ML17278A759

Soarca Sequoyah Updated Draft Executive Summary

ML17278A759
Person / Time
Site:	Sequoyah
Issue date:	10/05/2017
From:	Office of Nuclear Regulatory Research
To:
Ghosh T
Shared Package
ML17278A755	List: ML17278A759
References
Download: ML17278A759 (17)

Text

EXECUTIVE

SUMMARY

Through the application of modern analysis tools and techniques, the state-of-the-art reactor consequence analyses (SOARCA) project developed a body of knowledge regarding the realistic outcomes of potential severe reactor accidents. In NUREG-1935, State-of-the-Art Reactor Consequence Analyses (SOARCA) Report, SOARCA analyses of the Peach Bottom Atomic Power Station and Surry Power Station pilot plants revealed insights into the accident progression for important scenarios in a boiling water reactor (BWR) with a Mark I containment design and a pressurized water reactor (PWR) with a large dry (subatmospheric) containment design as well as the offsite consequences of potential radioactive releases. This analysis of station blackouts (SBOs) at the third SOARCA pilot plant, Sequoyah Nuclear Plant, expands on the SOARCA body of knowledge for the next most prevalent containment design in the U.S., a PWR with an ice condenser containment. Compared to a PWR large dry containment, an ice condenser containment design has smaller volume and has a lower design pressure; therefore, the containment cannot absorb as much energy from a deflagration despite the presence of ice.

Hydrogen combustion has long been known to be a potential challenge to the ice condenser containment. The Sequoyah SOARCA analysis examines phenomenology and modeling unique to the ice condenser design including the behavior of hydrogen and the potential for early containment failure from an energetic hydrogen combustion.

Scope and Approach While the Peach Bottom and Surry SOARCA analyses in NUREG-1935 considered a variety of scenarios including short-term and long-term SBOs, loss of vital AC bus E-12 for Peach Bottom, steam generator tube rupture (SGTR) and interfacing systems loss of cooling accidents for Surry, the Sequoyah SOARCA analysis focused specifically on short-term SBO (STSBO) and long-term SBO (LTSBO) scenarios only. These scenarios involve an immediate loss of offsite and onsite AC power. In the STSBO variation, early failure of the turbine driven auxiliary feedwater (TDAFW) system is assumed and direct current (DC) power is also immediately unavailable; thus, the accident can progress to core damage within the short term. In the LTSBO variation, DC power is available until station batteries deplete and the TDAFW system is initially available; thus the accident can progress to core damage within the long term. These are important scenarios for all light-water reactors in general, and for an ice condenser plant also because of its reliance on AC-powered igniters for hydrogen control. The possibility of an SBO-induced SGTR is not modeled, since the Surry analysis included a more detailed treatment and the focus here was instead on containment performance.

U.S. Nuclear Regulatory Commission (NRC) and Sandia National Laboratories (SNL) staff used updated and benchmarked standardized plant analysis risk (SPAR) models and available plant-specific external events information to identify the SBO scenario variations for this analysis.

SBO scenarios can be initiated by external events such as a fire, flood, or earthquake. The Sequoyah SOARCA analysis assumes that the SBO is initiated by a low probability severe seismic event because this is a challenging case in terms of timing, equipment failure, and evacuation. The contribution to core damage frequency for the LTSBO was estimated at one event per approximately 100,000 years of reactor operation (~1E-5 per reactor operating year).

The contribution to core damage frequency for the STSBO is estimated at one event per approximately 500,000 years of reactor operation (~2E-6 per reactor operating year). No new work on estimating SBO frequencies was completed for this study. The estimated frequency information is provided only to help place this consequence study in context.

i

The Sequoyah SOARCA analyses were performed primarily with two computer codes, MELCOR for severe accident progression and the MELCOR Accident Consequence Code System (MACCS) for offsite consequences, which are the same tools used in previous SOARCA efforts. During the analysis, improvements to the accident progression and consequence analysis computer models and tools were incorporated to provide the current state-of-the-art severe accident modeling practices. MELCOR models the following:

• Thermal-hydraulic response in the reactor coolant system, reactor cavity, containment, and confinement buildings;

• Core heatup, degradation, and relocation;

• Core-concrete attack;

• Hydrogen production, transport, combustion, and mitigation; and

• Fission product transport and release to the environment.

MACCS models the following:

• Atmospheric transport and deposition of radionuclides released to the environment;

• Emergency response and long-term protective actions;

• Exposure pathways;

• Acute and long-term doses to a set of tissues and organs; and

• Early and latent health effects for the affected population resulting from the doses1.

The Peach Bottom and Surry SOARCA studies (NUREG/CR-7110 Volume 1 and Volume 2, respectively) were comprised of deterministic analyses using point estimates for input parameter values, followed by uncertainty analyses (Peach Bottom Uncertainty Analysis documented in NUREG/CR-7155 and DRAFT Surry Uncertainty Analysis2, respectively), which sampled distributions representing input uncertainty to generate multiple results to represent a range of potential outcomes. The Sequoyah SOARCA analysis integrates probabilistic consideration of uncertainty into accident progression and offsite consequence analyses in parallel with deterministic calculations that are presented within this study.

Because this study had a particular focus on the potential for early containment failure, and ice condenser containment-specific issues, an uncertainty analysis (UA) was included for the scenario with more potential for early containment failure: the unmitigated STSBO3 scenario.

