ML12024A078

State-of-the-Art Reactor Consequence Analysis (Soarca); Exclusive Summary for the Full NUREG for Peach Bottom and Surry

ML12024A078
Person / Time
Site:	Peach Bottom, Surry
Issue date:	12/28/2011
From:	Office of Nuclear Regulatory Research
To:
References
FOIA/PA-2011-0083
Download: ML12024A078 (17)

Text

State-of-the-Art Reactor Consequence Analyses (SOARCA) tk - C ......

Executive Summary for the Full NUREG for Peach Bottom and Surry Backaround and Oblective The evaluation of accident phenomena and offsite consequences of severe reactor accidents has been the subject of considerable research by the U.S. Nuclear Regulatory Commission (NRC), the nuclear power industry, and the international nuclear energy research community.

As part of an NRC initiative to assess plant response to security-related events, updated analyses of severe accident progression and offsite consequences were completed utilizing the wealth of accumulated research and incorporating more detailed, integrated, and realistic modeling than past analyses. The results of those security-related studies confirmed and quantified what was suspected but not well-quantified -- namely, that some past studies of plant response and offsite consequences (for non-security events) could be extremely conservative, to the point that predictions were not useful for characterizing results or guiding public policy. In some cases, the overly conservative results were driven by the combination of conservative assumptions or boundary conditions. In other cases, simple bounding analysis was used in the belief that if the result was adequate to meet an overall risk goal, bounding estimates of consequences could be tolerated. The subsequent misuse and misinterpretation of such bounding estimates further suggests that communication of risk attributable to severe reactor accidents should be based on realistic estimates of the more likely outcomes.

The State-of-the-Art Reactor Consequence Analyses (SOARCA) project involves the reanalysis of severe accident consequences to develop a body of knowledge regarding the realistic outcomes of severe reactor accidents. In addition to incorporating the results of over 25 years of research, it is the objective of this study that this updated plant analysis include the significant plant improvements and updates (e.g., system improvements, training and emergency procedures and offsite emergency response), which have been made by plant owners and are not reflected in earlier NRC assessments. These improvements to plant safety also include those enhancements recently made in connection with security-related events. Thus, a key objective of this study was to evaluate the benefits of the recent mitigation improvements in preventing core damage events or in minimizing the offsite release should one occur. The NRC expects that the results of this evaluation would provide the foundation for communicating _

severe-accident-related aspects of nuclear safety to Federal, State, and local authorities; Camm~tnt oddlI:

• oecomncrnistherso licensees; and the general public. This evaluation of severe accident consequences also would r t ,rthesont^atig tuy update and replace the site-specific quantification of offsite consequences found in earlier NRC NuREGICR-2-w9. Cleay,theaaysis islimited to publications such as NUREG/CR-2239, "Technical Guidance for Siting Criteria Development," jut ft2ractors(atrset).and tixut umodsbd tsWntheadvuasnmfiet of ft. mf t-of-dated December 1982, and NUREG/CR-2723, "Estimates of the Financial Consequences of t vate mgntu fe .ia Reactor Accidents," dated September c1982. t o minx site the rmepoisnot a full rpi ofwSSanija shaly.

Nor anit be xpcted, givasti dx etewsiw nat of This report describes the analysis of two reactors, the Peach Bottom Atomic Power Station and thlfaMr cot fr the Surry Power Station, which served as pilot plants for the study. Peach Bottom is generally spcincaleutsce pdu-s fc EOK.

representative of a major class of U.S. operating reactors, General Electric boiling water reactor SAMs .o =easad ,egaiy piamiAL tiitlna haYMf-ul 60,dOU.S

ýsitim ili c besbhilly analy-zed.

-ý IAýLY

ý ýO TýIV ý ýOýMATOý

(BWR) designs that that have Mark I containments. Surry is generally representative of a second major class of U.S. operating reactors. Westinghouse pressurized water reactor (PWR) designs with large, dry containments. This analysis of Peach Bottom and Surry is being reviewed by the Advisory Committee on Reactor Safeguards and will be the subject of an external peer review.

Method The approach was to utilize the detailed, integrated, phenomenological modeling of accident progression (reactor and containment thermal-hydraulic and fission product response) that is embodied in the MELCOR code coupled with modeling of offsite consequences (MACCS code) in a consistent manner (e.g., accident timing) to estimate offsite consequences for important reactor accidents. The approach is described below.

