological data, with the former approach encouraged for current applications. Based on the meteorological sampling of site-specific data, and application of user-specified dose and/Or health effects models, complementary cumulative distribution functions (CCDFs) are calculated for various measures of consequence. The average, median, 95th, and 99.5th percentile consequences are provided in the output.

The United States Nuclear Regulatory Commission (NRC) sponsored the development of the MACCS code (Chanin, 1990; Jow, 1990; Rollstin, 1990; and Chanin, 1993) as a successor to the CRAC2 code for the performance of commercial nuclear industry probabilistic safety assessments (PSAs). The MACCS code was used in the NUREG-1 150 PSA study (NRC, 1990a) in the early 1990's. Prior to the code being released to the public, the MACCS code 'was independently verified by Idaho National Engineering and Environmental Laboratory (Dobbe, 1990). After Verification, the NRC released MACCS, Version 1.5.11 for use by the public. Examples of MACCS applied in this period include commercial reactor PSAs (both U.S. and international), as well as non-reactor nuclear facilities (primarily U.S.).

2-1

MACCS2 Guidance Report June 2004 Final Report The major enhancements in the MACCS2 code over itsýMACCS predecessor are in the number of nuclides included in the dose conversion factor database, the number of daughters in the decay chain, the emergency response model, the food pathway model, and the inclusion of consequences from meteorological data in a sector as opposed to the whole site.

Other features that have been added to MACCS2 as well as those retained from MACCS are noted in Section 2.2. Table 2-1 contains summary information on MACCS2, based on the software package available from the Radiation Safety Information Computational Center (RSICC). The same version will be transmitted directly from the SNL developer upon.

authorization from the'Nuclear Regulatory Commission.

The basis for the report is Version 1.12 of MACCS2. In March 2004, Version 1.13.1 was released to RSICC, however, nearly all of the report is applicable to the newer Version. A set of user notes for Version 1.13.1 is attached to this report as Appendix F.

N

• 2-2

MACCS2 Guidance Report June 2004 Final Report Table 2-1. Summary Description of MACCS2 Software Type Specific Information Code Name MACCS2 - MELCOR AccidentConsequence Code System for the Calculation of the Health and Economic Consequences of Accidental Atmospheric Radiological Releases Developing Sandia National Laboratories (SNL) for the U.S. Nuclear Regulatory Commission Organization and (primary) and U.S. Department of Energy (minor)

Sponsor Version of the Version 1.12 Code Auxiliary Codes AUXILIARY CODES:

DOSFAC2:NRC dose conversion factor (DCF) preprocessor.

FGRDCF: DCF preprocessor based on the DCF databases of Federal Guidance Reports 11 and 12 from ORNL (DLC-l172).

IDCF2: DCF preprocessor based on the IDCF code developed at the Idaho National Engineering Laboratory.

COMIDA2: Food pathway. preprocessor based on the COMIDA (PSR-343) food pathway preprocessor developed at the Idaho National Engineering Laboratory.

Note: MELMACCS (MACCS input generator from MELCOR runs) and CHAIN (Radionuclide progeny) are auxiliary codes, and not available from RSICC. CHAIN was developed by Keith Eckerman at ORNL.

Software FORTRAN 77/90, PC based some system dependencies Platform/Portability Coding and Fortran 77, PC based 80486 or Pentium processor (C00652/PC486/00).

Computer Technical Support Nathan Bixler Sandia National Laboratories P.O. Box 5800 Albuquerque, NM 87185-0748 (505) 845-3144 nbixlerosandia.gov; 2 Code Procurement Radiation Safety Information Computational Center (RSICC)

Oak Ridge National Laboratory Post Office Box 2008 Bethel Valley Road Oak Ridge, Tennessee 37831-6171 Phone: 865-574-6176; Fax: 865-241-4046 Email: pdc@oml.gov; Internet: http://www-rsicc.omi.gov/rsicc.html Contact Nathan Bixler (above) or Jocelyn Mitchell g NRC for authorization Phone: 301-415-5289 Email: jampnrc.gov I 2 Recommended procurement route is through N. Bixler/J. Mitchell (see below). Except where noted, items shown here are valid when MACCS2 is obtained through RSICC.