This scenario was an evaluation of an unmitigated STSBO without hydrogen igniters, and without the presence of random ignition sources4. The UA included three active ignition sources:

(1) ignition from hot gases exiting the hot leg failure location, (2) ignition from hot gases exiting the pressurizer relief tank (PRT), and (3) the ex-vessel debris following the reactor pressure vessel (RPV) melt-through. Key MELCOR (accident progression) and MACCS (offsite consequence) input parameters were selected from distributions that account for parameter uncertainty. The UA input parameter selections included 600 samples resulting in 567 successful MELCOR realizations. Each MELCOR source term was coupled with a unique input parameter set for the 567 MACCS UA realizations.

1 MACCS also models economic and societal consequences such as the population subject to protective actions, however, these were not used in the SOARCA project.

2 https://www.nrc.gov/docs/ML1522/ML15224A001.pdf 3 Because the unmitigated STSBO does not credit human actions, the UA does not address human actions.

4 An initial draft of the Sequoyah SOARCA analysis included two variations of the unmitigated STSBO - with and without random ignition. The with random ignition UA was not conducted for this final report. The reader is directed to Section 4 for further discussion and the DRAFT report of this effort:

https://www.nrc.gov/docs/ML1609/ML16096A374.pdf.

ii

These STSBO UA results were examined in detail using both quantitative and qualitative approaches. Selected realizations from the UA were identified and examined to qualitatively evaluate characteristics important to accident progression and offsite consequences. Four regression techniques were used to identify input parameters contributing to key accident progression characteristics and public health impacts. Measures of the main (individual, independent) contribution of the uncertain parameter on the result metric and the conjoint influence5 of the parameter on the result metric were determined. These two results were calculated as weighted averages of the overall contributions from the four regression techniques. In addition, a stability analysis was performed for the result metrics of interest (e.g.,

cesium and iodine release to the environment) using a bootstrapping method, to gain an understanding of the level of convergence in the statistical results.

Finally, separate sensitivity analyses were conducted to understand the variation in results arising from alternative modeling approaches. For accident progression, sensitivity analyses were conducted to examine the effect of including hydrogen igniters and the effect of reactor coolant pump (RCP) seal leakage. For offsite consequences, sensitivity analyses were conducted to examine the effect of delays in evacuation due to infrastructure damage, the reduced protection offered by degraded infrastructure caused by the seismic event, the effect of using a single weather year for the analysis, and the potential influence of the dose-response model on cancer risk.

For the MELCOR accident progression analysis, insights from the SOARCA DRAFT Surry UA (see Footnote 2) were leveraged to identify a reduced set of parameters to include in the Sequoyah integrated UA. Because of the Sequoyah SOARCA analysis focus on insights unique to the ice condenser containment and potential vulnerabilities to hydrogen challenges, ice condenser containment-specific and hydrogen-specific considerations added new parameters to the list. Table ES-1 lists the 13 MELCOR input parameters varied as part of the unmitigated STSBO UA accident progression.

For the offsite consequence analysis, parameters varied as part of the STSBO UA are shown in Table ES-2. These uncertain parameters are the same as those in the SOARCA DRAFT Surry UA (see Footnote 2) with two new parameters added: (1) a time-based crosswind dispersion coefficient and (2) a parameter related to weather-forecasting-time used in the keyhole evacuation model. One parameter that was made uncertain in the previous UAs, cloudshine shielding factor, was fixed as a point value in this analysis because cloudshine contributes very little to the overall risk. The results are presented as conditional individual latent cancer fatality (LCF) risk and conditional individual early fatality (EF) risk and are statistically averaged (reported as the mean) over weather conditions.

5 Conjoint influence is the influence of two or more input parameters acting together, which may have synergistic effects that would not be determined by studying the influence of each parameter separately and individually.

iii

Table ES-1 Uncertain MELCOR parameters used in the unmitigated STSBO UA Sequence Related Parameters Primary safety valve stochastic number of cycles until failure-to-close Primary safety valve open area fraction after failure Secondary safety valve stochastic number of cycles until failure-to-close Secondary safety valve open area fraction after failure In-Vessel Accident Progression Melting temperature of the eutectic formed from fuel and zirconium oxides Oxidation kinetics model Ex-Vessel Accident Progression Lower flammability limit hydrogen ignition criterion for an ignition source in lower containment Containment rupture pressure Barrier seal open area Barrier seal failure pressure Ice chest door open fraction Particle dynamic shape factor Time within the Fuel Cycle Time-in-cycle6 The Sequoyah MACCS model was developed assuming the large seismic initiating event that disrupts the Sequoyah plant systems also affects the evacuation routes. This Sequoyah SOARCA approach differs from earlier Peach Bottom and Surry SOARCA efforts with regard to the state of infrastructure assumed. In those analyses, impacts on evacuation road networks and infrastructure were considered in sensitivity analyses rather than as part of their respective UAs.