Scenario Selection The process of selecting sequences for analyses in the SOARCA project was the subject of considerable deliberation, discussion, and review. The central focus of this reassessment is to introduce the use of a detailed, best-estimate, self-consistent quantification of sequences based on current scientific knowledge and plant capabilities. The essencecritical core of the analysis methodology is the application of the integrated severe accident progression modeling tool, the MELCOR code, together with the improved MACCS code and the incorporation of site-specific and updated sequence-specific emergency planning. Because the priority of this work was to bring more detailed, best- estimate, and consistent analytical modeling to bear in determining realistic outcomes of severe accident scenarios, it was apparent that the demonstration of the benefits of this state of the art modeling could most efficiently be demonstrated by applying these methods to a set of the more important severe accident sequences.

What sequences should then be analyzed to demonstrate the benefits of our improved understanding incorporated into detailed, best-estimate modeling and the many plant improvements that have been realized over the last 25 years? To efficiently achieve these objectives, it seemed logical that we should select sequences that result in substantial offsite releases but also reflect probabilistic considerations - focusing on the more credible yet low-frequency accident sequences. By this approach, we could avoid the needless quantification of many sequences that are extremely low in probability or pose only residual risk. Further, SOARCA is intended to provide perspective on the question, "What are the likely outcomes and what is our best estimate of the risk if a severe accident were initiated at a nuclear plant?" The updated SOARCA requantification of consequences might include consideration of those sequences important to risk as demonstrated by a full-scope level 3 PRA. In practice, that is not feasible since there are no generally available and current full scope level 3 PRAs, considering both internal and external events, to draw upon. Fortunately, the preponderance of level 1 PRA information, combined with our insights on severe accident behavior obviates the need for such information in selecting sequences. Ample PRA information is available on dominant core damage sequences, especially internal event sequences. This information, combined with our understanding of containment loadings and failure mechanisms together with fission product release transport and deposition, allow us to utilize core damage frequen -ZF) as a IN i ATo

surrogate screening criterion for risk. Thus, for SOARCA we elected to analyze sequences with a CDF greater than 10 per reactor-year. In addition, we included sequences that have an inherent potential for higher consequences (and risk), with a lower CDF - those with a frequency greater than 10-7 per reactor-year. Such sequences would be associated with events involving containment bypass or leading to an early failure of the containment. By the adoption of these criteria, we are reasonably assured that the more probable and important sequences will be captured.

The sequence selection criteria identify risk-significant sequences in both an absolute and relative sense. It can be shown (see Appendix D of NUREG-1860) that a core damage frequency (CDF) of 10-4 per reactor-year and a large early release frequency (LERF) of 10-5 per reactor-year are acceptable surrogates to the latent and early quantitative health objectives (QHO) contained in the Commission's Safety Goal Policy Statement [51 FR 28044]. The American Society of Mechanical Engineer's 'Standard for Probabilistic Risk Assessment for Nuclear Power Plants," ASME RA-Sb-2005, which was endorsed by the staff in RG 1.200, defines a significant sequence as one of the set of sequences that, when rank ordered by decreasing frequency, aggregate to 95% of the CDF or that individually contribute more than 1% of the CDF. Therefore, the SOARCA sequence selection criteria are consistent with previously issued regulatory guidance. More importantly, they help to place severe accidents into their proper risk context. A search for high-consequence severe accidents, without consideration of the likelihood of their occurrence, can be an exercise that loses the perspective that one is entering a realm of very low residual risk, a realm where the risk quantification is suspect (often conservative) and may be more misleading than revealing.

Another yardstick for assessing the impact of low-frequency events is to consider the increase in the consequences that would be necessary to offset the lower frequency. Conceptually, an event with a larger radiological release could have greater risk if the increase in the radiation release is larger than the decrease in frequency of the event. For example, all other considerations equal, a 108 per reactor year event must have a radiological release more than 10 times the magnitude of an event with a frequency of 107 per reactor year in order to pose greater risk. Since we are including events with substantial volatile releases on the order of I to 10 percent, it is, practically speaking, not feasible to achieve greater risk by increasing the magnitude of the release by more than a factor of 10. Comms~ [dad2]: Iunderstand vwbisbeing

ad,andthis isgenmiliy Due for iLmit can

faiaiitisith .Iimunodreaholdtit~fioreariy Other than the magnitude of the radiological release, a major impact on risk is derived from the effocts thecakuistod nsksk ckwary am non-laca timing of the offsite release. In this respect, we have examined candidate SOARCA sequences with regard to 9owano turn nutgwtidia so ds Umen 4"Ad s.befwtvlirietL with timing in mind, both the timing of core damage along with the timing of containment failure.

