ML20027C211

Rev 5 to Probabilistic Risk Assessment.

ML20027C211
Person / Time
Site:	Limerick
Issue date:	09/30/1982
From:	PECO ENERGY CO., (FORMERLY PHILADELPHIA ELECTRIC
To:
Shared Package
ML20027C208	List: ML20027C207 ML20027C211
References
PRA-820930-02, NUDOCS 8210150133
Download: ML20027C211 (214)

Text

_ _ _ _ _ _ _ _ _ - _ _ _

/ , LIMERICK GENERATING STATION

\  ;

PROBABILISTIC RISK ASSESSMENT

! REVISION 5 PAGE CHANGES The attached Revision 5 pages, tables, and figures are considered part of ,a controlled copy of the Limerick Generating Station Probabilistic Risk Assessment. This material should be incorporated into Volumes 1 and 2 of the PRA by following the collating instruction below:

} REMOVE INSERT DATED I

VOLUME 1 l

l Title Page (June, 1982) Title Page (September, 1982) 9/82 Page 1-28 Page 1-28 9/82 Page 1-32 Page 1-32 9/82  ;

Page 3-3 Page 3-3 9/82 i Page 3-11 Page 3-11 9/82 Page 3-13 Page 3-13 9/82 Page 3-18 to 3-20 Page 3-18 to 3-20 9/82 Page 3-23 to 3-24 Page 3-23 to 3-24 9/82 73 Page 3-35 Page 3-35 9/82

(") Page 3-45 Page 3-48 Page 3- 45 Page 3-48 9/82 9/82 Page 3-62 to 3-64 Page 3-62 to 3-64 9/82 Page 3- 66 Page 3-66 9/82 Page 3-68 to 3-69 Page 3-68 to 3-69 9/82 Page 3-71 to 3-73 Page 3-71 to 3-73 9/82 Page 3-76 to 3-79 Page 3-76 to 3-79 9/82 Page 3-81 Page 3-81 9/82 Page 3-83 to 3-85 Page 3-83 to 3-85 9/82 Page 3-87 Page 3-87 9/82 Page 3-105 Page 3-105 9/82 Page 3-113 Page 3-113 9/82 Page 3-115 Page 3-115 9/82 Page 3-117 Page 3-117 9/82 Page 3-120 Page 3-120 9/82 l Page 3-125 Page 3-125 9/82 Page 3-128 Page 3-128 9/82 Page 3-136 Page 3-136 9/82 -

Page 3-140 Pape 3-140 9/82 Page 3-140a 9/82 l Page 3-141 to 3-145 Page 3-141 to 3-145 9/82

{ Page 3-147 Page 3-147 9/82 Page 3-155 to 3-156 Page 3-155 to 3-156 9/82 Page 3-170 Page 3-170 9/82 Page 3-172 to 3-173 Page 3-172 to 3-173 9/82

\ [') _ -'

Page 5-1 Page 5-5 Page 5-1 Page 5-5 9/82 9/82 j

i i Page 6-1 Page 6-1 9/82

\

\ r; 8210150133 821012

,- - PDR ADOCK 05000352 A r un

\ 2

f REMOVE INSERT DATED

- Page Q-0 9/82 Page Q-1 (Rev. 4) Page Q-la 9/82 Page Q-3 to s-5 Page Q-3 to Q-5 9/82 Page Q-8 Page Q-8 9/82 Page Q-10 to Q-15 Page Q-10 to Q-15 9/82 Page Q-17 to Q-18 Page Q-17 to Q-18 9/82 Page Q-22 Page Q-22 9/82 Page Q-25 to Q-27 Page Q-25 to Q-27 9/32 Page Q-32 to Q-38 Page Q-32 to Q-38 9/82 Page Q-40 Page Q-40 9/82 Page Q-42 to Q-45 Page Q-42 to Q-45 9/82 Page Q-48 to Q-49 Page Q-48 to Q-49 9/82 Page Q-51 to Q-53 Page Q-51 to Q-53 9/82 Page Q-55 to Q-56 Page Q-55 to Q-56 9/82 Page Q-58 to Q-63 Page Q-58 to Q-63 9/82 Page Q-68 to Q-69 Page Q-68 to Q-69 9/82 Page Q-71 to Q-74 Page Q-71 to Q-74 9/82

- Page Q-75a to Q-75q 9/82

~

Page Q-76 to Q-84 Page Q-76 to Q-84 9/82 Page Q-85 Page Q-85 9/82 Page Q-87 Page Q-87 9/82 Page Q-89 Page Q-89 9/82 Page Q-92 to Q-94 Page Q-92 to Q-94 9/82 Page Q-98 Page Q-98 9/82 Page Q-107 Page Q-107 9/82

{ } Page Q-110 Page Q-1@ 9/82 C/ Page Q-112 Page Q-112 9/82 Page Q-114 Page Q-114 9/82 Page Q-116 Page Q-116 9/82 Page Q-118 to Q-121 Page Q-118 to Q-121 9/82 Page Q-124 Page Q-124 9/82

- Page Q-125a to Q-125b 9/82 Page Q-126 to Q-127 Page Q-126 to Q-127 9/82 Page Q-131 Page Q-131 9/82 Page Q-135 to Q-136 Page Q-135 to Q-136 9/82 Page Q-145 Page Q-145 9/82

- Page Q-146a to Q-146m 9/82 Page Q-147 Page Q-147 9/82 Page Q-151 Page Q-151 9/82

- Page Q-156a to Q-156m 9/82 Page Q-157 to Q-158 Page Q-157 to Q-158 9/82 Page Q-161 to Q-162 Page Q-161 to Q-162 9/82 Page Q-164 Page Q-164 9/82 l

k

\

\

b

REMOVE INSERT DATED O Title Page (April,1982) Title Page (September, 1982) 9/82 ,

Page A-10 Page A-10 9/82 l Page B-6 Page B-6 9/82 Page B-44 Page B-44 9/82 Page B-79 Page B-79 9/82 Page E-11/E-12 Page E-11 9/82 Page E-12 9/82 Page E-13 Page E-13 9/82 Page E-16 Page E-16 9/82 Page E-17/E-18 Page E-17 9/82 Page E-18 9/82 Page E-19/E-20 Page E-19 9/82 Page E-20 9/82 Page E-23/E-24 Page E-23 9/82 Page E-24 9/82 l Page C-1/G-2 Page C-1 9/82 l

Page G-2 9/82 Page G-5/G-6 Page G-5 9/82 Page G-6 9/82 Page 87/88 (Appendix H) Page 11-87 9/82 J l

Page H-88 9/82 l l Page 89/90 (Appendix H) Page H-89 9/82 Page H-90 9/82  ;

I

'Om i

l l

l O

v

\

-- _ _ . _ _ _ _ . ___._________a

i l

O PROBABILISTIC RISK ASSESSMENT LIMERICK GENERATING STATION PHILADELPHIA ELECTRIC 001PMC l

l VOLUME 1 lO f

l SEPIEMBER, 1982 DOCKET NOS. 50-352 l 50-353 O '

For transient events, including IORV and SMV, ECCS system response is very similar to the response to a small LOCA, except that manual depressurization, by opening two safety / relief valves, would be required to initiate low pressure ECCS systems.

Table 1.3 summarizes system capability for a transient event with failure to scram (ATWS). For these events, as in the LOCA and transient events, the criteria are defined in terms of the minimum number of systems required to prevent excessive fuel clad temperature and remove decay heat.

(The table shows failed systems or functions.)

In Table 1.3, for all conditions shown as " acceptable" ( A),

supprassion pool bulk temperature is maintained below 220 F. The unlikely case o f two standby liquid control pumpsand both RHRs failed may result in suppression pool condensation conditions that have not been proven to be acceptable.

The success criteria, as shown in Table 1.3 are based on the

[]

following:

e An automatic standby liquid control (SLC) system o Failure of alternate rod insertion (ARI) e Turbine trip ATWS initiator event has 25% steam flow bypass available e No inadvertent ADS initiation.

For the degraded condition of feedwater and HPCI failed, the operator may be required to inhibit ADS. For the condition where HPCI continues to run, operator action within 10 minutes to prevent overfilling the vessel would provide successful shutdown.

1-28 Rev. 5, 9/82 L

r _ ._.

8. Common-mode miscalibration of similar sensors is incorporated into the model (see Appendix A).

9. Manual Operation -- Several guidelines are used to define the operator action assumptions used in the model:

Detailed analysis of the adequacy of core cooling under extreme conditions indicatas that positive manual operations can be delayed for more than 30 minutes (in most cases, 2 to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />). This is based upon the adequacy of cere cooling even if the effective reactor water level is below the top of the active fuel. In the analysis involving evaluation of adequate core cooling an,d core un-covering, human intervention to establish core coolant injection is not considered to be necessary for at least 30 minutes.

The event tree / fault tree analysis has been performed using the human-error rates documented in Appendix A.

These error rates have been applied to obvious actions which the operator should perform during an accident se-quence. In addition, those maintenance recovery actions which may be in error and which would adversely affect the system operation have been inciuded in the component failure rates (see the generic component fault trees).

l

, Operator action to restore failed or tripped systems

/ has been included in the case of the power conversion system (PCS), the RHR system, and the diesels.

10. The bases for fault tree quantification are:

l e The best estimate for a given probability is associated with the mean value of the data.

The failure rates used in the study are repre- l sentative of the equilibrium portion of the l plant life.

e The entire analysis is based on the use of realistic assumptions, data, and success criteria, and is intended to model, insofar as possible, actual events and actions as they would be expected to occur.

11. The failure of display of informution to the operator is treated as a random independent failure or set of failures and is not dependent on the accident sequence.

3 1-32 Rev. 5, 9/82 7

e

and therefore have some induced radioactivity. Ihis induced i

radioactivity is immobile and represents only a minute fraction of the total radioactivity. Therefore, it is not important in assessing the overall risk to the public. ,

x Table 8.1 TYPICAL RADI0 ACTIVITY INVENTORY FOR A 1000 We NUCLEAR POTER REACTOR __

Total Inventory (Curies) Fraction of Core Inventory Location Fuel Esp Total Fuel Gap Total Core (a) 8.0 x 10' 1.4 x 10 8 8.1 x 10' 9.8 a 10'I 1.8 x 10'2 1 Sper.t Frel Stora e Pool (Max. (b) 1.3 x 10' 1.3 a 10 1.3 x 10' l.6 x IQ'I 1.6 x 10'3 1.6 x 10'I 5 pent Fuel Stora e Pool 0 6 8 (Avg. (c) 3.6 x 10 3.8 x 10 3.6 x 10 4.5 x 10-2 4.8 r. 10'" 4.5 a 10-2 7 5 7

$ nipping Cask (d) 2.2 x 10 3.1 x 10 2.2 x 10 2.7 a.10'I 3.8 x 10-5 2.7 x 10'3 7 5 I Refueling (e) 2.2 x 10 2 x 10 2.2 x 10 2.7 x 10*3 2.5 x 10-5 2.7 x 10'3 0 Liquid Waste Storage T6ak . . g.5 x 10 I . -

1.2 x 10-8 (a) Core inventory based on activity 1/2 hour after shutdown. -

(b) Inventory of 2/3 core loading; 1/3 core with three day d(cay and 1/3 core with 150 day decay.

(c) Inventory of 1/2 core loading; 1/6 core with 150 day decay and 1/3 core with 60 day decay.

(d) Inventory for one fuel assemely with three day decay.

(e) Inventory for one fuel assembly with three day decay.

The transfer of spent fuel assemblies from the reactor core, w W essentially all the radioactivity in LCS is initially created, results in radioactive fission products being located in other parts of the plant, such as the spent fuel storage pool (SFSP). Taking into consideration the length of power operation and radioactive decay, the reactor core contains by far the 1 8-8 Rev. 5, 9/82

x 3.4 EVENT TREES USED IN Tile PROBABILISTIC ANALiSIS

( '

1 N.~

Event trees are used to present those accident sequences which may result from a specific initiating event. The philosophy used in the LCS analysis is to develop and quantify separate event trees for those initiating events which would have a strong effect on the systems available for accident nitigation.

Using this guideline, event trees are developed for the accident

[ initiators discussed in Section 3.2 and Appendix A. The event trees include:

1. Transient Event Trees (Section 3.4.1)

• Turbine Trip

• Manual Shutdowns

,/'~}

• MSIV Closure / Loss of Feedwater C'

• Loss of Offsite Power

• In. advertent Open Relief Valve

2. Loss of Coolant Event Trees (Section 3.4.2)

• Large LOCA

• Medium LOCA

• Small LOCA l

3. Event Trees for Low Probability Events (Section 3.4.3)

• ATWS Event Trees

• Interfacing LGCA l

4. The containment event tree applicable in the unlikely event that a severe disruption of the core occurs (Section 3.4.5).

Differences in potential consequences to the public are

(\' )

differentiated by the success or failure of the functions 3-11 Rev. 5, 9/82 g __

radioactive material, these similar accident sequences are O grouped into classes.

The consequences of each class are then treated separately by containment failure mode and release fraction.

This method leads to a much larger number of consequence groups to analyze than the five used in WASil-1400 BWR analysis; yet, it maintains the number of calculations which need to be performed at a manageable level. This technique provides a greater specificity in accident sequence definition than used in WASil-1400.

Table 3.3.1 (see preceding section) gives a description of each of the accident sequence classes as well as their physical containment phenomenology. For each of the event sequence classes, a detailed in plant consequence evaluation has l

been performed.

O 3-13 Rev. 5, 9/82

,- B.4.1.1 TT -- Turbine Trip Transient

8

\v )

The turbine trip transient involves the least challenge to reactor shutdown systens. IT does not, of itself, prevent the safe shutdown of s. olant using either the normal heat removal systems (i.e., condenser) or the safety related systems. In the developsent of this sequence, those turbine trip events for which l there is a failure of the turbine bypass valves to open are 1

1 transferred directly to the MSIV closure event tree. Figure B.4.1 is the turbine-trip-initiated event tree. Each of the functional events listed across the top of the event true are discussed below.

C -- Reactor Not Suberitical. Failure to bring the reactor

('~N saberitical is an accident sequence leading to a transfer to

\

'~) the ATES event trees (Figure 8.4.7, for turbine trip). The sequences assessed in Figure 3.4.1 are those in which control rods are successfully inserted.

M -- Safetv/ Relief Valves Fall to Open. This column represents the opening of the safety relief valves to limit reactor coolant pressure to 110 percent of the reactor-coolant pressure-boundary design pressure. Failure of a sufficient nusber of valves to open may lead to excessive pressure and a potential LOCA conditjon. For the most severe transient, i.e., turbine trip from high power without turbine bypass, eight of the fourteen valves are required to open to

- be successful. (This is included in the MSIV closur v+.)

/ i L j' 8-18 Rev. 5, 0/82 L - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - . - _ _ _

,~e P -- Safetv/Reller Valves Fall to Reclose. The safety /relier valves that open as a result of a transient must reclose to prevent discharge of an excessive quantity of reactor coolant and heat to the suppression pool. The impact on plant safety 1

arises from the additional heat load on the RllR system due to the stuck open relief valve (s). The additional heat load creates a demand for additional heat removal from the suppression pool via the RilR system.

Q -- Condensate & Feedwater System with PCS Unavailable. The condensate and feedwater system coupled with the PCS is used as the normal method of maintaining an adequate coolant inventory in the reactor vessel, while transferring the fission product decay heat to the environment. The

! l

\m / condensate /feedwater system must replenish the reactor inventory within 30 minutes after the initiation of the reactor trip signal to be successful. The large condenser hotwell water inventory permits limited condensate /feedwater system operation wihtout the immediate operation of the PCS. ,

Since the PCS provides the return loop from the reactor to the condenser hotwell, its eventual operation is required for the hotwell inventory replacement necessary for extended condensate /feedwater system operation.