Sequoyah roadway access and capacity are affected by the assumption that bridges within the 10-mile emergency planning zone (EPZ) are unusable. The infrastructure beyond the Sequoyah EPZ is assumed to be unaffected by the earthquake. It is difficult to consider all potential scenarios with respect to damage incurred within the EPZ from a large earthquake, such as the conditions of individual houses or buildings, the damage to roads in addition to bridges, the ability to evacuate or to shelter, etc. Therefore, the primary factors modeled in this study are the evacuation speeds and delays due to the loss of roadways with bridges. Specifically, the loss of roadways to exit the EPZ is expected to result in delays to find alternate routes and in decreased evacuation speeds due to increased traffic congestion on a suboptimal road network.

The evacuation delays and decreased travel speeds are evaluated to encompass other factors affecting the ability to evacuate.

Because the Sequoyah SOARCA STSBO is postulated to be caused by a large earthquake, staff considered, after discussing with staff from the Tennessee Emergency Management Agency (TEMA), that offsite response organizations might direct an extended period of sheltering-in-place before issuing an evacuation order, in order to allow time to survey the road network to confirm 6 Three points in the fuel burn-up cycle were sampled to represent beginning-of-cycle (BOC), middle-of-cycle (MOC),

or end-of-cycle (EOC).

iv

which routes would be safe for travel. Therefore sensitivity calculations were conducted for the Sequoyah STSBO to evaluate the impact of extended sheltering-in-place on radiogenic health risk, considering this possibility of a delayed evacuation order or the possibility that the road network is completely unusable. The shelter-in-place sensitivity assumes that homes and buildings are habitable but considers that windows might be broken and that corresponding inhalation protection factors might be compromised.

Table ES-2 Uncertain MACCS parameter groups used in the unmitigated STSBO UA Epistemic Uncertainty Dispersion Crosswind Dispersion Linear Coefficient Vertical Dispersion Linear Coefficient Time-Based Crosswind Dispersion Coefficient Deposition Wet Deposition Coefficient Dry Deposition Velocities Emergency Response Keyhole Weather Forecast Evacuation Delay Evacuation Speed Hotspot Relocation Time Normal Relocation Time Hotspot Relocation Dose Normal Relocation Dose Shielding Factors Groundshine Shielding Factors Inhalation Protection Factors Early Health Effects Early Health Effects LD50 Parameter Early Health Effects Exponential Parameter Early Health Effects Threshold Dose Latent Health Effects Dose and Dose Rate Effectiveness Factor Lifetime Cancer Fatality Risk Factors Long-Term Inhalation Dose Coefficients Aleatory Uncertainty Weather For the LTSBO scenario, a suite of deterministic MELCOR analyses without hydrogen igniters was performed to assess the impact of uncertain parameters including battery duration, RCP seal leakage, hydrogen ignition criteria, and safety valve behavior. A sensitivity case of a mitigated LTSBO was also evaluated in which hydrogen igniters are modeled as operable.

v

Results and Insights MELCOR STSBO Uncertainty Assessment Insights A primary goal of the Sequoyah UA was to investigate the potential for an ice condenser containment to fail early from a hydrogen deflagration in a severe accident situation. The containment end-state results are accordingly characterized into three general outcomes:

1. Late containment failure due to a slow pressurization of the containment from the core-concrete interaction (CCI) and steam

• The most common outcome in the 567 Monte Carlo realizations

2. No containment failure within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of the onset of the STSBO

• Almost exclusively BOC realizations with lower decay heat power

3. Early containment failure due to combustion of hydrogen generated in-vessel, following the first ignition

• Only four realizations with this outcome (see further discussion below).

A draft version of this analysis was prepared using different assumptions for the primary safety valve (SV) failure attributes (see reference in Footnote 4). The very small number of early containment failures within this UA compared to this draft are due primarily to changes in the primary SV failure attributes. After the draft UA was completed, the SV failure attributes were changed based on discussions with nuclear valve testing personnel and closer examination of Licensee Event Reports. In particular, the SV behavior was updated from the draft UA to reflect the following insights;

• If an SV is going to fail to close (FTC), then it will most likely do so on initial demand,

• If an SV functions per design on initial demand, then it will most likely function on all subsequent demands,

• If an SV experiences an FTC, then it will likely be in either a weeping (mostly closed) or mostly open position,

• An SV is very unlikely to fail to open when demanded to do so (i.e., fail fully closed),

• Passing hot liquid is not necessarily threatening to an SV, but passing cold fluid is, o Cold being relative to valves design conditions

• While there are differences between the main steam and reactor coolant system (RCS)

SVs, it was judged defensible to apply the main steam SV operational data to both the main steam and RCS SVs too due to a lack of operational data for RCS SVs.

A comparative analysis was performed to examine the role of the SV parameters on early versus late containment failures using the results of the draft UA (see reference in Footnote 4) and this UA. It was determined that the behavior of the pressurizer SVs, both in terms of FTC and the open area fraction upon FTC, strongly affects hydrogen production and transport to the containment by the time a hydrogen burns occurs, which in turn largely determines whether the containment fails early (near the time of core damage) or late (many hours after lower head vi

failure). Although this UA implements new SV insights, the results of the comparative analysis show that system response to similar SV parameter values is consistent between the two UAs.

