ML11355A192
| ML11355A192 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 12/21/2011 |
| From: | - No Known Affiliation |
| To: | Atomic Safety and Licensing Board Panel |
| SECY RAS | |
| Shared Package | |
| ML11355A177 | List: |
| References | |
| RAS 21594, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01, NUREG-1150 V1 | |
| Download: ML11355A192 (199) | |
Text
9. Accident Progression In addition to potentially producing missiles and shock waves, steam explosions can also rapidly generate large quantities of steam and hydrogen.
The steam produced from molten fuel-coolant in-teractions ex-vessel following vessel breach is an important contributor to the static drywell over-pressure failure in the Grand Gulf and Peach Bot-tom plants.
Gradual Overpressurization Figure 9. 9 illustrates the assessed pressure capa-bility for the five plants analyzed. The ability of a containment to withstand the production of gases in a severe accident depends on the volume of the containment as well as its failure pressure. One of the principal sources of pressurization in a severe accident is steam production. In each plant de-sign, however, engineered safety features are pre-sent to condense steam in the form of suppression pools, ice beds, sprays, air coolers, or in some de-signs, combinations of these systems. Steam pres-surization is only a major contributor to the total pressure if, in the scenario being analyzed, the heat removal system has become inoperative; e.g.,
the spray system has failed, the suppression pool has become saturated, or the ice has melted.
Large quantities of hydrogen are predicted to be released in severe accidents, both in-vessel during the melting phase and ex-vessel during core-concrete attack, debris bed quenching, or high-pressure melt ejection. If the hydrogen does not burn, it will contribute to the containment pres-sure. Carbon monoxide and carbon dioxide pro-duced during core-concrete attack also contribute to containment pressurization.
Because of its relatively small volume, the Peach Bottom (Mark I) design is more vulnerable to overpressurization failure by noncondensible gas generation. If the accident progression proceeds to vessel penetration and the molten core attacks the concrete, it is unlikely that containment integ-rity can be maintained in the long term unless other factors mitigate gas production.
Overheating The effect of high temperature in the drywell on containment failure probability and mode was considered in the Peach Bottom analysis. Al-though very high gas temperatures can be achieved as the result of hydrogen combustion in the other plant designs, the structure temperatures are not predicted to reach temperatures at which the strength of the structure would be substantially reduced or sealant materials would be degraded.
NUREG-1150 The Peach Bottom drywell, however, is relatively small. Substantial convective and radiative heat transfer from hot core debris could result in very high drywell wall temperatures. Failure could re-
- suit from the combination of high pressure in the drywell and decreased strength of the steel con-tainment wall. Overheating the drywell is only a contributor to scenarios in which the drywell spray is inoperative. If the sprays are operational, the drywell temperature will be much lower than for the dry case.
Drywell heating in the Peach Bottom plant repre-sents a delayed containment failure mechanism.
Since the likelihood of early failure by other mechanisms is high, drywell overtemperature fail-ure is not a substantial contributor to risk.
Loss of Vessel Support In the earlier section on steam explosions, a mechanism was described for drywell failure in the BWR designs in which structural failure of the reactor pedestal results in vessel motion (tipping or falling) and the tearout of piping penetrations through the drywell wall. Quasistatic pressuriza-tion of the pedestal region can result in the same phenomenon. Erosion of the pedestal by molten core attack of the concrete can also lead to the same effect. In this event, however, considerable time is required for the erosion to occur, and the failure would be late and the importance to risk is diminished. The likelihood of this mechanism of failure is generally small for the BWRs analyzed, in part because other mechanisms are likely to re-sult in failure earlier in the accident.
Basemat Meltthrough For each of the five plants analyzed, some poten-tial exists for core debris to be quenched as a par-ticulate debris bed and cooled in the reactor cav-ity or pedestal region if a continuous source of water is available. A significant likelihood exists, however, that, even if a replenishable water sup-ply is available, molten core debris will attack the concrete basemat. If the core-concrete interaction does occur, the presence or absence of an over-laying water pool is not expected to have much effect on the downward progression of the melt front.
9-16 The depth of the basemat of the Peach Bottom containment, directly under the vessel, is so great that it is unlikely that the basemat would be pene-trated before the occurrence of other failure modes. For the other plants, basemat penetration is possible, but the projected consequences are minor in comparison with those of aboveground failures.
OAGI0000611 00219 NYS00252B Submitted: December 21, 2011
- 9. Accident Progression Cumulative Failure Probability Zion 0.8 0.8 0.2 oL-~~=---~----~~==~~--------~----------L----------J 0
60 100 100 200 2110 Pressure (Psig)
Figure 9.9 Cumulative containment failure probability distribution for static pressurization (all plants).
9.4.3 Major Sources of Uncertainty The perspectives on the major sources of uncer-tainty described in this section come from four sources:
Regression analysis-based sensitivity analyses for the mean values for risk. Simple linear regression models were used to represent the complex risk models, and adequate results were obtained. Better results would require more complex regression models. Insights for this section are deduced from the risk regres-sion studies (regression analyses for condi-tional containment failure probabilities re-quired for more detailed accident progression insights were not performed). Results of these studies are presented in References 9. 2 through 9. 6.
Partial rank correlation analyses for the risk complementary cumulative distribution func-tions. Results of these studies are presented in References 9.2 through 9.6.
Sensitivity studies in which separate analyses were performed with certain parameter val-9-17 ues set to a specific value. Sensitivity studies were performed on the Mark I drywell shell meltthrough issue and the PWR RCS depres-surization scenarios. These studies were only performed for the accident progression analysis; no source term or consequence in-sights are available.
The subjective judgment of the analysts per-forming the plant-specific studies.
Importance of Accident Progression Analysis Variables to Rank Regression Analyses for Annual Risk The majority of the variables important to the rank regression analyses performed for Surry were the initiating event frequencies of the containment bypass events and the source term variables. The only accident progression event tree variable that was demonstrated to be important to the uncer-tainty in risk for internal events was the probabil-ity of vessel and containment breach by an in-vessel steam explosion; this variable was moderately important to the uncertainty in total early fatality risk (Ref. 9.2).
The regression analyses performed for Sequoyah showed the containment failure pressure and NUREG-1150 OAGI0000611 00220
- 9. Accident Progression loads at vessel breach to be accident progression variables somewhat important to the uncertainty in both total early fatality risk and total latent can-cer fatality risk (Ref. 9.4).
The probability of drywell meltthrough was the only *accident progression variable that was at all important to uncertainty in the early fatality risk or the latent cancer fatality risk for the internal regression analysis for Peach Bottom (Ref. 9.3).
The amount of hydrogen produced in-vessel, the probability of drywell failure following pedestal failure, the pressure load in the drywell at vessel breach, and the amount of hydrogen produced and released at and shortly after vessel breach were accident progression variables that were found to be important to the uncertainty in early fatality risk by the Grand Gulf regression analyses.
The probability of drywell failure following pedes-tal failure and the pressure load in the drywell at vessel breach were found to be important to the uncertainty in latent cancer fatality risk (Ref.
9.5).
The majority of variables important to the rank regression analyses performed for Zion were re-lated to failure or recovery of the component cooling water (CCW) system and the source term variables. The only accident progression event tree variable that was demonstrated to be impor-tant to the uncertainty in risk was the probability of vessel and containment breach by an in-vessel steam explosion. This result was also obtained from the Surry regression analyses. The probabil-ity of a steam explosion failure was found to be important to the uncertainty in both early and la-tent health risk measures at Zion. The importance of seal LOCA failure to risk uncertainty was ex-pected, given the large contribution of these events to the core damage frequency. Upgrades to the Zion service water and CCW systems have the potential to reduce the importance of these events as discussed in Appendix C (Section C.15) (Ref.
9.6).
Direct Attack of Drywell Shell in Peach Bottom The divergence of opinion of the panel of contain-ment performance experts, in itself, is an indica-tor of the uncertainty in the associated phenom-ena. A sensitivity study was performed to determine the impact on containment perform-ance of eliminating this failure mechanism. The mean early failure probability (averaged over all sequences) was reduced from 56 percent to 20 percent (Ref. 9.3).
NUREG-1150 9-18 High-Pressure Melt Ejection and Vessel Depressurization For the Surry and Zion plants, early containment failure resulting from loads at vessel breach is as-sessed to have low probability, on the order of 1 percent. Sensitivity studies were performed to determine the dependence of this result on expert judgments made about various reactor coolant sys-tem depressurization mechanisms prior to vessel breach. A sensitivity study was performed for Surry (Ref. 9. 2), which removed depressurization by temperature-induced breaks. This study indi-cated that removal of only temperature-induced failures for depressurization does not result in a significant increase in the likelihood of early con-tainment failure (from roughly 1 percent to roughly 2 percent). This probability study, there-fore, implies that other depressurization mecha-nisms, such as the failure of reactor coolant pump seals and stuck-open relief valves, are also impor-tant. However, a sensitivity study was also per-formed for Zion (Ref. 9.6) in which all depress-urization mechanisms were removed. The result of this study was a relatively small increase in the likelihood of early containment failure. For acci-dents initiated by LOCAs (which dominate the es-timated core damage frequency), this change re-sulted in essentially no change in the conditional probability of early containment failure. The probability of early failure increased by a factor of 5 for accidents initiated by transients (from roughly 0.01 to 0.06) and by a factor of 2 for ac-cidents initiated by station blackout (from roughly 0.03 to 0.06). The reason for the relatively small impact of removing all depressurization mecha-nisms on the probability of early containment fail-ure is that the Zion containment is expected to withstand high-pressure melt ejection loads (even at the upper end of the uncertainty range) with very high confidence (refer to Section C.S of Ap-pendix C for a more detailed discussion). Also, at these small probability levels, in-vessel steam ex-
- plosions contribute to the likelihood of early con-tainment failure. If the reactor coolant system pressure remains high, the likelihood of triggering a steam explosion is decreased. Thus, the slightly higher probability of early containment failure re-sulting from high-pressure melt ejection loads will be offset to some degree by the lower probability of containment failure from in-vessel steam explo-sions.
Uncertainties associated with high-pressure melt ejection also affect the early containment failure likelihood for the other three plants. The signifi-cance of this issue is greatest for the Sequoyah and Grand Gulf plants, which have lower over-pressure capacity and which are vulnerable to the OAGI0000611_00221
hydrogen produced in the oxidation of dispersed
. core debris by steam.
Containment Failure by Steam Explosions The production of missiles by in-vessel steam ex-plosions only appears as a significant contributor to early failure or bypass in the Zion analyses.
The contribution of alpha-mode containment fail-ure is the result of the very low probability of other modes of early failure or bypass and is itself a low value. Quasistatic and shock loading from an ex-vessel steam explosion is indicated to be a potentially important contributor to drywell failure for Grand Gulf. Ex-vessel steam explosions also contribute to quasistatic overpressurization failure in the Peach Bottom plant.
Core Melt Progression Many of the uncertain phenomena that have the potential to lead to early containment failure (e.g., high-pressure melt ejection, drywell shell at-9-19
- 9. Accident Progression tack, steam explosions, and hydrogen generation) are sensitive to the details of core melt progres-sion, particularly the later stages of progression in which molten core material enters the lower head of the vessel. The mass of material potentially available for dispersal at head failure, the compo-sition of this material, the timing of head failure, and the mode of head failure have a substantial indirect impact on the likelihood of early contain-ment failure through their effects on early failure mechanisms.
Containment Bypass The containment bypass sequences have been dis-cussed throughout this report as special scenarios (in which the containment function has failed) and will be briefly mentioned here. The contain-ment bypass initiating event frequencies, transmis-sion factors, and decontamination factors were demonstrated to be the variables most important to the uncertainty in all risk measures in both the Surry and Sequoyah rank regression analyses.
NUREG-1150 OAGI0000611 00222
- 9. Accident Progression REFERENCES FOR CHAPTER 9 9.1 M. Silberberg et al., "Reassessment of the Technical Bases for Estimating Source Terms," United States Nuclear Regulatory Commission (USNRC) Report NUREG-0956, July 1986.
9.2 R. J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREG/CR-4551, Vol.
3, Revision 1, SAND86-1309, October 1990.
9.3 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/
CR-4551, Vol.
4, Draft Revision 1,
SAND86-1309, to be published.*
9.4 J. J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, VoL 5, Revision 1, SAND86-1309, Decem-ber 1990.
- Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
NUREG-1150 9.5 T. D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," San-dia National Laboratories, NUREG/
CR-4551, Vol.
6, Draft Revision 1,
SAND86-1309, to be published.*
- 9. 6 C. K. Park et al., "Evaluation of Severe Accident Risks:
Zion Unit 1,"
Brook-haven National Laboratory, NUREG/
CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.*
- 9. 7 USNRC, "Reactor Safety Study-An Assess-ment of Accident Risks in U.S. Commercial Nuclear Power Plants,"
WASH-1400 (NUREG-75/014), October 1975.
9.8 R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios-PWR, Subatmospheric Contain-ment Design," Battelle Columbus Division, NUREG/CR-4624, Vol. 3, BMI-2139, July 1986.
9-20 9.9 USNRC, "Revised Severe Accident Re-search Program Plan: Fiscal Year 1990-1992," NUREG-1365, August 1989.
OAGI0000611 00223
- 10. PERSPECTIVES ON SEVERE ACCIDENT SOURCE TERMS 10.1 Introduction Shortly after the accident at Three Mile Island, the NRC initiated a program to review the ade-quacy of the methods available for predicting the magnitude of source terms for severe reactor acci-dents. After considerable effort and extensive peer review, the NRC published a report entitled "Reassessment of the Technical Bases for Estimat-ing Source Terms," NUREG-0956 (Ref. 10.1).
The report recommended that a set of integrated computer codes, the Source Term Code Package (STCP) (Ref. 10.2), be used as the state-of-the-art methodology. for source term analysis provided that uncertainties were considered. The STCP methodology provided a starting point for source term estimates in this study. In addition, the char-acterization of source term uncertainties was sup-ported by calculations with other system codes such as MELCOR (Ref. 10.3) and MAAP (Ref.
10.4), detailed special. purpose codes such as CONTAIN (Ref. 10.5), as well as small codes written for this project to examine specific source term phenomena. Because it was impractical to perform an STCP calculation for each source term required and the STCP does not contain models for all potentially important phenomena, simpli-fied methods of analysis were developed with ad-justable parameters that could be benchmarked against the more detailed codes. Probability distri-butions, which had been developed from the elicitations of the source term panel of experts, were provided for many of the parameters in the simplified computer codes. A large number of source term estimates were generated for each plant by sampling from the probability distribu-tions in the simplified codes.
Source terms are typically characterized by the fractions of the core inventory of radionuclides that are released to the environment, as well as the time and duration of the release, the size dis-tribution of the aerosols released, the elevation of the release, the warning time for evacuation, and the energy released with the radioactive material.
All these parameters are required for input to the MACCS (Ref. 10.6) consequence code. Although the illustrations and comparisons of source terms in this chapter emphasize the magnitude of esti-mated release, it is important to recognize that the other characteristics of the source term noted above, such as the timing of release, can also have an important effect on the ultimate consequences.
10-1 It is widely believed that the approximate treat-ment of source term phenomena in the Reactor Safety Study (RSS) (Ref. 10.7) analyses led to a substantial overestimation of severe accident con-sequences and risk. The current risk analyses pro-vide a basis for understanding the differences that exist in source terms calculated using the new methods relative to those calculated using the RSS methods and the impact of these differences on estimated risk.
10.2 Summary of Results Some examples of source terms (fractions of the core inventory of groups of radionuclides released to the environment) were provided for accident progression bins for each of the analyzed plants in Chapters 3 through 7. As expected, the magnitude of the source term varies between different acci-dent progression bins depending on whether or not containment fails, when it fails, and the effec-tiveness of engineered safety features (e.g., BWR suppression pool) in mitigating the release. How-ever. within an accident progression bin, which represents a specific set of accident progression events, the uncertainty in predicting severe acci-dent phenomena is great.
In Figure 10.1, the predicted frequency of radio-active releases is compared among the five plants.
In this figure, the mean distribution is presented, allowing differences in plant behavior to be illus-trated. The y-coordinate in the figure represents the predicted frequency with which a given magni-tude of release (the x-coordinate) would be ex-ceeded. The location of the exceedance curve is determined by the frequencies of accident se-quences in addition to the spectrum of possible source terms for those sequences.
It is not obvious in examining a radionuclide source term what the potential health impact would be to the public from a specified magnitude of release. Based on the compilation of a number of consequence analyses, however, one method (Ref. 10.8) has been developed that provides an approximate relationship for the mmtmum fractions of radionuclides released that result in early fatalities or early injuries. For the release of iodine, for example, the thresholds for early fatalities and early injuries occur at release frac-tions of the core inventory of approximately 0.1 and 0.01, respectively. Figure 10.1 does not indi-cate major differences in the exceedance curves for the five plant analyses. For the iodine group, NUREG-1150 OAGI0000611 00224
- 10. Severe Accident Source Terms Frequency of R > R* (yr-1) 1.0Eoo()3 =---=-----=-------....;,:.------------------~
Iodine Group 1.0Eoo()7 1.0Eoo()8 Surry Zion Sequoyab Peaeb Bottom Grand Gulf
' {)
1.0Eoo()9 L.___jL-.L....JU...u.J..lL-..L....J....J.....L..U..uJ.--'---J..-LJ....L..uJ.L-___JL-1.-1..J...L.U.J.L-_J_-'--l.....l...Ll.J.U l.OE-IY.I 1.0E-Oi l.OE-03 l.OE-02 l.OE-01 l.OE+OO Release.Fraction Frequency of R > R*
(yr-1}
1.0Eoo()3 =---=----=-------....;,:.--------------------,
Cesium Group Surry Zion Sequoyab Peach Bottom
- 0-Grand Gulf
- ~
\\
\\
\\
l.OEoo()9 L.__L-.L....JU...LU.lL_..L..U....J.....L..U..ll.L _
_L.....J.-L.J....L.l..llL------J....JU...L.U.J.L-..L..-L...L...I-L..L.lll l.OE-0:1 l.OE-Oi l.OE-03 l.OE-02
!.OE-01 l.OE+OO Release Fraction Figure 10.1 Frequency of release for key radionuclide groups.
NUREG-1150 10-2 OAGI0000611_00225
- 10. Severe Accident Source Terms Frequency of R > R* (yr-1) l.OE-G3.,.---=----------_.;.:---------------~---,
l.OE-Gf l.OE-<1:1 l.OE-GG l.OE-<17 l.OE-<18 Strontium Group
- =;:;_:;;;~,~~~~~~"':~:,,
'0.
Surry Zion Sequoyab Peach Bottom Grand Cult l.OE-()9 l----L....l-LJU-lll---'-.J_..L...J.-l...l..!.ll--L--l.....L.L.LlJJ.L-.--lL-L....I...l...Lll.ll...-...L_...l...~~~
l.OE-0~
l.OE-Of J.OE-03 l.OE-02 l.OE-01 l.OE+OO Release Fraction Frequency of R > R* (yr-1) l.OE-()3 c-_.::._ __
l.OE-<lf l.OE-<1:1 l.OE-GG l.OE-<17 l.OE-<16 Lanthanum Group
'0 Surry Zlon Sequoyah
- *- Peach Bottom Grand Cult l.OE-<19 L--'--.l-.l....LL.U.J.L..--'--1-.J...J..U.J.U_--l.--l....L..J..J...l.ll.l-.-L-.I-.li....L...u..t.U...--L--1-.J...J..U..L.U l.OE-0:1 l.OE-03 l.OE-01 J.OE+OO Release Fraction Figure 10.1 (Continued) 10-3 NUREG-1150 OAGI0000611 00226
- 10. Severe Accident Source Terms the frequency of exceeding a release fraction of 0.1 ranges from 1E-6 to 5E-6 per reactor year for the five plants. Similarly, for a release fraction of 0.01, the exceedance curves range from 2E-6 to 1E-5 per reactor year. The most outstanding fea-ture of these curves is their relative flatness over a wide range of release fractions. For the iodine, cesium, and strontium groups, the curves decrease only slightly over the range of release fractions from 1E-5 to 1E-1 and then fall rapidly from 0.1 to 1. For the lanthanum group, the rapid decrease in the curve occurs at a release fraction that is approximately a decade lower. As a result of the flatness of the exceedance curves, the frequency of accidents with source terms that are marginally capable of resulting in early fatalities is only slightly less than the frequency of accidents cover-ing a very broad spectrum of health consequences up to the occurrence of fatalities. However, the frequency of source terms with the potential for multiple early fatalities falls rapidly with increased release.
Based on the results of the source term analyses for the five plants, a number of general perspec-tives on severe accident source terms can be drawn:
The uncertainty in radionuclide source terms is large and represents a significant contribu-tion to the uncertainty in the absolute value of risk. The relative significance of source term uncertainties depends on the plant damage state.
Source terms for bypass sequences, such as accidents initiated by steam generator tube rupture (SGTR), can be quite large, poten-tially comparable to the largest Reactor Safety Study source terms.
Early containment failure by itself is not a re-lia~le indicator of the severity of severe acci-dem source terms. Substantial retention of radionuclides is predicted to occur in many of the early containment failure scenarios in the BWR pressure-suppression designs, par-ticularly for the in-vessel period of release during which radionuclides are transported to the suppression pool. Containment spray sys-tem and ice condenser decontamination can also substantially mitigate accident source terms.
Flooding of reactor cavities or pedestals can eliminate the core-concrete release of radio-nuclides, if a coolable debris bed is formed, or can significantly attenuate the release from NUREG-1150 the molten core-concrete interaction by scrubbing in the overlaying pool of water.
10.3 Comparison with Reactor Safety Study In the Reactor Safety Study (RSS) (Ref. 10. 7),
source terms were developed for nine release categories ("PWR1" to "PWR9") for the Surry plant and five release categories for the Peach Bottom plant ("BWR1" to "BWRS"). The RSS release categories are directly analogous to the ac-cidimt progression bins in the current study in that they are characterized by aspects of accident pro-gression and containment performance that affect the source term. For example, the PWR1 release category represented early containment failure re-sulting from an in-vessel steam explosion with containment sprays inoperative. A point estimate for release fractions (fraction of the core inven-tory of an elemental group released to the envi-ronment) for seven elemental groups (in the cur-rent study, the number of elemental groups has been expanded to nine) was then used to repre-sent this type of release.
In the current study, source terms were developed for a much larger number of accident progression bins. A distribution of release fractions was also obtained for each of the elemental groups corre-sponding to the individual sample members of the uncertainty analysis.
In order to simplify the presentation in this report, the results of similar accident progression bins have been aggregated to a level that is comparable to that used in the RSS. Figure 10.2 provides a comparison of an important large release category (PWR2) from the RSS for Surry with a compara-ble aggregation of accident progression bins (early containment failure, high reactor coolant system pressure) from the current study.* Also shown in Figure 10.2 is a low release category from the RSS (PWR7) with a comparable aggregation of ac-cident progression bins from the current study (late failure). No range is shown for the noble gas release for this study because no permanent reten-tion mechanisms were assumed to affect these gases. The point estimates of the release of radionuclides in the RSS early containment failure bin are more representative of the upper bounds
"'Because of the aggregation of accident progression bins, some of the range of the source terms represents variation in accident progression as well as modeling uncertainty.
The distribution was developed from all of the sample members within the aggregated bins without considera-tion of the relative frequencies of these bins.
10-4 OAGI0000611_00227
- 10. Severe Accident Source Terms Release Fraction 1.0E*oo~~--~~--------------------------------------,
6 OH mean Iliad ian 1.0E-02
~ RSS 1.0E-05 L-----------------------'
NG Cs Te Sr Ru La Ba Ce Elemental Group
- a. Comparison with Bin PWR2 Release Fraction 1.0E+OO=-----------------------------------------------.
1.0E-01 median 1.0E-02
~ RSS 1.0E-05 L--------f~--111-..-IJ.L--------------J NG Cs Te Sr Ru La Ba Ce Elemental Group
- b. Comparison with Bin PWR7 Figure 10.2 Comparison of source terms with Reactor Safety Study (Surry).
10-5 NUREG-1150 OAGI0000611_00228
- 10. Severe Accident Source Terms of the range in the current study than the mean or the median. For the late failure comparison, the results for this study are somewhat higher than those obtained for the RSS. The difference is re-lated to the types of failures in the late failure bin.
In the RSS, the PWR7 source terms were based on a release associated with meltthrough of the basemat in scenarios with containment sprays op-erable. The late failure bin in the current study also includes overpressure failure cases with a di-rect release from the plant to the atmosphere. Of particular significance is the nontrivial release of iodine that is associated with late release mecha-nisms, which were not considered in the RSS.
Figure 10.3 compares release fractions for an ag-gregation of early drywell failure accident progres-sion bins from the current study with the BWR2 and BWR3 release categories. In the current study, a range of reactor building decontamination factors is considered depending on the mode of drywell failure and variations in thermal-hydraulic conditions in the building. The BWR2 release fractions are at the upper bounds of the ranges in the current study, and the BWR3 releases are near the mean values.
The second example compares results for an isola-tipn failure in the wetwell region from the RSS, release category BWR4, with the venting accident progression bin from the current study. The RSS results are very similar to the mean release terms for the venting bin, with the exception of the io-dine group, which is higher because of the late release mechanisms (reevolution from the sup-pression pool and the reactor. vessel) considered in the current study.
Overall, the comparison indicates that the source terms in the RSS were in some instances higher and in other instances lower than those in the cur-rent study. For the early containment failure acci-dent progression bins that have the greatest im-pact on risk, however, the RSS source terms appear to be larger than the mean values of the current study and are typically at the upper bound of the uncertainty range.*
10.4 Perspectives 10.4.1 State of Methods The use of parametric source term methods, in which the parameters are fit to reproduce the re-suits of more mechanistic codes, was found to be a practical necessity in performing a PRA that in-cludes a complete treatment of phenomenological uncertainties. Research is in progress in some of the key areas of uncertainty that influence source term results. In a number of cases, the STCP did not have models that represent potentially impor-tant phenomena, such as revaporization from re-actor coolant system surfaces and reevolution of iodine from water pools. Later codes, such as MELCOR (Ref. 10.3), which have at least rudi-mentary models for these processes, should pro-vide greater assurance of consistency in the analy-sis. These advanced codes may not, however, remove the need for parametric codes capable of performing a large number of analyses inexpen-sively.
Improvement in Understanding Since the Reactor Safety Study (RSS), substantial improvements have been made in understanding severe accident processes and source term phe-nomena. A major shortcoming of the RSS was the limited treatment of the uncertainties in severe ac-cident source terms. In the intervening years, par-ticularly subsequent to the Three Mile Island acci-dent, major experimental and code development efforts have broadly explored severe accident be-havior. In this study, care has been taken to dis-play the assessed uncertainties associated with the analysis of accident source terms. Many of these-vere accident issues that are now recognized as the greatest sources of uncertainty were com-pletely unknown to the RSS analysts 15 years ago.
10.4.2 Important Design Features In Chapter 9, performance of the containments of the five plants was described with respect to the timing of the onset of containment failure and the magnitude of leakage to the environment. In par-ticular, the likelihood of early containment failure was used as a measure of containment perform-ance. Environmental source terms are Mfected by more than just the mode and timing of contain-ment failure, however. The following paragraphs describe the effect of different safety systems and
- plant features on the magnitude of source terms.
Suppression Pools
- Additional comparisons with the Reactor Safety Study Suppression pools can be very effective in the re-may be found in Reference 10.9.
moval of radionuclides in the form of aerosols or NUREG-1150 10-6 OAGI0000611 00229
- 10. Severe Accident Source Terms Release Fraction 1.0E+OO u D
116'11 r-mun 1.0E-01
~
.r-m*<!lan r-r-
A t:...
15'.1.
~
1-
~-
.6. RSS 1.0E-03 § 1-1.0E-04 1.0E-05
-IY
~
NG Cs Te Sr Ru La Ba Ce Elemental Group
- a. Comparison with Bins BWR2 and BWR3 Release Fraction 1.0E+OO
~ ~
116'11 mun 1.0E-01 § median 1-1.0E-02 § 1-Ui 1-t-
.6. RSS 1.0E-03 § r-f-
1.0E-04 E l-\\
It'
-~
NG Cs Te Sr Ru La Ba Ce Elemental Group
- b. Comparison with Bin BWR4 Figure 10.3 Comparison of source terms with Reactor Safety Study (Peach Bottom).
10-7 NUREG-1150 OAGI0000611 00230
- 10. Severe Accident Source Terms soluble vapors. Some of the most important radionuclides, such as isotopes of iodine, cesium, and tellurium, are primarily released from fuel during the in-vessel release period. Because risk-dominant accident sequences in BWRs typically involve transient sequences rather than pipe breaks, the in-vessel release is directed to the sup-pression pool rather than being released to the drywell. As a result, the in-vessel release is sub-jected to scrubbing in the suppression pool, even if containment failure has already occurred. For the Peach Bottom plant, de.contamination factors used in this study for scrubbing the in-vessel com-ponent ranged from approximately 1.2 to 4000, with a median value of 80. Since the early release of volatile radioactive material is typically the ma-jor contributor to early health effects, the effect of the suppression pool in depressing this component of the release is one of the reasons the likelihood of early fatalities is so low for the BWR designs analyzed.
Depending on the timing and location of contain-ment failure, the suppression pool may also be ef-fective in scrubbing the release occurring during core-concrete attack or reevolved from the reac-tor coolant system after vessel failure. In the Peach Bottom analyses, containment failure was found to be likely to occur in the drywell early in the accident. Thus, in many scenarios the sup-pression pool was not effective in mitigating the delayed release of radioactive material. Similarly, in the Grand Gulf design, drywell failure accom-panied containment failure in approximately one-half the early containment failure scenarios ana-lyzed. As a result, the suppression pool was found to be ineffective in mitigating ex-vessel releases in a substantial fraction of the scenarios for both BWR plants analyzed.
Although the decontamination factors for suppres-sion pools are typically large, radioactive iodine captured in the pool will not necessarily remain there. Reevolution of iodine was found to be im-portant in accident scenarios in which the contain-ment has failed and the suppression pool is boil-ing.
Containment Sprays If given adequate time, containment sprays can also be effective in reducing airborne concentra-tions of radioactive aerosols and vapors. In the Surry (subatmospheric) and Zion (large, dry) de-signs, approximately 20 percent of core meltdown sequences were predicted to eventually result in delayed failure or basemat meltthrough. The ef-fect of sprays, in those scenarios in which they are NUREG-1150 operational for an extended time, is to reduce the concentration of radioactive aerosols.airborne in the containment to negligible levels in comparison with non-aerosol radionuclides (e.g., noble gases) with respect to potential radiological effects. For shorter periods of operation, sprays would be less effective but can still have a substantial mitigative effect on the release.
The Sequoyah (ice condenser) design has con-tainment sprays for the purpose of condensing steam that might bypass the ice bed, as well as for use after the ice has melted. The effects of the sprays and ice beds in removing radioactive mate-rial are not completely independent since they both tend to remove larger aerosols preferentially.
In the Peach Bottom plant, drywell sprays can be operated in sequences in which ac power is avail-able. Scrubbing of radioactive material released from fuel during core-concrete attack can be ac-complished by a water layer developed on the drywell floor, as well as by the spray droplets.
Containment spray operation in Grand Gulf is most important for scenarios in which both the containment and drywell have failed. In the short-term station blackout plant damage state, power recovery that is too late to arrest core damage can still be important for the operation of containment sprays and the mitigation of the extended period of ex-vessel release from fuel.
Ice Condenser The ice beds in an ice condenser containment re-move radioactive material from the air by proc-esses that are very similar to those in the BWR pressure-suppression pools. The decontamination factor is very sensitive to the volume fraction of steam in the flowing gas, which in turn depends on whether the air-return fans are operational. For a typical case with the air-return fans on, the magni-tude of the decontamination factors was assessed to be in the range from 1.2 to 20, with a median value of 3. Thus, the effectiveness of the ice bed in mitigating the release of radioactive material is likely to be substantially less than for a BWR sup-pression pooL Drywell-Wetwell Configuration The Mark III design has the apparent advantage, relative to the Mark I and Mark II designs, of the wetwell boundary completely enclosing the dry-well, in effect providing a double barrier to radio-active material release. As long as the drywell remains intact, any release of radioactive material from the fuel would be subject to decontamination by the suppression pool. For this reason, failure 10-8 OAGI0000611 00231
of the Mark III containment is not as important to severe accident risk as the potential for containment failure in combination with drywell failure. Figures 6.5 and 6.6 illustrate the differ-ence in the environmental source terms for the early containment failure bins with and without drywell failure. With the drywell intact, the envi-ronmental source term is reduced to a level at which early fatalities would not be expected to oc-cur, even for eariy failure of the outer contain-ment. The potential advantages of the drywell-wetwell configuration were found to be limited in this study by the significant probability of drywell failure in an accident.
Cavity Flooding The configuration of PWR reactor cavity or BWR pedestal regions affects the likelihood of water ac-cumulation and water depth below the reactor vessel. The Surry reactor -cavity is not connected by a flowpath to the containment floor. If the spray system is not operating, the cavity will be dry at vessel failure. In the Peach Bottom (Mark I) design, there is a maximum water depth of ap-proximately 2 feet on the pedestal and drywell floor before water would overflow into the downcomer. The other three designs investigated have substantially greater potential for water accu-mulation in the pedestal or cavity region. In the Sequoyah design, the water depth could be as much as 40 feet.
If a coolable debris bed is formed in the cavity or pedestal and makeup water is continuously supplied, core-concrete release of radioactive ma-terial would be avoided.
Even if molten core-concrete interaction occurs, a continuous overlaying pool of water can substantially reduce the release of radioactive material to the contain-ment.
Reactor Building/Auxiliary Building Retention Radionuclide retention was evaluated for the Peach Bottom reactor building, but an evaluation was not made for the portion of the reactor build-ing that surrounds the Grand Gulf containment, which was assessed to have little potential for re-tention. The range of decontamination factors for aerosols for the Peach Bottom reactor building subsequent to drywell rupture was 1.1' to 80 with a median value of 2.6. The location of drywell fail-ure affects the potential for reactor building de-contamination. Leakage past the drywell head to the refueling building was assumed to result in very little decontamination. Failure of the drywell by meltthrough resulted in a release that was sub-10-9
- 10. Severe Accident Source Terms jected to a decontamination factor of 1.3 to 90 with a median value of 4.
In the interfacing LOCA sequences in the PWRs, some retention of radionuclides was assumed. in the auxiliary building (in addition to water pool decontamination for submerged releases). In the Sequoyah analyses, retention was enhanced by the actuation of the fire spray system.
Containment Venting In the Peach Bottom (Mark I) and Grand Gulf (Mark Ill) designs, procedures have been imple-mented to intentionally vent the containment to avoid overpressure failure. By venting from the wetwell air space (in Peach Bottom) and from the containment (in Grand Gulf), assurance is pro-vided that, subsequent to core damage, the re-lease of radionuclides through the vent line will have been subjected to decontamination by the suppression pool.
As discussed in Chapter 8, containment venting to the outside can substantially improve the likeli-hood of recovery from a loss of decay heat re-moval plant damage state and, as a result, reduce the frequency of severe accidents. The results of this study indicate, however, only limited benefits in consequence mitigation for the existing proce-dures and hardware for venting. Uncertainties in the decontamination factor for the suppression pool and for the ex-vessel release and in the reevolution of iodine from the suppression pool are quite broad. As a result, the consequences of a vented release are not necessarily minor. Fur-thermore, the effectiveness of venting in the two plant designs is limited by the high likelihood of mechanisms leading to early containment failure, which would result in bypass of the vent.
- 10. 4.3 Important Phenomenological Uncertainties In order to identify the principal sources of uncer-tainties in the estimated risk, regression analyses were performed for each of the plant types in this study. In general, in these regression analyses, the dependent variable is.risk expressed in terms of consequences per year (e.g., early fatalities per year or latent cancer fatalities per year). For the Surry plant (Ref. 10.10), however, additional re-gression analyses were performed in which the de-pendent variable is the quantity of release per year for each of the radionuclide groups. These analy-ses are particularly useful in investigating how un-certainties in source term variables affect the re-leases of different radionuclides. Also determined were partial correlation coefficients that represent NUREG-1150 OAGI0000611 00232
- 10. Severe Accident Source Terms the importance of uncertain variables as a func-tion of the magnitude of the environmental re-lease.
Relative Importance of Source Term Variables The results of these regression analyses indicate that uncertainties in source term variables are im-portant contributors to the uncertainties in risk but are often not the largest contributors. The relative contribution of uncertainties in source term variables depends on the characteristics of each plant damage state as illustrated in the Peach Bottom and Sequoyah regression analyses (Refs.
10.11 and 10.12). In general, the five plant analy-ses indicate that the importance of the aggregate of variables that affect release frequencies (acci-dent frequency variables and accident progression variables) is similar to or greater than the impor-tance of the aggregate of variables that affect source term magnitude.
Source term variables tend to have less impor-tance to the uncertainty in latent cancer fatality (or population dose) risk than to the risk of early fatalities. Because of the threshold nature of early fatalities, these risk results are particularly sensi-tive to pessimistic values of source term variables.
Importance of Source Term Variables to Uncertainty in Environmental Release Based on analyses performed for the Surry plant (Ref. 10.10), the importance of source term vari-ables is seen to be different for different groups of radionuclides. The uncertainty in the release of noble gases is dominated by the uncertainty in ac-cident frequency variables. The relative uncertain-ties in release fractions for the noble gases and in retention mechanisms (only volumetric holdup is assumed) are small.
The character of the risk-dominant accident se-quences at Surry plays an important role in deter-mining the importance of the source term vari-ables for the other radionuclide groups. The steam generator tube rupture (SGTR) accident and the interfacing-system LOCA sequences (the risk-dominant sequences) involve bypass routes in which radionuclides released from the core trans-port to the environment without being subjected to containment deposition processes. As a result, steam generator retention and the release of radionuclides from the fuel during in-vessel melt progression are the largest contributors to uncer-tainty for the volatile radionuclides, iodine and cesium, and for the semivolatile radionuclides, tel-NUREG-1150 lurium, barium, strontium, and ruthenium. For the involatile radionuclides, lanthanum and ce-rium, the release of radionuclides during core-concrete interactions is also an important con-tributor.
The Surry analyses also indicate that the uncer-tainties in source term variables tend to have rela-tively more importance for large releases. For small releases of radionuclides, the uncertainties are dominated by the uncertainties associated with the accident frequencies.
Plant-Specific Importance of Source Term Variables to Uncertainty in Risk Consistent with the discussion in the previous sec-tion, the largest contributors to uncertainty in early fatality risk for the Surry plant (Ref. 10.10) are the frequency of the interfacing-system LOCA sequence and two source term variables, retention in the steam generator (in an SGTR accident) and release from the fuel during in-vessel melt pro-gression. For latent cancer fatality risk, the fre-quency of SGTR accidents becomes of higher im-portance and the frequency of interfacing-system LOCAs of reduced importance. Steam generator retention and in-vessel release of radionuclides are of comparable importance to the accident fre-quency variables.
The Zion results (Ref. 10.13) are similar to those for Surry but reflect a reduced significance of the interfacing-system LOCA sequence and an in-creased importance of steam explosions as a mode of early containment failure (this results from a much lower frequency of interfacing-system LOCA in Zion). Release of radionuclides from fuel in-vessel, steam generator retention (in an SGTR accident), and containment retention of material released prior to vessel breach (as ap-plied in a steam explosion scenario) are the most important source term contributors to the uncer-tainty in early fatality risk. For latent cancer fatal-ity risk, containment failure from a steam explo-sion is of reduced significance and, as a result, containment retention is not an important con-tributor to risk uncertainty.
For early fatality risk at Sequoyah (Ref. 10.12),
the frequency of the interfacing-system LOCA is the most important contributor to uncertainty.
Containment failure by overpressurization is a more likely early failure mechanism for Sequoyah than for the large, high-pressure containments at Zion and Surry. As a result, accident progression mechanisms such as pressure rise at vessel breach and containment failure pressure are also impor-tant contributors to risk uncertainty for the 10-10 OAGI0000611_00233
Sequoyah design. The most significant source term variables are in-vessel retention fraction, containment retention fraction for the in-vessel release, and steam generator deposition (in an SGTR accident). For latent cancer fatality risk, the frequency of the SGTR accident is the most important contributor to uncertainty; none of the source term variables is significant.
Regression results were obtained for internal in-itiators, fire events, and seismic events for the Peach Bottom plant (Ref. 10.11). For early fatal-ity risk from internal initiators, release from fuel in-vessel, release during core-concrete interac-tions, and fractional release from containment of the core-concrete source terms are the most im-portant contributors to uncertainty. The contain-ment building decontamination factor, late release of iodine, reactor coolant system retention, and revaporization also contribute at a level similar to the contribution from the frequencies of the acci-
- 10. Severe.Accident Source Terms dent sequences. For fire initiators, the contribu-tions from the various source term variables are similar but slightly reduced consistent with greater uncertainty in the initiator frequency.
For latent cancer fatality risk at Peach Bottom, the important source term variables are the same as for the early fatality risk but are relatively less important than the contribution from uncertainties in the accident frequencies.
In the Grand Gulf analyses (Ref. 10.14), the source term variables were indicated to be less im-portant than the accident sequence and accident progression variables. The most significant source term variable was indicated to be the release frac-tion from containment following vessel failure.
The decontamination factor for the suppression pool, spray decontamination factor, in-vessel re-lease of radioactive material, and in-vessel reten-tion of radioactive material were also identified as moderate contributors to the uncertainty in risk.
10-11 NUREG-1150 OAGI0000611 00234
- 10. Severe Accident Source Terms REFERENCES FOR CHAPTER 10 10.1 M. Silberberg et al., "Reassessment of the Technical Bases for Estimating Source Terms," U.S. Nuclear Regulatory Commis-sion (USNRC) Report NUREG-0956, July 1986.
10.2 J. A. Gieseke et al., "Source Term Code Package, A User's Guide (Mod. 1)," Bat-telle Columbus
- Division, NUREG/
CR-4587, BMI-2138, July 1986.
10.3 R. M. Summers et al., "MELCOR In-Vessel Modeling," Proceedings of the Fif-teenth Water Reactor Safety Information Meeting (Gaithersburg, MD), NUREG/
CP-0091, February 1988.
10.4 Fauske and Associates, Inc., "MAAP Modular Accident Analysis Program Us-er's Manual," Vols. I and II, IDCOR Technical Report 16.2-3, February 1987.
10.5 K. D. Bergeron et al., "User's Manual for CONTAIN 1.0, A Computer Code for Se-vere Reactor Accident Containment Analysis," Sandia National Laboratories, NUREG/CR-4085, SAND84-1204, July 1985.
10.6 D. I. Chanin, H. Jow, J. A. Rollstin et at.,
"MELCOR Accident Consequence Code System (MACCS),"
Sandia National Laboratories, NUREG/CR-4691, Vols.
1-3, SAND86-1562, February 1990.
10.7 USNRC, "Reactor Safety Study-An As-sessment of Accident Risks in U. S. Com-mercial Nuclear Power Plants,"
WASH-1400 (NUREG-75/014), October 1975.
10.8 G. D. Kaiser, "The Implications of Re-duced Source Terms for Ex-Plant Conse-NUREG-1150 quence Modeling," Executive Conference on the Ramifications of the Source Term (Charleston, SC), March 12, 1985-.
10.9 L. LeSage et al., "Report of the Special Committee on NUREG-1150, The NRC's Study of Severe Accident Risks," Ameri-can Nuclear Society, June 1990.
10.10 R. J.. Breeding et al., "Evaluation of Se-vere Accident Risks: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, Octo-ber 1990.
10.11 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit 2,"
Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision
- 1. SAND86-1309, to be published.*
10.12 J. J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, De-cember 1990.
10.13 C. K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551, Vol.
7, Draft Revision 1,
BNL-NUREG-52029, to be published.*
10.14 T. D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," San-dia National Laboratories, NUREG/
CR-4551, Vol.
6, Draft Revision 1,
SAND86-1309, to be published.'"
- Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
10-12 OAGI0000611 00235
- 11. PERSPECTIVES ON OFFSITE CONSEQUENCES 11.1 Introduction Frequency distributions; in the form of comple-mentary cumulative distribution functions (CCDFs), of four selected offsite consequence measures of the atmospheric releases of radionuclides in reactor accidents (with all source terms contributing) have been presented in Chap-ters 3 through 7 for the five plants* covered in this study. For each consequence measure, the 5th percentile, 50th percentile (median), 95th pe~
centile, and the mean CCDFs were shown. This chapter provides some perspectives on the offsite consequence results for these plants.
Section 11. 2 provides a discussion on the basis of the CCDFs. Section 11.3 discusses, summarizes, and compares the consequence results for the five plants displayed in the mean and the median CCDFs. Section 11.4 compares the results from the mean and median CCDFs with those of the Reactor Safety Study (Ref. 11.1). Sections 11. 5 and 11. 6, respectively, provide discussions on po-tential sources of uncertainty in consequence analysis and on sensitivities of the mean CCDFs to the assumptions on the offsite protective measures to mitigate the consequences.
Some of the perspectives provided in this chapter relate to the effectiveness of various methods of offsite emergency response. For these five plants, it appears that evacuation is the most effective emergency response for the risk-dominant acci-dent sequences. However, as discussed below, the calculated effectiveness of a response is sensitive to assumptions on the timing of warnings to people offsite before radioactive release, the estimated delay before evacuation and the effective speed of evacuating populations, and the energy of the re-lease. In this chapter, the results of sensitivity studies on some of these factors are discussed.
The reader should not infer that these results sig-nal a modification to NRC's emergency response guidance. Rather, they provide a glimpse of the type of technical assessment that would be re-quired in NRC's reevaluation of emergency re-sponse.
11.2 Discussion of Consequence CCDFs As discussed in the earlier chapters, a large num-ber of source terms, each with its own frequency,
- See Figures 3.9, 3.10; 4.9, 4.10; 5.8; 6.8; and 7.7, re-spectively, for Surry, Peach Bottom, Sequoyah, Grand Gulf, and Zion.
11-1 were initially deveioped for each of the five plants.
They spanned a wide spectrum of plant damage states, phenomenological scenarios, and source term uncertainties for each plant that led to radionuclide releases to the atmosphere. How-ever, for the purpose of the manageability of the offsite consequence analysis, such large numbers of source terms for each plant were reduced to a much smaller number (about 30 to 60) of repre-sentative source term groups.
Each source term group was treated as a single source term in the offsite consequence analysis code, MACCS (Ref. 11.2). The MACCS analyses incorporated the mitigating effects of the offsite protective actions. The magnitudes of the selected consequence measures and their meteorology-based probabilities were calculated by MACCS for each source term group and were used to generate the meteorology-based CCDFs. These conditional CCDFs of the consequence measures for all indi-vidual source term groups served as the basic data set for further analysis. When the conditional CCDFs of a consequence measure were weighted by the frequencies of the source term groups, the 5th percentile*, 50th percentile (median), 95th percentile, and the mean values of the frequencies at various magnitude levels of the consequence measure were obtained and displayed as CCDFs in Chapters 3 through 7.
Thus, in this procedure, both the frequencies of the source term groups and the probabilities of the site meteorology (which in combination with the source term groups lead to the various conse-quence magnitude levels) have been used in gen-erating the percentile and mean CCDFs. (The construction of these CCDFs is discussed in Sec-tion A.9 of Appendix A.)
11.3 Discussion, Summary, and Interplant Comparison of Offsite Consequence Results The various percentile and the mean CCDFs of the consequence measures shown in Chapters 3 through 7 display the uncertainties in the offsite consequences stemming from the in-plant uncer-tainties up to the source terms and their frequen-cies and the ex-plant uncertainties due to the vari-ability of the site meteorology. The 5th and 95th percentile CCDFs provide a reasonable display of the bounds of the offsite consequences frequency distributions for the five plants.
NUREG-1150 OAGI0000611_00236
- 11. Offsite Consequences Tables 11.1 and 11.2 present the information contained in the mean and the median CCDFs in tabular form. Entries in these tables are. the ex-ceedance frequency levels of 10-5, 10-6, 10-1, 10-6, and 10-9 per reactor year and the magni-tudes of the consequences that will be exceeded at these frequencies for the five plants.
As stated in Chapters 3 through 7, the CCDFs of the consequence measures presented in those chapters (and, therefore, the results shown in Ta-bles 11.1 and 11.2) incorporate the benefits of evacuation of 99.5 percent of the population within the 10-mile plume exposure pathway emer-gency planning zone (EPZ), early relocation of the remaining population from the heavily con-taminated areas both within and outside the 10-mile EPZ, and other protective measures. De-tails of the assumptions on the protective meas-ures are presented in Table 11.3.
The results shown in Tables 11.1 and 11.2 for the five plants are discussed below.
Early Fatality Magnitudes The early fatality magnitudes (persons) at various exceedance frequencies for a plant are driven by the core damage frequency and the radionuclide release parameters of the source term groups for the plant; the site meteorology and the population distribution in the close-in site region; and the ef-fectiveness of the emergency response. These fac-tors are different for the five plants. Therefore, different values of early fatality magnitudes are shown for equal levels of exceedance frequencies.
Some of the plant/site features contributing to the differences between the early fatality CCDFs of the five plants are discussed below:
Core damage frequencies for the internal in-itiators for Peach Bottom and Grand Gulf are lower than those for the other three plants.
Therefore, the early fatality CCDFs for Peach Bottom and Grand Gulf are associated with relatively low exceedance frequencies.
Quantities of radionuclides associated with the early phase of the release* in the source term
- Virtually all source term groups developed for this study have two release phases-an early release phase and a later release phase. Early fatalities are essentially due to the early release. This is because the wind direction may change before the later release, so that the later release would not always add to the radiation dose of the same people who were affected by the early release, and evacuation or relocation would likely be completed before the later release would occur.
NUREG-1150 groups for Peach Bottom and Grand Gulf are typically smaller than those for the other three plants because of suppression pool scrubbing.
This lowered the early fatality magnitudes for these two plants.
Several source term groups for Surry and Se-quoyah with large quantities of radionuclides associated with the early release phase are also associated with large thermal energy in this phase. This resulted in vertical rise of the plume in several meteorological scenarios, re-ducing the potential for large early fatality magnitudes.
The time of warning before the start of the radionuclide release strongly influences the effectiveness of the emergency response, par-ticularly the evacuation. The source term groups for Peach Bottom and Grand Gulf with potential for early fatalities, unless mitigated by emergency response, are also associated with warning times that are well in advance of the release compared to those for the other three plants because the most important acci-dent sequences for the BWRs develop more slowly than those for the PWRs of this study.
In contrast, warning times are close to the start of the release (about 40 minutes before the release) for the source term groups con-taining the fast-developing interfacing-system LOCA accident sequences for Surry and Se-quoyah, which also have large quantities of radionuclides in the release.
The Zion site has the highest population den-sity within the 1 0-mile EPZ among the five plants (although about half of the area in this zone for Zion is water). It is followed by Surry, Sequoyah, Peach Bottom, and Grand Gulf.
11-2 For Zion, Surry, and Sequoyah, relatively long evacuation delay times after the warnings and slow effective evacuation speeds were cal-culated. For Peach Bottom and Grand Gulf, relatively short evacuation delay times and fast effective evacuation speeds were calcu-lated. Values of these parameters were based on the utility-sponsored plant-specific studies and the NRC requirements for emergency planning. The utility-sponsored evacuation time estimate studies, however, were not evaluated in terms of how well they realisti-cally represent the sites.
In the MACCS calculations, early warnings before the radionuclide release and short evacuation OAGI0000611 00237
Table 11.1 Summaries of mean and median CCDFs of offsite consequences-fatalities.
Exceedance Early Fatalities (persons) 2 Latent Cancer Fatalities (persons) 2 Frequency (ry-1) 1*
2*
3*
4*
5*
6*
7*
1*
2*
3*
4*
5*
6*
7*
10-5 Int.b 0
0 0
0 0
0 0
6(1)c 0
0 0
o*
0 0
0 0
0 0
0 2(1) 0 0
7(2) 1 (3)
Fire 0
0 0
6(2) 0 0
0 0
10-6 Int.
0 0
0 0
0 1(3) 1(3) 4(3) 3(2) 8(3) 0 0
0 0
0 0
0 4(2) 2(2) 1(3) 0 2(3) 5(3) 5(3)
Fire 0
0 1 (1) 8(3) 0 0
7(0) 3(3) 10-7 I
Int.
3(0) 0 5(1) 0 2(2) 8(3) 8(3) 9(3) 1(3) 3(4) 0 0
2(0) 0 2(0) 2(2) 2(0) 4(3) 3(3) 6(3) 6(2) 1(4) 2(4) 2(4)
Fire 0
0 4(2) 2(4) 0 0
2(1) 1(4) 10-8 Int.
4(1) 0 4(2) 0 3(3) 2(4) 2(4) 2(4) 3(3) 8(4) 0 0
5 (1) 0 5 (1) 1(3) 3(2) 9(3) 1(4) 1 (4) 2(3) 2(4) 3(4) 3(4)
Fire 0
1(0) 5(3) 4(4) 0 0
6(1) 2(4) 10-9 0
Int.
1 (2) 1(0) 2(3) 0 4(3) 4(4) 4(4) 2(4) 6(3) 1 (5) 8(0) 0 2(2) 0 8(2) 4(3) 2(3) 2(4) 2(4) 2(4) 3(3) 4(4) 4(4) 5(4) til' Fire 1 (1) 3(0) 2(4) 5 (4)
(1) z
()
c:::
0 0
1 (3) 4(4) 0
- I
~
til (1)
- Plant Names: 1 = Surry; 2 =Peach Bottom; 3 = Sequoyah; 4 = Grand Gulf; 5 =Zion; 6 = RSS-PWR; 7 = RSS-BWR
..0 0
?
- a. First line of entries corresponds to mean CCDF; second line corresponds to median CCDF.
s:::
(1)
)>
- b. Int. = Internal initiating events
- I G>
- c. 6(1) = 6 X 10.1 = 60
(')
- v.
(1) 0 0
0 0
0 O'l I 0 0
~
(.,)
00
z c:
~
~
ti1 Table 11.2 Summaries of mean and median CCDFs of offsite consequences-population exposures.
0 Q
I t;r rl-'
(II Vl n
0 Exceedance SO-Mile Region Population Exposure (person-rem) 8 Entire Site Region Population Exposure {person-rem) 8 0
Frequency
- l Cl>
(ry-1) 1*
2*
3*
4*
5*
1*
2*
3*
4*
5*
(II
.0 s::
(II 10-5
~
0 Int.b 7(2)C 0
1 (5) 0 5(3) 2(3) 0 4(5) 0 9(3)
(II Cl>
2(2) 0 4(4) 0 3(3) 3(2) 0 1 (5) 0 4(3)
Fire 5(1) 1 (6) 1 (2) 3(6) 0 2(3) 0 3(3) 10-6 Int.
1 (6) 3(6) 3(6) 2(5) 2(7) 8(6) 7(6) 2(7) 2(6) 5(7) 6(5) 6(5) 1 (6) 1 (2) 3(6) 2(6) 1 (6) 7(6) 2(2) 1(7)
Fire 3(4) 1(7) 1 (5) 5(7) 2(4) 6(6) 6(4) 2(7) 10-7 I
~
Int.
8(6) 1(7) 8(6) 6(5) 8(7) 5(7) 5(7) 6(7) 9(6) 2(8) 5(6) 6(6) 4(6) 3(5) 3(7) 2(7) 2(7) 3(7) 3(6) 7(7)
Fire 6(5) 3(7) 2(6) 1(8) 1(5) 1(7) 2(5) 7(7) 10-8 Int.
2(7) 2(7) 2(7) 1 (6) 2(8) 1 (8) 1 (8) 9 (7) 2(7) 3(8) 9(6) 1(7) 7(6) 6(5) 7(7) 6(7) 8(7) 6(7) 9(6) 1(8)
Fire 6(6) 5(7) 3(7) 2(8) 5(5) 3(7) 6(5) 1(8) 10-9 Int.
3(7) 4(7) 4(7) 2(6) 4(8) 2(8) 2(8) 1 (8) 3(7) 4(8) 1(7) 2(7) 1(7) 1 (6) 1 (8) 1 (8) 1 (8) 1 (8) 2(7) 2(8)
Fire 2(7) 6(7) 9(7) 3(8) 1(6) 4(7) 8 (6) 2(8) 0
- Plant Names: 1.= Surry; 2 =Peach Bottom; 3 = Sequoyah; 4 =Grand Gulf; 5 =Zion
)>
- a. First line of entries corresponds to mean CCDF; second line corresponds to median CCDF.
G>
- b. Int. = Internal-initiating events 0
- c. 7(2) = 7 X 102 = 700 0
0 0 (j)
I 0 0
~
(.,)
<D
0
)>
G>
0 0
0 0 (j)
I 0 0
~
0 Table 11.3 Offsite protective measures assumptions.
- 1.
Emergency Response Assumptions
- a.
Within 10-mile plume exposure pathway emergency planning zone (EPZ):
Evacuation of people after a delay* following the warning given by the reactor operator on the imminent radionuclide release.
Average evacuation delay times (hr): Surry 2.0, Peach Bottom 1.5, Sequoyah 2.3, Grand Gulf 1.25, Zion 2.3.
Average effective radial evacuation speeds (mile/hr): Surry 4.0, Peach Bottom 10.7, Sequoyah 3.1, Grand Gulf 8.3, Zion 2.5.
- b.
Outside of 10-mile EPZ:
Early relocation of people: within 12 hour1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />s/24 hours after plume passage from areas where the projected lifetime effective whole body dose equivalent (EDE), as defined in ICRP Publications 26 and 30, from a 7-day occupancy would exceed 50 rems/25 rems.
Note: These assumptions are also extended inward up to the plant site boundary for the nonevacuating or nonsheltering people.
I Ut z c
!:0 ti1
<?
Ut 0
- 2.
Protective Action Guides (PAGs) for Long-Term Countermeasures
- a.
FDA "emergency" PAG for directly contaminated foods and animal feeds-dose not to exceed 5-rem EDE and 15-rem thyroid (Ref. 11.3).
- b.
EPA's proposed PAGs for continuation of living in contaminated environment-dose not to exceed:
2-rem EDE in the first year 0.5-rem EDE in the second year from groundshine and inhalation of resuspended radionuclides.
Note: EPA's criteria (Ref. 11.4) are approximated in MACCS as dose not to exceed 4-rem EDE in 5 years.
- c.
In absence of any Federal agency criteria for ingestion dose to an individual from foods grown on contaminated soil via root up-takes, MACCS assumes a PAG of 0.5-rem EDE and 1.5-rem thyroid for this pathway, which is similar to FDA's "preventive" PAG for directly contaminated food and animal feeds (Ref. 11.3).
- Time steps involved during the delay are: (1) notification of the offsite authorities, (2) evaluation and decision by the authorities, (3) public notification advising evacu-ation, and (4) p(!ople's preparation for evacuation.