As part of this consideration, we addressed, for the Peach Bottom plant, an additional sequence, the short term station blackout (SBO), even though it did not satisfy our screening criterion. The short-term SBO frequency is roughly an order of magnitude lower than the long-term SBO (3x10"7 per reactor-year versus 3x1W0 per reactor year); however, the short-term SBO has a more prompt radiological release and a slightly larger release over the same interval of time. Our initial qualitative assessment of the short-term SBO led us to conclude that it would not have greater risk significance than the long-term SBO. Because while it was a more prompt release (8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> versus 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />), the release was delayed beyond the time needed for FICI U NL ENSI AL IN lIO

L I:111 U IV F~MATIQ-successful evacuation. In order to conclusively demonstrate the points regarding risk versus frequency for lower frequency events, we nonetheless included a detailed analysis of the short-term SBO. Table 5 shows the results of that analysis, and it can be seen that the absolute risk is indeed smaller for the short-term SBO than for the long-term SBO. Table 6 shows the same trends for the Surry sequences, where the lower frequency sequences may have greater conditional risk but smaller or equivalent absolute risk than other higher frequency sequences.

Finally, we routinely considered core damage initiators and phenomenological containment failure modes in SOARCA that have been considered in the past, except for those which have been excluded by extensive research (alpha mode failure, direct containment heating, and gross failure without prior leakage). Our detailed analysis includes modeling of behavior (including fission product transport and release) associated with long-term containment pressurization, Mark I liner failure, induced steam generator tube rupture, hydrogen combustion, and core concrete interactions.

We also have compared the SOARCA sequences against those identified as important to risk in NUREG-1 150 for the Surry and Peach Bottom plants. Adjusting for the improvements in our understanding of phenomena due to the research completed since the NUREG-1 150 study was completed (roughly 18 years ago), we have found that, with one exception, SOARCA addresses the more likely and important sequences identified in that landmark study. The one exception-a sequence identified in NUREG 1150 that has not been analyzed for the SOARCA project-involved an extreme earthquake that directly results in a large breach of the reactor coolant system (large loss-of-coolant accident [LOCA]), a large breach of the containment, and an immediate loss of safety systems. We conclude that this sequence is not appropriate for consideration as part of SOARCA for a number of reasons. Foremost, the state of quantification of such extreme and low-frequency seismic events is poor, considerable uncertainty exists in the quantification of the seismic loading condition itself, and a detailed soil-structure interactions analysis was not performed for the plant (and its equipment) response to the seismic loads.

The analysis of the plant's components to the seismic acceleration-commonly referred to as fragility analysis-is a key component, and the lack of detailed analysis in this area makes current consideration of this event incompatible with the thrust of SOARCA, which is the performance of detailed, realistic analyses. Further, recent experience at nuclear plants in Japan strongly suggests that nuclear plant designs possess inherently greater capability to withstand the effects of extremely large earthquakes. In addition, it would not be sufficient to perform a nuclear plant risk evaluation of this event (even if it were currently feasible) without also performing an assessment of the concomitant nonnuclear risk associated with such a large earthquake. This assessment would have to include an analysis of the general societal impacts of an extremely large earthquake-larger than that generally considered in residential or commercial construction codes (past or present)-such that a potentially significant impact would be had on the public health irrespective of the nuclear plant response. Such an analysis has not been performed for the areas surrounding the plants selected for SOARCA and would have to accompany an evaluation of nuclear plant risk to provide the perspective on the incremental risk posed by operation of the plant.

While we conclude that analysis of such an extreme earthquake that involves simultaneous failures of the reactor system, safety systems, and containment is not warranted as part of

SOARCA, we believe that such events because of their potential for risk should be assessed as part of a separate future study. This future study, which will be integrated into the NRC seismic research program, will include the development of detailed mechanistic models for site-specific plant response as well as assessment of the nonnuclear seismic impacts on the general public.

In summary, SOARCA addresses the more likely (though still remote) and important sequences that are understood to compose much of the severe accident risk from nuclear plants. We conclude that the general methods of SOARCA (i.e., detailed, consistent, phenomenologically based, sequence specific, accident progression analyses) are applicable to PRA and should be the focus of improvements in that regard.

Mitigation Measures In preparation for the detailed, realistic modeling of accident progression and offsite consequences, the staff had extensive cooperation from the licensees to develop high fidelity plant systems models, define operator actions including the most recently developed mitigative actions, and develop models for simulation of site-specific and scenario-specific emergency planning. Further, in addition to input for model development, licensees provided information from their own PRA on accident scenarios. Through table-top exercises (with senior reactor operators, PRA analysts, and other licensee staff) of the selected scenarios, licensees provided input on the timing and nature of the operator actions to mitigate the selected scenarios.