Both the condensate /feedwater system and the PCS are dependent on the successful operation of many of the same sub-systems. Therefo're, if the condensate /feedwater is available

(

1 p) w/ _

following an event, there is a very high probability that the 8-10 Rev. 5, D/82 l - - - _ . .

PCS will also be available. For the condensate /feedwater/PCS to successfully control inventory within 80 minutes and transfer decay heat on the long term, the foilowing equipment or systems must be available

• The condensate-feedwater delivery system is operable and able to deliver water from the condenser hotwell to the reactor vessel. This requires that one condensate and one feedwater pump be operable while the reactor is above j approximately 540 psia, and that one condensate l

l pump be operable when the reactor pressure l

decreases to below approximately 540 psia. Failure of the FW system to remain on-line following the event and the restoration of the FW system given a trip has been considered in the development of FW system unavailability.

• Steam must be available from the reactor to the feedwater pump turbines through the main turbine bypass valves. The main steam isolation valves (2) in one of the four main steamlines must either remain open or be reopened. A turbine bypass valve must open to control reactor pressure during reactor depressurization. If the condenser vacuum cannot be maintained below seven inches of lig, the low vacuum interlocks on the MSIV's and bypass valves must be overridden.

8-20 Rev. 5, 9/82

operator error, failure of the low pressure pumps

• to operate, or hardware failures within the ADS itself. The potential scenarios which could occur and lead to unacceptable core conditions include:

1. Timely ADS initiation does not occur, the core water inventory is depleted, and core melting is 50 to 00 percent complete before ADS is initiated. A cold slug of low pressure water is then injected into the vessel increasing the probability of a reactor vessel steam explosion.

2. Alternately, the manual blowdown which is performed by opening individual valves may result in lowering the reactor pressure, causing increased voids

• and lower power within the. core, while at the same time i .. not reaching the setpoint to allow the low pressure injection system valves to open. Eventually the water inventory will Le depleted and core melting may begin if complete depressurization does not occur.

3. The operator violates the emergency procedure guidelines and waits too long to initiate depressurization. The suppression pool temperature j may rise above acceptable limits due to loss of RIIR, and then, per the emergency procedure guidelines, ADS is not permitted.

i J

(

The probability that the operator will correctly act to depressurize the reactor when required within thirty minutes is assigned a high probability of success based on the foilowing: )

1. Operator training emphasizes that the low pressure systems are the final source of water to maintain adequate core cooling, and that they are only useable when the reactor can be brought to low pressure.

2. The operator has abundant indication of the potential problems which may exist in the core:

[m

• No IIPCI/RCIC/FW flow to the reactor 3-23 Rev. 5, 9/82 b _.

• Water level in the reactor dropping on several lf l

g indicators

8. Minimal other distractions to divert his attention.

The recommended method of depressurization in this case (no high pressure systems available) is through the ADS actuated SRV's. Each ADS actuator is provided with its own pneumatic

f. accumulator for short term use and one safety grade air supply from outside containment for long term use.

The following alternate methods of depressurization are available if required:

1

1. Depressurization through the manual actuation of I individual safety relief valves. The air supply to

\ non ADS metuated SRV's is isolated on low reactor

%) level and high drywell pressure and could require bypassing isolation to provide successful depressurization. A keylock bypass switch is provided.

2. Depressurize through the main condenser. This requires that the MSIVs be opened (a violation of containment integrity if a reactor low level signal is present). It also requires that offsite power and the condenser be available to provide a viable path.

B. Depressurize through the llPCI and/or RCIC turbines.

This implies that while these units may not be able to pump to the reactor vessel, they are not isolated from the steam supply.

While these alternate features are known to be viable methods of depressurization, they involve operator actions under potentially stressful conditions. The probability of successful completion of such actions is difficult to 8-24 Rev. 5, 9/82 ,

I l

RHR GENERALIZED S/R S/R HPCI TIMELY LP RA OR A DRHRM ESTIMATED C OF VALVES VALVES OR RCIC ADS ECCS TRANSIENT SUBCRITICAL EO SEQUENCE D

OPEN RECLOSE AVAILABLE ACTUATED AVAILABLE AVAILABLE DESIGNATOR DEGRADED PROBABILITY CORE TE C M P U X V W CONDITIONS

y. OK -

TW 1.6 x 10-8 CLASS 11 E

TEU* OK -

T" " '

E NA NA -6 T E UV 5.9 x 10 CLASSI

^

y T guX 6.9 x 10-7 CLASS I ta m TP OK -

E T EPW(P) 2.3 x 10 CLASS 11 10- E PU' OK -

T EPUW(P) NEGLIGIBLE CLASSII NA NA TEPOV 5.8 x 10~0 CLASSI 5.3 x 10-2 NA 62x10 -8 CLASS I T E PUX 10-6 TMt TR ANSF ER SEE FIG. 3.4Ae E (5.3 x 10-8y .

3 x 10 -6 T E C" 13 x 10 SEE FIG.3.4.10 l l

• NOT CORE MELT SEQUENCE z " ATWS INITIATOR'S ARE TREATED IN A SEPARATE EVENT TREE

t. TRANSFER TO LARGE LOCATREE Y

$ Figure 3.4.4a Loss of Offsite Power Transient Event Tree

~

, . . . . . . f . ,

s ,

e f 1

W -- RHR snd RHRSW or PCS Unavailable (Containment Heat (s

Removal). The RHR'and RHRSW systems have a dependency on the diesel generators when offsite power is unavailable. The PCS l

~

is unavailable when offsite power is lost. The reasons for dividing the sequences in a time phased diagram (Figure 8.4.4c) for a loss of offsite power are the following:

1. Loss of offsite power for less than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> has the following effects.

• Offsite power available for PCS recovery (needed within 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />)

• Offsite power available for RHR

2. Loss of offsite power for time periods of 4 to 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> is of some concern, because the PCS may not be recoverable in sufficient time to be of use in containment heat removal.

8. Loss of offsite power for periods greater than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> has the following effects:

• The PCS is treated as totally unavailable

• The RilR system is the only available system to perform active containment heat removal.

Initiation of the RllR System can be delayed up to 20 - 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />. The RHR and RHRSW systems can be powered from either the D/G or from offsite power, if offsite power is recovered before 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.

The net result of this breakdown of postulated sequences is that the dominant sequence leading to possible containment overpressure as a result of the failure to remove heat from l

containment is loss of offsite power for a period greater i than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />. The probability that the recovery of offsite power takes more than 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> is estimated to be 8.2 x 10-*

O (See Appendix A).

8-45 Rev. 5, 9/82

I LOW RHR AND GENERAll7ED TIMELY HPCl TIMELY PRESSURE . RM

. DORV SCRAM ACTOR ESTIMATED OR RCIC ADS ECCS- OR PCS SEQUENCE D TRANSIENT INITIATION ITICAL AVAILASLE SEQUENCE ACTUATION AVAILASLE AVAILASLE DESIGNATOR M O pnogagetgyy Tg C',C" C U X V W CONDITION J T* OK -

9.9 x 10-7 TW g S.Sx10-g CLASS 14 T U* OK -

I 8.5 x 10~I T gUW NEGLIGISLE CLASS il

+

4.9 x 10-3 7,7 m 10-5 T g uV 2A x 10 CLA381 2 x 10-3 T g uX BAx10-7 CLASSI

$ 3 x 10-5 T g C** 2.1 x 10 SEE FIG.3A.11 T gC** OK -

Tg CWM 5.0 x 10'8 CLASSII 0.07 T gC'U* OK -

T gC'UWIC'l 5.8x10~I CLASSIl 10-2 0.1 7.7 x 10-5 T gC'UV SA x10 4 CLASEI 2 x 10 T gC*UX 1 A x 10- CLASEI 3 x 10-5 T gC'C'* 2.1 x 10 SEE FIG.3A.11 8 x 10-I T g C"*** 4.2 x 10 SEE FIG.3A.11 E

• NOT CORE MELT SEQUENCE

• • ATWS INITIATORS ARE TREATED IN A SEPARATE EVENT TREE u

• MANUAL SCRAM TOO LATE TO PREVENT A CHALLENGE TO THE CONTAINMENT SIMILAR TO A CLASS IV EVENT e

D w

Figure 3.4.5 Inadvertent Open Safety Relief Valve Transient Event Tree

8.4.8.1 Anticipated Transient Without Scram (ATWS)

The ATWS event can be divided into two distinct portions ,

for discussion and analysis. These are:

1. Prevention: This includes those systen features designed to assure that the control rods will be inserted when required.

2. Mitigation: This includes the systems or features designed to provide a diverse method of reactor shutdown if the control rods cannot be inserted.

Limerick will have an ATWS prevention / mitigation system at least as good as the Alternate BA modification identifed by the NRC staff in NUREG-04GO. This system includes the following major features:

• Redundant and diverse safety grade level sensors in the scram discharge volume'*

• Alternate rod insertion (ARI) circuitry and solenoid valves (discussed further in Appendix B)

• Recirculation punp trip (RPT)

• Automatic standby liquid control (SLC) system to inject boron solution (discussed further in Appendix B)

• Feedwater runback

• A lower MSIV isolation setpoint fron level 2 to level 1.

These improvements are incorporated into the ATYS event frees and ,

the systems level fault trees which describe each function.

The event trees which have been developed to describe the postulated ATWS sequences are given in Figures 3.4.7 through

~

8-62 Rev. 5, 9/82

s 8.4.11. As noted in Section 8.4.1, each of the anticipated I transients has an event tree branch corresponding to the j transient initiator and the fallare of the control rods to insert (i.e., an ATWS). Since each of the identified transient initiators has a different interaction with the mitigating systess available, the ATWS event trees are constructed to parallel the event trees developed in Section 8.4.1 for the anticipated transients. Tables 8.4.2a and 8.4.2b explain the ATWS event tree notes and define the applicable event tree mystes functions. (These tables are located on pp B-84, 85, and SS.)

O l

\

{d 8-68 Rev. 5, 9/82

8.4.3.1.1 Turbine Trip ATWS Initiator The majority of transient initiators result from tu.bine trip or lead to turbine trip. Figure 8.4.7 is the event tree used to identify the potential outcomes of a turbine trip event.

The two cases used in this analysis are turbine trips which proceed as plenned with the condenser available as a heat sink, and those turbine trips with the condenser unavailable due to the closure of the turbine bypass valve, loss of feedwater, or loss l

of heat sink. In the first case, the following occurs: The turbine trips, the bypass opens, the condenser, remains available, and the feedwater is properly controlled to maintain adequate flow from the condenser hotwell to the reactor. The postulated effects of ATWS on the turbine trip are summarized in Figure 8.4.8 for cases with the bypass available: Figure 3.4.8a and 8.4.8b show AIWS prevention and mit8aation, respectively.

Implicit in the construction of the event tree for turbine trip with bypass is the fact that feedwater is available to supply coolant injection to the reactor, as shown in Figure 8.4.7. Cases where feedwater is unavailable following a turbine trip are treated in the MSIV closure event tree (Figure 3.4.9).

In addition to the turbine trip with bypass available, there is a second turbine trip case, for which the bypass fails.

For those cases, the feedwater system could still be available for coolant injection at reduced flows if condensate makeup is transferred from the CST to the hotwell. In the analysis all failures of the bypass valves are assumed to lead to loss of heat 8-64 Rev. 5, 9/82 I ______

7-~

d b V TURSINE TRIP l l TRANSIENT BALANCE TUR81NE CONDENSER NSIVs 8YPASS HEAT SINK RE:1AIN EVENT TREE TURSINE FEED.

OPEN SEQUENCE CONSEQUERCE TRA:ISFER l TRIP WATER T Q A W D

[

7 TT with Bypass Fl9ere 3.4.te (3.6)

.05 ------------------ -----------------

TD titSV Closure Figure 3.4.9e

(.14)

TW TT Without sypass' F;gure 3.4.9e

.95 M -

TWO Figure 3.4.9e

f. M5tV.C.losure

(. )

cn

' P $$

'O'3 3.98 1.0 TAD MSIV Closure Figure 3.4.98

( )

TQ TT Withoutfypass* Figure 3.4.te

.05 1.0 TQD H5IV Closure Figure 3.4.te

(.30)

• All Turbine Trips for Aich bypass to the condenser is not functional, arer considered to be equivalent to MSIV Closure Events. i

! U "" El'u.I'n',"@ 0,li'dTi, d

< Figure 3.4.7 Event Tree Diagram of Accident Sequences Following fone ed by a fauvre to scram a Turbine Trip Initiator. is in progress. The use of the

. tree is to discriminate between I events leading to isolation and i .* those for which the condenser y' remains availab.e y

l

The principal events for the ATWS turbine trip sequence are:

r~~

.(\

Cu -- The mechanical redundancy of the control rod drive mechanisms makes the common mode failure of multiple adjacent control rods unlikely.

Cg -- The electrical diversity in sensors, logic, and scram solenoids help to reduce the potential for common-mode failures leading to failure of multiple rods to insert.

R -- Recirculation pump trip (RPT) is implemented to reduce the effective power level of the core from 100% to approximately 30% with the control rods out.

K -- Alternate Rod Insertion (ARI) incorporates a number of changes including additional sensors, additional logic, and additional solenoid valves on each mechanism to provide added assurance that the postulated electrical failures will not prevent control rod insertion'.

Beyond the design capability to prevent ATWS (which is the preferred method of treating any ATWS case), there is also a combination of systems which can effectively mitigate the consequences of a postulated ATWS. The functions required for ATES mitigation durina the turbine trip event are those identifed in Figure 3.4.8b. Failures associated with these functions are i

discussed below:

C2 -- Poison Injection Failure: For Limerick, the Philadelphia Electric Company has committed to the installation of an automated baron injection system based on

'the NRC staff modification designated Alternate SA. The

]

system selected for Limerick has 3 pumps and is expected to exceed the requirements specifed by the Alternate SA NRC guidelines. The initiation of the poison injection is diverse from that for control rod insertion and similar to

[ \ that for RPT and ARI.

8-68 Rev. 5, 9/82

v. . .