0 -
Eir' (p
(')
0
- 3 (p -g (p
~
(p
- 11. Offsite Consequences delay times for Peach Bottom and Grand Gulf en-ab-led the evacuees to have a substantial head start on the plume. This, coupled with relatively fast effective evacuation speeds, enabled the evacuees to almost always avoid the trailing radioactive plumes. Thus, the relatively lower core damage frequencies, lower magnitudes of source term groups in the* early phase of release, early warn-ings, lower population densities, lower evacuation delays, and higher evacuation speeds made the Peach Bottom and Grand Gulf early fatality CCDFs in Figures 4.9 and 6.8 lie in the low fre-quency and low magnitude regions, and early fa-tality magnitude entries in Table 11.1 small or nil.
Surry and Sequoyah fit between Peach Bottom/
Grand Gulf and Zion. For Surry and Sequoyah, warnings close to release in the interfacing-system LOCA accident sequences made evacuation less effective for these sequences. Also, evacuation was less effective in the plume rise scenarios for those source terms for which early release phases were associated with large quantities of radio-nuclides and large amounts of thermal energy (se-quences with early containment failure at vessel breach). With the plume rise,.the highest air and ground radionuclide concentrations occur at some distance farther from the r:eactor (instead of oc-curring close to the reactor without plume rise). In such cases, the late starting evacuees from the close-in regions moving away from the reactor in the downwind direction encounter higher concen-trations and receive higher doses.
Latent Cancer Fatality Magnitudes The estimates of latent cancer fatality magnitude at various exceedance frequencies include the benefits of the protective measures discussed above. Contributions from radiation doses down to very low levels have been included. If future research concludes that it is appropriate to trun-cate the individual dose at a de minimis level, re-duced latent cancer fatality estimates would be obtained.
Variations of the latent cancer fatality magnitude for the five plants at equal exceedance frequency levels primarily arise because of differences in the source term groups and their frequencies, site me-teorologies, and differences in the site demogra-phy, topography, land use, agricultural practice and productivity, and distribution of fresh water bodies up to 50 to 100 miles from the plants.
Emergency response in the close-in regions has only a limited benefi~ial impact on delayed cancer NUREG-1150 fatality magnitude and does not contribute sub-stantially to the differences in the cancer fatality CCDFs for the five plants. The long-term protec-tive measures, such as temporary interdiction, condemnation, and decontamination of land, property, and foods contaminated above accept-able levels are based on the same protective ac-tion guides (FAGs) for all plants. Further, the site differences for the five plants are not large enough beyond the distances of 50 to 100 miles to con-tribute substantially to the differences in the latent cancer fatality CCDFs.
Population Exposure Magnitudes Population exposure magnitudes (person-rem*) at various exceedance frequencies include the con-tributions from the early and chronic exposures.
These magnitudes reflect the dose-saving actions of the protective measures and, therefore, are the residual magnitudes.
11-6 Variations of the population exposure magnitudes for the five plants at equal exceedance frequency levels were similar to those of the cancer fatality magnitudes discussed earlier.
The relative contributions of the exposure path-ways to the population dose for a given plant are highly source term dependent. Examples of rela-tive contributions of early and chronic exposure pathways (see Chapter 2 and Appendix A) to the meteorology-averaged mean estimates of the 50-mile and entire region population dose for se-lected source term groups for the five plants are shown in Table 11.4. For brevity of presentation, only four source term groups that are the top con-tributors to the risks of the population dose for the five plants are selected. These source term groups are designated only by their identification num-bers in Table 11.4. The chronic exposure pathway is shown subdivided in terms of direct (ground-shine and inhalation of resuspended radionu-clides) and ingestion (food and drinking water) pathways.
For a qualitative understanding of the results shown in Table 11.4, it should be noted that:
All radionuclides contribute to the early expo-sure pathway; all nonnoble gas radionuclides contribute to the chronic direct exposure pathway; and only the radionuclides of io-dine, strontium, and cesium contribute to the chronic ingestion exposure pathway.
- Effective dose equivalent (EDE) (as defined in ICRP Publications 26 and 30) in the unit of rem is used in the definition of person-rem.
OAGI0000611 00241
Table 11.4 Exposure pathways relative contributions (percent) to meteorology-averaged conditional mean estimates of population dose for selected source term groups.
Source Term Group 50-Mile Region*
Entire Region*
Identification Early Chronic Ex~osure Early Chronic Ex~Qsure Plant Name Number Exposure Direct Ingestion Exposure Direct Ingestion Surry 9
28 68 2
10 69 20 33 51 41 3
14 74 12 37 33 58 5
- 9.
79 12 49 13 80 7
9 58 33 Peach Bottom 28 28 66 2
15 77 7
34 42 47 5
24 68 5
37 38 52 5
20 72 6
40 23 70 3
10 81 8
Sequoyah 32 49 36 8
11 68 20 I
35 42 47 6
8 59 32
-..J 43 49 28 19 11 73 15 44 59 29 9
12 75 13 Grand Gulf 19 24 62 12 17 46 42 25 16 65 16 4
54 41 28 10 72 16 3
41 57 32 41 39 17 12 62 25 Zion 139 50 46 1
27 56 16
~
175
. 71 21 2
49 39 8
142 24 73 1
23 60 15 0
136 44 49 2
12 67 20 Ul (1>
z
- The difference between 100 percent and the sum of the pathway contributions is the relative population dose to the decontamination workers.
(j c::
0
- l
- 0 Ul tTl (1>
..0 0
Q c
)>
I (1>
G>
- s
()
0 Ul (1>
0 0
Cll 0
0 (j)
I 0 0
~
.j>..
~
- 11. Offsite Consequences Early exposure pathway population dose esti-mated is largely unmitigated, except for the evacuated and relocated people. In addition to cloudshine and cloud inhalation during plume passage, it includes the groundshine and inhalation of resuspended radionuclides for a period of 7 days after the radionuclide release.
Chronic exposure pathway involves dose inte-gration from 7 days to all future times (i.e.,
the sum total of the dose over time).
In the MACCS analysis, the protective actions to mitigate the chronic exposure pathways are largely confined to the 50-mile region of the site. Outside the 50-mile region, the mitigative actions (based on the PAGs) are generally not triggered in MACCS because of the relatively low levels of contamination (however, some-times they are triggered depending on the me-teorology and the source term magnitudes).
Protective actions are not assumed for water ingestion.
Except for Grand Gulf, Table 11.4 shows that in the 50-mile region the early exposure pathway population dose and the chronic direct exposure pathway population dose are roughly similar; the chronic ingestion pathway makes smaller contri-butions. For the entire region, the chronic direct exposure pathway has increased contributions relative to the early exposure pathway. This is be-cause at longer distances the early exposure path-way has weakened as a result of low air and ground concentrations and the short (i.e., 7 days) integration time for ground exposure. Relative contributions of the chronic ingestion exposure pathway are also higher for the entire region. This is because the chronic direct exposure is depend-ent on population size and the chronic ingestion exposure is dependent on farmland and water body surface area. An increase in the population size with distance from a plant generally occurs less rapidly compared to the increase in the area with distance.
For Grand Gulf, generally the contributions from the early exposure pathway are lower than the chronic direct exposure pathway in the 50-mile region relative to the other four plants and are due to the characteristics of the selected source term groups. For the entire region, the relative contributions of the early exposure pathway and chronic direct exposure pathway are similar to the other plants. However, the ingestion exposure NUREG-1150 pathway has higher contributions both in the 50-mile and entire region compared to the other plants. This is because the Grand Gulf site region has a smaller population size and a larger area de-voted to farming than the other four sites of this study.
11.4 Comparison with Reactor Safety Study The mean and the median CCDFs of two of the selected consequence measures, namely, early fa-talities and latent cancer fatalities, displayed in Chapters 3 through 7 for the internal initiators of the reactor accidents and summarized in Table 11.1, may be compared with the CCDFs displayed in the Reactor Safety Study (RSS). However, the RSS CCDFs are the results of superpositions of the meteorology-based conditional CCDFs for the RSS "release categories"
- after being weighted by the median frequencies of the release categories.
The CCDFs shown in Chapters 3 through 7 are calculated in a different way from the RSS CCDFs. Thus, they are not strictly comparable.
The RSS CCDFs of early fatalities and latent can-cer fatalities are shown in the RSS Figures 5-3 and 5-5, respectively. The magnitudes of delayed cancer fatalities shown in the RSS CCOFs are ac-tually the magnitudes of their projected uniform annual rates of occurrence over a 30-year period.
Thus, these RSS rate magnitudes need to be mul-tiplied by a factor of 30 to derive their total mag-nitudes. After performing this step, the RSS re-sults have been entered in Table 11.1 for comparison with the results of this study.
Table 11.1 shows that, for one or more early fa-tality magnitudes, the mean and median frequen-cies for the three PWRs of this study (Surry, Se-quoyah, and Zion) and the median frequency for the RSS-PWR are similar and are less than 10-6 per reactor year.. However, Table 11.1 also shows that these frequencies for the two BWRs of this study (Peach Bottom and Grand Gulf) are signifi-cantly lower than that for the RSS-BWR. For one or more early fatality magnitude, the median fre-quency is less than 10-s per reactor year for the RSS-BWR; whereas, the mean and median fre-quencies are less than 10-8 per reactor year for-Peach Bottom and less than 10-9 per reactor year for Grand Gulf.
11-8 Further, the comparison of the early fatality mag-nitudes in the median exceedance frequency
~RSS "release categories" are analogous to the source term groups in the present study but were developed by differ-ent procedures.
OAGI0000611_00243
range of 10-9 to 10-7 per reactor year shows that the RSS estimates are significantly highe.r than the estimates for the five plants of this study.
Table 11.1 shows that for the one or more latent cancer fatality magnitudes, the mean and median frequencies of only one plant (Sequoyah) of this study and the median frequencies for the RSS-PWR and RSS-BWR are similar and are less than 1 0-4 per reactor year. However, these frequencies for the other four plants of this study are an order of magnitude lower than that for the RSS; i.e.,
less than 10-5 per reactor year.
The RSS estimates of latent cancer fatality magni-tudes for the median exceedance frequency range of 10-9 to 10-5 per reactor year are higher (in some instances significantly higher) than those for the five plants of this study-except for Zion at the median exceedance frequency of 10-9 per reactor year where they are about equal.
There are several factors contributing to the dif-ferences in the frequency distributions of the offsite consequences for this study and the RSS.
Some of these factors are mentioned below:
Accident sequence frequency differences.
Source term characterization difference.
Most of the source terms of this study have two releases-an early release and a later re-lease. Early fatalities from a source term are mostly the consequences of the early release.
Cancer fatalities are the consequences of both early and later releases. On the other hand, the RSS source terms did not have such a breakdown in terms of early or later release.
Therefore, the early fatalities from an RSS source term were the consequences of the en-tire release, as were the latent cancer fatali-ties.
Consequence analyses for this study are site specific, using data for the site features de-scribed in Chapters 3 through 7. The RSS consequenc.e analysis was generic; it used composite offsite data by averaging over 68 different sites.
In the present study, evacuation to a distance of 10 miles is assumed; whereas, in the RSS, evacuation to a distance of 25 miles was as-sumed.
Health effect models of this study are differ-ent from those of the RSS.
- 11. Offsite Consequences Protective action guide dose levels for control-ling the long-term exposure are different.
There are other miscellaneous differences be-tween the accident consequence models and input data used in this study and the RSS.
Different procedures were used for construct-ing the CCDFs.
11.5 Uncertainties and Sensitivities There are uncertainties in the CCDFs of. the offsite consequence measures. Some of these un-certainties are inherited from the uncertainties in the source term group specifications and frequen-cies. However, even after disregarding the source term group uncertainties, there are significant un-certainties in the CCDFs of the consequence measures due to uncertainties in the modeling of atmospheric dispersion, deposition, and transport of the radionuclides; transfer of radionuclides in the terrestrial exposure pathways; emergency re-sponse and long-term countermeasures; dosimetry, shielding, and health effects; and un-certainties in the input data for the model pa-rameters.
Because of time constraints, uncertainty analyses for the offsite consequences, except for the uncer-tainties due to variability of the site meteorology, have not been performed for this report. They are planned for future studies. For this study, only best estimate values of the parameters for repre-sentation of the natural processes have been used in MACCS. An analysis of sensitivity of the CCDFs to the alternative protective measure as-sumptions is provided in the following section.
11.6 Sensitivity of Consequence Measure CCDFs to Protective Measure Assumptions Emergency response, such as evacuation, shelter-ing, and early relocation of people, has its greatest beneficial impact on the early fatality frequency distributions. The long-term protective measures, such as decontamination, temporary interdiction, and condemnation of contaminated land, prop-erty, and foods in accordance with various radio-logical protective action guides (PAGs), have their largest beneficial impact on the latent cancer fa-tality and population exposure frequency distribu-tions.
- 11. 6.1 Sensitivity of Early Fatality CCDFs to Emergency Response Four alternative emergency response modes within the 10-mile EPZ, as characterized in Table 11-9 NUREG-1150 OAGI0000611 00244
- 11. Offsite. Consequences 11.5, are assumed in order to show the sensitivity of-early fatality CCDFs to these response modes.
Table 11.6 summarizes the early fatality mean CCDFs in tabular form for Surry, Peach Bottom, Sequoyah, and Grand Gulf for two alternative emergency response modes, and Zion for all four alternative emergency response modes. Several inferences are drawn later in this section regarding the effectiveness of these alternative emergency response modes for the five plants based on these data. However, more analy~is is needed to support these inferences fo: emergency response and to provide detailed insight into the underlying com-peting processes involved that diminish or en-hance the effectiveness of any emergency re-sponse mode.
In particular, the effectiveness of evacuation is very site specific and source term specific. It is largely determined by two site parameters, namely, evacuation delay time and effective evacuation speed, and two source term parame-ters-warning time before release and energy asso-ciated with the release (which, during some mete-orological conditions, could cause the radioactive plume to rise while being transported downwind).
Therefore, it cannot be extrapolated across the source terms for a plant or across the plants for similar source terms.
The CCDFs discussed here include contributions from many source term groups. The effectiveness of any emergency response mode judged from the sensitivity of the early fatality mean CCDF for a plant is essentially the effectiveness for the domi-nant source terms in specific frequency intervals included in the CCDF. With these caveats, the in-ferences based on the data shown in Table 11.6 are as follows:
Zion
- 1.
Evacuation from the o.:.to-5 mile EPZ com-bined with sheltering in the 5-to-1 0 mile EPZ is as effective as evacuation from the entire 1 0-mile EPZ. Effectiveness of evacuation in close-in regions of radius less than 5 miles and sheltering in the outer regions will be evaluated in future studies. (See Chap-ter 13.)
- 2.
Sheltering, due to *better shielding protection indoors, is more effective than early reloca-tion from the state of normal activity. (See Tables 11.3 and 11.5 for distinctions be-tween evacuation, early relocation, and shel-tering modes of response assumed in this study.)
Sequoyah
- 1.
Evacuation is more effective than relocation for exceedance frequencies higher than 10-8 per reactor year.
- 2.
In the low frequency region (i.e., 10-B per reactor year or less), the early relocation mode is more effective than evacuation. This "crossover" of the early fatality mean CCDFs for the two response modes is likely because of the dominance of the low frequency large source terms that also have short warning times before release and/or high energy con-ten~s and calculated long evacuation delay time and slow effective evacuation speed.
Because of the short warning time before re-lease and a long delay between the warning and the start of evacuation, many evacuees become vulnerable to the radiation exposures from the passing plume and contaminated ground rather than escape these exposures.
Because of the plume-rise effect (for the hot plumes), the peak values of the air and ground radionuclide concentrations occur at some distance farther from the plant. In such a case, the evacuees from close-in regions moving in the downwind direction move from areas of lower concentrations to areas of higher concentrations and receive a higher dose. It should be noted that, while evacuat-ing, the people are out in the open and have minimal shielding protection. For the above situations, the sheltering mode also would show the same crossover effect.
However, the crossover effect showing that relocation or sheltering may be more effec-tive than evacuation may not be realistic be-cause of uncertainties in the consequence analysis.
Peach Bottom, Grand Gulf The source terms and features of these two low population density sites make evacuation a very effective mode of offsite response.
Surry Although entries in Table 11.6 show that evacu-ation is more effective than relocation from the state of normal activity, some low probability accident sequences for Surry are similar to those of Sequoyah (short warning times of the interfac-ing-system LOCA accident sequences and large NUREG-1150 11-10 OAGI0000611_00245
0
)>
G>
0 0
0 0 (j)
I 0 0
~
.j>..
(j)
I,_.
z c it' tr1 0
I,_.
Vl 0
Table 11.5 Assumptions on alternative emergency response modes within 10-mile plume exposure pathway EPZ for sensitivity analysis.
- a.
Evacuation (see Table 11.3).
- b.
Early relocation in lieu of evacuation or shelter: Extends the assumptions for relocation outside the 10-mile EPZ (see Table 11.3) inward up to the plant site boundary.
- c.
Sheltering* (getting to and remaining indoors) in lieu of evacuation, followed by fast relocation after plume passage.
- d.
Evacuation for the inner 0-5 mile region and sheltering* in the outer 5-10 mile region followed by fast relocation after plume passage.
- Sheltering assumptions details: After an initial delay of 45 minutes from the reactor operator's warning, people get indoors and remain indoors and are relocated to uncontaminated areas within a maximum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of remaining indoors. However, virtually all source terms analyzed in this study have two release phases-an early (first) release and a later (second) release. If there is a sufficient time gap (about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />) between the two release phases, then people from indoors can be relocated to uncontaminated areas during this gap and avoid the exposure from the second release. With this perspective, two cases of relocation earlier than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are implemented in calculations as follows:
Relocation within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after termination of the initial (the first) release, if the second release does not occur within this 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; otherwise, Relocation within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after termination of the second release (provided this relocation time is earlier than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of indoor occupancy; otherwise, relocation is at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of indoor occupancy).
The dose for the above extra 4-hour period is assumed to account for the dose during the period of waiting for the plume to leitve the area after termination of the release and the dose during people's transit to. the relocation areas.
~
0
~
en
~*
(!>
n 0
- l en
(!>
.g
(!>
- l n
(!>
en
- 11. Offsite Consequences Table 11.6 Sensitivity of mean CCDF of early fatalities to assumptions on offsite emergency response.
Exceedance 10-mile EPZ Early Fatalities (persons)
Frequency Emergency (ry-1)
Response Mode*
Surry Peach Bottom Sequoyah Grand Gulf Zion 10-5
- a. Evacuation 0/0 0/0 0
0 0
- b. Relocation 010 0/0 0
0 0
- c. Shelter 0
- d. Evac/Shelter 0
- a. Evacuation 0/0 0/0 0
0 0
- b. Relocation 0/0 0/2(1) 6(0) 0 6(0) 8
- c. Shelter 0
- d. Evac/Shelter 0
- a. Evacuation 0/0 0/0 5 (1) 0 2(2)
- b. Relocation 2(1)/0 1 (1)/1 (2) 7(1) 2(0) 1(3)
- c. Shelter 7(2)
- d. Evac/Shelter 2(2)
- a. Evacuation 4(1)/0 0/0 4(2) 0 3(3)
- b. Relocation 2(2)/0 7(1)/3(2) 2(2) 2(1) 8(3)
- c. Shelter 6(3)
- d. Evac/Shelter 3(3)
- a. Evacuation 1 (2)/1 (1) 0/0 2(3) 0 4(3)
- b. Relocation 9 (2)/5 (1) 2(2)/5(2) 6(2) 8(1) 2(4)
- c. Shelter 9(3)
- d. Evac/Shelter 4(3)
Note: Under each plant name, the first entry is for the internal initiators and the second entry is for fire.
- See Table 11.3 for assumptions.
- No data
- a. 6(0) = 6x10° = 6 thermal energy for the sequences with early con-tainment failure at vessel breach). Analyses of the sensitivity of early fatality CCDFs to sheltering, or a combination of evacuation and sheltering, have not been performed for Surry (nor for Peach Bot-tom, Sequoyah, and Grand Gulf).
11.6.2 Sensitivity of Latent Cancer Fatality and Population Exposure CCDFs to Radiological Protective Action Guide (PAG) Levels for Long-Term Countermeasures The potential for latent cancer fatalities and population exposure is assumed to exist down to any low level of radiation dose and, therefore, over the entire site region. Although both early and chronic exposure pathways contribute to these consequence measures, only the chronic exposure pathways are expected to be mitigated by the long-term countermeasures such as decontamination, temporary interdiction, or con-demnation of contaminated land, property, and foods based on guidance provided by responsible Federal agencies in terms of PAGs. This implies that, if the radiation dose to an individual from a NUREG-1150 11-12 OAGI0000611 00247
chronic exposure pathway would be projected to exceed the PAG (or intervention) level for that pathway, countermeasures should be undertaken to reduce the projected dose from the pathway so that it does not exceed the PAG level. Therefore, the latent cancer fatalities and the population ex-posures stemming from the chronic exposure pathways are expected to be sensitive to the PAG values.
The chronic exposure pathways base case PAGs are shown in Table 11.3. The only alternative PAG used for this sensitivity analysis is the RSS PAG for the groundshine dose to an individual for continuing to live in the contaminated environ-ment. The RSS PAG adopted here is 25-rem EDE from groundshine and inhalation of resuspended radionuclides (instead of the RSS 25-rem whole body dose from groundshine only) in 30 years.
This alternative is used to replace the base case PAG of 4-rem EDE in 5 years.
Summaries of the latent cancer fatality and popu-lation exposure mean CCDFs for both cases for the five plants for the internal initiating events are shown in Table 11.7.
- 11. Offsite Consequences Table 11.7 shows that there is practically no dif-ference between the consequence magnitudes for the five plants for the two PAGs for continuing to live in the contaminated environment at the ex-ceedance frequency of 10-5 per reactor year. This is because the source terms with frequency 10-5 per reactor year or higher have low release magni-tudes such that the resulting environmental con-taminations are below both the EPA and RSS PAG-based trigger levels for protective actions (i.e., no protective actions are needed).
At lower exceedance frequencies, source terms with larger release magnitudes contribute and the two PAGs reduce the consequences to different extents. The RSS PAG is less restrictive than the EPA PAG. *Thus, the long-term consequence magnitudes with the RSS PAG are generally higher than those with the EPA PAG at equal ex-ceedance frequencies. However, the economic consequences, discussed in the supporting con-tractor reports (Refs. 11.5 through 11.9), would show just the opposite behavior, i.e., economic consequences would be higher for the EPA PAG than for the RSS P AG.
11-13 NUREG-1150 OAGI0000611 00248
z c::
- Q 0
trl 0
Table 11.7 Sensitivity of mean CCDFs of latent cancer fatalities and population exposures to the PAGs l
for living in contaminated areas-internal initiating events.
~
(II V>
n 0
Exceedance Cancer Fatalities (persons) 50-Mile Pop. Exp. (person-rem)
Entire Region Pop. Exp. (person-rem) 0
- 1 Frequency (II (ry-1) 1*
2*
3*
4*
5*
1*
2*
3*
4*
5*
1*
2*
3*
4*
5*
..c s::
(II
- 1 10-5
()
(II EPA+
0 0
6(1)a 0
0 7(2) 0 1 (5) 0 5(3) 2(3) 0 4(5) 0 9(3)
RSS+
0 0
6(1) 0 0
7(2) 0 1 (5) 0 5(3) 2(3) 0 4(5) 0 9(3) 10-6 EPA 1 (3) 1 (3) 4(3) 3(2) 8(3) 1 (6) 3(6) 3(6) 2(5) 2(7) 8(6) 7(6) 2(7) 2(6) 5(7)
RSS 2(3) 2(3) 5(3) 3(2) 1(4) 2(6) 4(6) 5(6) 2(5) 3(7) 1(7) 1 (7) 3(7) 2(6) 8(7) 10-7 EPA 8(3) 8 (3) 9 (3) 1 (3) 3(4) 8(6) 1 (7) 8 (6) 6(5) 8(7) 5(7) 5(7) 6(7) 9(6) 2(8)
I.....
~
RSS 9(3) 1(4) 1(4) 2(3) 4(4) 1(7) 2(7) 1 (7) 1 (6) 2(8) 6(7) 7(7) 6(7) 1(7) 2(8) 10-8 EPA 2(4) 2(4).
2(4) 3 (3) 8(4) 2.(7) 2(7) 2(7) 1(6) 2(8) 1 (8) 1 (8) 9(7) 2(7) 3(8)
RSS 2(4) 4(4) 2(4) 4(3) 1(5) 2(7) 4(7) 2(7) 2(6) 3(8) 2(8) 2(8) 1(8) 2(7) 4 (8) 10-9 EPA 4(4) 4(4) 2(4) 6(3) 1(5) 3(7) 4(7) 4(7) 2(6) 4(8) 2(8) 2(8) 1(8) 3(7) 4(8)
RSS 5(4) 4(4) 3(4) 6(3) 4(7) 6(7) 4(7) 3(6) 4(8) 3(8) 5(8) 2(8) 4(7) 4(8)
- Plant Names: 1 = Surry; 2 = Peach Bottom; 3 = Sequoyah; 4 = Grand Gulf; 5 = Zion
+ Long-term relocation PAGs:
EPA = 4-rem EDE in 5 years from groundshine-an approximation of EPA-proposed long-term relocation PAG RSS = 25-rem EDE in 30 years from groundshine-RSS long-term relocation PAG a.6(1) = 6 X 101 = 60 0
)>
G>
0 0
0 0 (j)
I 0 0
~
~
<D
- 11. Offsite Consequences REFERENCES FOR CHAPTER 11 11.1 U.S.
Nuclear Regulatory Commis-sion, "Reactor Safety Study-An Assess-ment of Accident Risks in U.S. Commer-cial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.
11.2 D. I. Chanin, H. Jaw, J. A. Rollstin et al.,
"MELCOR Accident Consequence Code System (MACCS)," Sandia National Labo-ratories, NUREG/CR-4691, Vols. 1-3, SAND86-1562, February 1990.
11.3 U.S. Department of Health and Human Services/Food and Drug Administration, "Accidental Radioactive Contamination of Human Food and Animal Feeds; Recom-mendations for State and Local Agencies,"
Federal Register, Vol. 47, No. 205, pp.
47073-47083, October 22, 1982.
11.4 U.S. Environmental Protection Agency, "Manual of Protective Action Guides and Protective Actions for Nuclear Incidents,"
Draft, 1989.
- Available in the NRC Public Document Room, 2120 L Street NW., \\Vashington, DC.
11.5 R. J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, Octo-ber 1990.
11.6 A. C. Payne, Jr., et al., "Evaluation of Se-vere Accident Risks: Peach Bottom Unit 2,"
Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND86-1309, to be published.*
11.7 J. J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, De-cember 1990.
11.8 T. D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," San-dia National Laboratories, NUREG/
CR-4551, Vol.
6, Draft Revision 1,
SAND86-1309, to be published.*
11.9 C. K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551, Vol.
7, Draft Revision 1,
BNL-NUREG-52029, to be published.*
11-15 NUREG-1150 OAGI0000611 00250
- 12. PERSPECTIVES ON PUBLIC RISK 12.1 Introduction One of the objectives of this study has been to gain and summarize perspectives regarding risk to public health from severe accidents at the five studied commercial nuclear power plants. In this chapter, risk measures for these plants are com-pared and perspectives drawn from these com-parisons.
As discussed in Chapter 2, the quantitative assess-ment of risk involves combining severe accident sequence frequency data with corresponding con-tainment failure probabilities and offsite conse-quence effects. An important aspect of the risk estimates in this study is the explicit treatment of uncertainties. The risk information discussed here includes estimates of the mean and the median of the distributions of the risk measures and the 5th percentile and the 95th percentile vaiues. The risk results obtained have been analyzed with respect to major contributing accident sequences, plant-specific design and operational features, and acci-dent phenomena that play important roles.
The assessments of plant risk that support the dis-cussions of this chapter are discussed in detail in References 12.1 through 12.7 and summarized in Chapters 3 through 7 for the five individual plants.
Appendix C to this report provides more detailed information on certain technical issues important to the risk studies. This work was performed by Sandia National Laboratories (on the Surry, Se-quoyah, Peach Bottom, and Grand Gulf plants) and Idaho National Engineering Laboratory and Brookhaven National Laboratory (on the Zion plant).
12.2 Summary of Results Estimates of risk presented in Chapters 3 through 7 for the five plants studied are compared in this section. Risk measures that are used for these comparisons are: early fatality, latent cancer fa-tality, average individual early fatality, and aver-age individual latent cancer fatality risks for inter-nally initiated and externally initiated (fire) events (additional risk measures are provided in Refs.
12.3 through 12.7). For reasons discussed in Chapter 1, seismic risk is not discussed here.
In order to display the variabilities in the noted risk measures, the early fatality and latent cancer 12-1 fatality risk results of all five plants from internally initiated accidents are plotted together in Figure 12.1. Individual early fatality and latent cancer fa-tality risks from internally initiated accidents are compared with the NRC safety goals* (Ref. 12.8) in Figure 12.2. Similar risk results from externally initiated (fire) accidents for the Surry and Peach Bottom plants are presented in Figures 12.3 and 12.4. Estimates of the frequencies of a "large re-lease" of radioactive material (using a definition of large as a release that results in one or more early fatalities) are presented in Figure 12.5.
Based on the results of the risk analyses for the five plants, a number of general conclusions can be drawn:
The risks to the public from operation of the five plants are, in general, lower than the Reactor Safety Study (Ref. 12.10) estimates for two plants in 197 5. Among the five plants studied, the two BWRs show lower risks than the three PWRs, principally because of the much lower. core damage frequencies esti-mated for these two plants, as well as the mitigative. capabilities of the BWR suppres-sion pools during the early portions of severe accidents.
Individual early fatality and latent cancer fa-tality risks from internally initiated events for all of these five plants, and from fire-initiated accidents for Surry and Peach Bottom, are well below the NRC safety goals.
Fire-initiated accident sequences have rela-tively minor effects on the Surry plant risk compared to the risks from internal events but have a significant impact on Peach Bot-tom risk.
The Surry and Zion plants benefit from their strong and large containments and therefore have lower conditional early containment failure probabilities. The Peach Bottom and Grand Gulf have higher conditional prob-abilities of early failure, offsetting to some degree the risk benefits of estimated lower core damage frequencies for these plants.
~Throughout this report, discussion of and comparison with the NRC safety goals relates specifically and only to the two quantitative health objectives identified in the Commission's policy statement (Ref. 12.8).
NUREG-1150 OAGI0000611 00251
- 12. Public Risk Early fatality /ry 1.0E-03 1.0E-04 1.0E-05
~
~
r-
+
~
§ 1.0E-06
~
1.0E-07
~
Legend 1.0E-08 1.0E-09 f-f
§ r-mean median
~
Ul 1.0E-10
_l ASS PWR SURRY PEACH SEQUOYAH GRAND ZION RSS BWR BOTTOM GULF Latent cancer fatality/ry 1.0E+OO 1.0E-01 f-1.0E-02 1::
+
f-1.0E-03 lt Looond
["
=
n~**n 1-1.0E-04 I
ASS PWR SURRY PEACH SEQUOYAH GRAND ZION RSS BWR BOTTOM GULF Notes: As discussed in Reference 12.9, estimated risks at or below lE-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.
"+" indicates recalculated mean value based on recent modifications to the Zion plant (as discussed in Section C.l 5).
Figure 12.1 Comparison of early and latent cancer fatality risks at all plants (internal events).
NUREG-1150 12-2 OAGI0000611 00252
. 12. Public Risk 1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 1.0E-11 1.0E-05 1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 Individual early fatality/ry
=
=<:===Safety Goal
~
f-
§
§
§ SURRY
~
PEACH BOTTOM SEQUOYAH Individual latent cancer fatality/ry 1::
=
~
=
~-
<:===Safety Goal SURRY lt PEACH BOTTOM SEQUOYAH
~
GRAND GULF
~
GRAND GULF
- Legend i"
mean mldlan
&ll f-
+
ZION Legend ff" mean median 6$
r-*
+
ZION Notes:
As discussed in Reference 12.9, estimated risks at or below lE-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.
"+" indicates recalculated mean value based on recent modifications to the Zion plant (as discussed in Section C. 15).
Figure 12.2 Comparison of risk results at all plants with safety goals (internal events).
12-3 NUREG-1150 OAGI0000611 00253
- 12. Public Risk 1.0E-03 1.0E-04 1.0E-05 1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 1.0E+OO 1.0E-01 1.0E-02 1.0E-03 1.0E-04 Early fatality/ry E
~
~
~
~
~
~
SURRY FIRE Latent cancer fatality/ry f-
~
SURRY FIRE Legend ff" mean median 6\\11 Legend f'
mean median fillS PEACH BOTTOM FIRE 1-
~ J PEACH BOTTOM FIRE Note: As discussed in Reference 12.9, estimated risks at or below lE-? should be viewed with caution because of the potential impact of events not studied in the risk analyses.
Figure 12.3 Comparison of early and latent cancer fatality risks at Surry and Peach Bottom (fire-initiated accidents).
NUREG-1150 12-4 OAGI0000611 00254
1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 1.0E-11 1.0E-05 1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 Individual early fatality/ry E:
~
~
f-
~
¢=Safety Goal
~
SURRY FIRE Legend medl,n ['
mean 6Z 1-PEACH BOTTOM FIRE Individual latent cancer fatality/ry
§
~
~
~
<:===Safety Goal 0
SURRY FIRE
_Legend m&dlen K mean 611!
]-
PEACH BOTTOM FIRE
- 12. Public Risk Note: As discussed in Reference 12.9, estimated risks at or below lE-7 should be viewed with caution because of the potential impact of events not studierl in the risk analyses.
Figure 12.4 Comparison of risk results at Surry and Peach Bottom with safety goals (fire-initiated accidents).
12-5 NUREG-1150 OAGI0000611 00255
- 12. Public Risk Probability of a large release 1.0E-05=---------------------------------------------------~
1.0E-06 1.0E-07 1.0E-08 1.0E-09
~
1.0E-10 Lar1t ttltut
- Rtl.. tt tht oal!l re*utt In one 01 *ore eatly tatalltl...
Legend
~
Q6'll mean me<lten 6!1
~
+
SURRY PEACH SEQUOYAH GRAND ZION BOTTOM GULF Probability of a large release 1.0E-05 Llttl *******.. R*t**** that can r*autt In one or aar*
earl)' latalltl...
Legend 1.0E-06 ~
f mean medl*a F
1.0E-07 1.0E-08 § 1-1.0E-09 E
~
1.0E-10 SURRY-FIRE PEACH BOTTOM - FIRE Notes: As discussed in Reference 12.9, estimated risks at or below lE-7 should be viewed with cau-tion because of the potential impact of events not studied in the risk analyses.
"+" indicates recalculated mean value based on recent modifications to the Zion plant (as dis-cussed in Section C. 15).
Figure 12.5 Frequency of one or more early fatalities at all plants.
NUREG-1150 12-6 OAGI0000611 00256
The principal challenges to containment structures vary considerably among the five plants studied. Hydrogen combustion is a sig-nificant threat to the Sequoyah and Grand Gulf plants (in part because of the. inop-erability of ignition systems in some key acci-dent sequences), while direct attack of the containment structure by molten core mate-rial is most important in the Peach Bottom plant. Few physical processes were identified that could seriously challenge the Surry and Zion containments.
Emergency response parameters (warning time, evacuation speed, etc.) appear to have a significant impact on early fatality risk but almost no effect on latent cancer fatality risk.
12.3 Comparison with Reactor Safety Study Results of the present study (for internal initia-tors) are compared with the Surry and Peach Bot-tom results in the Reactor Safety Study (RSS) in Figure 12.1. In general, for the early fatality risk measure, the Surry risk estimates in this study are lower than the corresponding RSS PWR values.
Similarly, the present Peach Bottom risk estimates are lower than the RSS BWR estimates. For the latent cancer fatality risk measure, the patterns in the results are less clear; the RSS risk estimates for both of the plants lie in the upper portion of the risk estimates of this study.
Focusing on the major contributors to risk, it may be seen that, in the RSS, the Surry risk was domi-nated by interfacing-system LOCA (the V se-quence), station blackout (TMLB'), and small LOCA sequences, with hydrogen burning and overpressure failures of containment. While the estimated risks of the interfacing-system LOCA accident sequence are lower in the present study because of a lower estimated frequency, it is still an important contributor to risk. Also important (because of their large source terms) are contain-ment bypass accidents initiated by steam genera-tor tube rupture, compounded by operator errors (which result in core damage) and subsequent stuck-open safety-relief valves on the secondary side. Early overpressurization containment failure at Surry is much less probable.
In the Peach Bottom analysis of the RSS, risk was dominated by transient-initiated events with loss of heat removal (TW type of sequence) and ATWS accidents with failure of containment prior
- 12. Public Risk to vessel breach. Dominant containment failure modes were from steam overpressurization. In the present study, risk is dominated by long-term sta-tion blackout and A TWS accident sequences. The dominant containment failure mode is drywell meltthrough.
The RSS did not perform an analysis of accidents initiated by fires. As such, comparisons of the pre-sent study's fire risk estimates with the RSS are not possible.
Since the publication of the RSS in 197 5, a vast amount of work has been done in all areas of risk analysis, funded by government agencies and the nuclear industry. Major improvements have been made in the understanding of severe accident phenomenology and approaches to quantification of risk, many of which have been used in this study. These efforts have helped in lowering the estimates of overall risk levels in the present study to some extent by reducing the use of conservative and bounding types of analyses. Equally impor-tant, some plants have made modifications to plant systems or procedures based on PRAs, les-sons learned from the Three Mile Island accident, etc., thus reducing risk. On the other hand, new
- issues have been raised and the possibility of new phenomena such as direct containment heating and drywell meltthrough has been introduced, which added to the previous estimates of risk. For issues that are not well understood, expert judg-ments were elicited that frequently showed diverse conclusions. The net effect of this improved un-derstanding is that total plant risk estimates are lower than the RSS estimates, but the distributions of these risk measures are very broad.
12-7 12.4 Perspectives As discussed above, plant-specific features con-tribute largely to the estimates of risks. In order to compare the variables and characteristics of the three PWR plants (Surry, Sequoyah, and Zion) and two BWR plants (Peach Bottom and Grand Gulf) in this study, the dominant contributors to early and latent cancer fatality risks for the PWRs and BWRs from internally initiated events are shown in Figures 12.6 through 12.10. Dominant contributors to risk from fire-initiated accidents for Surry and Peach Bottom are compared in Fig-ure 12.9. Perspectives on risks for the five plants from these comparisons, supplemented by infor-mation in the supporting contractor reports (Refs.
12.1 through 12.7) are discussed below.
NUREG-1150 OAGI0000611 00257
- 2E*B/RY Plant Damage States
- 1. 880
- 2. ATW8
- 11. 'TRANSIENTS
- 4. LOCA
- e. av""ss M EAH
- 2.BE-5/RY 4 2 2
4 Plant Damage States
- 1. 880
- 2. ATWS
- s. TRANSIENTS
- 4. LOCA.
- 11. IIYPASB MEAN
- 1.4E*2/RY 5
ZION EARLY FATALITY ZION LATENT CANCER FATALITY MEAN
- 1.1E*.t/RY 4
MEAN
- 2.4E*2/RY 5
Plant Damage States
'L SBO
- 2. ATW8
- 3. TRAN81EHT8
"* LOCA II. BYPASS Figure 12.6 Contributions of plant damage states to mean early and latent cancer fatality risks for Surry, Sequoyah, and Zion (internal events).
NUREG-1150 12-8 OAGI0000611 00258
MEAN
- Z.OE*$/RY 2
3 GRAND GULF EARLY FATALITY MEAN
- 8.2E-~/RY 1
4 MEAN
- 4.0E-3/RY Plant Damage States 3
- 1. LOCA
- 2. SBO
- 3. ATWS
.... TRANSIENTS 1
4 GRAND GULF LATENT CANCER FATALITY 1
3 2
MEAN
- O.GE*-4/RY Plant Damage States
- 1. LONG TERM 8BO
- 2. SHORT TERM SBO
- 3. ATWS
- 4. TRANSIENTS 1
3 Figure 12.7 Contributions of plant damage states to mean early and latent cancer fatality risks for Peach Bottom and Grand Gulf (internal events).
12-9 NUREG-1150 OAGI0000611 00259
- 21E-8/RV UI!AN
- 1.21!-lii/RV Accident Progression Blna
- 1. VII, Early CF, Alpba Modo
- 2. VB, Early CF. RCS Pteeeure *200 pela at Y8 lll. VII, Early CF, RCII Pl'901Ul'9 <200 pola ol \\'II
- 4. VII, BMT aod Lolo Ltak ll,llypa..
- 2.11E-e/RY WEAN
- 1.41!-2/RY 3
1 9
Accident Progression Bins 7
- 2. VII, ECF, Alpha Modo
~. VB. ECF, R08 Prea*ure*200 IP*I* at VB
&. VII, No CF
MEAN
- 2.4E-2/AY Accident Progression Bins
- 1. IVM.SII
- a. EARLY CONT. r#.ILURI!
Figure 12.8 Contributions of accident progression bins to mean early and latent cancer fatality risks for Surry, Sequoyah, and Zion (internal events).
NUREG-1150 12-10 OAGI0000611 00260
- 2.8E*8/fiY MEAN
- 4.8E*3/RY 4
Accident Progression Bins
-1. VB, ECF, DW Failure, V Preaa<200 pala at VB
- 7. VB, Vent
- 9. No VB 4
7 6
GRAND GULF EA8LY FATALITY GRAND GULF LATENT CANCER FATALITY MEAN
- 8.2E*9/RY MEAN
- 9.15E*4/RV 2
3 8
5 4
5 Accident Progression Bins
- 1. *va, ECf', EARLY SP BYPASS, CONT. SPRAYS NOT AVAIL.
&,VB, VENT
- 8. NO VB 8
Figure 12.9 Contributions of accident progression bins to mean early and latent cancer fatality risks for Peach Bottom and Grand Gulf (internal events).
12-11 NUREG-1150 OAGI0000611 00261
- 12. Public Risk SURRY EARLY FATALITY (FIRE)
SURRY LATENT CANCER FATALITY (FIRE) 2 MEAN
- 3.8E~8/RY MEAN
- 2.7E-4/RY 3
Accident Progression Bins
- 4. VB, BMT and Late Leak
- 5. Bypaaa
PEACH BOTTOM LATENT CANCER FATALITY (FIRE) 3 MEAN
- 3.5E-7/RY 1
6 4
Accident Progression Bins MEAN
- 3.4E-2/RY
- 7. VB, Vent
- 9. No VB Figure 12.10 Contributions of accident progression bins to mean early and latent cancer fatality risks for Surry and Peach Bottom (fire-initiated accidents).
NUREG-1150 12-12 OAGI0000611 00262
Accident Sequences Important to Risk Mean early fatality risks at Surry and Se-quoyah and latent cancer fatality risk at Surry are dominated by bypass accidents (Event V and steam generator tube rupture accidents). Sequoyah latent cancer risk is dominated equally by loss of offsite power se-quences and bypass accidents. The risk at Zion is dominated by medium LOCA se-quences resulting from the failure of reactor coolant pump seals, induced by failures of the component cooling water system (CCWS) or service water system. Zion has the feature that CCWS (supported by the service water system) cools both the reactor coolant pump seals and high-pressure injection pump oil coolers, thus creating the potential for a common-mode failure.
(As discussed in Chapter 7, steps have been taken by the plant licensee to address this dependency.)
BWR risks are driven by events that fail a multitude of systems (i.e., reduce the redun-dancy through some common-mode or sup-port system failure) or events that require a small number of systems to fail in order to get to core damage, such as ATWS !?equences.
The accidents important to both early fatality and latent cancer fatality risk at Peach Bot-tom are station blackouts and ATWS; the ac-cident most important at Grand Gulf is sta-tion blackout.
For the Peach Bottom plant, the estimated risks from accidents initiated by fires, while low, are greater than those from accidents in-itiated by internal events. Fire-initiated acci-dents are similar to station blackout accidents in terms of systems failed and accident pro-gression. As such, the conditional probability of early containment failure is relatively *high, principally due to the drywell shell melt-through failure mode (see Chapter 9 for ad-ditional discussion) (the conditional probabil-
.ity is somewhat higher because of the lower probability of ac power recovery). For the Surry plant, the fire risks are estimated to be smaller than those from internal events. This is because of two reasons: the frequency of core damage from fire initiators is lower; and fire-initiated accidents result in low condi-tional probabilities of early containment fail-ure. As noted above, the internal-event risks are dominated by containment bypass acci-dents.
- 12. Public Risk Containment Failure Issues Important to Risk At
- Surry, containment bypass events (interfacing-system LOCAs and steam gen-erator tube ruptures) are assessed to be most important to risk. Other containment failure modes of less importance are: static failure at the containment spring line from loads at vessel breach (i.e., direct containment heat-ing loads, hydrogen burns, ex-vessel steam explosion loads, and steam blowdown loads);
or containment failure from in-vessel steam explosions (the "alpha-mode" failure of the Reactor Safety Study). These failure modes have only a small probability of resulting in early containment failure.
At Zion, the conditional probability of early containment failure is small, comparable to that of Surry. Those containment failure modes that contribute to this small failure probability include alpha-mode failure, con-tainment isolation failure, and overpress-urization failure at vessel breach.
In previous studies, the potential impact of direct containment heating loads was found to be very important to risk. In this study, the potential impact is less significant for the Surry and Zion plants. Reasons for this re-duced importance include:
Temperature-induced and other depres-surization mechanisms that reduce the probability of reactor vessel breach at high reactor coolant system pressure, either eliminating direct containment heating (DCH) or reducing the pressure rise at vessel breach. These depressuri-zation mechanisms are stuck-open power-operated relief valves, reactor coolant pump seal failures, accident-in-duced hot leg and. surge line failures, and deliberate opening of PORVs by op-erators; and The size and the strength of the Surry containment (the maximum DCH load has only a conditional probability of 0.3 of failing the containment).
Additional discussion of the issue of direct containment heating may be found in Section 9.4.3 and Section C.5 of Appendix C.
At Sequoyah, containment bypass events are assessed to be most important to mean early fatality risk. Another failure important to 12-13 NUREG-1150 OAGI0000611_00263
- 12. Public Risk early fatality risk is early failure of contain-ment. In particular, the catastrophic rupture failure mode dominates early containment failures, which occur as a result of pre-vessel-breach hydrogen events and failures at vessel breach. The failures at vessel breach are the result of a variety of load sources (individu-ally or in some combinations), including di-rect containment heating loads, hydrogen burns, direct contact of molten debris with the steel containment, alpha-mode failures, or loads from ex-vessel steam explosions.
The bypass mode of containment failure and early containment failures dominate the mean latent cancer risk at Sequoyah and contribute about equally to this consequence measure.
At Peach Bottom, drywell meltthrough is the most important mode of containment fail-ure. Other containment failure modes of im-portance are: drywell overpressure failure, static failure of the wetwell (above as well as below the level of the suppression pool), and static failure at the drywell head.
At Grand Gulf, the risk is most affected by containment failures in which both the dry-well and the contai~ment fail. As discussed in Chapter 9, roughly one-half the contain-ment failures analyzed in this study also re-sulted in drywell failure. The principal causes of the combined failures were hydrogen com-bustion in the containment atmosphere and loads at reactor vessel breach (direct contain-ment heating, ex-vessel steam explosions, or steam blowdown from the reactor vessel).
Source Term and Offsite Consequence Issues Important to Risk BWR suppression pools provide a significant benefit in severe accidents in that they effec-tively trap radioactive material (such as io-dine and cesium) released early in the acci-dent (before vessel breach) and, for some containment failure locations, after vessel breach as well.
Accidents that bypass the containment struc-ture compromise the many mitigative fea-tures of these structures and thus can have significant estimated radioactive releases. As noted above, such accidents dominated the risk for the Surry and Sequoyah plants.
The design of the reactor cavity can signifi-cantly influence long-term releases of radio-active material; if large amounts of water can enter the cavity (e.g., as at Sequoyah), re-leases during core-concrete interactions can be significantly mitigated.
Site parameters such as population density and evacuation speeds can have a significant effect on some risk measures (e.g., early fa-tality risk). Other risk measures, such as la-tent cancer fatality risk and individual early fatality risk, are less sensitive to such parame-ters. Latent cancer fatality risks are sensitive to the assumed level of interdiction of land and crops. (These issues are discussed in more detail below.)
Factors Important to Uncertainty in Risk In order to identify the principal sources of uncer-tainties in the estimated risk, regression analyses have been performed for each of the plants in this study. A stepwise linear model is used, and, in general, the dependent variable is a risk measure (e.g., early fatalities per year) although some study has been done on the Surry plant using fre-quencies of radionuclide releases (discussed in Section 10.4.3). The independent variables con-sisted of individual parameters and groups of cor-related parameters. Also, the analyses are gener-ally performed for the complete risk model, although in some cases analyses are performed on specific plant damage states. The extent to which this model accounted for the overall uncertainty (the R-square value) varied considerably, from roughly 30 percent in the analysis of latent cancer fatality risk in the Sequoyah plant to roughly 7 5 percent in the analysis of early fatality risk in the Surry plant.
The results of the regression analyses indicate the following:
For Surry, the uncertainty in all risk meas-ures is dominated by the uncertainties in pa-rameters determining the frequencies of con-tainment bypass accidents (interfacing-system LOCA and steam generator tube rupture (SGTR)) and the radioactive release magni-tudes of these accidents. More specifically, the most important parameters are the initiat-ing event frequencies for these bypass acci-dents, the fraction of the core radionuclide inventory released into the vessel, and the fraction of material in the vessel in an SGTR-initiated core damage accident that is re-leased to the environment. With the high risk importance of bypass accidents, it is not sur-prising that uncertainties in bypass accident parameters are important to risk uncertainty, NUREG-1150 12-14 OAGI0000611 00264
while other parameters such as those relating to source terms in containment, containment strength, etc., are not found to be important.
For Zion, the regression analyses also indi-cated that accident frequency and source term parameter uncertainties were most im-portant. More specifically, the most impor-tant parameters were the initiating event fre-quencies for loss of component cooling water (CCW)/service water (SW), the failure tore-cover CCW /SW, the fraction of the core radionuclide inventory released into the ves-sel, ~he radionuclide containment transport fractiOn at vessel breach, and the fraction of radionuclides released to the environment through the steam generators. The impor-tance of the loss of CCW /SW frequencies is not surprising, given the large contribution of accidents initiated by these events to the core damage frequency. Also, those source term parameters that influence the release frac-tions for early containment failure and bypass events are not surpi"isingly important to some risk measures. The only accident progression parameter that was demonstrated to be im-portant to the uncertainty in risk was the probability of vessel and containment breach by an in-vessel steam explosion. This result occurs because the probability of early con-tainment failure from all other causes is ex-tremely low at Zion, so that (at these very low probability levels) uncertainty in the in-vessel steam explosion failure mode becomes more significant. The importance of the steam explosion failure mode is also more significant because the accident progression analysis for Zion indicates that the reactor coolant system (RCS) is not likely to be at high pressure when vessel breach occurs.
This means that loads at vessel breach from direct containment heating are likely to be smaller than would have been the case if RCS pressure were high. Also, at low RCS pres-sure, the probability of triggering an in-vessel steam explosion is increased.
For Sequoyah, the regression analysis for the complete risk model did not account for a large fraction of the uncertainty. As such, re-gression analyses were performed for individ-ual plant damage states (PDSs). For the con-tainment bypass PDSs (which dominated the mean risk at Sequoyah), the most important uncertainties related to accident frequency and source term issues. More specifically, for the interfacing-system LOCA PDS, the most 12-15
- 12. Public Risk important parameter uncertainties were those for the initiating event frequency, the prob-ability that releases will be scrubbed by fire sprays in the vicinity of the break, and the decontamination factor of the fire sprays.
For the SGTR-initiated core damage acci-dent, the most important parameters are the initiating event frequency, the fraction of the core radionuclide inventory released into the vessel, and the fraction of material in the ves-sel that is released to the environment.
For the station blackout, LOCA, and tran-sient plant damage states, the uncertainty in early fatality risk is accounted for by parame-ters from the accident frequency, accident progression, and source term analysis, with none of these groups or any small set of pa-rameters dominating. In this circumstance, the parameters relating to the containment failure pressure, the fraction of the core par-ticipating in a high-pressure melt ejection, and the pressure rise at vessel breach for low-pressure accident sequences appeared as somewhat important for each of these plant damage states (but, again, did not by them-selves or in combination dominate the uncer-tainty estimation).
For Peach Bottom, the regression analysis for the complete internal-event model indicated that the risk uncertainty is dominated by un-certainties in radioactive release uncertain-ties-more specifically, the dominating pa-rameters relating to the fraction of the core radionuclide inventory released into the ves-sel before vessel breach, the fraction of the radionuclide inventory released during core-concrete interaction that is released from containment, and the fraction of the radio-nuclide inventory remaining in the core ma-terial at the initiation of core-concrete inter-action that is released during that interaction.
The regression analysis on the fire risk model does not show such a clear domination by any parameters. The early fatality risk uncer-tainty is dominated by radioactive release parameters (the fraction of core radionuclide inventory released to the vessel before vessel breach, the fraction of radionuclide inven-tory remaining in the core material at the initiation of core-concrete interaction that is released during that interaction, and the frac-tion of the radionuclide inventory released during core-concrete interaction that is released from containment). The latent can-cer fatality risk uncertainty is dominated by NUREG-1150 OAGI0000611 00265
- 12. Public Risk accident frequency parameters (fire initiating event frequencies, diesel generator failure-to-run probability).
For Grand Gulf, the uncertainty in early health effect parameters (early fatalities and individual early fatalities within 1 mile) is not dominated by any small set of parameters.
Rather, it is accounted for by a number of parameters that determine the frequencies and radioactive release magnitudes of those events leading to early containment failure, such as the amount of hydrogen generated during the in-vessel portion of the accident progression, and the frequency of loss of off-site power. The uncertainties in the other risk measures are dominated by uncertainties in accident frequency parameters (including loss of offsite power frequency, diesel genera-tor failure-to-start probability, diesel genera-tor failure-to-run probability, and the prob-ability that the batteries fail to deliver power when needed).
Impact of Emergency Response and Protective Action Guide Options Sensitivity calculations were performed as a part of this study to assess the impacts of different emergency response and protective action guide options on estimates of risks for the five plants.
Emergency Response Options In order to study the effects of emergency re-sponse options under severe accident conditions on public risk, the plants were analyzed using the following assumptions, and changes in the early fatality risk were calculated:
Base Case: 99.5 percent evacuation from 0 to 10 miles Option 1:
100 percent evacuation from 0 to 10 miles Option 2:
0 percent evacuation with early relocation from high contamination areas Option 3:
100 percent sheltering Option 4:
100 percent* evacuation from 0 to 5 miles and 100 percent sheltering from 5 to 10 miles NUREG-1150 The last two options are used in the Zion plant analysis only. Results of the analyses are pre-sented in Figure 12.11.
As discussed in Section 11.3, radionuclide release magnitudes associated with the early phase of an accident for Peach Bottom and Grand Gulf are typically smaller than thOse for the other three plants because of the mitigative effects of suppres-sion pool scrubbing. The source term groups for Peach Bottom and Grand Gulf were typically found to have longer warning times than for the PWRs studied because the accident sequences de-veloped more slowly. Further, Peach Bottom and Grand Gulf have very low surrounding population densities, which leads to shorter evacuation delays and higher evacuation speeds. The effect of all these considerations is that, for Peach Bottom and Grand Gulf, evacuation is more effective in reduc-ing early fatality risk than for Surry, Sequoyah, and Zion.
For Surry and Sequoyah, the risk-dominant acci-dent is the interfacing-system LOCA (the V se-quence). This accident has a very short warning time, and, consequently, evacuation actions are not very effective. Also for Sequoyah, some high-consequence releases occur from containment failure at vessel breach; these releases are highly energetic and cause plume rise. This reduces early fatality risk, as is indicated in the case of Option 2 for Sequoyah; however, this also reduces the ef-fectiveness of evacuation. Further details on emergency response options are provided in Chapter 11.
Protective Action Options In this study an interdiction criterion of 4 rems (effective dose equivalent (EDE)) in 5 years has been used for groundshine and inhalation of re-suspended radionuclides. Sensitivity calculations have been performed using the equivalent of the Reactor Safety Study (RSS) criterion, i.e., 25-rem EDE in 30 years. The impact of such an alterna-tive criterion on mean latent cancer fatality risk is shoWn in Figure 12.12. As may be seen, the RSS criterion is less restrictive than the criterion used in this study, and the corresponding latent cancer fatalities using the RSS criterion are higher by 12 percent (for Grand Gulf) to 47 percent (for Peach Bottom).
12-16 OAGI0000611_00266
- 12. Public Risk Early fatality/ry 1.0E-03 ~:E r-SURRY PEACH BOTTOM 1.0E-04
~
2 2
1.0E-05 §8 1
1.0E-06 ~
B 1.0E-07
~* =
1.0E-08 ~ -
r-1.0E-09 § 1
rvl SEQUOYAH B
1 2
GRAND GULF 2
B 1
ru rv ZION B
1 2
3 LEGEND 1::::
.. ED IAN CON TO.
BELOW 1 liTH 4
1.0E-1 0..___ __
-.~. ____
---1.._ ____
L._ ____
___J BASE CASE (B) 99.5% Evacuation from 0 to 10 miles EMERGENCY RESPONSE OPTIONS (1 TO 4}
- 1. 100% Evacuation from 0 to 10 miles
- 2. 0% Evacuation with early relocation from high contamination areas
- 3. 100% Sheltering
- 4. 100% Evacuation from 0 to 5 miles, and 100% sheltering from 5 to 10 miles Note: As discussed in Reference 12. 9, estimated risks at or below lE-7 should be viewed with caution because of the potential impact of events not studied in the risk analyses.
Figure 12.11 Effects of emergency response assumptions on early fatality risks at all plants (internal events).
12-17 NUREG-1150 OAGI0000611 00267
- 12. Public Risk MEAN LATENT CANCER FATALITY RISK/YR 0.05~------------------------------------~
0.04 0.03 0.02 0.01 0
SURRY SEQUOYAH PEACH BOTTOM GRAND GULF m:ti!~!~!f!'@j BASE CASE
-RSS PAG ZION Figure 12.12 Effects of protective action assumptions on mean latent cancer fatal-ity risks at all plants (internal events).
NUREG-1150 12-18 OAGI0000611 00268
- 12. Public Risk REFERENCES FOR CHAPTER 12 12.1 E. D. Gorham-Bergeron et al., "Evalu-ation of Severe Accident Risks: Method-ology for the Accident Progression, Source Term, Consequence, Risk Integra-tion, and Uncertainty Analyses," Sandia National Laboratories, NUREG/CR-4551, Vol. 1, DraftRevision 1, SAND86-1309, to be published.
- 12.2 F. T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major lnput Parameters," Sandia National Lab-oratories, NUREG/CR-4551, Vol.
2, Revision 1, SAND86-1309, December 1990.