The licensee input for each scenario was used to develop timelines of operator actions and equipment lineup or setup times for the implementation of the available mitigation measures.

This includes mitigation measures beyond those treated in current PRA models. Mitigation measures treated in SOARCA include Emergency Operating Procedures (EOPs), Severe Accident Management Guidelines (SAMGs), and post-9/11 mitigation measures. Post-9/11 mitigation measures refer to additional equipment and strategies required by the NRC following the terrorist attacks of September 11, 2001, to further improve severe accident mitigation capability. NRC inspectors completed the verification of licensee implementation (i.e.,

equipment, procedures, and training) of post-9/11 mitigation measures in December, 2008.

Scenarios identified in SOARCA included both externally and internally initiated events. The externally initiated events frequently included events for which seismic, fire, and flooding initiators were grouped together. For the externally initiated events, the timeline of operator actions was developed assuming the initiator was a seismic event because the seismic initiator was judged to be the most severe initiator in terms of timing and with respect to how much equipment would be available to mitigate. Thus, there is some conservatism in attributing all of the event likelihood to a seismic initiator.

Accident Progression and Fission Product Release At the beginning of this project, an independent expert panel was assembled to review the proposed severe accident modeling approach of MELCOR to identify priority areas that would benefit from improvement prior to undertaking the SOARCA calculations. MELCOR is NRC's detailed mechanistic model that incorporates our best understanding of plant response and

- E

severe accident phenomenology. The SOARCA project team evaluated comments and recommendations made by the panel, and refinements or adjustments were made to the code and input files to improve the models.

MELCOR plant system models for Peach Bottom and Surry also were upgraded based on updated information from the licensees (e.g., system flow rates and actuation criteria). In addition, updated containment structural and leakage performance models were added to the MELCOR Peach Bottom and Surry models based on an extensive containment experimental research program conducted at Sandia National Laboratories that revealed concrete containments would experience an increase in leakage that would prevent catastrophic failure.

With respect to Peach Bottom, improved modeling of drywell head leakage was incorporated.

The use of MELCOR for SOARCA represents a significant and fundamental improvement over past consequence and risk studies.

The assessment of mitigation measures, including emergency operating procedures, severe accident management guidelines, and security-related mitigation measures, led us to the conclusion that all the identified scenarios could reasonably be mitigated. The assessment of the mitigation measures was undertaken with support from integrated accident progression analyses using the MELCOR code. MELCOR analyses were used to both confirm the timing available to take mitigation measures and to confirm that those measures, once taken, were adequate to prevent core damage or to significantly reduce radiological releases. In other instances, MELCOR analyses using only installed equipment revealed that PRA success criteria were overly conservative, indicating core damage where MELCOR analysis indicated no core damage.

To quantify the benefits of the mitigative measures and to provide a basis for comparison to past analyses of unmitigated severe accident scenarios, the SOARCA project analyzed these same groups of scenarios conservatively assuming ,the event proceeded as unmitigated and led ultimately to an offsite release.

Offsite Radiological Consequences An independent expert panel was assembled to review the proposed severe accident modeling approach of MACCS to identify areas that would benefit from improvement. The SOARCA project team evaluated the comments and recommendations made by the panel team and made refinements or adjustments to the code and input files to improve the models.

Improvements made to the code and input files include use of 64 radial directions for plume travel instead of 16 as well as use of short (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> long) plume segments.

MACCS models for Peach Bottom and Surry are based on 1 year of hourly weather data from the licensees' meteorology towers and were updated to include site-specific population distributions for 2005. Also, site-specific public evacuation models were developed for each scenario based on the licensees' updated Emergency Preparedness programs and state emergency response plans to reflect the actual evacuation time estimates and road networks at Peach Bottom and Surry.

IClSE FO ON

-F-These public evacuation models also are more detailed in that they use multiple evacuating cohorts. A cohort is any population subgroup, such as schoolchildren, general public, and special needs individuals, that respondsmoves differently from other population subgroups.

Each cohort moves at a different time and speed and may have different sheltering characteristics that allow more realistic representation of shielding factors applied to the population. Cohorts modeled within the EPZ included the general public, school children, special facilities such as hospitals, and a nonevacuating cohort. The nonevacuating cohort of 0.5 percent of the public was used to represent those individuals who may not follow the protective action recommendations. Research of large-scale evacuations has shown that only a small percentage of the public does refuse to evacuate (NUREG/CR-6864, 2005), and establishing this cohort helps to quantify this small population group.