O O O POISON INJECTION COOLANT INJECTION IN ADVERTE NT OPER ATION ME AT REMOV AL GE NER AU2E D ADEO SAFETY ADS NOT PW OR MPCI APPROxsMATE CLASS OP CONTROL RODS iwo og POSTULATED F AtL TO ONE PRES $URii VALVES HPCl ACTUATED DOES NOT BOTH ONE PROSAstLITY THR,E E RECLOSE OR RCIC RMR$ RMR SEQUENCE LE VE L (PER OEGRADED INSERT SL SLC CONTROL AUTOMAT- CONTINUE pg.jpg PUMP FW ICALLY TO RUN RE ACTOR YE AR] CORE CONDfTIONS Ty'Cpy+ Ty 'CE K C 12 C2 M$ P d U UR D UH "2 "12 TC g OK -

"' 4 CLASS (V TT'C g g U SA e 10 2 a 10 Ty'Cg D SA a 50-0 CLASSIV Ty'Cy U OK -

T'O CLASSIV T MUW NEGUGISLE 0A1 [ 2

' Ty'Cg uW 12 NEGUGISLE CLASSIV 10 g CLASSIV TyC gW g NEGUGisLE 10 4 m to CLASS IV Ty'Cg UO NEGUGISLE 0.18 I NEGUGsSLE CLASS til Ty Cg UU, TT 'C g P OK ~

g0A1 ~8 I

y C PW g 2 3.4 a 0 CLASS altMV*

2 a 10 Ty'Cg Pu g NEGUGisLE CLASSIV (d O.g 2 a 10 Ty'Cg PD NEGLIGia LE CLASSIV OA73 Ty'CuPU 2.7 m 10 CLASSHI 10 Ty'Cg M 3.7 s 10~O CLASSIV Ty'Cg C 12 OK -

-4

,g S TT 'O M 12 C gU NEGUGIBLE CLASStV 2 m to TT'OM C 12D NEGUGIBLE CLASS 8V OA73 Ty 'C g 12CU 1.4 a 10-8 CLASS Ill

, TT 'C g 12CP OK -

' Ty'Cg C12P "2 NEGUGisLE CLASS Hl/fv*

' T,'Cuc,,PU, =EGuGesLE CLAS$ev at 2 a 1d Ty'Cg Cg NEGUGiBLE CLASS IV y

• S NEGuGisLE CLASSna 3, , ,,- 2 Ty'C,C,,PU 10 1 y y g 12 CC M NEGUGISLE CL/6 eV

[ OM y yCC1 1Ae10-I CLASSsusV e g g2 N

CD 'THESE SEQUENCES ARE 80% CLASS ul AND 20% CLASS GV N ALL NOTES ARE IN TASLE 3.4 2e Figure 3.4.8b Event Tree Diagram of Postulated ATWS Accident Sequences Following a Turbine Trip Initiator Y- \s h.. - -

. l.

5

O P - All Safety Valves Do Not Reclose: While the large member of relief valves provides high reliability of l

maintaining pressure within the reactor system capability, the probability of leakage, or stuck open/ inadvertent open relief valves must be considered.

U - Failure of Coolant Inf ection: Initially reactor coolmat is injected via the feedenter system. For those cases, HPCI and RCIC are not initally required. For those cases where SORVs result in forcing the closure of the MSIVs, HPCI is required to maintain adequate coolant injection. As noted in the success criteria (Section 1.5), RCIC is conservatively considered inadequate for SORV or those cases where only one SLC pump is available. The event tree is constructed to reflect this requirement.

D - ADS Actuation (Inadvertent Operation): During the course of an ATWS event, the drywell pressure may rise and the reactor water level may drop. Due to calibration errors or instrument drift, sufficient automatic signals may exist to initiate ADS. T1.e operator is required to inhibit ADS to prevent potential boron dilution until the automatic initiation signals clear. The consequences of such an incident are similar to those evaluated for Class IV, since the containment loads associated with blowdown at high suppression pool temperature may lead to containment failure.

O 8-71 Rev. 5, 9/82

U - FW or HPCI Continue to Run (Inadvertent Operation):

A Following poison injection and reactor shutdown, it is required that feedwater and HPCI be shut off to avoid poison removal / dilution from the reactor vessel. The shut off of the high pressure systems can be accomplished either by the automatic high level trips or manual action. Feedwater rumback is also initiated automatically by AIYS signals.

M - Failure of Containment Heat Removnl: The ability to remove decay heat from containment is a function which helps to avoid the release of radioactive material to the environment. The systems available to fulfill this function ares e The normal heat removal path through the condenser e The RHR heat exchangers For the turbine trip with bypass transient seqwences, the heat sink used for nearly all cases is the main condenner.

For those cases where multiple relief valves fall open, the analysis conservatively requires the RHR to operate successfully on the assumption that the MSIVs will close.

Other sequences which result in isolation of the reactor from the main condenser are treated in the MSIV closure event tree.

All of the ATWS sequences are subject to some d- uncertainty with respect to the plant response. In lieu of 8-72 Rev. 5, 9/82

detailed analysis or extensive operoting experience for the two dominant sequences, several consersci'ive assumptions have been made to allow the estimation of accident sequence likelihood.

The two turbine trip ATWS sequences with the largest impact on calculated prohmbility of risk to the public are the following:

1. Sequence:

! Turbine Trip, Failure of Control Rods to Insert, Failure of SLC (TT1 CM C2) l Anticipated Result l With RPT, the power level is reduced to about 80%.

l Steam flow corresponding to about 25% power is routed through the turbine bypass valves to the main condenser and feedwater is supplying makeup to the reactor. The remainder of the steam is discharged through the SRV's l into the suppression pool where best is removed by the RRR. For purposes of this analysis, it was O conservatively assumed that this condition would eventustly lead to MSIV closure and loss of the PCS.

The result is a sequence leading to contaissent failure prior to core melt, a Class IV event.

2. Sequence:

Turbine Trip, Failure of Control Rods to Insert, Failure of RPT (TT1 CM R/IT1 CE 'R)

Anticipated Result:

For turbine trip with ATWS, RPI failure is assumed to result in unacceptable fuel conditions before SLC can effectively reduce reactor power. This is indicated in the success criteria in Table 1.8. Since RPT and feedwater rumback are tripped from the same set of logic and sensors it was conservatively assumed that RPI failure would also result in failure of feeddater rumback and re criticality due to dilution of the boron.

The increased power and steam flow were assumed to be beyond the capacity of the turbine bypass values and RHR, resulting in a Class IV event.

8-78 Rev. 5, 9/82 I

,,, . f% '[ Y g s

\ ,/ s/ v/

POeSON INJECTION COOLANT INJECTIOas lesADVERTENT OPERATIOss MEATREMOVAL ADSNOT Fw OR HPCI ANNAII CLAgg gy CONTROL ROOS TWO OR ONE ADEO SAFETY HPC8 PROSAssuTV PRESSURE VALVES TED DOES NOT SOTH ONE POSTULATED F AIL TO THREE og SEQUENCE LEVEL (PER CONTROL RCBC ACTUA,8AT-AUTO CDesTessuE RMRS RMR DE69tADED sNSERT SLC ,SLC, yg RECLOSE ,a REACTOR PU,sPS sCA*.LY TO Ruse LORE

"^"' coNo87'o**

7,2c,, . 7,2C, a C,, C, g@ ,@ U u, a ug w, w,,

7,Cu ou .

ny 1,Cgwy OK .

10.30 T,0 wgg 1 A e IO~ CLASS 881/IV*

2 a 10-8 T,Cg ug 3,y ,30-8 CLASSIV j

2e10-4 T,Cg D 3.7 a 10'O CLASSIV 7p".gU og .

0At , OK -

i

~j 10Je T,CgUwgg gJ m 10~ CL ASS itIJrV * '

10~8 T,Cg uug NEGLaGeeLE CLASStv 0A73 4 a 10 -4 T,CguD e#EGL8G80LE CLASS IV 0.15 T,C,,UUn 2.3 a 10*I CLASS 688 T,CgP Ost -

l es' T,CgPw2 2.1 e 10-8 CLASS III/IV' 2e10~4 T,CgNg NEGUGeelt CLASSIV y a, 2.iO-* 7,C ,Po NEGuGietE CLASStV OA73 T,Cg PU qAa10*I CLASStes 10-4 FM M 2J m 10-0 CLASSSV T,C CM 12 OK -

0.9 F M 12 2 NEGleG4GLE CLASESH/IV'-

i l0Je T,C Cg 12"12 8'EGUG'#LS CLASSalsAV* f 2 a 10 d 2J4 = 10-9 7,C Cg 12U n NEGuGleLE CLAS8IV 2neQ~4 T,C Cg 12 D esEGUGt9LE CLAN tv OA73 T,C CM 12 U CLASSell 8#EGUGISLE 7,C ,C12P Ost -

1 0.1 T,C Cg 12'"2 BeEGUGISLE CLASSHtAV*

2 m to 7,CgC12 PUw NEGUGastt CLASEIV 13 30~3 gg 2 go-T,C Cg 12 PO NEGuGISLE CLASSIV 5' ,,n

< 7,C.,C,2Pu EGuG. La CLASS *

,,- 7,C.,C,,M .sEGoG .a C- .V y ,,, T,C,,C, 24. ,0 * -

CtASS inav-e ALL NOTES ARE Pu TAgLE 3 4.2a 'THESE SEQUE NCES ARE 80% CLASS tel AND 20% CLASS IV w

Figure 3.4.9b Event Tree Diagram of Postulated ATWS Accident. Sequences Following an MSIV Closure Initiator

1. HPCI when at.least one 48 gym SLC pump is available

(~s for boron injection. Shutdown is calculated to

.( occur within 16 minutes for two SLC pumps operational and 80 minutes with one pump operational.

2. RCIC when two or more SLC pumps are available for boron injection. (conservative)

The other sources of high pressure water have not been emplicitly used in,the reliability evaluation of the coolant injection fenetion since analysis does not predict that adequate coolant injection will occur from any combination of these sources.

W - Failure of Containment Heat Removal The probability of having adequate heat removal available is a function of the RER reliability under the various conditions set in the specific accident sequences. For example, multiple stuck open relief valves (P) is treated with a conservative assumption that one RHR subsystem must 9perate.

Because of the relatively short time available for the initiation of RHR following a posulated ATWS, the calculated probability of RHR failure is dominated by human error in falling to align and initiate the RHR.

Discussion of ATTS MSIV Clo=ure Accident Sequences The MSIV closure initiator, followed by a mechanical failure of the control rods to insert, places a demand on three safety systems which are provided to prevent degraded cere conditions (see Section 1.5). The accident sequences which would result from a failure of each of these safety systems could be quite different in their impact on risk. The following discussion outlines the course of each accident sequence as developed in the Limerick analysis 8-77 Rev. 5, 9/82

( SEQUENCE l ANTICIPATED RESULT TCC pg2 This accident sequence is similar to that discussed for the turbine trip ATWS initiator followed by failure of liquid poison injection. The physical processes which are included in the modeling are:

e Recirculation pumps trip and power level drops to N 30%.

l l e The HPCI maintains adequate coolant inventory to the f reactor, e All heat is being deposited in the suppression pool. l e 3 SLC pumps fail to inject poison.

e Containment pressure rises to containment design pressure.

HPCI may shut off due to high turbine exhaust pressure.

e Based on the decisions made probabilistically, the con-tainment may fail:

a. prior to core melt initiation with HPCI continuing to run. This sequence is included in Class IV since radio-active releases may be emitted directly to the CT atmosphere during the core vaporization.

O

b. following core melt if HPCI terminates as it is designed to. This sequence is included in Class III since the containment still serves the function of retention and deposition of radioactive material during the core melt /

vaporization process.

T pg C UU R This sequence is the failure to provide adequate coolant makeup to the reactor. The physical processes involved in this '

l sequence are:

e Recirculation pump trips and power level drops to % 30%.

s With the MSIVs closed, feedwater is unavailable, o HPCI and RCIC fail.

.e With no coolant injection, the core water level drops.

e With the loss of coolant inventory, core melt is initiated.

e Containment pressure is relatively low.

e Containment is calculated to fail in a manner similar to n Class I -- after the core vaporization phase.

U 3-78 Rev. 5, 9/82

r 7s SEQUENCE ANTICIPATED RESULT b-(

l ' L} The result of such a sequence is that initiation of degraded core conditions and postulated core melt would occur with the i

containment intact. This is typical of Class III accident sequences.

TCC 0 p g 12 This sequence is'similar to that noted above for loss of coolant inventory, however, in this accident sequence one SLC pump leg is available for injection. RCIC is insufficient ** to maintain adequate coolant inventory (see the ATWS Success Criteria in Section 1.5). Therefore, for sequences with one SLC, where the HPCI system provides coolant injection, its failure leads to Class III events.

TCW pg This sequence involves the inability to adequately remove heat from containment using the RHR. The physical processes involved are:

e The recirculation pumps trip and power drops to % 30%.

e Both HPCI and SLC start automatically to maintain coolant inventory and provide negative reactivity for core shutdown.

e However, since there is no heat removal from containment (MSIVs are closed and RHR has not been initiated) contain-ment pressure continues to rise, o The two options which may occur following this accident scenario are:

a. Loss of HPCI due to high cont.ainment pressure

• leading to core melt initiation with a intact containment. This is a Class III event.

b. If HPCI continues to run, failure of containment may occur prior to initiation of core melt. This sequence is a Class IV event.

• Turbine exhaust pressure trip.

• • Conservative 7

3-79 Rev. 5, 9/82-L

g_ ~~

3 A

^

O O O pot 90N INJECTION COOLApeT INF.CTIOas INAOvf ATEas? OPERAT10ss MEAT REasOVAL G&asERauzte CONTROL MODS Two OR .ADEO SAFETY ADSNOT Fw On HPCI -

APPROutteATE CLAABOf ONE HPCI POSTULATED P AtL TO THREE PRESSURE valves ACTUATED DOES NOT SOTH ONE PROSASIL8TV RCIC RHR$ RHR SEQUENCE LEVEL lPER DEGRADED IssSERT SLC CONTROL RECLOSE O y ,R AUTOesAT- CONTessuE PUMP 5 0CALLY TO RU88 REACTOR CORE 3 Un Un W2 V' ' '

Yg C u ' T,3CF g

C 12 C2 M S P@ U D. *tt Tkg u Ost . = ,

T E 8C ,w, o.05 , On .

I& 78 Yag cy ,,y , a , se 4 class nev* ,

2eu d y g 3Cg u, esEGuGacLE CLASSev 2 a-* - 7,2C ,,o NEGuG .u Cum tv T8 ECuo C" -

OM i Tg k,Uw 2 " ~

I " Y g I C,Uw 2.4 a 10 4

CLA$$ 18@v*

12 Yg 3Cu MUU NEGU(elSLE CLAaBtv -

Ot 4mm d T3 "'WO'"E E" '#

E Cy uD Tg I C,UU, 2.4 a to - class pas .

, T g 8C,P . m .

'"" T E 8C .Pw, u .io-* CtAss neve T g 8CgPU , NEGuGISLE CLAgggy W

0.1 2 e 10 TE3Cm 0

u esEGuGieLE class sv

' 03 0.1 a Tg CasPU SA a 10 CLASE tes 3 NEGuGitLE N " IV TgCM g Tg C,C,3 Ost .

an i TE*C C.,w, O.c .

IIL71 i

Yg 3C ,C,,w,3 esEGuGacLE class u@vs 2 e 10 S.4m10-7 Tg 3Cy C 12 Ug NEGuGeSLE CLAS5sv Tg CC g 12D esEGuGe8LE M = tv 0.1 Yg C C,3U 8eEGuGsSLE CLASSHe u

, T,8C,C,,P Oc .

n 0.94 T E 3C,,C12 " teEGuGIBLE CLASSev 2a10-4 3, E 12PUM 8sEGuG88LE  ?.LASSev 1A 10-3 0.9 2 e 10-8 pt2 T 3C,,C NEGUG88LE CLASBev E 12 H at

<d, Tg g,,C,yPU NEGUG89u ' M na "4 TE 'C.C12= NEGuG u CLA=

w .

TE'C.s 2 C ==G ue=E Ctas...v.