12.3 R. J. Breeding et al., "Evaluation of Se-vere Accident Risks: Surry Unit 1," San-dia National Laboratories, NUREG/
CR-4551, Vol. 3, Revision 1, SAND86-1309, October 1990.
12.4 A. C. Payne, Jr., et al., "Evaluation of Severe Accident Risks:
Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND86-1309, to be published.
- 12.5 J. J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," San-
- Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
12-19 dia National Laboratories, NUREG/
CR-4551, Vol. 5, Revision 1, SAND86-1309, December 1990.
12.6 T. D. Brown et al., "Evaluation of Severe Accident Risks:
Grand Gulf Unit 1,"
Sandia National Laboratories, NUREG/
CR-4551, Vol.
6, Draft Revision 1,
SAND86-1309, to be published.
- 12.7 C. K. Park et al., "Evaluation of Severe Accident Risks:
Zion Unit 1," Brook-haven National Laboratory, NUREG/
CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.*
12.8 USNRC, "Safety Goals for the Operation of Nuclear Power Plants; Policy State-ment," Federal Register, Vol. 51, p.
30028, August 21, 1986.
12.9 H. J. C. Kouts et al., "Special Committee Review of the Nuclear Regulatory Com-mission's Severe Accident Risks Report (NUREG-115 0), " NUREG-14 20, August 1990.
12.10 USNRC, "Reactor Safety Study-An As-sessment of Accident Risks in U.S. Com-mercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.
NUREG-1150 OAGI0000611 00269
- 13. NUREG-1150 AS A RESOURCE DOCUMENT 13.1 Introduction NUREG-1150 is one element of the NRC's pro-gram to address severe accident issues. The entire program was discussed in a staff document entitled "Integration Plan for Closure of Severe Accident Issues" (SECY-88-147) (Ref. 13.1).
NUREG-11 50 is used to provide a snapshot of the state of the art of probabilistic risk analysis (PRA) technology, incorporating improvements since the issuance of the Reactor Safety Study (Ref. 13.2).
This chapter discusses the results of NUREG-11 50 (and its supporting contractor studies, Refs. 13.3 through 13.16) as a resource document and examines the extent to which infor-mation provided in the document can be applied in regulatory activities. This is accomplished by applying NUREG-1150 results and principles to selected regulatory issues to illustrate how the in-formation and insights described in Chapters 3 through 12 of this document can be used in the regulatory process. The discussion will concen-trate on technical issues although it is recognized that there are other issues (e.g., legal, procedural) that must be taken into account when making regulatory decisions.
This report includes an examination of the severe accident frequencies and risks and their associ-ated uncertainties for five licensed nuclear power plants and uses the latest source term information available from both the NRC and its contractors and the nuclear industry. The information in the report provides a valuable resource and insights to the various elements of the severe accident inte-gration plan. The information provided and how it will be used include the following:
Probabilistic models of the spectrum of possi-ble accident sequences, containment events, and offsite consequences of severe accidents for use in:
Development of guidance for the indi-vidual plant examinations of internally and externally initiated accidents; Accident management strategies; Analysis of the need and appropriate means for improving containment per-formance under severe accident condi-tions; 13-1 Characterization of the importance of plant operational features and areas po-tentially requiring improvement; Analysis of alternative safety goal imple-mentation strategies; and Emergency preparedness and conse-quences.
Data on the major contributing factors to risk and the uncertainty in risk for use in:
Prioritization of research; Prioritization of generic issues; and Use of PRA in inspection.
In the following sections, these uses will be dis-cussed in greater detail, using examples based on the risk analysis results discussed in previous chapters.
13.2 Probabilistic Models of Accident Sequences NUREG-1150 identifies the dominant accident sequences and plant features contributing signifi-cantly to risk at a given plant as well as the plant models used in the study. The plant models and results underlying the report can be used to sup-port the development of staff guidance on licensee-performed studies (individual plant ex-aminations, accident management studies) and staff work in other areas related to severe acci-dents (e.g., improving containment performance under severe accident conditions). Such uses are discussed in greater detail in the following sec-tions.
13.2.1 Guidance for Individual Plant Examinations Plant-specific PRAs have yielded valuable per-spectives on unique plant vulnerabilities. The NRC and the nuclear industry both have consider-able experience with plant-specific PRAs. This ex-perience, coupled with the interactions of NRC and the nuclear industry on severe accident is-sues, have resulted in the Commission's formulat-ing an integrated systematic approach to an ex-amination of each nuclear power plant now operating or under construction for possible sig-nificant risk contributions (sometimes called "out-liers") that might be plant specific and might be NUREG-1150 OAGI0000611 00270
- 13. Resource Document missed without a systematic approach. In Novem-ber 1988, the NRC requested (by generic letter) that each licensed nuclear power plant perform an individual plant examination (IPE) to identify any plant-specific vulnerabilities to severe accidents (Ref. 13.17). The technical data generated in the course of preparing NUREG-1150 on severe acci-dent frequencies, risks, and important uncertain.;
ties were used in developing the analysis require-ments described in the IPE generic letter and the supplemental guidance on the IPE external-event analysis (Ref. 13.18).
- These studies will also aid the staff in evaluating individual submittals, assess-ing the adequacy of the identification of plant-specific vulnerabilities by the licensee, and evalu-ating any associated potential plant modifications.
The extent to which NUREG-1150 results are ap-plicable to different classes of reactors or to oper-ating U.S. light-water reactors as a group is illus-trated in Table 13.1. The generic insights presented in NUREG-1150 are indicative of items that may be applicable within a class of plants.
This includes the identification of possible vul-nerabilities that may exist in plants of similar de-sign. These insights cannot be assumed to apply to a given plant without consideration of plant design and operational practices because of the design differences that exist in U.S. plants, particularly those involving ancillary support systems (e.g., ac power, component cooling water) for the engi-neered safety features and differences in details of containment design.
For some issues, the state of knowledge is very limited, and it is not possible to identify plant-specific features that may influence the issue be-cause sensitivity analyses have not been per-formed. In other cases, the methodology is broadly applicable, but the results are highly plant specific. In spite of the plant-specific nature of many of the results, much can be learned from one plant that can be applied to another. Example types of generic applicability are presented in Ta-ble 13.1.
The NUREG-1150 methods refer not only to the analytical techniques employed but the general structure and framework upon which the analyses were conducted. These methods include the un-certainty analysis, expert elicitation methods, acci-dent progression event tree analysis, and source term modeling. The general approaches adopted
- In addition, NUREG-1150 provides extensive and de-tailed analyses of five nuclear power plants and thus of-fers licensees of those plants an opportunity to use these studies in developing their IPEs and submitting them on an expedited basis.
NUREG-1150 in these analysis procedures are not plant specific and are therefore adaptable to other plant analy-ses.
As noted above, plant-specific PRAs have yielded valuable perspectives on unique plant vul-nerabilities. These perspectives are, in general, not directly applicable to other plants, although they provide useful information to the study of plants of similar NSSS (nuclear steam supply sys-tem) and containment design. At the present time, the principal contributors to the likelihood of a core damage accident at boiling. water reac-tors (BWRs) include sequences related to station blackout or anticipated transients without scram (A TWS). Accident sequences making important contributions to the frequency of core damage ac-cidents at pressurized water reactors (PWRs) in-clude those initiated by a variety of electrical power system disturbances (loss of a single ac bus, which initiates a transient; loss of offsite portions of the equipment needed to respond to the tran-sient; loss of offsite power; and complete station blackout),
small loss-of-coolant accidents (LOCAs), loss of coolant support systems such as the component cooling water system, ATWS, and interfacing-system LOCAs or steam generator tube ruptures in which reactor coolant is released outside the containment boundary. All have the potential for being important at PWRs.
13-2 NUREG-1150 provides a wide spectrum of phenomenological and operational data (much of it of a very detailed nature). For example, infor-mation on hydrogen generation has been com-piled from experimental and calculational results as well as interpretations of these data by experts.
This data base provides an important source of information that may be used for NSSS contain-ment types similar to those studied here but is somewhat less applicable for different NSSS con-tainment types. The operational data base in-cludes component failure rates, maintenance times, and initiating-event frequency data. Much of these data are generic in nature and thus appli-cable for selected classes of plants.
The analyses presented in Chapters 3 through 7, when combined with the information gained from earlier PRA work sponsored by both NRC (e.g.,
Ref. 13.19) and utilities, make it clear that the quantitative results (core damage frequencies and risk results) calculated for internal and external initiators cannot be considered applicable to an-other plant, even if the plant has a similar NSSS design and the same architect-engineer was in-volved in the design of the balance of plant.
OAGI0000611_00271
- 13. Resource Document Table 13.1 Utility of NUREG-1150 PRA process to other plant studies.
Applicability Example Results Class of Plants Plant Population
- 1.
Methods (e.g., uncertainty, elicitation, event tree/
fault tree) high high
- 2.
General perspectives (e.g., principal contributors to core damage frequency and risk) medium low
- 3.
Supporting data base on design features, operational characteristics, and phenomenology (e.g., hydrogen generation in core damage accidents, operational data) high medium
- 4.
Quantitative results (e.g., core damage frequency, containment performance, risk) low low Site-specific requirements and differing utility re-quirements often lead to significant differences in support system designs (e.g., ac power, de power, service water) that can significantly influence the response of the plant to various potential acci-dent-initiating events. Further, different opera-tional practices, including maintenance activities and techniques for monitoring the operational re-liability of components or systems can have a sig-nificant influence on the likelihood or severity of an accident.
13.2.2 Guidance for Accident Management Strategies Certain preparatory and recovery measures can be taken by the plant operating and technical staff that could prevent or significantly mitigate the consequences of a severe accident. Broadly de-fined, such "accident management" includes the measures taken by the plant staff to (1) prevent core damage, (2) terminate the progress of core damage if it begins and retain the core within the reactor vessel, (3) maintain containment integrity as long as possible, and finally ( 4) minimize the consequences of offsite releases. In addition, acci-dent management includes certain measures taken before the occurrence of an event (e.g., improved training for severe accidents, hardware or proce-dure modifications) to facilitate implementation of accident management strategies. With all these factors taken together, accident management is viewed as an important means of achieving *and maintaining a low risk from severe accidents.
Under the staff program, accident management programs will be developed and implemented by 13-3 licensees. The NRC will focus on developing the regulatory framework under which the industry programs will be developed and implemented, as well as providing an independent assessment of licensee-proposed accident management capa-bilities and strategies. NUREG-1150 has been used by the NRC staff to support the development of the accident management program. NUREG-115 0 methods provide a methodological frame-work that can be used to evaluate particular strategies, and the current results provide some in-sights into the efficacy of strategies in place or that might be considered at the NUREG-1150 plants.
Thus, the NUREG-1150 methods and results will support a staff review of licensee accident man-agement submittals.
PRA information has been used in the past to in-fluence accident management strategies; however, the methods used in NUREG-1150 can bring added depth and breadth to the process, along with a detailed, explicit treatment of uncertainties.
The integrated nature of the methods is particu-larly important, since actions taken during early parts of an accident can affect later accident pro-gression and offsite consequences. For example, an accident management strategy at a BWR may involve opening a containment vent. This action can affect such things as the system response and core damage frequency, the retention of radioac-tive material within the containment, and the tim-ing of radionuclide releases (which impacts evacu-ation strategies). It is possible that actions to reduce the core damage frequency can yield accident sequences of lower frequency but with much higher consequences. All these factors need to be considered in concert when developing NUREG-1150 OAGI0000611 00272
- 13. Resource Document appropriate venting strategies. The treatment of uncertainties is another key aspect of accident management. Generally, procedures are devel-oped based on "most likely" or "expected" out-comes. For severe accidents, the outcomes are particularly uncertain. PRA models and results, such as those produced in the accident progres-sion event trees, can identify possible alternative outcomes for important accident sequences. By making this information available to operators and response teams, unexpected events can be recog-nized when they occur, and a more flexible ap-proach to severe accidents can be developed. The recent trend toward symptom-based, as opposed to event-based, procedures is consistent with this need for flexibility.
To demonstrate the potential benefits of an acci-dent management program, some example calcu-lations were performed, as documented in Refer-ence 13.20. For this initial demonstration, these calculations were limited to the internal-event ac-cident sequence portion of the analysis. Further, the numerical results presented are "point esti-mates" of the core damage frequency as opposed to mean frequency estimates. Selected examples from the initial analysis are presented below.
Effect of Firewater System at Grand Gulf The first NUREG-1150 analysis of the Grand Gulf plant (Ref. 13.21) did not credit use of the firewater system for emergency coolant injection because of the unavailability of operating proce-dures for its use in this mode and the difficulties in physically configuring its operation. However, since that time, the licensee has made significant system and procedural modifications. As a result, the firewater system at Grand Gulf can now be used as a backup source of low-pressure coolant injection to the reactor vessel. The system would be used for long-term accident sequences, i.e.,
where makeup water was provided by other injec-tion systems for several hours before their subse-quent failure. The firewater system primarily aids the plant during station blackout conditions and is considered a last resort effort.
An examination has been made of the benefit of these licensee modifications to the Grand Gulf plant. As shown in Figure 13.1, these analyses showed that the total core damage frequency was reduced from 4E-6 to 2E-6 per reactor year be-cause of these changes.
NUREG-1150 Effect of Feed and Bleed on Core Damage Frequency at Surry The NUREG-1150 analysis for Surry includes the use of feed and bleed cooling for those sequences in which all feedwater to the steam generators is lost (thus causing their loss as heat removal sys-tems). Feed and bleed cooling restores heat re-moval from the core using high-pressure injection (HPI) to inject into the reactor vessel and the power-operated relief valves (PORVs) on the pressurizer to release steam and regulate reactor coolant system pressure.
An examination has been made to determine to what extent feed and bleed cooling decreases core damage frequency at Surry. The current Surry model includes two basic events representing fail-ure modes for feed and bleed cooling in the event of a loss of all feedwater. These modes are: opera-tor failure to initiate high-pressure injection and operator failure to properly operate the PORVs.
In order to examine the impact of feed and bleed cooling, both basic events were assumed to always occur. As shown in Figure 13. 1, the resulting total core damage frequency for Surry (if feed and bleed cooling were not available) then increases by roughly a factor of 1.3. That is, the availability of the feed and bleed core cooling option in the Surry design and operation is estimated to reduce core damage frequency from 4E-S to 3E-5 per reactor year.
Gas Turbine Generator Recovery Action at Surry The present NUREG-1150 modeling and analysis of the Surry plant have not considered the bene-fits of using onsite gas turbine generators for re-covery in the event of station blackout accidents.
Both a 25 MW and a 16 MW gas turbine genera-tor are available to provide emergency ac power to
. safety-related and non-safety-related equipment.
13-4 These generators were not included in the analysis because, as currently configured, they would not be available to mitigate important accident se-quences.
An examination has been made* of the effect on core damage frequency at Surry of including the gas turbine generators as a means of recovery from station blackout sequences. To give credit for the addition of one generator for emergency ac power, it is assumed that Surry plant personnel have the authority to start the gas turbines when required and that 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> is required to start the gas turbines and energize the safety buses. In the analysis, the gas turbines were assumed to be available 90 percent of the time.
OAGI0000611 00273
1.000E-03 1.000E-04 1.000E-05 1.000E-06 1-1-'
1-1-
r-r-
1-t-r-1-
t-1-
1-1-
1-t-t-I-
t-t-
t-t-
f-f-
PCV I
Peach
- Bottom FWS l
Grand Gulf
- 13. Resource Document Legend PCV: Primary Containment Venting FWS: Firewater System F&B: Feed and Bleed CC: Cross-Connects GTG: Gas Turbine Generator Q: Base case point estimate X : Sensitivity point estimate cc F&B J
GTG Surry Surry Surry Figure 13.1 Benefits of accident management strategies.
13-5 NUREG-1150 OAGI0000611 00274
- 13. Resource Document The use of the onsite gas turbine was estimated to reduce core damage frequency from 3E-5 to 2E-5 per reactor year.
High-Pressure Injection and Auxiliary Feed,.
water Crossconnects at Surry The Surry Unit 1 plant is configured to recover from loss of either the high-pressure injection (HPI) system or the auxiliary feedwater (AFW) system by operator-initiated crossconnection to the analogous system at Unit 2. While these ac-tions provide added redundancy to these systems, new failure modes (e.g., flow diversion pathways) that were included in the modeling process for Surry have been created. The alignment of the Unit 1 and Unit 2 HPI and AFW systems for crossconnect injection is modeled as a recovery action.
Analysis of the importance of crossconnect injec-tion at Surry includes two parts. First, credit for crossconnect injection was removed from all ap-plicable dominant sequences, which were then re-quantified. Second, sequences that were previ-ously screened out of the anaJy:;i:; were checked to determine if they would become dominant in the absence of crossconnect injection. As shown in Figure 13.1, the point estimate of the total core damage frequency without crossconnects is lE-4, compared to the value of 3E-5 for internally initi-ated events in the base case.
Primary Containment Venting at Peach Bottom The primary containment venting (PCV) system at Peach Bottom is used to prevent primary contain-ment overpressurization during accident se-quences in which all containment heat removal is lost. Most sequences of this type involve failure of the residual heat removal systems. Because of the existence of this venting capability, no such acci-dent sequences appeared as dominant in the NUREG-1150 analysis for Peach Bottom.
The effect of the PCV system on the core damage frequency at Peach Bottom was determined by ex-amining the sequences screened out in the NUREG-1150 analysis that included the PCV sys-tem as an event (primarily the sequences involving loss of containment heat removal). Credit for the PCV system was removed from these sequences, which were then summed and added to the cur-rent point estimate of the core damage frequency.
As shown in Figure 13.1, this results in a point estimate of the Peach Bottom core damage fre-NUREG-1150 quency withou~ containment venting of 9E-6, about a factor of 2.6. increase over the NUREG-1150 value of 4E-6.
13.2.3 Improving Containment Performance The NRC has performed an assessment of the need to improve the capabilities of containment structures to withstand severe accidents (Ref.
13.1). Staff efforts focused initially on BWR plants with a Mark I containment, followed by the review of other containment types. This program was intended to examine potential enhanced plant and containment capabilities and procedures with regard to severe accident mitigation. NUREG-1 is 0 provided information that served to focus at-tention on areas where potential containment per-formance improvements might be realized.
NUREG-115 0 as well as other recent risk studies indicate that BWR Mark I risk is dominated by station blackout and anticipated transient without scram (A TWS) accident sequences. NUREG-1150 further provided a model for and showed the benefit of a hardened vent for Peach Bottom (discussed above and displayed in Figure 13.1).
The staff is currently pursuing regulatory actions to require hardened vents in all Mark I plants, using NUREG-1150 and other PRAs in the cost-benefit analysis.
The NUREG-1150 accident progression analysis models were used by the staff and its contractors in the evaluation of possible containment im-provements for the PWR ice condenser and BWR Mark III designs. The result of the staff reviews of these designs (and all others except the Mark I) was that potential improvements would best be pursued as part of the individual plant examina-tion process (discussed in Section 13. 2.1).
13-6 13.2.4 Determining Important Plant Operational Features NUREG-1150 will provide a source of informa-tion for investigating the importance of opera-tional safety issues that may arise during day-to-day plant operations. The NUREG-1150 models, methods, and results have already been used to analyze the importance of venting of the suppres-sion pool, the importance of keeping the PORVs and atmospheric dump valves unblocked, the im-portance of operational characteristics of the ice condenser containment design, the importance of operator recovery during an accident sequence, and the importance of crossties between systems.
These operational and system characteristics, as well as many others, are described in detail in Chapters 3 through 7. For example, characteris-tics of the Surry plant design and operation that OAGI0000611 00275
have been found to be important include crossties between units, diesel generators, reactor coolant pump seals, battery capacity, capability for feed and bleed core cooling, subatmospheric contain-ment operation, post-accident heat removal sys-tem, and reactor cavity design.
13.2.5 Alternative Safety Goal Implementation Strategies On August 21, 1986, the Commission published a Policy Statement on Safety Goals for the Opera-tion of Nuclear Power Plants (Ref. 13.22). In this statement, the Commission established two quali-tative safety goals supported by two risk-based quantitative objectives that deal with individual and societal risks posed by nuclear power plant
. operation. The objective of the policy statement was to establish goals that broadly define an ac-ceptable level of radiological risk that might be imposed on the public as a result of nuclear power plant operation.
The Commission recognized that the safety goals could provide a useful tool by which the adequacy of regulations or regulatory decisions regarding changes to the regulations could be judged. Safety goals could be of benefit also in the much more difficult task of assessing whether existing plants that have been designed, constructed, and oper-.
ated to comply with past and current regulations conform adequately with the intent of the safety goal policy.
The models and results of NUREG-1150 can be used in a number of ways in the NRC staff's analysis and implementation of safety goal policy.
For example, the five plants studied for this report have been compared with the two quantitative health objectives, as shown in Figure 13.2 for in-ternal initiators. Figure 13.3 compares Surry and Peach Bottom with the quantitative health objec-tives for fire initiators. As may be seen, the pre-sent risk estimates for these five plants (consider-ing internally initiated accidents) and for the Surry and Peach Bottom plants (considering fire initiators) fall beneath the quantitative health ob-jective risk goals. In addition, however, it may be seen that the risk estimates among the five plants vary considerably. An analysis of the plant design and operational differences that cause this vari-ability can provide valuable information to the staff in its consideration of the balance of the pre-sent set of regulations and the areas of regulation that could most benefit from improvement.
The staff has reviewed the NUREG-1150 results at a broad level to determine the causes of the variability among plant risks shown in Figure 13.2.
13-7
- 13. Resource Document A number of design, operational, and siting fac-tors are important to this measure of plant risk and determine the relative location of a specific plant's risk range in comparison with other plants and with the safety goal. At a general level, core damage frequency, containment and source term performance, and surrounding population demo-graphics all can affect the risk range. Thus, using the Surry plant as an example, the combination of a relatively low core damage frequency, relatively good containment performance, and a low popu-lation density act to ensure with a high probability that the risk is below the safety goal.
The NUREG-1150 results can also be used to support the analysis of alternative safety goal im-plementation approaches. One subject of discus-sion in the staff's work is the need for a supple-mental definition of containment performance in severe accidents using the probability of a large release as a measure. An acceptable frequency for such a release was defined as 1E-6 per reactor year. A potential definition of a large release is one that can cause one or more early fatalities.*
The present NUREG-1150 risk analyses have been evaluated to provide the frequency of such a release, as shown in Figure 13.4. The mean large release probabilities are below 1E-6 per reactor year. Further staff work in assessing alternative definitions is planned as part of the safety goal implementation program, and it is expected that NUREG-1150 methods and results will be used.
13.2.6 Effect of Emergency Preparedness on Consequence Estimates NUREG-1150 provides information for develop-ing protective action strategies that could be fol-lowed near a nuclear power plant in case of a severe accident. In developing strategies, consid-eration must be given to several types of protective actions, such as sheltering, evacuation, and relo-cation and various combinations. These strategies are influenced by the types of severe accidents that might occur at a nuclear power plant, their frequency of occurrence, and the radioactive re-lease expected to result from each accident type as well as by the topography, weather, population density, and other site-specific characteristics.
NUREG-1150 provides assessments of a broad spectrum of potential core damage accidents that could occur at a nuclear power plant. These as-sessments permit the evaluation of hypothetical
- The Commission has now indicated that this is not an appropriate definition and has asked the staff to review and propose an alternative definition.
NUREG-1150 OAGI0000611 00276
- 13. Resource Document 1.0E-06 1.0E-07 1.0E*08 1.0E-09 1.0E-10 1.0E-11 1.0£-05 1.0E-06 1.0E*07 1.0E-08 1.0E-09 1.0E-10 Individual early fatality/ry
~Safety Goal 1-
§
~
- o
~
SURRY
~
PEACH BOTTOM f--
SEQUOYAH Individual latent cancer fatality/ry E
=
1=:
r:;:
~
~
<==Safety Goal 1-SURRY lt PEACH BOTTOM 1-SEQUOYAH
~
GRAND GULF
.~
GRAND GULF Legend if mean m*dtan G$
1-ZION Leg ana
~"
mea<~
m&dlan 5$
j-ZION Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.
Figure 13.2 Comparison of individual early and latent cancer fatality risks at all plants (internal initiators).
NUREG-1150 13-8 OAGI0000611_00277
1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 1.0E-11 1.0E-05 1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 Individual early fatality/ry
~
~
~
E:
- ===Safety Goal
~
SURRY FIRE
- 13. Resource Document Legend median ['
mean li'£ PEACH BOTTOM FIRE Individual latent cancer fatality/ry
=
E
~
<:==Safety Goal 0
SURRY FIRE Legend median ff."
mean liS Jt PEACH BOTTOM FIRE Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.
Figure 13.3 Comparison of individual early and latent cancer fatality risks at Surry and Peach Bottom (fire initiators).
13-9 NUREG-1150 OAGI0000611 00278
- 13. Resource Document Probability of a large release 1.0E -05 o::----_;_------------L-or-ao-,-.-... -,-, ---11-ol-oa-oo-,h-at------,
1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.0E-10 1.0E-05 1.0E-06 1.0E-07 1.0E-08 1.0E-09 1.QE-10
~
oen re1uU In on* or *o**
- fll' tataJUiae.
Legend ff os mean median
~"
~
SURRY PEACH SEOUOYAH GRAND ZION BOTTOM GULF Probability of a large release L*r** *******
- lltl**** that oan ***\\IU In on* *r ****
- ar~y fat*IIUte.
Legend I=
1f m*cn*"
~
5S E
~
~
SURRY-FIRE PEACH BOTTOM - FIRE Note: As discussed in Reference 13.23, estimated risks at or below 1E-7 per reactor year should be viewed with caution because of the potential impact of events not studied in the risk analyses.
Figure 13.4 Frequency of one or more early fatalities.
NUREG-1150 13-10 OAGI0000611 00279
dose savings for a spectrum of accidents and pro*
vide a means for evaluating potential reduction in early severe health effects (injuries and fatalities) in the event of an accident by implementing emer-gency response strategies.
The most important considerations in establishing emergency preparedness strategies are the warning times before release to initiate the emergency re*
sponse and magnitude of the release of the radio-active material to the environment. The warning time and magnitude of radioactive release are in turn strongly influenced by the time and size of containment failure or bypass. If the containment fails early, the radioactive release is generally larger and more difficult to predict than if the containment fails late.
To evaluate the effectiveness of various protective actions, the conditional probabilities of acute red bone marrow doses exceeding 200 rems and 50 rems were calculated for several possible actions, using Zion plant source terms as examples. Doses were calculated on the plume centerline for vari-ous distances from the plant. The actions evalu-ated are:
Normal activity-assumed that no protective actions were taken during the release but as*
sumed that people were relocated within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of plume arrival.
Home sheltering-sheltering in a single family home (see Table 11.5 for a definition of sheltering). The penetration fractions for groundshine and cloudshine were representa-tive of masonry houses without basements as well as wood frame houses with basements.
Indoor protection for inhalation of radio-nuclides was assumed. People were relocated from the shelter mode within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of plume arrival.
Large building shelter-sheltering in a large building, for example, an office building, hospital, apartment building, or school. In-door protection for inhalation of radionu-clides was assumed. People were relocated from the shelter mode within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> of plume arrival.
Evacuation-doses were calculated for people starting to travel at the time of release, 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> before start of release, and 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after start of release. An evacuation speed of 2.5 mph was assumed.
Figure 13.5 shows the conditional probabilities of exceeding a 50-rem and a 200-rem red bone mar-
- 13. Resource Document row dose for the various possible response modes assuming an early containment failure at Zion with source term magnitudes varying from low to high. Figure 13.6 shows similar results for a late containment failure at Zion.
Use of the above assumptions indicates that if a large release occurs (Fig. 13.5), there is a large probability of doses exceeding 200 rems within 1 to 2 miles from the reactor. Sheltering does not significantly lower this probability. Thus, if a large release can occur, it is prudent to consider prompt evacuation prior to the start of the release.
At 3 miles and beyond, it is possible to avoid doses exceeding 200 rems by sheltering in large buildings even if a large release were to occur.
Thus, people in large buildings such as hospitals would not necessarily have to be immediately evacuated, but could shelter instead. Of course, further reductions in dose are possible by evacu-ation.
At 10 miles, no protective actions except reloca-tion would be necessary to avoid 200-rem doses.
Sheltering in large buildings or evacuation prior to release would probably keep doses below 50 rems.
13.3 Major Factors Contributing to Risk NUREG-115 0 results can be used to identify dominant plant risk contributors and associated uncertainties. A discussion of these dominant risk contributors is found in Chapters 3 through 8 and Chapter 12. This section focuses on the use in guiding research, generic issue resolution, and in-spection programs.
Because of its integrated nature, discussion of uncertainties, and reliance on more realistic as-sessments, PRA-based information found in NUREG-1150 and its supporting documents can be used to guide and focus a wide spectrum of activities designed to improve the state of knowl-edge regarding the safety of individual nuclear power plants, as well as that of the nuclear indus-try as a whole. The resources of both the NRC and the industry are limited, and the application of PRA techniques and subsequent insights pro-vides an important tool to aid the decisionmaker in effectively allocating these resources.
The nature of the many decisions necessary to al-locate regulatory resources does not require great precision in PRA results. For example, in assign-ing priorities to research or efforts to resolve ge-neric safety issues, it is sufficient to use broad 13-11 NUREG-1150 OAGI0000611_00280
- 13. Resource Document Probability of Exceeding 50-Rem Acute Red Bone Marrow Dose 1r-----------,-------------.-~~--------------------~
o.a 0.6 0.4 0.2 I
Early Containment Failure
- t. Cofttlou* ******.. urlty I. l*****ftt *taelter I. *~*liar lo I**** loull41n*
- ltart M"*tuattolt 1 Ju ltefore rei****
- ltart... aw&tloR at rtl****
- e. Start *va*vaU*" 1 tu alter *******
I 4
Distance from Reactor Probability of Exceeding 200-Rem Acute Red Bone Marrow Doae 1~----------~------------~--------------------------~
0.8 0.6 0.4 I
0.2 I
Early Containment Failure
- 1. CDitiRMe ltlfMit MIJWUJ
- a. *~*n*r **,., ** **u"r**
- 4. *t*rl ew***.. *** 1 ar ****** r******
- t. atarl lhae**U** at r*******
- ,........... 1.,.,,.,, ******
I o~~~~,-m~l-le-L----~~-L-3-m_l_le-.~~~L-~-Le--m_I_I*-,~--L-~~--1-0-m~ll-,a----_J Distance from reactor Figure 13.5 Relative effectiveness of emergency response actions assuming early contain-ment failure with high and low source terms.
NUREG-1150 13-12 OAGI0000611 00281
- 13. Resource Document Probability of Exceeding 50-Rem Acute Red Bone Marrow Doae 1------~-----r--~---------.--------~--~~~-------.
Late ContainmentFallure 0.8 1-0.6 1-0.4 1-1 0.2 2
- 1. Continue nor*** activity
- 2. ******nt aheUer
- a. ah*ll*' '" ***1* *ulldlng
"* Start *~*cY*Uoa 1 1\\r betor* rel****
I. Start ev*cuatfoa at rei****
- e. Start *vec:uaUoa t 11r etter re1****
o~--~1-m~.~
~----~3~m~.~ ** -.-------L------6-m __
ll_e-.-------L----~1~0~m~u~.-.----~
Distance from Reactor Probability of Exceed.lng 200-Rem Acute Red Bone Marrow Dose 1
Late containment failure
- 1. Cnllnn "****I oatiYit)'
- 2. *******t oholl*r
- a. ahellor 110 lute hlldlot
- 4. aurt *no'fatlon 'I hr.....,.,. *****
- 1. atert evaouatloft at *******
0.8
- Iter t ****uaUon t lllr arter ftl****
0.6 0.4 0.2 1
l 0
1 mile S 111llea 5 rnllea 10 mllea Distance from Reactor Figure 13.6 Relative effectiveness of emergency response actions assuming late contain-ment failure with high and low source terms.
13-13 NUREG-1150 OAGI0000611 00282
- 13. Resource Document categories of risk impact (e.g., high, medium, and low) (Ref. 13.24). In a similar manner, informa-tion from PRAs can be used to guide the alloca-tion of resources in inspection and enforcement programs (see Section 13.3.3).
13.3.1 Reactor Research As noted earlier, the nature of the decisions nec-essary to allocate resources does not require great precision in PRA results. In prioritizing research efforts, it is sufficient to use broad categories of risk impact (e. g., high, medium, and low). A given issue can be evaluated in terms of the num-ber of plants affected, the risk impacts on each plant, the effect of modifications in reducing the risk, and the effect of additional knowledge on improving the prediction of plant risk or severe core damage frequency or on reducing or defining more clearly the associated uncertainties. These generic measures of significance, combined ap-propriately with other information (e.g., cost of resolving the issue) can be used to evaluate the issue under consideration.
- 13. 3. 2 Prioritization of Generic Issues The NRC has been setting priorities for generic safety issues for several years using PRA as one informational input (Ref. 13.25). In prioritizing efforts to resolve generic safety issues, it is suffi-cient to use broad categories of risk impact (e.g.,
high, medium, and low) in which only order-of-magnitude variations are considered important.
The reasoning is that a potential safety issue would not be dismissed unless it were clearly of low risk.
Thus, one or more completed PRA studies can often be selected as surrogates for the purpose of assigning such priorities, even though they clearly do not fully represent the characteristics of some plants, provided the nature of the difference is reasonably understood and can be qualitatively evaluated.
As with any priority-assignment method, the final results must be tempered with an engineering evaluation of the reasonableness of the assign-ment, and the PRA-based analysis can serve as only one ingredient of the overall decision.
One of the most important benefits of using PRA as an aid to assigning priorities is the documenta-tion of a comprehensive and disciplined analysis of the issue, which enhances debate on the merits of specific aspects of the issue and reduces reli-ance on more subjective judgments. Clearly, some issues would be very difficult to quantify with rea-sonable accuracy, and the assignment of priorities to these issues would have to be based largely on subjective judgment.
PRA is being usefully applied to setting priorities for generic safety issues and to evaluating new is-sues as they are identified. In this effort, each is-sue is assessed as to its nature, its probable core damage frequency and public risk, and the cost of one or more conceptual fixes that could resolve the issue. A matrix is developed whereby each is-sue is characterized as of high, medium, or low probability, or whether the issue should be sum-marily dropped from further regulatory considera-tion. This matrix considers both the absolute mag-nitude of the core damage frequency or risk and the value/impact ratio of conceptual fixes. Risk-reduction estimates are normally made using sur-rogate PWRs and BWRs, based on existing PRAs.
A principal benefit of PRA-based prioritization, compared to other methods for allocating re-sources to safety issues, is that important assump-tions made in quantifying the risk are displayed and uncertainties in the analyses are estimated. A principal limitation is that some of the issues, such as those dealing with human factors, are only subjectively quantified. Thus, the uncertainties can be large. However, on balance, PRA-based prioritization has been found to be quite useful.
Although uncertainties may be large, the process forces attention on these uncertainties to a much higher degree than if the quantification were not attempted. Also, the uncertainties are normally part of the issues themselves and not just an arti-fact of the PRA analysis.
Since, as discussed above, the prioritization is done on an approximate (order-of-magnitude)
- basis, the new information developed in NUREG-1150 is not expected to substantially change previously developed priority rankings.
However, a sample of key issues will be re-examined to determine whether, based on the up-dated information in NUREG-1150, changes in dominant accident sequences or performance of mitigative systems could substantially affect the previous rankings.
13.3.3 Use of PRA in Inspections The importance to NRC of risk-based inspection data is exemplified by the following statement in NRC's 5-Year Plan: "Probabilistic risk assessment techniques will be applied to all phases of the in-spection program in order to insure that in-spection activities are prioritized and conducted in an integrated fashion." Within NRC, the Risk Applications Branch of the Office of Nuclear Re-actor Regulation has the responsibility of directly NUREG-1150 13-14 OAGI0000611 00283
providing risk-based information to the regional offices and resident inspectors. This ongoing ef-fort has resulted in the development of plant-specific, and in some cases generic, PRA perspec-tives that help to provide an optimization of inspection resources and a prioritization of inspec-tion resources on the high-risk aspects of a plant.
Using draft NUREG-1150 data, team inspection procedures based on plant-specific PRA informa-tion have been developed and implemented on such plants as Grand Gulf. Formalization of these
- 13. Resource Document inspection activities can be found in a recently is-sued inspection module entitled "Risk Focused Operation Readiness Inspection Procedures."
This module focuses on how to use PRA perspec-tives and conduct a risk-based team inspection based on risk insights. The spectrum of reactor plant design types addressed in NUREG-115 0 provide a broad risk data base that in many in-stances can be used to assist in inspection-type de-cisions even for plants without a PRA.
13-15 NUREG-1150 OAGI0000611 00284
- 13. Resource Document REFERENCES FOR CHAPTER 13 13.1 U.S.
Nuclear Regulatory Commission (USNRC), "Integration Plan for Closure of Severe Accident Issues," SECY-88-147, May 25, 1988.
13.2 USNRC, "Reactor Safety Study-An As-sessment of Accident Risks in U.S. Com-mercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.
13.3 D. M. Ericson, Jr.,(Ed.) et al., "Analysis of Core Damage Frequency:
Internal Events Methodology,"
Sandia National Laboratories, NUREG/CR-4550, Vol. 1, Revision 1, SAND86-2084, January 1990.
13.4 T. A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events:
Expert Judgment Elicitation," Sandia Na-tional Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April 1989.
13.5 R. C. Bertucio and J. A. Julius, "Analysis of Core Damage Frequency:
Surry Unit 1,"
Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990.
13.6 A. M. Kolaczkowski et al., "Analysis of Core Damage Frequency: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4550, Vol. 4, Revision 1, SAND86-2084, August 1989.
13.7 R. C. Bertucio and S. R. Brown, "Analysis of Core Damage Frequency: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 5, Revision 1, SAND86-2084, April 1990.
13.8 M. T. Drouin et a!., "Analysis of Core Damage Frequency: Grand Gulf Unit 1,"
Sandia National Laboratories, NUREG/
CR-4550, Vol. 6, Revision 1, SAND86-2084, September 1989.
13.9 M. B. Sattison and K. W. Hall, "Analysis of Core Damage Frequency: Zion Unit 1,"
Idaho National Engineering Laboratory, NUREG/CR-4550, Vol. 7, Revision 1, EGG-2554, May 1990.
13.10 E. D. Gorham-Bergeron eta!., "Evaluation of Severe Accident Risks: Methodology for the Accident Progression, Source Term, Consequence, Risk Integration, and Uncer-tainty Analyses," Sandia National Labora-tories, NUREG/CR-4551, Vol. 1, Draft Revision 1, SAND86-1309, to be pub-lished.*
13.11 F. T. Harper et al., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Labo-ratories, NUREG/CR-4551, Vol. 2, Revi-sion 1, SAND86-1309, December 1990.
13.12 R. J. Breeding eta!., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia Na-tional Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, Octo-ber 1990.
13.13 A. C. Payne, Jr., et a!., "Evaluation of Severe Accident Risks:
Peach Bottom Unit 2,"
Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND86-1309, to be published.*
13.14 J. J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, De-cember 1990.
13.15 T. D. Brown et al., "Evaluation of Severe Accident Risks:
Grand Gulf Unit 1,"
Sandia National Laboratories, NUREG/
CR-4551, Vol.
6, Draft Revision 1,
SAND86-1309, to be published.*
13.16 C. K. Park et al., "Evaluation of Severe Accident Risks:
Zion Unit 1," Brook-haven National Laboratory, NUREG/
CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, "to be published.*
13.17 USNRC, "Individual Plant Examination for Severe Accident Vulnerabilities-1 0 CFR
§50.54(f)," Generic Letter 88-20, Novem-ber 23, 1988.
13.18 USNRC, "Procedural and Submittal Guid-ance for the Individual Plant Examination of External Events (IPEEE) for Severe Ac-cident Vulnerabilities,"
NUREG-1407, Draft Report for Comment, July 1990.
- Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
NUREG-1150 13-16 OAGI0000611 00285
13.19 USNRC, "Probabilistic Risk Assessment Reference Document,"
NUREG-1050, September 1984.
13.20 A. L. Camp et al., "The Risk Management Implications of NUREG-1150 Methods and Results," Sandia National Laborato-ries, NUREG/CR-5263, SAND88-3100, September 1989.
13.21 M. T. Drouin et al., "Analysis of Core Damage Frequency from Internal Events:
Grand Gulf, Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 6, SAND86-2084, April 1987.
13.22 USNRC, "Safety Goals for the Operation of Nuclear Power Plants; Policy State-13-17
- 13. Resource Document ment," Federal Register, Vol. 51, p.
30028, August 21, 1986.
13.23 H. J. C. Kouts et al., "Special Committee Review of the Nuclear Regulatory Commis-sion's Severe Accident Risks Report (NUREG-1150)," NUREG-1420, August 1990.
13.24 USNRC, "Categorization of React<_>r Safety Issues from a Risk Perspective," NUREG-1115, March 1985.
13.25 R. Emrit et al., "A Prioritization of Generic Safety Issues," USNRC Report NUREG-0933, July 1984.
NUREG-1150 OAGI0000611 00286
NRC FORM335
(.2-89)
NRCM 1102, 3.201, 3202
.2. TITLE AND SUBTITLE U.S. NUCLEAR REGULATORY COMMISSION BIBLIOGRAPHIC DATA SHEET (See instructions on the reverse)
Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants Final Summary Report
- 5. AUTHOR(S) 1. REPORT NUMBER (Assigned by NRC, Add Vol.,
Supp., Rev., and Addendum Num-bers, if any.)
NUREG-1150 Vol. 1
- 3. DATE REPORT PUBLISHED MONTH l
December YEAR 1990
- 6. TYPE OF REPORT Final Technical
- 7. PERIOD COVERED (Inclusive Dates)
- 8. PERFORMING ORGANIZATION -NAME AND ADDRESS (If NRC, provide Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address; If contractor, provide name and mailing address.)
Division of Systems Research Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555
- 9. SPONSORING ORGANIZATION-NAME AND ADDRESS (If NRC, type "Same as above"; If contractor, provide NRC Division, Office or Region, U.S. Nuclear Regulatory Commission, and mailing address.)
Same as 8. above.
- 10. SUPPLEMENTARY NOTES
- 11. ABSTRACT (.200 words or less)
This report summarizes an assessment of the risks from severe accidents in five commercial nuclear power plants in the United States. These risks are measured in a number of ways, including: the estimated frequencies of core dam-age accidents from internally initiated accidents, and externally initiated accidents for two of the plants; the perform-ance of containment structures under severe accident loadings; the potential magnitude of radionuclide releases and offsite consequences of such accidents; and the overall risk (the product of accident frequencies and consequences).
Supporting this summary report are a large number of reports written under contract to NRC which provide the de-tailed discussion of the methods used and results obtained in these risk studies.
Volume 1 of this report has three parts. Part I provides the background and objectives of the assessment and summa-rizes the methods used to perform the risk studies. Part n provides a summary of results obtained for each of the five plants studied. Part ill provides perspectives on the results and discusses the role of this work in the larger context of the NRC staff's work.
1.2. KEY WORDS/DESCRIPTORS (List words or phrases that will assist researchers In locating the report.)
severe accidents risk analysis probabilistic risk analysis NRC FORM 335 (2-89)
- 13. AVAILABILITY STATEMENT Unlimited
- 14. SECURITY CLASSIFICATION (This Page)
Unclassified (This Report)
Unclassified
- 15. NUMBER OF PAGES
- 16. PRICE OAGI0000611 00287
THIS DOCUMENT WAS PRINTED USING RECYCLED PAPER.
OAGI0000611 00288
Severe Accident Risks:
An Assessment for Five U.S. Nuclear Power Plants Appendices A, B, and C Final Report U.S. Nuclear Regulatory Commission Office of Nuclear Regulatory Research NUREG-1150 Vol. 2 OAGI0000611 00289
AVAILABILITY NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:
- 1.
The NRC Public Document Room, 2120 L Street, NW, Lower Level, Washington, DC 20555
- 2.
The Superintendent of Documents, U.S. Government Printing Office, P.O. Box 37082, Washington, DC 20013-7082
- 3.
The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publica-tions, it is not intended to be exhaustive.
Referenced documents available for inspection and copying for a fee from ~he NRC Public Document Room Include NRC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices, inspection and Investi-gation notices; Licensee Event Reports: vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.
The following documents in the NUREG series are available for purchase from the GPO Sales Program:
formal NRC staff and contractor reports, NRC-sponsored conference proceed-ings, and NRC booklets and brochures. Also available are Regulatory Guides, NRC regula-tions in the Code of Federal Regulations, and Nuclear Regulatory Commission Issuances.
Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.
Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. Federal Register notices, federal and state legislation, and congressional reports can usually be obtained from these libraries.
Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.
Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Information Resources Management, Distribution Section, U.S.
Nuclear Regulatory Commission, Washington, DC 20555.
Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by the public. Codes and standards are usually copy-righted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute, 1430 Broadway, New York, NY 10018.
OAGI0000611 00290
Severe Accident Risks:
An Assessment for Five U.S. Nuclear Power Plants Appendices A, B, and C Final Report Manuscript Completed: October 1990 Date Published: December 1990 Division of Systems Research Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 NUREG-1150 Vol. 2 OAGI0000611 00291
ABSTRACT This report summarizes an assessment of the risks from severe accidents in five commercial nuclear power plants in the United States. These risks are measured in a number of ways, including: the estimated frequencies of core damage accidents from internally initiated accidents and externally initiated accidents for two of the plants; the performance of containment structures under severe accident loadings; the potential magnitude of radionuclide releases and offsite consequences of such accidents; and the overall risk (the product of accident frequencies and conse-quences). Supporting this summary report are a large number of reports written under contract to NRC that provide the detailed discussion of the methods used and results obtained in these risk studies.
This report was first published in February 1987 as a draft for public comment. Extensive peer review and public comment were received. As a result, both the underlying technical analyses and iii the report itself were substantially changed. A second version of the report was published in June 1989 as a draft for peer review. Two peer reviews of the second version were performed. One was sponsored by NRC; its results are pub1ished as the NRC report NUREG-1420.
A second was sponsored by the American Nuclear Society (ANS); its report has also been completed and is available from the ANS. The comments by both groups were generally positive and recommended that a final version of the report be published as soon as practical and without performing any major reanalysis. With this direction, the NRC proceeded to generate this final version of the report.
Volume 2 of this report contains three appendi-ces, providing greater detail on the methods used, an example risk calculation, and more detailed discussion of particular technical issues found im-portant in the risk studies.
NUREG-1150 OAGI0000611 00292
CONTENTS Page APPENDIX A-RISK ANALYSIS METHODS A 1 Introduction and Overview..................................................
A-1 A.1.1 Introduction......................................................
A-1 A.1. 2 Overview of Risk Analysis Process....................................
A-1 A.2 Accident Frequency Analysis Methods.........................................
A.2.1 Internal-Event Methods for Surry, Sequoyah, Peach Bottom, and Grand Gulf A.2.2 Internal-Event Methods for Zion.....................................
A.2.3 External-Event Methods for Surry and Peach Bottom...................
A.2.4 Products of Accident Frequency Analysis..............................
A-6 A-6 A-12 A-16 A-20 A.3 Accident Progression, Containment Loadings, and Structural Response Analysis.......
A-22 A.3.1 Introduction......................................................
A.3.2 Development of Accident Progression Event Trees......................
A.3.3 Structural Analyses................................................
A.3.4 Probabilistic Quantification of APETs.................................
A.3.5 Grouping of Event Tree Outcomes....................................
A. 3. 6 Products of Accident Progression Analysis.............................
A-22 A-24 A-27 A-27 A-27 A-27 A.4 Radioactive Material Transport (Source Term) Analysis..........................
A-28 A.4.1 Introduction......................................................
A.4.2 Development of Parametric Models...................................
A.4.3 Development of Values or Probability Distributions......................
A. 4.4 Grouping of Radioactive Releases.....................................
A.4.5 Products of Source Term Analysis....................................
A-28 A-28 A-33 A-33 A-33 AS Offsite Consequence Analysis................................................
A-33 A.5.1 Introduction......................................................
A.5.2 Assessment of Pre-Accident Inventories...............................
A. 5. 3 Transport, Dispersion, and Deposition of Radioactive Material.............
A.5.4 Calculation of Doses...............................................
A.S.S Mitigation of Doses by Emergency Response Actions.....................
A.5.6 Health Effects Modeling............................................
A.5.7 Products of Offsite Consequence Analysis..............................
A. 6 Characterization and Combination of Uncertainties..............................
A. 7 Elicitation of Experts.......................................................
A.8 Calculation of Risk........................................................
A. 8.1 Methods for Calculation of RisK......................................
A.8.2 Products of Risk Calculation.........................................
A-33 A-36 A-37 A-37 A-37 A-38 A-39 A-39 A-43 A-45 A-45 A-47 A.9 Additional Explanation of Some Figures, Tables, and Terms......................
A-48 A.9.1 Additional Explanation of Some Figures and Tables.....................
A-48 A.9.2 Explanation of Some Terms.........................................
A-51 REFERENCES FOR APPENDIX A................................................
A-53 v
NUREG-1150 OAGI0000611 00293
Page APPENDIX B-AN EXAMPLE RISK CALCULATION B.1 Introduction..............................................................
B-1 B. 2 Accident Frequency Analysis................................................
B-1 B.2.1 Overview of Accident Frequency Analysis..............................
B-1 B.2.2 Description of Accident Sequence....................................
B-7 B.2.3 Quantification of Cut Set...........................................
B-8 B.2.4 Accident Sequence and PDS........................................
B-9 B.3 Accident Progression Analysis...............................................
B-10 B.3.1 Introduction......................................................
B-1 0 B.3.2 Discussion of APET Questions.......................................
B-16 B.3.3 Quantification of APET Questions by Expert Judgment...................
B-22 B.3.4 Binning Results of APET...........................................
B-35 B.4 Source Term Analysis......................................................
B-38 B.4.1 Equation for Release Fraction for Iodine..............................
B-39 B.4.2 Discussion of Source Term Factors...................................
B-41 B.4.3 Quantification of Source Term Factors by Experts.......................
B-44 B.4.4 Releases for All Fission Products.....................................
B-53 B.5 Partitioning of Source Terms................................................
B-53 B.S.1 Introduction......................................................
B-53 B.5.2 Effects Weights...................................................
B-54 B.5.3 Partitioning Process and Results......................................
B-58 B.6 Consequence Calculation...................................................
B-60 B.6.1 Description of Consequence Calculation...............................
B-60 B.6.2 Results of Consequence Calculation...................................
B-61 B. 7 Computation of Risk...................,...................................
B-63 B. 7.1 Introduction......................................................
B-6 3 B.7.2 Calculation and Display of Mean Risk.................................
B-63 B.7.3 Calculation and Display of CCDFs....................................
B-66 B.8 Summary................................................................
B-70 REFERENCES FOR APPENDIX B................................................
B-72 APPENDIX C-ISSUES IMPORTANT TO QUANTIFICATION OF RISK C.1 Introduction..............................................................
C-1 C.1.1 Description of Table C.1. 1; Variables Sampled in Accident Frequency Analysis.........................................................
C-3 C.1.2 Description of Table C.1.2; Questions in Surry APET....................
C-7 C.1.3 Description of Table C.1.3; Variables Sampled in Source Term Analysis.....
C-12 REFERENCES FOR SECTION C.l................................................
C-13 vi OAGI0000611 00294
Page C.2 Common-Cause and Dependent Failures.......................................
C-15 C.2.1 Issue Definition...................................................
C-15 C.2.2 Technical Bases for Issue Quantification...............................
C-16 C.2.3 Treatment in PRA and Results.......................................
C-18 REFERENCES FOR SECTION C.2................................................
C-20 C.3 Human Reliability Analysis...................... -............................
C-21 C.3.1 Issue Definition...................................................
C-21 C.3.2 Technical Bases for Issue Quantification...............................
C-21 C.3.3 Treatment in PRA and Results.......................................
C-22 REFERENCES FOR SECTION C.3................................................
C-23 C.4 Hydrogen Combustion Prior to Reactor Vessel Breach...........................
C-24 C.4.1 Issue Definition...................................................
C-25 C.4.2 Technical Bases for. Issue Quantification...............................
C-27 C.4.3 Treatment in PRA and Results.......................................
C-33 REFERENCES FOR SECTION C.4................................................
C-41 C.5 PWR Containment Loads During High-Pressure Melt Ejection.....................
C-42 C.5.1 Issue Definition...................................................
C-43 C.5.2 Technical Bases for Issue Quantification...............................
C-49 C.5.3 Treatment in PRA and Results.......................................
C-57 C.5.4 Differences in Treatment of HPME and DCH Between First and Second Drafts of NUREG-1150......................................
C-61 REFERENCES FOR SECTION C.S................................................
C-62 C.6 Mechanisms for PWR Reactor Vessel Depressurization Prior to Vessel Breach........
C-64 C.6.1 Issue Definition...................................................
C-64 C.6.2 Technical Bases for Issue Quantification...............................
C-65 C.6.3 Treatment in PRA and Results.......................................
C-69 REFERENCES FOR SECTION C.6................................................
C-71 C. 7 Drywell Shell Meltthrough..................................................
C-73 C. 7.1 Issue Definition...................................................
C-73 C. 7. 2 Technical Bases for Issue Quantification...............................
C-7 6 C. 7.3 Treatment in PRA and Results.......................................
C-80 REFERENCES FOR SECTION C. 7................................................
C-81 C.B Containment Strength Under Static Pressure Loads..............................
C-83 C.8.1 Issue Definition...................................................
C-83 C.8.2 Technical Bases for Issue Quantification...............................
C-84 C.8.3 Treatment in PRA and Results.......................................
C-89 vii NUREG-1150 OAGI0000611 00295
Page REFERENCES FOR SECTION C. 8................................................
C-92 C.9 Containment Failure as a Result of Steam Explosions............................
C-94 C.9.1 Issue Definition...................................................
C-94 C.9.2 Technical Bases for Issue Quantification...............................
C-96 C.9.3 Treatment in PRA and Results.......................................
C-99 REFERENCES FOR SECTION C.9................................................
C-101 C.10 Source Term Phenomena...................................................
C. 10. 1 Issue Definition...................................................
C.10.2 Technical Bases for Issue Quantification...............................
C.1 0. 3 Treatment in PRA and Results.......................................
C-102 C-102 C-103 C-103 REFERENCES FOR SECTION C.10............................................... C-110 C.11 Analysis of Seismic Issues................................................... C-111 C. 11. 1 Issue Definition...................................................
C-111 C.11.2 Treatment in PRA and Results......................................
C-121 REFERENCES FOR SECTION C.11............................................... C-126 C.12 Analysis of Fire Issue......................................................
C.12.1 Analysis Procedure for NUREG-1150 Fire Analysis.....................
C.12.2 PRA Results.....................................................
C.12.3 Issue Definition and Discussion......................................
C-128 C-128 C-128 C-130 REFERENCES FOR SECTION C.12............................................... C-133 C.13 Containment Bypass Sequences.............................................. C-134 C-134 C-135 C-137 C-139 C.13.1 ISLOCAs-Accident Sequence Issues.................................
C.13.2 ISLOCAs-Source Term Issues......................................
C.13.3 SGTRs-Accident Sequence Issues...................................
C.13.4 SGTRs-Source Term Issues........................................
REFERENCES FOR SECTION C.13............................................... C-141 C.14 Reactor Coolant Pump Seal Failures in Westinghouse Plants After Loss of All Seal Cooling..............................................................
C-142 C.14.1 Issue Definition...................................................
C-142 C.14.2 Technical Bases for Issue Quantification..............................
C-142 C.14.3 Treatment in PRA and Results......................................
C-144 REFERENCES FOR SECTION C.14............................................... C-151 C.15 Zion Service Water and Component Cooling Water Upgrade...................... C-152 C. 15.1 Issue Definition..................................................... C-1 52 C.15.2 Issue Analysis......................................................
C-152 viii OAGI0000611 00296
C.15. 3 Issue Quantification and Results.......................................
C.15.4 Impact of Issues on Risk.............................................
Page C-153 C-153 REFERENCES FOR SECTION C.15...............................................
C-154 A.1 A.2 A.3 A.4 A.5 A.6 A.7 A.B A.9 A.10 A.11 A.12 A.13 A.14 A.15 A.16 A.17 A.18 B.l B.2 B.3 B.4 B.S B.6 B.7 B.8 B.9 B.10 B.ll FIGURES Principal steps in NUREG-1150 risk analysis process...........................
Interfaces between risk analysis steps........................................
Models used in calculation of risk..........................................
Steps in accident frequency analysis of Surry, Sequoyah, Peach Bottom, and Grand Gulf.............................................................
Zion Probabilistic Safety Study master logic diagram...........................
Example display of core damage frequency distribution.........................
Example display of mean plant damage state frequencies........................
Schematic of accident progression event tree..................................
Example display of early containment failure probability distribution..............
Example display of mean accident progression bin conditional probabilities.........
Simplified schematic of source term (XSOR) algorithm.........................
Exampl~ disp~ay of radioactive release distributions for selected accident progression bin..........................................................
Example display of source term complementary cumulative distribution function....
Example display of offsite consequences complementary cumulative distribution function...............................................................
Principal steps in expert elicitation process...................................
Matrix formulation of risk analysis calculation................................
Example display of relative contributions to mean risk..........................
Probability that f(PDS;) will fall in interval Im.................................
Event tree for T1S-SBO at Surry Unit 1.....................................
Reduced fault tree for DG 1 at Surry Unit 1................................
Reduced fault tree for AFWS at Surry Unit 1................................
Simplified diagram of first part of Surry accident progression event tree...........
Event tree used by all three experts in determining the probabilities of different leak rates for a single reactor coolant pump..................................
First part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps.............,...........
Second part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps.........................
Results of expert elicitation for pressure rise at vessel breach for Surry............
Simplified schematic of Surry containment...................................
Results of expert elicitation for static failure pressure of Surry containment.........
Results of expert elicitation for FCOR, fraction of the fission products released from core to vessel for the nine radionuclide groups...........................
Page A-2 A-3 A-7 A-8 A-13 A-21 A-23 A-26 A-29 A-30 A-32 A-34 A-35 A-40 A-44 A-46 A-49 A-50 B-4 B-5 B-6 B-13 B-24 B-25 B-26 B-32 B-33 B-36 B-46 ix NUREG-1150 OAGI0000611 00297
B.12 B.13 B.14 B.15 B.16 B.17 B.18 B.19 C.1.1 C.4.1 C.4.2 C.4.3 C.4.4 C.4.5 C.4.6 C.4.7 C.4.8 C.4.9 C.4.10 C.5.1 C.5.2 C.5.3 C.5.4 C.5.5 C.5.6 Results of expert elicitation for FCOR, fraction of fission products released from core to vessel for the nine radionuclide groups................................
Results of expert elicitation for FCONV, fraction of fission products in containment from RCS release that is released to environment..............................
Distributions for late release of iodine from containment in volatile form..........