2-3

MACCS2 Guidance Report .i. June2004 Final Report Table 2-1. Summary Description of MACCS2 Software (Continued)

Code Package CCC-652; Included are the references cited below and the Fortran source code, executables and data; which are distributed on 1 CD in self-extracting compressed DOS files Contributors Sandia National Laboratories, Albuquerque, New Mexico, Oak Ridge National Laboratory, Oak Ridge; Tennessee, Idaho National Engineering and Environmental Laboratory, Idaho Falls, ID Documentation 1. D. Chanin and M. L. Young, "Code Manual for MACCS2, User's Guide,"

Supplied with Code NUREG/CR-6613, Vol 1, SAND97-0594 (May 1998), Sandia National Transmittal Laboratories, Albuquerque, NM.

2. D. Chanin and M. L. Young, "Code Manual for MACCS2, Preprocessor Codes COMIDA2, FGRDCF, IDCF2," NUREG/CR-6613, Vol. 2, SAND97-0594 (May 1998), Sandia National Laboratories, Albuquerque, NM.

3. M. L. Young and D. Chanin, "DOSFAC2 User's Guide," NUREG/CR-6547, SAND97-2776 (December 1997).

4. H-N. Jow, J. L. Sprung, J. A. Rollstin, L. T. Ritchie, D. I. Chanin, "MELCOR Accident Consequence Code System (MACCS), Model Description,"

NUREG/CR-4691, SAND86-1562, Vol. 2 (February 1990).

5. J. Gregory, "Software Defect Notifications" (May 1998).

6. M. L. Young, "READMAC2.txt" (April 1997).

Nature of Problem MACCS2 simulates the impact of accidental atmospheric releases of radiological materials on the surrounding environment. This package is a major enhancement of the previous CCC-546/MACCS 1.5.11 package. The principal 'phenomena considered in MACCS are atmospheric transport, mitigative actions based on dose projection, dose accumulation by a number of pathways including food and water ingestion, early and latent health effects, and economic costs. MACCS can be used for a variety of applications including probabilistic risk assessment (PRA) of nuclear power plants and other nuclear facilities, sensitivity studies to gain a better understanding of the parameters important to PRA, and cost benefit analysis.

Method of MACCS2 contains simple models with convenient analytical solutions. A MACCS2 Solution calculation consists of three phases: input processing and validation, phenomenological modeling and output processing. The phenomenological models are based mostly on empirical data, and the solutions they entail are usually analytical in nature and computationally straightforward. The modeling phase is subdivided into three modules. ATMOS treats atmospheric transport and dispersion of material and its deposition from the air utilizing a Gaussian plume model with Pasquill-Gifford dispersion parameters. EARLY models consequences of the accident to the surrounding area during an emergency action period. CHRONC considers the long term impact in the period subsequent to the emergency action period. Detailed meteorological, population, and economic and health data are required depending upon the type of analyses to be performed and output required. Model parameters can be provided by the user via input facilitating the analysis of consequence uncertainties due to uncertainties in the model parameters.

2-4

MACCS2 Guidance Report June 2004 Final Report Table 2-1. Summary Description of MACCS2 Software (Continued)

Restrictions or MACCS2 and MACCS do not comply fully With Appendix A, DOE-STD-3009-94 Limitations (NRC Regulatory Guide 1.145 Position 3) methodology for determination of direction-independent 95"h percentile dose to the offsite individual. It may be used to conservatively evaluate the 95h percentile direction-independent dose to receptors equidistant to the source.

7. The atmospheric model included in the code does not model the impact of terrain effects on atmospheric dispersion, nor can it accept more than one weather spatial location. Like all Gaussian models, MACCS2 is notwell suited for modeling dispersion close to the source (less than 100 meters from the source) or long-range dispersion (beyond 15 to 20 miles from the source). Momentum effects of highly energetic releases can be approximated. The economic model included in the code models only the economic cost of mitigative actions.