ALL esOTES ARE tas TASLE 3.4.2a *THESE SEGJENCES ARE 80% CLASS til AND 20% CLAsE IV w

Figure 3.4.10b Event Tree Diagram of. Postulated ATWS Accident-Sequences Following a Loss of Offsite Power Initiator

WW' ~

,:4 O o -

o~

POISON 6MJECTION COOLANT 6MJECTION INADVERTENT OPERai&ON HEAT REn80V AL l

CONTROL RODS TWO OR ADEO FETY

' ~

C ONE HPC9 A W ATED NSW SOTH ME 3 F AIL TO THREE g PFIESSURE VALVES OR POSTULATE D IpsSERT C8C AUTOMAT. CLWT6NUE RHRS RMR IEOUENCE LEVEL (PE R SLC y CONTROL RECLOSE FW DEGRADEO PuesPS ICALLY TO RUN REACTOR COftt R

T,"CE E + T,"C, C,y C2 uW P@ U Un o Ug 2 "12 l T,*C, Osc -

DD1 2 0 ~

l C i *** T,*c w,, S.1 10

• class umV-2 e 1d y,4Cu NEGUGeeLE class av y g T,"Cy D NEGUGl0LE CLASB tv 01 y 4Cu 4 g g 4.4 s 10 CLASS tat

, T,4Cr y OK -

W I ' T,"Cy M y 6.4 s 10

• CLASSIV J TgCyPU g NEGUGleLE CLASSIV W 0.g 4 = 10 4

y e#C,,PD NEGuGeLE CLAR N O1 g g 4C,PU 2.1 s 10 CLASSR1 10 " T,"Cg M NEGUGasLE CLASSBV T,*C ,C 12 OK -

3 E' T,8CCg 12*2 NEGUG1SLE CLASSseUIV9 2 e 10 4 yy C,C12Ug NE W G40 W MN 4m to y 4CC 0 CLAABtv g y 12 NEGUGisLE 01 4 U yCC g 12 EGUGleLE CLASS 181

, T 'C c' u iz 0" ~

n'o T,*C,,C,,Pw, NEGucietE class u** * )

.T 2 '0-* T,*C,C,,PU,, NEGuG=Le class N gg 4m10-0

]4 C,C yyPD asEGuG89LE CLAaB N y ,,,,,_. of 7,*C,,C,,PU =souereta CtAm an g

I 10-* "1 ASS N 7, C,C,3 es NEGuGacLE 038 Tg CC uy 2A e 10 CLASS 88WW M

ALL NOTES ARE IN TABLE 3 4 2n *THESE SE QUENCES ARE 80% CLASS fu AND 20% CLASS av Figure 3.4.11b Event Tree Diagram of Postulated ATWS Accident Sequences Following an 10RV-Initiator

l O -

Table 3.4.2a l NOTES FOR ATWS EVENT TREES 1 Estimated probability for these branches has been considered in Figure 3.4.1.

2 Heat removal capability from the suppression pool may be coupled to " safety valves fail to reclose."

Therefore, a different probability of failure is applicable depending upon which sequence occurs (i.e.,

PW is treated as a distinct type of event).

3 For the inadvertently open relief valve transient, the scram and ARI are initiated manually; therefore, the probability of success must be modified to account for this.

4 Adequate pressure cont *rol has three meanings in these event trees. Each function must be fulfilled or un-acceptable consequences result.

5 The scenario following control rod insertion is that developed in WASH-1400, however since ARI was not con-sidered in WASH-1400, a success of this function repre-O- sents a reduction in the probability of unacceptable consequences calculated in WASH-1400.

1 0

3-84 Rev. 5, 9/82

(

Table 3.4.2b O DEFINITIONS OF FUNCTIONS OF EACH SYSTEM APPLIED IN THE ATWS EVENT TREE DEVELOPMENT l

DESIGNATION SYSTEM FUNCTION C

M Reactor Protection The RPS has been divided into electrical and System'(Mechanical) mechanical functions for this study. The

~

' mechanical function includes the opc i :on of the CRD hydraulic system,, the physical insertion of a sufficient number of contol rods to bring the reactor subcritical, and other mechanical parts as required.

C E

Reactor Protection This portion of the RPS includes proper System (Electrical) generation of a scram signal from the sensors, processing the signal through the logic, and tife de-energizing of the scram solenoids.

C 2

Poison Injection Termination of nuclear fission is required to assure containment and core integrity. Note that' delayed control rod insertion has not been assumed.

R Recirculation Pump This system is designed to be completely Trip diverse from the RPS (both electrically'and mechanically) in order to gucrantee that either the RPS or RPT will function. The RPT is intended to trip the recirculation pumps which will reduce the flow through the core and lead to reduced moderation in the core and lower core power level.

I E tv meat Isolation In the event of an ATWS provision must be j made for preventing the release of radio-

' active material to the environment. One method is the isolation of containment which includes 'the closure of the MSIVs (see also secondary containment isolation).

V Isolation of Balance One potential scenario which could occur of Plant Systems '

following an ATWS is the removal of reactor

.ieat through the condenser via turbine bypass ,

valves. The secondary system will function I properly to remove heat from the reactor as long as high radiation levels are not sensed, low level (level 1) is not reached, and low steam line pressure (e.g. LOCA) ~does not occur. Therefore, operation of the PCS to remove heat is dependent upon the severity of the ATWS event, namely, the fuel integrity and water level following an ATWS.

85 Rev. 5, 9/82

8.4.8.1.8 Loss of Offsite Power ATWS Initiator An accident initiator which directly affects the reliability of the mitigating systems is the loss of offsite power. This initiator leads to conditions similar to the MSIV closure, with the added requirement that some of the safety systems depend on a diesel generator for the necessary power.

The event tree for tais initiator is given in Figure 8.4.10 and is nearly identical to that for MSIV closure, except that the initiator frequency'* is lower than the MSIV closure frequency, but the probability of failure of the mitigation systems is higher, due to the dependency of the safety systems on the emergency diesels.

8.4.8.1.4 Inadvertent Open Relief Valve AIVS Initiator (See Figure 8.4.11) l The 10RV accident initiator is a relatively frequent event that may require manual initiation of scram and RIIR.

Therefore, the human error rate has a significant effect on the calculated probability of successful accident mitigation. (See the discussion in Section 8.4.1) 8.4.8.2 Reactor Pressure Vessel Failure Disruptive failure of the reactor pressure vessel is not incorporated in the Limerick analysis because a scoping analysis indicated that potential failures 8-87 Rev. 5, 9/82

t- _

Table 3.5.5

SUMMARY

OF' SEQUENCE FREQUENCIES (PER REACTOR YEAR) BY CONTAINMENT FAILURE MODE FOR DOMINANT SEQUENCES OF THE CLASS III VARIETY CONTAINMENT FAILURE MODES DOMINANT a 8 .u ' y .u .y' ' y" tc.6c c.6 SEQUENCES 0.001 0.002 0.256 0.222- 0.025 0.078 0.42 TfCPWg 2 2.7x10-11 5.4x10-II 6.9x10-9 6.0x10'9 6.8x10-10 2.1x10'9 1.1x10-8 2.7x10-10 5.4x10-10 6.9x10-8 6.0x10-8 6.8x10 4 2.1x10-8 1.1x10-7 TfC g PU TfCC y 12 U 1.4x10-12 2.8x10-12 3.6x10-10 3.1x10-10 3.5x10*II 1.1x10-10 5.9x10-10 TfCC g2 8.0x10~II 1.6x10-10 2.0x10-8 1.8x10-8 2.0x10'9 6.2x10'9 3.4x10-8 2

Tp CR 4.4x10-12 8.8x10-12 1.1x10 9.8x10-10 1.1x10-10 3.4x10-10 1.8x10 4

E Tp2CR g 2.2x10-12' 4.4x10-12 5.6x10-10 4.9x10-10 5.5x10'II 1.7x10-10 9.2x10-10 2

TpCW g 12 1.4x10-10 2.8x10-10 3.6x10-8 3.1x10-8 3.5x10'9 1.1x10-8 5.9x10-8 7.5x10-10 4.0x10 4 2

TpCW g 12 9.6x10-12 1.9x10'II 2.5x10-9 2.1x10'9 2.4x10-10 2

TpC gUU R 2.3x10-10 4.6x10-10 5.9x10-8 5.1x10-8 5.7x10~9 1.8x10-8 9.7x10-8 2 4-TpC gPW 2 1.7x10'II 3.4x10'II 4.4x10 3.8x10-9 4.3x10-10 1.3x10'9 7.1x10 2

TpC gPU 1.6x10-10 3.2x10-10 4.1x10-8 3.6x10-8 4.0x10 4 1.2x10*9 6.7x10-8 2 9 Tp CC g2 1.6x10'II 3.2x10-II 4.1x10-9 3.6x10'9 4.0x10-10 1.2x101 6.7x10*9 O- TECW g 12 1.1x10~II 2.2x10-11 2.8x10~9 2.4x10'9 2.7x10-10 8.6x10-10 4.6x10 4

.T E CWg 12 1.9x10-12 3.8x10-12 4.9x10-10 4.2x10-10 4.7x10-11 1.5x10-10 8.0x10-10 TECgUU R 2.4x10-II 4.8x10'II 6.1x10-9 5.3x10~9 6.0x10-10 1.9x10~9 1.0x10-8 3

TEC gPW 2 5.4x10-12 1.1x10-II 1.4x10-9 1.2x10'9 1.3x10'I'I 4.2x10-10 2.3x10-9 T

E MPU 5.4x10-12 1.1x10*II 1.4x10~9 1.2x10~9 1.3x10-10 4.2x10-10 2.3x10 4 Tg4CW g 12 4.5x10-12 9.0x10-12 1.2x10~9 1.0x10~9 1.1x10-10 3.5x10-10 1.9x10~9 TkU g g 6.4x10-II 1.3x10-10 1.6x10-8 1,4x10-8 1.6x10 4 5.0x10'9 2.7x10-8 4

TgCgPU . 7.1x10-12 1.4x10-II 1.8x10~9 1.6x10-9 1.8x10-10 5.5x10-10 3.0x10 4 4

Tg CC g2 1.9x10-12 3.8x10-12 4.9x10-10 4.2x10-10 4.7x10~II 1.5x10-10 8.0x10-10 AE/AI 1.6x10-12 3.2x10-12 4.1x10-10 3.6x10-10 4.0x10~II 1.2x10-10 6.7x10-10 APPROXIMATE IU '1.1x10~9 2.2x10'9 2.8x10~7 2.4x10~7 2.7x10-8 8.5x10-8 4.6x10~7 SEQUENCES O

3-105 Rev. 5, 9/82 1

o. _

8.5.8 Section Deleted 8.5.4 Quantification of the Containment Event Tree The two containment event trees which describe the possible paths of radioactive release from containment, and the numerical values used in the evaluation, are given in Figures 8.5.Ga and b. The reason for two separate sets of numerical values for the containment event tree is that Class IV containment failures are assumed to be relatively rapid overpressures for which containment leakage before rupture is much less likely than for the relatively slow overpressure failures postulated for Class I, II, and III. A discussion of probabilities used for each of the containment failure modes is provided below, o --- Steam Explosion (In-Vessel). Full scale testing of the potential for coherent steam explosions when molten metal comes in intimate contact with water has not been performed. Xn an l

attempt to identify a probability for a coherent steam explosion inside the reactor vessel of sufficient energy to fall containment, the following evaluations were considered:

• Fauske Associates provided an analysis of the Limerick m_

design to determine if the required conditions axist for a coherent steam explosion in the reactor vessel which would have sufficient energy to overpressurize containment. Their conclusion was that the coherent steam explosion appears to be impossible (see Appendix II) .

=

8-118 Rev. 5, 9/82

. . , . . . _ _ . - - - - - . - . = - - - - = - - - - - -

< a

.y f'%  !

i

' ],

ONT QUALITAftvE COREHI OVE E

, DET A ION CONTARMENT p T, SU*PR 5840N CONT A NMENT NO SGTS OVE E , A Su P OVEMEME E E SEQUENCE fN ir ESSE L CONTAsNMENT

, F A! LURE F AILURE TO PREVENT

'A I F ASLURE NELL) (LARGE) M CFM W N e w NT OVERPRESSURE gwgyngtg F ALLURE MODE 'l CM e a P n' e 7 - Th rh tA e.

On 4 0.001 -

i estoRvWeau , o,g3 OVERPRESSURE ORVWELL e sus 09 OVERPRES8uRE

9. . SW OSINETWELO WE TW7L L <

01 ,. SUPPRESSBON POOL 0 080 P Altuftt 4 4 0 0001 SMALL LE AK N* 4( 4 0 0001 " ALE LI""*

ante-4 SGTS F A8L 8tRE N f. 4 0 0151 LARGE LE AK -

0S

- LARGE LE AK,3GTS of A 0000t RADEOuATE ,,

.w, 00s

.,. 00 0 OvE-ESSU E a IO et ,,. 0 0010 WSTANTANEOUS O ICONOtTION A LI OVERPRESSURE w G oe,

, ,,,,,, ENERGETie OVE RPRE SSURE 0 001 ENE RGE TIC

, g G010 OVERPRESSURE It 3 CONTAINMENT FA6 LURE MAY MAVE OCCURRED PRIOR TO CORE MELT.

IN THOSE CASES ICLASS It AND CLASS DVL THE CONT AINMENT F AILURE MODES ARE ONLV USED AS MECHANISMS FOR RELEASE FR ACTION OE TERMINATION.

(2) ASSUMES THAT M2EMPLoseON IN CONTAINMENT CAUSES OVERPRESSURE F AILURE WITH DeRECT PATHWAY TO OUTSsDE ATMOSPME RE.

WLEAR AGE ATL400 VOLUME PERCENT 80AV, 141F AILURE STAND 64 GAS TRE ATMENT SYSTEM r

I i-

. :e 44 4:

!- .u e

r N

E Figure 3.5.6b Containment Event Tree for the Mark II Containment for Class IV Event Sequences i

i

(g W p'- Hvdrogen Burn or Explosion in Containment. For the

-\ 1 inerted Limerick containment, the possibility of a hydrogen detonation or burn appears quite remotes however, according to the tentative technical specification there may be short periods of time when the plant is operating at power and the containment is not fully inerted. This is anticipated to occur following reactor startups and prior to shutdowns. Based on past PECo i

experience and projected Limerick operating procedures, the probability of the plant not being inerted while operating at power was considered to be 0.01. ReJative to this 0.01 probability of not being inerted at power, if a core melt occurs during this time, then the probability of a burn or detonation sufficient to cause direct overpressure release, with a significant increase in the radioactive release fraction (i.e.,

comparable to a containment steam explosion) is no larger than 0.1. This leads to a probability on the order of 10-8 f'or the au prime failure mode. However, the probability of some hydrogen burn (mu) remains at 0.01. This may lead to a drywell l

overpressure release and is included in the gamma containment l

failure mode.

1 O

3-117 Rev. 5, 9/82

v" -- Wetwell Failure. The probability of a failure of containment which results in the loss of water in the suppression i pool is evaluated based upon the Bechtel analysis which indicates that the points of highest stress in the wetwell are near the nominal waterline in the suppression pool. It is assumed that the probability of a failure large enough2' to drain the pool

- below the downcomers is approximately 10% of the probability that

the failure will occur in the wetwell. Therefore, the probability of V" used in the Limerick analysis is 0.025 for Class I, II, and III, and 0.05 for Class IV.

p

?

(/6 -- Large Leak. If a leak in containment does occur prior to failure, then the question arises as to the size of the leak.

( is the probability that the leak is greater than an equivalent 6" diameter hole in the drywell. This size hole is r-insufficient to fall the secondary containment blowout panels, but does lead to overloading of the standby gas treatment system.