Relationship between I-131 release and mean early fatalities used in determining early effects weights for partitioning.........................................
Distribution of latent cancer fatalities computed for STG SUR-49................
Distribution of expected (weather-averaged) latent cancer fatality risk for Surry.....
CCDFs for latent cancer fatalities for STG SUR-49 and for all 52 STGs...........
Computed curves showing four statistical measures of 200 CCDFs for Surry for early fatalities and latent cancer fatalities.........................................
Example of NUREG-1150 "issue decomposition".............................
Cross section of Sequoyah containment......................................
Cross section of Grand Gulf containment....................................
Ignition frequency as a function of initial hydrogen concentration in the Grand Gulf containment building {outer containment-wetwell region for accident progressions in which the RPV is at high pressure).............................
Ignition frequency for various regions of the Sequoyah containment-illustrated for an assumed initial hydrogen concentration between 5. 5 and 11 volume percent..
Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and high initial steam concentrations).........................................................
Range of Grand Gulf containment loads in comparison with important structural pressure capacities (various initial hydrogen concentrations and low initial steam concentrations).........................................................
Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (fast station blackout scenarios with various levels of in-vessel cladding oxidation).......................................
Range of Sequoyah containment loads from hydrogen combustion in comparison with containment pressure capacity (slow station blackout accidents with induced reactor coolant pump seal LOCA and various levels of in-vessel cladding oxidation)
Frequency of hydrogen detonations in Grand Gulf containment (probability of a detonation per combustion event-i.e., given ignition). H and L refer to high and low steam concentrations, respectively...................................
Frequency of hydrogen detonations in Sequoyah ice condenser or upper plenum (probability of a detonation per combustion event)............................
Cross section of Surry Unit 1 containment...................................
Cross section of Zion Unit 1 containment....................................
Calculated containment peak pressure as a function of molten mass ejected (Ref. C.S.8)............................................................
Example display of distributions for containment loads at vessel breach versus static failure pressure.....................................................
Surry containment loads at vessel breach; cases involving vessel breach at high pressure with containment sprays operating (wet cavity)........................
Surry containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity)......................
X Page B-47 B-50 B-52 B-56 B-62 B-65 B-67 B-69 C-2 C-28 C-30 C-31 C-32 C-34 C-35 C-36 C-37 C-38 C-39 C-44 C-45 C-48 C-50 C-52 C-53 OAGI0000611 00298
Page C.S. 7 Surry containment load distributions generated by composite of individual experts for each of the cases shown in Figure C.S.5..................................
C-54 C.S.8 Zion containment loads at vessel breach: cases involving vessel breach at high pressure with containment sprays operating (wet cavity)........................
C-55 C.S. 9 Zion containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity)......................
C-56 C.S.10 Sequoyah containment loads at vessel breach; cases involving vessel breach at
~igh pressure. with col!t~inment sprays operating (wet cavity) and a substantial mventory of 1ce rema1n1ng................................................
C-58 C.S.11 Sequoyah containment loads at vessel breach; cases involving vessel breach at high pressure without containment sprays operating (dry cavity) and a substantial inventory of ice remaining................................................
C-59 C.5.12 Sequoyah containment loads at vessel breach; cases involving vessel breach at C.6.1 C.6.2 C.7.1 C.7.2 C.7.3 C.7.4 C.8.1 C.9.1 C.10.1 C.10.2 C.10.3 C.10.4 C.11.1 C.11.2 C.11.3 C.11.4 C.11.5 C.11.6 C.11.7 C.11.8 C.11.9 high ~ressure with~ut conta~n~ent sprays operating (dry cavity) and a negligibly small mventory of 1ce remammg............................................
C-60 Aggregate distribution for frequency of temperature-induced hot leg failure (Surry, Zion, and Sequoyah)....................................................
Aggregate distributions for frequency of temperature-induced steam generator tube rupture.........................................................,..
Configuration of Peach Bottom drywell shell/floor-vertical cross section...........
Configuration of Peach Bottom drywell shell/floor-horizontal cross section.........
Aggregate cumulative conditional probability distributions for Peach Bottom drywell shell meltthrough........................................................
Cumulative probability distributions composite of individuals on expert panel for this issue. (Six panelists (6 curves) are shown for each of four cases.)............
Containment failure pressure..............................................
Frequency of alpha-mode failure conditional upon core damage.................
In-vessel release distribution, PWR case with low cladding oxidation..............
RCS transmission fraction, PWR case at system setpoint pressure.................
RCS transmission fraction, PWR case with low system pressure..................
Revaporization release fraction for iodine, PWR case with two holes..............
Model of seismic hazard analysis...........................................
LLNL hazard curves for Peach Bottom site..................................
10000-year return period uniform hazard spectra for Peach Bottom site...........
Example of logic-tree format used to represent uncertainty in hazard analysis input (EPRI program)....................................................
EPRI hazard curves for Peach Bottom site...................................
Surry external events, core damage frequency ranges (5th and 95th percentiles)....
Peach Bottom external events, core damage frequency ranges (5th and 95th percentiles)............................................................
Contribution from different earthquake ranges at Peach Bottom..................
Mean plant level fragilities................................................
C-67 C-68 C-74 C-75 C-78 C-79 C-86 C-100 C-105 C-106 C-107 C-109 C-112 C-114 C-115 C-116 C-117 C-119 C-120 C-125 C-126 xi NUREG-1150 OAGI0000611 00299
Page C.14.1 Westinghouse RCP seal assembly (Ref. C.14.1)...............................
C-143 C.14.2 Decision tree (Ref. C.14.1)............................................... C-144 A.1 B.1 B.2 B.3 B.4 B.S B.6 C.1.1 C.1.2 C.1.3 C.2.1 C.2.2 C.2.3 C.2.4 C.2.5 C.3.1 C.3.2 C.5.1 C.6.1 C.6.2 C.6.3 C.6.4 C.7.1 C.8.1 TABLES Issues considered by expert panels..........................................
Most likely cut set in Surry sequence T1S-QS-L quantification for observation 4....
Selected questions in Surry APET..........................................
Aggregate results for RCP seal failure with existing o-ring material................
Isotopes in each radionuclide release class....................................
Partitioning parameters and results..........................................
Properties of source term 17, subgroup 1....................................
Variables sampled in accident frequency analysis for internal initiators............
Questions in Surry APET.................................................
Variables sampled in source term analysis.....................................
Beta factor analysis for pumps-based on Fleming data.........................
Beta factor analysis for valves-based on Fleming data.........................
Beta factor models from EPRI NP-3967.....................................
Risk-reduction measures for selected common-cause events in Surry and Peach Bottom analysis....................................................
Results of sensitivity study in which common-cause failures were eliminated from fault trees..............................................................
Representative ranges of human error uncertainties (taken from Grand Gulf analysis)...............................................................
Core damage frequencies with and without human errors.......................
Mean conditional probability of containment failure for three PWRs..............
Surry reactor vessel pressure at time of core uncovery and at vessel breach........
Surry reactor vessel pressure at time of core uncovery and at vessel breach (sensitivity study without induced hot leg failure and steam generator tube ruptures).
Fraction of Surry slow blackout accident progressions that results in various modes of containment failure (mean values)........................................
Fraction of Sequoyah accident progressions that results in HPME and containment overpressure failure......................................................
Probability of drywell shell meltthrough (conditional on a core damage accident of various types)...........................................................
Containment strength under static pressure loads: summary information...........
A-41 B-3 B-11 B-28 B-39 B-55 B-60 C-3 C-9 C-12 C-17 C-17 C-19 C-19 C-20 C-22 C-23 C-61 C-70 C-70 C-71 C-71 C-Bl C-91 C.10.1 APS recommendations for source term research (Ref. C.10.3)................... C-102 xii OAGI0000611 00300
C.10.2 Source term issues.......................................................
C.11.1 Seismic core damage and release frequencies from published probabilistic risk assessments............................................................
C.11. 2 Core damage frequencies.................................................
C.11. 3 Comparison of contributions of modeling uncertainty in response, fragility, and hazard curves to core damage frequency.....................................
C.11.4 Dominant sequences at Peach Bottom.......................................
C.12.1 Dominant Surry fire area core damage frequency contributors (core damage frequency/yr) (Ref. C.12. 7)...............................................
C.12.2 Dominant Peach Bottom fire area core damage frequency contributors (core damage frequency/yr) (Ref. C.12.8)........................................
C.12.3 Dominant Surry accident sequence core damage frequency contributors (Ref. C.12.7)...........................................................
C.12.4 Dominant Peach Bottom accident sequence core damage frequency contributors Page C-104 C-112 C-122 C-123 C-124 C-129 C-129 C-131 (Ref. C.12.8)...........................................................
C-131 C.13.1 Secondary side safety valve failure probabilities...............................
C-138 C.14.1 Aggregated RCP seal LOCA probabilities for Westinghouse three-loop plant........
C.14.2 Aggregated RCP seal LOCA probabilities for Westinghouse four-loop plant.........
C.14.3 Sequoyah RCP seal LOCA model scenarios..................................
C.14.4 Sequoyah RCP seal LOCA model..........................................
C.15.1 Plant damage state comparison.............................................
C.lS.2 Comparison of mean risk values...........................................
C-145 C-146 C-148 C-150 C-153 C-154 xiii NUREG-1150 OAGI0000611 00301
APPENDIX A RISK ANALYSIS METHODS OAGI0000611 00302
CONTENTS Page A.1 Introduction and Overview............. *..................................
A-1 A.1.1 Introduction......................................................
A-1 A.1.2 Overview of Risk Analysis Process....................................
A-1 A.2 Accident Frequency Analysis Methods......................................
A-6 A.2.1 Internal-Event Methods for Surry, Sequoyah, Peach Bottom, and Grand Gulf A.2.2 Internal-Event Methods for Zion.....................................
A.2.3 External-Event Methods for Surry and Peach Bottom....................
A.2.4 Products of Accident Frequency Analysis............... 0..............
A-6 A-12' A-16 A-20 A.3 Accident Progression, Containment Loadings, and Structural Response Analysis... 0.
A-22 A.3.1 Introduction... 0 ********************** 0...........................
A-22 A.3.2 Development of Accident Progression Event Trees.................. o....
A-24 A.3.3 Structural Analyses..... 0 0 0....... 0... 0 0........ 0. 0 0... 0 A-27 A.3.4 Probabilistic Quantification of APETs.. o *** o ** o. o o ** o ** o o
o ****** o..
- A-27 A.3.5 Grouping of Event Tree Outcomes.. 0. 0 ****** 0........... 0 0
0 ** 0...
- A-27 A.3.6 Products of Accident Progression Analysis....... 0 *** 0 ** 0 ** 0: 0 *** 0 0 *** 0 0
A-27 A.4 Radioactive Material Transport (Source Term) Analysis.......... 0 ************ 0.
A-28 A.4.1 Introduction................................. 0 ***************** 0..
A.4.2 Development of Parametric Models........... 0................ 0......
A.4.3 Development of Values or Probability Distributions.............. 0........
A.4.4 Grouping of Radioactive Releases..... 0........ 0......................
A.4.5 Products of Source Term Analysis................... 0 ****************
A.S Offsite Consequence Analysis... 0. 0 ***** 0 ********* 0 ***************** 0... 0 0.
A.5.1 Introduction..... 0 ************ 0 ** 0 ** 0 *****************************
Ao502 Assessment of Pre-Accident Inventories. 0. 0 ******** 0 ** 0 ******** 0 *** 0 ***
A.5.3 Transport, Dispersion, and Deposition of Radioactive Material.............
A.So4 Calculation of Doses 0
0 0
0 *********************************** 0 0 0. 0 A.S.5 Mitigation of Doses by Emergency Response Actions. 0
- 0 0 *** 0 ****** 0...
A.5.6 Health Effects Modeling....... 0. 0 *************** 0..... 0...... 0 *****
A. 5. 7 Products of Offsite Consequence Analysis..... 0
- o ******* o *************
A.6 Characterization and Combination of Uncertainties................. 0 **********
A. 7 Elicitation of Experts............... 0.............. 0 ******* 0 ***** 0 ********
A.B Calculation of Risk. 0......................
0 ***** 0
- 0 ** 0. 0 ****** 0 ****** 0 Ao8o1 Methods for Calculation of Risk.. 0 ** 0 ********************************
A.8.2 Products of Risk Calculation 0..... 0.. 0. 0 0 0 0 o
- 0 0. 0 0 0 0.. 0 0. 0 0 0 0 0 0 0 0 0 0 0 0 A. 9 Additional Explanation of Some Figures, Tables, and Terms. 0..... 0 ***** 0. 0.. 0.
A.9.1 Additional Explanation of Some Figures and Tables.... 0............ 0 0. 0.
A.9.2 Explanation of Some Terms......... 0..... 0....... 0 0. 0 0.. 0 ******** 0 0 REFERENCES FOR APPENDIX A 0 ****** 0 *************** 0 ************* o ** 0 o ***
A-28 A-28 A-33 A-33 A-33 A-33 A-33 A-36 A-37 A-37 A-37 A-38 A-39 A-39 A-43 A-45 A-45 A-47 A-48 A-48 A-51 A-53 iii NUREG-1150 OAGI0000611 00303
FIGURES A.l Principal steps in NUREG-1150 risk analysis process.
A.2 Interfaces between risk analysis steps.......................................
A. 3 Models used in calculation of risk..........................................
A.4 Steps in accident frequency analysis of Surry, Sequoyah, Peach Bottom, and Grand Gulf..................................*.........................
A.S Zion Probabilistic Safety Study master logic diagram...........................
A.6 Example display of core damage frequency distribution.........................
A. 7 Example display of mean plant damage state frequencies........................
A.8 Schematic of accident progression event tree..................................
A. 9 Example display of early containment failure probability distribution..............
A.1 0 Example display of mean accident progression bin conditional probabilities.........
A.11 Simplified schematic of source term (XSOR) algorithm.........................
A.12 Exampl~ disp.lay of radioactive release distributions for selected accident progression b1n..........................................................
A.13 Example display of source term complementary cumulative distribution function....
A.14 Example display of offsite consequences complementary cumulative distribution function...............................................................
A.15 Principal steps in expert elicitation process...................................
A.16 Matrix formulation of risk analysis calculation................................
A.17 Example display of relative contributions to mean risk..........................
A.18 Probability that f(PDSi) will fall in interval 1m.................................
TABLE A.l Issues considered by expert panels.........................................
NUREG-1150 iv A-2 A-3 A-7 A-8 A-13 A-21 A-23 A-26 A-29 A-30 A-32 A-34 A-35 A-40 A-44 A-46 A-49 A-50 A-41 OAGI0000611 00304
Appendix A A.l Introduction and Overview A.l.l Introduction This appendix provides an overview of the NUREG-1150 risk analysis process, describing the different steps in the calculational process and the interrelationships among steps. This summary has been written for a reader familiar with risk analysis but does not discuss the subtleties and complexities of the methods used to perform the various analysis steps. The reader seeking a more comprehensive discussion is directed to References A.1 and A.2.
The analysis methods used in NUREG-1150 were selected or developed to satisfy some special objectives of the project. In particular, the following were important considerations in the selection of methods:
The need to perform quantitative uncertainty analyses (considering both data and modeling, uncertainties) as part of the calculations; The need to make explicit use of the data base of severe accident experimental and calculational information generated by NRC's contractors and the nuclear industry, which resulted in the development of more detailed accident progression analysis models and the use of formal methods for eliciting expert judgment; The ability to readily assess the impact: of postulated modifications to the studied plants; The ability to calculate and display intermediate results and a detailed breakdown of the risk results, providing traceability throughout the computations; and Computational practicality.
The selection of the methods also benefited from experience obtained in conducting the analyses presented in the first draft version of NUREG-1150 (Ref. A.3) and supporting contractor reports (Refs.
A.4, A.5, and A.6), and the reviews of these reports (Refs. A.7, A.8, and A.9).
The remainder of this appendix discusses the individual steps in the NUREG-1150 risk analysis process.
Section A.1.2 provides an overview of the process, while Sections A.2 through A.8 describe individual steps in greater detail. Section A.2 contains a separate discussion of the methods used in the accident frequency analysis of internal events for the Surry, Sequoyah, Peach Bottom, and Grand Gulf plants; the internal-event analysis for the Zion plant; and the external-event analysis for the Surry and Peach Bottom plants. Since the accident progression, source term, and offsite consequence analysis methods did not significantly differ among the plants or for internal and external events, the discussions in Sections A.3 through A. 8 are applicable to all five plants and for both internally and externally initiated accidents.
As noted above, the risk analyses of NUREG-1150 included the performance of quantitative uncertainty analysis, considering both data and modeling uncertainties. Section A.6 discusses how this uncertainty analysis was introduced and applied in the NUREG-1150 risk analyses. The methods by which expert judgments were obtained for use in the risk analyses are discussed in Section A. 7.
The remaining sections of this appendix have been extracted from the contractor reports underlying NUREG-1150. Some editorial modifications have been made to improve the flow of the text.
A.l. 2 Overview of Risk Analysis Process*
The risk analyses performed in NUREG-1150 have five principal steps (as shown in Fig. A.1):
(1) accident frequency (systems) analysis; (2) accident progression, containment loadings, and structural response analysis; (3) radioactive material transport (source term) analysis; and ( 4) offsite consequence analysis. A fifth analysis part, risk calculation, combines and analyzes the information from the previous four steps.
The transfer of information between analysis steps is critical; thus, three interfaces are illustrated in Figure A.2. Each distinct continuous line that can be followed from the left of the illustration to the box marked
- This section adapted, with editorial modification, from Chapter 2 of Reference A. 2.
A-1 NUREG-1150 OAGI0000611 00305
Appendix A Accident Frequencies Plant Damage States
/
Accident Progression, Containment Loadings, and Structural Response ll l Accident Progression Bins Transport of Radioactive Material II Source Term Groups Offsite Consequences Consequence Measure s Risk Integration Figure A.l Principal steps in NUREG-1150 risk analysis process.
NUREG-1150 A-2 OAGI0000611_00306
- r-Vl a
- tl trl ?
0
)>
VI 0
G>
0 0
0 0 (j) 0 0
(.,)
0......
Systems Analysis lnterf* tl\\iU fPDS 1 I 1PDS2 1 lPDS
- I Accident Progression
& Containment Analysis Interface Accident progression event tree ri I IAPB 1 I 4
l IAPB 2 I I
1APB3 1 r:__
t:::::'-
IAPB **I Source Term Analysis XSOR Consequence Analysis I ISTG 1 I MACCS I
YSTG+ I Key: * = npos
- = "APB
+ = nsrG Figure A.2 Interfaces between risk analysis steps.
Risk I
carcuratron
_I
~
ro
- s
- 0.
x*
Appendix A "Risk Calculation" corresponds to a distinct group of accidents with a particular set of characteristics in each analysis step. Each of the analysis steps produces results that are useful for understanding the plant's response to that stage or aspect of the accident, and each part also provides an ingredient necessary to the calculation of overall risk.
Each of the analysis steps is supported by a variety of information sources and supporting analyses. An ideal study might use comprehensive mechanistic models to calculate the entire sequence of events leading to core damage, release of radioactive material, and exposure to the public for each possible accident.
However, a large variety of accidents will be possible because there are a variety of initiating events and because "random" events occurring during the accident can change the progress of the accident. It is presently neither practical (too many possible accidents to follow) nor possible (mechanistic models do not exist for many parts of the process) to conduct such a study. As such, PRAs have relied on the use of a variety of simple models and calculational tools to substitute where integrated mechanistic calculations were not available. Some of the tools assemble results from several existing mechanistic calculations to yield a more comprehensive result. Other models provide simplified mechanistic models with as much of the detailed analysis as possible but which are able to efficiently calculate results for the wide range of conditions needed to examine the set of possible accidents.
The accident frequency analyses identify the combination of events that can lead to core damage and estimate their frequency of occurrences. Potential accident initiating events (including external events for two plants) were examined and grouped according to the subsequent system response required. Once these groups were established, accident sequence event trees were developed that detailed the relation-ships among systems required to respond to the initiating event in terms of potential system successes and failures. The front-line systems in the event trees. and the related support systems, were modeled with fault trees or Boolean logic expressions as required. The core damage sequence analysis was accomplished by appropriate Boolean reduction of the fault trees in the system combinations (the accident sequences) specified by the event trees. This Boolean reduction provides the logical combinations of failures (the cut sets) that can lead to core damage. Once the important failure events are identified, probabilities are assigned to each event and the accident sequence frequencies are quantified. The accident sequence cut sets are then regrouped into plant damage states in which all cut sets are expected to result in a similar accident progression. Variations in these frequencies are explicitly considered in an uncertainty analysis using a structured Monte Carlo approach.
The NUREG-1150 accident frequency analyses have the following products:
The total core damage frequency from internal events and, where estimated, for external events; The definitions and estimated frequencies of plant damage states; and The definitions and estimated frequencies of accident sequences.
Importance measures, including risk reduction, risk increase, and uncertainty measures, have also been assessed in NUREG-1150 accident frequency analyses.
The accident progression, containment loadings, and structural response analysis investigated the physical processes affecting the core after an initiating event occurs. In addition, this part of the analysis tracked the impact of the accident progression on the containment building. The principal tool used in NUREG-1150 for delineating and characterizing the possible scenarios in this study was the accident progression event tree. The event tree is a computational tool used to assemble a large variety of analysis results and data to yield a comprehensive result (in terms of the characteristics of alternative failure modes of the containment building and related probabilities) for each of the many accidents. The event tree is particularly suited for the study of processes that are not completely understood, permitting the study of alternative phenomenological models. The output of the accident progression event tree (APET) was a listing of numerous different outcomes of the accident progression. As illustrated in Figure A.2, these outcomes were grouped into accident progression bins (APBs) that, analogous to plant damage states.
allow the collection of outcomes into groups that are similar in terms of the characteristics that are important to the next stage of the analysis, in this case source term estimation. Once the APET is constructed, the probabilities of the paths through the APET were evaluated by a computational tool, EVNTRE (Ref. A.10). EVNTRE also performs the function of grouping similar outcomes into bins. The NUREG-1150 A-4 OAGI0000611 00308
Appendix A accidents that are grouped into a single bin are similar enough in terms of timing, energy, and other characteristics that a single source term estimate suffices for estimating the radiological impact of any of the individual accidents within that bin.
The qualitative product of the containment loadings analysis is a set of accident progression bins. Each bin consists of a set of event tree outcomes (with associated probabilities) that have a similar effect on the subsequent portion of the risk analysis, analysis of radioactive material transport. Quantitatively, the product consists of a matrix of conditional failure probabilities, with one probability for each combination of plant damage state and accident progression bin. These probabilities are in the form of probability distributions, reflecting the uncertainties in accident processes.
The next step in the risk calculation was the source term analysis. Once again a relatively simple model was developed to allow consideration of alternative inputs and the assembly of information from many sources. In this study, a plant-specific model was developed for each of the plants, with the suffix SOR '
built into the code name (shown as XSOR in Fig. A.2) (Ref. A.11). For example, SURSOR is the source term model for the Surry plant. The results of the source term analysis were release fractions for groups of chemically similar radionuclides for each accident progression bin. As with the previous analyses, a large number of results were calculated, too many for direct transfer to the next part. The interface in this case is accomplished through the calculation of "partitioned" source term groups. The large number of XSOR results are assessed and grouped in terms of their important parameters (i.e., early health threat potential and latent health threat potential) and by similarity of accident progression as it affects warning times to the surrounding population.
The product of this step in the NUREG-1150 risk analysis was the estimate of the radioactive release of a set of source team groups, each with an associated energy content, time, and duration of release.
The offsite consequence analysis in this study was performed with the MACCS (MELCOR Accident Consequence Code System) computer code, Version 1.5 (Ref. A.12). This code has been developed as a replacement for the CRAC2 code (Ref. A.13), which had previously been used by the NRC and others to estimate consequences for nuclear power plant risk analyses and other studies. The MACCS calculations were performed for each of the partitioned source terms defined in the previous step.
The product of this part of the analysis is a set of offsite consequence measures for each source term group. For NUREG-1150, the specific consequence measures discussed include early fatalities, latent cancer fatalities, population dose (within 50 miles and total), and two measures for comparison with NRC's safety goals (average individual early fatality probability within 1 mile and average individual latent fatality probability within 10 miles) (Ref. A.14).
The final stage of the risk analysis was the assembly of the outputs of the first four steps into an expression of risk. As shown in Figure A.2, the calculation of risk can be written in terms of the outputs of the individual steps in the analyses:
where:
Riskin
= Risk of consequence measure l for observation n (consequences/year);
fn (IE h)
= Frequency (per year) of initiating event h for observation n; Pn(IEh -
PDSi)
= Conditional probability that initiating event h will lead to plant damage state i for observation n; Pn(PDS;- APBj) = Conditional probability that PDS; will lead to accident progression bin j for observation n; Pn (APBJ-STGk)
Conditional probability that accident progression bin j will lead to source term group k for observation n; and A-5 NUREG-1150 OAGI0000611 00309
Appendix A Ctk
= Expected value of consequence measure l conditional on the occurrence of source term group k.
In considering this equation, the reader should note that the frequency and probabilities noted are in the form of distributions, rather than single-valued. A specialized Monte Carlo (Latin hypercube sampling) technique is used to generate these distributions (Ref. A.15). As discussed in Section A. 5, however, the consequence values used were expected values, reflecting variability in meteorology only.
Because of the large information-handling requirements of all these analysis steps, computer codes have been used to manipulate the data. Figure A.3 illustrates the computer codes used in the risk assembly process in this study. The purpose of each of these codes will be discussed in the following sections.
A.2 Accident Frequency Analysis Methods A.2.1 Internal-Event Methods for Surry, Sequoyah, Peach Bottom, and Grand Gulf*
The accident frequency analysis for the Surry, Sequoyah, Peach Bottom, and Grand Gulf plants consisted of 10 principal tasks. These are illustrated in Figure A.4. This section briefly discusses each major task and the interrelationships among tasks. These tasks are discussed in greater detail in Reference A.l.
The principal steps in the accident frequency analysis of the Surry, Sequoyah, Peach Bottom, and Grand Gulf plants were:
Plant familiarization analysis, Accident sequence initiating event analysis, Accident sequence event tree analysis, Systems analysis, Dependent and subtle failure analysis, Human reliability analysis, Data base analysis.
Accident sequence quantification analysis, Plant damage state analysis, and Uncertainty analysis.
Each of these steps will be discussed below.
Plant Familiarization Analysis The initial task of this analysis was to develop familiarity with the plant, forming the foundation for the development of plant models in subsequent tasks. Information was assembled using such sources as the Final Safety Analysis Report, piping and instrumentation diagrams, technical specifications, operating procedures, and maintenance records, as well as a plant site visit to inspect the facility and clarify and gather information from plant personnel. One week was spent in the initial plant visit. Regular contact was maintained with the plant staff throughout the course of the study. The analyses discussed in NUREG-1150 reflect each plant's status as of approximately March 1988.
At the conclusion of the initial plant visit, much of the information required to perform the remaining tasks had been collected and discussed in some detail with utility personnel so that the analysis team was familiar with the design and operation of the plant. Subsequent plant contacts were used to verify the information obtained and to identify plant changes that occurred during the analysis.
Accident Sequence Initiating Event Analysis The next task was to identify potentially important initiating events and determine the plant systems required to respond to these events. Initiating events of importance were generally those that led to a need
- Thts sectton ex1racted, with editorial modification, from Chapter 1 of Reference A.l.
NUREG-1150 A-6 OAGI0000611 00310
t z c
- 0 0
m
)>
0 I
G>
0 Ut 0
0 0
0 (j)
I 0 0
(.,)
SYSTEMS ANALYSIS Fault and event tree models I
SETS I
Core damage cutset expreJslons TEMAC I
Frequencies of plant damage states l
ACCIDENT PROGRESSION ANALYSIS Accident Progression event tree I
EVNTRE PSTEVNT
-r Probabilities of accident progression bins for each plant damage state I
I SOURCE TERM ANALYSIS Accident progression bin characteristics I
XSOR I
Source term magnitudes and release Information for each accident progression bin I
I I
I I
I CONSEQUENCE ANALYSIS Magnitudes of all source terms calculated I
PARTITION Source term group characteristics and mapping of accident progression bins to source term groups I
[MAces I I
Probabilities of consequence measures for each source term group J
l:hl:fl:j~k fiEh P(IEh-+PDSf} P(POSf-+APBj} P(APBj-+STGk) C{STGn<) = RISkJ RISQUE/PRAMlS Figure A.3 Models used in calculation of risk.
.6'
'0 (ll
~
- 0. x*
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
~
a
- o m Q
I 1-'
1-'
VI 0
r 00
~~~~~
Jtlf~l.~
- ~**********************************************..
I '
I i * * : * * *.....
FtNAlCORE INITIATING EVENT PlANT SEQUENCE DAMAGE EVENT
~
TREE DAMAGE STATE..
+
ANAlYStS ANAlYStS OUANTIFICATION ANALYSIS QUANTIFICATION UNCERTAINTY
.***....**..*.**....**. ~
~--*******************************************
DePENDENT REPORTING OF FAilURE RESULTS ANALYSIS
~
~ -
SYSTEMS DATA HUMAN ANALYSIS BASE REUABIUTY ANALYSIS ANALYSIS
_ff
-i I
PLANT FAMILIARIZATION ANALYSIS 1-I Figure A.4 Steps in accident frequency analysis of Surry, Sequoyah, Peach Bottom, and Grand Gulf.
i g 0.. x*
Appendix A for plant trip and removal of decay heat by plant safety systems. The analysis explicitly included initiating events due to failures in support systems, such as ac power or component cooling water. This analysis included several steps:
Identification of initiating events to be included in the analysis by review of previous PRAs and plant data, including review of unusual or unique events that might have affected the specific plant; Screening of initiating events on frequency of occurrence (and elimination from further consideration events of very low frequency);*
Identification of functions required to successfully prevent core damage by review of plant design and operational information; Identification of the "front-line" systems (e.g., emergency core cooling systems) performing the above functions by review of plant design and operational information; Identification of the support systems (e.g., ac power, component cooling water) necessary for operation of the front-line systems by review of plant design and operational information; Delineation of success criteria for each front-line system responding to each initiating event by review of available data and performance of additional calculations (e.g., as described in Ref. A.16); and Grouping of initiating events, based on similarity of system response.
At the conclusion of this task, the number and type of event trees to be constructed and the systems to be modeled had been identified. Thus, the scope of the modeling effort in subsequent tasks was defined.
Accident Sequence Event Tree Analysis In this task, accident sequences leading to core damage were defined by constructing event trees for each initiating event group. In general, separate event trees were constructed for each group.
System event trees that included the systems responding to each initiating event group as defined in the accident sequence initiating event analysis were constructed. The event tree structure reflected system interrelationships and aspects of accident phenomenology that determined whether or not the sequences led to core damage. Phenomenological information, such as containment failure effects that potentially impact core cooling or other systems, was obtained from the staff involved in the accident progression and containment loadings analysis.
At the conclusion of this task, models that identified all those accident sequences to be assessed in the accident sequence quantification analysis task had been constructed.
Systems Analysis In order to estimate accident sequence frequencies, the success and failure probabilities must be determined for each question (or "top event") on the system event trees. Thus, the important contributors to failure of each system must be identified, modeled, and quantified. Although the event tree questions were usually phrased in terms of system success, the fault tree top events were formulated in terms of system failure. With this transformation in mind, fault trees were constructed that reflected the success criteria specified in the three previous tasks. Each success criterion was transformed into a failure criterion that was developed for all the front-line systems included in the event trees. If these front-line systems depended on support systems, such as electric power or service water, then models were also developed for those systems. In a subsequent task, the support system trees were merged with the respective front-line system fault trees to describe the ways, including support system faults, that the undesired event may occur. Thus support system dependencies were included systematically and automatically in the quantification process.
- The reader is cautioned that the screening analysis performed and the degree of system modeling detail performed in this study were based on the designs of each of the plants. Thus, it should not be inferred that such assessments necessarily apply to other plants.
A-9 NUREG-1150 OAGI0000611 00313
Appendix A The majority of the models in this study were detailed fault trees. These were supplemented with a few simplified fault trees, Boolean equations, or black box models (event probabilities or failure rates), based on guidelines that considered such things as the relative importance of the system, complexity of the system, dominant failure modes, availability of data, etc. Selection of the level of modeling detail for each system was one of the most important steps in the analysis and did, to a great extent, determine the amount of effort required to complete the accident frequency analysis. All the front-line fluid systems required detailed fault trees, as did a few critical support systems. The outputs of this task were models for each event found in the event trees.
This task interfaced with the human reliability, dependent and subtle failure, and data base analyses.
Human errors associated with test and maintenance activities and certain responses to and recovery from accident situations were modeled directly in the fault trees. Dependent and subtle failures as a result of system interdependencies and component common-cause failures were also directly modeled. The fault trees were developed to a level of detail consistent with the data base used for quantifying failure probabilities.
Dependent and Subtle Failure Analysis Nuclear power plants are sufficiently complex that dependent and subtle failures can be of significant importance in estimating the core damage frequency. Failures that are buried in the depths of the design and operation of the plant are often not easily identifiable. Dependent and subtle failures were categorized separately because they are very distinct types of failures.
The dependent failures included:
Direct functional dependencies that involve initiators, support systems, and shared equipment; and Common-cause faults involving failures that can affect multiple components.
The subtle failures included:
Peculiar or unusual interactions of system design and interfaces, or system component operation; and Subtle interactions identified in previous studies and PRAs or by PRA experts.
The dependent failures were identified in the accident sequence analysis. When the subtle failures were identified, they were added to the sequence event trees or fault trees, as appropriate. In rare cases, such events were modeled by changes to failure data or the cut-set expressions.
Human Reliability Analysis This task involved the analysis of two types of potential human errors: (1) pre-accident errors, including miscalibrations of equipment or failure to restore equipment to operability following test and maintenance, and (2) post-accident errors, including failure to diagnose and respond appropriately to accidents. In the evaluation of pre-accident faults, calibration, test, and maintenance procedures and practices were reviewed for each front-line and support system. The evaluation included the identification of components improperly calibrated or left in an inoperable state following test or maintenance activities. For post-accident faults, procedures expected to be followed in responding to accidents modeled in the event trees were identified and reviewed for possible sources of human errors that could have affected the operability or function of responding systems. In order to support eventual sequence quantification, estimates were produced for human error rates. In generating these estimates, screening values were sometimes used for initial calculations. For most of the human errors expected to be significant in the analysis, nominal human error probabilities were evaluated using modified THERP techniques (Ref.
A.17) and plant-specific characteristics. For the boiling water reactor (BWR) plants in NUREG-1150, a detailed human reliability analysis (HRA) was performed on the post-accident human faults for the anticipated transient without scram (ATWS) sequences (Ref. A.18).
Data Base Analysis This task involved the development of a data base for quantifying initiating event frequencies and basic event probabilities (other than human errors) that appeared in the models. A generic data base NUREG-1150 A-10 OAGI0000611 00314
Appendix A representing typical initiating event frequencies as well as plant component failure rates and their uncertainties was developed. Data for the plant being analyzed, however, may have differed significantly from industrywide data. In this task, the operating history of the plant (if available) was reviewed to develop plant-specific initiating event frequencies and to determine whether any plant components had unusually high or low failure rates. Test and maintenance practices and plant experiences were also reviewed to determine the frequency and duration of these activities. This information was used to supplement the generic data base.
Accident Sequence Quantification Ana1ysis The models from each previous step were integrated into the accident sequence quantification analysis task to calculate accident sequence frequencies. This was an iterative task performed at various times during the analysis. For example, the analyst first estimated partial sequence frequencies, sometimes conservatively. If the resulting frequency of the accident sequence, considering only some of the failures involved, was below a specified cutoff value, the sequence was dropped from further consideration.
However, if the frequency of the partial accident sequence was above the cutoff value, the sequence was fully developed and recovery actions applied where appropriate using the SETS code (Ref. A.19).
Plant Damage State Analysis Plant damage state analysis provides the information necessary to initiate an accident progression analysis in a Level 2 PRA (discussed in Section A.3). The plant damage state definitions provide the status of plant systems at the onset of core damage. These definitions include descriptions of the status of core cooling systems, containment systems, and support systems in sufficient detail to describe the state of the plant for the accident progression analysis. The development of plant damage state definitions was accomplished by adding additional questions to the end of the accident sequence event trees. However, in many cases it was not necessary to actually draw the plant damage state event tree, but rather, the questions could be dealt with in a matrix format (see Section 11 of Ref. A.l).
The questions that defined the plant damage states were selected during an iterative process with the accident progression analysis staff. During the actual analysis, the accident sequence cut sets were regrouped into plant damage states, based on the particular failures in the cut sets and the answers to the selected questions. Some accident sequences contained cut sets that contributed to several different plant damage states. Similarly, there were cases where several different accident sequences could have contributed cut sets to the same plant damage state.
Once the new plant damage state cut-set groups were formed, they were quantified in the same manner as the accident sequences, in that point estimates (using mean values) were generated and an uncertainty analysis performed (as discussed below).
Uncertainty Analysis With the NUREG-1150 objective of assessing the uncertainties in severe accident frequencies and risks, the single-valued estimates of accident sequence and plant damage state frequencies were supplemented with quantitative uncertainty analysis. Both parameter value (data) and modeling uncertainties were included in the analysis, which involved several steps:
Preparation of probability distributions for the set of basic events in the logic models; Elicitation of expert judgment (from expert panels and project staff) for those issues or parameters for which insufficient information was available to readily prepare an uncertainty distribution; Determination of the correlation between parameters in the logic models; Input of the logic models and probability distributions, including correlation factors, to a computer-ized analysis package (Ref. A.20) to perform the Monte Carlo sampling and importance calculations; and Performance of additional sensitivity studies on certain key issues.
A-11 NUREG-1150 OAGI0000611 00315
Appendix A This analysis produced a frequency distribution from which mean, median, and 5th and 95th percentile values were obtained. The underlying logic models were also analyzed to rank the basic events according to their contribution to core damage frequency (using risk-reduction and risk-increase importance measures) and the uncertainty in this frequency.
A.2.2 Internal-Event Methods for Zion*
The analysis of the Zion Nuclear Plant Unit 1 for NUREG-1150 (Ref. A.21) used the large event tree, small fault tree approach originally used in the Zion Probabilistic Safety Study (ZPSS) (Ref. A.22).
Because of the existence of the ZPSS, it was determined that an accident frequency analysis of the Zion plant could be included in NUREG-1150 at a greatly reduced level of effort and cost. To achieve this, many aspects of the probabilistic risk analysis process developed in the ZPSS were carried over into the NUREG-1150 analysis.
The principal steps of the methods used in the analysis of Zion included:
Identification of initiating events, Plant response modeling (including systems analysis),
Human reliability analysis (including recovery),
Data analysis, Quantification, and Sensitivity/uncertainty analyses.
Each of these steps is discussed in more detail in the following sections.
Identification of Initiating Events-Zion The initiating event categories for which plant response models were developed were determined in the ZPSS and were used directly in the NUREG-1150 analysis with only minimal changes. The ZPSS used a number of sources of information to establish these initiating event categories, including:
Zion plant operating records, Zion plant design features and safety analyses, Previous probabilistic risk analyses, and General industry experience.
In addition to these resources, the ZPSS analysis team developed a "Master Logic Diagram" to organize their thought processes and to structure the information. Figure A.S shows the high-level Master Logic Diagram developed for the Zion Probabilistic Safety Study. Level I in the diagram represents the undesired event for which the risk analysis is being conducted, i.e., an offsite release of radioactive material. Level II answers the question: "How can a release to the environment occur?" Level III shows that a release of radioactive material requires simultaneous core damage and containment failure. Level IV answers the question: "How can core damage occur?"
After several more levels of "how can" questions, the diagram arrives at a set of potential initiating events.
The ZPSS listed 59 internal initiating events that were assigned to the first 13 initiating event categories shown in Figure A.S. The NUREG-1150 analysis was able to reduce the number of initiating event categories by combining several that had the same plant response. For example, the loss of steam inside and outside the containment was collapsed into loss of steam. The result was 11 initiating event categories for the NUREG-115 0 analysis.
Plant Response Modeling-Zion The plant response modeling for the NUREG-1150 analysis was based on the ZPSS work and consists of three parts. The first part is event tree modeling. The ZPSS developed 14 event tree models, one for each
- This sectton extracted, with edt tonal modtftcahon, from Reference A.21.
NUREG-1150 A-12 OAGI0000611 00316
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
-...(
~
f-'
lJ.l z
~
m 0
I f-'
H
~
UYff..l U'Vtln U'Vlt..ut LlYl\\. rv Lf.YU.Y t.IYlLYI L.IVILVII UYlt.VIII I
tAit~t Q
IHTUlNAL INilaATOJI$....
IKUNfAL 1Ntlt4JOAS..
J 1 r"'"""Y COOLAH' : 1 tQ\\JHDARV,AIL vi' I Q
~
MUhutll SWAu.
- OCA I.OCA
_Q 9 Ut1UNAL 1ttT£AJtAt.
INI11A10AS llrtlfiAlORS EJCTIRNA.L fXtlfiiNAL tNtTIATOA5 IN lilA lOftS I
I_ **u:.u or:
J C0Rl UAT(AIAL
(,J I
I co**
OAMAGt Q
I l
LOSSOfl COR£ COOllttG Q
l IIHSUff ICI(HT co.., I HlAT lii(MOVAL Q
I DIRECT I
L IHOIII(CT J
wun.&.TOftS tHI1'1A10"1i Q
Q I
7 10 II 12 Lf.A.CA.Gl' U)SSOI l0$$0F LO$SM T\\IAIINl SI'VRIOUC.
llfAC1'0A
'OQOP LOSIOI ro PIUMAIIV' fUO SliAM SAJtTY
$TEAM U.mtiOA""
IXlO""'l fi.DW fLDw NOlC"fi()M lMSIOl 0\\11$10\\
COOIAH'I HOW a:lhTAI...
CONTAtNo IIIINT Q Q _Q _ Q Q
_Q Q Q Q lftTtR..,AI.
JN'UR,.,AL.
INUA,.AL I,..TUiiHAL ttftt:RNAI.
tfrriiTUUf.&L IN1UifWAl INT[IU'CAL tlfTliii.. AL.
lfrlllf1A1Qft5 INITIATORS INITtAlOR$:
IHITIAlOAS INI11.&T0fll~
lttlliAlOAS WIIITIATOIIIS lf'fiTtATOI'S INJTIATOftS
~
l~T(A,.A\\.
IXUANAL I:UUINAL lKURNAl l:XUAh*L t:lf(IJINAL f.lllE.RfriiA\\.
faruu.,.-.L fX1UtN... L IHIJIAIOR$
INIIIATOftS 1~11tATOA$
INiliATOfll$
INITIATOA!I IHiti*TOMS 1NtTtATOA5 INITIA10ftS IN.nATD"S Figure A.S Zion Probabilistic Safety Study master logic diagram.
I OU$t11 I
ftlllA.St Q
I
~CHrrOfroiA&.
IXJfrtiAIHMIIIIIT fAILUI'II c~
I lliCUS I
COlli( fOWl II 0
I]
COO(
D:>HTAIN I'()Wlft
,.,,,.r
\\MC"lA.M.
fAJLual
_Q _ _Q t~HftNA\\.
IHUI.NAI.
,,..,,,,.,,0"5 IH.IIAIOM tllllRNAL lX'trftNAL lfrlllll"'fOIII lfr61TIA10II.S I
lllUASCOf'..O..
c:o*t """""""
0 J
NO"'COftl JtfU.&S.f Q
lfoiTtft'-IA\\
INIIIATOAS tkllRt.IAL tNniATO"S..
~
(D
- l
- 0.
~-
Appendix A of the initiating event categories and one for the failure of reactor trip condition (anticipated transient without scram). This last event tree is actually a subtree or extension to a number of the main event trees but was separated out to easily quantify the frequency of ATWS.
The ZPSS event trees were the basis for the NUREG-1150 event trees. Modifications were made to each of the original event trees to reflect the latest understanding of the intersystem dependencies. Many of the changes from the ZPSS to the NUREG-1150 analysis were based on the review of the ZPSS performed by Sandia National Laboratories under contract to the NRC staff (Ref. A.23) and comments on the draft version of this work (Ref. A.4).
The second part of the plant response model was the development of electric power support states. The ZPSS analysis of the Zion electric power system and the dependencies of other plant systems on electric power resulted in the identification of eight unique electric power states. Each power state defined a combination of successful and failed power sources. Each electric power state had a unique impact on the set of systems included in the event tree top events.
The final part of the plant response modeling was the analysis of the systems that provide the safety and support functions defined by the event tree top events. From the top event definitions and success criteria and the electric power states, a set of boundary conditions for each system analysis was developed. The number of unique boundary conditions determined the number of conditional split fractions that had to be modeled.
A conditional split fraction is the system availability given a specific set of conditions such as the initiating event, the electric power state, and the operational status of other required support systems. For instance, for the auxiliary feedwater system, seven conditional split fractions were needed. One (conditional split fraction "L 11"), for example, was used for transients and loss-of-coolant accidents (LOCAs) with all power available.
The NUREG-1150 analysis for Zion made extensive use of the system analyses in the ZPSS. After verification of the current plant configuration, most conditional split fractions used in the NUREG-1150 analysis came directly from the ZPSS. In some cases, new conditional split fractions had to be developed to accommodate event tree model changes. These included several for the component cooling water system, the service water system, and the high-pressure injection system, among others. For the most part, the new conditional split fractions were able to be constructed from pieces of system analyses existing in the ZPSS.
Human Reliability Analysis-Zion The human reliability analysis identified the human actions of operation, maintenance, and recovery that should be considered in the probabilistic risk analysis process. It also determined the human error rates to be used in the quantification of these actions. The NUREG-1150 analysis included human action involving: pre-initiator testing and maintenance actions; accident procedure actions; and recovery actions.
Pre-initiator testing and maintenance actions included the types of human errors that could render a portion of the plant unavailable to respond to an initiating event. Examples of these errors were improper restoration of a system after testing and miscalibration of instrument channels.
Accident procedure actions are required for the plant to fully respond to an initiating event. These actions were generally called out in the emergency operating procedures. Examples of these human actions were establishing feed-and-bleed cooling, switching from the injection mode of emergency core cooling to containment sump recirculation, and depressurizing below the steam generator safety valve setpoints during a steam generator tube rupture.
Recovery actions may or may not be called out in the emergency operating procedures. These actions are taken in response to the failure of an expected function. Examples of these types of actions included recovering ac electrical power, manually starting a pump that should have received an auto-start signal, and refilling the refueling water storage tank in the event of emergency core cooling system recirculation failure.
NUREG-1150 A-14 OAGI0000611 00318
Appendix A Pre-initiator testing and maintenance actions were usually incorporated into the system models since most of them impacted only a single system. Accident procedure actions were typically included at the event tree level as a top event because they were an expected portion of the plant/operator response to the initiating event. These actions may have been included in the system models if they impacted only a single system. Recovery actions were included either in the event trees or the system models or applied to the sequence models after processing of the plant response models.
Pre-initiating event testing and maintenance errors were included in the system models and were taken directly from the ZPSS. The accident procedure errors were also taken from the ZPSS after verification that the emergency procedures and plant operating philosophies had not changed significantly from the time of the ZPSS. Recovery actions were developed specifically for the NUREG-1150 analysis and were applied to specific system models and to specific accident sequences as appropriate.
Data Analysis-Zion The ZPSS performed an extensive analysis of plant-specific data to determine the failure rates and demand failure probabilities for all the basic events used in the models. The plant data collected included component failure data, test frequencies and results, component service hours, and maintenance frequencies and durations.
This information was combined with generic failure data from sources such as Reactor Safety Study (Ref.
A.24), IEEE-500 (Ref. A.25), and others by a single-stage or two-stage Bayesian update analysis. The generic data were reviewed and screened for applicability before being used as a prior distribution in the Bayesian updating process.
The NUREG-1150 analysis reviewed the plant operating history and determined that no significant changes had occurred that would invalidate any portion of the ZPSS data analysis. This was confirmed in discussions with the licensee. Therefore, the data used in the NUREG-1150 analysis were taken directly from the ZPSS.
Quantification-Zion For the NUREG-1150 analysis, the event tree models and the conditional split fraction values were input and processed using computer codes designed specifically for manipulation of large event tree, small fault tree models with support system states (i.e., the models used in the ZPSS and other PRAs) (e.g.,
Ref. A.26). Approximately 16,000 accident sequences were quantified. Each event tree was analyzed eight times, once for each electric power state. For each analysis, the appropriate conditional split fractions were assigned to the top events. The results were single-valued estimate accident sequence frequencies.
The accident sequences with a single-valued estimate frequency less than lE-9 per year were not processed any further and were dropped. Recovery actions pertaining to specific situations were applied to the appropriate remaining sequences. Again, any sequences that fell below the lE-9 cutoff were dropped.
The remaining accident sequences were assigned to plant damage states (PDSs). The PDS frequencies were determined by summing the frequencies of all the sequences in a given PDS.
Sensitivity/Uncertainty Analyses-Zion For purposes of sensitivity and uncertainty analyses, the accident sequences with a single-valued estimate frequency greater than or equal to 1E-9 per reactor year were loaded into IRRAS 2.0 (Ref. A.27), a fault tree/event tree generation and analysis model developed for NRC. Six issues were identified for which sensitivity/uncertainty evaluations were desired. These issues were determined by examining the results of the single-valued estimate quantification.
For each of these issues, an expression of the uncertainty was developed. These expressions were used in combination with uncertainties in failure data in a specialized Monte Carlo analysis method (Latin hypercube sampling) (Ref. A.15) to generate a sample of 150 observations. These observations were A-15 NUREG-1150 OAGI0000611 00319
Appendix A propagated through the system and sequence models using IRRAS 2.0 to generate 150 frequencies for each sequence and plant damage state. From these, probability distributions for individual plant damage states and total core damage frequency were determined. This information was then passed on to the accident progression and risk analysis portions of the Zion study.
A.2.3 External-Event Methods for Surry and Peach Bottom*
Seismic Accident Frequency Analysis Methods A nuclear power plant is designed to ensure the survival of buildings and emergency safety systems in earthquakes less than one of a specific magnitude (the "safe shutdown" earthquake). In contrast, the analysis of seismic risk requires consideration of the range of possible earthquakes, including those of magnitudes less than and greater than the safe shutdown earthquake. Seismic risk is obtained by combining the frequencies of the spectrum of possible earthquakes, their potential (and very uncertain) effects on equipment and structures within the plant under study, and the subsequent effects on core and containment building integrity. In considering this, it should be noted that during an earthquake, all parts of the plant are excited simultaneously. Thus, during an earthquake, redundant safety system components experience highly correlated base motion, and there is a high likelihood that multiple redundant components would be damaged if one is damaged. Hence, the "planned-for" redundancy of equipment could be compromised. This common-cause failure mechanism represents a potentially significant risk to nuclear power plants during earthquakes.
The seismic accident frequency analysis method used in NUREG-1150 for the analysis of the Surry and Peach Bottom plants is based, in part, on the results of two earlier NRC-sponsored programs. The first was the Seismic Safety Margins Research Program (SSMRP) (Ref. A.29). In the SSMRP, a detailed seismic risk analysis method was developed. This program culminated in a detailed evaluation of the seismic core damage frequency of the Zion nuclear power station (Ref. A.30). In this evaluation, an attempt was made to accurately compute the responses of walls and floor slabs in the Zion structures, movements in the important piping systems, accelerations of all important valves, and the spectral accelerations at each safety system component (pump, electrical bus, motor control center, etc.). Correlation between the responses of all components was computed from the detailed dynamic response calculations. The important safety and auxiliary systems functions were analyzed, and fault trees were developed that traced failure down to the individual component level. Event trees related the system failures to accident sequences and radioactive release modes. Using these detailed models and calculations, it was possible to evaluate the frequency of core damage from seismic events at Zion and to determine quantitatively the risk importance of the components, initiating events, and accident sequences.
The second NRC program used in the NUREG-1150 analyses was the Eastern Seismic Hazard Characterization Program (Ref. A. 31), which performed a detailed earthquake hazard assessment of nuclear power plant sites east of the Rocky Mountains. Results of these two programs formed the basis for a number of simplifications used in the seismic method reported here.
There are seven steps required for calculating the frequency of seismically initiated core damage accidents in a nuclear power plant:
Determination of the local earthquake hazard (hazard curve and site spectra);
Identification of accident sequences for the plant that lead to the potential for release of radioactive material (initiating events and event trees);
Determination of failure modes for the plant safety and support systems (fault trees);
Determination of the responses (accelerations or forces) of all structures and components (for each earthquake level);
Determination of fragilities (probabilistic failure criteria) for the important structures and compo-nents;
- nis section extracted, with editorial modification, from Part 3 of Reference A.28.
NUREG-1150 A-16 OAGI0000611 00320
Appendix A Computation of the frequency of core damage using the information from the first five steps; and Estimation of the uncertainty in the core damage frequencies.
Work performed in each of these steps is summarized below.
Determination of Local Earthquake Hazard The seismic analyses in this report made use of two data sources on the frequency of earthquakes of various intensities at the specific plant site (the seismic "hazard curve" for that site): the Eastern United States Seismic Hazard Characterization Program, funded by the NRC at Lawrence Livermore National Laboratory (LLNL) (Ref. A.31); and the Seismic Hazard Methodology for the Central and Eastern United States Program, sponsored by the Electric Power Research Institute (EPRI) (Ref. A.32). In both the LLNL and EPRI programs, seismic hazard curves were developed for all U.S. commercial power plant sites east of the Rocky Mountains, using expert panels to interpret available data. The NRC staff presently considers both program results to be equally valid (Ref. A.33). For this reason, two sets of seismic results are provided in this report. Section C.11 of Appendix C discusses the analysis of seismic hazards in more detail.
Identification of Accident Sequences The scope of the NUREG-1150 seismic analysis includes loss-of-coolant accidents (LOCAs) (including vessel rupture and pipe ruptures of a spectrum of sizes) and transient events. Two types of transient events were considered: those in which the power conversion system (PCS) is initially available (denoted type T3 transients) and those in which the PCS is failed as a direct consequence of the initiating event (denoted type T1 transients). The event trees developed in the internal-event analyses are used. For the seismic analysis, the reactor vessel rupture and large LOCA event frequencies were based on a Monte Carlo analysis of steam generator and reactor coolant pump support failures. The frequency of Type Tl transients is based on the frequency of loss of offsite power (LOSP). This is the dominant cause of this type of transient (for plants such as those studied in NUREG-1150 in which LOSP causes loss of main feedwater). Given an earthquake of reasonable size, it is assumed that a type T3 transient occurs with a probability of unity.
Determination of Failure Modes The internal-event fault trees were used in the seismic analysis with some modification to include basic events for seismic failure modes and to resolve the trees for pertinent cut sets to be included in the probabilistic calculations. Probabilistic culling was used in the resolution of these trees in such a way as to ensure that important correlated failure modes were not lost.
Determination of Fragilities Component seismic fragilities were obtained both from a generic fragility data base and from plant-specific fragilities developed for components identified during the plant walkdown.
The generic data base of fragility functions for seismically induced failures was originally developed as part of the SSMRP (Ref. A.29). Fragility functions for the generic categories were developed based on a combination of experimental data, design analysis reports, and an extensive expert opinion survey. The experimental data used in developing fragility curves were obtained from the results of component manufacturers' qualification tests, independent testing laboratory failure data, and data obtained from the extensive U.S. Corps of Engineers SAFEGUARD Subsystem Hardness Assurance Program (Ref. A.34).
These data were statistically combined with the expert opinion survey data to produce fragility curves for each of the generic component categories.
Detailed structural fragility analyses were performed for all important safety-related structures at the NUREG-1150 plants. In addition, an analysis of liquefaction for the underlying soils was performed.
These were included directly into the accident frequency analysis.
Determination of Responses Building and component seismic responses were estimated from peak ground accelerations at several probability intervals on the hazard curve. Three basic aspects of seismic response-best estimates, A-17 NUREG-1150 OAGI0000611 00321
Appendix A variability, and correlation-were generated. Results from the SSMRP Zion analysis (Ref. A.30) and other methods studies (Ref. A.35) formed the basis for assigning scaling, variability, and correlation of responses.
In each case, computer code calculations (using the SHAKE code (Ref. A.36)) were performed to assess the effect of the local soil column (if any) on the surface peak ground acceleration and soil-structure interactions. This permitted an evaluation of the effects of nonhomogeneous underlying soil conditions that could have strongly affected the building responses.
Fixed base mass-spring (eigen-system) models were either obtained from the plant's architect/engineer or were developed from the plant drawings. Using these models, the floor slab accelerations were calculated using the CLASS! computer code (Ref. A.37). This code uses a fixed-base eigen-system model of the structure and input-specified frequency-dependent soil impedances and computes the structural response (as well as variation in structural response if desired). Variability in responses (floor and spectral accelerations) was assigned based on results of the SSMRP.
Correlation between component failures was explicitly included in the analysis. In computing the correlation between component failures (in order to quantify the cut sets), it was necessary to consider correlations both in the responses and in the fragilities of each component. Inasmuch as there are no data as yet on correlation between fragilities, the fragility correlatwns between like components were taken as zero, and the possible effect of such correlation quantified in a sensitivity study. The correlation between responses is assigned according to a set of rules.
Computation of Frequency of Core Damage Given the input from the five steps above, the SETS computer code (Ref. A.19) was used to calculate required outputs (probabilities of failure, core damage frequency, etc.).
Estimation of Uncertainty Using Monte Carlo techniques, frequency distributions of individual parameters in the seismic analysis were combined to yield frequency distributions of accident sequences, plant damage states, and total core damage.
Fire Accident Frequency Analysis Methods Nuclear power plants are designed to be able to safely shut down in the presence of a spectrum of possible fires throughout the plant (Ref. A.38). Nonetheless, some plant areas contain cabling for multiple trains of core cooling equipment. Fires in such areas (and in some cases in conjunction with random equipment failures not caused by a fire) can lead to accident sequences with relatively important frequencies. For this reason, the core damage frequency from fire-initiated accidents was assessed for two power plants (Surry and Peach Bottom).
The principal steps in the simplified fire accident frequency analysis method used in NUREG-1150 were as follows:
Initial plant visit, Screening of potential fire locations, and Accident sequence quantification.
Each of these steps is summarized below.
Initial Plant Visit Based on the internal-event and seismic analyses, the general location of cables and components of the principal plant systems had previously been developed. A plant visit was then made to provide the analysis staff with a means of seeing the physical arrangements in each of these areas. The analyst had a fire zone checklist that would aid the screening analysis and the quantification step.
NUREG-1150 A-18 OAGI0000611 00322
Appendix A The second purpose of the initial plant visit was to confirm with plant personnel that the documentation being used was in fact the best available information and to get clarification about any questions that might have arisen in a review of the documentation. As part of this, a thorough review of firefighting procedures was conducted.
Screening of Potential Fire Locations It was necessary to select important fire locations within the power plant under study that have the greatest potential for producing accident sequences of high frequency or risk.