Run Time One source term for one meteorological sequence requires less than one second on a Pentium 2 or 3 GHZ. Running two source terms and sampling a year of weather data (Sample Problem A) requires approximately times on the order of-seconds to minutes, depending on the complexity of the problem. '

Computer IBM-compatible 486/DX or Pentium PC with 8 MB of RAM Hardware The MACCS2 package files require approximately the following disk space Requirements when decompressed:

MAC2ZIPA.EXE 6 MB MAC2ZIPB.EXE 4 MB FGR-DCF.EXE 2 MB COMIDA2A.EXE 3 MB IDCF 2.EXE 2 MB DOSFAC 2.EXE 4 MB COMIDA2B.EXE 3 MB.

Approximately 30 MB of hard disk space is required to load the. complete MACCS2 package. Approximately 11 MB of hard disk space is required to load MACCS2 without the preprocessors included in the MACCS2 package.

Computer Software The MACCS2 software was developed in a DOS environment. Lahey.F77L-Requirements EM/32 Version 5.2 compiler was used to create the executables included in the code transmittal package from RSICC, which run successfully in a DOS window of Windows 3. 1, Windows 95, Windows NT, and Windows 2000. The programs can also be compiled for those PC operating systems with the Microsoft Powerstation FORTRAN 1.Oa co'rnpiler. The distributed executables will not run under Windows XP. However, upon request, the code developer will supply executables for Windows XP that were compiled using Compaci FORTRAN 95.

,2 3 Typical PRA calculations often apply a 1000-mile radius basis.

2-5

}

MACCS2 Guidance Report June 2004 Final Report Table 2-1. Summary Description of MACCS2 Software (Continued)

Other Versions MACCS 1.5.11.1 (PC486); MACCS 1.5.11.0 (IBM RISC);

Available Version 1.13.1 was released in March 2004 to RSICC for distribution. See Appendix F for "readme" text file notes.

2-6

MACCS2 Guidance Report June 2004 Final Report 6.0 SOFTWARE LIMITATIONS Radiological dispersion and consequence computer software that is based on the Gaussian plume model is generally limited to certain domains of applicability. Initially, this section will highlight the general regime for which the Gaussian model provides a reasonable estimate of the behavior of radioactive releases into the atmosphere. Next, code specific issues shall be-discussed for both MACCS and MACCS2.

Table'6-1 lists several of the primary limitations of the Gaussian model with respect to its use in accident analysis.

Table 6-1. Limitations of Gaussian Plume Model in MACCS2 and MACCS Topic Applicable Regime*,i Basis Sour~ce'or Referience Distance from 100 m < x < 10 km - Dispersion parameterization (Haugen, 1959); Other Source 20 km accounts of Prairie Grass experiments; Sensible Energy Well-defined (e.g., Point-wise (stack) or pool- Briggs (1975); Mills (1987) sensible heat, timing, type (area) release certainty of radiological release with combustibles) releases Release Duration Approximately three Dependent on basis NUREG/CR-455 1; Tadmor minutes to ten'hours dispersion parameters (1969); Gifford (1975)

Terrain Flat-earth to "gently Adjust dispersion parameter AMS (1977);

Sensitivity rolling" set to region of interest with (Hanna, 1982);.

AMS model; Complicated Hanna (2002);

terrain over'the region of Others transport may require Lagrangian particle or other models Building wake Within approximately See discussion beginning Turner (1970) effects ten x characteristic page A-29 of this report.

building dimension lengths 6.1 Code-Specific Issues This section summarizes MACCS (6.1.1) and MACCS2 (6.1.2) software limitations in terms of past occurrences of errors and defects in various versions of the code. The last section (6.2) summarizes the gap analysis, i.e., evaluation of MACCS2 against defined software standards.

6 K

MACCS2 Guidance Report June 2004 Final Report 6.1.1 Issues Associated with MACCS During the, use of MACCS 1.5.11 by different organizations for various reactor and non-reactor applications,12 errors were discovered in the code. These errors prompted the issuance of a maintenance version of the MACCS code (i.e. version 1.5.11.1). The changes in the original MACCS source code were independently verified (Chanin, 1993) before the new source code (MACCS, Version 1.5.11.1) was released in 1993. In addition to the correction of errors in the original MACCS code, the MACCS, Version 1.5.11.1 distribution package included executables for several operating systems in addition to the original VAX/VMS system.