The comparative analysis was performed by comparing the timing to the first deflagration from the start of hydrogen generation to the amount of hydrogen that is produced in-vessel by the time of the first hydrogen burn. Figure ES-1 shows these results for the current UA and the draft UA. There was low variability in the timing to the first combustion when the hot leg failure of the RCS occurs from relatively high pressure. In contrast, the realizations with delayed hot leg failure due to a RCS depressurization after a pressurizer SV FTC showed considerable variability in the timing to the first ignition. Both this UA and the draft UA exhibit the same general characteristics; the changes in the uncertainty parameter distributions between the two UAs only affects the distribution of these results and not the trends. Due to the RCS SV distribution differences, this UA shows little variability in the results for the timing to the first ignition whereas the draft UA includes more realizations with protracted timings to the first ignition.

Figure ES-1 Comparison of hydrogen production in current UA and draft UA MOC cases The amount of hydrogen produced in-vessel is generally less when the pressurizer SV continues cycling until hot leg failure with the primary system at high pressure. For these high pressure cases, the heat from the core is more efficiently transferred from the vessel to the reactor coolant system piping. The combination of a high differential pressure across the hot leg to the containment, and the more effective heating at high pressure results in hot leg failure vii

earlier in the core degradation progression. The first ignition source is the failure of the hot leg, which is associated with less in-vessel hydrogen generation, and a lower amount of hydrogen transported to the containment. The early deflagration from the smaller amounts of hydrogen in the high pressure cases did not fail the containment. Furthermore, the subsequent deflagrations also did not challenge the containment integrity because they occurred closer to the lower flammability limit due to the presence of active ignition sources (e.g., hot gases from the primary system or ex-vessel debris).

In contrast to the high pressure cases, the timing for the start of the hydrogen production is generally accelerated for the cases with system depressurization through SV FTC (especially realizations with an early SV FTC and a combined SV fractional open area over all valves greater than 0.3). The accumulation of creep damage to the hot leg and the heat transfer from the core to the hot leg are less efficient at low pressure. Furthermore, the early SV FTC scenarios may include partial accumulator injections at low RCS pressure. The combined effects of these factors lead to a longer amount of time from the start of core damage to the first deflagration and a larger amount of in-vessel hydrogen production. Finally, the higher rate of hydrogen discharge to the containment through the open SV and the corresponding lower retention in the vessel also significantly increases the amount of hydrogen in the containment at the time of the first deflagration. These cases generally had much more severe burns that challenged the containment integrity.

In both this UA and the draft UA, only realizations with a primary SV FTC and SV open area fraction greater than approximately 0.3 had early containment failure. The higher SV open area fraction led to an accident progression that allows more time for hydrogen to be produced in-vessel and transported to the containment dome. In these cases, the core damage timing is greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (and produces in-vessel hydrogen in excess of 300 kg); compared to less than an hour, and less in-vessel hydrogen generation for the high pressure cases. In this UA, only four realizations resulted in early containment failure out of the small number of completed MELCOR realizations with the potential for an early containment failure (i.e., 23 realizations).

The very small number of early containment failures within this UA compared to the draft UA are due primarily to the smaller likelihood of a pressurizer SV to experience an FTC with a sufficiently large open area, which in turn is due to the updated distributions specified for SV FTC on demand and SV open area fraction upon FTC. Considerable uncertainty remains on the true distributions for these parameters since very little real-world data is publicly available, as discussed in Section 3 of this report.

The effect of oxidation kinetic model is pronounced for realizations in which the SV operates without failure. In this UA, three oxidation models are used as compared to only the Urbanic-Heidrich (UH) in the draft UA. The Leistikov-Schanz/Prater-Courtright model produces less hydrogen at low fuel temperatures as compared to the other models. The Cathcart-Pawel/Urbanic-Heidrick and UH models had successively higher hydrogen oxidation rates at low to mid fuel temperatures that led to successively greater hydrogen generation amounts prior to the first deflagration, respectively.

Both this UA and the draft UA also capture the decrease in the time to hot leg failure with increasing hydrogen production. This downward trend of the timing to the first ignition with greater amounts of hydrogen production prior to the first burn corresponds to higher oxidation rates and a faster accident progression that accelerates the heating of the RCS pressure boundaries including the hot leg. The trend is demonstrated by shorter timings from the start of hydrogen generation to hot leg creep rupture and the first deflagration.

viii

The effect of decay heat (time in the burnup cycle) during core damage also had an impact on the amount of hydrogen production prior to the first ignition. While the MOC and EOC behave similarly due to only slight variations in the decay heat, the lower decay heat power in the BOC realizations at the start of the hydrogen generation slowed the accident progression. The lower decay heat not only slowed the core heatup, but also resulted in a more closely coupled heatup of the hot leg. The combined impact of the lower decay heat and tighter coupling between the core thermal response and the hot leg temperature resulted in slightly more time to hot leg failure and less in-vessel hydrogen generation.

If containment does not rupture early (within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />), then the subsequent hydrogen burns are never energetic enough to rupture the steel containment vessel later in the sequence. The late burns (after 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />) are less energetic due to frequent burning of smaller quantities of combustible gases near the lower flammability limit (i.e., ignited by aerosols and hot gases from ex-vessel CCI). As the burns consume oxygen, the oxygen concentration in containment eventually decreases to the point where it is insufficient to support further burning. Although the deflagrations cease, the containment continues to pressurize and heat up from the ex-vessel CCI non-condensable gas generation, and the resulting vaporization of water from the melted ice. The pressurization is monotonic and most often pressurizes containment to rupture prior to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (end of simulation time). Notable exceptions to this are realizations having BOC representations of the Sequoyah reactor core, where the reduced decay heating retards this monotonically increasing containment pressure. None of the BOC realizations overpressurized containment by 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Figure ES-2 shows the containment pressure response for the STBO UA realizations, color coded by time-in-cycle.