A cohort outside the EPZ was used to represent a shadow evacuation. A shadow evacuation occurs when people evacuate from areas that are not under an evacuation order, and shadow evacuations are commonly observed in large-scale evacuations (NUREG/CR-6864, 2005). An estimate of about 20 percent of the public in the area from 16 to 32 km (10 to 20 miles) from the plant was assumed to evacuate as a shadow evacuation when an evacuation order is issued for residents of the EPZ. This 20-percent value was derived from a national telephone survey conducted to support NUREG/CR 6953, Volume II, "Review of NUREG-0654, Supplement 3,

'Criteria for Protective Action Recommendations for Severe Accidents'" (2008).

The initiating event for the SOARCA SBO scenarios was assumed to be a seismic event near the plant, and it was assumed that severe damage would be generally localized. Because the fault lines for the SOARCA pilot plants do not intersect the surface, roads were expected to be usable but long-span bridges could become unusable. The local electrical grid was assumed out of service, and offsite response organizations would perform route alerting (door-to-door notification) to notify the public of the need to take protective actions. This is a routine and effective method of informing the public to implement protective actions as identified in the NUREGICR 6864, "Identification and Analysis of Factors Affecting Emergency Evacuations" (2005) and was not considered to delay evacuation time.

The offsite consequence analysis is based on the fission product release to the environment for the first 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> of the accident. The truncation of the release at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is intended to reflect the eventual termination of the release as a result of continually escalating mitigation action using both onsite and offsite resources. Because the release for the Surry long-term SBO does not start until 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br />, consequence calculations for this sequence instead use a release truncation time of 72 to provide a basis for comparison to past analyses of unmitigated severe accident scenarios.

Metrics for the offsite radiological consequence estimates are provided for each important scenario expressed as the average individual likelihood of an early fatality and latent cancer fatality conditional to the occurrence of a severe reactor accident and expressed as a risk metric factoring in the frequency of the scenario. The modeling of latent cancer fatality risk has been an issue of considerable controversy because evidence regarding risk is inconclusive in the low-dose region. To provide additional information on the potential range of health consequences, ONLY SITI T

IVImi L INF0MTIO the SOARCA project has developed latent cancer risk estimates assuming the linear-no-threshold model (LNT) and a range of truncation doses below which the cancer risk is not quantified. The LNT model is a basic assumption in many regulatory applications. Dose truncation values were used to help provide insight into the latent cancer health effects relative to the dose received by different exposure groups. Inclusion of dose truncation values is not meant to imply any NRC endorsement of a truncation value. Rather, it allows various audiences to readily understand the calculated consequences in a context that resonates with their assumptions of the dose-response relationship. Dose truncation values used for SOARCA included 10 mrem/year representing a small dose, 360 mrem/year representing background radiation levels in the environment, and 5 rem/year with a 10 rem lifetime cap representing the Health Physics Society Position Statement in 'Radiation Risk in Perspective," August 2004.

IAUgý ý lN0 Rý Rý

Results and Conclusions Scenario Selection The result of our scenario selection process, using updated and benchmarked Standardized PlantProbabilistic Analysis Risk (SPAR) models and the best available plant-specific external events information, was the identification of two major groups of accident scenarios. The first group, common to both Peach Bottom and Surry, was events commonly referred to as SBO scenarios that include variations identified as short-term and long-term SBO. These scenarios involve a loss of all alternating current (ac) power, and the short-term SBO also involves the loss of turbine driven systems through loss of direct current control power or direct loss of the turbine system. The short-term SBO has a lower frequency because it involves more extensive system failures. These scenarios were typically initiated by some external events-fire, flood, or seismic initiators. The initiators were not always well differentiated in external events PRA. For the purpose of SOARCA analyses, it was assumed the SBO was initiated by a seismic event, which is conservative. Notwithstanding the SOARCA process, SBO scenarios are commonly identified as important contributors in PRA because of the common failure mode nature of the scenario and the fact that both containment safety systems as well as reactor safety systems are similarly affected.

The second scenario group, which was identified for Surry only, was the containment bypass scenario. For Surry, two bypass scenarios were identified and analyzed--one involved an interfacing systems LOCA (ISLOCA) due to an unisolated rupture of low pressure safety injection piping outside containment, and the other scenario involved a thermally induced steam generator tube rupture. The SPAR model frequency for the ISLOCA of 3x1 08/reactor-year falls below the SOARCA screening criteria for bypass events (1x10-7/reactor-year). However, SOARCA analyses included this scenario because it has been commonly identified as an important contributor in PRA. Also, the licensee's PRA for Surry included an ISLOCA frequency of 7xl 0/reactor year. The thermally induced steam generator tube rupture scenario occurs as a variant of an SBO scenario. This scenario also is generally understood to be an important potential contributor to risk in PRA. The scenarios are listed in Tables 1 and 2.