Although the aforementioned changes had a small impact on the results, the maintenance version of MACCS has an additional cancer fatality model. The older model is a linear quadratic equation based on BEIR III cancer model. The newer model is a discontinuous linear equation, based on review of the BEIR V cancer models in a report (LMF-132) prepared by the Lovelace Inhalation and Toxicology Research Institute (ITRI) (Chanin, 1993). This cancer model was the only one for cancer estimates distributed with MACCS. The discontinuity between 1) low doses at low dose rates and 2) higher doses or high dose rates remained in the post-BEIR-V cancer risk model of ICRP 60 (1991). MACCS2 includes data for the use of both olderand newer cancer models, but the use of the more recent ICRP 60 cancer risk model is recommended for DOE applications.

Since the issuance of the maintenance version of MACCS, several errors have been catalogued.

The errors and additional enhancements have been corrected in MACCS2 (RSICC, 1997). Table 6-2 lists enhancements and corrections. It should be pointed out that except in one case, i.e.,

groundshine from criticality source terms (item #5), there is no impact to dose calculations performed in support of DSA from these modifications.

K!

12 _ The MACCS code is used for PSA studies and facility licensing throughout the United States and abroad by both commercial and government 0rganizatlons 6-2

MACCS2 Guidance Report June 2004 Final Report Table 6-2. Code Modifications to MACCS2 and Impact to DSA Calculation (See Pages 3-9 through 3-16 of RSICC (1997))

Error/Enhancement Action Impact to DSA MOI Dose Analysis"

1. Dose-Dependent Reduction Corrected EARLY module for error to Cancer risks are not Factor Implementation Error cancer risk estimates. Did not affect calculated for DSAs -

chronic, cancer risk calculations. No Impact

2. Number of People Exceeding This type of result is Dose Threshold not calculated for DSAs Subject coding error has been corrected in - No Impact

- Incorrect calculations when- MACCS2 ten results are requested for the number of people exceeding a dose threshold

- MACCS2 has automatic switch to

- Inability to Report Small exponential format (from fixed) to allow Values of Dose Threshold reporting of dose thresholds < 0.0005 Sv (50 mrem)

3. Incomplete Implementation Corrections, made in MACCS2 only: Intermediate and long-of the Intermediate Phase term phases are not

- Corrected dose data'stored for calculated for DSAs -

- health effects and collective intermediate phase No Impact doses Mitigativeactions are based upon

- lack of interaction between, intermediate phase results.

intermediate phase relocation and farm interdiction

4. Summation of Early and MACCS2 improved to report emergency Evacuation and Intermediate Phase Costs and intermediate phase costs due to relocation costs are not evacuation and relocation separately considered in DSAs -

No Impact

5. Dose Calculations for Groundshine following plume passage was Potentially important Groundshine Following Plume calculated by interpolating and for criticality (short Passage . extrapolating doses based on 8-hour and I - half-life radionuclides),

week DCFs (MACCS). MACCS2 performs but groundshine dose exact numerical integration. component is usually small - Minor Impact 6-3

MACCS2 Guidance Report . .-! - June 2004 Final Report Table 6-2. Code Modifications to MACCS2 and Impact to DSA Calculation (Continued)

Error/Enhancement Action Impact to DSA MOI Dose Analysis

6. Nonprintable characters in site MACCS query of population counts and other Does not affect data file and FORTRAN Source information in site data file may lead to code MACCS non Code crash due to suspected nonprintable ASCII debugging runs -

characters or control codes in the file. No Impact to DSA MACCS2 has eliminated this factor. calculations

7. Minor Changes to Input and MACCS2 improved to allow: Useful for some Output DSA calculations,

- 9 9 9 th quantile changed to show 99.5 but most DSA quantile per NRC Reg. Guide 1.145 results will focus on 95h percentile, Variable DLBCST in CHRONC no longer direction allowed to have $0 cost for decontamination, independent to avoid potential division by zero errors. results.