The state of knowledge of the size of the postulated leaks is such that it leads to an estimate of equal frequency of occurrence for both postulated leak sizes ((/6 - 0.5).

w-3-120 Rev. 5, 9/82

Table 3.5.14

SUMMARY

-- GENERIC ACCIDENT SEQUENCE / RELEASE PATH COMBINATIONS CLASS PRO 8 ITY R E CLASS I CLASS !! CLASS III CLASS IV A a 1.2x10-8 9.6x10-10 g,g,yg-9 1.3x10-10 1.5x10-8 8 .a ' 2.5x10-8 1.9x10 2.2x10 f.5x10-10 2.9x10-8 y .u 3.2x10-6 2.5x10'I 2.8x10'I 6.4x10-8 3.8x10-6 y' 2.8x10-6 2.1x10'I 2.4x10'I 5.6x10-8 3.3x10-6 y* 3.1x10'I 2.4x10~8 2.7x10-8 6.3x10 4 3.7x10'I tc.5c 9.7x10'7 -8 7.5x10-8 8.5x10 2.5x10'II 1.1x10-6 c.6 5.2x10-6 4.0x10'I 4.6x10'I 2.5x10'II 6.1x10-6 fS ^L" 1.2x10

-5 9.6x10'I 1.1x10-E 1.3x10'I 1.5x10' I

Figure 3.5.7 indicates that the highest probability scenarios /are those involving a coupling of core melt accident sequences with postulated containment overpressure failures. The in-vessel steam explosion and con-tainment steam explosion scenarios both have significantly lower probability than the others. However, the conseqt nces for these scenarios tend to be O. larger than for overpressure failures. The postulated leaks are of relatively h',gh probability, but they have smaller consequences than the containment overpressure failures.

1 10 i

y 1.0 -

7 -

g & ,

s - .

w 10-1 CLASS 1, CLASS -

h l!i " .

=

s to-2 - i b .-

8 -

^

,o-a - --- >

~

a go -4 %x a o./ v.u ,' ," ta. s e t. s CONTAINMENT FAILURE MODES Figure 3.5.7 Probability of a Radioactive Release Given a Severe Degradation of Core Integrity -- Presented by Containment Failure Mode for All Classes.

3-125 Rev. 5, 9/82

Upon initiation of core melt, radionuclides will be released by all the potential physical mechaniswa, but for the purposes of modeling and discussion it is useful to talk of four separate time phases of release. The four major radionuclide release phases considered in the CORRAL model are:

Gap: The nuclides are released as a result of the fuel rods breaking. This is the first release to occur in the ,

accident. The radionuclides are passed to the containment via the safety relief valves or a reactor system leak or rupture.

Melt: This release occurs after the core has been uncovered and it begins to melt. Fission products are then released for one to two hears. At 80% core melt, the core is assumed to slump to the bottom of the vessel and begin to attack the lower head.

Vaporization: This release occurs after the RPV falls in the O bottom head due to the attack by the molten core. The core remnants then fall to the diaphragm floor and interact with the concrete releasing nuclides to the drywell atmosphere.

The release continues for several hours and decreases exponentially with time. l Oxidation: Particulate nuclides are released into the wetwell vapor region from molten core falling through the downconers into the suppression pool and causing small scale steam explosions. This release da almost instantaneous.

The radionuclides emitted from the above releases are divided into seven species and further classified into one of three types because of their chemical properties. The seven species of nuclides, and their appropriate classifications, that are considered in the Limerick PRA analysis are chosen to parallel those chosen in WASH-1400 and are the following:

s 8-128 Rev. 5, 9/82

Containment failure after the various releases (gap, melt, oxidation, vaporization) results in the radionuclides from each release accumulating in containment and then being released to the atmosphere. If containment failure occurs prior to any of the radionuclide releases, without the benefit of longer accumulation in containment where natural deposition or plateout has a larger influence, the radioactivity may be released directly to the atmosphere.

The containment conditions which have the most effect on the radionuclide releases are described below for each of the accident sequence classes:

1. Class I: Cases involving a loss of cooling to the core are evaluated to result in a core melt with an intact containment. The containment conditions are such that 9 the containment pressure just prior to meltthrough of the reactor vessel is slightly higher than atmospheric and the suppression pool is subcooled. Therefore, the radionuclide release fractions are calculated for containment conditions for which the containment is l intact throagh a large portion of the core vaporization l phase.

O

TABLE 3.6.5 RADIONUCLIDE AELEASE PARAMETERS AND RELEASE FRICTIONS FOR I

DOMINANT ACCIDENT SEQUENCE CLASSES AND CONTAINMENT FA:LU:E MODES LIITED IN TABLE 3.5.14 WtRNING CONTAINMENT UI CRAC (h) pg g y TIME OF UI DURATION TIME FOR ELEVATION ENERGY INPUT RELEASE OF RELEASF EVICUATION OF RELEASE RELEASE GROUP SEGUENCE (Hr) (Hr) (Hr) (feet) (106 STU/Hr) ggi a Steam C ,C 3 3 2.0 0.5 1.0 82 130

[

explosion C 2

39.0 0.5 3.0 82 130 f and C 4 2.0 0.5 1.5 82 130

! hydrogen 6.v' Release parameters used for CIRE h explosion C 1 C,C,C 2 3 4 h.0 0.5 3.0 82 120 l i

OPREL y.u Release parsneters used for O'REL Dryvell Cg l7.0 2.0 6.0 82 120 l

[ and vetvell C 2

37.0 2.0 7.0 82 1.0 overpressure C 3

7.0 2.0 5.0 82 120 failure Y' including

• 3. C3 7.0 2.0 6.0 82 120 hydrogen burn 2 37.0 2.0 7.0 82 1.0 g y Release parameters used for C41

W failure C 4 (1. 5 2.0 1.0 82 1.0 l prior to melt y'

?

^} !

CM Wtwell C Release parameters used for C4f f1.5 2.0 1.0 82 1.0 4 l m-prior to melt C4Y" y" Release parameters used for (4Y" Itse of C4 l1.5 2.0 1.0 0 1.0 l suppression pool prior to melt Not Ra y" loss et Cg,C3 7.0 2.0 6.0 0 120 pool C 37.0 2.0 7.0 0 1.0 2

Leaks- tc.6c NoSCTS CC 3 3 7.0 2.0 6.0 82 W C2,C4 37.0 2.0 7.0 82 1.0 Leaks t.5 with SCTS Cg.C3 7.0 2.0 6.0 82 12 0 C ,C 37.0 2.0 7.0 82 1.0 2 4 (a) Includes Xe Kr (g) includes la. Y, Zr. Nb, Ce, Pr, Nd, Np. Pa. Sm. Eu, Pu (b) Includes 1 (elemental). Br (h) The five cases run in CRAC e~ (c) Includes Ca. Rb (1) Time from accident initiation (d) Includes Te. Se, $b (j) Sensible heat rate for plume rise (e) Includes Sr. Ba (f) Includes Ru. Rh, Pd, Mo, Tc 3-140 Rev. 5, 9/82 L . .

TABLE 3.6.5 (continued)

RADIONUCLIDE RELEASE PARAMETERS AND RELEASE FR/CTIONS FOR DOMINANT ACCIDENT SEQUENCE CLASSES AND CONTAINMENT FA: LURE MODES LISTED IN TABLE 3.5.14 PATHi,Ay g(a) g (b)+CH 1 Cs ICI Te(d) Sr IN Ru IU 14 IE 3

GROUP SEQUENCE CEI. a steam C g,0 3 1.0 0.40 0.40 0.50 0.05 0.50 3.0x10-3 explosion C 2 2.0 0.096 0.10 0.40 0.01 0.40 2.0x10'3 and C 4 1.0 0.096 0.10 0.40 0.01 0.40 2.0x10-3 hydrogen 8.u' Cg ,C 1.0x10-5j explosion 2 'b ' 4 1.0 0.20 0.06 0.50 0.007 0.40 OPREL Y.D Drvve11 C l 1.? 0.11 J.09 0.016 0.010 3.0x10'3 3.0x10 and utwell C 1.0 0.06 0.023 0.4 6.3x10'3 0.069 4.7x10 overpre.sure C 1.0 0.04 0.024 0.073 2.7x10'3 8.6x10' 9.1 x 10' 3

failure Y' including C g,C3 1.0 0.064 0.075 0.115 6.4x10'3 0.019 1.3x10 hydrogen C Not calculated, but smaller than C4Y' 2

[ Y DW failure C 4 l 1.0 0.261 0.202 0.434 0.029 0.095 5.2 3x10N prior to melt C4Y' Y' O' ,11 f ailure cg l 1.0 0.07 0.09 0.20 0.016 0.088 5.0x1C prior to melt C4Y" Y" Lors of C4 l 1.0 0.73 0.70 0.55 0.09 0.12 7.0x10'3l suppression pool prior to ncit Not Rn Y" loss of C ,C Not calculated, but s= aller than C2y" g 3 pool C 1.0 0.13 0.17 0.5 0.02 0.08 6.2x10 '

2 Leaks- U .5c Nc5 CTS Cg ,C) Not calculated, but smaller than Ct.6c, C2, C4 C2,C4 0.73 1.9x10 4 9.8x10'3 4.6x10 -2 1.6x10'3 3.2x10'3 5.8x10

1.eaks C.f with $GIS Cg,C3 Not calculated, kt smaller t hn C,6,C2,G C2.c4 0.73 2.7x10'3 9.8x10

-5 4.6x10 1.6x10' 3.2x10-5 5.8x10 (a) Includes Xe, Rr (g) includes 14 Y, Zr. Nb, Ce, Pr, Nd , Np, Pa Sm. Eu, Pu (b) Includes I (elemental), Br (h) The five cases run in CRAC (1) Time from accident initia t ion S

(c) 1 ludes Cs, Rb (d) In.ludes Te, Se, Sb (j) Sensible heat rate for plume rise (e) Includes Sr, Ba (f) Includes Ru, Rh, Pd , Mo, Tc 3-140a Rev. 5, 9/82

8.6.8.1 Alphs. - In-Vessel Steam Explosion The postulated in-vessel steam explosion is assumed to lead to an oxidation reaction involsing a large fraction of the molten core releasing the remaining volatile fission products.

Therefore, a potentially high radionuclide release from the open containment may occur.

The radionuclide release fractions for each of the four accident sequences for in-vessel steam explosion are basically the same. The major differences in the release fractions between j the sequences occur due to the amount of core melt that is assumed prior to the postulated steam explosion and the conditions of the suppression pool. These differences cause higher release fractions for the Class I and Class III sequences than for Class II and Class IV. In Class I and III sequences, l l

the core is assumed to drop to the bottom of the RPV when 50%

l core melt has been reached. Up until this time, all the radionuclides released have been passed through the suppression pool and therefore attenuated before they are released into the containment atmosphere. However, when the core drops, there is a sudden oxidation release (in-vessel steam explosion) of the radionuclides remaining in the core which breaches first the RPV then the containment. In the Class II and Class IV sequences, the core is not assumed to drop to the bottom of the vessel until it has reached 100% melt. Therefore, a large fraction of the volatile radionuclides have already been released and filtered 8-141 Rev. 5, D/82

through_the suppression pool before the in-vessel steam explosion occurs which releases the remaining nuclides to the containment.

8.6.8.2 Beta - In-Containment Steam Explosion In the unlikely event of a core melt, it is conceivable that this molten fuel may interact with the suppression pool in a coherent manner. A significant portion of core material could then be released to the environment due to the molten core contacting the water of the suppression pool in a confined area, thereby causing a steam explosion (or oxidation release). It is musumed that the releases due to 'his containment failure mode occur from a combination of sources:

1. E terial released from the fuel / cladding gap or during core melt which has been discharged through the SRV's to the suppression pool at the time of vessel meltthrough.

l l

2. Eterial released during the vaporization sinHe due to the interaction between the molten core and concrete diaphragm floor.

8. E terial previously dissolved or suspended in the suppression pool which is revaporized (with the steam) or resuspended as a result of the steam explosion in the pool.

4. h ierial released from the fuel during the oxidation process as a result of the steam explosion.

It was assumed that the oxidation event would preclude any significant vaporization reaction. Reentrainment or resuspension of radionuclides from the pool was not considered to be significant for this case. It was also assumed that the Beta release fractions did not vary much from one class to another.

The gap releases vary among the different classes; however, the source term associated with gap release was considered smal1

relative to the dominant sources, the melt down and oxidation releases. (Items 1 and 4, above) 8-142 Rev. 5, 9/82

The radionuclides suspended in containment following the l oxidation release are assumed to be the same for each accident sequence. Effects due to the status of the suppression pool are considered to be negligible for this release.

8.6.3.8 Mu prime Hydrogen Explosion Hydrogen explosion is considered to be a low probability event for the Limerick containment since it is usually inerted.

However, there may be times when the plant is operating at power with the containment deinerted. Therefore, the possibility of hydrogen combustion is considered and the release fractions due to this type of failure are taken from WASH-1400.

The hydrogen combustion (nu prime ) and containment steam explosion (beta) are combined because of the similar manner in which they fall the containment and the assumption that they both have similar impacts on the radionuclide release fractions.

8.6.8.4 Gamma -- Relatsvely Slow Overpressure Failures During Postulated Core Melt Scenarios (Class I through IV)

The containment may fall due to a relatively slow pressure buildup due to core melt (assessed as the most likely type of failure). The various locations for such a failure are differentiated as follows:

gamma - Drywell Failure gamma prime - Wetwell Failure gamma double prime - Wetwell Failure below the suppression pool waterline.

i J

i 8-148 Rev. 5, 9/82

These locations were chosen based upon a structural analysis of

(

N_ / the LGS containment (see Appendix J).

The release fractions associated with gamma (drywell failure) and gamma double prime (loss of suppression pool) are similar since the benefits of pool scrubbing are lost in both cases.

)

l

)

i l 8.7 CONSEQUENCES ASSOCIATED WITH ACCIDENT SEQUENCES i

This section summarizes the calculaton of offsite effects for the following:

e The calculational model used in the Limerick site-specific analysis (CRAC).

e The input data used in the CRAC evaluation.

1 e The results of the CRAC calculation. i 8.7.1 Ex-Plant Consequence Model l

.CRAC (calculation of reactor accident conseque ices) is a computer code which was used in the Reactor Safety Study (WASH-1400) to assess the impact of reactor accidents on public risk.

The CRAC evaluation in WASH-1400 was applied to specific sites but in the final assessment was applied to a composite site with population density derived in a manner to approximate an average site in the United States. This section focuses on the application of the CRAC model to the site-specific evaluation of the Limerick Generating Station. A discussion of the various aspects of the CRAC model is provided in Appendix E.

O 8-144 Rev. 5, 9/82

9 The basic-CRAC model as used in WASil-1400 was also used O in the LGS analysis. The effect on public risk is determined by

-the behavior of the radionuclide cloud, the ' health effects induced by the radionuclides, and the population response.

Specific aspects'of the LCS CRAC model and additional commenis are noted below.

1. Impacts on the dispersion of radionuclides from the reactor site is governed by the following:

• The length of release23 was-modified from that used j in WASH-1400 based on subsequent data to produce a more lateral diffusion estimate.

e A plant-specific terrain roughness 2

• factor is used in the model calculation of plume dspersion to account for turbulence producing ground effects.

• The height of the release is varied as a function of the accident sequence (see Section 8.7.2) and the release energy rate.

e A seasonal wind rose is used to determine the weighting of the consequences as they are affected a by the wind direction.

• The wind speed and precipitation are determined using meteorological data gathered by PECo for the LCS site.

• All calculations were done using five years of weather data with risk estimates averaged to provide a best estimate.

2. The effect on public risk is determined by the behavior I of the radionuclide cloud and by the population response. The population response model used for the LCS evaluation incorporated the following:

• Population shielding factors characteristic of the Pennsylvania area.

• Evacuation speeds and affected area the same as used in WASH-1400.

3. The health effects model used in the evaluation of early fatality risk is a threshold model, which requires the exposed person to'be subjected to a specific level of radiation before an early fatality is recorded.

O .