Generally, there is more hydrogen generated ex-vessel through CCI than generated in-vessel through zirconium and steel oxidation. Important with respect to hydrogen generated ex-vessel is that this does not evolve until after the first deflagration. Consequently, ex-vessel hydrogen production does not contribute to the magnitude of the first deflagration. The hydrogen generated ex-vessel evolves in the presence of an ignition source, and therefore burns as it is being produced until such time that a sufficient oxygen concentration is no longer available to support burning. The burning contributes to the gradual containment heating and pressurization as does continued hydrogen and non-condensable gas generation from CCI once all burning has ended. However, the ex-vessel combustible gas production is not a determining factor in whether or not containment fails early.

Consistent with the insights described above and past studies (such as the draft Surry UA),

regression analyses indicate that the most influential uncertain parameters on in-vessel hydrogen production were the oxidation model, time-in-cycle, aggregate primary SV cycles7 (priSVcycles), and U-Zr-O eutectic melt temperature.

7 Which was a surrogate for the importance of both the number of SV cycles (priSVcycles) and the failure area upon failure, if an SV experienced FTC. The FTC failure area was not included in the regressions due to the challenge of the majority of values being zero, since a primary SV didnt FTC.

ix

Figure ES-2 Containment pressure response for the STSBO UA realizations For both cesium and iodine environmental release (Figure ES-3), regression analyses indicate the time-in-cycle is significant; Realization (Rlz) 266 is the reference realization because its results are close to the population medians for results of interest. Releases vary from nearly zero (at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />) for BOC realizations, then increase in magnitude and occur earlier with increasing burnup (MOC and then EOC). The aggregate number of primary SV cycles experienced (priSVcycles, due to SV FTC or RCS depressurization by other means) is also significant, and the results are consistent with deterministic analyses. The primary SV cycles parameter also has high interaction effects (identified from non-linear regression techniques) for both the cesium and iodine environmental release. With regards to the magnitude of the environmental release, no other parameters were identified as having significant main effects on cesium or iodine release to the environment. In terms of significant effects only in interaction with other parameters, the U-Zr-O eutectic melt temperature was identified as significant for both cesium and iodine environmental releases, and the containment rupture pressure was identified as significant for only the iodine environmental release. Generally, cesium and iodine environmental releases are minimal until about 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> into the simulation, and increases significantly from 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> to the end of the simulation (72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />).

x

Figure ES-3 Cesium (left) and iodine (right) environmental release fraction horsetails based on the STSBO UA realizations.

MELCOR STSBO and LTSBO Sensitivity Analyses The hydrogen mitigation system (HMS) benefit analysis showed that igniters prevent the buildup and circulation of hydrogen to the dome prior to the first burn. The igniters burned smaller quantities of hydrogen primarily in the lower containment to prevent large pressurizations from large burns, especially for the first burn. In the STSBO sequence, recovery of the HMS (i.e.,

igniters) by 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> was shown to shift an early containment failure to a late containment failure.

All the LTSBO sensitivity cases experienced late containment failure. Consequently, the benefit of igniters had a less important effect for the range of conditions investigated.

The hydrogen ignition sensitivity study (similar to the STSBO individual realization analysis) showed that hot gas auto-ignition from the hot leg and PRT mitigated the build-up of hydrogen for cases with attributes that promoted an early containment failure. These ignition sources burned hydrogen earlier in the accident progression, which contributed to reducing (but not eliminating) the likelihood of an early containment failure.

The inclusion of increased RCP seal leakage8 only had a small effect on a sensitivity calculation where the pressurizer SV did not fail and late containment failure occurred. The timing of the key events and the source term to the environment were similar in the reference case and the RCP seal leakage sensitivity case. The amount of leakage from the RCP seal leakage is significantly smaller as compared to a stuck-open pressurizer SV, which is needed to develop the conditions for an early containment failure.

The inclusion of increased RCP seal leakage had a more significant effect on the realization with the earliest containment rupture from the STSBO UA. However, and most importantly, both this reference case (Realization 554) and sensitivity case with RCP seal leakage resulted in an early containment failure and a relatively large source term. Although the reference case had a hot leg failure and the sensitivity case did not, the in-vessel hydrogen production and the subsequent hydrogen release to the containment prior to the first hydrogen burn were comparable. The pressurizations from the burn following the first burn were also very similar.

8 The increased RCP seal leakage sensitivity calculation simulated failure of the seal barrier, which results in a nominal leakage rate of 480 gpm per pump after 13 min. In contrast, the nominal RCP leakage rate in the other UA calculations was 21 gpm per pump.

xi

A set of LTSBO calculations were defined to explore the plant response to variations in pressurizer and steam generator (SG) SV FTC and failure open area parameters, the TDAFW operation, battery life, availability of ignition sources, HMS recovery, and RCP seal leakage. All of the calculations showed the benefits of TDAFW to significantly extend the time taken to uncover the core and over-pressurize the RPV to failure. LTSBO accident progression was similar to STSBO progression after TDAFW injection failed, but more protracted due to lower decay heat. There were no early containment failures due to hydrogen burns9 and all cases were progressing slowly to containment over-pressurization due to ongoing steam production and CCI at the end of the calculation (i.e., 72 hr).