The decontamination factor cost issue is not applicable to DSA calculations.

- No Impact Overall.

6-4

MACCS2 Guidance Report' June 2004 Final Report 6.1.2 Issues Associated with MACCS2 A Sandia National Laboratories SQA program was implemented in 1992. The SNL guidelines"3 (SNL, 1987; SNL, 1995; SNL, 1986; SNL, 1992; and SNL, 1989) followed the methodology established by IEEE software standards (IEEE, 1984). Of the five primary SNL software guideline volumes, two 14 were published after the completion of the original MACCS code. These documents demonstrate the development of the code was performed in a systematic way with each step thoroughly reviewed before the next step was taken. The other three volumes15 were published during the development phase of the MACCS code and were in place before the beginning of the MACCS2 development. Although the guidelines were published after the completion of the MACCS code, the MACCS development followed a systematic method as did error reporting and correction processes associated with the code.

In the initial code development for MACCS2 the same systematic process was followed. A project plan was prepared as were draft versions of a development plan for the food model and for the inclusion of the new dose conversion factors. In addition, a draft test plan was developed. The draft test plan was followed through MACCS2 Version 1.02. However, the plans were never finalized and a formal SQA plan was not put into place.

13 The SNL documentation is clearly described as guidance. The management directing the project may choose not to follow any part, or all, of the recommendations outlined in the guidelines.

14 The two volumes published after the beginning of the MACCS2 development'were the' Documentation volume and the Configuration Management volume. The Documentation volume (SNL, 1995) presents a description of documents needed for developing, maintaining, and defining software projects. The Configuration Management volume (SNL, 1992) presents a discussion of configuration management objectives and approaches throughoutthe software live cycle for software projects at SNL.

15 The three volumes published before the beginning of the MACCS2 development were Software Quality Planning volume, Standards, Practices, and Conventions volume, and Tools, Techniques, and Methodologies volume. The Software Quality Planning volume (SNL, 1987) presents an overview of procedures designed to ensure software quality. The Standards, Practices, and Conventions volume (SNL, 1986) presents standards and practices for developing and maintaining quality software at SNL and includes a description of the documents needed for a complete SQA package at SNL. The Tools, Techniques, and Methodologies volume (SNL, 1989) presents evaluations and a directory of software tools and methodologies available to SNL personnel.

6-5

MACCS2 Guidance Report June 2004 Final Report In addition to early testing of the MACCS2 code by in-house staff, SNL contracted the University of New Mexico (UNM) to independently test the code during development. This testing was published in a draft document (Summa, 1996). The report focused on the following areas:

ATMOS Module: Calculation of the downwind relative air concentration (X/Q) and of the diffusion parameters by using both the power law and the new look-up table methods EARLY Module: Calculation of the acute thyroid dose, of the network evacuation centerline dose, of the radial evacuation peak dose, of the crosswind evacuation dose, and the dose when the evacuation speed changes CHRONC Module: Testing of the ability to turn off the long-term phase and the decontamination model, comparison of intermediate phase and long-term phase doses, and calculation of the intermediate phase dose The testing by UMN was done in an iterative manner. Errors discovered by UNM resulted in coding changes and a newversion of the code. The new code version would then be retested by UNM for the function in question. This process would continue until the function worked correctly. The UNM testing did not include any of the preprocessors developed by SNL nor did it include the COMIDA food model developed at INEEL.

After the MACCS2 code was released, ,several new features of the MACCS2 code were verified against hand calculations at SRS (East 1997). These features were-the calculation of the CCDF for the atmospheric concentration, and the vertical and horizontal diffusion parameters in the ATMOS module and the reporting of the peak dose both independent and dependent of sector in the EARLY module. The module functions tested worked properly.

As part of the MACCS2 SQA program evaluation, a review of the code's documentation and source code was performed. From that review, a number of undocumented changes from MACCS to MACCS2 were found. Many of the changes were simply a change in the upper.

and/or lower bound of the input parameter. Many of those input parameter changes can be attributed to the UNM testing effort. However, that effort was never published.