8-145 Rev. 5, 9/82 L

-7 8.7.8 Results of the Limerick Specific Offsite Consequence G Evaluation The analysis of risk involves both the estimation of the probability and the calculation of consequences that may occur due to identified accident sequences. The consequence analysis for LGS was performed using the CRAC code, as was done in WASII-1400.

The form used to present the results of the LGS probabilistic risk assessment is identical to that used in WASil-1400s the complementary cumulative distribution function (CCDF).

The CCDF is a plot of the probability or frequency of equaling or exceeding a given parameter versus the parameter in question.

The parameters analyzed in this study are early or latent fatalities and property damage due to postulated nuclear reactor accidents.

The early, latent and property damage CCDFs for LGS are presented in Figures 8.7.1, 8.7.2, and 8.7.8 respectively. For the early fatalities, a compar i son is presented which indicates 1

i that the risk due to LGS is several orders of magnitude lower '

than that encountered oy the general public from various non-voluntary activities (i.e., activities undertaken without a conscious decision).

O 8-147 Rev. 5, 9/82

l e

l Uncertainties associated with the calculation of

,:("-}.

accident sequence probabilities can be evaluated by propagation of input uncertainties through each accident sequence, and combination of all accident sequences to determine the overall uncertainty range for each accident class.

This process can be simplified for the Limerick analysis due to the following:

1. There is a single dominant accident sequence with probability much larger than the other sequences. This allows the evaluation of a single sequence to characterize the uncertainties in that particular accident class.

2. Each of the accident sequences in the class have similar probabilities, and the uncertainty ranges associated with each are nearly the same. This allows the use of the uncertainty range determined from the explicit calculation for one sequence to represent the range for the Boolean sum of the class.

Based on the above discussion, the following evaluation of individual accident sequences is presented:

MSIV Closure and Loss of Coolant Injection: TFQUX This sequence is one of the major contributors to the Class I event sequence probability. Other sequences which contribute to the Class I probability have similar system and operator interactions, and therefore similar uncertainty ranges.

The MSIV Closure with the subsequent failure of high pressure

( coolant injection, and the inability to return feedwater to 8-155 Rev. 5, 9/82

service, coupled with the failure to depressurize is modeled in fault tree format. The component unavailabilities are input along with their probability distributions (assumed to be log-normal in most cases). The uncertainties are propagated through the fault tree model using Monte Carlo simulation (see Appendix E). This uncertalaty bound is transferred through the calculations to the CCDF for those consequences affected by Class I. However, it should be noted that some measures of consequences (e.g. early fatalities) are not strongly affected by Class I sequences.

ATWS Accident Sequences ATWS sequences, as evaluated in the LCS analysis, are important in the calculation of the CCDF for early fatalities contributing to Class IV sequence probabilities.8+ The uncertainty distribution associated with the scram failure probability is one of the most important single elements in the estimation of the confidence bounds on ATWS accident sequence probabilities. A simplified approach is used to define the probability distribution to be assigned to scram failure.

Bayes' theorem makes it possible to update the state of-knowledge of a given event by incorporating any available operating experience data into the prior distribution.

Acknowledging the existence of different sets of experience data from different sources, Apostalokis et.al. (8-5) computed a 8-156 Rev. 5, 9/82

REFERENCES

/

D 3 8-1 A Risk Assessment of A Pressurized Water" Reactor for Class VII - VIII, R. E. Hall, et. al. Brookhaven National Laboratory, NUREG CR/0603, October 1979.

8-2 Reactor Safety Study, WASH-1400, An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, USNRC report, October 1975.

8-8 F.L. Leverenz, J. M. Koren, R. C. Erdmann, and G. S.

Lellouche, ATWS: A Reappraisal, Part III, Frequency of Anticipated Transients, EPRI NP-801, July 1978.

8-4 Anticipated Transients Without Scram For Light Water Reactors NUREG-0460, Vol. 8, Staff Report, USNRC, December 1978.

8-5 G. Apostolakis,S. Kaplan, B. J. Garrick, and W. Dicksen,

" Assessment of the Frequency of Failure to Scram in -

Light-Water Reactors," Nuclear Safety, Vol. 20, No. 6, 7- November-December 1979, pp. 690-705.

(

l i

I

(

8-170 Rev. 5, 9/82 i, , ..

f-s These improvements are the result of the design to eliminate f the postulated single point mechanical failure of tha control rod drive mechanisms identified in WASH-1400, EPRI, and General Electric investigations.

NUREG-0460, Volume IV provides a discussion nhich considers it acceptable to have a failure of decay heat removal from containment. The NRC staff evaluation of ATWS Alternates 8A and 4A in NUREG-0460, Volume IV, stated that a failure mode from WASH-1400 which was taken to lead directly to core melt is not assumed to lead to core melt in the ATWS evaluation.

This sequence is the TW sequence, that is, the ATWS or transient coupled with the failure to remove decay heat using the main condenser or the RHR. WASH-1400 assessed this accident sequence as one of the principal sources of risk associated with a BWR, h'o wever, the recent NRC evaluation in NUREG-0460 indicates a different approach is acceptable.- The new approach recognizes that containment failure will not necessarily compromise the ability to inject cool water to the reactor vessel or the ability to maintain adequate liquid poison. Therefore, loss of containment by overpressure is not a direct core melt but requires other failures to occur to preclude adequate coolant inventory or liquid poison inventory in the core before a core melt will occur. On the l

other hand, the NRC Probabilistic Analysis Staff (PAS) in rebaselining BWRs has placed containment overpressure failures in a much more prominent position as major risk contributors. The evaluation of Limerick capability given an ATWS event conservatively considers the failure of heat removal capability from the containment to lead to unacceptable core conditions (similar to the PAS rebaselined assumptions).

'8 Deleted Feedwater is supplied by turbine driven feedwater psaps.

While there does exist a line around the MSIVs, this path may not be available, with any high degree of assurance, following an ATES, because of the short reaction time available.

Based upon operating experience data on the PJM grid.

Smoothing is a technique of the WASH-1400 analysis used to ensure that possible miscategorization of event sequences did not cause the risk to be underestimated.

[

(

8-172 Rev. 5, 9/82

88 See also the NRC BWR Rebaseline Case: E. J. Hanraham and L.

O Bickwit, Jr., " Report to the Commissioners,

Subject:

Report of the Task Force on Interim Operation of Indian Point",

(Docket Nos. 50-247 and 50-286), June 12, 1980.

l

$7 Personal communication, Corradini (Sandia) to Burns and i

Parkinson (SAI).

Personal communication between NRC (Taylor) and SAI (Burns).

l se Any reduction of the hydrogen concentration by means of the hydrogen recombiners was not assumed due to the large amounts of hydrogen released during a core melt and the relatively small capacity of the recombiners.

2" Gamma prine /Hamma means gamma prime given gamma.

8' Either a failure below the elevation of the bottom of the downconers or a containment wetwell failure which propagates to below the bottom elevation of the downconers.

( 28 SAI-REACT was also used to verify the CORRAL results.

28 Both items are ennsistent with current NRC site review methods. See Appendix E for further discussion of radionuclide dispersion.

8' Note mean values are used in all accident sequence calculationr.

28 WASH-1400 states that the error factor on LOCA initiators is

80. The actual implementaion of the data in accident sequences and the evaluation of their uncertainty do not reflect error bands of this magnitude. (A value of 7 appears to have been used.)

O 8-178 Rev. 5, 9/82

Section 5 CONCLUSION AND

SUMMARY

The Limerick Generating Station Probabilistic Risk Assessment represents the implementation of the best analysis tools available for the identification of potential accident scenarios and evaluation of the

! attendant level of risk to the public. The key features of the methods used include the use of fault trees and event trees to develop and quantify 1

the probability of postulated accident sequences, an accident analysis code package developed through EPRI to evaluate plant thermal-hydraulic responses and radioactivity releases'for severe accidents, and the use of CRAC to cal-culate the consequences to the public of releases of radionuclides to the environment. The analysis includes the'same general types of accident initia-tors as evaluated in WASH-1400, i.e., transients and LOCAs under operating conditions, with and without scram. Excluded from the assessment are event-sequences associated with external events, such as seismic, tornado and flood; fires; sabotage; and operator errors of commission. The risk evaluation tech-niques used involve several potentially important uncertainties, which are incorporated into uncertainty bands around the best estimate calculations.

These uncertainties, and how they are treated in the Limerick analysis, are discussed in Section 3.8 and Appendix I. The LGS analysis can be compared directly to, and on the same basis as, the WASH-1400 evaluation.

The results of the LGS evaluation are shown in Figures 5.1, 5.2, and 5.3, and can be summarized as follows:

1. The calculated core melt frequency for Limerick is approximately one half that calculated in WASH-1400. The accident sequence contributors identified and evaluated in the Limerick analysis are of a different nature, and more numerous than those identi-fied and assessed in WASH-1400.

2. The Limerick best estimate CCDF curves are below the published WASH-1400 CCDF curves for both early fatalities and latent f atalities for all calculated consequences. The total inte-grated risk values for early and latent fatalities are 2.36E-6 f atalities/ year and 1.06E-2 fatalities /30 years respectively.

These values may be compared to the WASH-1400 values of 3.0E-5 and 2.1E-2.

5-1 Rev. 5', 9/82

!~

3. The Limerick best estimate for property damage is nearly the same L.O-as the published WAS&l400 curve. .The total integrated risk value for property damage is $5,350/40 year' plant life or $133.75/ year.

- These values may be compared to the WASW1400 values of- $20,000/40 year plant life.or $500/ year.

4. L The. Limerick best ' estimate CCDF for early fatalities is several orders of magnitude below the CCDFs due to all natural and man-

made risks.

5. Even with the uncertainties involved in the analysis, the Limerick ~

Generating Station is not expected to represent any undue or-disproportionate risk to the public.

4 The LGS analysis includes a major reevaluation of the assumptions and techniques used in WASH-1400, taking into account significant comments from the iewis Comittee review of WASH-1400. The following items are key

. differences in the LGS analysis with respect to WASH-14CJ:

1. The estimate of the probability of the in-vessel steam explosion leading directly to containment failure was reassessed (see Appendix H). The probability of a steam explosion leading directly to a containment failure is reduced by a factor of ten.

2. The use of accident categories in WASH-1400 required lumping accident' sequences having~ major differences in potential con-sequences into the same category, for consequence evaluation.

For the LGS evaluation, the use of categories was eliminated, and each unique sequence type was evaluated separately.

3. WASH-1400 used a concept of smoothing of probabilities between i categories. to account for miscategorization and other un-certainties. This procedure was unnecessary in the LGS evalua-tion, because of better definition of accident sequence consequence evaluation.

4. Accident sequences were reevaluated, and additional sequences affecting offsite consequences were identified.

5. Component failure. rate data were reevaluated based upon the latest operating nuclear data.

6. . Philadelphia Electric Company nuclear experience data for maintenance operations, Ldiesel reliability, and offsite power availability were all used in the LGS evaluation. These data are believed to be more applicable to Limerick than the broader-based WASH-1400 data.

O 5-5 Rev. 5, 9/82

Stetion 6 REFERENCES O

l-1 Letter from D. G. Eisenhut (USNRC) to E. G. Bauer, Jr.

(Philadelphia Electric Co.), " Risk Evaluation - Limeric'x Generating Station, Units 1 and 2", May 6,1980.

1-2 Reactor Safety Study, "An Assessment of Accident Risks in U. S. Coninercial Nuclear Power Plants", USNRC report WASH-1400, October 1975.

1-3 H. W. Kendall, Study Director, "The Pisks of Nuclear Power Reactors" Union of Concerned Scientists, Cambridge,' MA, August 1977.

1-4 H. W. Lewis, Chairman, " Risk Assessment Review Group Report of the U. S. Nuclear Regulatory Commission",

NUREG/CR-0400, September 1978.

1-5 W. B. Murfin, " Preliminary Model In Core-Concrete Interaction," SAND 77-0370, Sandia National Lab.,

October , 1978.

3-1 A Risk Assessment of A Pressurized Water Reactor for Class VII - VIII, R. E. Hall, et. al. Brookhaven National Laboratory, NUREG CR/0603, October 1979.

3-2 Reactor Safety Study, WASH-1400, An Assessment of Accident Risks in U.S.

Commercial Nuclear Power Plants, USNRC report, October 1975.

3-3 F. L. Leverenz, J. M. Koren, R. C. Erdmann, and G. S. Lellouche, ATWS: A Reappraisal, Part III, Frequency of Anticipated Transients, EPRI NP-801, July 1978.

3-4 Anticipated Transients Without Scram For Light Water Reactors NUREG-0460, Vol. 3, Staff Report, USNRC, December 1978.

3-5 G. Apostolakis,S. Kaplan, B. J. Garrick, and W. Dicksen, " Assessment of l the Frequency of Failure to Scram in Light-Water Reactors,"

Nuclear Safety, Vol. 20, No. 6, November-December 1979, pp. 690-705.

O 6-1 Rev. 5, 9/82

L-REQUEST FOR ADDITIONAL-INFORMATION AND CLARIFICATION ON

'. LIMERICK PROBABILISTIC-RISK ASSESSMENT i LIMERICK GENERATING STATION l-l

\

l This revision consists of responses to the NRC request for additional information and updates the PRA to September of 1982.- All items contained in this section are grouped according to the Chapters and Appendices of the -PRA. Revision of existing pages was due to either, the clarification of responses to previously submitted questions or the correction-of typographical errors. Responses to the NRC request-for additional information dated August 10, 1982 are inserted at the end of each section. The page numbering has not been redone; rather a suffix has been added to the page number for all inserted material, l

l l

l O

Q-0 Rev. 5, 9/82

CHAPTER 1 O QUESTION 1.01 The text conveys the notion that no cross-ties between Unit 1 and Unit 2 were taken into account (p. 1-18). Cross-ties could be sources of redundancy as well as additionial failure causes. Are there cross-ties between units (e.g., RHRSW, RHRHX)? If yes, provide rationale for not considering them

.in the analysis.

RESPONSE

The referenced statement has been revised in Revision 8 to the PRA, as follows:

"The system evaluation has been performed using design drawings from GE and Bechtel for Limerick Unit 1 only, and considers no cross-ties, benefits, or other effects between the two units with the exception of a cross-tie between Unit I and Unit 2 ESW and RHR service water pumps."

l l No other cross-ties, that would enter into the analysis are l known to exist.

l 0

Q-la Rev. 5, 9/82

(e,.g., smoke) have plugged leaks. Therefore, the containment leakage rate should not increase prior to reaching 140 psig.

Secondly,^for the accident sequences where the containment 1.

failed prior to core melt (i.e., Class II and Class IV), the containment leakage prior to core melt would not result in

" increased" radionuclide release to the environment.

Nevertheless, in the Containment Systems Experiments I (Reference 8) it was observed that' leaks were also plugged by condensed steam. .

It should be noted that leakage of steam from the containment into the Reactos Building could result in some environmental degradation'in the Reactor Building, however, due to the compartmentalization and system of room cooling units in the Limerick Reactor Building this leakage is expected to be easily treated and would not adversely affect the opera, tion of ECCS equipment. This question only affects the timing of operator action. Since Class IV scenarios have containment pressure rises to the ultimate pressure capacity of the 'I containment in less than one hour, operator. action for repair j is minimal to begin with and would therefore, he minimal'ly i affected by increased leakage. Class II sequences are l potentially affected by adverse environment since operator action for equipment repair has been included in the Class II evaluation.

l Based on the above discussion, there should not be an 01 lucreased leakage rate of the containment prior to reaching 140 psig. By considering the design leakage of the containment in the analysis, the Limerick PRA is judged to be realistic.