Table 1. Peach Bottom Scenarios Selected for Consequence Analysis Scenario Initiating Event Core damage Description of scenario frequency (per reactor-year)

Long-term Seismic, fire, Immediate loss of ac power and SBO flooding 3x1106 eventual loss of control of turbine-driven systems due to battery exhaustion Short-term Seismic, fire, 3xl0-7 Immediate loss of ac power and SBO flooding I turbine-driven systems IC CU SE ý ORM ON

P LLU LY - FO TIO Table 2. Surry Scenarios Selected for Consequence Analysis Scenario Initiating Event Core damage Description of scenario frequency (per reactor-year)

Long-term SBO Seismic, fire, Immediate loss of ac power and flooding' 2x10-5 eventual loss of control of turbine-driven systems due to battery exhaustion Short-term SBO Seismic, fire, 2x10- Immediate loss of ac power and flooding turbine-driven systems Thermally Seismic, fire, Immediate loss of ac power and induced steam flooding 5x10.7 turbine-driven systems, generator tube consequential tube rupture rupture Interfacing Random failure Two series Ccheck valves in systems LOCA of check valves high-pressure system fail to open catastrophically fail 3x108 internally causing low- pressure piping outside containment to rupture, followed by operator error Miti~gation Measures The assessment of mitigation measures, including emergency operating procedures, severe accident management guidelines, and security-related mitigation measures, led us to the conclusion that all the identified scenarios could reasonably be mitigated. The security-related measures to provide alternative ac power and portable diesel-driven pumps were especially helpful in counteracting SBO scenarios. For the ISLOCA scenario, installed equipment was adequate to prevent core damage owing to the time available for corrective action. For all events except one, the mitigation was sufficient to prevent core damage. For one event, the Surry short-term SBO, the mitigation was sufficient to enable flooding of the containment through the containment spray system to cover core debris. The assessment of the mitigation measures was undertaken with support from integrated accident progression analyses using the MELCOR code. MELCOR analyses were used to both confirm the timing available to take mitigation measures and to confirm that those measures, once taken, were adequate to prevent core damage or significantly reduce radiological releases. In other instances, MELCOR analyses using only installed equipment revealed that PRA success criteria were overly conservative, indicating core damage, where MELCOR analysis indicated no core damage.

Accident Progression and Fission Product Release To quantify the benefits of the mitigation measures and to provide a basis for comparison to past analyses of unmitigated severe accident scenarios, the SOARCA project analyzed these SE - NSIT L INF ION

same groups of scenarios assuming the event proceeded as unmitigated, leading ultimately to an offsite release. The overall result of the MELCOR accident progression analyses was the confirmation that accident progression in severe accidents proceeds much more slowly than earlier conservative and simplified treatments indicated. The reasons for this are principally twofold--(1) research and development of better phenomenological modeling has produced a much more protracted and delayed core degradation transient with substantial delays of reactor vessel failure and (2) all aspects of accident scenarios receive more consistent treatment, which includes more complete modeling of plant systems and also often yields delays in core damage and radiological release. Bounding approaches have often been used in past simplified treatments using qualitative logical models. In SOARCA, where specific self-consistent scenarios are analyzed in an integral fashion using MELCOR, it can be seen that accident conditions or attributes that contribute to a more severe response in one area may produce an ameliorating effect in another area.

In the most likely accidents considered in SOARCA (assuming no mitigation)-the long- term SBO--core damage was delayed for 10 to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> and reactor vessel failure was delayed for approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. Approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> (BWR) or 45 hours5.208333e-4 days <br />0.0125 hours <br />7.440476e-5 weeks <br />1.71225e-5 months <br /> (PWR) were available before the onset of offsite radiological release due to containment failure. In the 1982 siting study, for the dominant event (identified as the SST1 release), it was assumed that a major release occurs in IY hours. The SOARCA analyses clearly indicate that ample time is available for operators to take corrective action even if initial efforts are assumed unsuccessful. Further, these time delays also allow substantial time for input from plant technical support centers and emergency planning. Even in the case of the most rapid events (i.e., the unmitigated short-term SBO where core damage may begin in 1 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />), reactor vessel failure is delayed for roughly 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> allowing time for restoration of cooling and preventing vessel failure. In these cases, containment failure and radiological release is delayed for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (BWR) or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (PWR). For the bypass events, substantial delays occur or, in the case of the thermally induced steam generator tube rupture, the radiological release is shown by analyses to be substantially reduced. Tables 3 and 4 provide key accident progression timing results for SOARCA scenarios.