The screening analysis was comprised of:
Identification of relevant fire zones A thorough review of the plant Appendix R (Ref. A.38) submittal was conducted to permit the division of this plant into fire zones. A fire zone can be defined as a plant area surrounded by a 3-hour-rated barrier or its equivalent. From this complete plant model, fire zones were screened from further analysis if it could be shown that neither safety-related equipment nor its associated power or control cabling was located within them.
Screening of fire zones on probable fire-induced initiating events Fire zones where the overall fire occurrence frequency is less than 1E-6 per year were eliminated from further consideration. Also, certain fire-induced initiating events such as loss of offsite power could be eliminated if a particular fire zone contained none of its cabling. Therefore, even if a fire zone could not be screened as a whole, certain of the fire-induced initiators that might be postulated to occur within this zone could be eliminated.
Screening of fire zones on both order and frequency of cut sets Cut sets containing random failure combinations with frequencies less than lE-4 were eliminated from further consideration. In this step, cut sets with multiple fire zone combinations were addressed.
Any cut set containing three or more fire zone combinations was screened from further considera-tion. These scenarios would imply the simultaneous failure of two or more 3-hour-rated fire barriers and therefore were considered probabilistically insignificant. Cut sets containing only two fire zones were eliminated on the following three criteria:
If there was no adjacency between the two areas; If there was an adjacency, it contains no penetrations; and On probability, with barrier failure probability set to 0.1.
Analysis of each fire zone remaining to numerically evaluate and to cull on probability The remaining cut sets were now resolved with fire-zone-specific fire initiating event frequencies and then screened on a frequency criteria of lE-8 per year.
Accident Sequence Quantification After the screening analysis has eliminated all but the probabilistically significant fire zones, quantification of dominant cut sets was completed as follows:
Determination of the temperature response in each fire zone The modified COMPBRN III code (Ref. A.39) was used to calculate time to damage of all critical cabling and components within a fire zone.
Computation of component fire fragilities For those modeled components in the COMPBRN analysis, damageability temperatures were assigned based on fire test experience.
Assessment of the probability of barrier failure for all remaining combinations of fire zones A-19 NUREG-1150 OAGI0000611 00323
Appendix A The remaining cut sets that contained two fire zones had barrier failure probabilities calculated.
Those cut sets that were below 1E-8 per year were eliminated from further consideration.
Performance of recovery analyses In a manner like that of the internal-event recovery analysis, recovery of random failures was applied on a cut-set by cut-set basis. For sequences less than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in duration, only one recovery action was allowed. If more than one recovery action was possible for any of these given cut sets, a consistent hierarchy of which recovery action to apply was used. In sequences of greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, two recovery actions were allowed. The only modifications to recovery probabilities were found in areas where a fire had to first be extinguished and then the area desmoked prior to the occurrence of a local action.
This quantification was performed using specialized Monte Carlo techniques (Latin hypercube sampling)
(Ref. A.15) so that individual parameter frequency distributions can be combined into frequency distributions of accident sequences, plant damage states, and total core damage frequency.
Bounding Analysis of Other External Events Bounding analyses were performed for NUREG-1150 for those external events that were judged to potentially contribute to the estimated plant risk. Those events that were considered included extreme winds and tornadoes, turbine missiles, internal and external flooding, and aircraft impacts.
Conservative probabilistic models were used in these bounding analyses to integrate the randomness and uncertainty associated with event loads and plant responses and capacities. Clearly, if the mean initiating event frequency resulting from a conservative model was predicted to be low (e.g., less than 1E-6), the external event could be eliminated from further consideration. Using this logic, the bounding analyses identified those external events that needed to be studied in more detail as part of the risk analysis. In the case of both Peach Bottom and Surry, none of these "other external events" was found to be a potentially significant contributor to core damage frequency.
A.2.4 Products of Accident Frequency Analysis The results of the accident frequency analyses discussed in this section can be displayed in a variety of ways. The specific products shown in NUREG-1150 are described as follows:
The total core damage frequency for internal events and, where estimated, for external events For Part II of NUREG-1150 (plant-specific results), a histogram-type plot was used to represent the distribution of total core damage frequency as shown on the right side of Figure A.6. This histogram displays the fraction of Latin hypercube sampling (LHS) observations falling within each interval.*
Four measures of the probability distribution are identified:
- Mean, Median, 5th percentile value, and 95th percentile value.
A second display of accident frequency results is used in Part III of NUREG-1150, where results for all five plants are displayed together. This figure provides a summary of these four specific measures in a simple graphical form (shown on the left side of Fig. A.6).
For those plants in which both internal and external events have been analyzed (Surry and Peach Bottom), the core damage frequency results are provided separately for the two classes of accident initiators.
- Care should be taken in using these histograms to estimate probability density functions. These histogram plots were developed such that the heights of the individual rectangles were not adjusted so tliat the rectangular areas represented probabilities. TI1e shape of a corresponding density funct1on may be very different from that of the histogram. The histograms represent the probability distnbution of the loganthm of the core damage frequency.
NUREG-1150 A-20 OAGI0000611 00324
Appendix A 95th,_..
j I
I m~
l Key M =mean m =median Figure A.6 Example display of core damage frequency distribution.
A-21 NUREG-1150 OAGI0000611_00325
Appendix A The definitions and estimated frequencies of plant damage states The total core damage frequency estimates described above are the result of the summation of the frequencies of various types of accidents. For this summary report, the total core damage frequency has been divided into the contributions of specific plant damage states:*
Station blackouts, in which all ac power (coming from off site and from emergency sources in the plant) is lost; Transient events with failure of the reactor protection system (A'lWS events);
Other transient events; Loss-of-coolant accidents (LOCAs) resulting from pipe ruptures, reactor coolant pump seal failures, and failed relief valves occurring within the containment building; and LOCAs that bypass the containment building (steam generator tube ruptures and other "interfacing-system LOCAs").
Figure A.7 provides an example display of mean plant damage state frequencies used in NUREG-1150.
In addition to these quantitative displays, the results of the accident frequency analyses also can be discussed with respect to the qualitative perspectives obtained. In NUREG-1150, qualitative perspectives are provided in two levels:
Important plant characteristics. The discussion of important plant characteristics focuses on general system design and operational aspects of the plant. Perspectives are thus provided on, for example, the design and operation of the emergency diesel generators or the capability for the feed and bleed mode of emergency core cooling.
Important individual events. One typical product of a PRA is a set of "importance measures." Such measures are used to assess the relative importance of individual items (such as the failure rates of individual plant components or the uncertainties in such failure rates) to the total core damage frequency. While a variety of measures exists, two are discussed (qualitatively) in NUREG-1150. The first importance measure (risk reduction) shows the effect of significant reductions in the frequencies of individual plant component failures or plant events (e.g., loss of offsite power, specific human errors) on the total core damage frequency. In effect, this measure shows how to most effectively reduce core damage frequency by reductions in the frequencies of these individual events. The second importance measure (uncertainty reduction) discussed in NUREG-1150 indicates the relative contribution of the uncertainty in key probability distributions to the uncertainty in total core damage frequency. In effect, this measure shows how most effectively to reduce the uncertainty in core damage frequency. A third importance measure, risk increase, is discussed in the contractor reports underlying NUREG-1150.
As illustrated in Figure A.3, the results of this analysis are the first and second inputs to the risk calculations, F(/Eh), the frequency of initiating event h, and P(IEh-PDSi), the conditional probability of plant damage state i, given initiating event h.
A.3 Accident Progression, Containment Loadings, and Structural Response Analysis**
A.3.1 Introduction The purpose of the accident progression, containment loadings, and structural response analysis is to track the physical progression of the accident from the initiating event until it is concluded that no additional release of radioactive material from the containment building will occur. Thus, the core damage process is studied in the reactor vessel, as the vessel is breached, and outside the vessel. At the same time, the analysis tracks the impact of the accident progression on the containment building structure, with particular focus on the threat to containment integrity posed by pressure loadings or other physical processes.
- A more detailed set of plant damage states is provided m the supportmg contractor reports.
.. This section extracted, with editonal modification, from Chapter 2 of Reference A.2.
NUREG-1150 A-22 OAGI0000611 00326
Appendix A Transients ATWS Total Mean Core Damage Frequency: 4.5E-6 Figure A 7 Example display of mean plant damage state frequencies.
A-23 NUREG-1150 OAGI0000611_00327
Appendix A The requirements of an ideal accident progression analysis would be knowledge, probably in the form of the results of mechanistic calculations from validated computer codes, of the characteristics of the set of possible accident progressions resulting from individual plant damage states defined in the previous analysis step. More than one accident progression can result from each plant damage state since random events (hydrogen detonations, for example) occurring during the accident progression can alter the course of the accident. Given the frequency of the plant damage state and the probabilities of the random events, one could determine the outcomes and frequencies of the set of possible accidents.
Knowledge of the characteristics of all possible accidents resulting from each plant damage state is clearly not available with current technology. A large number of mechanistic codes that can predict some aspects of the accident progression are available. For example, MELPROG (Ref. A.40) and CONTAIN (Ref.
A.41) can be used to track in-vessel and containment events, respectively, for very explicit accident progressions. Less detailed but more comprehensive codes, such as the Source Term Code Package (STCP) (Ref. A.42), MAAP (Ref. A.43), and, more recently, MELCOR (Ref. A.44), have been developed to predict generalized characteristics of more aspects of the accident in an integrated fashion.
While these codes are very useful for developing a detailed understanding of accident phenomena and how the different phenomena interact, they do not meet the constraints imposed by a PRA; i.e., the ability to analyze a very wide range of scenarios with diverse boundary conditions in a timely and cost-efficient manner. In addition, the number of code calculations necessary to investigate uncertainty and sensitivity to inputs, models, and assumptions would be prohibitively expensive. Further, these codes have not been fully validated against experiments. Thus, codes developed by different groups (for example, NRC and industry contractors) frequently include contradictory models and give different results for given sets of accident boundary conditions. Finally, these codes also do not contain models of all phenomena that may determine the progression of the accident.
The information that was available with which to conduct the accident progression analysis for NUREG-1150 consisted of the diverse body of research results from about 10 years of severe accident research within the reactcr safety community. This included a large variety of severe accident computer code calculations, other mechanistic analyses, and experimental results. Much of the information represented basic understanding of some important phenomena. Because of the expense of developing and running large integrated codes, less information was in the form of integrated accident progression analyses. That which was available was usually confined to analyses of a few types of accident sequences.
All existing codes were recognized to have some limitations in their abilities to mechanistically model severe accidents.
Many new calculations were conducted specifically for NUREG-1150. For example, new CONTAIN code calculations were performed to assess pressure loadings on the containment and sensitivity of the loading calculations to various phenomenological assumptions (Ref. A.45). Most of the new calculations are described in the contractor reports supporting NUREG-1150. In particular, Reference A.46 contains a complete listing and description of the new supporting calculations. For the most part, the new calculations were intended to fill the largest gaps in the present state of knowledge of accident progression for the most important accidents.
Given this state of information, the NUREG-1150 accident progression analysis was performed in a series of steps, including:
Development of accident progression event trees, Structural analyses, Probabilistic quantification of event tree issues, and Grouping of event tree outcomes.
Each of these steps is discussed below.
A.3.2 Development of Accident Progression Event Trees The NUREG-1150 accident progression analyses were conducted using plant-specific event trees, called accident progression event trees (APETs). The APETs consist of a series of questions about physical phenomena affecting the progression of the accident. A typical question would be "What is the pressure rise in the containment building at reactor vessel breach?" A complete listing of the questions that make NUREG-1150 A-24 OAGI0000611 00328
Appendix A up the accident progression event tree for each plant studied in NUREG-1150 can be found in References A.47 through A.51. Typically, the event trees for each plant consisted of about 100 questions; each question could have multiple outcomes or branches.
The NUREG-1150 APETs were general enough to efficiently calculate the impact of changes in phenomenological models on the accident progression in order to study the effect of uncertainties among these models. This generality added complexity to the analysis since, with the ability to consider different models, some paths through the tree, which would be forbidden for a specific model, had to be included when a variety of models was considered. The multiplicity of possible accident progression results caused by the consideration of multiple models for some of the accident phenomena was amplified at each additional stage of the accident progression since, in addition to creating more possible outcomes, a wider range in boundary conditions at the subsequent events was made possible. Because of the flexibility and generality of the APETs, basic principles, such as hydrogen mass conservation, steam mass conservation, etc., were incorporated into the event trees in order to automatically eliminate pathways for which the principles are violated. This was accomplished with parameters, such as hydrogen concentrations in various compartments, passed along in the tree as each accident pathway was evaluated. At some questions in the tree, the parameters were manipulated using computer subroutines. The branch taken in each question could depend on the values of such calculated parameters. The consistency of phenomen-ological treatment throughout each accident was also ensured by allowing questions to depend on the branches or parameters taken in previous questions.
Figure A.B schematically illustrates the APETs used in this study. The first section of the tree (about 20 percent of the total number of questions) was used to automatically define the input conditions associated with the individual plant damage state (PDS). Thus, if one of the characteristics of a PDS was the pressure in the reactor vessel at the onset of core damage, a question was included to set the initial condition according to that variable. The next part of the tree was then devoted to determining whether or not the accident was terminated before failure of the reactor vessel. Questions pertinent to the recovery of cooling and coolability of the core were asked in this part of the tree. The next section of the tree continued the examination of the accident progression in the reactor vessel. As illustrated in Figure A.8, there were two principal areas of investigation for this part of the analysis: in-vessel phenomena that determined the radioactive release characteristics; and events that impacted the potential for containment loadings. The example in Figure A. 8 shows the phenomena associated with the release of hydrogen during the in-vessel phase of accident progression and the resultant escape of that hydrogen into the containment building.
The next stage illustrated in Figure A.8 continues the examination of the accident during, and immediately after, reactor vessel breach. This included the continued core meltdown in the vessel and the simultaneous loading and response of the containment building. A good example for this stage of the APET analysis is an examination of the coolability of the debris once out of the reactor vessel, followed by questions concerning the loading of the containment as a result of core-concrete interactions.
The final stage of the illustrated APET is related to the final status of containment building integrity.
Long-term overpressurization, threats from combustion events, and similar questions were asked for this stage of the accident progression. For convenience, some questions that summarized the status of the containment at specific times during the accident were also included.
Throughout the progression of a severe accident, operator intervention to recover systems has the potential to mitigate the accident's impact. Such actions were considered in the APET analysis, using the same rules as those used in the accident frequency analysis.
The previous explanation has delineated the general flow of the accident progression event tree. What is not immediately apparent in this summary is the degree to which dependencies could be taken into account.
An example of the dependency treatment is a series of questions that relate to hydrogen combustion. The outcomes of the event tree questions that ask whether hydrogen deflagration occurs sometime after vessel breach and what is the resulting pressure load from the burn are highly dependent on previous questions.
The individual values for the probability of ignition and the pressure rise were dependent on:
Previous hydrogen burn questions (the amount consumed in each previous burn was tracked, and the concentration at the later time was calculated consistent with all previous hydrogen events);
A-25 NUREG-1150 OAGI0000611 00329
Appendix A Boundary Conditions:
Plant Damage States Pressure In vessel NUREG-1150 I Recovel)' of I Core Prior to Vessel Breach I
Recovel)'of lniection Yes In-Vessel Processes and Containment Impact Hydrogen released?
Hydrogen bum before vessel breach
--[
I Ex-Vessel l Processes and Containment (Impact Debris coolablnty J Pressure increase I due to H2 burn during CCI gas I generation
[
- Amount of hydrogen released Is sampled from continuous probability distribution
- Pressure increase is calculated from user function Figure A.8 Schematic of accident progression event tree.
A-26 I Final I Outcome I late I contalnment J overpressure I Yes I~
I,c I
~c I :c I IC I
'C I
'C I
t,c I
'C I
OAGI0000611_00330
Appendix A Questions concerning the steam loading to determine whether the atmosphere was steam inert; and Questions concerning the availability of power, which influenced the probability of ignition.
In tum, these questions all had further dependencies on each other and on other questions. For example, the steam loading questions were dependent on the power and equipment availability since heat removal system operation would impact the steam concentration.
A.3.3 Structural Analyses The NUREG-1150 APETs explicitly incorporate consideration of the structural response of containment buildings, including a building's ultimate strength, failure locations, and failure modes. Use was made of available detailed structural analyses (e.g., Ref. A.52) and results of recent experimental programs (e.g.,
Ref. A. 53). The judgments of experts were used to interpret the available information and develop the required input (probability distributions) for the APET (see Section A. 7 for discussion of the use of expert judgment).
A.3.4 Probabilistic Quantification of APETs In general, phenomenological models were not directly substituted into the event trees (in the form of subroutines) at each question. Rather, the results of the model calculations were entered into the trees through the assigned branching probabilities, the dependencies of the questions on previous questions (the "case structure"), and/or tables of values that were used to determine parameters passed or manipulated by the event tree. Some questions in the trees, such as those concerning the operability of equipment and availability of power, were assigned probability distributions derived from data analogous to the process in the accident frequency analysis. Timing of key events was identified through a review of available code calculations and other relevant studies in the literature. The process of assigning values to the branch point probabilities, creating the case structure, writing the user functions, and supplying parameter values or tables is referred to as "quantification" of the tree.
Once an accident progression event tree, with its list of questions (their branches and their case structure),
its subroutines, and its parameter tables, had been constructed by an analyst, it was evaluated using the computer code EVNTRE (Ref. A.10). EVNTRE can automatically track the different kinds of dependen-cies associated with the accident progression issues. This code was also built with specific capabilities for analyzing and investigating the tree as it was being built, allowing close scrutiny of the development of a complex model. For each plant damage state, EVNTRE evaluates the outcomes of the set of subsequent accident progressions predicted by the APET and their probabilities.
A.3.5 Grouping of Event Tree Outcomes EVNTRE groups paths through the tree into accident progression bins. PSTEVNT (Ref. A.54) is a "rebinner" computer code that further groups the initial set of bins produced by EVNTRE.
- To meet the needs of the subsequent source term analysis, the APET results are grouped into "accident progression bins."
The accident progression bins were defined through interactions between the accident progression analysts and the source term analysts. Characteristics of the bins include, for example, timing of release events, size and location of containment failure, and availability of equipment and processes that remove radioactive material. As such, the bins are relatively insensitive to many of the individual questions in the tree as they focus on the ultimate outcomes, and through the use of these bins, the paths through the tree were greatly reduced in terms of the number of unique outcomes.
A.3.6 Products of Accident Progression Analysis The qualitative product of the accident progression, containment loadings, and structural response analysis is a set of accident progression bins. Each bin consists of a set of event tree outcomes (with associated probabilities) that have a similar effect on the subsequent portion of the risk analysis, analysis of radioactive material transport. As such, the accident progression bins are analogous to the plant damage states described in Section A.2.4.
- EVNTRE groupings can be chosen to illustrate the importance of a specif1c aspect of accident phenomenology, system performance, or operator performance, as long as that aspect is a distinct part of the APET.
A-27 NUREG-1150 OAGI0000611 00331
Appendix A Quantitatively, the product consists of a matrix of conditional failure probabilities, with one probability for each combination of plant damage state and accident progression bin. These probabilities are in the form of probability distributions, reflecting the uncertainties in accident processes.
In NUREG-1150, products of the accident progression analysis are shown in the following ways:
The distribution of the probability of early containment failure* for each plant damage state (as shown in Fig. A.9).
Measures of this distribution provided include:
- Mean, Median, 5th percentile value, and 95th percentile value.
The mean probability of each accident progression bin for each plant damage state (as shown in Fig. A.lO).
As illustrated in Figure A.3, the result of this process is the third input to the risk calculation, P(PDSi ~ APBj), the conditional probability of accident progression bin j given plant damage state i.
A.4 Radioactive Material Transport (Source Term) Analysis**
A. 4.1 Introduction The third part of the NUREG-1150 risk analyses is the estimation of the extent of radioactive material transport and release into the environment and the conditions of the release (timing and energy). As described above, the interface between this and the previous step (the interface being the accident progression bin) is defined to efficiently transfer the important information, while maintaining a manageable set of calculations.
The principal steps in the source term analyses were:
Development of parametric models of material transport, Development of values or probability distributions for parameters in the models, and Grouping of radioactive releases.
Each of these steps will be discussed below.
A. 4. 2 Development of Parametric Models As noted previously, in a risk analysis it is not practical to analyze every projected accident in detail with a mechanistic computer code. The method used for this part of the risk analysis was designed to be efficient enough to calculate source terms for thousands of accident progression bins and flexible enough to allow for incorporation of phenomenological uncertainties into the analysis.
For the NUREG-1150 risk analyses, parametric models were developed that allowed the calculation of source terms for a wide range of projected accidents. While the basic parametric equation for the models was largely the same for all five plants studied, it was customized to reflect plant-specific features and
- In this report, early containment failure includes failures occurring before or within a few minutes of reactor vessel breach for pressuriZed water reactors and those failures occurring before or within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of vessel breach for boiling water reactors. Containment bypass fail-ures are categorized separately from early failures.
.. This section adapted, with editorial modification, from Chapter 2 of Reference A.2.
NUREG-1150 A-28 OAGI0000611 00332
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
(.,)
(.,)
'\\,,
-~
~
tv 1.0 z c
~
m
'?
f-'
f-'
VI 0
~
\\
' \\
Q.)
s...
l.EO l.E-1
-1 E
§ ;e l.E-2~
~"Ei
.D Q) o E 1-c d
~ *a t.E-3 tU d
§ 0
- u
- a~
d
~ l.E-4 8r£~
0 l.E-5 SURRY
~5th.
u
~~
95th.
95th.
95th.
u u_
95l4
~~-
w_
u w_
95th.
u....
95l~
u_
5th_.,
m._l I
5t~
I M ""mean m"" median th = perc.enl1le l.E-6~------------------------------------------------------------------
Internal Init1ators-------------------
Fire Seismic PDS Group Core Damage Freq.
LOSP 2.8E-05 ATWS 14E-06 Transients l.BE-06 LOCAs Bypass 6.1E-06 3.4E-06 All 4.1E-05 Figure A.9 Example display of early containment failure probability distribution.
LLNL l.lE-05 1 9E-04 i
(l)
- l 0..
!it
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
(.,)
z c 0
I,_.
t-'
VI 0
~
w 0
SUMMARY
ACCIDENT PROGRESSION BIN GROUP VB, alpha, early CF VB> 200 psi, early CF VB,< 200 psi, early CF VB, B:t.IT or late CL Bypass VB, No CF No VB
SUMMARY
PDS GROUP (Mean Core Damage Frequency)
lnternallnitiators-----------------
Fire LOSP ATWS Transients LOCAs Bypass All
( 2.8E-05) ( 1.4E-06) ( l.BE-06} ( 6.1E-06) ( 3.4E-06} ( 4.1E-05} ( l.lE-05) 10.003 0.003 10.005 0.001
~ 0.079
~ 0.046 1 0.013 0.003
~ 0.070 0.007 00.310 1 0.52t 0 0.217 8
0 0.350 1 0.762 1 Key: BMT = Basemat Melt-Through CF ~ Containment Failure CL = Containment Leak VB = Vessel Breach 0.005 0.003 0.005 0.001 0.004 1 0.013
~ 0.055
~ 0.059 00.292 E:J
~ 0.122 6
00.340 10.6901 00.352 DD.46E SURRY Figure A.lO Example display of mean accident progression bin conditional probabilities.
SE:lSOHC LLNL
( 1.9E-04) 0.006 0 <lOB
~ 0 082 00.280 0 001 00.435 0
0.109
~
'0 CD
- 1
- 0.
~t
Appendix A conditions that could impact the source term estimates. As noted in Figure A.3, the codes that manipulate these parametric equations are called XSOR, where the X refers to a plant-specific abbreviation; for example, the code for Peach Bottom is PBSOR (Ref. A.11).
The parametric equations do not contain any chemistry or physics (except mass conservation) but describe the source terms as the product of release fractions and transmission factors at successive stages in the accident progression for a variety of release pathways, a variety of projected accidents, and nine classes of radionuclides. (To allow a manageable calculation, the radionuclides were treated in terms of radionuclide groups that have similar properties, the same nine groups that are defined in the Source Term Code Package (Ref. A.42)). Figure A.11 illustrates some of the release pathways and release fractions included in the model. The release is broken up into constituent parts (release fractions and transmission factors) in order to allow the input of a range of uncertainty within each part and to allow different components of the release to occur at different times.
The basic parametric equations are of the form ST;(i) + STh (i) + STe(i) + STz(i) + Special Terms, where (i) represents the radionuclide group, ST;(i) represents releases from the fuel that occur in-vessel, STh(i) represents releases from the fuel that occur during high-pressure melt ejection, STe(i) represents releases from the fuel when the fuel is out of the vessel, primarily during core-concrete interactions, and STt(i) represents releases from the fuel that occur in-vessel but that plate out in the reactor coolant system (RCS) before the RCS integrity is lost and are released later. An example of a "Special Term" is an expression for releases from the plant for a bypass accident. The individual terms on the right hand side of the equation above represent different radionuclide release pathways and are represented as products of release fractions and transmission factors. For example, the expression for ST;(i) for PWRs is given by ST;(i) = FCOR(i)*(FISG(i)*FOSG(i) + (1-FISG(i))*FVES(i)*FCONV/DFE) where FCOR(i) is the fraction of initial inventory of nuclide group i released from the fuel in-vessel, FISG(i) is the fraction of material released from the core in-vessel that enters the steam generators, FOSG(i) is the fraction of material entering the steam generators that leaves the steam generators and enters the environment, FVES (i) is the fraction of material entering the RCS that is released from the RCS, FCONV(i) is the fraction of the material released from the vessel that would be released from the containment in the absence of special decontamination mechanisms such as sprays that are included in DFE, and DFE is the decontamination factor to be applied to release from the vessel. The expression for BWRs is simpler because the terms related to the steam generators can be omitted. Similar expressions exist for STe(i), STh(i), and STz(i).
The parametric equation allows for uncertainty in the release fractions and for the effects of important boundary conditions, such as timing or temperature history to be included in the source term calculation.
Any parameter in the equation can be represented by a probability distribution (this distribution can be sampled in the Monte Carlo analysis). All parameters (FVES(i) FISG(i), etc.) can be made to vary with accident progression bin characteristics, such as high pressure in the vessel. The accident progression bin characteristics are passed from the previous part of the risk analysis.
The expression for ST e (i) is associated with the core-concrete interaction releases. The impact of containment conditions such as the availability of overlaying water or the operability of sprays is included in the expression for STe(i). In addition, the timing and mode of containment failure or leakage is considered in order to calculate a release from the containment to the environment.
Late revolatilization from the vessel and late release of iodine from water pools are included in the expression for STt(i). These secondary sources of radionuclides that were removed in earlier processes are kept track of in a consistent manner and made available for release at a later time.
A-31 NUREG-1150 OAGI0000611 00335
Appendix A Contamment release tale revolabhzahon Late leYolatliiZalton from vessel Late containment deContamtnabon Late release ol iochne fromwaler pools Containment release of in-vessel spec~es Early containment dec:ontaminat,on depostllOn, etc Figure A.ll Simplified schematic of source term (XSOR) algorithm.
NUREG-1150 A-32 OAGI0000611 00336
Appendix A A.4.3 Development of Values or Probability Distributions Given the parametric equations used to define the source terms, it was necessary to define basic parameters. None of the parameters was internally calculated; the values must be specified by the user or chosen from a distribution of values by a sampling algorithm. Initially, the equations and the parameters for the equations were developed through detailed examination of the results of Source Term Code Package (STCP) analyses of selected accidents, performed specifically for the NUREG-1150 study (Refs.
A.SS and A. 56). Subsequent incorporation of calculations and experimental data from a variety of sources (e.g., STCP (Ref. A.42), CONTAIN (Ref. A.41), MELCOR (Ref. A.44), and other computer codes) has led to models that more broadly reflect the range of source term information available in the reactor safety research community.
With the NUREG-1150 objective of the performance of quantitative uncertainty analysis, data on the more important parameters were constructed in the form of probability distributions. Such distributions were developed using expert judgment to interpret the available data or calculations. For a few parameters that were judged of lesser importance or not considered as uncertain, single-valued estimates were used in the XSOR models. These estimates were derived from STCP and other calculations, adjusted as needed for the boundary conditions associated with the accident progression bins.
A.4.4 Grouping of Radioactive Releases The source term calculations performed with the XSOR codes have a one-to-one correspondence with the accident progression bins. With the large number of bins used in the detailed risk analyses and the consideration of parameter uncertainties, a large number of source term calculations was required. This number of calculations was too great to be directly used in the next step in the risk analysis, the offsite consequence analysis. Therefore, the tens of thousands of source terms were grouped into about 50 groups. The source terms were grouped according to their potential for causing early fatalities, their potential for causing latent cancer fatalities, and the warning time associated with them. This grouping was accomplished with the PARTITION code (Ref. A.57). Reference A.57 explains in more detail how the early fatality and latent cancer fatality potentials and the warning times were calculated. Each source term group was represented by an average source term, where the averaging was weighted by the frequency of occurrence of the accident progression bin giving rise to that source term and where each (Monte Carlo) calculation for the uncertainty analysis was weighted equally. Characteristics such as the energy of release were not used to group the source terms, although each group was represented by an average energy of release.
A.4.5 Products of Source Term Analysis The product of this step in the NUREG-1150 risk analysis process is the estimate of the radioactive release magnitude (in the form of a probability distribution), with associated energy content, time, and duration of release, for each of the specified source term groups.
In NUREG-1150, radioactive release magnitudes are displayed in the following ways:
Distribution of release magnitudes for each of the nine isotopic groups for selected accident progression bins (as shown in Fig. A.12); and Frequency distribution (in the form of complementary cumulative distribution functions) of radioac-tive releases of iodine, cesium, strontium, and lanthanum (as shown in Fig. A.13).
The results of the source term analysis are the fourth input to the risk calculation, P(APBj-STGk), the conditional probability that accident progression bin j will lead to source term group k.
A.5 Offsite Consequence Analysis A.S.l Introduction The severe reactor accident radioactive releases described in the preceding section are of concern because of their potential for impacts in the surrounding environment and population. The impacts of radioactive A-33 NUREG-1150 OAGI0000611 00337
Appendix A Release Fraction 1.0E+OO~~~~--------------------------------------~
1.0E-01 1.0E-02 1.0E-03 1.0E-04 on.
mean me ulan titf.
1.0E-05 L--------------------------.l NG Cs Te Sr Ru La Ba Ce Radionuclide Group Figure A.12 Example display of radioactive release distributions for selected accident progression bin.
NUREG-1150 A-34 OAGI0000611 00338
Appendix A Iodine Group Frequency of R > R* (yr-1) l.OE-o3 r--------------------------------.
l.OE-o4 l.OE-05 l.OE-Q6 LOE-o7 l.OE-08 Surry Zion
-GI-Sequoyah Peach Bottom Grand Gulf
__ ;;.-6.-_..,,(.>...0
/\\~"'" 0. _ ~
v v
v
.......,/\\.~
....... v*'.... A.
. 'V"** -:<o.:.* *--o **,.
'~ ' o,..
',A '\\,
V*
\\
- \\
\\'
'.\\
\\
\\~~
Gl
~\\..
~ \\
I
- 0
- 1. OE-Q9 '-----'----'-....J.-1--l...L.L.U...--1---L...JL-W'-I..l.J..L.---1--'-.....1-.L.J.....I....LU.--'--'--.1-1-.1-.l..l.l..l--.L.-.I.-L-'-'-..u..u l.OE-05 l.OE-04 l.OE-03 l.OE-02 l.OE-01 l.OE+OO Release Fraction Figure A.13 Example display of source term complementary cumulative distribution function.
A-35 NUREG-1150 OAGI0000611 00339
Appendix A releases to the atmosphere from such accidents can manifest themselves in a variety of ways, such as early and delayed health effects, loss of habitability of areas close to the power plant, and economic losses. The fourth step in the NUREG-1150 risk analyses is the estimation of these offsite consequences, given the radioactive releases generated in the previous step of the analysis.
The principal steps in the offsite consequence analysis are:
Assessment of pre-accident inventories of radioactive material; Analysis of the downwind transport, dispersion, and deposition of the radioactive materials released from the plant; Analysis of the radiation doses received by the exposed populations via direct (cloudshine, inhalation, groundshine, and deposition on skin) and indirect (ingestion) pathways; Analysis of the mitigation of these doses by emergency response actions (evacuation, sheltering, and relocation of people), interdiction of milk and crops, and decontamination or interdiction of land and buildings; and Calculation of the health effects of the release, including:
Number of early fatalities and early injuries expected to occur within 1 year of the accident, and the latent cancer fatalities expected to occur over the lifetimes of the exposed individuals; The total population dose received by the people living within specific distances (e.g., 50 miles) of the plant; and Other specified measures of offsite health effect consequences (e.g., the number of early fatalities in the population living within 1 mile of the reactor site boundary).
Each of these steps will be discussed in the following sections.
The NUREG-1150 offsite consequence calculations were performed with Version 1.5 of the MACCS (MELCOR Accident Consequence Code System) computer code (Ref. A.12).
A.5.2 Assessment of Pre-Accident Inventories The radionuclide core inventories were calculated using the SANDIA-ORIGEN code (Ref. A. 58). For PWRs, a 3412 megawatt (MW) (thermal) Westinghouse PWR was used, assuming an annual refueling cycle and an 80 percent capacity factor. The core contains 89.1 metric tons of uranium (MTU), is initially enriched to 3.3 percent U-235, and is used in a 3-year cycle, with one-third of the core being replaced each year. The specific power is 38.3 MW/MTU, which gives the burnups at the end of a 3-year cycle at 11,183 megawatt-days (MWD)/MTU, 22,366 MWD/MTU, and 33,550 MWD/MTU for each of the three regions of the core.
For BWRs, a 3578 MWT General Electric BWR-6 was used, assuming an annual refueling cycle and an 80 percent capacity factor. The core contains 136.7 MTU and has initial enrichments of 2.66 percent and 2.83 percent U-235. The 2.66 percent fuel is used for both the 3-year cycle and the 4-year cycle, while the 2.83 percent is used only for the 4-year cycle. The fuel on 4-year cycles operates at roughly average power for the first three years and is then divided into two batches for the fourth year: half going to the core center (near average power) and half going to the periphery (about half of the average power). This complex fuel management plan yields five different types of discharged spent fuel. The inventory at the end of annual refueling is then a blend of different types since the code performed the actual calculation on a per fuel assembly basis.
The core inventory of each specified plant studied was calculated by multiplying the standard PWR or BWR core inventory calculated above by the ratio of plant power level to the power level of the standard plant.
For these risk analyses, nine groups were used to represent 60 radionuclides considered to be of most importance to offsite consequences: noble gases, iodine, cesium, tellurium, strontium, ruthenium, cerium, barium, and lanthanum.
NUREG-1150 A-36 OAGI0000611 00340
Appendix A A.5.3 Transport, Dispersion, and Deposition of Radioactive Material The MACCS code uses an empirical straightline Gaussian model for calculations of transport and dispersion of the plume that would be formed by the radioactive material released from the plant. These calculations use the sequence of successive hourly meteorological data of the reactor site for several days beginning at the release (Ref. A.12). MACCS also calculates the rise of the plume vertically while it is transported downwind if the radionuclide release is accompanied by thermal energy. Actual occurrence and the height of the plume rise would depend on the thermal release rate and the ambient meteorological conditions at the time of the release (Ref. A. 59). Depletion of the plume by radioactive decay and dry and wet deposition processes during transport are taken into account. Radioactive contamination of the ground in the wake of the plume passage due to the dry and wet deposition processes is also calculated.
These calculations are performed up to a very large distance, namely, 1,000 miles, from the reactor.
Beyond the distance of 500 miles from the reactor, a special artifice of calculation is used to gradua1ly deplete the plume of its remaining radionuclide content in particulate form and deposit it on the ground.
The purpose of doing this is to provide a nearly complete accounting of the radionuclides released in particulate form from the plant. The impact of relatively small quantities of the noble gases (which do not deposit) leaving the 1,000-mile region is considered to be negligible. For this reason the 1,000-mile circular region is recognized as the entire impacted site region for this study.
The consequences for a given release of radioactive material would be different if the release occurred at different times of the year and under different ambient weather conditions. Consequences would also be different for different wind directions during the accident due to variations with direction in the population distribution, land use, and agricultural practice and productivity of the site region. As such, the MACCS code provides probability distributions of the consequence estimates arising from the statistical variability of seasonal and meteorological conditions during the accident. The models generally accom-plish this by repeating the calculations for many weather sequences (each beginning with the release of the radioactive material) which are statistically sampled from the historical hourly meteorological data of the reactor site for 1 full year. The product of the probability of a weather sequence and the probability of wind blowing toward a direction sector of the compass provides the probability for the estimate of the magnitude of each consequence measure for this weather sequence and direction sector combination.
Computer models employed in the past and present NRC studies use about 1,500 to 2,500 weather sequence and direction sector combinations. This produces a like number of magnitude and probability pairs for each consequence measure analyzed. Collectively, these pairs for a consequence measure provide a large data base to generate its meteorology-based probability distribution.
A.5.4 Calculation of Doses MACCS calculates the radiological doses to the population resulting from several exposure pathways using a set of dose conversion factors described in References A.60 through A.62. During the early phase, which begins at the time of the radionuclide release and lasts about a week, the exposure pathways are the external radiation from the passing radioactive cloud (plume), contaminated ground, and radiation from the radionuclides deposited on the skin, and internal radiation from inhalation of radionuclides from the cloud and resuspended radionuclides deposited on the ground. Following the early phase, the long-term (chronic) exposure pathways are external radiation from the contaminated ground and internal radiation from ingestion of (1) foods (milk and crops} directly contaminated during plume passage, (2) foods grown on contaminated soil, and (3) contaminated water, and from inhalation of resuspended radionuclides.
A. 5. 5 Mitigation of Doses by Emergency Response Actions In the event of a large atmospheric release of radionuclides in a severe reactor accident, a variety of emergency response and long-term countermeasures would be undertaken on behalf of the public to mitigate the consequences of the accident. The emergency response measures to reduce the doses from the early exposure pathways include evacuation or sheltering (followed by relocation) of the people in the areas relatively close to the plant site and relocation of people from highly contaminated areas farther away from the site. The long-term countermeasures include decontamination of land and property to make them usable, or temporary or permanent interdiction (condemnation) of highly contaminated land, property, and foods that cannot be effectively or economically decontaminated. These response measures are associated w:th expenses and losses that contribute to the offsite economic cost of the accident.
A-37 NUREG-1150 OAGI0000611 00341
Appendix A The analysis of offsite consequences for this study included a "base case" and several sets of alternative emergency response actions. For the base case, it was assumed that 99.5 percent of the population within the 1 0-mile emergency planning zone (EPZ) participated ~n an evacuation. This set of people was assumed to move away from the plant site at a speed estimat.ed from the plant licensee's emergency plan, after an initial delay (to permit communication ofthe need to evacuate) also estimated from the licensee's plan. It was also assumed that the 0.5 percent of the population that did not participate in the initial evacuation was relocated within 12 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after plume passage, based on the measured concentra-tions of radioactive material in the surrounding area and the comparison of projected doses with proposed Environmental Protection Agency (EPA) guidelines (Ref. A. 63). Similar relocation assumptions were made for the population outside the 10-mile planning zone.
Several alternative emergency response assumptions were also analyzed in this study's offsite consequence and risk analyses. These included:
Evacuation of 100 percent of the population within the 10-mile emergency planning zone; Indoor sheltering of 100 percent of the population within the EPZ (during plume passage) followed by rapid subsequent relocation after plume passage; Evacuation of 100 percent of the population in the first 5 miles of the planning zone, and sheltering followed by fast relocation of the population in the second 5 miles of the EPZ; and In lieu of evacuation or sheltering, only relocation from the EPZ within 12 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after plume passage, using relocation criteria described above.
In each of these alternatives, the region outside the 10-mile zone was subject to a common assumption that relocation was performed based on comparisons of projected doses with EPA guidelines (as discussed above).
A.5.6 Health Effects Modeling The potential early health effects of radioactive releases are fatalities and morbidities (injuries) occurring within about a year in the population that would receive acute and high radiological doses from the early exposure pathways. The potential delayed health effects are fatal and nonfatal cancers that may occur in the exposed population after varying periods of latency and continuing for many years; and various types of genetic effects that may occur in the succeeding generations stemming from radiological exposures of the parents. Both early and chronic exposure pathways would contribute to the latent health effects.
The early fatality models currently implemented in MACCS are based on information provided in Reference A.64. Three body organs are used in the early fatality calculations: red marrow, lung, and lower large intestine (LLI). The organ-specific early fatality threshold doses used are 150 rems, 500 rems, and 750 rems, and LD50 used are 400 rems, 1,000 rems, and 1,500 rems to the red marrow, lung, and LLI, respectively. The models incorporate the reduced effectiveness of inhalation dose protraction in causing early fatality and the benefits of medical treatment.
The early injury models implemented in MACCS are also threshold models and are similar to those described in Reference A.64. The candidate organs used for the current analysis are the stomach, lungs, skin, and thyroid.
The latent fatal and nonfatal cancer models implemented in MACCS are the same as described in Reference A.64, which are based on those of the BEIR III report (Ref. A.65). These models are nonthreshold and linear-quadratic types. However, only a linear model was used for latent cancer fatalities from the chronic exposure pathways since the quadratic term was small compared to the linear term because of low individual doses from these pathways. The specific organs used were red marrow (for leukemia), bone, breast, lung, thyroid, LLI, and others (based on the LLI dose representing the dose to the other organs).
Population exposure has been treated as a nonthreshold measure; truncation at low individual radiation dose levels was not performed.
NUREG-1150 A-38 OAGI0000611 00342
Appendix A A. S. 7 Products of Off site Consequence Analysis The product of this part of the analysis is a set of offsite consequence measures for each source term group. For NUREG-1150, the specific consequence measures discussed include early fatalities, latent cancer fatalities, total population dose (within 50 miles and the entire site region), and two measures for comparison with NRC's safety goals, average individual early fatality risk within 1 mile and average individual latent fatality risk within 10 miles. In NUREG-1150, results of the offsite consequence analysis are displayed in the form of complementary cumulative distribution functions (CCDFs), as shown in Figure A.14.
The schedule for completing the risk analyses of this report did not permit the performance of uncertainty analyses for parameters of the offsite consequence analysis although variability due to annual variations in meteorological conditions is included.
The reader seeking extensive discussion of the methods used is directed to Part 7 of Reference A. 46 and to Reference A.12, which discusses the computer used to perform the offsite consequence analysis (i.e.,
the MELCOR Accident Consequence Code System (MACCS), Version 1.5).
Through the use of the MACCS code, the fifth part of the risk calculation was developed: C1k, the mean consequence (representing the meteorologically based statistical variability) for measure l given the source term group k.
A.6 Characterization and Combination of Uncertainties*
An important characteristic of the probabilistic risk analyses conducted in support of this report is that they have explicitly included an estimation of the uncertainties in the calculations of core damage frequency and risk that exist because of incomplete understanding of reactor systems and severe accident phenomena.
There are four steps in the performance of uncertainty analyses. Briefly, these are:
Scope of Uncertainty Analyses. Important sources of uncertainty exist in all four stages of the risk analysis. In this study, the total number of parameters that could be varied to produce an estimate of the uncertainty in risk was large, and it was somewhat limited by the computer capacity required to execute the uncertainty analyses. Therefore, only the most important sources of uncertainty were included. Some understanding of which uncertainties would be most important to risk was obtained from previous PRAs, discussion with phenomenologists, and limited sensitivity analyses. Subjective probability distributions for parameters for which the uncertainties were estimated to be large and important to risk and for which there were no widely accepted data or analyses were generated by expert panels. Those issues for which expert panels generated probability distributions are listed in Table A.l.
Definition of Specific Uncertainties. In order for uncertainties in accident phenomena to be included in this study's probabilistic risk analyses, they had to be expressed in terms of uncertainties in the parameters that were used in the study. Each section of the risk analysis was conducted at a slightly different level of detail. However, each analysis part (except for offsite consequence analysis, which was not included in the uncertainty analysis) did not calculate the characteristics of the accidents in as much detail as would a mechanistic and detailed computer code. Thus, the uncertain input parameters used in this study are "high level" or summary parameters. The relationships between fundamental physical parameters and the summary parameters of the risk analysis parts are not always clear; this lack of understanding leads to what is referred to in this study as modeling uncertainties. In addition, the values of some important physical or chemical parameters are not known and lead to uncertainties in the summary parameters. These uncertainties were referred to as data uncertainties. Both types of uncertainties were included in the study and no consistent effort was made to differentiate between the effects of the two types of uncertainties.
As noted above, parameters were chosen to be included in the uncertainty analysis if they were estimated to be large and important to risk and if there were no widely accepted data or analysis.
- Titis section adapted, with editorial modification, from Section 2 of Reference A.2.
A-39 NUREG-1150 OAGI0000611 00343
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
-1>-
-1>-
z c:::
- 0 ti1 0
I U\\
0
- r-
.I>.
0 i
1 OE-03 q)
>-* g 0
~
ID
- 0.
";: 1 OE -06 0 c (I)
- J u
~
- ~, oe-oar**--..
0 c
<11
~ 1 OE-09 Gl 0
~ IOE*tO 1 OE*OO IOE+OI
~ 1 0[-03~----- *.**
lii (I) ?' I OE *04 g
0
~ I Of-05 lii 9
1 OE-06
,... g
~ I OE-07 Q
- t g
<11 0
(I)
¢>
0
)(
I OE-08 I OE*09 Percenllho 06th tJ*an 60th 51h tOE*02 IOE*03 Early Fatalities LU
~*
I OE. 10 J..... t.....
I IIHM I
Percentile
- 95th Meen
-60th 6th IOE*04 1 OE*OS IOE*OO IOE*02 101'*04 10E*06 IOE*08 Population Do&o (person-rern) to -50 Miles i
I.OE*03f ------- --*-
~
- 9 1 oE*04 l>ercenllle 95th u
-Mean
~ 1 OE-OSE-n
[)
c 1 Of-CJ6
~ 1 OE*OT cr CD
~ 1 OE-08 g
0
<D CD
~
w CD,...
I g
~
- a. s g (I)
- )
t..:1 (I)
U:
~
u (I)
(I) u t Of*09 tOE-10 I I I!!""'
I I"""
I I""'"
t "I IIIII
)
I 10£*00 IOE*OI 10E*02 IOE*03 10E*04 10E*05 t.OE*OO Latent Cancer Fatalities 1 OE*03 1 OE*04
- . ~--..
""\\
1 OE*05
\\
1 OE-07'"' --------
Percan!Ue 1 oe-oa~l... gsth Mosn I.OE*09~~-
OOih 511\\
OJ tQE*tOu..,. ""* '"U" 'II"* '""* ""* '"I"" "":~\\,LJ 1 OE *00 I OE *O:Z 1 OE: *04 1 OE *06 1 OE *OB Populat1on Dose (person-rem) to -Entire Regton Figure A.14 Example display of offsite consequences complementary cumulative distribution function.
-6"
'd (l)
- l 0..
S:t
)>
Appendix A Table A.l Issues considered by expert panels.
Accident Frequency Analysis Panel Failure probabilities for check valves in the quantification of interfacing-system LOCA frequencies (PWRs)
Physical effects of containment structural or vent failures on core cooling equipment (BWRs)
Innovative recovery actions in long-term accident sequences (PWRs and BWRs)
Pipe rupture frequency in component cooling water system (Zion)
Use of high-pressure service water system as source for drywell sprays (Peach Bottom)
Reactor Coolant Pump Seal Performance Panel Frequency and size of reactor coolant pump seal failures (PWRs)
In-Vessel Accident Progression Panel Probability of temperature-induced reactor coolant system hot leg failure (PWRs)
Probability of temperature-induced steam generator tube failure (PWRs)
Magnitude of in-vessel hydrogen generation (PWRs and BWRs)
Mode of temperature-induced reactor vessel bottom head failure (PWRs and BWRs)
Containment Loadings Panel Containment pressure increase at reactor vessel breach (PWRs and BWRs)
Probability and pressure of hydrogen combustion before reactor vessel breach (Sequoyah and Grand Gulf)
Probability and effects of hydrogen combustion in reactor building (Peach Bottom)
Molten Core-Containment Interactions Panel Drywell shell meltthrough (Peach Bottom)
Pedestal erosion from core-concrete interaction (Grand Gulf)
Containment Structural Performance Panel Static containment failure pressure and mode (PWRs and BWRs)
Probability of ice condenser failure due to hydrogen detonation (Sequoyah)
Strength of reactor building (Peach Bottom)
Probability of drywell and containment failure due to hydrogen detonation (Grand Gulf)
Pedestal strength during concrete erosion (Grand Gulf)
Source Term Expert Panel In-vessel retention and release of radioactive material (PWRs and BWRs)
Revo1atization of radioactive material from the reactor vessel and reactor coolant system (early and late) (PWRs and BWRs)
Radioactive releases during high-pressure melt ejection/direct containment heating (PWRs and BWRs)
Radioactive releases during core-concrete interaction (PWRs and BWRs)
Retention and release from containment of core-concrete interaction radioactive releases (PWRs and BWRs)
Ice condenser decontamination factor (Sequoyah)
Reactor building decontamination factor (Grand Gulf)
Late sources of iodine (Grand Gulf )
A-41 NUREG-1150 OAGI0000611 00345
Appendix A Development of Probability Distributions. Probability distributions for input parameters were developed by a number of methods. As stated previously, distributions for the input parameters having the highest uncertainties and believed to be of the largest importance to risk were determined by panels of experts. The experts used a wide variety of techniques to generate probability distributions, including reliance on detailed code calculations, extrapolation of existing experimental and accident data to postulated conditions during the accident, and complex logic networks. Probability distributions were obtained from the expert panels using formalized procedures designed to minimize bias and maximize accuracy and scrutability of the experts' results. These procedures are described in more detail in Section A 7. Probability distributions for parameters believed to be of less importance to risk were generated by analysts on the project staff or by phenomenologists from several different national laboratories using techniques like those employed with the expert panels. This list of issues assigned probability distributions for the Surry plant is provided in Section C.l of Appendix C. Similar lists for the other plants are provided in References A.48 thorugh A.51.
Combination of Uncertainties. A specialized Monte Carlo method, Latin hypercube sampling (Ref.
A.15), was used to sample the probability distributions defined for the many input parameters. The sample observations were propagated through the constituent analyses to produce probability distributions for core damage frequency and risk. Monte Carlo methods produce results that can be analyzed with a variety of techniques, such as regression analysis. Such methods can treat distributions with wide ranges and can i:t;1corporate correlations between variables. Latin hypercube sampling provides for a more efficient sampling technique than straightforward Monte Carlo sampling while retaining the benefits of Monte Carlo techniques. It has been shown to be an effective technique when compared to other, more costly, methods (Ref. A.66). Since many of the probability distributions used in the risk analyses are subjective distributions, the composite probability distributions for core damage frequency and risk must also be considered subjective.
As stated in Section A.1.2, the results of the risk analysis and its constituent analyses are subjective probability distributions for the quantities in the following equation:
where:
Risk1n = Risk of consequence measure l for observation n (consequences/year);
fn(IEh)
= Frequency (per year) of initiating event h for observation n; Pn(IEh ~ PDSi)
= Conditional probability that initiating event h will lead to plant damage state i for observation n; Pn(PDSr ~ APBj)
= Conditional probability that PDSi will lead to accident progression bin j for observation n; Pn(APBj ~ STGk) = Conditional probability that accident progression bin j will lead to source term group k for observation n; and Czk
= Expected value of consequence measure 1 conditional on the occurrence of source term group k.
With Latin hypercube sampling, the probability distributions are estimated with a limited number (about 200) of calculations of risk, each calculation being equally likely. That is, for the uncertainty analysis about 200 values of Riskin are generated. Risk1n can then be described in a number of ways, such as a his-togram describing the distribution of Risk1n values, the average (mean) value of risk, etc. Explanations for the tables and figures in this document that show the results of the risk analysis and its constituent analyses are provided in Section A.9.
Detailed discussion of the NUREG-1150 uncertainty analysis methods is provided in Reference A.2.
NUREG-1150 A-42 OAGI0000611 00346
Appendix A A. 7 Elicitation of Experts*
The risk analysis of severe reactor accidents inherently involves the consideration of parameters for which little or no experiential data exist. Expert judgment was needed to supplement and interpret the available data on these issues. The elicitation of experts on key issues was performed using a formal set of procedures, discussed in greater detail in Reference A.2. The principal steps of this process are shown in Figure A.15. Briefly, these steps are:
Selection of Issues. As stated in Section A.6, the total number of uncertain parameters that could be included in the core damage frequency and risk uncertainty analyses was somewhat limited. The parameters considered were restricted to those with the largest uncertainties, expected to be the most important to risk, and for which widely accepted data were not available. In addition, the number of parameters that could be determined by expert panels was further restricted by time and resource limitations. The parameters that were determined by expert panels are, in the vernacular of this project, referred to as "issues." An initial list of issues was chosen from the important uncertain parameters by the plant analyst, based on results from the first draft NUREG-1150 analyses (Ref.
A.3). The list was further modified by the expert panels.
Selection of Experts. Seven panels of experts were assembled to consider the principal issues in the accident frequency analyses (two panels), accident progression and containment loading analyses (three panels), containment structural response analyses (one panel), and source term analyses (one panel). The experts were selected on the basis of their recognized expertise in the is:.;ue areas, such as demonstrated by their publications in refereed journals. Representatives from the nuclear industry, the NRC and its contractors, and academia were assigned to each panel to ensure a balance of "perspectives." Diversity of perspectives has been viewed by some (e.g., Refs. A.67 and A.68) as allowing the problem to be considered from more viewpoints and thus leading to better quality answers. The panels contained from 3 to 10 experts.
Training in Elicitation Methods. Both the experts and analysis team members received training from specialists in decision analysis. The team members were trained in elicitation methods so that they would be proficient and consistent in their elicitations. The experts' training included an introduction to the elicitation and analysis methods, to the psychological aspects of probability estimation (e.g.,
the tendency to be overly confident in the estimation of probabilities), and to probability estimation.
The purpose of this training was to better enable the experts to transform their knowledge and judgments into the form of probability distributions and to avoid particular psychological biases such as overconfidence. Additionally, the experts were given practice in assigning probabilities to sample questions with known answers (almanac questions). Studies such as those discussed in Reference A.69 have shown that feedback on outcomes can reduce some of the biases affecting judgmental accuracy.
Presentation and Review of Issues. Presentations were made to each panel on the set of issues to be considered, the definition of each issue, and relevant data on each issue. Other parameters considered by the analysis staff to be of somewhat lesser importance were also described to the experts. The purposes of these presentations were to permit the panel to add or drop issues depending on their judgments as to their importance; to provide a specific definition of each issue chosen and the sets of associated boundary conditions imposed by other issue definitions; and to obtain information from additional data sources known to the experts.
In addition, written descriptions of the issues were provided to the experts by the analysis staff. The descriptions provided the same information as provided in the presentations, in addition to reference lists of relevant technical material, relevant plant data, detailed descriptions of the types of accidents of most importance, and the context of the issue within the total analysis. The written descriptions also included suggestions of how the issues could be decomposed into their parts using logic trees.
The issues were to be decomposed because the decomposition of problems has been shown to ease the cognitive burden of considering complex problems and to improve the accuracy of judgments (Ref. A.70).
- This sectiOn adapted, with editorial modification, from Section 2 of Reference A.2.
A-43 NUREG-1150 OAGI0000611 00347
Appendix A Presentation Selection Elicitation of Technical 1-of Experts Training Evidence 1
l Selection of Preparation Presentation laeuea of laeuea of laauea Expert Preparation Dlecuaalon Elicitation 1----
of Analyaea of Analyeea of Ex perta Composition Review Aggregation and by Experts Documen tatlon Figure A.15 Principal steps in expert elicitation process.
NUREG-1150 A-44 OAGI0000611 00348
Appendix A For the initial meeting, researchers, plant representatives, and interested parties were invited to present their perspectives on the issues to the experts. Frequently, these presentations took several days.
Preparation of Expert Analyses. After the initial meeting in which the issues were presented, the experts were given time to prepare their analyses of the issues. This time ranged from 1 to 4 months.
The experts were encouraged to use this time to investigate alternative methods for decomposing the issues, to search for additional sources of information on the issues, and to conduct calculations.
During this period, several panels met to exchange information and ideas concerning the issues.
During some of these meetings, expert panels were briefed by the project staff on the results from other expert panels in order to provide the most current data.
Expert Review and Discussion. After the expert panels had prepared their analyses, a final meeting was held in which each expert discussed the methods he/she used to analyze the issue. These discussions frequently led to modifications of the preliminary judgments of individual experts.
However, the experts' actual judgments were not discussed in the meeting because group dynamics can cause people to unconsciously alter their judgments in the desire to conform (Ref. A.71).
Elicitation of Experts. Following the panel discussions, each expert's judgments were elicited. These elicitations were performed privately, typically with an individual expert, an analysis staff member trained in elicitation techniques, and an analysis staff member familiar with the technical subject.
With few exceptions, the elicitations were done with one expert at a time so that they could be performed in depth and so that an expert's judgments would not be adversely influenced by other experts. Initial documentation of the expert's judgments and supporting reasoning were obtained in these sessions.
Composition and Aggregation of Judgments. Following the elicitation, the analysis staff composed probability distributions for each expert's judgments. The individual judgments were then aggregated to provide a single composite judgment for each issue. Each expert was weighted equally in the aggregation because this simple method has been found in many studies (e.g., Ref. A. 72) to perform the best.
Review by Experts. Each expert's probability distribution and associated documentation developed by the analysis staff was reviewed by that expert. This review ensured that potential misunderstandings were identified and corrected and that the issue documentation properly reflected the judgments of the expert.
Detailed documentation of the expert elicitations is provided in References A.46 and A. 73.
A.8 Calculation of Risk*
A.8.1 Methods for Calculation of Risk The constituent parts of the risk calculation have been described in previous sections. As illustrated in Figure A.3, a number of computer codes were used to generate a variety of intermediate information.
This information is then processed by an additional code, RISQUE, to calculate risk. RISQUE is a matrix manipulation code. As illustrated in Figure A.16 and explained in Section A.1.2, the elements of the risk calculation can be represented in a vector/matrix format.
The initiating event frequencies f(IE) constitute a vector of nm dimensions, where nm is the number of initiating events. The plant damage state frequencies f(PDS) constitute a vector of npns dimension, where npns is derived from f(IE) by multiplying it by the nm by npns matrix [P(IE -+ PDS)]. P(IEh -
PDSt) is the conditional probability that initiating event h will result in plant damage state i. In the detailed analyses underlying this study, there are approximately 20 plant damage states. The f(PDS) vector is a product of the accident frequency analysis.
Similarly, to obtain the accident progression bin frequencies, the plant damage state vector is multiplied by the accident progression tree output matrix [P(PDS-+ APB)]. The fP(PDS-+ APB)J matrix is the principal product of the accident progression analysis. This npDs by nAPB matrix represents the conditional "This section adapted, with editorial modification, from Section 2 of Reference A.2.