After the MACCS2 code had been released to the Radiation Safety Information Computation Center (RSICC) at Oak Ridge for distribution, an error was found during routine calculations by the DOE Area Office at Los Alamos National Laboratory. 16 This error involved the source term 16 This coding error (affecting only source term looping), and essentiallythe same error in looping on emergency response scenarios, was corrected in a local version of MACCS2 developed for Pantex Plant. Also incorporated was the Mills (1987) pool-fire model for aircraft crash fires, in addition to a new capability for sampling for as many as ten years of weather data.

That Pantex version of MACCS2 underwent verification published by Hills et al. (1998).

6-6

MACCS2 Guidance Report June 2004 Final Report looping function that produced erroneous results when four release plumes were specified. The

-coding error was introduced when the total number of radionuclideswas increased from 825 to 900.17 When this coding change was made, the dimensions of the Variables associated with this change were properly increased, but the variables that were dependent on the changed variables were not modified. This led to a corruption of the data stored during each run and led to the subsequent erroneous results. See Appendix B for the Software Defect Notification.

In the interim before the completion of the MACCS2 backfit package, safety analysts using MACCS2 Version 1.12 should proceed with caution, using the guidance contained herein.

(Section 4). Alternatively, MACCS Version 1.5.11.1 can be applied with the appropriate dose conversion factor data, using the guidance provided in Appendix D of this report. 18 In either case, independent confirmation and peer review of technical products is advised. "Spot checks" of key consequence calculations using an independentcode calculation, or a set of spreadsheet or hand calculations, can frequently minimize or remove code result uncertainty while enhancing analyst confidence in code calculations 6.1.2.1 MACC2 Errors Not Important to DSA Calculations Other errors exist in MACCS2, but these are determined to be negligible in DSA calculations where MOI doses are being estimated. In the first case, SNL developers reported an error in the emergency preparedness model (described in Appendix B), but this option is not used in obtaining MOI dose estimates, and thus is deemed of no impact to DSA calculations.

A second error is found in the deterministic health effects model. Although latent cancer deaths and injuries arising from exposure to radioactive materials is the primary health concern in nuclear safety, deterministic health effects are also of interest in some contexts. Latent cancer is a long-term health problem (incidence in some cases up to 70 year after exposure) and arises from relatively small internal doses (primarily from inhalation of alpha emitters). Deterministic health effects (called "acute" or "early" in MACCS2), on the other hand, arise from relatively larger intakes. These health effects, such as pneumonitis, manifest within a shorter time after intake, from days to perhaps a few years, depending on the size of the dose and the organ affected. MACCS2 includes a model for these health effects but, unfortunately, they are not calculated correctly.

The method used in MACCS2 to evaluate deterministic health effects is based on the model(s) given in a series of NUREG/CR-4214 reports (e.g., Abrahamson 1993). The equations in MACCS2 are correct, for most part, but their implementation is not. The issue is complex and 17 This is the number of available radionuclides in the Dose Conversion Factor database.

MACCS2, is still limited to 150 radionuclides per execution.

18 At the issuance. of this report, Version 113.1 has been released, correcting the source-term "looping" errors. See Appendix F for additional detail.

6-7

MACCS2 Guidance Report June 2004 Final Report will not be discussed fully here. Briefly, there is, some confusion in the 'Useof absorbed dose vs.

adjusted dose (which has the RBE applied). For example, the LD5 0 and ED5 0 values used in MACCS2 are based on low-LET radiation, for which absorbed dose and adjusted dose are the.

same. However, for high-LET radiation (such as alpha emitters), the LD5 0 and ED' 0 should be based on adjusted dose, not absorbed dose. The calculatidns also need to account for the uncertainties in the parameters in the equations, and in differences in parameter values between low-LET and high-LET. In addition, the period for the effect to manifest is restricted to one year, whereas it should be at least five years. A technique has been published that correctly models these effects (Scott, 2003). Comparisons of calculations using the new technique with those from the MACCS2 code shows that MACCS2 overestimates the doses required to produce the deterministic health effects. A minor error is in the use of units: deterministic doses are measured in Gray, not Sievert. The latter should be used only for stochastic effects (cancer).