The inclusion of increased RCP seal leakage had a significant impact on the LTSBO accident progression. Due to the longer time for an LTSBO to progress to core damage, the impact of the RCP seal leakage was greater. The primary system response was substantially different due to the large water inventory loss through the RCP seal leakage prior to station battery (DC) exhaustion. Unlike the LTSBO calculations without seal failures, the primary system became thermally decoupled from the secondary system due to the high amount of coolant inventory loss through the RCP seals, which circumvented most combinations of the SV failures investigated in the STSBO UA. Nevertheless, the RCP seal leakage sensitivity case also progressed to late containment failure like the LTSBO cases without increased RCP seal leakage.

Focused Pressurizer Safety Valve Study - MELCOR Insights Only four of the 567 completed UA realizations resulted in an early containment failure. In addition, the MELCOR run incompletion rate10 was higher for realizations with sampled SV parameter values in the ranges supportive of a potential early containment failure.

Consequently, a focused pressurizer SV study was performed to better understand conditions leading to an early containment failure, and the resulting environmental radionuclide releases.

The focused SV study included sampling of the same uncertain variables as the UA. However, the range of the number of primary SV cycles to failure, priSVcycles, and SV open area fraction upon failure, priSVfrac, were limited to between 1 and 65 cycles and 0.3 and 1.0 open area fraction, respectively, to ensure they were sampled within the ranges supportive of a potential early containment failure. The remaining uncertain parameters were sampled with simple random sampling from the same distributions (and associated ranges) as the UA.

The focused SV study satisfied several important objectives. First, it explored the most important uncertain parameter attributes that contribute to early containment failure. The early containment failure realizations are particularly important because they have larger and earlier environmental releases. Second, the UA realizations with these SV attributes experienced a large number of code failures that warranted further investigation. Consequently, there was some uncertainty in the relative occurrence of an early containment failure. Third, this study corrected the barrier seal failure pressure error (see Section 4 of report). Consequently, the impact of the barrier seal performance on a larger set of calculations was explored.

9 One ignition sensitivity calculation that disabled a hot jet ignition source from the PRT resulted in an early containment failure due to a hydrogen burn at 24.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The PRT generated a hot jet that would cause auto-ignition of the surrounding hydrogen, but for this sensitivity case the PRT was not allowed to initiate at burn. The purpose of the sensitivity case was to illustrate the importance of this previously ignored ignition source.

10 The incompletion rate for the subset of MELCOR realizations with SV parameter values in the ranges supportive of a potential early containment failure was nine out of 32 attempted realizations, ~28%; whereas the overall incompletion rate was 33 out of 600 attempted realizations, ~6%.

xii

Approximately 17% of the 361 successful realizations had a containment failure occurring in less than 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br />. The 17% early containment failure rate compares well with the 17% early containment failure rate in the UA (i.e., four early containment failures in 23 realizations with the same attributes as the focused SV study). The focused SV study also shows the potential for early containment failure fora BOC core state, which was not observed in the overall UA. The figures-of-merit examined were the time to containment failure, mass of hydrogen generated in-vessel up to the first hydrogen burn, the mass of hydrogen passed through the PRT to the first hydrogen burn, and the mass of hydrogen reaching the dome at the time of first burn.

The only overlapping correlation between the focused SV study and the UA was the total in-vessel hydrogen generation. Both the UA and the focused SV study show agreement on the importance of the top three uncertain input variables11 for this metric but in a different order.

This was possible due to the limited scope of the SV parameters in the focused SV study. The regression results for the focused SV study show the containment failure pressure (Rupture) as the most important sampled parameter with respect to whether or not containment failed early.

An examination of the results shows that almost all of the sampled rupture pressures leading to early containment failure were less than the mode of the failure pressure distribution.

The regression of the mass of hydrogen vented to containment through the PRT indicated the number of pressurizer SV cycles (priSVcycles), the time in cycle (Cycle), and the oxidation model (Ox_Model) as the most important parameters, which was consistent with the findings for total mass of hydrogen generated in-vessel. The regression for the amount of hydrogen transported to the dome indicated the number of pressurizer SV cycles (priSVcycles), the eutectic melting temperature (EU_melt_T), and the oxidation model (Ox_Model) as the most important parameters.

The average cesium and iodine environmental release fractions at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for the realizations with early containment rupture were 0.022 and 0.063, respectively. The highest cesium and iodine environmental release fractions were 0.058 and 0.15, respectively. The lowest cesium and iodine environmental releases were 0.01 and 0.025, respectively. Neither the maximum nor minimum values were well represented in the four early containment failure realizations from the overall UA. However, the average values from the focused SV study corroborated the four early containment failure results in the UA.

MACCS Offsite Consequence Uncertainty Analysis Similar to the results from the Peach Bottom and Surry SOARCA UAs, the Sequoyah analyses show essentially zero individual EF risk and a low individual LCF risk for the affected population.