A-45 NUREG-1150 OAGI0000611 00349
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
(J'1 0
z c:::
- tl tr.l
'?
til 0
- r
~
0'1 Systems Accident Source Term Consequence Analysis Progression Analysis Analysis Analysis LHSIH f(POS)
P(POS-+APB)
P(APB-.STG)
C(STG)
--.,,.,.........,. "1.,.,..
.......,. 1
~~11 c,
- c,n APB STG c I
[t,...... fn J X I Pz1 x
P21 c21 X
!nPPS 1
- *.PnPDs"APB Pn 1
- * * *.Pn n
i:"srG1
- Pn n
APB APB STG STG C LHS#2 f(POS)
P(PDS-+APB)
P(APB-.STG)
C(STG) r-P11 p12 ******* P1n p11 Ptz ******* P1n c,, c,z
- c,n APB STG c
E1...... fn
]
X P2t Pz, c21 l
X X
PDS Pn 1
- Pn n
Pn 1
- Pn n
Cn 1
- **** Pn n
PDS PPS APB APB APB STG STG STG C LHS#nLHS f(POS}
P(POS-+APB)
P(APB-.STG)
C{STG) r-
- P1nAPS~ X P11 P1z
~~11.,........*,. ~
rc11 c,z
- C1n STG c
E1...... fn J X I Pzt Pzt c21 X
PDS I.
I
~.,
Pn 1
- Pn n
- **** Pn n I I Cn 1
- . Pn n
POS POS APB APB APB STG STG STG C Figure A.16 Matrix formulation of risk analysis calculation.
=
Risk Results RISK r:RISK1 ****** RISKn]
c RISK
~RJSK1 ****** RISKn~
RISK
~RISK1 ****** RISKn ~
c
~
'0 CD
- l Q.
~-
Appendix A probability that an accident grouped in plant damage state I will result in an accident grouped in the jth accident progression bin. In the detailed analyses underlying this study, there are between a few hundred and a few thousand accident progression bins (nAPB ::: 1000) depending on the plant.
The result of the previous calculation is multiplied by a third matrix that represents the outcome of the source term and partitioning analyses [P(APB __.. STG) ]. This nAPB by nsTo matrix represents the conditional probability that an accident progression bin j will be assigned to source term group k. There are approximately 50 source term groups (nsTG = 50). This yields a vector f(STG) of frequencies of the source term groups.
The final element of the risk calculation is a matrix representing the consequences for each of the source term groups C. The nsTG by nc matrix is the product of the consequence analysis, where nc represents the number of consequence measures. For this study, eight consequence measures were calculated (nc = 8).
Risk is the product of the frequency vector for the source term groups f(STG) and the consequence matrix C. Risk is an eight-component vector, for the eight consequence measures, and represents consequences averaged over the source term groups.
There are nLHS sets of vectors and matrices described above, one for each sample member. Each sample member represents a unique set of values for each uncertainty issue and is equally likely. Since consequence uncertainty was not included in LHS sampling, only one consequence matrix C is required; the last term in Figure A.16 is the same for each and every sample member.
The matrix manipulations described above were carried out using the RISQUE code. The risk calculation is a fairly straightforward process, but the number of numerical manipulations is large, since the risk vector must be calculated nLHs times, where nLHs is 150 for the Zion calculation, 200 for the Surry, Sequoyah, and Peach Bottom calculations, and 250 for the Grand Gulf calculation. Results form a distribution in risk values that represent the uncertainty associated with the issues.
The Monte Carlo-based techniques are amenable to statistical examination to provide insights concerning the result. Descriptive statistics such as central measures, variance, and range can be calculated. The relative importance of the issues to uncertainty in risk can be determined through examination of the results with statistical techniques such as regression analysis. The individual observations can also be examined. For example, if the final distribution contains some results that are quite different from all the others (say five observations an order of magnitude higher in consequences than any other observations),
the individual five sample members can be examined as separate complete risk analyses to determine the important effects causing the overall result.
One of the key developments in this program is the automation of the risk assembly process. The most significant advantage of this methods package is the ability to recalculate an entire risk result very efficiently, even given major changes in the constituent analyses. The manipulation of these models in sensitivity studies allows efficient, focused examination of particular issues and significant ability for examining changes in the plants or in the analysis.
The objectives of the program included not only calculations and conclusions concerning the risk results, but also intermediate results were quite important. Each of the analysis steps resulted in intermediate outputs. The intermediate outputs were examined by analysts to ensure the correctness of each step. The nomenclature and representation of the results described in this section are used consistently throughout the documentation of both the methods and the results for a specific plant. The same intermediate results are illustrated for each facility, and the terminology used to describe those results is consistent with that developed here.
A.8.2 Products of Risk Calculation The risk analyses performed in the NUREG-1150 project can be displayed in a variety of ways. The specific products shown in NUREG-115 0 are described in the following sections, with similar products provided for early fatality risk, latent cancer fatality risk, average individual early fatality risk within 1 mile (for comparison with NRC safety goals (Ref. A.14)), average individual latent cancer fatality risk within 10 miles of the site boundary (for safety goal comparison), population dose risk within 50 miles, and population dose risk within the entire region.
A-47 NUREG-1150 OAGI0000611 00351
Appendix A The total' risk from internal events and, where estimated, for external events Reflecting the uncertain nature of risk results, such results can be displayed using a probability distribution. For Part II of NUREG-115 0 (plant-specific results), a histogram is used to represent this probability distribution (like that shown on the right side of Fig. A. 6). Four measures of the probability distribution are identified in NUREG-1150:
- Mean, Median, 5th percentile, and 95th percentile.
A second display of risk results is used in Part III of this report, where results for all five plants are displayed together. This rectangular display (shown on the left side of Fig. A.6) provides a summary of these four specific measures in a simple graphical form.
Contributions of plant damage states and accident progression bins to mean risk The risk results generated in the NUREG-1150 project can be studied to determine the relative contribution of individual plant damage states and accident progression bins to the mean risk. An example display of the results of such a study is shown in Figure A.17.
A.9 Additional Explanation of Some Figures, Tables, and Terms A. 9.1 Additional Explanation of Some Figures and Tables Most of the results presented in this report are generalized or summary results. They are similar to the intermediate results described in Section A.8.1. However, the groupings of postulated accidents that take place at the end of each constituent part of the risk calculation are more general in this document than in the contractor reports and than described in Section A. 8.1. For example, in reporting the results for the Surry power plant, only five (summary) plant damage states are used, rather than the nine plant damage states described in the supporting documents. The descriptions of the results at both levels of detail are consistent with each other, and one can derive the more generalized results presented in this document from those presented in the supporting documents. Details of this derivation are presented in the supporting documents.
Since a Latin hypercube sample of size nLHs is being used for the risk analyses, there are nLHs values of the generalized frequency vectors f(IE), f(PDS), f(APB), f(STG), and RISK. (PDS, APB, and STG refer to the generalized groupings of projected accidents used in this report.)
Due to the nature of Latin hypercube sampling, each of these observations has probability equal to 1/nLHs* Thus, the mean value of the ith element of the vector f(PDS), (i.e., f( PDSi)) is given by f(PDSz)mean = l:n f(PDS;)n/nLHs where f(PDS;)n is the frequency of the generalized plant damage state i for Latin hypercube member n.
Further, individual analysis results for the nLHs sample elements can be ordered from the smallest to the largest and then used to estimate desired quantiles (i.e., 5th, median, and 95th), where the 'q'th quantile is the value of the variable that is greater than or equal to the 'q' of the observed results. Median is the commonly used term for the 50th quantile.
The nLHS values of f(PDS;) can also be used to construct estimated prohability density functions for f(PDS;). The estimated density function is constructed by discretizing the range of values of f(PDSi) into a number of equal intervals. The estimated density function over each of these intervals is the fraction of Latin hypercube members with values that fall within that interval. In Figure A.18, Pmis an estimate of the probability that f(PDSi) will fall in interval lm. However, because most of the histogramsfdensity plots presented in NUREG-1150 span several orders of magnitude, the plots are provided on a logarithmic scale. Thus, the corresponding histogram/density functions presented are for the logarithm of the variable under consideration. In these cases, the histogram/density functions represent the probability that the NUREG-1150 A-48 OAGI0000611 00352
SURRY EARLY FATALITY SURRY LATENT CANCER FATALITY MEAN
- 2£-11/RY MEAN
- ti.2E-S/RY Plant Damage States
- 1. SBO
- 2. AlWS
- 3. TRANSIENTS
- 4. LOCA
- 2E*II/F!Y MEAN
- 11.2£*3/RY Accident Progression Bins
- 4. VII, BMT and Lata Leak
- 11. 8ypua
A-49 Appendix A NUREG-1150 OAGI0000611 00353
Appendix A f(POSj):
frequency of PDSi t
lm +
I I
I I
I I
I t
Pm probability that f(PDSi) e lm Figure A.18 Probability that f(PDSi) will fall in interval Im.
NUREG-1150 A-50 OAGI0000611 00354
--~--
~--~~~~-
Appendix A logarithm of the variable falls in various intervals. Whether a density function is for a variable or its logarithm can be recognized by the scale used on the axis corresponding to the variable.
Explanation of Figure A.6: Figure A.6 represents an estimated probability density function, as explained above, for the total core damage frequency. The total core damage frequency for a single observation is related to the vector f(PDSh) by total core damage frequency = TCDF = 'l';i f(PDSi)*
Total core damage frequency is calculated for each observation and used to estimate a core damage histogram as described above.
Explanation of Figure A. 7: Figure A. 7 shows the mean value of the total core damage frequency, where the mean is over all the Latin hypercube sample members, as explained above. The fractional contributions indicated by sections of the pie charts are the ratios of the mean values of the frequencies of the summary plant damage states f(PDSi) to the mean value of the total core damage frequency.
Explanation of Figure A.JO: Figure A.10 is a table of mean transition probabilities (the mean taken over all Latin hypercube members) of the matrix (P(PDS-*APB)), using summary plant damage states and summary accident progression bins. The summary plant damage states and accident progression bins are described in the figure and the figure key.
Explanation of Figures A.13 and A.14: The results of the risk analyses are also used in the construction of complementary cumulative distribution functions (CCDFs). Examples of mean CCDFs appear in Figures A.13 and A.14. The CCDFs in Figure A.13 are for source term magnitude. The CCDFs in Figure A.14 are for consequence results and incorporate both stochastic weather variation and variation/uncertainty in accident initiation, progression, and source term characteristics. In figures of this type, the value on the ordinate (y-axis) gives the frequency at which the corresponding value on the abscissa (x-axis) is exceeded. A discussion of the construction of the CCDFs is provided in Appendix B.
A.9.2 Explanation of Some Terms An uncertain variable (often called a random variable in statistical texts) can take on any of several possible values, but it is impossible to predict which value will be observed in any given trial. The possible specific values are called realizations of the uncertain variable. Although there is no precise knowledge which realization will occur, there is a rule that tells which of the possible realizations is most likely; in fact, the rule quantifies the likelihood of each possible realization. The rule is called a probability distribution. For any possible realization, the probability distribution tells the probability of that value occurring.
There is controversy about the meaning of the probability distribution. The two principal interpretations are the frequentist and the subjective approaches. The frequentist orientation defines the probability as the frequency of obtaining the specific value in a very long number of independent trials. For example, if the uncertain variable took the value xl 500 times out of 1000 trials, then the probability attached to the value xl is 0.50. The subjective approach defines the probability as an individual's degree of belief in the likelihood of obtaining the specific value. The subjective probability can be defined as the odds that an individual would be equally willing to give or take on a bet that the uncertain variable would have the specific value. For example, if an individual will accept even money odds that the uncertain variable will have the value xl and is equally willing to take either side of the bet, then his probability for the value x1 is 0.50.
For many variables, the probability distribution for their realizations is unknown or the laws of nature affecting the probability distribution are imperfectly understood. However, an expert might understand which laws could apply and have an opinion as to which law is more likely. If the expert combines his knowledge of the known parts of the situation with his opinions about the relevant unknown parts, he can develop a personal estimate of the probability distribution. This is a subjective probability distribution (SPD). It is subjective because it varies from one expert to another. SPDs are manipulated by precisely the same rules as probability distributions developed from a frequentist approach.
A-51 NUREG-1150 OAGI0000611 00355
Appendix A If, in a group of experts who are representative of the possible pool of experts, each expert produces a subjective probability distribution, the distributions of the group members can be aggregated or combined in such a way that the aggregate distribution can be generalized to the entire pool of possible experts.
- The most important uncertain variables of this study were developed by groups of experts and so aggregated.
There is an important difference in interpretation between subjective probability distributions and data-based probability distributions. The latter represent the probability that a specific value will occur on a given trial. The SPD expresses a degree of belief that the value might occur. The distribution can be considered a distribution of belief rather than of knowledge. It must not be supposed that any value will be realized with the probability indicated by the SPD, nor even that an occurrence must be contained within the experts' aggregated range. However, although experts are sometimes wrong, the aggregated opinions of experts should be superior to the opinions of non-experts.
Most of the variables in this study are actually continuous and have an infinite number of possible realizations. Almost all uncertain variables have a minimum possible value and a maximum possible value; the distance between the two is the range of the uncertain variable. The probability that the uncertain variable will take on just one value out of an infinite number of possible values within the range is zero.
However, it is possible to speak of the density of probability about any specific value. The rule that describes the density of probability over the range of the variable is the probability density function (PDF). It is the probability that a realization will occur within the neighborhood of each value, divided by the width of the neighborhood. The integral of the PDF over the range is 1.0; this says that any realization must be within the range. The integral of the PDF between the minimum value of the range and any specific point in the range is the probability that the next realization will have a value less than or equal to the specific point. If the integral is carried out for every point in the range, the resulting function is the cumulative distribution function (CDF) or cumulative probability distribution (CPD). The CDF was used to characterize the uncertainty in each of the sampled variables considered in this study but does not generally appear in this report.
The complementary cumulative distribution function (CCDF) is closely related to the CDF. It is the probability that the "true" realization will be greater than any specific point in the range. The CCDF is simply 1.0 minus the CDF at every point. The CCDF is used in some instances in this report.
The PDF is difficult to compute accurately from a limited sample of data. However, the PDF can be approximated by the frequency histogram. This is the number of observations falling in each finite interval of the range. If the intervals are suitably cqosen, the frequency histogram can be a good approximation of the PDF. Frequency histograms are often used in this report.
Initiating events are characterized by their frequency-the number of times such events can be expected to occur per year. As long as the frequency is substantially less thaQ 1.0, this is equivalent to the probability of the event occurring in any given year. Succeeding events are characterized by their conditional probability. The conditional probability of B given A is the probability that B will occur if A has already occurred. The characterization of succeeding events can also be thought of as a relative frequency, that is, their frequency relative to the frequency of the preceding event. The methods for manipulation of chains of conditional probabilities are well known.
Additional information on statistics and probability can be found in References A.74 through A.78.
- This is so because (absent any other information about the population) the sample mean is the best estimate of the popula-tion mean, and the population mean (absent any special information about individuals in the population) is the best estimate of the responses of any member of the population.
NUREG-1150 A-52 OAGI0000611 00356
Appendix A REFERENCES FOR APPENDIX A A.1 D. M. Ericson, Jr., (Ed.) et al., "Analysis of Core Damage Frequency: Internal Events Methodol-ogy," Sandia National Laboratories, NUREG/CR-4550, Vol. 1, Revision 1, SAND86-2084, January 1990.
A.2 E. D. Gorham-Bergeron et al., "Evaluation of Severe Accident Risks: Methodology for the Accident Progression, Source Term, Consequence, Risk Integration, and Uncertainty Analyses,"
Sandia National Laboratories, NUREG/CR-4551, Vol. 1, Draft Revision 1, SAND86-1309, to be published.*
A. 3 U.S. Nuclear Regulatory Commission (U SNRC),
"Reactor Risk Reference Document,"
NUREG-1150, Vols. 1-3, Draft for Comment, February 1987.
A.4 F. T. Harper et al., "Analysis of Core Damage Frequency from Internal Events: Methodology Guidelines," Sandia National Laboratories, NUREG/CR-4550, Vol. 1, SAND86-2084, September 1987.
A.5 A. S. Benjamin et al., "Evaluation of Severe Accident Risks and the Potential for Risk Reduction:
Surry Power Station, Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 1, Draft for Comment, SAND86-1309, February 1987.
A.6 A. S. Benjamin et al., "Containment Event Analysis for Postulated Severe Accidents: Surry Nuclear Power Station, Unit 1," Sandia National Laboratories, NUREG/CR-4700, Vol. 1, Draft for Comment, SAND86-1135, February 1987.
A.7 H. J. C. Kouts et al., "Methodology for Uncertainty Estimation in NUREG-1150 (Draft):
Conclusions of a Review Panel,"
Brookhaven National Laboratory, NUREG/CR-5000, BNL-NUREG-5 2119, December 19 8 7.
A.8 W. E. Kastenberg et al., "Findings of the Peer Review Panel on the Draft Reactor Risk Reference Document, NUREG-1150," Lawrence Livermore National Laboratory, NUREG/CR-5113, UCID-21346, May 1988.
A.9 L. LeSage et al., "Initial Report of the Special Committee on Reactor Risk Reference Document (NUREG-1150)," American Nuclear Society, April 1988.
A.10 J. M. Griesmeyer and L. N. Smith, "A Reference Manual for the Event Progression Analysis Code (EVNTRE)," Sandia National Laboratories, NUREG/CR-5174, SAND88-1607, September 1989.
A.ll H-N Jow et al., "XSOR Codes User's Manual," Sandia National Laboratories, NUREG/CR-5360, SAND89-0943, to be published.
- A.12 D. I. Chanin, H-N Jow, J. A. Rollstin et al., "MELCOR Accident Consequence Code System (MACCS), Sandia National Laboratories, NUREG/CR-4691, Vols. 1-3, SAND86-1562, Febru-ary 1990.
A.13 L. T. Ritchie et al., "CRAC2 Model Description," Sandia National Laboratories, NUREG/
CR-2552, SAND82-0342, April 1984.
A.14 USNRC, "Safety Goals for the Operation of Nuclear Power Plants; Policy Statement," Federal Register, Vol. 51, p. 30028, August 21, 1986.
-A.15 M. D. McKay et al., "A Comparison of Three Methods for Selecting Values in Input Variables in the Analysis of Output from a Computer Code," Technometrics 21(2), 1979.
A.16 M. T. Drouin et al., "Analysis of Core Damage Frequency: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 6, Revision 1, SAND86-2084, September 1989.
- Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
A-53 NUREG-1150 OAGI0000611 00357
Appendix A A.17 A. D. Swain III, "Accident Sequence Evaluation Program-Human Reliability Analysis Procedure,"
Sandia National Laboratories, NUREG/CR-4772, SAND86-1996, February 1987.
A.18 W. J. Luckas, Jr., "A Human Reliability Analysis for the ATWS Accident Sequence with MSIV Closure at the Peach Bottom Atomic Power Station," Brookhaven National Laboratory, May 1986.
A.19 D. W. Stack, "A SETS User's Manual for Accident Sequence Analysis," Sandia National Laboratories, NUREG/CR-3547, SAND83-2238, January 1984.
A.20 R. L. Iman and M. J. Shortencarier, "A User's Guide for the Top Event Matrix Analysis Code (TEMAC)," Sandia National Laboratories, NUREG/CR-4598, SAND86-0960, August 1986.
A.21 M. B. Sattison and K. W. Hall, "Analysis of Core Damage Frequency: Zion Unit 1," Idaho National Engineering Laboratory, NUREG/CR-4550, Vol. 7, Revision 1, EGG-2554, May 1990.
A.22 Commonwealth Edison Company of Chicago, "Zion Probabilistic Safety Study," September 1981.
A.23 D. L. Berry et al., "Review and Evaluation of the Zion Probabilistic Safety Study: Plant Analysis,"
Sandia National Laboratories, NUREG/CR-3300, SAND83-1118, May 1984.
A.24 USNRC, "Reactor Safety Study-An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400 (NUREG-75/014), October 1975.
A.25 Institute of Electrical and Electronics Engineers, Inc. (IEEE), "IEEE Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear-Power Generating Stations," IEEE Standard 500-1984, 1983.
A.26 Houston Lighting and Power Company, "South Texas Project Probabilistic Safety Assessment,"
April 1989.
A.27 K. D. Russell et al., "Integrated Reliability and Risk Analysis System (IRRAS) Version 2.0 User's Guide," Idaho National Engineering Laboratory, NUREG/CR-5111, EGG-2535, June 1990.
A.28 R. C. Bertucio and J. A. Julius, "Analysis of Core Damage Frequency: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4550, Vol. 3, Revision 1, SAND86-2084, April 1990.
A.29 G. E. Cummings, "Summary Report on the Seismic Safety Margins Research Program," Lawrence Livermore National Laboratory, NUREG/CR-4431, UCID-20549, January 1986.
A.30 M. P. Bohn et al., "Application of the SSMRP Methodology to the Seismic Risk at the Zion Nuclear Power Plant,"
Lawrence Livermore National Laboratory, NUREG/CR-3428, UCRL-53483, January 1984.
A.31 D. L. Bemreuter et al., "Seismic Hazard Characterization of 69 Nuclear Power Sites East of the Rocky Mountains," Lawrence Livermore National Laboratory, NUREG/CR-5250, Vols. 1-8, UCID-21517, January 1989.
A.32 Seismicity Owners Group and Electric Power Research Institute, "Seismic Hazard Methodology for the Central and Eastern United States," EPRI NP-4726, July 1986.
A.33 J. E. Richardson, USNRC, letter to R. A. Thomas, Seismicity Owners Group, "Safety Evaluation Review of the SOG/EPRI Topical Report Titled 'Seismic Hazard Methodology for the Central and Eastern United States,' " dated September 20, 1988.
A.34 U.S. Army Corps of Engineers, Huntsville Division, SAFEGUARD Shock Test Program, HNDDSP-72-151-ED-R, Vol. 1, 1973.
A.35 M. P. Bohn and J. A. Lambright, "Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150," Sandia National Laboratories, NUREG/CR-4840, SAND88-3102, November 1990.
NUREG-1150 A-54 OAGI0000611 00358
Appendix A A.36 P. B. Schnabel, J, Lysmer, and H. B. Seed, "SHAKE-A Computer Program for Earthquake Response Analysis of Horizontally Layered Sites," Earthquake Engineering Research Center, University of California at Berkeley, EERC 72-12, 1972.
A.37 H. L. Wong and J. E. Luco, "Soil-Structure Interaction: A Linear Continuum Mechanics Approach (CLASS!)," Department of Civil Engineering, University of Southern California, CE79-03, 1980.
A.38 Code of Federal Regulations, Appendix R, "Fire Protection Program for Nuclear Power Facilities Operating Prior to January 1, 1979," to Part 50, "Domestic Licensing of Production and Utilization Facilities," of Title 10, "Energy."
A.39 V. Ho et al., "COMPBRN III-A Computer Code for Modeling Compartment Fires," University of California at Los Angeles, UCLA-ENG-8524, November 1985.
A.40 S. S. Dosanjh, "MELPROG-PWR/MOD1: A Two-Dimensional, Mechanistic Code for Analysis of Reactor Core Melt Progression and Vessel Attack Under Severe Accident Conditions," Sandia National Laboratories, NUREG/CR-5193, SAND88-1824, May 1989.
A.41 K. D. Bergeron et al., "User's Manual for CONTAIN 1.0, A Computer Code for Severe Reactor Accident Containment Analysis," Sandia National Laboratories, NUREG/CR-4085, SAND84-1204, July 1985.
A.42 J. A. Gieseke et al., "Source Term Code Package: A User's Guide," Battelle Columbus Division, NUREG/CR-4587, BMI-2138, July 1986.
A.43 Fauske and Associates, Inc., "MAAP Modular Accident Analysis Program User's Manual, " Vols.
I and II, IDCOR Technical Report 16.2-3, February 1987.
A.44 R. M. Summers et a!., "MELCOR In-Vessel Modeling," Proceedings of the Fifteenth Water Reactor Safety Information Meeting (Gaithersburg, MD), NUREG/CP-0091, Feburary 1988.
A.45 N. K. Tutu et al., "Estimation of Containment Loading Due to Direct Containment Heating for the Zion Plant," Brookhaven National Laboratory, NUREG/CR-5282, BNL-NUREG-52181, to be published.*
A.46 F. T. Harper et a!., "Evaluation of Severe Accident Risks: Quantification of Major Input Parameters," Sandia National Laboratories, NUREG/CR-4551, Vol. 2, Revision 1, SAND86-1309, December 1990.
A.47 R. J. Breeding et al., "Evaluation of Severe Accident Risks: Surry Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 3, Revision 1, SAND86-1309, October 1990.
A.48 A. C. Payne, Jr., et al., "Evaluation of Severe Accident Risks: Peach Bottom Unit 2," Sandia National Laboratories, NUREG/CR-4551, Vol. 4, Draft Revision 1, SAND86-1309, to be published.*
A.49 J. J. Gregory et al., "Evaluation of Severe Accident Risks: Sequoyah Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 5, Revision 1, SAND86-1309, December 1990.
A.50 T. D. Brown et al., "Evaluation of Severe Accident Risks: Grand Gulf Unit 1," Sandia National Laboratories, NUREG/CR-4551, Vol. 6, Draft Revision 1, SAND86-1309, to be published.*
A.51 C. K. Park et al., "Evaluation of Severe Accident Risks: Zion Unit 1," Brookhaven National Laboratory, NUREG/CR-4551, Vol. 7, Draft Revision 1, BNL-NUREG-52029, to be published.*
A.52 K. Mokhtarian et al., "MARK I Containment Severe Accident Analysis for the MARK I Owners' Group," CBI NA-CON, Inc., April 1987.
- Available in the NRC Public Document Room, 2120 L Street NW., Washington, DC.
A-55 NUREG-1150 OAGI0000611 00359
Appendix A A.53 D. B. Clauss, "Comparison of Analytical Predictions and Experimental Results for a 1:8-Scale Steel Containment Model Pressurized to Failure," Sandia National Laboratories. NUREG/
CR-4209, SAND85-0679, September 1985.
A.54 S. J. Higgins, "A User's Manual for the Postprocessing Program PSTEVNT," Sandia National Laboratories, NUREG/CR-5380, SAND88-2988, November 1989.
A. 55 R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios,"
Battelle Columbus Division, NUREG/CR-4624, Vols. 1-5, BMI-2139, July 1986.
A.56 R. S. Denning et al., "Radionuclide Release Calculations for Selected Severe Accident Scenarios:
Supplemental Calculations," Battelle Columbus Division, NUREG/CR-4624, Vol. 6, BMI-2139, August 1990.
A.57 R. L. Iman et al., "PARTITION: A Program for Defining the Source Term/Consequence Analysis Interface in the NUREG-1150 Probabilistic Risk Assessments," Sandia National Laboratories, NUREG/CR-5253, SAND88-2940, May 1990.
A.58 D. Bennett, "SANDIA-ORIGEN User's Manual," Sandia National Laboratories, NUREG/
CR-0987, SAND79-0299, December 1979.
A. 59 G. A. Briggs, "Plume Rise Prediction," Proceedings of Workshop: Lectures on Air Pollution and Environmental Analysis, American Meteorological Society, 1975.
A.60 D. C. Kocher, "Dose Rate Conversion Factors for External Exposure to Photons and Electrons,"
Oak Ridge National Laboratory, NUREG/CR-1918, ORNL/NUREG-79, August 1981.
A.61 International Commission on Radiological Protection, "Recommendations of ICRP," Publication 26, Annals of ICRP, Vol. l, No. 3, 1977.
A.62 International Commission on Radiological Protection, "Limits for Intakes of Radionuclides by Workers," Publication 30, Annals of ICRP, Vol. 2, Nos. 3 and 4, 1978.
A.63 U. S. Environmental Protection Agency, "Manual of Protective Action Guides and Protective Actions for Nuclear Incidents," Office of Radiation Programs, Draft, 1989.
A.64 J. S. Evans et al., "Health Effects Model for Nuclear Power Plant Accident Consequence Analysis," Harvard University, NUREG/CR-4214, SAND85-7185, August 1985.
A.65 U.S. National Research Council, National Academy of Sciences, Committee on the Biological Effects of Ionizing Radiation, "The Effects on Populations of Exposure to Low Levels of Ionizing Radiation: 1980, National Academy Press, 1980.
A.66 R. L. Iman and J. C. Helton, "A Comparison of Uncertainty and Sensitivity Analysis Techniques for Computer Models," Sandia National Laboratories, NUREG/CR-3904, SAND84-1461, May 1985.
A. 6 7 P. A. Seaver, "Assessments of Group Preferences and Group Uncertainty for Decision Making,"
University of Southern California, Social Sciences Research Institute, 1976.
A.68 J. M. Booker and M. A. Meyer, "Sources and Effects of Interexpert Correlation: An Empirical Study," IEEE Transactions on Systems, Man, and Cybernetics, Vol. 18, No. 1, pp. 135-142, 1988.
A.69 S. Lictenstein et al., "Calibration of Probabilities: The State of the Art to 1980," Judgment Under Uncertainty: Heuristics and Biases, Cambridge University Press, 1982.
A.70 J. S. Armstrong et al., "Use ofthe Decomposition Principle in Making Judgments," Organizational Behavior and Human Performance, 14: 257-263, 1975.
NUREG-1150 A-56 OAGI0000611 00360
Appendix A A. 71 I. C. Janis, Victims of Group Think: A Psychological Study of Foreign Policy Decisions and Fiascoes, Houghton Mifflin, Boston, MA.
A.72 H. F. Martz et al., "Eliciting and Aggregating Subjective Judgment-Some Experimental Results,"
Proceedings of the 1984 Statistical Symposium on National Energy Issues (Seattle, WA),
NUREG/CP-0063, July 1985.
A. 73 T. A. Wheeler et al., "Analysis of Core Damage Frequency from Internal Events: Expert Judgment Elicitation," Sandia National Laboratories, NUREG/CR-4550, Vol. 2, SAND86-2084, April1989.
A.74 I. J. Good, "Axioms of Probability," Encyclopedia of Statistical Sciences, Vol. 1, pp. 169-176, Wiley, New York, 1983.
A. 75 E. Sverdrup, "Frequency Interpretation in Probability and Statistical Inference," Encyclopedia of Statistical Sciences, Vol. 3, pp. 225-231, Wiley, New York, 1983.
A. 76 T. L. Fine, "Foundation of Probability,"
Encyclopedia of Statistical Sciences, Vol. 3, pp.
175-184, Wiley, New York, 1983.
A.77 R. V. Hogg and A. T. Craig, Introduction to Mathematical Statistics, 3rd Ed., Macmillan, New York, 1970.
A.78 V. Barnett, Comparative Statistical Inference, 2nd Ed., Wiley, New York, 1982.
A-57 NUREG-1150 OAGI0000611_00361
APPENDIX B AN EXAMPLE RISK CALCULATION OAGI0000611 00362
CONTENTS Page B.1 Introduction............................................................
B-1 B.2 Accident Frequency Analysis..............................................
B-1 B.2.1 Overview of Accident Frequency Analysis..............................
B-1 B.2.2 Description of Accident Sequence....................................
B-7 B.2.3 Quantification of Cut Set............................................
B-8 B.2.4 Accident Sequence and PDS.........................................
B-9 B.3 Accident Progression Analysis..............................................
B-10 B. 3.1 Introduction......................................................
B-1 0 B.3.2 Discussion of APET Questions.......................................
B-16 B.3.3 Quantification of APET Questions by Expert Judgment...................
B-22 B.3.4 Binning Results of APET............................................
B-35 B.4 Source Term Analysis....................................................
B-38 B.4.1 Equation for Release Fraction for Iodine...............................
B-39 B.4.2 Discussion of Source Term Factors....................................
B-41 B.4.3 Quantification of Source Term Factors by Experts.......................
B-44 B.4.4 Releases for All Fission Products.....................................
B-53 B.S Partitioning of Source Terms...............................................
B-53 B.5.1 Introduction......................................................
B-53 B.5.2 Effects Weights....................................................
B-54 B.5.3 Partitioning Process and Results......................................
B-58 B. 6 Consequence Calculation..................................................
B-60 B.6.1 Description of Consequence Calculation................................
B-60 B.6.2 Results of Consequence Calculation...................................
B-61 B.7 Computation of Risk.....................................................
B-63 B. 7.1 Introduction......................................................
B-63 B.7.2 Calculation and Display of Mean Risk.................................
B-63 B. 7.3 Calculation and Display of CCDFs....................................
B-66 B.8 Summary...............................................................
B-70 REFERENCES FOR APPENDIX B.............................................
B-72 iii NUREG-1150 OAGI0000611 00363
FIGURES B.1 Event tree for T1S-SBO at Surry Unit 1.....................................
B-4 B.2 Reduced fault tree for DG 1 at Surry Unit 1................................
B-5 B.3 Reduced fault tree for AFWS at Surry Unit 1................................
B-6 B.4 Simplified diagram of first part of Surry accident progression event tree...........
B-13 B.S Event tree used by all three experts in determining the probabilities of different leak rates for a single reactor coolant pump..................................
B-24 B.6 First part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps.........................
B-25 B. 7 Second part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps.........................
B-26 B.8 Results of expert elicitation for pressure rise at vessel breach for Surry............
B-32 B. 9 Simplified schematic of Surry containment...................................
B-33 B.lO Results of expert elicitation for static failure pressure of Surry containment.........
B-36 B.11 Results of expert elicitation for FCOR, fraction of the fission products released from core to vessel for the nine radionuclide groups...........................
B-46 B.12 Results of expert elicitation for FCOR, fraction of fission products released from core to vessel for the nine radionuclide groups................................
B-47 B.13 Results of expert elicitation for FCONV, fraction of fission products in containment from RCS release that is released to environment..............................
B-50 B.14 Distributions for late release of iodine from containment in volatile form..........
B-52 B.15 Relationship between I-131 release and mean early fatalities used in determining early effects weights for partitioning.........................................
B-56 B.16 Distribution of latent cancer fatalities computed for STG SUR-49................
B-62 B.17 Distribution of expected (weather-averaged) latent cancer fatality risk for Surry.....
B-65 B.18 CCDFs for latent cancer fatalities for STG SUR-49 and for all 52 STGs...........
B-67 B.19 Computed curves showing four statistical measures of 200 CCDFs for Surry for early fatalities and latent cancer fatalities.
B-69 TABLES B.1. Most likely cut set in Surry sequence T1S-QS-L quantification for observation 4.
B-3 B.2 Selected questions in Surry APET..........................................
B-11 B.3
- Aggregate results for RCP seal failure with existing o-ring material................
B-28 B.4 Isotopes in each radionuclide release class....................................
B-39 B.S Partitioning parameters and results..........................................
B-55 B. 6 Properties of source term 17, subgroup 1....................................
B-60 NUREG-1150 iv OAGI0000611 00364
Appendix B B.l Introduction In this appendix, which is adapted from Reference B.1, an example calculation is followed through the entire analysis from the initiating event in the accident frequency analysis through to the offsite risk. This discussion has been prepared for the reader seeking detailed information on how the risk calculations were performed. It is assumed that the reader is familiar with nuclear power plants in general and with severe accident risk analysis in particular. Since the accident frequency analysis is generally more familiar to the PRA community, and the accident frequency analyses performed for NUREG-1150 have fewer novel features than the other analyses, the discussion of the accident frequency analysis in this appendix is abbreviated. Thus, even though the accident frequency analysis requires a level of effort comparable to that required for the other analyses, the discussion of the risk calculation from the identification of the initiating event through the definition of the plant damage state (PDS) does not reflect that fact.
The example selected for this discussion is a fast station blackout (SBO) accident for Surry. This accident, denoted TMLB'
- in the Reactor Safety Study, is estimated to be one of the more likely accidents and is of historical interest. Surry was chosen because the accident progression event tree (APET) for Surry is simpler than the APETs for the other plants.
The PDS designation for the fast SBO accident is TRRR-RSR. (The PDS nomenclature is explained in Section B.2.3.) This PDS has the third highest mean core damage frequency (MCDF) at Surry. Several accident sequences comprise this PDS; the one chosen for this example is T1S-QS-L, which has the highest frequency of the sequences in TRRR-RSR. (This sequence is defined in detail in Section B.2.1.)
PDS TRRR-RSR is the only PDS in PDS group 3, fast SBOs. The example will be followed through the APET to accident progression bin (APB) GFA-CAC-ABA-DA. (The APB nomenclature is explained in Section B.3.4.) For the observation chosen, this bin is the most likely to have both vessel breach (VB) and containment failure (CF). The computation of the source term for this bin will be followed through the source term analysis, and this source term will then be grouped with other similar source terms in the partitioning process.
Finally, offsite consequences will be determined for the subgroup to which the source term for GFA-CAC-ABA-DA was assigned, and the results of all the analyses will be combined to obtain the measures of risk.
To determine the uncertainty in risk, the accident frequency analysis, the accident progression analysis, and the source term analysis were performed many times, with different values for the important parameters each time. A sample of 200 observations was used for the Surry analysis. The Latin hypercube sampling method, a stratified Monte Carlo method, was used. In this example, one sample member or observation, Observation 4, will be followed all the way through the risk analysis. It was chosen because it was the median observation for early fatality risk (in the analysis in which 100 percent evacuation was assumed).
B.2 Accident Frequency Analysis The accident frequency analysis determines the expected frequencies for the many different types of core damage accidents that can occur. This appendix is not intended to present methods, as those are summarized in Appendix A and presented in detail in Reference B.2. Nevertheless, many aspects of the methods will become apparent in this discussion. Section B.2.1 is an overview of the accident frequency analysis, and Section B.2.2 contains a description of the accident sequence. Section B.2.3 describes the quantification of the cut set, and Section B.2.4 discusses how the accident sequences are grouped into PDSs.
B.2.1 Overview of Accident Frequency Analysis Development of the chronology and frequency of the accident sequences involves many tasks or constituent analyses. These include:
- TMLB' was defined in the Reactor Safety Study as a transient loss of offsite power (T) with failure of the power conversion system (M) and the auxiliary feed water system (L), and failure of the emergency ac power system with no recovery of offsite ac power in 1 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (B').
B-1 NUREG-1150 OAGI0000611 00365
Appendix B Initiating event analysis, including determination of the system success criteria, Event tree analysis, including accident sequence delineation, Systems analysis, including fault tree construction, Dependent and subtle failure analysis, Human reliability analysis, Data base analysis, including development of the data base, Elicitation of expert judgment, Accident sequence quantification, including recovery actions, Grouping of the accident sequences into PDSs, and Uncertainty analysis.
These tasks are performed approximately in the order given above. The quantification and the assignment of the sequences to PDSs are performed several times in iterative fashion as the information available evolves and the requirements of the subsequent analyses change.
An accident sequence is a particular accident defined by the initiating event and failures of the systems required to respond to the initiator. Sequences are defined by specifying what systems fail to respond to the initiator. In the accident frequency analysis, models (event trees, fault trees) are constructed for all the important safety systems in the plant (usually at the pump and valve level of detail). Failure rates for equipment such as pumps and valves are developed from failure data specific to the plant being analyzed and from generic nuclear power plant data bases. The models and the failure rates are used by the computer program that calculates the thousands of possible failure combinations, denoted as cut sets, that lead to core damage.
Each cut set consists of the initiator and the specific hardware or operator failures that produce the system failures. The initiator and the failures are often referred to as "events." For example, a water injection system could fail because the pump failed to start or because the normally closed, motor-operated discharge valve failed to open. Cut sets that include the pump failure and cut sets that include the valve failure, but are otherwise identical, occur in the same accident sequence since the pump and valve failures have the same effect on a system level.
The accident sequence followed for this example is TlS-QS-L, which is the highest frequency sequence that contributes to PDS TRRR-RSR. This sequence is the most probable of several sequences that involve station blackout and early failure of the auxiliary feed water system (AFWS). The mean frequency for TRRR-RSR is 4.8E-6/reactor year, and T1S-QS-L contributes about 75 percent of that. For Observation 4, the frequency of TRRR-RSR is 4.8E-7/reactor year, and the frequency of TlS*QS-L is 2.4E-7/reactor year. (It is purely coincidental that the frequency of TRRR-RSR for Observation 4 is one-tenth of the average frequency over all 200 observations.)
Sequence TlS-QS-L is comprised of 216 cut sets. The cut set with the highest frequency, consisting of nine events, is given in Table B.l. The cut set equation for T1S-QS-L is:
T1S-QS-L = (IE-T1) * (OEP-DGN-FS-DGOl) * (/DGN-FTO) * (OEP-DGN-FS-DG03) *
(NRAC-lHR) * (REC-XHE-FO-DGEN) * (NOTQ) * (QS-SBO) * (AFW-XHE-FO-CST2)
+...... ( 215 other cut sets )
The frequency of each cut set varies from observation to observation because the probabilities of some of the events are sampled from distributions. For Observation 4, the frequency of the cut set in Table B.l is NUREG-1150 B-2 OAGI0000611 00366
Appendix B 3.4E-8/reactor year. This cut set defines one group of specific failures that cause the accident, which will be followed through the entire analysis in this appendix. Each event listed in Table B.l is discussed in some detail in Section B.2.3 below.
Table B.l Most likely cut set in Surry sequence TlS-QS-L quantification for observation 4.
Event IE-T1 OEP-DGN-FS-DG01
/DGN-FTO OEP-DGN-FS-DG03 NRAC-1HR REC-XHE-FO-DGEN NOTQ QS-SBO AFW-XHE-FO-CST2 Entire cut set Quantification 0.0994 0.0133 0.966 0.0133 0.44 0.90 0.973 0.0675 0.0762 3.4E-8 Description Initiating Event: LOSP DG 1 fails to start Success of DG 2 DG 3 fails to start Failure to restore offsite electric power within 1 h Failure to restore a DG to operation within 1 h RCS PORVs successfully reclose during SBO Stuck-open SRV in the secondary system Failure of operator to open the manual valve from the AFW pump suction to CST2 Frequency (per year) for Observation 4 Figure B.1 shows the event tree for TIS-station blackout at Unit 1. Three of the paths through this tree lead to core damage situations that are in PDS TRRR-RSR. Accident sequence 19, TlS-QS-L, is the most likely of these three. The logical expression for this sequence, according to the column headings or top events, is:
T1S-QS-L== T1S
- NRAC-HALFHOUR * /Q
- QS
- L, where /Q indicates not-Q, or success. System success states like /Q are sometimes omitted during quantification if the state results from a single event since the success value is very close to 1.0. Tl is a loss of offsite power (LOSP) initiator, and the "S" in T1S indicates that it is followed by failure of the emergency ac power system (EACPS). Failure of EACPS, although not shown explicitly in Figure B.1, is determined by a fault tree, and T1S = T1
- Failure of EACPS, where failure of EACPS is failure of diesel generator (DG) 1 and DG 3, or, failure of DG 1 and DG 2.
(Failure of only DG 2 and DG 3 implies success of DG 1, which is not SBO for Unit 1. If DG 2 fails, it is assumed that DG 3 is assigned to Unit 2. Failure of all three DGs is included in a different sequence.)
Note that T1 appears as IE-Tl in the cut set; the SBO is implied by events OEP-DGN-FS-DG01 and OEP-DGN-FS-DG03.
The cut set considered in this appendix has the failure of DG 1 and DG 3. A simplified depiction of the fault tree for DG 1 is shown in Figure B.2. The fault tree for DG 3 is similar. The heavier line in Figure B.2 indicates the failure, OEP-DGN-FS-DGOl, in the cut set of interest. The other failures are included in other cut sets. (Figs. B.2 and B.3 are illustrative only and do not provide an accurate representation of the complete fault trees. The complete fault trees are given in Appendix B.2 to Ref. B.3.)
In Figure B.l, the cut set of interest is part of sequence 19, TlS-QS-L, which is shown by the heavier line.
The first top event is the initiator, discussed above. The second top event concerns the recovery of offsite ac power within 30 minutes (NRAC-HALFHOUR). In the event of a loss of auxiliary feedwater, core uncovery will occur in approximately 60 minutes. A 30-minute time delay for reestablishing support systems (including canal water level) was assumed from the time that ac power was restored to the time that feed and bleed could be established. Thus, ac power must be recovered within 30 minutes in order to mitigate failure of auxiliary feedwater.
B-3 NUREG-1150 OAGI0000611 00367
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
(j) 00
~
ttl cr Ut 0
to
.J,.
SBO NRAC*
AT HALF UNIT1 HOUR T1S -
--~-- --
RCI SGI AF\\1 NRAC-SEAL OPER. RCP NRAC* NRAC*
ONE COOL OPRES SEAL SEAL SEVEN HOUR FH U2 LOCA LOCA IIOURS a-OS-L NR1
\\12*
o-Sl*
NRS NR7 Sequence I CORE I Pl DAMAGE ST I I
I I
I I
I I
1 L
1 1
1 I
I 1
1 I
I 1
1 I
1 1
l
?
I
.?
- 1. T1S
- 2. ns*
- 3. T1S*NR7
- 4. T1S*\\12*
- 5. T1S*\\l2*NR7
- 6. T1S*\\l2*Sl*
- 7. T1S*U2*SL*NRS
- 8. T1S*\\12*0*
- 9. T1S*\\12*0*NR7 O. T1S*\\12*0*SL*
- 1. T1S*\\12*0*SL*NRS
- 2. T1S*L
- 3. T1S*OS*
- 4. T1S*OS*NR7
- 5. T1S*QS*\\l2*
- 6. T1S*OS*\\12*NR7
- 7. T1S*QS*\\12*SL*
- 8. T1S*QS*\\l2*SL*NRS
- 9. T1S*OS*l O. T1S*O*
- 1. T1S*Q*NR1
- 2. T1S*Q*L
- 3. T1S*Q*QS*
- 4. T1S*Q*OS*NR1
- 5. T1S*Q*QS*l OK OK CH OK CH OK CH OK CH OK CH CH OK CH OK CH OK CH CH OK CH CH OK CH CH Figure B.l Event tree for TlS-SBO at Surry Unit 1. (This figure is adapted from Section 4.4 of Ref. B.3. No PDS assignment is indicated for sequence 25 because the sequence frequency fell below the cutoff value.)
TRRR*RDY TRRR*RDR S3RRR*RDR TRRR*RCR S3RRR*RCR TRRR*RSR TRRR*RDY TRRR*RDR S3RRR*RDR TRRR*RSR S2RRR*RCR TRRR*RSR S2RRR*RDR i [
x*
bj
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
(j)
<D t;1j I
VI z
c:::
~
0 I
1-'
f-'
~
fjJJureof 4180 BUS IJ P=l for TlS-QS-L OEP-DGN-FS-DGOl Other Figure B.2 Reduced fault tree for DG 1 at Surry Unit 1. (This figure is a greatly simplified version of the fault tree given in Appendix B.2 of Ref. B.3. P = 1 indicates that the failure probability is 1.0.)
.6>
'0 CD
- )
Cl.
~-
t:J:1
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
0 z c
- Q ti1 0
I....
VI 0
to I 0\\
MDP Faile to Start Molor*Drlven TrainA Pel for TlS-QS-L MDP Falla to Run Other r
AFW Syalem Motor-Driven TralnB I
P=l for TlS-QS-L TDP Falls to Start LOtiOfAC Power TDP Falls to Run Other Turbine-Driven Failure to Open Backup CSTLfne Lo.. ofDC Power Failure ol Suction Line Valve*
~
AFW-XHE-FO-CST2 Figure B.3 Reduced fault tree for AFWS at Surry Unit 1. (This figure is a greatly simplified version of the fault tree given in Appendix B.Z of Ref. B.3. P = 1 indicates that the failure probability is 1.0.)
- g (I)
- s
~
t::!j
Appendix B The third top event is RCI, failure of reactor coolant system integrity, Event Q. In the cut set being followed, the success branch is taken here, i.e., the PORVs cycle correctly and do not stick open. The fourth top event in Figure B.1 is SGI, failure of steam generator (secondary side) integrity. In this cut set, a relief valve on the main steam line sticks open, Event QS, so the failure branch is taken. Failure of QS causes rapid depressurization of the steam generator and rapid depletion of condensate water.
The fifth top event, L, is failure of the AFWS. In the cut set listed in Table B.1, the steam-turbine-driven AFWS runs until the condensate storage tank (CST) is depleted at about 60 minutes after the start of the accident. The AFWS fails at that time because the operators fail to switch the pump suction to the backup CST. This failure is event AFW-XHE-FO-CST2. Thus, the appropriate power recovery time for this cut set is NRAC-1HR, which replaces NRAC-HALFHOUR in the cut set, although the failure (lower) branch for NRAC-HALFHOUR is indicated on the event tree. None of the subsequent top events are applicable since the failures that have already occurred are sufficient to cause core damage, so there are no further branches on the path to sequence 19.
Figure B.3 is a simplified fault tree for the AFWS. The motor-driven AFW trains, of course, require ac electrical power and are not available for this accident. The heavier line in Figure B.3 indicates the failure that occurs in the cut set considered for this example. The other failures are included in other cut sets.
A general description of this accident sequence follows in the next section. More detail on the methods used in the accident frequency analysis may be found in Reference B.2. Details of the specific analysis for Surry may be found in Reference B.3.
B.2.2 Description of Accident Sequence An LOSP initiator, IE-T1, starts this transient accident by tripping the reactor and the main steam turbine. The DG assigned to Unit 1, DG 1, fails to start, OEP-DGN-FS-DG01. DG 3 also fails to start, OEP-DGN-FS-DG03. (DG 2 is dedicated to Unit 2.) The event /DGN-FTO indicates that DG 2 is successfully powering Unit 2. The failure to start of DG 1 and DG 3 causes a complete failure of ac power at Unit 1. However, de power is available from the Unit 1 batteries until they are depleted (in roughly 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />).
The pressure boundary of the reactor coolant system (RCS) is intact, so loss of water from the RCS is not an immediate problem. However, all the systems capable of injecting water into the RCS depend on pumps driven by ac electric motors. Thus, if decay heat cannot be removed from the RCS, the pressure and temperature of the water in the RCS will increase to the point where water will flow out through the PORVs, and there will be no way to replace this lost water.
Heat removal after shutdown is normally accomplished by the auxiliary feedwater system (AFWS). Surry's AFWS has three trains: two of these trains have pumps driven by ac electric motors, and these trains are unavailable due to the SBO. The only means of heat removal in a blackout situation is the steam-turbine-driven AFW train. In the accident defined by the cut set in Table B.1, the steam-turbine-driven AFW train is initially available as steam is being generated in the steam generators (SGs) to drive the steam turbine, and de power is available for control purposes. The initiating LOSP causes the main steam isolation valves (MSIVs) to close, preventing the steam being generated in the SGs that is not needed by the AFWS turbine from flowing to the main condenser. The normal means of venting excess steam from the secondary system is through the atmospheric dump valves (ADVs), but in this sequence they are failed in the closed position because of the loss of 120 v ac power. Thus, pressure relief takes place through one or more of the secondary system safety-relief valves (SRVs).
In this accident sequence, at least one of the secondary system SRVs fails to reclose, which causes water to be lost at a significant rate from the secondary system. This is event QS in Figure B.1; it is denoted QS-SBO in the cut set. The AFWS initially draws from the 100,000-gallon condensate storage tank (CST). With an SRV stuck open, the AFWS will draw from the CST at 1,000 to 1,500 gpm to replace the water lost through the SRV, thus depleting the CST in 1.0 to 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. A 300,000-gallon backup water supply (CST2) is available, but the AFWS cannot draw from this tank unless a manual valve is opened. In this cut set, the operators fail to open this valve, and the AFWS fails. This human error is event AFW-XHE-FO-CST2. There are two recovery actions in this cut set. One is the failure to restore offsite power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (NRAC-1HR), and the other is the failure to recover a failed DG B-7 NUREG-1150 OAGI0000611 00371
Appendix B (REC-XHE-FO-DGEN). In the path to sequence 19 shown in Figure B.1, the failure to recover offsite power is NRAC-HALFHOUR. In this particular cut set, the time to failure of the AFWS is longer than in the majority of cut sets in sequence TlS-QS-L, and this failure is replaced by NRAC-1HR.
With the failure of the turbine-driven AFW train, and no ac power to run the motor-driven AFW trains, the reactor coolant system (RCS) heats up until the pressure forces steam through the PORV(s). Water loss through the PORV(s) continues, with the PORV(s) cycling open and closed, until enough water has been lost to reduce the liquid water level below the top of active fuel (T AF). The PORVs do not stick open; this is event NOTQ. Without electric power, there is no way to replace the water lost from the RCS.
The uncovering of the T AF (UT AF) marks the transition of the accident from the accident frequency analysis to the accident progression analysis. The onset of core degradation follows shortly after the UTAF.
B.2.3 Quantification of Cut Set Table B.l gives the specific cut set being considered in this example and shows the quantification of each event in the cut set for Observation 4. A discussion of how each quantification was derived follows.
IE-Tl is the initiating event: LOSP. The frequency of this initiating event was sampled from a distribution.
The quantification for Observation 4 is 0.0994. This value is above the mean value of 0.077. The distribution for LOSP was derived from Surry station historical experience, using the methods in Reference B.4. This analysis uses Bayesian models for both the frequency of LOSP and the time to recovery of offsite power. Utility data from 63 LOSP incidents was analyzed to develop a composite offsite power model that combined the effects of failures of the grid, events at the plant (e.g., switchyard problems), and severe weather. The model can be adjusted to reflect specific switchyard design.
OEP-DGN-FS-DG01 is the failure of DG 1 to start. The probability of this event was sampled from a distribution. The quantification for Observation 4 is 0.0133. This value is slightly below the mean value of 0.022. The distribution for this event was derived from the Surry plant records of DG operation for 1980 to 1988. In this period, there were 484 attempts to start the DGs and 19 failures. Eight of these failures were ignored since they occurred during maintenance. A lognormal distribution with an error factor of three was used to model the uncertainty in this event. The error factor was based on a very narrow chi squared uncertainty interval.
/DGN-FTO indicates that DG 2 has started and is supplying power to Unit 2. Thus, DG 3, the "swing" DG at Surry, may be aligned to supply power to Unit 1. The Surry station consists of two units. Emergency power is supplied by three DGs; DG 1 can supply power only to Unit 1, DG 2 can supply power only to Unit 2, and DG 3 can be aligned to supply power to either unit. If DG 2 starts and runs initially, DG 3 is not required for Unit 2. The probability of this event was sampled from a distribution. The quantification for Observation 4 is 0.966, which is almost equal to the mean value (0.97) of this distribution. The distribution was developed from Surry plant data on DG operation at Unit 2 in a manner similar to that for the previous event.
OEP-DGN-FS-DG03 is the failure of DG 3 to start. The quantification for Observation 4 is 0.0133, the same as for OEP-DGN-FS-DG01 above. The same distribution was used for both DG 1 and DG 3, and the sampling was fully correlated.
NRAC-1HR is the failure to restore offsite power within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. Initially, the probability of this event was sampled from a distribution obtained using the offsite power recovery methods of Reference B.4. As the uncertainty in this event proved to be only a small contributor to the uncertainty in the core damage frequency in the uncertainty analysis performed for the accident frequency analysis alone, it was not sampled in the integrated analysis. For the integrated analysis, NRAC-1HR was set to the mean value of the distribution, 0.44, for every observation in the sample.
REC-XHE-FO-DGEN is the failure to restore a DG to operation within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The probability of this event was sampled from the distribution for this operation that appears in the Accident Sequence Evaluation Program (ASEP) generic data base (Ref. B.2). The uncertainty in this event was not a significant contributor to the uncertainty in the core damage frequency. It was not sampled in the integrated analysis, and REC-XHE-FO-DGEN was set to the mean value of the distribution, 0.90, for every observation in the sample.
NUREG-1150 B-8 OAGI0000611 00372
Appendix B NOTQ indicates that the RCS PORV(s) successfully reclose during SBO. Event Q is the failure of the RCS PORV(s) to reclose in an SBO sequence, so NOTQ is success. The probability of this event was sampled from a distribution in the stand-alone version of the accident frequency analysis. Because the uncertainty in NOTQ was not a significant contributor to the uncertainty in the core damage frequency, NOTQ was set to 0.973, the complement of the mean value of the distribution for Event Q, for the integrated analysis.
The distribution for Event Q was taken from the ASEP generic data base (Ref. B.2).
QS-SBO is the failure of a PORV or SRV in the secondary system to reclose after opening one or more times. For an SBO, the PORVs on the secondary side, also known as the atmospheric dump valves, are not operable, so it is the SRVs that open. The probability of this event was sampled from a distribution.
The quantification for Observation 4 is 0.0675, which is considerably less than the mean value (0.27) of this distribution. The distribution for QS-SBO was determined from the ASEP generic data base (Ref.
B.2). This analysis considered the number of times an SRV may be expected to open, and the rate at which the SRVs at Surry are expected to fail to reclose (Ref. B.3).
AFW-XHE-FO-CST2 is the failure of the operator to open the manual valves to the auxiliary condensate storage tank, CST2. This action is necessary to provide a supply of water for the AFWS after the primary condensate storage tank is depleted. The probability of this event was sampled from a distribution derived using a standard method for estimating human reliability. AFW-XHE-FO-CST2 is the failure to successfully complete a step-by-step operation following well-designed emergency operating procedures with a moderate level of stress. The method used is presented in Reference B.2, and detailed results may be found in Reference B.3. The quantification for Observation 4 is 0.0762, which is slightly above the mean value (0.065) of this distribution.
B.2.4 Accident Sequence and PDS The cut set gives specific hardware faults and operator failures. In determining the general nature of the accident, however, many cut sets are essentially equivalent. These cut sets are grouped together in an accident sequence. For example, consider the cut set described above. In the description of the accident, it would have made little difference whether there was no ac power because DG 1 was out of service for maintenance (see Fig. B.2) or whether DG 1 failed to start as in the cut set in Table B.l. The fault is different, and the possibilities for recovery may be different, but the result is the same on a system level.
Thus, both cut sets occur in accident sequence TlS-QS-L, along with many other cut sets that also result in the same combination of system failures. In the example, the important development for defining the accident is that DG 1 has failed. Exactly how it failed must be known to determine the probability of failure but is rarely important in determining how the accident progresses after UT AF.
The accident frequency analysis results in many significant accident sequences, typically dozens and perhaps a hundred or so. As the accident progression analysis is a complex and lengthy process, accident sequences that will progress in a similar fashion are grouped together into plant damage states (PDSs).
That is, sequences with similar times to UTAF, similar plant conditions at UTAF, and that are expected to progress similarly after UTAF, are grouped together in a PDS. Figure B.1 shows the three sequences that are placed together in PDS TRRR-RSR. They are T1S-QS-L, T1S-L, and T1S-Q-L. (A fourth sequence, TlS-Q-QS-L, sequence 25, would have been placed in TRRR-RSR but was eliminated because of its low frequency.) T1S-QS-L is by far the most likely of these accident sequences and has been described above. Sequence T1S-L is similar to T1S-QS-L but has the AFWS failing at the very start of the accident because of failures in the steam-turbine-driven AFW train itself (such as fail to start, fail to run, etc.). In TlS-Q-L, which is much less probable than either TlS-QS-L or T1S-L, an RCS PORV sticks open, and there is no way to replace the water lost through this valve.