Another minor error is including pneumonitis in the list of "acute injuries", whereas it is almost always fatal..

It should be noted, however, that although DSA accident analyses must include calculations of doses, calculations of health effects are not required. Therefore, the errors noted here are not relevant for DSA analyses.

In the interim before the completion of the MACCS2 upgrades and improvements, safety analysts using MACCS2 Version 1.12 should proceed with caution, using the guidance contained herein (Section 4). Alternatively, MACCS Version 1.5.11.1 can be applied with the appropriate dose conversion/ factor data, using the guidance provided in Appendix D of this report.

In either case, independent confirmation and peer review of technical products is advised. "Spot checks" of key consequence calculations using an independent code calculation, or a set of spreadsheet or hand calculations, can frequently minimize or remove code result uncertainty.

• 6.2 Outcome of Gap Analysis The gap analysis for Version 1.12 of the MACCS2 software, based on requirements and criteria compliant with NQA-1 and 10 CFR-830, as contained in DOE (2003e), has been documented in the report, Software Quality Assurance Improvement Plan: MACCS2 Gap Analysis, (DOE, 2004). It was determined that MACCS2 code does meet its intended function for use in supporting documented safety analysis. However, as with all safety-related software, users should be aware of current limitations and capabilities of MACCS2 for supporting safety analysis. Informed use of the software can be assisted by the current set of MACCS2 reports, as well as the present report. Furthermore, while SQA improvement actions are recommended for MACCS2, no evidence has been found of programming, logic, or other types of software errors in MACCS2 that have led to non-conservatisms in nuclear facility operations, or in the_

identification of facility controls.

Of the ten primary SQA requirements for existing software at the Level B classification (important for safety analysis but whose output is not applied without further review), two 6-8

MACCS2 Guidance Report June 2004 Final Report requirements are met at an acceptable level, i.e., Classification(1) and User Instructions (7). A third requirement, ErrorNotification and CorrectiveAction (10), is partially met. Improvement actions are recommended for MACCS2 to fully meet requirement (10) criteria, and the remaining seven requirements, and these are listed in Table 6-3. This evaluation outcome is deemed acceptable because- (1) MACCS2 is used as.a tool, and as such its output is applied in safety analysis only after appropriate technical review; (2) User-specified inputs are chosen at a reasonably conservative level of confidence; and (3) Use of MACCS2 is limited to those analytic applications for which the software is intended.

By order of priority, it is recommended that the following MACCS2 software improvement actions be taken:

1. correct known defects

2. upgrade user technical support activities

3. provide training on a regular basis, and 4:. revise software documentation.

Performing these four primary actions should satisfactorily improve the SQA compliance status of MACCS2 relative to the primary evaluation criteria cited in this report.

A new software baseline set of documents is recommended for MACCS2 to demonstrate completion of item 4 (above), revise software documentation. The list of baseline documents for revision includes:

1. Software Quality Assurance Plan

2. Software Model Description,, including, but not limited to,

a. Software Requirements

b. Software Design

3. User's Manual, including, but not limited to,

a. User Instructions

b. Test Case Description and Report

c. Software Configuration and Control

4. Error Notification and Corrective Action Procedure.

Additionally, user documentation should be augmented to include error diagnostic advice and suggested input files for prototypic nuclear facility safety analysis problem types.

Approximately two full-time equivalent years is conservatively estimated to upgrade MACCS2 software to be compliant with NQA-l-based requirements for existing software. While most of this effort is logically to be used by the code developer, independent review of the end products is necessary.

A new version of MACCS2, Version 1.13, has recently been released. It is recommended that this version be evaluated relative, to the software improvement and baseline document recommendations, As well as the full set of SQA criteria discussed in the gap analysis report. If this version is found to be satisfactory, it should replace Version 1.12 as the designated version of the software for the toolbox.

6-9

MACCS2 Guidance Report - June 2004, Final Report It is recommended that MACCS2 user training for DOE safety analysis applications be conducted formally on, at minimum, an annual basis. Prerequisites for, and core knowledge needed by, the user prior to initiating MACCS2 applications should be documented by the code developer.