IAL ON -I

Table 3. Peach Bottom Accident Progression Timing Results Scenario Time to start of Time to lower Time to start of release to core damage head failure environment (hours)

(hours) (hours)

Long-term SBO 10 20 20 Short-term SBO 1 8 8 Table 4. Surry Accident Progression Timing Results Scenario Time to start of Time to lower Time to start of release to core damage head failure environment (hours)

(hours) (hours)

Long-term SBO 16 21 45 Short-term SBO 3 7 25 Thermally 3 7.5 3.5 induced steam generator tube rupture Interfacing 9 15 10 systems LOCA I The SOARCA study also demonstrated that the magnitude of the fission product release is likely to be much smaller than assumed in past studies, again as a result of extensive research and improved modeling and as a result of integrated and more complete plant simulation. Typical releases of important radionuclides such as iodine and cesium are predicted to be no more than 10 percent and are more generally in the range of 0.5 to 2 percent. By contrast, the 1982 siting study assumed an iodine release of 45 percent and a cesium release of 67 percent. Figures 1 and 2 provide the fission product release results for iodine and cesium.

IA SE Y- N N TI

--NAL 1 MAT Iodine Release to the Environment for Unmitigated Cases 0.7-0.6, o0.5 1982 Siting Study E

o 0.4 E 0.3 i

"C Surry station blackouts 0 0.2 U.

0.1 Su~rry ISLOCA P t;,

0, 0 12 24 36 48 lime (hr)

Figure 1. Iodine Releases to the Environment for SOARCA Unmitigated Scenarios Cesium Release to the Environment for Unmitigated Cases 0 12 24 36 48 Time (hr)

Figure 2. Cesium Releases to the Environment for SOARCA Unmitigated Scenarios IA ON - S I R t

LU " Sequences involving large early releases have influenced the results of past PRAs and consequence studies. For example, the 1982 Siting Study results were controlled by an internally initiated event with a large early release that was assigned a frequency of lxlO5/year.

However, in the SOARCA study, no sequences with a frequency above lx1 0l/year resulted in a large early release, even considering external events and neglecting post-9/11 mitigation measures. This is a result 6f research conducted over the last 2 decades that has shown that phenomena earlier believed to lead to a large early release are of extremely low probability or physically unfeasible. This research was focused on phenomena that have been previously assumed to be prime contributors to severe accident risk, including direct containment heating and alpha mode failure.

The PWR SBO with a thermally induced steam generator tube rupture has in the past been believed to result in a large, relatively early release potentially leading to higher offsite consequences. However, MELCOR analysis performed for SOARCA showed that the release was small owing to thermally induced failures of other reactor coolant system components after the tube rupture. Also, the release was somewhat delayed; for the short-term SBO where no injection occurred at the start of the accident, the tube rupture and release began about 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> into the event. Further, core damage, tube rupture, and radiological release could be delayed for many hours if auxiliary feedwater were available even for a relatively short time period.

Offsite Radiological Consequences The result of the accident progression and source-term analysis, combined with realistic simulation of emergency planning, is that offsite health consequences are dramatically smaller than reported in earlier studies. Because of the delayed nature of the releases and their diminished magnitude, no early acute health effects were predicted; close-in populations were evacuated and no early fatalities occurred. Latent health effects are also quite limited, even using the most conservative dose response treatment. Much of the latent cancer risk for the close-in population was in fact derived from the relatively small doses received by populations returning to their homes in accordance with emergency planning guidelines. For example, for the Peach Bottom long-term SBO, about 70 percent of the latent cancer risk to individuals within 50 miles is from returning home. Here, the prediction of latent cancer risk, though very small, is strongly influenced by the relationship between low-dose health effects modeling and criteria for allowing return of populations.

Estimates of conditional (i.e., assuming the accident has occurred) individual latent cancer risk range from roughly 10-3 to 104, using the linear-no-threshold (LNT) dose response model (other dose models result in lower or much lower conditional risk). If one also accounts for the probability of the severe accident itself, the risk to an individual for an important severe accident scenario is on the order of 10 9 to 10.10 per reactor year. These risk estimates are thousands of times smaller than the NRC safety goal for latent cancer fatality risk of 2x1 06 per reactor-year and a million times smaller than the U.S. average risk of a cancer fatality of 2x10 3 per year.

Tables 5 and 6 provide the risk estimates for individual SOARCA scenarios using the LNT dose response model. The risk estimates are based on an assumed truncation of the release at 48 Fl E - SITIV RNA ION

FFIAL ONLY IEI AI TC hours as a result of continually escalating mitigation actions, including containment and reactor building flooding.