The process of assigning accident sequences to PDSs forms the interface between the accident frequency analysis and the accident progression analysis. The characteristics that define the PDSs are determined by the accident progression analysts based on the information needed in the APET. These characteristics are carefully reviewed with the staff that performs the accident progression analysis to ensure that all situations are included, that the definitions are clear, and that there are no ambiguous cases. Then, every cut set is examined to determine its appropriate PDS. This often requires an iteration through the event tree and fault tree analyses since assignment to the proper PDS may require information, for example, about the containment spray systems, that was not needed to determine the core damage frequency. Thus, it is possible that the cut sets that form a single accident sequence might be separated into two (or more) different PDSs, although this never occurs in the Surry analysis.
B-9 NUREG-1150 OAGI0000611 00373
Appendix B The seven letters that make up the Surry PDS indicator denote characteristics of the plant condition when the water level falls below the TAF and consideration of the accident passes from the accident frequency analysis to the accident progression analysis. For PDS TRRR-RSR, each character in the PDS designation is explained below. Recoverable means the system is not operating but can operate if ac power is recovered.
T -
RCS is intact at the onset of core damage; R - Emergency core cooling is recoverable; R - Containment heat removal is recoverable; R - ac power can be recovered from offsite sources; R - The contents of the refueling water storage tank (RWST) have not been injected into the containment but can be injected if ac power is recovered; S -
The steam-turbine-driven AFWS failed at, or shortly after, the start of the accident; the electric-motor-driven AFWS is recoverable; and R - Cooling for the reactor coolant pump (RCP) seals is recoverable.
A more complete description of the PDS nomenclature may be found in Reference B.l. The assignment of sequences to PDSs is discussed in Reference B.3. For internal initiators at Surry, 25 PDSs were above the cutoff frequency of l.OE-7 /reactor year for the accident progression analysis. They were placed in seven PDS groups based on the initiating events. The seven PDS groups for internal initiators at Surry, in order by decreasing mean core damage frequency, are:
- 1.
Slow SBO;
- 2.
Loss-of-coolant accidents (LOCAs);
- 3.
Fast SBO;
- 4.
Event V (interfacing-system LOCA);
- 5.
- 6.
ATWS (failure to scram the reactor); and
- 7.
Steam generator tube mptures.
The example being followed here goes to the third PDS group, Fast SBO, which consists of only a single PDS, TRRR-RSR.
B.3 Accident Progression Analysis The accident progression analysis considers the core degradation process and the response of the containment and other safety systems to the events that accompany core degradation. Of particular interest is whether the containment remains intact, since this determines the magnitude of the fission product release in many accidents. In the analyses conducted for NUREG-1150, the accident progression analysis is performed by use of a large event tree. While a simple event tree like that shown in Figure B.l can be easily illustrated and evaluated with a hand calculator, the event trees used for the accident progression analysis are too large to be depicted in a figure and have so many paths through them that they can only be evaluated by a computer program.
B.3.1 Introduction The APET for Surry consists of 71 questions. Many of these questions are not of particular interest for PDS TRRR-RSR; therefore, only about half the questions are listed in Table B.2 and shown in Figure B.4.
NUREG-1150 B-10 OAGI0000611 00374
Appendix B Table B.2 Selected questions in Surry APET.
Branch Taken or Source of Parameter Quantifi-Question Defined cation Meaning of Branch or Parameter
- 1.
Br.6 PDS Def.
RCS intact-water loss is through cycling PORVs
- 8.
Status of ac Power?
Br.2 PDS Def.
Will be available when offsite power recovered
- 10. Heat Removal from SGs?
Br.2 PDS Def.
Will be available when offsite power recovered
- 12. Cooling for RCP Seals?
Br.2 PDS Def.
Will be available when offsite power recovered
- 13. Initial Cont. Condition?
Br.3 Acc.Freq.
Containment intact
Br.1 Summary RCS is at system setpoint pressure (2500 psia)
- 16. PORVs Stick Open?
Br.2 Internal PORVs do not stick open
- 17. T-1 RCP Seal Failure?
Br.1 Acc.Freq.
RCP seals fail
- 19. T-I SGTR?
Br.2 Experts No steam generator tube rupture
- 20. T-I Hot Leg Failure?
Br.2 Experts No hot leg or surge line failure
- 21. AC Power Early?
Br.2 Distrb.
Offsite ac power is not recovered before VB
Br.3 Internal The RCS is at intermediate pressure (200 to 600 psia)
- 28. Cont. Pressure before VB?
Par.l Summary The containment is at 26 psia just before VB
- 29. Time of Accm. Discharge?
Br.2 Summary The accumulators discharge during core melt
- 30. Fr. Zr Oxidized In-Ves.?
Par.2 Experts 0.866 of the Zr is oxidized in-vessel
- 31. Amt. Zr Oxidized In-Ves.?
Br.l Summary A high fraction of Zr is oxidized in-vessel
- 32. Water in Cavity at VB?
Br.2 Summary The reactor cavity is dry at VB
- 33. Fr. Core Released at VB?
Par.3 Experts 0.544 of the core is released at VB
- 34. Amt. Core Released at VB?
Br.l Summary A high fraction of the core is released at VB
- 35. Alpha-Mode Failure?
Br.2 Experts There is no alpha-mode failure
- 36. Type of Vessel Breach?
Br.1 Experts High-pressure melt ejection occurs at VB
- 38. Size of Hole in Vessel?
Br.l Internal The hole in the vessel is large
- 39. Pressure Rise at VB?
Par.4 Experts The pressure rise at VB is 56. 8 psig
- 41. Ex-Vessel Steam Explosion?
Br.2 Internal There is no ex-vessel steam explosion at VB B-11 NUREG-1150 OAGI0000611 00375
Appendix B Table B.2 (Continued)
Branch Taken or Source of Parameter Quantifi-Question Defined cation Meaning of Branch or Parameter
- 42. Cont. Failure Pressure?
Par.7 Experts The containment failure pressure is 148.4 psig Par.8 The LHS number for failure mode is 0.808
- 43. Containment Failure?
Br.4 Calc.
The containment does not fail at VB
- 45. AC Power Late?
Br.l Distrb.
Offsite ac power is recovered during early CCI
- 46. Late Sprays?
Br.l Summary Containment sprays are recovered during early CCI
- 49. How much H2 Burns at VB?
Par.8 Internal 0.30 of the hydrogen burns at VB
- 50. Late Ignition?
Br.l Experts Ignition occurs during early CCI Par.9 Internal 95 percent of the hydrogen burns if ignition occurs Par.lO Internal The pressure rise scale factor is 1.12
- 51. Late Burn? Pressure Rise?
Br.l Calc.
Hydrogen combustion occurs during early CCI Par.11 Calc.
The load pressure is 100.2 psia
- 52. Containment Failure?
Br.4 Calc.
The containment does not fail during early CCI
- 53. Amount of Core in CCI?
Br.2 Internal A medium amount of the core is involved in CCI
- 54. Is Debris Bed Coolable?
Br.l Internal The debris bed is coolable if water is available
- 55. Does Prompt CCI Occur?
Br.l Summary Prompt CCI occurs
- 62. Very Late Ignition?
Br.2 Experts Ignition does not occur during or after late CCI
- 68. Basemat Meltthrough?
Br.l Internal The basemat eventually melts through
- 71. Final Cont. Condition?
Br.3 Summary The only containment failure is basemat meltthrough NUREG-1150 B-12 OAGI0000611 00376
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
ttl I
w z
c:::
- c1 trl
~
...... g:
Start Question 1:
Question 8:
Accident RCS Integrity Status of Progression atUTAF?
ACPower?
Analysis 1.0 I
Question 20:
Question 21:
Question 23:
T *I Hot Leg AC Power RCS Pressure Failure?
Early?
at VB?
I Question 10:
Heat Removal from SGs?
Question 28:
Containment Pressure b'e1oreVB?
P1 = 26 psfa Question 12:
Cooling for RCP Seals?
Question 29:
Time of Accumulator Discharge?
Question 13:
Initial Containment Condition?
- 9998 I noB-CF Question 30:
Fr. Core Oxidized ln*Ves.?
P2 =.866 Question 15:
Question 16:
Question 17:
RCS Pressure PORVs Stick T-1 RCP at UTAF?
1.0 -
E*SSPr...
I Question 31:
Arnt. Zr Oxidized In-Yes.?
Open?
Seal Failure?
1.0 -
EB*PSS3' L!!r..JL PORVnStO Question 32:
Water In Cavity at VB?
Question 33:
Fr. Core Released at VB?
P3 =.544 Figure B.4, Sheet 1 Simplified diagram of first part of Suny accident progression event tree. (The complete tree is too large to be depicted graphically. The complete tree is listed and discussed in Appendix A to Ref. B.l.)
Question 19:
T-1 SGTR?
11.0 noE*SGTR Question 34:
Amt. Core Released at VB?
1.0 HI-FCoR
~
"0
~
- a.
$t l;l;
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
00 td I
Question 50:
Question 51:
Question 52:
- Question 53:
Question 54:
Question 55:
Question 62:
Question 68:
Late Late Burn?
Containment Amount of Is Debris Does Prompt Very Late Basemat Ignition?
Pressure Rise?
Failure?
Core In CCI? Bed Coolable? CCI Occur?
Ignition?
Melt-through?
P9 =.95 P10 = 1.12 P11 = 100.2 pslg 1.0 -
noLCF Figure B.4, Sheet 2 Simplified diagram of second part of Suny accident progression event tree.
Question 71:
Final Containment Condition?
Appendix B A full listing of the questions in the Surry APET and detailed discussions of them may be found in Appendix A to Reference B.1. A discussion of how the event trees are defined and evaluated may be found in the methodology discussion in Reference B.5. Many of the branching ratios and parameter values used were determined by expert panels. More detail on this subject may be found in Part I and Part VIII of Reference B.6. EVNTRE, the computer code used to evaluate the APET, is documented in Reference B. 7.
Figure B.4 shows the 38 questions displayed and discussed for this example. Only the path chosen for this example is followed from beginning to end in this figure. That is, at each question, only the branch chosen for this example continues on to the next question. In the complete evaluation of the APET for Observation 4 for PDS group 3, many of the branches shown as ending in Figure B.4 do terminate because they have zero probability.
However, many other branches shown as ending in Figure B.4 have nonzero probability and do propagate to the end of the tree. They are undeveloped in Figure B.4 because of space limitations.
In Figure B.4, which is best read in conjunction with Table B.2, the probability of the branch taken is shown above.the line. It is the probability of that branch for the entire question and may have contributions from paths other than the one followed for this example. That is, all paths through the APET pass through every question. The probability of a particular branch in Figure B.4 reflects all paths, not just the one being followed in this example, and thus may be different from the probability for this path. Below the line in Figure B.4 is the branch mnemonic abbreviation. This is a succinct way of referring to each branch in the tree, and it is useful to have this information when relating this abbreviated Surry APET to the complete APET listed in Appendix A to Reference B.1.
The complete APET contains case structure, which is not shown in Figure B.4. By defining different cases for a question, different branch probabilities may be defined that depend on the branches taken at previous questions. For example, the branch taken at Question 15, RCS Pressure at UTAF, depends upon the RCS Integrity at UT AF, Question 1. This dependency is implemented by defining a number of cases.
Case 2 is the system setpoint pressure (2500 psia) case for Question 15. One of the applicability conditions for Case 2 is that there be no break in the RCS at UTAF, i.e., that Branch 6 was taken at Question 1. For Case 2, the probability for the first branch, system setpoint pressure, is 1. 0. Only the total branch probability for the path of interest can be shown in Figure B.4. There is no way to show branching probabilities as functions of the case structure for each question in a compact plot of the APET such as this.
As discussed above, for Observation 4, the accident frequency analysis determined that PDS TRRR-RSR had a frequency of 4.8E-7/reactor year. As PDS group 3 consists solely of TRRR-RSR, the frequency of group 3 is also 4.8E-7/reactor year for Observation 4. The APET is evaluated without regard to this frequency, and the result is a conditional probability for each path given the occurrence of PDS group 3.
There are too many paths through the APET for us to be able to keep and treat each path individually.
Therefore, paths that are similar as far as the release of fission products and risk are placed together in accident progression bins (APBs or just "bins") as explained in Section B.3.4. For the bin that results from the path followed in this example, denoted GFA-CAC-ABA-DA, the conditional probability is 0.017. The absolute frequency of this bin from PDS group 3 is the product of these two values, or 8.1E-9freactor year.
Table B.2 lists the 38 questions shown in Figure B.4. These are the most important questions for following TRRR-RSR through the APET. The question is often given in abbreviated form to avoid using two lines.
The "Branch Taken or Parameter Defined" column gives the branch taken at that question for the path being followed through the APET. If a parameter is defined in the question, the parameter number is given. The "Source of Quantification" column gives the source of the branch probability or the distribution for the parameter value for this question. PDS Def. means that the branch taken is determined by the definition of the PDS. Ace. Freq. means that the split between the branches at this question was determined in the accident frequency analysis. "Summary" indicates that the branch taken at this question is determined solely by the branches taken at previous questions. "Internal" means that the split between the branches, or the parameter value, was determined by the NUREG-1150 team of analysts, usually with assistance from other experts in various national laboratories. "Distrb." means that the probability of offsite power recovery was determined from distributions of power recovery as a B-15 NUREG-1150 OAGI0000611 00379
Appendix B function of time prepared for each reactor site. "Experts" indicates that the sampling is from a distribution determined by one of the expert panels that considered the most important issues for risk.
A discussion of each question follows in Section B.3.2. An expanded discussion of a few questions that were quantified by panels of experts follows in Section B.3.3. Finally, the binning of the results of the evaluation of the APET is discussed in Section B.3.4.
B.3.2 Discussion of APET Questions Question 1. RCS Integrity at UTAF?
This question defines the state of the RCS at the start of the accident progression analysis. UTAF indicates the uncovering of the T AF, which is the nominal starting point for this analysis. The first character in the PDS definition, "T", indicates that TRRR-RSR has no failures of the RCS pressure boundary. Branch 6 is chosen; the water loss is through the cycling PORVs.
Question 8. Status of ac Power?
Branch 2 is chosen as indicated by the fourth character in the PDS definition. This is the "available" state, and it indicates that ac power will be available throughout the plant if offsite power is recovered after UTAF. The accident frequency analysis concluded that recovery of power from the diesel generators was of negligible probability. Recovery of offsite power in time to prevent core damage was considered by the accident frequency analysis. Recovery of offsite power after the ostensible onset of core damage but before vessel failure is more likely than not for TRRR-RSR. Recovery of power would allow the high-pressure injection system (HPIS) and the containment sprays to operate as these are also in the available state at UTAF. (The questions concerning emergency core cooling system (ECCS) and spray states are not listed in the interest of brevity.)
Question 10. Heat Removal from SGs?
As determined by the sixth letter of the PDS indicator, Branch 2 is chosen. This branch indicates that the steam-turbine-driven AFWS is failed, but the electric-motor-driven AFWS is available to operate when power is restored.
Question 12. Cooling for RCP Seals?
The last character of the PDS definition indicates that the accident frequency analysis concluded that there would be no cooling water flow to the RCP seals unless ac power was recovered. Thus, Branch 2 is taken.
Question 13. Initial Containment Condition?
The Surry containment is maintained below atmospheric pressure, at about 10 psia, during operation. The accident frequency analysis concluded that the probability of a pre-existing leak is negligible and that the probability of an isolation failure at the start of the accident was 0.0002. The more likely branch, no containment failure (Branch 3), is followed in this example.
Question 15. RCS Pressure at UTAF?
This question summarizes the information in the previous questions to determine the RCS pressure at the onset of core damage. As there is no break in the pressure boundary and no heat removal by the AFWS, the only water loss mechanism is the cycling PORVs: the RCS must be at the setpoint pressure of the PORVs, about 2500 psia. This pressure range is indicated by Branch 1.
Question 16. PORVs Stick Open?
After the core degradation process has proceeded for some time, the PORVs will be passing hydrogen and superheated steam and will be operating at temperatures well in excess of those for which they were designed. Based on the rate at which PORVs fail to reclose at normal operating conditions, the number of cycles expected, and allowing for degraded performance at high temperatures, failure of the PORVs was NUREG-1150 B-16 OAGI0000611 00380
Appendix B estimated to be of indeterminate probability. As there was no information available on PORV perform-ance at temperatures considerably above the design temperature, a uniform probability distribution from 0.0 to 1.0 was used for this question. That is, the probability that the PORVs will stick open is equally likely to be anywhere between 0.0 and 1.0. In Observation 4, the value for PORV failure is 0.0528. This example follows the more likely branch, Branch 2, and the PORVs reclose.
Question 17. Temperature-Induced (T-1) RCP Seal Failure?
In normal operation, the seals around the shafts of the reactor coolant pumps (RCPs) are kept from overheating by a flow of relatively cool water. If this cooling flow is not available, the seal material may become too hot and fail. Failure of the RCP seals is important in both the accident frequency analysis and the accident progression analysis. In the accident frequency analysis, whether the seals fail, and when they fail, determines the time to UT AF and the RCS pressure at UT AF. In the accident progression analysis, if the seals have not failed before UT AF or whether the seals fail after UT AF may determine the RCS pressure when the vessel fails. The containment loads at VB are strongly dependent on the RCS pressure at that time.
As part of the accident frequency analysis, an expert panel was convened specifically to consider the failure of RCP seals. One of their conclusions was that the seals must be deprived of cooling for some time before failure is likely. In TRRR-RSR, UTAF occurs fast enough that the probability of RCP seal failure calculated in the accident frequency analysis was negligible. That is, by the time the seals have been without cooling long enough to have a significant chance of failure, the water level has dropped below the T AF and the consideration of the accident has passed to the accident progression analysis. In the accident sequence chosen for this example, then, seal failure only occurs in the accident progression analysis.
In the accident frequency analysis. the question of RCP seal failure is sampled zero-one; that is, in some observations a seal-failure branch has a probability of 1.0, and in other observations the no-seal-failure branch has a probability of 1.0. The accident progression analysis samples RCP seal failure the same way for consistency. For the entire sample, the probability of seal failure for this case where the RCS is at setpoint pressure (2500 psia) is 0.71. That is, of the 200 observations, 142 have seal failure and 58 have no seal failure. In Observation 4, the seals fail, so Branch 1 is taken. More discussion on the matter of RCP seal failure may be found in Section B.3.3 and in Reference B.S.
Question 19. Temperature-Induced (T-I) Steam Generator Tube Rupture (SGTR)?
After some period of core melt, the gases leaving the core region are expected to be quite hot. If these gases heat the steam generator (SG) tubes sufficiently, failure of the tubes may be possible. The expert panel that considered this issue concluded that T-1 SGTR was possible but very unlikely if the RCS was at PORV setpoint pressure, and not possible if the system was at less than setpoint pressure (Ref. B.6). The failure of the RCP seals has reduced the RCS pressure below the setpoint of the PORVs, so, for Observation 4, there is no possibility of T-I SGTR, and Branch 2 is taken.
Question 20. Temperature-Induced Hot Leg Failure?
The very hot gases leaving the core region during melt may also heat the hot leg or the surge line to temperatures where failure is possible. The experts considered this failure much more likely than T-I SGTR, but only if the RCS was at, or near, the PORV setpoint pressure (Ref. B.6). The failure of the RCP seals has reduced the RCS pressure considerably below the setpoint of the PORVs, so, for Observation 4, there is no possibility of T-1 hot leg or surge line failure. Branch 2 is taken.
Question 21. AC Power Early?
This question determines whether offsite power is recovered in time to restore coolant injection to the core before vessel failure. Distributions giving the probability of offsite power recovery as a function of time for the Surry plant are sampled to obtain the values used in this question (Ref. B.4). The times marking the beginning and the end of the time period considered were determined by considering the rate at which this accident progresses and the nature of the plant. For PDS TRRR-RSR, case 2 of this question is applicable; the time period is 0.5 to 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> after the start of the accident (LOSP). The average value for power recovery in this period for this case is 0.565. The value in Observation 4 is slightly above B-17 NUREG-1150 OAGI0000611 00381
Appendix B average at 0.614. If power is recovered during this period, it is likely that vessel breach will not occur.
Because an example that proceeds to vessel breach is desirable, the less likely branch is chosen at this question. Branch 2 indicates that offsite power is not available in the plant during this period but may still be recovered in the future.
Question 23. RCS Pressure at VB?
This question determines the pressure in the RCS, including the vessel, just before the vessel fails. For the cases with large breaks in the RC8 or with no breaks in the RC8, this pressure is well known. For cases with small (82) or very small (83) breaks, the pressure at VB depends upon the time between core slump and VB and the rate at which the pressure decays away following the steam spike at core slump. The RCP seal failure may be of large S3 orsmall 82 size although all are classed as 83 breaks in this analysis. Taking the range of break sizes and the likely delay between core slump and vessel breach into account, it was estimated that it was equally likely that the RC8 pressure at VB would be in the High range, the Intermediate range, or the Low range (Ref. B.6). This question is sampled zero-one. In Observation 4, the Intermediate range is selected. Therefore, all of the accident, except the 5.3 percent with the PORVs stuck open, goes to Branch 3.
Question 28. Containment Pressure before VB?
The total pressure in the containment just after vessel breach consists of the baseline pressure before breach plus the pressure rise associated with the events at VB. (The pressure rise at VB is considered in Questions 39 and 40.) The containment pressure before VB is a function of spray operation and the magnitude of the blowdown from the RCS. The path followed in this example has no sprays and no large break. The results of detailed mechanistic simulation codes indicate that the containment atmospheric pressure will be around 26 psia in this case. Parameter 1 is set to 26 in this question. As the RC8 pressure was above the accumulator setpoint when the core uncovered, and is below the setpoint (due to the RCP seal failure) at VB, the accumulators must have discharged during the core melt. Branch 2 is chosen.
Question 30. Fraction of Zr Oxidized In-Vessel?
The fraction of the Zr oxidized in the vessel before VB determines the rate of the core degradation process and temperatures of the gases leaving the core region. The amount of unoxidized Zr in the core debris leaving the vessel is also important in determining the nature of the core-concrete interaction (CCI). The expert panel provided distributions for this parameter for cases that depended upon the RCS pressure and the time of accumulator discharge (Ref. B. 6). The path followed here has setpoint pressure in the RC8 at the start of core melt and accumulator discharge during core melt. Observation 4 contains the value 0.866 for parameter 2 for this case. The median value for this distribution is 0.45; the value in Observation 4 is the 91st percentile value. As the fraction of Zr oxidized in the vessel is related to the temperature of the gas leaving the core by a known physical mechanism, the value for this parameter is as rank correlated with the probability of T-1 hot leg failure as possible.
Question 31. Amount of Zr Oxidized In-Vessel?
The expert panel that considered containment loads at vessel breach gave distributions for two discrete levels of in-vessel Zr oxidation. Therefore, the oxidation fractions obtained from a continuous distribution in the previous question must be sorted into two ranges or classes. This is accomplished by Question 31; the fraction 0.40 divides the fraction of Zr oxidized in-vessel into High and Low ranges. The value of parameter 2 selected from the experts' distribution in the previous question, 0.866, falls in the High range; Branch 1 is taken.
Question 32. Water in Reactor Cavity at VB?
At Surry, the cavity is not connected to the containment sumps at a low level. The only way to get an appreciable amount of water in the cavity before VB is for the sprays to operate. As there is no electric power to operate the spray pumps in this blackout accident, the cavity is dry at VB in the path followed in this example. This is indicated by Branch 2.
Question 33. Fraction of Core Released from Vessel at Breach?
The expert panel provided a distribution for the amount of the core ejected promptly when the vessel fails (Ref. B. 6). This is the fraction of the core that can be redistributed in the containment by the subsequent NUREG-1150 B-18 OAGI0000611 00382
Appendix B gas blowdown in a direct containment heating event. Observation 4 contains the value 0.544 for parameter 3. This is the 92nd percentile value. The median value is 0.27.
Question 34. Amount of Core Released from Vessel at Breach?
This question sorts the parameter values obtained from the experts' distribution in the previous question into three classes. The fraction 0.40 divides the High range from the Medium range for the fraction of core released at VB. The value of parameter 3 selected from the experts' distribution in the previous question falls in the High range; Branch 1 is chosen.
Question 35. Alpha-Mode Failure?
An alpha-mode failure is a steam explosion (fuel-coolant interaction) in the vessel that fails the vessel in such a way that a missile fails the containment pressure boundary as well. The distribution for this failure mode was constructed from the individual distributions contained in the Steam Explosion Review Group report (Ref. B.9) modified and updated as explained in Reference B.6. The alpha-mode failure probability in Observation 4 is 0.00011. This is considerably less than the mean value. It is so low that alpha-mode failures are truncated within the tree and do not appear in the results. The path selected for this example follows the more probable branch, Branch 2.
Question 36. Type of Vessel Breach?
This question determines the way in which the vessel fails. The possible failure modes are pressurized ejection, gravity pour, or gross bottom head failure. A panel of experts considered the relative likelihood of these possible failure modes (Ref. B.6). Their aggregate conclusion is sampled zero-one. The mode selected in Observation 4 is pressurized ejection (also denoted high-pressure melt ejection). For the whole sample, this failure mode is selected 60 percent of the time for the case where the vessel is at a high or intermediate pressure. Branch 1 indicates pressurized ejection upon vessel breach.
Question 38. Size of Hole in Vessel?
The experts who considered the loading of the containment at vessel breach gave pressure rise distributions that depend upon the size of the hole in the vessel. Hole size was also to have been determined by the experts, but no usable results were obtained. The hole size question was considered by a national laboratory expert in this field (Ref. B.6). He concluded that a small hole (nominal size= 0.1 m2) was much more likely than a large hole (nominal size= 2.0 m2). This question is sampled zero-one.
Only 10 percent of the time is the large hole branch, Branch 1, selected as it was in Observation 4.
Question 39. Pressure Rise at VB?
The magnitude of the pressure rise in containment that accompanies vessel breach was determined by a panel of experts (Ref. B.6). In defining their distributions, the experts took into account all the pressure rise mechanisms, including vessel blowdown, steam generation, hydrogen burns, ex-vessel steam explo-sions, and direct containment heating. The pressure rise at vessel breach is treated in two questions, 39 and 40, in the Surry APET because the experts considering this issue defined so many cases. The large hole cases are considered in Question 39. The applicable case for the path being followed in this example is case 11: large hole, high fraction of the core ejected at breach, RCS at intermediate pressure, and dry cavity. For Observation 4, the 34th percentile value, 56.8 psig, was selected for this case. Parameter 4 is set to this value. This issue is discussed further in Section B.3.3.
Question 41. Ex-Vessel Steam Explosion?
This question determines whether a significant steam explosion occurs when the hot core debris falls into water in the reactor cavity upon vessel breach. In the path for this example, the cavity is dry, so there is no steam explosion, which is indicated by Branch 2.
Question 42. Containment Failure Pressure?
Two sampled variables are determined in this question. The first is the failure pressure of the containment. It is sampled from a distribution provided by structural experts who considered the Surry B-19 NUREG-1150 OAGI0000611 00383
Appendix B containment specifically. The other value is a random number between 0.0 and 1.0 that is used to determine the mode of failure if the containment fails. The value for the failure pressure in Observation 4 is 148.4 psig. This is the 93rd percentile value. The mean and the median failure pressures are around 126 psig. The random number selected for determining the mode of failure is 0.808 for Observation 4.
Thus, in this question, parameter 6 is assigned a value of 148.4 psig and parameter 7 is assigned a value of 0.808. This issue is discussed further in Section B.3.3 and in Reference B.6.
Question 43. Containment Failure and Type of Failure?
This question determines if the containment fails shortly after vessel breach, and, if it fails, the mode of failure. This calculation is done in a FORTRAN "user function," which is evaluated at this question in the APET. Failure is determined by comparing the load pressure with the failure pressure (Refs. B.S and B.6). In the user function, the failure pressure is converted to absolute pressure (163.1 psia) and the load pressure is calculated by summing the baseline containment pressure (parameter 1, see Question 28), 26 psia, and the pressure rise at VB (parameter 4, see Question 39), 56.8 psi. The load pressure, 82.8 psia, is less than the failure pressure so there is no containment failure at vessel breach in Observation 4. No containment failure is indicated by Branch 4.
Question 45. AC Power Late?
This question determines whether offsite power is recovered after vessel breach and during the initial period of CCI. The same basic distributions sampled in Question 21 are sampled again to obtain the probability of power recovery in this period. The average value for power recovery in this period for this case is 0.888. The value in Observation 4 is slightly above average at 0.927. This is the probability that power is recovered in this period if it was not recovered in the previous period, and it applies only to the fraction, 0.386, that did not have power recovered in the previous period. The most likely branch, Branch 1, is taken here; the path being followed in this example thus has power recovery at this point.
Question 46. Late Sprays?
As the sprays were available to operate at the start of the accident (Question 6, not discussed in the interest of brevity), they operate now that power has been restored throughout the plant. Branch 1 is selected for the path of interest.
Question 49. How Much Hydrogen Burns at Vessel Breach?
The restoration of power means that the sprays will begin to operate in the containment and that ignition sources will probably be present. The sprays will condense most of the steam in the containment and may convert the atmosphere from one that was inert because of the high steam concentration to one that is flammable. To determine the hydrogen concentration in the containment atmosphere during this period, the fraction of the available hydrogen burned at VB must be known. For the path of interest, pressurized ejection at VB with no sprays operating (the sprays were recovered after VB), there is a good chance that all or most of the the containment would have been effectively inert at VB because of the steam concentration. It was estimated internally that, on the average, 30 percent of the hydrogen produced in-vessel would burn at VB. Thus, parameter 8 is set equal to 0.30.
Question 50. Late Ignition?
This question determines the likelihood of ignition and sets the values of two parameters. The experts who considered ignition concluded that, if electric power were available, ignition was almost ensured in a matter of seconds or minutes, given that the atmosphere was flammable. In the path of interest, due to power recovery and the de-inerting of the containment, ignition is essentially ensured. Parameter 9 is the conversion ratio for hydrogen combustion, i.e., the fraction of the hydrogen that bums if there is ignition.
The Surry containment is fairly open, and steam condensation due to the spray action is expected to make it well mixed at this time. The conversion factor is estimated to be 0.95, and parameter 9 is set to this value. Parameter 10 is the scale factor applied to the adiabatic pressure rise. A distribution was obtained for this value internally. The value for Observation 4 is 1.12, the 91st percentile value, and parameter 10 is set to this value. (Values of the scale factor greater than 1.0 account for the possibility that local flame acceleration will result in pressures greater than those calculated for deflagrations using the adiabatic assumptions. Global detonations were not considered at Surry.)
NUREG-1150 B-20 OAGI0000611 00384
~~ - - - - -
Appendix B Question 51. Late Burn? Pressure Rise?
In this question, a FORTRAN "user function" is evaluated to determine if the containment atmosphere is flammable and, if it is, the total pressure that results from the ensuing deflagration. The amount of hydrogen in the containment is computed from the fraction of the Zr oxidized before vessel failure (parameter 2, see Question 30) and the fraction of the existing hydrogen that burned at vessel failure (parameter 8, see Question 49). This assumes that the ignition takes place before CCI or early in the CCI,
- ~.* before any appreciable amount of hydrogen has been generated by the CCI. The fraction of the hydrogen available that is consumed in the deflagration is given by the conversion ratio, parameter 9, read in the previous question. The baseline pressure is determined from the masses of the different gas species in the containment assuming a 50 percent steam mole concentration. The pressure rise calculated with the adiabatic assumptions is multiplied by the scale factor (parameter 10, Question 50) to obtain the final load pressure. For Observation 4 and the path of interest, 253 kg-moles of hydrogen burned resulting in an adiabatic pressure rise of 64.7 psia. The scaled pressure rise is 72.6 psia, and the total load pressure is 1 00. 2 psia. Parameter 11 is set to this value.
Question 52. Containment Failure and Type of Failure?
This question determines if the containment fails several hours after vessel breach. If CCI occurs, failure at this time would be during the initial portion of CCI. This is designated the "Late" period. If the containment fails, the mode of failure is determined. This calculation is done in a FORTRAN "user function" as in Question 43. Failure is determined by comparing the load pressure with the failure pressure (parameter 6, see Question 42). The failure pressure is 163.1 psia. The load pressure is 100.2 psia, so there is no late containment failure for Observation 4. This is indicated by Branch 4.
Question 53. Amount of Core in CCI?
This question determines the amount of core available for CCI, should it take place. The path being followed has pressurized ejection at VB and a large fraction of the core ejected from the vessel.
Pressurized ejection means that a substantial portion of the core material was widely distributed throughout the containment. For this case, it was estimated that between 30 and 70 percent of the core would be available to participate in CCI. This is the Medium range for CCI, indicated by Branch 2.
Question 54. Is Debris Bed Coolable?
This question determines if the core debris in the reactor cavity will be coolable, assuming that water is available. The path being followed has pressurized ejection at VB, so a substantial portion of the core material was widely distributed throughout the containment, and this portion of the core debris is likely to be coolable. It was internally estimated that, for this case, the probability of the debris in the cavity being in a coo1able configuration is 80 percent (Ref. B. 6). Note that for the debris to actually be cooled, in addition to the debris being in a coolable configuration, water must be present in the cavity at vessel breach and must be continuously replenished thereafter. This question only determines whether the debris configuration is coolable. The most likely branch, Branch 1, is followed for the example path, indicating that the debris bed configuration is potentially coolable. In the path being followed, the reactor cavity is dry at vessel breach, so whether the debris bed is coolable is a moot point.
Question 55. Does Prompt CCI Occur?
The reactor cavity is dry at vessel breach since the sprays did not operate before VB, so CCI begins promptly. While the sprays are recovered in the period following VB, they may not start to operate until some time after vessel breach. It was internally concluded that if the cavity was dry at VB, the debris would heat up and form a noncoolable configuration, and that, even if water was provided at some later time, the debris would remain noncoolable. Thus, prompt CCI occurs, and Branch 1 is chosen.
Question 62. Very Late Ignition?
Ignition leading to a significant hydrogen burn does not occur during the late portion of CCI, or after CCI, in the path being followed through the Surry APET for this example. Ignition occurred in the previous period and ac power has been available since that time. As an ignition source has been present since the late burn, any hydrogen that accumulates after the burn will burn off whenever a flammable concentration B-21 NUREG-1150 OAGI0000611 00385
Appendix B is reached. Burns at the lower flammable concentration limit will not threaten the Surry containment.
Therefore, Branch 2, no ignition, is taken at this question.
Question 68. Basemat Meltthrough?
The path of interest has a medium amount of the core involved in CCI and the sprays start after VB and operate continuously thereafter. As the basemat at Surry is 10 feet thick, eventual penetration of the basemat by the CCI was internally judged to be only 5 percent probable for this case (Ref. B.6). Branch 1 is followed at this question. Although this branch indicates basemat meltthrough and is less probable than the other branch, it is taken because the source term and risk analyses are not of much interest if there is no failure of the containment.
Question 71. Final Containment Condition?
This is the final question in the Surry APET; it summarizes the condition of the containment a day or more after the start of the accident. Only the most severe failure is considered, that is, if the containment failed at vessel breach, a later basemat meltthrough would be ignored. In the path followed through the APET, there were no aboveground failures, so Branch 3 is selected, indicating basemat meltthrough.
B.3.3 Quantification of APET Questions by Expert Judgment This section contains detailed quantification of three questions in the APET that were considered by the expert panels. The first is Question 17: probability of RCP seal failure. The second is Question 39:
pressure rise in the containment at VB. The last is Question 42: containment failure pressure.
Temperature-Induced RCP Seal Failure Question 17 determines whether there is a temperature-induced failure of the RCP seals. This failure mechanism is considered in the accident frequency analysis as well as in the accident progression analysis as it is important to both. The panel of experts that considered RCP seal failure was convened as part of the accident frequency analysis, and the results of that panel were used here as well. These experts concluded that the seal degradation depended primarily on the amount of time the seals had spent at elevated temperatures. For fast SBO accidents such as TRRR-RSR, the seal failure would not occur before UTAF. (It could, however, occur after UTAF.) Thus, for the accident sequence and PDS considered in this example, RCP seal failure is primarily of interest in the accident progression analysis.
The RCP seal is designed to allow a small amount of leakage (3 gpm) of primary coolant water during normal operation. The purpose of the leakage is to cool the shaft of the pump. This leak rate is well within the capacity of the normal makeup system. During an SBO with loss of the AFWS, there is no heat removal from the RCS and no cooling flow to the RCP seals. As the temperature and pressure of the reactor coolant system rise, the ability of the RCP seals to control leakage at acceptable levels determines whether the integrity of the RCS will be maintained. Significant leakage of RCS water through the seals will hasten the uncovering of the core and reduce the time available for restoration of ac power and core cooling.
The RCP seal is a complex multistage labyrinth seal that uses elastomer o-rings and free-floating seal plates. The integrity of the a-rings and the stability of the plates depend on the pressure in the RCS and the temperature of the water passing through the seal. Should the RCP seals fail, the size of the leak and the time of failure are functions of the combination of o-ring and seal plate failures in the seal assembly.
In the operating history of Westinghouse reactors, there has never been a seal failure caused by loss of seal cooling. However, there have been six incidents where seal cooling has been lost in U. S.
Westinghouse reactors. In each case, the loss of seal cooling lasted less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, which is the minimum time considered necessary to degrade the seal o-rings. While instability of the seal plates could occur at any time after the loss of seal cooling, this phenomenon has not been observed in any of the incidents to date. The o-ring material has been tested by both the Idaho National Engineering Laboratory (INEL)
(Refs. B.10 and B.11) and the French national electrical utility, EDF. These tests showed that the o-ring material can be degraded when subjected to off-normal temperatures and pressures.
NUREG-1150 B-22 OAGI0000611 00386
Appendix B Both Westinghouse (Ref. B.12) and Atomic Energy of Canada Ltd. (AECL) (the latter under contract to the NRC) have performed extensive analyses of the performance of the RCP seal assemblies under off-normal conditions. Neither these tests or analyses, nor the incidents to date, have provided sufficient data for a quantitative probability model of RCP seal leak rate as a function of time after loss of cooling on which all parties can agree. Furthermore, the analyses by Westinghouse and AECL are proprietary. For these reasons, the resolution of this issue was delegated to a separate panel of three experts who were familiar with the problem and who had access to this proprietary information.
The three experts on this panel were:
Michael Hitchler, Westinghouse, Jerry Jackson, U.S. Nuclear Regulatory Commission, and David Rhodes, Atomic Energy of Canada Limited.
Which expert provided each distribution is not identified. The experts are described below as A, B, and C, which is not necessarily the order given above. They were asked to determine the probability of failure of the Westinghouse RCP shaft seals and corresponding leak rates under SBO conditions. More detail on this issue may be found in Reference B. 8.
With the approval of the panel, the issue of RCP seal failures was decomposed into two questions:
- 1.
What is the likelihood of the various combinations of o-ring and seal plate failures in a single RCP, and what is the resulting leak rate for each combination of failures?
- 2.
What correlation, if any, exists between pumps for each combination of similar o-ring and seal plate failures?
The first question simplified the issue by focusing attention on the specific leak paths that might develop in a single pump. The second question expanded the scope of the panel's analysis to develop total leak rates for all of the RCPs. (Surry has three pumps.)
In resolving the first question, the experts agreed to develop a single event tree that would represent the set of all possible failure combinations and their corresponding leak rates for a single pump. A consensus was reached on the expected leak rate assigned to each set of failures. Each expert assigned his own probabilities to the various events of the event tree to arrive at his own estimate of single pump leak rate probabilities. To resolve the second question, each expert gave his judgments regarding the correlation of failures of event tree events between pumps. Then the experts' correlation elicitations were used to extend each expert's single pump model to obtain leak rates and their probabilities for all three pumps.
The single pump event tree is shown in Figure B.S. The probabilities on the tree are those for Expert A. It should be noted that some of the event probabilities on the tree are shown as functions of time. The experts concluded that degradation of o-ring elastomer material is dependent on the length of time that the o-rings are exposed to uncooled RCS water. The extension of Expert A's elicitation to a three-pump model is shown in Figures B.6 and B.7. Figure B.7 is the continuation of Figure B.6; it shows the various failure combinations for the first stage seal plates of the three pumps, based on Expert A's elicitation on the correlation of first stage seal failures. The five outcomes on Figure B. 6 are passed on to Figure B. 7, where the first stage o-ring and second stage component failures are shown. The result is 16 possible outcomes on Figure B. 7, each with a time-dependent probability. Similar trees were developed for Experts B and C, but each expert's tree was unique because of differences in their elicitations.
To illustrate the method used, the path to outcome 5 in Figure B.7 will be followed. Expert A concluded that this was the most likely outcome; the path starts on Figure B.6, where the upper branch taken at top event B1 indicates success; that is, the first stage seal ring of pump 1 does not fail. The first stage seal rings also do not fail for pumps 2 and 3, so transfer path 1 is reached on Figure B.6. Transfer path 1 is the top entry path on Figure B. 7, and Expert A concluded that this was the most likely transfer path (probability=
0.951). In the path to outcome 5 in Figure B.7, the first stage a-ring fails, so the lower branch is taken at B-23 NUREG-1150 OAGI0000611 00387
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
00 00 z c
~
0 I
til 0
to
~
~
RCP SEAL FIRST STAGE FIRST STAGE SECOND STAGE SECOND STAGE LEAK RATE LOCA MODEL SEAL RING Q-RING SEAL RING O~RING 1-12{\\)
21 gpm 172 gpm f2(t) 1-f1 (t) 2.00E-01 182 gpm 1-f3(t) 61 gpm 250 gpm f3(t) f1 (t) 2.00E-01 250 gpm 1-11 (t) 76 gpm 2.50E-02 f1(t) 250 gpm 2.00E-01 480 gpm Figure B.5 Event tree used by all three experts in determining the probabilities of different leak rates for a single reactor coolant pump. The branch fractions shown are for Expert A. (This figure is adapted from Section C.4 of Ref. B.8.)
PATH 1
2 3
4 5
6 7
8 9
i (l)
- 3
- 0.
x*
b:f
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
00
<D td tG VI z c:
- 0 trl 0
I......
VI 0
EXPERT A*
THREE PUMPS 81 TRANSFER PATHI STATE I SEQ. PROS.
82 B3
..--------t 1 818283 I 9.51E-01 L-------f2 B1B2B3 I 1.20E-02
~--------------------~3 B1 82~ I 1.20E-02 r-----------------.......... --~4 81 B283 I 1.20E-02
"------------f 5 81 8283 I 1.30E-02 Figure B.6 First part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps. The transfer paths indicate the entry point on the second part of this event tree. The top events concern failure of the first stage seal rings; Bl for pump 1, B2 for pump 2, and B3 for pump 3. In the State column, Bi indicates no failure of the seal rings, and Bi indicates failure of the seal rings, for pump i. (This figure is adapted from Section C.4 of Ref. B.8.)
~
(!)
- 5.
S<'
t1J
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
<D 0
z c
- 0 trl
? --
Ut 0
to tG 0'1 TRANSFER FIRST STAGE FIRST STAGE SECOND STAGE SECOND STAGE PATH LEAK RATE FROM PREVIOUS SEAL RING 0-RING SEAL RING 0-RING FIGURE STATE r 1-t2(U 1
63 gpm I
2 516 gpm f2(t) 1-f1 (t) 2.00E-01 3
546 gpm 1
3 PUMPS 1*f3ltl 4
183 gpm I
5 750 gpm f3(t) f1 (t) 2.00E-01 I
6 750 gpm 7
42 gpm I
11:.f2lt\\
l f2(t) 8 344 gpm 1-f1(t) 2.00E-01 9
364 gpm 2 PUMPS l1-f3(t) 10 122 gpm l
11 500 gpm 3.60E-02 f3(t) f1(t) 2,3,4 2.00E-01 12 500 gpm I
13 250 gpm 1 PUMP 2.00E-01 14 480 gpm 1.30E-02 15 750 gpm 5
3 PUMPS 12.00E-01 16 1440 gpm Figure B. 7 Second part of the event tree used by Expert A in determining the probabilities of different leak rates for all three reactor coolant pumps.
The transfer paths indicate the exit point from the first part of this event tree. (This figure is adapted from Section C.4 of Ref. B.S.)
i CD
~
- 0.
x*
tJ:j
Appendix B top event "First Stage 0-Ring." For the probability of this branch, Expert A developed a time-dependent model, denoted f1 (t) on Figure B. 7. Expert A was of the opinion that if the a-ring failed in the seal for one pump, they would fail on the other pumps as well, so the lower path at top event "First Stage 0-Ring" represents the failure of the a-rings in all three pumps. At the next top event, the second stage seal rings do not fail, so the upper branch is taken. Expert A assigned a probability of 0.80 to this branch. At the final top event, the second stage a-ring fails in all three pumps. Expert A represented the probability of this failure by another function of time, denoted f3(t). Outcome 5 on Figure B.7 is a 250-gpm leak in all three pumps, for 750 gpm total. The probability of this outcome is a function of time, rising from zero at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> after the loss of core cooling to 0. 76 at 2.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.
Experts A and C had fairly similar models for the single pump fault tree. Both treated failure of the first stage a-rings as a step function of time. Experts A and C concluded that failure would be virtually certain by 1.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and 2.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, respectively. Both reasoned that the first stage seal plates would be very reliable, but that integrity of the seals would be compromised by high probability failures of the first and second stage a-rings and second stage seal plates. Experts A and C judged that the likelihood of a second stage failure was somewhat dependent on the status of the first stage as first stage failure could compromise the ability of the second stage to succeed. Expert B's model was considerably more optimistic than those of Experts A and C. He also concluded that the probability of o-ring failure would be a function of time, but with a maximum value of 0.15 for the first stage and 0.50 for the second stage. His probability for seal plate failure was similar to those of Experts A and C, but he did not think that the second stage was dependent on the status of the first stage.
The most significant difference between Expert B and Experts A and C is the failure of. the a-rings as a function of time. Expert B thought that the a-rings would degrade slowly, and, by 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after loss of cooling to the RCS, the RCS would have been depressurized by the operators. He believed that the a-rings would not fail in the depressurized environment. Experts A and C were of the opinion that the degradation of the a-rings would be so rapid that the question of depressurization within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> was moot.
With respect to the correlation of o-ring and seal plate faults between pumps, Expert C's elicitation was the most simplistic. He concluded that similar components would behave similarly in different pumps.
Thus, his three-pump leak rate model was exactly the same as his single-pump model, except that the leak rates of the single-pump model are multiplied by three. Experts A and B had significantly more complex elicitations for correlation of faults between pumps. Both had similar models for the correlation of first stage seal plate failures.
They both judged that the first stage seal plates could fail independently of each other, but they agreed to a simplifying assumption that, should similar components in any two pumps fail, the third pump would experience the same failure. Thus, Expert B's model for first stage seal plate failures is the same as that of Expert A in Figure B.6. The probabilities for several of the five outcomes for the first stage seal plate failure tend to be somewhat lower for Expert B than for Expert A. However, both models show the first outcome (all three first stage seals succeed) to be the most dominant outcome by far.
For the second stage, Experts A and B both concluded that the second stage a-rings would all fail in the same manner. But Expert A concluded that the second stage seal plates would all fail in the same manner, while Expert B judged that the second stage seal plates would fail independently.
The final RCP seal LOCA leak rates were calculated by averaging the leak rate probabilities of the three experts for various time intervals. Each expert's leak rate probabilities were given equal weight with respect to the others. The results are shown in Table B.3. (The o-rings in the RCP seals can be made from two types of material. The new material is much more resistant to degradation at high temperatures. The experts considered both types of material. All the pressurized water reactors (PWRs) considered for NUREG-1150 had a-rings made of the old material when these analyses were performed. Table B.3 shows only the results for seals with a-rings composed of the old, less heat-resistant material.)
The entries in the table give the probability of having the total leak rate shown at the times listed. Values in parentheses denote the probabilities that apply if the RCS is not depressurized.
B-27 NUREG-1150 OAGI0000611 00391
Appendix B Table B.3 Aggregate results for RCP seal failure with existing o-ring material.
Leak Rate 1.5 2.5 3.5 4.5 5.5 (gpm)
(h)
(h)
(h)
(h)
{h) 63 0.31 0.29 0.27 0.27(0.26) 0.27(0.24) 183 to 224 0.15 0.04 0.05 0.05(0.06) 0.05(0.08) 372 0.008 0.005 0.005 0.004 0.003 516 to 546 0.0004 0.0003 0.0003 0.0003 0.0003 602 to 614 0.001 0.0 0.0 0.0 0.0 750 0.53 0.66 0.66 0.66 0.66 1440 0.004 0.004 0.004 0.004 0.004 The time dependence shown in Table B.3 could not be incorporated directly into the accident frequency analysis. Instead, eight RCP seal states were defined, and Table B.3 was used to derive probabilities for these states. Some of the less likely leak rates were combined with similar leak rates. The result for the Surry accident frequency analysis was:
Seal State
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
Probability 0.29 0.014 0.53 0.0043 0.016 0.13 0.0040 0.016 Total Leak Rate and the Time Seals Fail Design leakage (no failure) 183 gpm at 90 minutes 750 gpm at 90 minutes 1440 gpm at 90 minutes 183 gpm at 150 minutes 467 gpm at 150 minutes 561 gpm at 150 minutes 183 gpm at 210 minutes In the accident frequency analysis, each of these eight RCP seal states was considered separately as the different flow rates and different times of failure led to UT AF at different times. This level of detail could not be accommodated in the accident progression analysis. The APET considered only two RCP seal states: failed and not failed. Based on the results of the expert panel given above, the failed state has a probability of 71 percent. The failed state was designated as an S3 break (less than 2-in. diameter) even though the most likely flow rate, 750 gpm total, is in the lower end of the range of flows of the S2 breaks (0.5-in. to 2-in. diameter). This assignment, initiated in the accident frequency analysis, keeps the RCP seal failures separate from the stuck-open PORV cases, since the latter were all classified as S2 breaks and avoids having to split the RCP seal failures between the two break sizes.
As mentioned in the discussion of Question 17, the accident frequency analysis sampled this issue in the zero-one manner, i.e., there were eight states for the RCP seals: seven failure states and one design leakage (no failure) state. In each observation, one of these states was assigned a probability of 1.0 and the other seven were assigned a probability of 0. 0. The relative frequency of each state in the entire sample corresponded to the aggregate distribution of the experts, e.g., 29 percent of the observations had the design leakage state with a probability of unity. The accident progression analysis samples RCP seal failure the same way for consistency except that there are only two states. The sample for the accident progression analysis consists of 200 observations, so 142 observations had the failure state selected and 58 had the no-failure state selected.
Pressure Rise at Vessel Breach Questions 39 and 40 determine the pressure rise at VB in the Surry APET. Two questions are required because of the number of cases to be considered. Vessel failure usually causes the pressure to rise in the containment, sometimes dramatically. A number of mechanisms may contribute to this pressure rise:
vessel blowdown, steam generation by the expelled debris, hydrogen combustion, ex-vessel steam NUREG-1150 B-28 OAGI0000611 00392
Appendix B explosions, and direct containment heating (DCH). The expert panel convened to consider the containment loads at VB concluded that the contributions of each of these mechanisms were generally not separable. Thus, the distributions for pressure rise provided by the experts include the contributions from all the pressure rise mechanisms. RCS blowdown and DCH cause significant loads to the containment only if the RCS pressure is 10 to 20 atmospheres or more above that of the containment at vessel breach.
After some discussion with the panel, the following case structure for Surry was adopted:
RCS Pressure Cavity Sprays Case (psia)
Water Operating 1
2000 to 2500 Full Yes 1a 2000 to 2500 Half Yes 1b 2000 to 2500 Dry No 1c 2000 to 2500 Full No 3
500 to 1000 Full Yes 3a 500 to 1000 Half Yes 3b 500 to 1000 Dry No 4
15 to 200 Half Yes The panel defined eight subcases by considering the following variations (nominal values in parentheses):
Zr Oxidation-High (60 percent) and Low (25 percent),
Melt Fraction Ejected-High (75 percent) and Low (33 percent), and Initial Hole Size-Large (2m2) and Small (0.1 m2).
As there were eight cases, eight subcases for each meant that each expert provided 64 distributions for pressure rise at VB for Surry. Four members of the containment loadings expert panel considered the pressure rise at Surry. They were:
Kenneth Bergeron, Sandia National Laboratories, Theodore Ginsberg, Brookhaven National Laboratory, James Metcalf, Stone and Webster, and Alfred Torri, Pickard, Lowe, and Garrick.
Expert A approached the problem by using the available CONTAIN (Refs. B.13 and B.14), MAAP (Ref.
B.15), and Surtsey results (Refs. B.16 through B.19) to assess pressure rise distributions for three base cases. His base cases were chosen to represent the most severe pressure rises for the three different RCS pressure levels analyzed and were 1b, 3b, and 4. The low Zr oxidation, large hole, and large fraction ejected subcase was used for each* base case.
For the middle portions of his base case distributions, Expert A placed the most reliance on the CONTAIN results as reported in NUREG/CR-4896 (Ref. B.20) and some subsequent calculations (Refs.
B.21 through B.23). He obtained the extreme values from energy balance calculations. Using a PC spreadsheet program, he then adjusted these base cases for the effects of hole size, the amount of core ejected, and the fraction of Zr oxidized in-vessel to get values for the other 61 subcases.
Expert B also based his "best estimates" on CONTAIN calculations and on scaled experiments. The case for the 500 to 1,000 psia pressure range was taken as a base, and the cumulative distribution function (CDF) for that case was modified to obtain the CDFs for other cases. Expert B concluded that the presence of water in the cavity could either enhance or reduce the pressure, so the median for the wet cavity cases was kept the same as for the dry cavity cases, but the distribution was stretched at both ends.
On the low side, an overabundance of water might reduce pressure by two bars. On the high side, calculations indicate the possibility of increasing pressure by one bar. Expert B took his high extreme B-29 NUREG-1150 OAGI0000611 00393
Appendix B values from a one cell adiabatic equilibrium code he had written to analyze Zion and Surry. While calculating the low side of the distribution, he considered phenomena that might reduce pressure, such as larger drop diameter or faster trapping.
Dependence on the extent of Zr oxidation, the VB area (hole size), and the fraction of melt ejected was also considered by Expert B. CONTAIN calculations (Refs. B.20 through B.23) have indicated that there is little dependence on previous Zr oxidation, probably because of oxidation starvation in the cavity. The effect of greater hole area is to give higher pressure rises across the entire distribution because the gas would exit with higher velocity. The effect of fraction of core ejected was handled by scaling the base case ratio of final to initial pressure.
Expert C used HMC calculations (Ref. B.24), CONTAIN calculations (Refs. B.20 through B.23), and MAAP calculations (Ref. B.1S). He tabulated the cases described in the issue description and applied the code results that appeared to be the most applicable to each case. He was forced to modify the code results in many instances to account for differences between the initial conditions in the code calculations and the case under consideration. Expert C used the HMC calculations for the several cases in which there was water in the cavity and considered the highest pressures calculated by HMC to be the upper bounds of his distributions. The pressure rise without direct heating formed his lower bound.
Expert C relied on CONTAIN and MAAP results in cases in which the cavity was dry. CONTAIN calculations with unconditional hydrogen burn and default burn were averaged and used for the upper part of his distributions, while the MAAP results were used for the lower part of his distributions.
Although he believed the CONTAIN calculations to be consistently above the median, he considered the results quite credible. From CONTAIN sensitivity calculations, Expert C was able to estimate the effects of changes in initial conditions, and using these estimates he obtained distributions for the subcases for which no HMC, CONTAIN, or MAAP results were directly applicable.
Expert D used CONTAIN results (Refs. B.20 through B.23) as the basis for his analysis because CONTAIN is currently the only code that has a DCH model. For his base case, he took the high-pressure case with a large fraction of melt ejected (75 percent) and a small initial hole. No further definition of the base case was necessary because Expert D was of the opinion that the effects of co-dispersed water should not be included and that the fraction of the Zr oxidized in-vessel was not particularly important.
(CONTAIN runs in which the in-vessel oxidation was varied showed small differences in pressure rise.)
To obtain his distribution for this base case, he started from results of the 18-node Surry model with unconditional hydrogen burn as defined in References B.21 and B.22. Expert D adjusted these results to account for alternate particle sizes, an alternate trapping model, and the effect of the thin steel in the containment on peak pressure.
For the small hole cases, Expert D adjusted the CONTAIN pressures upward somewhat since there is the possibility that more than one penetration may fail at or about the same time. For the cases with the sprays operating, he reduced the pressures about 1.5 to 2.5 bars below the pressures in the equivalent cases without the sprays operating. Expert D concluded that changing the particle size assumed in CONTAIN could only decrease the pressure rise. If the particle size assumed in the CONTAIN calculations (1.0 mm) is increased, the pressure rise will decrease because the material in the center of the particle will not have reacted before the particle is quenched. If the particle size is decreased from that assumed in CONTAIN, there is a negligible effect since all the metal in the particle is already reacting. CONTAIN assumes that the core debris distributed throughout the containment during the blowdown phase of the DCH process is homogeneous. Expert D expects the entrained material to be richer in oxides than a homogeneous mixture, which would decrease the pressure rise somewhat. He also pointed out that, when DCH occurs, only a very small portion of the hydrogen pre-existing in the containment or produced during the high-pressure melt ejection (HPME) can be expected to remain unburned after the event is over.
Results for all 64 subcases may be found in Reference B.6. Statistical tests on the 64 subcases showed that many of them could be combined, that the differentiation made on the fraction of Zr oxidized in-vessel could be dropped, and that all the subcases for the low-pressure case (case 4) could be consolidated. The result of the statistical analysis was that there were 13 distinct cases for Surry.
However, the dividing point between high and low fraction ejected used by the expert panel on containment loads, 50 percent ejected, was very near the high end of the aggregate distribution given for NUREG-1150 B-30 OAGI0000611 00394
Appendix B fraction ejected by the in-vessel experts. As defined by the loads panel, the high-fraction-ejected subcase has the fraction ejected greater than 50 percent with a 75 percent nominal value and the low-fraction-ejected subcase has the fraction ejected less than 50 percent with a 33 percent nominal value. The aggregate distribution from the in-vessel panel for core fraction ejected has a maximum value of 60 percent, and the probability that the fraction ejected will exceed 50 percent is only about 11 percent.
Not wishing to place 89 percent of the samples in the low-fraction-ejected subcase of the loads panel, and as the "high-low" division was more coarse than necessary, the core-fraction-ejected distribution of the in-vessel panel was divided into three ranges: 0 to 20 percent, 20 to 40 percent, and 40 to 60 percent.
The pressure rise distributions from the loads panel were then adjusted to provide pressure rises for these three ranges.