Approximately one FTE-month per year would be needed to maintain a web-based error notification and corrective action process for MACCS2. However, such a process has not been defined in depth for MACCS2 and the other designated toolbox codes.

6-10

MACCS2 Guidance Report June 2004 Final Report Table 6-3. Summary of Improvement Actions Identified in the Gap Analysis No. Criterion Reason Not Met Remedial Action(s)

• {*Sectionsrefer

. to0discussion in - .

- .. DOE (2004)} .- . * .

I SQA Earlier versions of MACCS (version As part of the new software baseline, the Procedures/Plans 1.5.11.1 and older) followed SNL SQA Plan covering version 1.12 and software engineering guidance. successor versions of MACCS2 should be i 4 addressed as a stand-alone report or as part Although initially followed, SNL of another SQA procedures document.

that provide Any new SQA prescriptive SQA Plan and*Procedures for Version guidance to the MACCS2 software 1.12 of MACCS2 software were not developers should be made available to a explicitly followed.* SQA evaluator for confirmatory review.

- Document a written and approved SQA plan eliminating draft or non-compliant informal process of development.

Upgrade SQA"program documentation, especially those procedures used for new features added in MACCS2.

2. Requirements Software Requirements documents for As part of the new software baseline for Phase Version 1.12 of MACCS2 software, MACCS2, a concise listing of the software although filed for a 3 - 4 year period, requirements should be documented. This

• (Section 4.3) were not maintained. Consequently a can be reported as a stand-alone Software

• S4 Software Requirements Document Requirements report, or as part of another was never completed. MACCS2-specific document. Specific MACCS2 requirements need to be documented. Those from MACCS may be added to supplement the MACCS2 information, but are not as critical. In

• contrast, some MACCS-attributes are no longer present in the code, and it would facilitate understanding of the current code requirements to know which ones have been deleted.

3. Design Phase A Software Design Document was not As part of the new software baseline for made available for the gap analysis. MACCS2, software design information

• (Section 4.4) Thus, design information was not should be provided. This can be reported as

• directly available. Instead, it was a stand-alone report, or as partof another-necessary to infer the intent of MACCS2-specific document, such as the MACCS2 design from incomplete model description report.

model description and user guidance documents, some of which address MACCS, not MACCS2.

6-11

MACCS2 Guidance Report June2004 Final Report No. Criterioio, -Reason Not Met Remedial Action(s)

{*Sections refer in .to.discussion

4. Implementation Written documentation on - No action needed at this time. The gap Phase implementation of Version 1.12 was analysis inferred from other documentation not produced for MACCS2. that source code and other software

• (Section 4.5) elements were finalized prior to transmittal of the code to RSICC.

5. Testing Phase A Software Testing Report Document A test document was prepared by the has not been produced for MACCS2, University of New Mexico (Summa, 1996),.

and therefore, test process and but never approved. As part of the new

• (Section 4.6) methodology could not be evaluated software baseline for MACCS2, this report directly. Thus, testing process and should be finalized.

methods had to be inferred from other information. A draft validation study.

has never been published.

As part of the new software baseline for

6. Acceptance Test An Acceptance Test protocol was not MACCS2, an acceptance-test process should provided to the gap analysis. No be documented: This instruction can be hsisrcincnb documentation exists that indicates b ouetd

• (Section 4d8) how the code developers tested the made part of an upgraded User's Guide, and 4tcode dproceduralized in the installation files provided by RSICC or SNL.

There is no known formal procedure to assure that an installed version of MACCS2 is working properly.

7. Configuration A MACCS2 Configuration and It is recommended that a full-scope Control Control document was not provided Software Corifiguration and Control for the gap analysis, despite indication document be issued as part of the new that a configuration control system software baseline. If this document has

• (Section 4.9) was in place for MACCS2. Files to been generated, then it should be made support this area were not maintained, available for review.

8. Error Notification An Error Notification and Corrective While a Software Problem Reporting Action Report process is in place at system is apparently functional at SNL,

• (Section 4.10) SNL, but limited documentation was provided. written documentation to demonstrate should be provided its effectiveness.

6-12