Table 5. Peach Bottom Results for Scenarios Without Successful Mitigation and Assuming LNT Dose Response Model Conditional risk Absolute risk of of latent cancer latent cancer Core damage fatality for an fatality for an frequency individual individual located (per located within within 10 miles Scenario reactor-year) 10 miles (per reactor-year)

Long-term SBO 3x106 2x1 04 6x10-0° 7

Short-term SBO 3x10 2x10-4 7x1O-11 Table 6. Surry Results for Scenarios Without Successful Mitigation and Assuming LNT Dose Response Model Conditional risk Absolute risk of of latent cancer latent cancer Core damage fatality for an fatality for an frequency individual individual located (per located within within 10 miles Scenario reactor-year) 10 miles (per reactor-year) 5 Long-term SBO 2x10 5x10 5 7x10 1 0 Short-term SBO 2xl 0- 9x10 5 lx 10 -10 Thermally induced steam generator tube 5x10-7 3x10"4 1x0 10 ()

rupture Interfacing systems 3x108 7x1 0"4 2xl 01 1 LOCA To provide additional information on the potential range of health consequences, the SOARCA project has developed latent cancer risk estimates assuming the LNT and a range of truncation doses below which the cancer risk is not quantified. Dose truncation values used for SOARCA included 10 mrem/year representing a small dose, 360 mrem/year representing background radiation levels in the environment and 5 rem/year with a 10 rem lifetime cap representing the Health Physics Society Position Statement in "Radiation Risk in Perspective," August 2004.

L LY - ITIVM

Tables 7 and 8 show the results of sensitivity calculations for dose truncation values for background and the Health Physics Society Position. Using these truncation values makes the already small latent cancer fatality risk estimates even smaller, in some cases by orders of magnitude. Using the 10 mrem/year truncation value made a relatively small change in the latent cancer risk from the LNT model.

SOARCA analysis included predictions of individual latent cancer fatality risk for 3 distance intervals, 0 to 10 miles, 0 to 50 miles, and 0 to 100 miles. The analysis indicated that individual latent cancer risk estimates generally decrease with increasing distance due to plume dispersion and fission product deposition closer to the site.

As noted above, the SOARCA offsite consequence estimates are dramatically smaller than reported in earlier studies. For example, the Siting Study predicted 92 early fatalities for Peach Bottom and 45 early fatalities for Surry for the SST1 source term. In contrast, SOARCA predicted that the early fatality risk was 0 for both sites. Also, the Siting Study predicted 2,700 cancer fatalities for Peach Bottom and 1,200 for Surry for the SST1 source term using the LNT model. Although the exact basis for these cancer fatality estimates could not be recovered, literature searches and sensitivity analyses with MACCS suggested that these estimates are for the population within 500 miles of the site. Although SOARCA does not include the same latent cancer fatality consequence metrics as the Siting Study, an indirect comparison is possible.

SOARCA predicted that the conditional risk of latent cancer fatality for an individual located within 10 miles assuming LNT was 2x10 4 for Peach Bottom and from 5x10 5 to 7x10 4 for Surry.

Multiplying this conditional risk by the population within 10 miles of each site roughly corresponds to about 10 cancer fatalities for Peach Bottom and 10 to 100 for Surry for the population within 10 miles. SOARCA estimates for large distances would make the SOARCA predictions larger due to a larger exposed population in combination with the LNT assumption, while application of dose truncation criteria would make the SOARCA predictions smaller.

CIAL E N E MA

Table 7. Peach Bottom Results for Scenarios without Successful Mitigation for LNT and Alternative Dose Response Models Absolute risk of latent cancer fatality for an individual located within 10 miles (per reactor-year)

Linear No Health Physics Scenario Threshold Background Society Long-term SBO 6x10 10 3x10-11 5x1012 Short-term SBO 7x10 1 1 6xl 0 1 2 4xl 0-12 Table 8. Surry Results for Scenarios Without Successful Mitigation for LNT and Alternative DoseResponse Models Absolute risk of latent cancer fatality for an individual located within 10 miles (per reactor-year)

Linear No Health Physics Scenario Threshold Background Society Long-term SBO 7x10 10 2x101" 2x10 1 4 Short-term SBO lxlO 1 0 1x10-11 2x10i14 Thermally induced steam generator tube lxl0-10 4x1O-11 3x1 0-12 rupture Interfacing systems 2xl 01" 8x10-12 5x1 0-12 LOCA, We conclude that SOARCA has clearly demonstrated that a phenomenologically based and integral analysis of severe accident behavior and emergency planning reveals that the likely outcomes of an accident are much more benign, conducive to mitigation, and in the worst case, much less consequential for public health.

Fl - ElR