For the 0 to 20 percent ejected range, the average of the low-fraction-ejected results and the case 4 results (RCS pressure < 200 psia) were used. As the low-fraction-ejected case had 33 percent (nominally) ejected, and case 4 had, in effect, no core ejected at high pressure, this appeared to be appropriate. For the 20 to 40 percent ejected range, the low-fraction-ejected results from the loads panel were be used directly since the nominal value used by the loads experts was 33 percent ejected. For the 40 to 60 percent ejected range, the loads low-fraction-ejected distributions and high-fraction-ejected distributions were averaged. The average of the nominal fractions ejected is 54 percent, which is reasonably close to the center of this range. This treatment of the distributions was discussed with, and approved by, a member of the containment loadings expert panel.
This expands the number of cases for Surry from 13 to 19. Plots of the aggregate distributions for these 19 cases are contained in Reference B.6.
For the example being followed through Observation 4, the path through the APET went to case 11 of Question 39. This case has intermediate pressure in the RCS at VB, dry cavity, large hole, and high ( 40 to 60 percent) core fraction ejected at breach. This is case 3b of the loads panel. The statistical analysis found no significant differences between the expert's results for cases 1, 1a, and 3b. As explained above, the 40 to 60 percent ejected distribution is the mean of the loads panel low-fraction-ejected aggregate distribution and high-fraction-ejected aggregate distribution. Figure B. 8 shows the distributions of the four experts and the aggregate for case 3b, large hole, for both core fractions ejected. Also included in Figure B.8 is a plot showing the two aggregates for case 1/1a/3b, large hole, and the aggregate for case 4, as received from the loads panel, and the three aggregate distributions derived therefrom for the three ranges of the in-vessel panel distribution for core fraction ejected. The distribution for 40 to 60 percent ejected was used in the sampling process to obtain the value of 56.8 psig, the 34th percentile value, used for Question 39, case 11, in Observation 4.
Containment Failure Pressure The value for the containment failure pressure is determined in Question 42. The Surry containment is a cylinder with a hemispherical dome roof. Both the cylinder and the dome are constructed of reinforced concrete. The foundation is a reinforced concrete slab. The containment is lined with welded 0.25-inch plate steel. The containment is maintained below ambient atmospheric pressure, at about 10 psia, during operation. The design pressure is 45 psig. The free volume is about 1,850,000 cm3
- A section through this containment is shown in Figure B. 9.
A panel of structural experts was convened to determine the loads that would cause containment failure at Surry and the other plants. As the probability of a global detonation in the Surry containment was considered to be quite small, only static loads were treated for Surry. Such loads would result from the pressure rise that accompanies VB or a deflagration. Typical pressure rise times would be on the order of a few seconds, which is longer than the containment response time.
Four members of the structural expert panel considered failure pressure and failure mode for the Surry containment. They were:
Joseph Rashid, ANA1ECH Research Corp.,
Richard Toland, United Engineers and Constructors, B-31 NUREG-1150 OAGI0000611 00395
0
)>
G>
0 0
0 0 (j)
I 0 0
(.,)
<D (j) z c:::
- z
- l ttl 0
I Vl 0
to
~
N
?:
- g
.0 f:
- 41)
.2::
15
~
Case 3b,lm Pr, Dry Cavity Lorge Hole Lorge Core Fraction Ejected Lorge Hole Small Core Fraction Ejected t.oo 1 J.t>t;gzs
- 1 t.oo I f
- asp*
I 0.75 0.50 0.25 o = EXP. A o = EXP. B A= EXP. c v = EXP. D
~
~
~
- 41)
"5 E a 0.75 0.50 0.25 o = EXP. A o = EXP. B A= EXP. c v = EXP. D o.oo ' * *
...- I I
f * = AGGR.
Lorge Hole o.oo,,.. e I
I y* = AGGR.
o.o 5.0 10.0 15.0 0.0 5.0 10.0 15.0 Pressure Rise (bars) 1.oo 1
- a~ I
.?:-
2i 0.75 0
.0 e Q._
0.50 G)
~
0 :;
0.25 E a Pressure Rise (bars) c = Ag. Lrg o = Ag. Sml 6 = Ag.LoPr v = 0-20%
11!1 = 20-40%
0.00,.....--
I I
'X = 40-60%
0.0 5.0 10.0 15.0 Pressure Rise (bars)
Figure B.8 Results of expert elicitation for pressure rise at vessel breach for Surry. [The pressure rise is shown for the case where the RCS is at intermediate pressure (200-600 psia), the cavity is dry, and the sprays are not operating when the vessel fails by the formation of a large hole. In the top two plots, the first four distributions are those given by the experts and the fifth plot is the aggregate distribution. The lower plot shows the aggregate distributions provided by the experts and the distributions actually used in the APET. The first curve is the large-core-fraction-ejected aggregate from the upper left plot, and the second curve is the small-fraction-ejected aggregate from the upper right plot. The third curve is the aggregate for low pressure (less than 200 psia) in the RCS at VB. The last three curves are the actual distributions used in the APET evaluation. The distribution for 20-40 percent ejected is coincident with the second curve (small fraction ejected).]
-6" "0
(I>
- s 0.. sr tD
Appendix B
~Containment Sprays 200-ton Crane Reclrc. Spray
.. a
- o 0
Manipulator Crane Generator
~
i o'
~
- o.
t Reactor
\\)*
t, *:
o".
~***
0~
Reactor 0
- t Cavity Figure B.9 Simplified schematic of Surry containment.
B-33 NUREG-1150 OAGI0000611 00397
Appendix B Adolph Walser, Sargent and Lundy, and J. Randall Weatherby, Sandia National Laboratories.
They did not differentiate on the basis of failure location since any failure location except shear at the basemat-cylinder junction would result in a direct path to the outside. The reinforcing and concrete details in this junction area were such that three of the four experts ruled out failure in this location. (The fourth expert did not specify failure location explicitly.)
The experts treating Surry did not perform any extensive new calculations. They reviewed the previous detailed calculations and the drawings of the containment, including reinforcing details, penetrations, and hatches and airlocks. Their experience allowed them to judge how comprehensive the previous analyses had been and, when there were conflicting results, which result was more likely to be correct.
Expert A based his conclusions on previous analyses of the Indian Point containment (Ref. B. 25), the Surry containment (Ref. B.26), and the drawings of the Surry containment structure. He considered four failure modes: hoop failure in the cylinder, hoop failure in the dome, shear failure at the cylinder-basemat junction, and penetration failure. Meridional failure in the dome will be similar to the hoop failure and was not considered explicitly.
On the basis of the detailed drawings and some brief calculations, Expert A concluded that the cylinder-basemat junction was a very strong region and ruled out failure at this location. He looked briefly at the equipment hatch, personnel airlock, pipe penetrations, and electrical penetrations and concluded that they were sufficiently similar to those at Zion that failures at these locations were of relatively low probability. At low and medium stress levels, with the liner taken into account, Expert A concluded that the dome is stronger than the cylinder. However, the way the rebar was placed at the top of the dome led Expert A to question whether the dome would be stronger than the cylinder at high stress levels.
For the cylinder, the hoop stress can adequately be calculated by hand. In this manner, Expert A concluded that general yield of the rebar would occur at 119 psig, which agrees with the Stone & Webster analysis (Ref. B.26). This is the lowest pressure for which Expert A would expect to find any chance of failure; at this pressure the cylinder wall has moved out 2 inches. Expert A then calculated that 2 percent hoop strain corresponded to 150 psig, including the effects of strain hardening of the rebar. At this level of strain, he concluded that liner tear is certain at discontinuities such as those around penetrations and stiffener plates. Further, concrete cracking at 2 percent general strain will have removed much of the liner support. At 2 percent strain, the cylinder wall has moved out 16 inches.
In summary, Expert A concluded that the containment would fail between 120 and 150 psig and that the probability density of failure was uniform in that range. His median value was 135 psig.
Expert B based his analysis on the Stone & Webster study of the Surry containment (Ref. B.26), studies of other plants such as Indian Point 2 and 3 (Ref. B.25), Seabrook (Ref. B.27), and the test of the 1/6-scale model at Sandia (Ref. B.28). Expert B's hoop membrane stress analysis showed that there would be general yielding of the shell and rebar at 120 psig, and that rebar that just met the minimum requirements would fail at 144 psig. If all the rebar were of average strength, the rebar would fail at 166 psi g.
Based on the reference analyses and this information, Expert B placed his median failure pressure at 120 psig and his upper bound at 165 psig. He placed his lower bound at 70 psig. This took into account the possibility of faulty rebar joints or liner tears due to stress concentrations around openings.
Expert C based his conclusions on an analysis of the mid-section of the cylindrical portion of the containment. His study of the drawings and the results of other analyses led him to conclude that this was the weakest portion of the containment. His conclusions about the leak failure mode and liner tear are largely based on the 1/6-scale model test at Sandia (Ref. B.28). Once a liner tear has developed, it is difficult to see how it could be kept from expanding with a continued increase in pressure.
Expert C concluded that failure was most likely in the 135 to 147 psig range, and he placed 70 percent of his probability there. He placed 10 percent of his probability below 135 psig to allow for his uncertainty about the actual rebar properties.
NUREG-1150 B-34 OAGI0000611 00398
. Appendix B Expert D's analysis led him to conclude that a leak was certain to develop by 130 psig. At this pressure the rebar has yielded considerably and reached a strain of about 1 percent. He would expect leaks to develop because of dislocation at discontinuities (Ref. B.29). There is no possibility of a leak developing at pressures below 75 psig. This value was obtained by hoop membrane stress analysis assuming that the liner is at its yield stress of 35,000 psi. If the liner and the hoop reinforcement are both at their respective yield stress, which is 55,000 psi for the reinforcement and 35,000 psi for the liner, the pressure would be 110 psig. Expert D took 110 psig to be his median value for leaks. He noted that the specified minimum yield strength is 55,000 psi for the reinforcement and 35,000 psi for the liner.
Expert D took the lower threshold for rupture to be 140 psig, which was determined by a local effects analysis of the discontinuity at the basemat-cylinder junction (Ref. B.30). He expected that a crack would open at this junction for a substantial portion of the circumference. Although the crack might be very small, it would be long enough to depressurize the containment in less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. He concluded that rupture was certain when the main reinforcement reaches its specified minimum ultimate strength. For the Surry containment, Expert D considered catastrophic rupture to be impossible.
Figure B. 10 shows the distributions of the four experts and the aggregate distribution for total cumulative failure probability. Experts A and C concluded that there is little or no chance of failure by 120 psig, while Expert D concluded that failure is almost certain by 120 psig. The aggregate distribution for the failure pressure of the Surry containment was formed by weighting equally the individual distributions of the four structural experts who considered this issue.
From the information provided by the experts, aggregate distributions were also obtained for the mode of containment failure. Because the containment did not fail in this example, the question of the mode of failure is not discussed here. The results of the experts' elicitations on the mode of failure may be found in Reference B.6, and the method used to determine the mode of failure in the APET is discussed in References B. 1 and B.S.
For use in Question 42, a value for the containment failure pressure is obtained from the aggregate distribution by a random sampling process. The value for the failure pressure in Observation 4 is 148.4 psig. This is the 93rd percentile value. The mean and the median failure pressures are around 127 psig.
B.3.4 Binning Results of APET There are so many paths through the APET that they cannot all be considered individually in the source term analysis. The results of evaluating the APET are therefore condensed into accident progression bins (APBs) or just bins. The computer code, EVNTRE, that evaluates the APET places the paths through the tree in the bins as it evaluates them. At Surry, each bin is defined by 11 characteristics of the path taken through the event tree. (For the summary discussions contained in Volume 1 of NUREG-1150, these detailed bin definitions were collapsed into a smaller set.) The bin definition provides sufficient information for the algorithm used in the source term calculation. The binning method provides the link between the accident progression analysis and the source term analysis, which calculates the fission product release.
The computer input file that contains the binning instructions is referred to as the "binner." It is listed and discussed in detail in Reference B.l. A discussion of the binning process may be found in the methodolqgy discussion in Reference B. 5.
In computer files, the bin is represented as an unbroken string of 11 letters. For presentation here, hyphens have been inserted every three characters to make the bin more readable. A given letter in a given position has a definite meaning. For example, the first characteristic primarily concerns the time of containment failure. If the first character in the bin designator is a "C", containment failure before VB is indicated.
B-35 NUREG-1150 OAGI0000611 00399
Appendix B
- t:
- 0 0.a 0
L 0..
Q)
.~
-+-0
- s E
- s u
0.9 O.B 0.7 0.6 0.5 0.4 0.3 0.2 0.1 ISSUE 2 - SURRY STATIC FAILURE PRESSURE CUMULATIVE FAILURE PROBABILITIES o.o...
....-M:&-.!i-!!-"'B-fii-t!-e4~-...,.----rl --~-~
o = EXP. A o = EXP. 8
~ = EXP. C v = EXP. D t = AGGR.
60.0 80.0 100.0 120.0 140.0 160.0 180.0 200.0 PRESSURE(psig)
Figure B.10 Results of expert elicitation for static failure pressure of Surry containment. {The first four curves are the distributions of the four experts, and the fifth curve is the aggregate distribution.)
NUREG-1150 B-36 OAGI0000611_00400
Appendix B For PDS group 3, Observation 4 produced 22 bins. These resulted from all the paths that remained above the cutoff probability (l.OE-7). For example, the alpha-mode probability was so low in Observation 4 that all the alpha-mode paths were truncated and there are no bins with alpha-mode failures of the containment. The most probable bin (0.55) in Observation 4 is HDC-CFC-DBD-FA, which has no VB and no containment failure. It results from offsite ac power recovery before the core degradation process had gone too far.
Bin GFA-CAC-ABA-DA results from the path followed through the tree in this example for Observation
- 4. It is the most likely (0.017) bin for Observation 4, which has both VB and containment failure.
Basemat meltthrough occurred a day or more after the start of the accident. Containment failure in this time period is indicated by the character "G" in the first position. The other ten characteristics are defined in a similar manner. For bin GFA-CAC-ABA-DA, each character in the bin designation has the following meaning:
G - Containment failure in the final period; F-Sprays only in the Late and Very Late periods; A - Prompt CCI, dry cavity; C - Intermediate pressure in the RCS at VB; A - High-pressure melt ejection (HPME) occurred at VB; C - No steam generator tube rupture; A - A large fraction of the core was available for CCI; B - A high fraction of the Zr was oxidized in-vessel; A-High amount of core in HPME; D - Basemat meltthrough; and A -One effective hole in the RCS after VB.
The binning follows directly from the path through the APET with one exception. At Question 53, the amount of core in CCI was determined to be medium (Branch 2). The binning above shows that the fraction of the core involved in the CCI is large. The reason for this is that the computer code that performs the source term analysis, SURSOR, subtracts the amount of the core involved in HPME from the total passed to it. To avoid subtracting this amount twice, whenever HPME occurs, the amount of the core involved in CCI is set to Large in the binner.
It is common to keep more information in the binner than that actually used in the source term code. The reason is so that the results of the accident progression analysis can be examined in more detail. By reducing the amount of information passed on to the source term analysis in a "rebinning" step, the amount of source term calculation time can be reduced. Thus, the APBs from an evaluation of the APET by EVNTRE are processed or rebinned by a small computer program, PSTEVNT (Ref. B.31) before the source term analysis.
SURSOR does not distinguish between the various after-VB containment failure times. So PSTEVNT combines the "Very Late" and "Final" containment failure times. The result is that the indicator for failure in the Final period is changed from a "G" in the 1st character to an "F". Bin characteristics 2 through 9 and characteristic 11 are unchanged by the processing with PSTEVNT. The other change is in the 10th character. SURSOR treats BMT in the same manner as it treats a leak in the final period, so Leak, "C", and BMT,"D", are combined and appear as "C". SURSOR also determines whether a bypass of the containment has occurred directly from character 1 ("A" or "B" for Event V) and from character 6 ("C" for no SGTR), so Bypass ("E") and NoCF ("F") are combined as "D" in the rebinner.
(At one time BMT was considered separately from final leaks in SURSOR; the releases of inert gases and organic iodine from BMT were lower than those from a late leak. It turned out to be very difficult to B-37 NUREG-1150 OAGI0000611 00401
Appendix B determine, with any certainty at all, just how much lower than the final leak releases the BMT releases should be. As the BMT releases were not expected to be substantial contributors to risk, in the interest of simplicity, the BMT releases were conservatively assumed to be equivalent to the final leak releases.)
Thus the "rebinned" bin equivalent to GFA-CAC-ABA-DA is FFA-CAC-ABA-CA. The meaning of each rebinned character is:
F - Containment failure in the Very Late or Final period; F - Sprays only in the Late and Very Late periods; A - Prompt CCI, dry cavity; C - Intermediate pressure in the RCS at VB; A - HPME occurred at VB; C - No steam generator tube rupture; A - A large fraction of the core was available for CCI~
B - A high fraction of the Zr was oxidized in-vessel; A - High amount of core in HPME; C - Leak or basemat meltthrough; and A - One effective hole in the RCS after VB.
As mentioned in the introduction to this section, for Observation 4 the conditional probability of bin FFA-CAC-ABA-CA is 0.017 (given that PDS group 3 has occurred) and the absolute frequency is 8.1E-9/reactor year. For Observation 4, PDS group 3 is not the only group to produce this bin when the APET is evaluated. Group 1, slow SBO, also produces this bin. For Observation 4, the frequency of PDS group 1 is 9.3E-6/reactor year, and the conditional probability of APB FFA-CAC-ABA-CA is 2.6E-3, so the absolute frequency is 2.4E-8/reactor year. In the source term calculation, there is no point in calculating a source term twice for FFA-CAC-ABA-CA for Observation 4. Therefore, the bins resulting from the seven PDS groups for internal initiators are combined to produce a master bin list for each observation. In producing the master bin list, FFA-CAC-ABA-CA from group 3 is combined with FFA-CAC-ABA-CA from group 1; the total frequency for FFA-CAC-ABA-CA is 3.2E-8/reactor year for Observation 4.
B.4 Source Te~m Analysis The source term is the information passed to the next analysis so that the offsite consequences can be calculated for each group of accident progression bins. The source term for a given bin consists of the release fractions for the nine radionuclide groups for the early release and for the late release, and additional information about the timing of the releases, the energy associated with the releases, and the height of the releases.
The source term analysis is performed by a relatively small computer code: SURSOR. The aim of this code is not to calculate the behavior of the fission products from their chemical and physical properties and the flow and temperature conditions in the reactor and the containment. Instead, the purpose is to represent the results of the more detailed codes that do consider these quantities. The release fractions are calculated in SURSOR using a limited number of factors. Many of these factors were considered by a panel of experts. Collectively, they provided distributions for these factors, and the value used in any particular observation is determined by a sampling process. The sampling process used is Latin hypercube sampling (LHS) (Ref. B.32); it is a stratified Monte Carlo method and is more efficient than straightforward Monte Carlo sampling.
NUREG-1150 B-38 OAGI0000611 00402
Appendix B The 60 radionuclides (also referred to as isotopes or fission products) considered in the consequence calculation are not dealt with individually in the source term calculation. Some different elements behave similarly enough both chemically and physically in the release path that they can be considered together.
The 60 isotopes are placed in nine radionuclide classes as shown in Table B.4. It is these nine classes that are treated individually in the source term analysis. A more complete discussion of the source term analysis, and of SURSOR in particular, may be found in Reference B.33. The methods on which SURSOR is based are presented in Reference B.S, and the source term issues considered by the expert panels are described more fully in Part IV of Reference B.6.
The example being followed has led to accident progression bin FFA-CAC-ABA-CA for Observation 4.
The total absolute frequency for this APB is 3.2E-8/reactor year, which comes from PDS group 1 and PDS group 3. The path followed to this point came through PDS group 3, Fast SBO.
Release Class
- 1. Inert Gases
- 2. Iodine
- 3. Cesium
- 4. Tellurium
- 5. Strontium
- 6. Ruthenium
- 7. Lanthanum
- 8. Cerium
- 9. Barium Table B.4 Isotopes in each radionuclide release class.
Isotopes Included Kr-85, Kr-85M, Kr-87, Kr-88, Xe-133, Xe-135 I-131, I-132, I-133, I-134, I-135 Rb-86, Cs-134, Cs-136, Cs-137 Sb-127, Sb-129, Te-127, Te-127M, Te-129, Te-129M, Te-131, Te-132 Sr-89, Sr-90, Sr-91, Sr-92 Co-58, Co-60, Mo-99, Tc-99M, Ru-103, Ru-105, Ru-106, Rh-105 Y-90, Y-91, Y-92, Y-93, Zr-95, Zr-97, Nb-95, La-140, La-141, La-142, Pr-143, Nd-147, Am-241, Cm-242, Cm-244 Ce-141, Ce-143, Ce-144, Np-239, Pu-238, Pu-239, Pu-240, Pu-241 Ba-139, Ba-140 B.4.1 Equation for Release Fraction for Iodine In this example of a complete calculation, only the computation of the release fraction for iodine will be presented in detail. The releases of the other fission products are calculated in an analogous fashion. The total release is calculated in two parts as if the containment failed before, at, or a few tens of minutes after vessel breach. The early release occurs before, at, or within a few tens of minutes of vessel breach. The late release occurs more than a few tens of minutes, typically several hours, after vessel breach. In general, the early release is due to fission products that escape from the fuel while the core is still in the RCS, i.e., before vessel breach (VB), and is often referred to as the RCS release. The late release is largely due to fission products that escape from the fuel during the CCI, i.e., after VB, and is referred to as the CCI release. For situations where the containment fails many hours after VB, the "early" release equation is still used, but the release is better termed the RCS release, and after both releases are calculated in SURSOR, *both releases are combined into the late release and the early release is set to zero. The "late" release includes not only fission products released from the core during CCI, but also material released from the fuel before VB that deposits in the RCS or the containment and then is revolatilized after VB.
The early or RCS iodine release is calculated from the following equation:
ST = [FCOR
- FVES
- FCONV I DFE] + DST.
And the late or CCI iodine release is calculated from:
STL = ((1-FCOR)
- FPART
- FCCI
- FCONC I DFL] + FLATE +LATE!.
In these equations, some terms that pertain only to steam generator tube ruptures (SGTRs) have been omitted since bin FFA-CAC-ABA-CA has no SGTR. The meaning of the terms is as follows:
ST = fraction of the core iodine in the RCS release to the environment; B-39 NUREG-1150 OAGI0000611 00403
Appendix B PCOR = fraction of the iodine in the core released to the vessel before VB; PVES = fraction of the iodine released to the vessel that is subsequently released to the containment; PCONV = fraction of the iodine in the containment from the RCS release that is released from the contain-ment in the absence of any mitigating effects; DPE = decontamination factor for RCS releases (sprays, etc.);
DST = fraction of core iodine released to the environment due to direct containment heating at vessel breach; STL = fraction of the core iodine in the late release to the environment; FP ART = fraction of the core that participates in the CCI; PCCI = fraction of the iodine from CCI released to the containment; FCONC = fraction of the iodine in the containment from the CCI release that is released from the contain-ment in the absence of any mitigating effects; DFL = decontamination factor for late releases (sprays, etc.);
FLATE = fraction of core iodine remaining in the RCS that is revolatilized and released late in the accident; and LATE I = fraction of core iodine remaining in the containment that is converted to volatile forms and released late in the accident.
Like ST and STL, DST, PLATE, and LATEI are expressed as fractions of the initial core inventory.
DST, PLATE, and LATE! are not independent of the other factors in the equations given above.
Complete expressions for these three terms and an expanded discussion of them may be found in Reference B.18.
Some of these factors are determined directly by sampling from distributions provided by the expert panels. Others are derived from such values, and still others were determined internally. In Section B.4.2, each factor in the equation above will be discussed briefly, and the source of the value used for each factor will be given. In Section B.4.3, three of the factors are discussed in more detail.
For Observation 4, the following values were used in the equation for the RCS iodine release for bin FFA-CAC-ABA-CA:
PCOR = 0.98 FCONV = LOE-6 DST = 0.0 PVES = 0.86 DFE = 34.0 resulting in ST = 2.5E-8.
ST is a very small fraction of the original core inventory of iodine because the containment failure takes place many hours after VB and there is a long time for natural and engineered removal process to operate.
For Observation 4, the following values were used in the equation for the late or CCI iodine release for bin FFA-CAC-ABA-CA:
1 - FCOR = 0.02 FCCI = 1.0 NUREG-1150 B-40 OAGI0000611 00404
Appendix B DFL = 82.2 LA TEl = 0.0044 FPART = 0.57 FCONC = 1.2E-4 PLATE = 7.2E-9 resulting in STL = 0.0044 Containment failure occurs a long time after most of the radionuclides have been released from the fuel during CCI, so there is a long period in which the aerosol removal processes operate. Thus, the CCI release of iodine in nonvolatile form is very small, and the total late iodine release is almost all due to the late formation of volatile iodine in the containment.
B.4.2 Discussion of Source Term Factors As most of the parameters in the source term equations were determined by sampling from distributions provided by a panel of experts, Part VI of Reference B.6 is not cited for each of the parameters. The parameters not determined by expert panels are discussed in References B.l, B.6, and B.33.
The values for many of the parameters defined above are obtained from distributions when SURSOR is evaluated, most of which were provided by experts. They determined distributions for the nine radionuclide release classes defined in Table B.4. Only the distributions for iodine (class 2) are discussed here, but distributions exist for the other eight classes as well (Ref. B.6). These distributions are not necessarily discrete. While the experts provided separate distributions for all nine classes for FCOR, for other factors, for example,* they stated that classes 5 through 9 should be considered together as an aerosol class. Note that the distributions for the nine radionuclide classes are assumed to be completely correlated. That is, a single LHS number is obtained for each factor in the source term equation, and it applies to the distributions for all nine radionuclide classes. For example, in Observation 4 the LHS number for FCOR is 0.828. That means the 82.8th percentile value is chosen from the iodine distribution, the cesium distribution, the tellurium distribution, etc., for FCOR.
FCOR is the fraction of the fission products released from the core to the vessel before vessel failure. The value used in each observation is obtained directly from the experts' aggregate distribution. There are separate distributions for each fission product group (inert gases, iodine, cesium, etc.) for high and low Zr oxidation in-vessel. Each distribution takes the form of a curve that relates the values of FCOR to a cumulative probability. A value of FCOR is obtained in the following manner: the LHS program (Ref.
B.32) selects a number between zero and 1.0 that is the cumulative probability. Using this value, the value of FCOR is obtained from the experts' aggregate cumulative probability distribution. The LHS number in Observation 4 for FCOR is 0.828, and the corresponding FCOR value for iodine is 0.98. For Observation 4, then, almost all the iodine is released from the core to the vessel before breach. FCOR is discussed in more detail in Section B.4. 3.
FVES is the fraction of the fission products released to the vessel that is subsequently released to the containment before or at vessel failure. As for FCOR, the value used in each observation is obtained directly from the experts' aggregate distribution, and there are separate distributions for each fission product group. The LHS number in Observation 4 for FVES is 0.931. The corresponding value in the experts' aggregate distribution for FVES for iodine is 0.86. So, in this example, most of the iodine in the vessel before breach is released from the vessel to the containment.
FCONV is the fraction of the fission products in the containment from the RCS release that is released from the containment in the absence of mitigating factors such as sprays. The expert panel provided distributions for FCONV for four cases, each of which applies to all species except the noble gases. These cases apply to containment failure at or before VB, or within a few hours of VB. (There is a fifth distribution that applies to Event V.) None of these distributions is used in the path followed for this example since containment failure happens a day or more after the start of the accident. Because of the long time period for the engineered and natural removal processes to reduce the concentration of the fission products in the containment atmosphere, the fraction of the fission products released before or at VB remaining airborne at the time of containment failure is very small. This fraction was estimated B-41 NUREG-1150 OAGI0000611 00405
Appendix B internally to be l.OE-6, and FCONV is set to that value for final period releases. (The particular value of l.OE-6 is not important; any very small value would be satisfactory.) This value is used whether the release is due to aboveground failure or basemat meltthrough. FCONV is discussed in more detail in Section B.4.3.
DFE is the decontamination factor for early releases. For APB FFA-CAC-ABA-CA, the containment sprays are the only mechanisms that contribute to DFE. The expert panel concluded that the distributions used for the spray decontamination factors (DFs) were less important to determining offsite risk and the uncertainty in risk than whether the sprays were operating and other factors, so the spray DF distributions were determined internally. There are two spray distributions that apply to the fission products released from the RCS before or at VB: the first applies when the containment fails before or at VB and the RCS is at high pressure at VB; and the second applies when the containment fails after VB or when the containment fails at VB but the RCS is at low pressure. Each distribution applies to all species except the noble gases. The LHS number for the spray distribution for Observation 4 was 0.928. Using the distribution for late containment failure, a spray DF value of 3.4 is obtained. For failures of the containment in the final period, the value from the distribution is multiplied by 10 to account for the very long period that the sprays have to wash particulate material out of the containment atmosphere. Thus, DFE is increased from 3.4 to 34.
DST is the fission product release (in fraction of the original core inventory) from the fine core debris particles that are rapidly spread throughout the containment in a direct containment heating (DCH) event at VB. The experts provided distributions for the fractions of the fission products that are released from the portion of the core involved in DCH for VB at high pressure (1,000 to 2,500 psia) and for VB at intermediate pressure (200 to 1,000 psia). There are separate distributions for each fission product group (inert gases, iodine, cesium, etc.). However, neither the high-pressure nor the low-pressure set of distributions was used in calculating the source term for FFA-CAC-ABA-CA because the containment failure occurs so long after VB. It was internally estimated that the amount of fission products from DCH remaining in the atmosphere many hours after VB would be negligible, so DST is set to zero for this APB.
FPART is the fraction of the core that participates in the CCI. Bin FFA-CAC-ABA-CA has a "large" fraction, nominally 40 percent, of the core participating in HPME. As 5 percent of the core is estimated to remain in the vessel indefinitely, the fraction participating in DCH is 0.95
- 0.40 = 0.38. The fraction of the core available to participate in CCI is thus 0.95 - 0.38 = 0.57.
FCCI is the fraction of the fission products present in the core material at the start of CCI that is released to the containment during CCI. The experts provided distributions for four cases that depended upon the fraction of the Zr oxidized in-vessel and the presence or absence of water over the core debris during CCI. There are separate distributions for each fission product group. For the path being followed in this example, bin FFA-CAC-ABA-CA indicates that a large fraction of the Zr was oxidized in-vessel before VB and that the cavity was dry at the start of CCI. However, for iodine, the case is immaterial since all the iodine remaining in the core debris is released during CCI for any case and for every point on the distribution. Thus, FCCI is 1.0.
FCONC is the fraction of the fission products released to the containment from the CCI that is released from the containment. The expert panel provided distributions for FCONC for five cases. There are separate distributions for each fission product group (inert gases, iodine, cesium, etc.). None of these cases applies directly to the situation for APB FFA-CAC-ABA-CA since this bin has containment failure in the final period (after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). Since containment failure occurs many hours after most of the fission products have been released from CCI, only a very small fraction of these fission products will still be in the containment atmosphere at the time of containment failure. This fraction was estimated internally to be on the order of l.OE-4. The exact value is determined by using the FCONC distribution for case 3, rupture before the onset of CCI. The ratio of the LHS value from the distribution to the median value times l.OE-4 is the value of FCONC used for final period containment failure. In Observation 4, the LHS number for determining FCONC is 0.777. The iodine value of FCONC for this point on the FCONC, case 3, for the CDF is 0.78, and for the median value of the distribution is 0.63. Thus, FCONC is set to 0.78/0.63
- 1.0E-4 = 1.2E-4. This value is used whether the release is due to aboveground failure or basemat meltthrough.
DFL is the decontamination factor for late releases. At Surry, DFL can be due to either the containment sprays or a pool of water over the core debris during CCI. Since the CCI began in a dry cavity, only the NUREG-1150 B-42 OAGI0000611 00406
Appendix B spray DF applies for bin FFA-CAC-ABA-CA. The procedure used to obtain the spray DF for the CCI release for final period CF is similar to that used to obtain the value for DFE (discussed above). There is only one distribution for the spray DF for the CCI release, and it applies to all species except the noble gases. The same LHS number (0.928) is used for all the spray distributions, giving a CCI spray DF value of 8.2. As for DFE, because the containment fails in the final period, the value from the distribution is multiplied by 10 to account for the very long time the sprays have to wash particulate material out of the containment atmosphere. Thus, DFL is 82.
FLATE accounts for the release of iodine from the RCS late in the accident. Like DST, it is a fraction of the original core inventory. Iodine that had been deposited in the RCS before VB may revert to a volatile form after the vessel fails and make its way to the environment. This term considers only revolatilization from the RCS; revolatilization from the containment is considered in the next term. The experts provided distributions for the fraction of the radionuclides remaining in the RCS that are revolatilized. The amount remaining in the RCS is a function of FCOR, FVES, and other terms and is calculated in SURSOR (Ref.
B.33). The experts concluded that whether there was effective natural circulation through the vessel was important in determining the amount of revolatilization. Thus, there are two cases: one large hole in the RCS and two large holes in the RCS.
The experts provided separate distributions only for iodine, cesium, and tellurium. (Revolatilization is not possible for the inert gases as they would deposit, and it is negligible for radionuclide classes 5 through 9.)
For accident progression bin FFA-CAC-ABA-CA, the last character indicates that there is only one effective hole in the RCS: the hole formed in the bottom head when the vessel failed. The other failure of the RCS pressure boundary is the RCP seals, and the path through them is considered too tortuous to allow effective natural circulation to develop. The LHS number for late revolati!ization of Observation 4 is 0.412, and the corresponding value for iodine from the experts' distribution for iodine is 0.033. This number is applied to the fraction of the iodine remaining in the RCS, which is small, and then the FCONC value for tellurium is applied to that value to determine how much of the iodine that is revolatilized from the RCS escapes from the containment. (The Te value for FCONC is considered to be generally appropriate for revolatilized material since it, like Te, is slowly released over a long time period.) The resulting value for revolatilized iodine that escapes from the containment is very low, 7. 2E-9.
LA TEl accounts for iodine in the containment that may assume a volatile form and may be released late in the accident. The volatile forms are typically organic iodides such as methyl iodide, but are not limited to organic forms. The primary source of this iodine is the water in the reactor cavity and the containment sumps (which are separate at Surry). This term is added to the late release only for radionuclide class 2, iodine. The experts provided only one distribution. The LHS number for late revolatilization in Observation 4 is 0.055, and the corresponding value for iodine from the experts' distribution is 0.0051.
This number is applied to the fraction of the iodine remaining in the containment. Based on the values of FCOR, FVES, FCCI, and other factors, the fraction of the original core iodine still in the containment and available to assume a volatile form was determined to be 85 percent for Observation 4. Applying the release fraction obtained from the experts' distribution to this gives a late revolatilization iodine release fraction of 0.0044. LATE! is discussed in more detail, and the expression used to calculate it is given in Section B.4.3.
While the total iodine release is small compared to a case where the containment fails at VB or is bypassed from the start (such as Event V), the iodine release is very large compared to the other radionuclide classes except inert gases (see Section B.4.4). This relatively large release fraction for iodine is entirely due to the LATEI term. Even though the release point for basemat meltthrough is underground, no allowance is made for attenuation or decontamination of the late iodine release represented by the LA TEl term. For the example considered, the very slow passage of the gases through wet soil with a low driving pressure would undoubtedly result in some reduction in the late iodine release. This reduction could be quite large.. Although giving no credit for removal in the wet soil is conservative, it is unimportant for the sample as a whole. Other observations and other modes of containment failure dominate risk. For the mode of containment failure in this example, basemat meltthrough, however, the release of late organic iodine is a major contributor to risk, and the risk from this release may be overestimated by the neglect of iodine removal in the wet soil. Even with this conservative estimate of the late iodine release, the total iodine release and the risk therefrom are very small compared to the releases and risks from accidents and pathways in which the containment fails at or before vessel breach, or where the containment is bypassed.
B-43 NUREG-1150 OAGI0000611 00407
Appendix B It could be argued that, since BMT is so much more likely than early CF, overstating the BMT release results in a significant overestimate of the population dose and latent cancer fatality estimates. However, bypass accidents (V or SGTR) are twice as likely at Surry as nonbypass accidents that lead to BMT. As the iodine releases from the bypass accidents are more than an order of magnitude higher than BMT iodine releases, this argument is not valid.
B.4.3 Quantification of Source Term Factors by Experts In this section, the quantification of three factors in the source term equation that were considered by the expert panel is presented in more detail. The eight issues considered by the source term expert panel are:
- 1.
FCOR and FVES
- 2.
Ice Condenser DF (not applicable to Suny)
- 3.
PLATE
- 4.
FCCI
- 5.
FCONV and FCONC
- 6.
LATEI (not used for PWRs)
- 7.
Reactor Building DF (not applicable to PWRs)
- 8.
DCH Releases (DST)
Three of these issues are not applicable to Surry. Of the eight factors in the iodine equation for Surry, only three are discussed here. More extensive documentation of all the issues may be found in Part IV of Reference B.6. The source term factors chosen for discussion here are FCOR, FCONV, and LA TEL The consideration for FVES is similar to that for FCOR, only there are more cases. The consideration for FCONC is similar to that for FCONV, except that the experts provided a distribution for each fission product group for FCONC and they did not for FCONV. Of the remaining factors, LATE! made the largest contribution to the iodine example considered above.
B.4.3.1 FCOR FCOR is the fraction of the fission products released from the core to the vessel before vessel failure. Four members of the source term expert panel provided distributions for FCOR:
Peter Bieniarz, Risk Management Associates, Robert Henry, Fauske and Associates, Inc.,
Thomas Kress, Oak Ridge National Laboratory, and Dana Powers, Sandia National Laboratories.
Two of these four experts concluded that there were no significant differences between PWRs and BWRs as far as FCOR was concerned, and each provided one distribution that applied to both types of reactors.
The other two experts provided separate PWR and BWR distributions and further subdivided this issue by providing different distributions for high Zr oxidation in-vessel and low Zr oxidation in-vessel.
Expert A based his analysis for FCOR upon the experimental work done on the release of fission products from fuel (Refs. B.34 and B.35). He concluded that the results for cesium could be well represented by an equation similar to the diffusion equation and that the constants in the solution could be determined from the data. He obtained release rates for the other fission products by considering their "relative volatilities." The results of applying this method of calculating release rates appeared to him to agree reasonably well with experiments. Expert A then wrote a simple computer program to vary the temperature rise with time over a range of reasonable scenarios and keep track of the amount of each fission product released. Expert A provided FCOR distributions for both high and low Zr oxidation in-vessel for both types of reactors.
NUREG-1150 B-44 OAGI0000611 00408
Appendix B Expert B based his conclusions for FCOR on a large number of MAAP (Ref. B.15) calculations for various accident scenarios. He also relied on Reference B.36 and the evidence from TMI-2 (Refs. B.37 and B.38). The MAAP results served as the basis for his conclusions, but he included uncertainty for phenomena not modeled in MAAP and phenomena that MAAP currently does not treat in sufficient detail. For example, Expert B thought that MAAP sometimes overestimated the releases of certain nuclide groups because the process of core collapse imposes physical limitations on other processes that MAAP does not consider adequately at this time. He also concluded that neither the reactor type nor the amount of Zr oxidation in core had a significant effect on FCOR, so he provided a single distribution for FCOR.
Expert C reasoned that even if the dependency of the fission product release rates on temperature were much better known, the release rates, and thus FCOR, could not be much better predicted because the variations of the temperatures in the core by time and location are so crudely known at this time, especially after the onset of relocation. The extent of metal oxidation is also a significant uncertainty.
Relocation not only changes the surface to volume ratio, but it alters the hydrogen-steam ratio, which in turn affects the diffusion and transport rates of the fission products. Thus, the current models, which largely depend upon Arrhenius-type equations, have definite limitations. For example, the STCP (Ref.
B.39) tends to overpredict FCOR because it poorly treats the formation of eutectics and the gradual relocation of the core. Expert C provided separate FCOR distributions for high and low Zr oxidation in-vessel for both types of reactors.
Expert D did not consider the amount of Zr oxidation in-vessel or the type of reactor to be important for FCOR; he provided one distribution for FCOR. Expert D was of the opinion that all the noble or inert gases (Xe and Kr) would escape from the fuel. For tellurium, he concluded that the data were so ambiguous and conflicting that he could not support any particular distribution. He thus specified that a uniform distribution between zero and one be used. For the other seven radionuclide groups, he provided nonuniform distributions. His conclusions were based on a set of experimental work that he has performed or was performed by others (Refs. B.40 and B.41). He made use of several small computer programs to manipulate the experimental results to obtain release fractions for different pressures and temperatures.
The aggregate distributions for the two PWR cases are shown in Figures B.11 and B.12, as are the distributions of each of the four experts who considered this issue. The estimated fraction released depends strongly on the volatility of the fission products, as might be expected. The differences between I and Cs are not great. The differences between the less volatile fission products Ba, Sr, Ru, La, and Ce are small. Note that the differences between the high-Zr-oxidation case and the low-Zr-oxidation case are small compared to the differences between the experts. Furthermore, the differences between the radionuclide classes are often less than the differences between the experts for a given class. This is indicative of the uncertainty in the source term area.
B.4.3.2 FCONV This issue concerns the fraction of radionuclides released to the containment atmosphere from the vessel before it fails or at failure that is subsequently released to the environment if the containment fails.
FCONV may *be defined by the equation:
FCONV = m Vout/m Vin where:
mVin = mass (kg) of a radionuclide (or radionuclide class) released from the vessel to the contain-ment atmosphere at or before vessel breach (VB); and m Vout = mass (kg) of a radionuclide (or radio nuclide group) released from the vessel to the containment atmosphere at or before VB that is subsequently released from containment.
That is, FCONV is the fraction of mVin that is released to the environment when the containment fails.
B-45 NUREG-1150 OAGI0000611 00409
0
)>
G>
0 0
0 0 (j) 0 0
0 z
c:::
51
'?
1-'
1-'
gj to 0'1 Xe 1.0 f 0.5 FCOR-Case PWR High Zr Oxidation Release Fraction (abscissa) by Cumulative Probability (ordinate)
Cs Te t.O a Bv
- 1.0 I li1!
lfil 1.0 I 5f'J 1i!!
4 0.5 o.s 0.5 Ba 1.0 ~
1 I I I I !!t 0.5 0.0 ' 8 6
1
,V +
0.0 ' sW"'?:!M(r
' 0.0,_-.;<<:
f
, 0.0 fl' 1
f 0.0 '
1 f
o.o 0.5 1.0 0.0 0.5 1.0 0.0 o.s 1.0 o.o
. o.s 1.0 0.0 0.5 1.0 Sr Ru La Ce 1.0 fl: I I
I f 3 !1 1.0f ~
1
- 1 1.0 f~
I J'P I 1.0 !Iii 0.5 0.5 0.5..
I 0.5 0.0 '
1
! 0.0 '
I I
p 0.0 '
I I
f 0.0 '
I f
0.0 0.5 1.0 0.0 0.1 0.2 0.3 0.00 0.05 0.10 0.15 0.0 0.5 1.0 o = EXP. A o = EXP. B ll. = EXP. C v = EXP. 0
- = AGGR.
Figure B.ll Results of expert elicitation for FCOR, fraction of the fission products released from core to vessel for the nine radionuclide groups. (This figure shows the results when a high fraction of the core Zr is oxidized in-vessel. In each plot, the first four curves are the distributions of the experts, and the fifth curve is the aggregate distribution.)
- g (1)
- 1 0.
~r ttl
l:d
.b.
-.]
z e
~
trl 0
0
)>
I G>
0 Ul 0
0 0
0 (j) 0 0
Xe 1.0 1 J!l I
0.5 FCOR - Case PWR Low Zr Oxidation Release Fraction (abscissa) by Cumulative Probability (ordinate)
Cs Te 1.0 I 1.0 I t!
ill 1.0 I S 56 o.s o.s 0.5 0.5 Ba 0.0 f F I
f 0.0 F~
~
f 0.0.... 9C f
f 0.0 ~
1 f 0.0 '
1 f
0.0 0.5 1.0 0.0 0.5 1.0 0.0 0.5 t.O 0.0 0.5 1.0 0.0 0.5 1.0 Sr Ru La Ce
- 1 s:f to f !: PT '
- I 1.0..
0.5 0.5 o.s..
I 0.5 0.0 '
I
' o.o '
I I
' 0.0 '
I I
' 0.0 '
I I
0.0 o.s 1.0 0.0 0.1 0.2 0.3 o.oo o.os 0.10 0.15 0.0 0.5 1.0 o = EXP. A o = EXP. B
!!. = EXP. C v = EXP. D
- = AGGR.
Figure B.12 Results of expert elicitation for FCOR, fraction of fission products released from core to vessel for the nine radionuclide groups. (This figure shows the results when a low fraction of the core Zr is oxidized in-vessel. In each plot, the first four curves are the distributions of the experts, and the fifth curve is the aggregate distribution.)
~
(I>
i-t;lj
Appendix B Three cases were defined for FCONV for the large, dry PWR containments:
- 1.
Early containment failure, leak
- 2.
Early containment failure, rupture
- 3.
Late containment failure, rupture Early containment failure means at or before vessel breach, and "late" means at least 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and nominally 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after VB. A "leak" is a failure of the containment that results in leakage significantly larger than design leakage but is small enough so that the containment does not depressurize in less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The nominal leak is a hole with an area of 0.1 ft2. A "rupture" is a containment failure sufficient to depressurize the containment in less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />; the nominal hole size is 7 ft2
- The releases from late leaks were deemed to be low enough that the value of FCONV for late leaks could be derived from these three cases without significantly affecting risk.
FCONV is defined to be the release fraction from containment excluding the effects of engineered safety features such as containment sprays. One expert, however, concluded that one of the principal removal mechanisms, aerosol agglomeration, depended upon the humidity of the atmosphere for case 1. While the humidity may depend on whether the sprays are operating, aerosol removal from the atmosphere by the sprays is considered separately.
Five members of the source term panel considered FCONV:
Andrzej Drozd, Stone and Webster, James Gieseke, Battelle Columbus Division, Thomas Kress, Oak Ridge National Laboratory, Y. H. (Ben) Liu, University of Minnesota, and David Williams, Sandia National Laboratories.
They all concluded that the inert gases would be completely released and that all the other radionuclides would behave as aerosols. Thus, their distributions for FCONV apply to fission product classes 2 through
- 9.
Expert A obtained his estimates of the event timing and, thus, residence times from References B.42 and B.43. Expert A concluded that the most important factor in determining FCONV was the residence time of the aerosols in the containment; the longer the time between the formation of the aerosols and the failure of the containment, the smaller the release. Because of the opposing effects of the dynamic shape factor on coagulation and settling, the uncertainty in the dynamic shape factor has little effect on the fraction released. Expert A did not distinguish between the volatile fission products and the refractory groups because he concluded that a significant fraction of the volatiles is released from the fuel prior to VB and deposit on the surfaces of the reactor coolant system. The refractory fission products are released from the fuel at a slower rate and a significant fraction is released after VB and has a direct pathway to the containment. Thus both the volatile and nonvolatile species have similar release rates during the times of interest. He also stated that the aerosol concentration in the containment dropped dramatically in 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and did not change much after that. The atmospheric humidity has little effect; high humidity makes particles more compact. The compact particles settle out faster but do not agglomerate as fast.
Expert Bused NAUA (Ref. B.44) calculations done in conjunction with STCP calculations (Refs. B.42, B.43, and B.45) as a basis for his results, obtaining values directly from NAUA computer output as well as from published reports. For practical considerations, only Xe, I, Cs, and Te were considered for FCONV, and these were deemed to be applicable to all the fission product groups. Other sources consulted by Expert B are the Brookhaven National Laboratory uncertainty study (Ref. B.46), an Electric Power Research Institute (EPRI) calculation for Peach Bottom (Ref. B.47), the recent CONTAIN calculations (Refs. B.20 through B.23), the MELCOR analysis of Peach Bottom (Ref. B.48), and other MELCOR calculations (Refs. B.49 and B.SO).
NUREG-1150 B-48 OAGI0000611 00412
Appendix B Expert B intended his distributions to include uncertainties from:
- 1.
Surface area (deposition area or compartment height),
- 2.
Natural circulation,
- 3.
Hygroscopic nature of aerosols (primarily I and Cs groups),
- 4.
Particle shape factors (not a big effect),
- 5.
H2 bum, and
- 6.
Residence time.
Expert C examined the available code calculations relevant to aerosol and fission product behavior in, and release from, the containment. In most cases, these calculations were performed with the STCP (Ref.
B.39) or CONTAIN (Ref. B.14) codes. He developed base distributions for FCONV from the code results and then modified them for the effects of factors not considered by the codes. The scale factors applied to the base distributions took into account factors such as aerosol agglomeration, aerosol source strength, timing, shape factors, and containment volume.
Finally, Expert C modified the resulting distributions if they were greatly different from his intuitive expectations.
Expert D considered calculations performed in the GREST exercise (Ref. B.51), by Sandia with MELCOR (Ref. B.48), and by the ANS (Ref. B.52). He concluded that the factors affecting the value of FCONV include:
- 1.
Aerosol characteristics (shape factors, distribution, density);
- 2.
Residence time (size and time of containment failure);
- 3.
Whether the containment was open or divided into many compartments;
- 4.
The effective height of the containment;
- 5.
Thermodynamic state of the atmosphere (superheated or condensing); and
- 6.
Hygroscopic nature of the aerosols.
Expert D noted that the ANS parametric study showed a decrease in aerosol concentration by a factor of 10 in 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and that both the ANS parametric study and KfK DEMONA experiments (Ref. B.53) showed that the existence of many compartments in the containment reduced the release by about a factor of 1.6. Expert D pointed out that the LACE experiments (Ref. B. 54) show that, if the hygroscopic effect is present, it can be dominant. A hydrogen burn, by decreasing the residence time and reducing the condensation in the atmosphere, can increase the release fraction FCONV by a factor of 2.
Expert E used an EPRI/FAI aerosol behavior algorithm (Ref. B.SS) to perform an independent uncertainty analysis for this issue. He directly varied the aerosol source rates and the aerosol form factors (gamma and chi). To study the impact of the timing and mode of containment failure, he varied the containment failure time and leak rates, assuming choked flowthrough holes from 0.1 ft2 to 7 ft2
- He also considered pre-existing leakage, steam condensation onto walls, and the impact of pool flashing in his calculations.
Expert E assumed that the aerosols were released directly from the reactor vessel and obtained his aerosol form factors from the QUASAR (Ref. B.46) and QUEST (Ref. B.56) studies. He concluded that the timing and mode of containment failure is the major source of uncertainty. Because it affects agglomera-tion, the level of turbulence in containment is also an important uncertainty.
The distributions of the five experts who considered this issue are shown in Figure B.13. Case 1 is divided into wet and dry subcases because one of the experts concluded that the release fraction depended on the B-49 NUREG-1150 OAGI0000611 00413
0
)>
G>
0 0
0 0 (j) 10 0
trl cr
~
t:C I g)
- 0 c
..0 e a:
~
- g
'"5 E a
£
- 0 0
..0 e 0..
Q) 0 "S E a Surry - Early Leak Dry Contafnment Atmosphere 1.oo I
?1/fiJ,.,
- u;a~
I 0.75 0.50 0.25 0.00 'Rl I
I I
I o.oo 0.25 0.50 0.75 1.00 FCONV Surry -Early Rupture 1.001
~
0.75 0.50 0.25 0.00 :IF"ilfiJ"'r;; lqj":
I I
o.oo 0.25 0.50 0.75 1.00 F'CONV
- =
=8
.Q e a..
CD 0 '3 E
- s u
.... =
1i 0
.Q e 0...
CD
- 0:::
0 '5 E a Surry - Early Leak Humid Containment Atmosphere 1.00 "1*--~~:::::::::==~=;;llfll!!......
0.75 o.so 0.25 o.oo 0.00 0.25 0.50 0.75 1.00 F'CONV Surry - late Rupture 1.00 0.75 0.50 o.~f o = EXP. A o = EXP. 8 ll = EXP. C v = EXP. 0 1!!1== EXP. E o.oo
- = AGGR.
o.oo 0.25 0.50 0.75 1.00 F'CONV Figure B.13 Results of expen elicitation for FCONV, fraction of fission products in containment from RCS release that is released to environment.
(In each plot, the first five curves are the distributions of the experts, and the sixth curve is the aggregate distribution.)
~
(1)
- s
- 0.
x*
ttl
Appendix B humidity for this case. The differences between the wet and dry atmosphere subcases are small compared with the differences betweep. the experts, so this distinction was dropped. The aggregate distributions are also shown on Figure B.13. The differences between the experts are large compared to the differences between cases 1 and 2. As explained in the discussion of FCONV in Section B.4.2, none of these four distributions was used for bin FFA-CAC-ABA-CA since the containment failure time was so late.
B.4.3.3 LATEI The question of interest for this issue is how much of the iodine in the containment late in the accident assumes a volatile form (typically organic) and is released to the environment. This volatile iodine is assumed to be unaffected by all removal mechanisms (pool scrubbing, sprays, deposition, etc.). The release fraction determined in this issue applies to almost an the iodine released from the fuel and retained in the containment. The bulk of this iodine is expected to be in aqueous solution, so the issue was specifically framed as release from water pools.
The late release of volatile iodine was deemed to be much more important for BWRs than for PWRs because the BWR design often results in most of the iodine released during core degradation being transported to and retained in the suppression pool. Therefore, the panel of experts was asked only about BWRs directly. They were asked to consider the release of volatile iodine from a BWR suppression pool following containment failure and from water in the pedestal region beneath the reactor pressure vessel (RPV) during CCI.
For the release of volatile iodine from the suppression pool after the containment has failed, two cases were defined: (1) the pool remains subcooled, and (2) the pool is at the saturation temperature. In case 1, considerable surface evaporation is expected but no bulk boiling. In case 2, substantial flashing of the pool would accompany containment failure.
For the release of volatile iodine from water that overlies the core debris in the RPV pedestal, there are also two cases: (1) the drywell is flooded at the time of VB and the entire CCI takes place beneath a pool at least a few feet deep; and (2) the RPV pedestal area contains some water at the time of VB but most of this water is boiled away during CCI.
The results of the expert elicitation on this issue are contained in detail in Part IV of Reference B.6. They are not summarized here because the source term calculation for Surry did not use the results of any of the BWR cases. The PWR situation is somewhat different since the bulk of the iodine is expected to be contained in solution in the sump water. The sump water does not play the same role in heat removal that the suppression pool does in the BWR, and the sump water at Surry is separate from the water in the reactor cavity. Thus, none of the BWR cases is directly applicable although the subcooled suppression pool case is the most applicable. Instead of using this BWR case, the distribution obtained specifically for PWRs in the first draft of NUREG-1150 (Ref. B.S7) was used. This is discussed further in Part VI of Reference B. 6.
The equation used to calculate the late release of iodine in volatile form is:
LATE!= XLATE.. l{FCOR
- FVES + (1-FCOR).. FPART
- FCCI} - ST-STL + FLATE]
where XLA TE is the fraction of the iodine in the containment late in the accident that assumes a volatile form and is released to the environment. The other terms have been defined above. The term in brackets
( ] is the fraction of the initial core inventory that is in the containment at late times. FCOR
- FVES is the RCS release to the containment, and ST is the RCS release from the containment. Similarly, (1-FCOR)
- FCCI is the CCI release to the containment, and STL is the CCI release from the containment. The FLATE iodine is not considered amenable to this release mechanism because its residence time in the containment is short.
Figure B.14 displays the four aggregate distributions obtained for late volatile iodine release fraction, XLATE, for the BWR cases described above and the distribution for XLATE used for Surry. The range of release fractions used for Surry is the same as for the most applicable BWR case-subcooled suppression pool. The details of the distribution used for Surry are not particularly important as the risk is B-51 NUREG-1150 OAGI0000611 00415
Appendix B LATE RELEASE OF IODINE IN VOLATILE FORM 0.7 1-
_J CD 0.6
<{
CD 0
~
(l.
0.5 w >
~ 0.4
...J
~
o = Sbc. PI
(.)
0.3 o =Sat. PI
~:. = Fld. Cv 0.2 v =Wet Cv fill= Surry 0.1 0.0 -8>>~-,.I{----t----r----,.-.....,--,.--,.---ro--.,--1 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 RELEASE FRACTION Figure B.14 Distributions for late release of iodine from containment in volatile form. (The first four curves are the aggregate distributions for BWRs: release from a subcooled pool, release from a saturated pool. release from a flooded cavity, and release from a wet cavity. The fifth curve is the distribution used for Surry.)
NUREG-1150 B-52 OAGI0000611_00416
Appendix B dominated by accident scenarios in which the path from the reactor vessel to the atmosphere is quite direct (Event V and SGTRs). As this volatile release of iodine occurs late in the accident. its contribution to early fatality risk is negligible. In the accidents that contribute the most to the latent cancer fatality risk, there is little iodine remaining in the containment at late times to be released by this mechanism.
B.4.4 Releases for All Fission Products
'- release that commences a day or more after the onset of core damage or 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> or more after VB would be expected to have very small releases, and such is observed to be the case here. The iodine release is dominated by volatile (mostly organic) species that form late in the accident. When the release is so late in the accident, there is only one release, and the distinction between an RCS or early release and a CCI or late release is not kept. The RCS release is put in the late release with the CCI release, and the early release is set to zero. Thus, the complete early and late release fractions for bin FFA-CAC-ABA-CA are:
Fission Early Late Total Products Release Release Release Xe,Kr 0.0 1.0 1.0 I
0.0 4.4E-3 4.4E-3 Cs,Rb 0.0 8.6E-8 8.6E-8 Te, Sc, Sb 0.0 2.3E-7 2.3E-7 Ba 0.0 2.8E-7 2.8E-7 Sr 0.0 1.2E-9 1.2E-9 Ru, etc.
0.0 3.0E-8 3.0E-8 La, etc.
0.0 3.1E-8 3.1E-8 Ce, Np, Pu 0.0 2.0E-7 2.0E-7 SURSOR also provides the times and energies associated with the early and late releases, the release elevation, and the time that a general emergency is declared. For bin FFA-CAC-ABA-CA, the times for the early release are irrelevant. The other parameters are:
TW = time warning is given = 6. 1 h T2 = start of late release = 36 h DT2 = duration of late release = 6 h E2 = energy release rate = 3600 W ELEV = height of release = 10 m If BMT releases had been calculated separately, the release height would have been zero. Since BMT and leak releases are treated together, a height more appropriate to a leak above ground is used.
B.S Partitioning of Source Terms The accident progression analysis and the source term analysis, each performed once for the 200 observations that constitute the sample, produced 18,591 source terms. This is far too many to be able to perform a consequence analysis for each, so a reduction step is performed before the consequence analysis. This step is called partitioning. Partitioning is performed for all the observations in the sample together.
B.S.l Introduction Partitioning is a grouping of the source terms based on the radiological potential of each source term to cause adverse effects on humans. The factors used in partitioning are those most important for the B-53 NUREG-1150 OAGI0000611 00417