Even for STSBO variations leading to early containment failure in which the release to the environment begins prior to the completion of the 10-mile EPZ evacuation, there is essentially zero individual EF risk (three out of 567 realizations had a non-zero EF risk calculated and even those are small), and the individual LCF risk is low. Individual LCF risk calculations are generally dominated by long-term exposure to small annual doses (using the linear-no-threshold

[LNT] dose response model, below 2 rem in the first year after the accident and below 500 mrem per year in subsequent years corresponding to the habitability criteria) for populations exposed to residual contamination over a long period of time.

Using the LNT dose response model, the conditional individual LCF risks for the UA are bimodal and range from about 6E-04 to 2E-09 for the 0-10 mile region and the individual LCF risks 11 In the focused SV study, both priSVcycles and the failure area upon failure were included as separate inputs to the regressions, since the SV was forced to experience an FTC.

xiii

generally decrease with increasing distance from Sequoyah; see Figure ES-4. The bimodal nature of the complementary cumulative distribution function (CCDF) curves derives from the fact that the containment does not fail by 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> (the end of the simulation) in 13% of the realizations and does fail before 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> in the remaining 87% of the realizations. The cases with no containment failure account for the upper left (very low risk) portion of the CCDF curves; the cases with containment failure account for the right (relatively higher risk) portion of the CCDF curves. These risks are conditional on the occurrence of an STSBO. Contributions from the long-term phase risks dominate the emergency-phase risks for the large majority of the realizations.

Another notable feature of the CCDF curves shown in Figure ES-4 is that the curves are close together for the portion of the curves representing containment failure. This indicates that risk is nearly flat as a function of distance from the plant. While it is generally true that risk decreases with distance beyond the 10-mile EPZ, the decrease is small for these cases.

Regression analyses indicate that the time-in-cycle when the accident occurs has the largest influence on consequences of all the uncertain inputs considered in the Sequoyah STSBO UA; this parameter affects fission product inventory and associated decay heat. Within the 10-mile EPZ, three MACCS parameters and two additional MELCOR parameter are also assessed as important. The MACCS parameters are the cancer risk factors for the residual and colon organs, and the long-term groundshine shielding factor. The cancer fatality risk factor for the residual organ12 represents all of the cancer types not specifically treated in this version of MACCS. The MELCOR parameters are the aggregate primary (pressurizer) SV cycles to failure and containment rupture pressure. Two additional MACCS parameters are important at longer distances presented in the regression analysis; the cancer risk factor for lung cancer and normal relocation time.

Specific to the MELCOR parameters, aggregate primary SV cycles to failure is significant with respect to uncertainty in individual LCF risk for the 0-10 and 10-20 mile ranges, but not for ranges beyond those. This parameter influences hydrogen buildup in containment and the potential for early containment failure, leading to early releases. Early release has the potential to affect evacuees within the EPZ and shadow evacuees from 10 to 15 miles because some of the evacuees can be directly affected by the plume. This parameter has a lesser influence on the non-evacuating population who are assumed to remain in place at the start of release regardless of whether it is an early or late release.

Time-in-cycle is consistently significant at all distances and is driven by its strong influence on the magnitude of the source term. Consequences are more severe as this parameter increases, both because of its influence on release fractions as noted in the MELCOR result insights above, as well as due to the additional creation of cesium activity with increased time in the fuel burnup cycle. The differences are more profound between BOC (where containment doesnt fail in the overall UA) and MOC/EOC, and less profound between MOC and EOC.

12 MACCS uses eight cancer sites (organs), seven of which are specific (lung, red bone marrow, bone, breast, thyroid, liver, and colon) and the last of which (residual) represents the cancers not explicitly modeled and is based on the dose for the pancreas, which is used as a surrogate for other soft tissues.

xiv

Figure ES-4 Complimentary cumulative distribution functions of conditional individual LCF risk within five intervals (annuli) centered on Sequoyah Containment rupture pressure is also significant nearer the plant, but not significant within the 30 to 40 and 40 to 50 mile ranges. The pressure at which containment ruptures is correlated negatively with consequences, which means consequences decrease as containment failure pressure increases. Lower containment failure pressure generally corresponds to earlier containment failure; a higher failure pressure translates to a delay in containment failure timing which benefits both evacuation as well as aerosol deposition effectiveness within the containment.

Specific to the MACCS parameters, the long-term groundshine shielding factor is only indicated as significant in the 10 mile EPZ. This parameter is a factor in the equation for groundshine dose, so risk increases with this factor. Groundshine is relatively more important within the EPZ because nearly all of the risk is from the intermediate and long-term phases. The cancer risk factors have high significance with the colon and residual organs consistently indicated as significant, though in differing orders at different radial distances; these are the two largest of the LCF risk factors and both appear as multipliers in terms of the equation for individual LCF risk.

MACCS Offsite Consequence Sensitivity Analyses Sensitivity calculations were conducted for the Sequoyah STSBO to evaluate the impact of extended sheltering-in-place prior to evacuation on radiogenic health risk. These sensitivities, which assumed a 12-hour and 48-hour period of sheltering prior to evacuation, resulted in slightly larger individual LCF risk for the public compared to calculations with a prompt evacuation order (using the LNT dose response model). If seismically-impacted structures are assumed to be damaged resulting in reduced shielding factors, the advantage of a prompt evacuation order is even greater. The individual EF risk also increases for calculations with xv

extended sheltering-in-place when structures are assumed to be degraded, but the individual EF risks remain very low even for this case.