REFERENCES E1] Wheat, L. L., et. al., CONTEMPT-LT, ANCR-1219, Idaho, June 1975.

[2] Morowitz, H. A., " leakage of Aerosols from Containment Buildings", to be published in Health Physics.

[3] Witherspoon, M. W., and Postma, A. K., Leakage of Fission Products From Artificial Leaks in the Containment Systems Experiments, BNWL 1582, Battelle Northwest Laboratories, Richmond,' Washing, ton.

O Q-8 Rev. 5, 9/82

l QUESTION 1.03

[

Based on the design leakage of the containment (p. 1-20), it is expected that some amount of containment environment constituents will escape into the reactor buildings this may become more pronounced when the containment is at an elevated pressure. Given the long-time nature of some transients, what is the prob _ ability of hydrogen combustion inside the reactor building? In the event that there is containment k failure prior.to core melt, what is the likelihood of hydrogen combustion in the reactor building? Does hydrogen combustion inside the reactor building further aggravate radioactive releases, and if so, in what way?

RESPONSE

Assuming perfect mixture of hydrogen with the air in the secondary containment, ignitiqn quantitles for hydrogen combustion have been calculated.for the Limerick secondary containment. These are shown in Table 1 as a function of temperature. This indicates that at the design leakage rates (see answer to PRA 1.02), given the composition of the vapor region of the primary containment, the amount.of H2 gas which could escape to the reactor building will be far below the amount shown in the table *. Therefore, H2 combustion inside the reactor building would not be possible at all for Class I and Class III sequences where the containment is intact during core meltdown and hydrogen is produced from metal-water reactions.

Table 1 IGNITION QUANTITIES OF HYDROGEN IN THE REACTOR BUILDING

• Imperative 62*F 210*F 290*F Lower Limit 400 lb moles 360 lb moles 250 lb moles Upper Limit 8780 lb moles 2990 lb moles 2440 lb moles

• Assumes mixing and dry air at the operating pressure of 14.6 psia in the RB.

In the event that the containment were failed prior to core melt (Class II and IV), the reactor building (RB) would be steam laden and steam inerting would occur with the oxygen being displaced from the RB. Hydrogen combustion would be highly unlikely.

Q-4 Rev. 5, 9/82

l If hydrogen combustion in the reactor building should occur it would result in a pressure rise in the compartment which might increase radioactive release rate at that time. The j N

['_' pre.wsure increase at ignition could result in e puff release l of radionuclides rtducing the potential for radionuclide removal in the reactor building. This possibility is extremely remote and has not been explicitly modeled in the Limerick radionuclide release calculations.

• The relative volumes and leak rates of the reactor building and an intact containment provide a dilution ratio of 2000:1. Even if the hydrogen concentration in the containment were 10-20%, the resulting concentration in the reactor building would remain far below the ignition level. ...

I I l l

l 1

_ e

/

O Q-5 Rev. 5, 9/82

t - - --

Examples of WASH-1400 and WAS11-1270 failure rate data used in the analyses or for comparison are:

e BWR accident initiators - WASH-1400 and WASH-1270

• Component failure rate data - WASH-1400 1

• Human failure rate data - WASH-1400 m System unavailability due to maintenance - WASH-1400 The scope of this PRA did not generally include integration and re-evaluation of different data sources. In anch infrequent instances, data were combined and re evaluated when it appeared that the data were compatible, uncertainty was reduced, and the integrated results were at least as realistic as the reaults from either of the individual data bases. Applicable data evaluations were collected from each of the four categories =lthout priority discrimination.

Subsequently, comparisons of the applicable results were used' to determine a failure rate probability based on relevancy of the data base to the Limerick failure rate assessmeat.

O- For example, the LGS evaluation of diesels generator failure rates was divided into three probability areas: (1) Failure to " start and run" probability for a single diesel is based on the PECo operating experience at the Peach Bottom Station which has similar diesel generators: (2) The conditional probability of multiple diesel failures given a single diesel failure is tased on combining the 23 L4R (McLagan et. al.,

" Preliminary Assessment of Diesel Generator Reliability at Light Wate. Reactors, "SAI/AMES, 1980) with the NUREG/CR-1362 data to use the most information available: (3) Recovery of a diesel is based upon the NRC evaluation and is consistent with the Peach Bottom data. This combined use of the available data was believed to provide a valid and the most applicable approach for the LCS PRA.

Q-8 Rev. 5, 9/82

d GUESTION 1.06

() (a) What is the rationale for Guideline No. 11 (p. 1-82)?

(b) Provide the reference for the "Japroved chronic-health-effects model" referred to (p. 1-10).

4 4 RESPONSE (a) Guideline No. 11 of the LGS PRA assumes that the failure of display information to the operator is not dependent on the accident sequences.

This guideline was adopted because in the detailed engineering evaluation which accompanied the LGS PRA, no identified link could be made between the accident sequences investigated and common cause adverse effects on all the information available to the operator. It is recognized that there may be a possibility for very low frequency accident sequence initiators which could cause a loss of display information*. 3owever, these initiators were not quantified explicitly in the PRA, since an engineering investigation determined that such circumstances were highly unlikely at Limerick.

Therefore it was judged that the overall probability of

( such sequences would be much less than other identified j- sequences and.this initiator was not quantified.

(b) The referenced statement was inaccurate. In Revision 8 to the Limerick PRA, the statement has been corrected to

, reads i

! "These improvements include corrected calculational i

routines and improved output routines providing for better analysis of results, including. sensitivity studies where applicable."

i I

i l

• Cases of loss of display information have occurred at BaW reactors. However, the Limerick design is

~

significantly different than the R&W design and the display instrumentation is not subject to the same I..

relatively high frequency of disabling events.

l

Rev. 5, 9/82 Q-10

QUESTION 1.07 l

" Table 1.2 Summary Of Success Criteria For The Mitigating Systems Tabulated As A Function Of Accident Initiators (p. 1-26)." For each initiator, including all 5 transients, reference the section of the FSAR that describes the adequacy of the selected success criteria. For those initiators, including all 5 transients with success criteria not described in the FSAR, provide the reference that justifies the adequacy of the selected success criteria.

RFSPONSE The content of Table 1.2 derines the minimum system requirements to successfully terminate a transient or LOCA initiating event (with scram). All success criteria in this table were developed from the analyses given in NEDO -24708,

" Additional Information Required for NRC Staff Generic Report on BoiIing Water Reactors," December, 1980. The anslyses in that report are based on realistic conditions of core hentup, instead of the conservative licensing basis analysis performed for the FSAR.

The analysis in the FSAR demons.trates the performance of the s safety systems under the " single active failure" criteria, and is not applicable to the PRA ground rules or conditions (multiple failures with realistic conditions).

>O0 Q-11 Rev. 5, D/82

r.

b, i

t I Chapter S L

QUESTION 8.01 t-

[ For the event trees shown in Chapter III, provide the reference for the probabilities assigned, to each system success or failure and/or frequency of initiators. Provide l rationale and method used whenever different probability l values are used for the same event.

Identify values obtained from fault trees and provide cross reference to corresponding fault tree figure.

RESPONSE

• The initiator frequencies used in the event tree quantification are presented in Appendix A.1.

• The conditional probabilities used in the event tree quantification are developed in the propriety document entitled, "Quantification of Limerick PRA Event Tree Functions".

Q-12 Rev. 5, 9/82

QUESTION 8.02

) The Limerick FSAR reported that the vapor suppression system V reliability and effectiveness varies as a function of the LOCA size. However, in the Limerick PRA study, it does not appear that this particular aspect of the system has been incorporated into the containment event trees. If'it was neglected, what is the justification? If it was included, provide additional details on how the system was modeled.

RESPONSE

1. Quantification of the vapor suppression failure probability and effect is subjective since there is only limited test experience to indicate potential bounds.

2. A large LOCA coupled with* vapor suppression failure leading to core melt was found in WASH-1400 not to be a contributor to risk, therefore the decision was made early in the development of the LOCA event trees to eliminate this failure mode from LOCA sequences since the Limerick reactor and containment design would tend to suppress its impact and not enhance the contribution to potential unacceptable conditions. This was reviewed by study participants to ensure that a dominant O contributor was not being overlooked.

mechanism could be incorporated into the system level This failure LOCA event trees for, completeness, however, scoping studies still demonstrate that inclusion of vapor suppression failure would not contribute to the calculated level of risk at Limerick.

8. The assessment nf sequences involving potential degraded core conditions using the containment event trees does take into account the potential for premature containment failure due to vapor suppression failure during challenges to the containment integrity in the assignment of the conditional failure probability for drywell failure ( v ).

O 0-18 Rev. 5, 9/82 l

GUESTION 3.03 O In addressing manual shutdown as an initiating event, there are situations in which the reactor operator is required to shutdown the react.:.c in order to be in compliance with technical specifications due to the unavailability of certain safety systems. Provide a summary of how these types of manual shutdowns were included in the event tree depicted in Figure 8.4.2?

RESPONSE

A previous review of operating experience data regarding manual shutdown [1] ranked the causes for BWR manual shutdowns as follows:

(1) Refueling outages (2) Turbine / generator problems (8) Relief valves, BOP valves (4) Recirculation Pumps t

(5) Drywell leakage (6) Gaseous radwaste system (7) Planned outages for maintenance (ST Ventilation system (9) Operator training / exams / inspections For the quantification of the LGS manual shutdown event tree some simplifications were made. For example, violations of technical specification leading to a manual shutdown were not explicitly included, since based upon the limited operating experience data available this did not appear to be a noticeable contributor to manual shutdowns.

In order to ensure that a possible dominant sequence was not being overlooked, the potential contribution to core melt frequency due to the possibility of RHR outages leading to a manual shutdown challenge was scoped. The comparison between the frequencies of PCS containment heat removal challenges as evaluated in the event tree versus those which could result if one RHR is disabled initially is as follows:

The potential f'equency of PCS challenges following manual shutdowns inf... ted by RHR failures outside technical specification requirements can be estimated as the product:

n U l Q-14 Rev. 5, 9/82

I Manual shutdown

~

Probability of Condition.nl failure

'freq. due to RHR x losing feedwater x probability of the PCS -

f-s tech. spec. vio- and PCS during and remaining RRR given

() lation per Rx Yr. shutdown a manual shutdown 5x10-8/RxYr** x 7x10-8/d x 1.6x10-*/d -

5.6x10-'*/Rx Yr i

This frequency is nagligible compared to the dominant ,

sequence for manual shutdowns. (2.2x10-7)

J 1

• Excluding the few cases which affected the condensate i

Pumps.

• • Frequency is calculated based upon the data from reference [1] and the assumption that 1/2 of these failures would be recoverable in the 20 hour2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> period subsequent to shutdown prior to cor.tainment overpressure.

i O ,

Q-15 Rev. 5, 9/82 ,

QUESTION 8.0_4

() Plateout and settling is assumed to " remove" radioactivity.

Can the radioactivity be released back to the environment by some physical means, for instance water flash (p. 8-125)?

RESPONSE

Containment failure at elevated temperature and pressure.will in most cases result in the " flashing" of snppression pool l water to vapor until equilibrium saturation conditions are I reached.

Radioactivity dissolved in the suppression pool was conservatively assumed to be re-released back into the containment mir space upon containment failure for Class I and Class III accident sequences. During the sudden depressurization it was conservatively assumed that the ,

dissolved radionuclides in the water which boil off would be released back in direct proportion to the amount of water flashed. The vaporized water would then leave the radionuclide salts in the air space to be released to the environment through the postulated containment break.

Radionuclides (i.e., elemental I )2 can also be partitioned O between the aqueous phase and the vapor phase resulting in '

another mechanism for possible rerelease. This is treated in CORRAL in the equilibration of I2 in the containment spray water.

I O

Q-17 Rev. 5, 9/82

, = . .. ..

QUESTION 8.05 ,

I l

Isn't the 6 sequence a drywell overpressure and not a wetwell overpressure as labeled in the far right column of the containment event trees (see for example p. 8-82)?

Explain the difference betwee,n 6 , 6' , and 6". The definition of 6 is confusing. In the containment event trees it means containment overpressure either drywell or wetwell. The definition on the top of page 8-188 indicates it is a drywell failure.

RESPONSE

l l

(The Greek letter used to identify relatively slow l overpressure failures of the containment postulated to occur  ;

due to slow containment pressure increases is Y, not 6 . )

The location of potential overpressure failures is described by the following conditional probability momenclature:

Y -

containment overpressure failure occurring in the drywell v' -

containment overpressure failure occurring in the suppression pool air chamber space above the waterline V"- containment overpressure failure occurring below the water line of the suppression pool There were goveral places where the symbols were incorrect in the origina+ FE4. Corrections wers made in Revision 83 however, severa! places still remain inencrect. Revision 4 includes additienal corrections.

1 Q-18 Rev. 5, 9/82

consists of an ultrasonic inspection of weld Joints, and surface inspections (visual, liquid penetrant test and magnetic particle test) before the vessel goes into service and inspections every

'10 years thereafter.

4. Reactor vessels are designed and operated with a higher degree of protection from pressure transients and temperature events than are non-nuclear vessels. This higher degree of protection is assured by virtue of design measures, including over pressure relief devices and operational control procedures.

5. Due to low neutron flux, BWR vessels are not significantly subjected to nil-ductility phenomena during the course of their expected operating i lifetime. I

6. Reactor vessels are designed and constructed in l accordance with Section III of the ASME Code.

These rules are more restrictive than the rules of Section I and VIII, which are used for non-nuclear vessels.

7. Reactor vessels are operated in accordance with the limitations specified in NRC License Technical Specifications, wheras no such requirements are O imposed on non nuclear vessels.

Based or the above considerations it was concluded that, the probability of RPV disruptive failure is so low that its explicit inclusion in the analysis would not significantly impact the PRA results. The RPV failure modes that are mechanistically plausible would produce consequences similar to the higher probability LOCA events because of the " leak-before-break" phenomenon. These latter events are analyzed in detail and reported in the PRA.

An indication of the significance of the reactor vessel failure on the LGS risk can be obtained by considering the treatment given this subject in WASH-1400. In WASH-1400 a pressure vessel rupture accident was included in release category BWR-3 at a frequency of 10-7/ year while an accident at a frequency of 10-*/ year was included in release category BWR2.

Release category BWR2 contains accident sequences which have early containment failure and limited fission product removal and is similar to the LGS type IV accident class. This class has a total frequency of 1.8x10-7/ year in the Limerick analysis. The vessel failure as quantified in WASit-1400 would increase the LCS frequency to 1.4x10-7 for this class.

The EWR3 category has smaller fission product release with greater credit for removal in the containment and/or the Q-22 Rev. 5, 9/82

(b) The following events have also been considered in scoping analyses to determine if these low frequency gs initiators would produce sequences which might

( significantly contribute to the potential risk of the Limerick plant operation

• Recirculation Pump Seal Failure: This particular failure is included in the small LOCA initiator.

Recirculation pump seal failure during accident scenarios is judged to not significantly alter the progression or quantification of the accident sequences. Therefore, no further event tree development was performed. {

i

• Loss of instrument air: While instrument air has a pervasive influence on many balance of plant i functions the evaluation of its contribution to j risk has been adequately assessed by inclusion in the MSIV closure initiated event tree. The impact of MSIV closure on the key balance of plant system l st Limerick is similar for both loss of instrument air and MSIV closure, i.e.:

l all MSIVs eventually close i

N -

condenser becomes unavailable as a heat sink feedwater becomes unavailable l

l ECCS equipment remains unaffected to perform safety function (i.e., air operated valves in safety systems fail safe)

Recovery of instrument mir and reopening the MSIVs are both given relatively little credit during the initir,1 80 minutes and some additional credit during the subsequent 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br />.