Five years of meteorological data (2008-2012) from the Sequoyah site were evaluated with respect to their impact on individual LCF risk. The year 2012 was selected for this study because it was judged to be the most representative of the site weather (i.e., the annual precipitation was consistent with the five-year-average precipitation and it has the second highest data completion rate) of years 2008 to 2012. The sensitivity calculations showed that the mean individual LCF risk using 2012 weather is within a few percent of the mean individual LCF risk using the entire five year span of weather data. Also, the results of the selected year lie between the upper and lower bounds of the individual weather year results and is very close to the means at the distance intervals evaluated. These results give confidence that the selection of 2012 meteorological data does not significantly bias individual LCF risk calculations.

Sensitivity calculations were conducted to evaluate the impact of the following four alternative dose-response models for cancer risk beyond LNT:

• 10 mrem per year threshold (demonstrates the contribution from extremely low doses),

• 310 mrem per year threshold (U.S. natural background average annual dose),

• 620 mrem per year threshold (U.S. natural background average annual dose plus annual dose from man-made radiation sources), and

• Threshold based on the Health Physics Societys (HPSs) 2004 position statement on radiation risk (includes both annual (5 rem) and lifetime (10 rem) thresholds).

With the non-LNT dose-response approaches considered, only annual doses above the thresholds contribute to individual LCF risk. These calculations demonstrate that as the dose threshold increases, the corresponding individual LCF risks decrease from ~5% (10 mrem per year threshold) to orders of magnitude (threshold based on HPSs 2004 position statement),

which is expected.

As part of the focused SV study, the health effects were calculated for each of the realizations that were extended to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. This included 61 realizations that had progressed to an early containment failure, and 57 realizations that progressed to a late containment failure. The mean (over weather variability), conditional, individual LCF risk to the 0-10 mile radial population assuming LNT for the late containment failure cases was 8E-5, which was equal to one significant digit to the 0-10 mile result from the overall STSBO UA. The mean, conditional, individual LCF risk assuming LNT for the early containment failure cases was 7E-4, which was higher than the 95th percentile from the overall STSBO UA (which was 2E-4). Considering that the early containment failure cases represented only 4 out of 567 (less than one percent) of the STSBO UA, the LCF risk results from the focused SV study are consistent with those of the overall STSBO UA.

Summary The Sequoyah SOARCA analyses provide valuable insights on potential accident progression and consequences for an unmitigated station blackout severe accident at the Sequoyah Nuclear Generating Station. An important focus of the analysis was investigating the susceptibility of the xvi

ice condenser containment to rupture from a hydrogen deflagration. The analyses suggest that rupturing of an ice condenser containment by a hydrogen deflagration, while possible, is unlikely. The analyses also suggest that in the severe accident scenario modeled, a safety valve on the primary side (pressurizer) of the reactor coolant system would need to fail to close for an ice condenser containment to rupture from a hydrogen deflagration. A containment rupture from a hydrogen deflagration would come early, i.e., within hours of the loss of electrical power for an STSBO. Considerably more likely than an early containment rupture is a late rupture, i.e., days after the loss of power, due to gradual over-pressurization from fission product decay incessantly driving steam production and core-concrete interaction. The relative likelihood of different containment failure times in the modeled STSBO scenario is highly influenced by uncertainty in the primary safety valve failure-to-close parameters, and considerable uncertainty remains in the distributions of these key safety valve parameters in the current state-of-knowledge. Sensitivity calculations conducted as part of this study reinforce the results of past analyses (e.g., NUREG-1150) of ice condenser containments showing that successful use of igniters (HMS) is effective in averting early containment failure.

Even for scenarios resulting in early containment failure (radioactive release to the environment prior to completion of evacuation for the EPZ), resulting individual LCF risks are small and individual EF risks are essentially zero. The sensitivities which assumed an extended period of sheltering prior to evacuation resulted in slightly larger individual latent cancer fatality risk for the public compared to calculations with a prompt evacuation order, assuming the LNT dose response model. If shelters are assumed to be damaged by the earthquake, the advantage of a prompt evacuation order is even greater. The individual EF risk also increases for calculations with extended sheltering-in-place when structures are assumed to be degraded, but the individual EF risks remain very low even for this case.

Sequoyah SOARCA insights, while specific to Sequoyah, can be used to obtain insights for other PWRs with ice condenser containments. However, additional work would be needed to assess the impact of differences in plant-specific designs and site-specific characteristics.

The SOARCA analyses of the three pilot plants have been useful in many ways beyond their original objectives. The SOARCA projects results, insights, computer code models, and modeling best practices have supported NRC rulemaking, licensing, and oversight efforts as well as facilitated international cooperation and knowledge management. Additionally, the process of conducting such detailed analyses has developed staff expertise in a variety of important technical areas including severe accident progression, environmental source terms, atmospheric transport and dispersion, offsite consequence analysis, emergency preparedness and response, dosimetry, health effects, uncertainty analysis, and risk communication. The study also resulted in improvements in NRC analytical tools and associated severe accident analysis methodologies, including parametric uncertainty analysis. The improvement of tools, methodologies, and of staff technical expertise improves NRCs capabilities to carry out its mission to protect public health and safety, and the environment.

xvii