• Loss of DC Power: A PRA evaluation of the contribution of Loss of DC Power initiator to the risk spectrum of a BWR/4 plant which has two emergency DC buses has been performed. The results of this non-Limerick evaluation indicated that the loss of DC power initiators represented less than 10% of the core melt frequency and that the resulting accident sequences would produce Q-25 Rev. 5, 9/82

consequences in the lower release categories, i.e.,

lower risk to the public.

O The calculated contribution to early fatalities from the analysies was negligible. Since this evaluation was performed on a plant with 2 - ,

emergency D.C. buses (one battery each), and the Limerick plant has four emergency DC buse's (one battery each) it is judged that the LGS plant would have an even lower contribution to risk f. rom loss of DC power.

REFERENCES

[1] Risk Assessment Review Crc,up Report to the U.S. Nuclear Regulatory Commission, U.S. Nuclear Regulatory Commission NUREG/CR-0400.

O Q-26 Rev. 5, 9/82

QUESTION 3.09

-/

In order to successfully operate the ADS, it must be manually initiated in a timely fashion (p. 3-17).

Provide the basis for the time limit on how soon the depressurization should begin.

In there a time limit beyond which depressurization is not possible?

Is there any requirement on the rate of depressurization?

It is stated (p. S-18) that the alternate methods of depressurization are given low probability for success, since they involve " creative operator actions under potential stressful conditions:. Will there be approved procedures delinenting steps required to implement these alternate methods? Are these methods included in the quantification of the sequence?

RESPONSE

The operator will follow procedures. Procedures for Linerick will follow the EPG [13, which was used as a basis for the

~, Limerick PRA analysis.

The referenced statements (p. 3-17, 3-18) are now on p. 8-22,  ;

8-23, 3-24, and 3-25 of Revision 8 to the PRA. The statement that ADS must be manually initiated carries the underlying assumption that automatic ADS has not occurred. The

(

referenced statements are made in reference to the turbine trip event tree (Figure 3.4.1). For this event, automatic ADS usually will not occur. On the event tree, ADS is shown to be required in the event of failure of high pressure injection ~(FW/cond, HPCI, and RCIC).

Fallrre of high pressure injection would result in decreasing reactor water level. At this time, the operator should initiate ADS. The operator would have at least 80 minutes (see p. 8-23 of the PRA) to accomplish ADS. The basis for this time limit is the boil-off time. The water level in the core would reach top of active fuel (TAF) in 25 minutes and would be slightly below TAF in 30 minutes [2]. The core would be adequately steam cooled to remain undamaged.

The time limit beyond which depressurization is not possible is dependent on various conditions of the event, but is always limited by the effect on suppression pool temperature and/or suppression pool water level. The attached pages, (Q-29, 30, 31), from the'EPG defines these limits.

\

Q-27 Rev. 5, 9/82

QUESTION 3.10

(% Why does a " controlled" manual shutdown require SRV actuation? Isn't the plane scrammed from a power level below the bypass valve capacity? Explain the major sequence of events which are expected for a normal reactor shutdown.

RESPONSE

Manual shutdown does not require SRV actuat".on. The incidence of inadvertent SRV actuation dur ang manual shutdown is so low as to be considered negligible. In Revision 8 co the Limerick PRA, SRV actuation has been deleted from the manual shutdown event' tree (Figure 8.4.2). l The sequence of events for a manual shutdown will be described in the plant operating procedures. The major saquence of events maybe summarized generically as foilows.

(Plant specific procedures may vary somewhat from these guidelines):

1. Pre-shutdown preparation and system checks.

2. Reduce reactor recirculation flow to 80% power.

8. Perform syster. checks (PSC)*

4. Reduce reactor recirculation flow to 65% power.

5. PSC

6. Shut down one reactor feed pump

7. PSC t 8. Reduce reactor recirculation flow to 557. power.

l

9. Shut down one condensate pump.

10. Insert control rods to 80% power using Rod Sequence Control System (RSCS).

11. PSC

12. Transfer feedwater control to MANUAL and shut down feedwater heaters.

13. Insert control rods to 10% power using RSCS.

14. PSC (A

V) 15. At approximately 5% power, transfer reactor level control to MANUAL and place mode switch in STARTUP.

Q-82 Rev. 5, 9/82

16. PSC

17. Begin scramming individual rods.

1'

18. Reduce generator load to 10MW cr less (Bypass valves will open).

19. PSC

, 20. Trip turbine and shut down generator.

21. PSC

22. Shut down second reactor feed pump and second condensate pump.

28. Continue scramming indivdual rods. Hold reactor pressure at 900 psig for two hours.

24. PSC

25. Manually open bypass valves further to reduce pressure (limit reactor cooldown rate to 100*F/hr)

26. PSC

27. At approximately 200 psig, shut down remaining

~

reactor feed pump. Removo steam jet mir ejector and start mechanical vacuum pump.

28. PSC j **29. At approximately 75 psig, place RHR in service in Shutdown Cooling Mode. Hold reactor temprature at 125'F.

80. At approximately 50 psig, close bypass valves and MSIV's.

81. Scram all remaining control rods, and place mode switch in SHUTDOWN.

• Numerous checks of system conditions and process parameters are conducted throughout the shut down procedure.

• • RHR required only if going to cold shut down.

O Q-88 Rev. 5, 9/82

g I

QUESTION 8.11 Explain why a value of 1.1x10-* was used for the unavailability of RHR/RHRSW or PCS, given a failure of the SRV's to reclose, in Figure 8.4.8. This is the same as for turbine trip or manual scram event trees. The additional problem of recovering feedwater ( the initiating event) should increase the ansvallability as stated on p. 2-27 under event W descriptfor..

RESPONSE

For MSIV closure initiated sequences with multiple relief valves stuck open it was conservatively assumed that the RHR heat exchangers would be required to remove decay heat from l the suppression pool. Consequently, the failure rate of the contmiraent heat removal path was determined without l includtag credit for the ability to use the power conversion system as an adequate heat sink for these sequences.

Similarly, in turbine trip or manual shutdown sequences *, if there are multiple stuck open relief valves, no credit is taken for the PCS system. Therefore, the containment heat -

removal path failure rate is the conditional probability of failure of containment heat removal throught the RHR heat exchangers. (9.9x10-8 in Revision 8)

• For Revision 8 of LCS PRA, the manual shutdown case Figure 8.4.2 is realistically modeled without SORV since rellef valves seldom open on manual shutdown.

q-34 Rev. 5, 9/82

_. i

QUESTION 3.12 Provide supporting documentation and/or calculations showing

(--/) that a feedwater pump can add water to the reactor vessel following a scram and a subsequent stuck open SRV. The event trees for turbine trip and MSIV closure show the feedwater Svailability to be the same, independent of the condition of the SRV. It is realized that, should the feedwater pump not be able to continue running, due to low steam pressure, the condensate pump would take over at approximately 600-700 psig pressure. Ilowever, operator actions and additional valve operation would seem to reduce the probability of successful operation. llave these items been considered?

RESPONSE

Refer to Feedwater P&ID, Bechtel Drawing No. 8031-Mod. No operator action is required to initiate condensate pumps.

When main feedwater pumps trip.. condensate pumps continue to l run and deliver water to the RPV through the centrifugal

feedwater pumps. If RPV pressure is too high, the condensate l pumps continue to run with ninimum flow bypass until RPV pressure decreases to the point where injection begins. No valving is needed.

1 L h Condensate pumps will continue to deliver water to the RPV '

% and will eventually overfill the RPV unless the operator takes manual control by diverting flow back to the main condenser hotwell by means of flow control valves.

f

\.)

Q-35 Rev. 5, 9/82

QUESTION 3.13

'l

'O

( j (a) The event. tree for manual shutdown has different feedwater system unavailabilities depending upon the condition of the SRV's. Why does the difference exist in this case?

(b) The statement at the top of p. 3-20 discusses overriding of the low vacuum interlocks for the turbine bypass vaives. Have the operator actions required to bypass the MSIV low vacuum interlocks been considered in calculating the unavailability of the power conversion system?

RESPONSE

, ta) See response to Question 3.10. Manual shutdowns are judged to be slow, controlled events for which the

feedwater/ condensate system can provide short tern l coolant makeup with a high reliability. In the manual shutdown event tree there is considered to be a negligible probability that the safety relief valves may be required to operate; therefore, the operation of

, safety relief valves has been deleted from the manual shutdown event tree in Revision 8 to the Limerick PRA.

(b) The statement on p. 8-20, in more complete context, reads as follows:

"The main steam isolation valves (2) in one of the j

four main steam lines must either remain open or be reopened. A turbine bypass valve must open to

. control reactor pressure during reactor depressurization. If the condenser vacuum cannot

, he maintained below seven inches of Hg, the low vacuum interlocks on the bypass valves must be overridden."

The assumption that the MSIV low vacuum interlock must be overridden is correct. For completeness, the referenced sentence should so state. Both interlocks (turbine bypass and MSIV) can be overridden by the.

operator from the control room.

The referenced statement is in the discussion of the ,

turbine trip event tree. As explained on p. 3-18, this

. event free is for turbine trips with bypass. For this event, the frequency of loss of condenser vacuum is very low, and the availability of feedwater and the PCS is t high.

Q-36 Rev. G, 9/82

Loss of condenser vacuun as an initiating event la included in the MSIV closure event tree (Figure 3.4.8).

'N For this event, the probability of recovering feedwater and the PCS is lower and does require the operator to 3

override both high vacuun interlocks (bypass valve and MSIV) for those cases where vacuum is lost. This is accounted for.in the analysis.

4 i

1 i

4, 2

6 d

2 1

i Q-37 Rev. 5, 9/82 i

l l.

L QUESTION 3.14

..( ) For the MS1V transient, the report indicated that the RCIC steam condensing mode was not evaluated (p. 8-28). On p. 8-20 it is stated that the RCIC steam / condensing mode was included in the turbine trip event tree. Why is this decay heat removal method not consistently included in the analysis?

RESPONSE

In Revision 3 of the Limerick PRA, credit for the steam condensing mode of RHR was deleted. A definitive statement is given as Item 3 on pages 3-2G and 8-27 of the PRA, and is repeated here:

"3. Heat removal via the RHR steam condensing mode is viewed as an addit.8onal design feature which allows the operator flexibility in maintaining a safe reactor condition in the face of unusual plant occurrences. The Rild steam condensing mode utilizes the HPCI steam lines, the RCIC turbine and pump, RIIR heat exchangers, and RIIR service water to transfer reactor decay heat to the ultimate heat sink. The steam condensing mode will be available for plant operation. However, it is not included in the system fault trees. A scoping analysis has shown that a small net benefit would be derived from the use of steam condensing, but no credit was taken in the analysis."

1 Q-38 Rev. 5, 9/82

QUESTION S.16 i

/ Further elaboration on the removal of the emergency core k, cooling functionability from the event tree is required (p. I 8-40).

RESPONSE

The issue was not addressed explicitly in the Limerick PRA for the following reasons which were included in WASil-1400 Appendix XI, Section 7.

" The question of the success or failure of ECCS - as a matter of functionability, as opposed to operability --

, Joes not readily lend itself to analysis by the methods used in WASH-1400. Thus, the study decided to examine l what level of failure probability would cause ECF to contribute to potential accident risks. As noted in Appendix V, Section 4.2, sensitivity studies reveal that

... even if values as high as 10-' for ECF failure (probability) were to be used, any contribution made would be within the accuracy of the overall calculations."

4 Thus, although there appears to be no current basis for making a rigorous quantitative assessment of the probability of ECF failure, the analysis referenced showed that even if ECF failure probability were as high as 10, it would not change the results of the study significantly. It is the view of the study that the probability that ECCS will fail to cool the core

adequately is significantly less than 10-8."

In addition, there have been further efforts within the nuclear research community to verify that these assertions ,

are true. Based upon the assumptions used in WASil-1400 and I the additional verification of these assumptions by efforts such as LOFT, it was judged that no new information has become available since WASil-1400 which would change the sensitivity evaluation ir.dicating that even significantly higher failure probabilities of ECF would not change the results of the study.

There is nothing unique in the LCS design which would change the conclusion presented in Appendix XI of WASil-1400.

O Q-40 Rev. 5, 9/82

QUESTION 3.18 Please explain the basis for assigning a reactor scram Cx failure of 1x10-" for a large LOCA (p. 3-42) and 3x10-8 for medium and small LOCAs (p. 3-45 & 3-47).

RESPONSE

The treatment of LOCA coupled with a failure to scram can be explained through the following key facts:

1. The failure to scram conditional probability has been extracted from the NRC document NUREG-0400 and is estimated at 3x10-5/ demand. Based upon the BWR precursors which have occurred, the ratio of common mode mechanical to electrical scram system failure without ARI is 1/2 as discussed in Volume 2, Appendix B of the LCS PRA. Therefore, the conditional probability of common mode mechanical failure of the scram system is estimated to os 1x10-5/ demand and electrical to be 2x10-*/ demand.

2. Following a large LOCA, the SLC is assumed to be ineffective as a means of inserting negative reactivity into the core for shutdown, and scram system failure is taken to lead directly to core melt of the Class IV type. ARI has the effect of reducing the common-mode electrical failures in the scram system by approximately a factor of 100.

3. Medium and small LOCA's coup'ed with a failure to scram are judged to be capable of being effectively mitigated through the use of the SLC system and ARI. Transfers to the IORV event tree is used to model both ARI and SLC mitigation capability.

4. As noted in the text, the evaluation of failure to scram for a large LOCA has been simplified for the purposes of the quantification. Since the remote probability of a failure to scram has been assumed to be independent of the low frequency of a large LOCA (i.e., initiator and blow down forces), the calculated frequency of a large LOCA coupled with an ATWS is extremely low.

A simplification has been made in the treatment of failure to scram for each of the LOCA initiators, as follows:

• For large LOCA initiators, a specialized ATWS event tree is not drawn. The following two simplifications reduce the problem:

\,j Q-42 Rev. G, 9/82

electrical common mode failures plus failures in ARI are of significantly lower frequency

- than mechanical common mode failures.

SLC is assumed to be ineffective 4

Therefore, 1x10-*/d is used as the conditional probability that the large LOCA would be followed by a common mode failure to scram.

e A similar simplification could be done for small and medium LOCA's; however, these are treated in the IORY ATWS event tree (Figure 3.4.11) to which transfer occurs. Therefore, the total conditional probability of failure to scram is used to assess the transfer.

An additional ATWS tree could be drawn for large LOCA initiators; however, the quantified results would not be changed. In particular, the simplification for large LOCA dows not affect the sequence quantification used in the calculation of risk due to Class IV sequences.

l 4

0 e

O

'Q-43 Rev. 5, 9/82

QUESTION 8.19 l

rs ' The text Indicates (p. 3-43) that the success criteria and

\~- calculated probability of long term coolant recirculation and short term coolant isjection are similar. Why are the success criteria for long term and short term demands the same? What is the difference in system configuration between coolant injection and coolant recirculation?

Given the long time nature of some of the accident scenarios-in the order of twenty to thirty hours, was failure subsequent to successful system actuation addressed in the Limerick study (failure to run)? If yes, were the degraded environmental conditions under which the systems must operate taken into consideration?

RESPONSE

(a) The success criteria indicate the minimum complement of mystems necessary to successfully fulfill a function.

The success criteria indicate that all accident sequences requiring low pressure coolant injection considered in the LCS PRA could be adequately mitigated by one leg of any of the low pressure systems, i.e., any one of the four LPCI pumps or either of the two core spray subsystems. The success criteria for coolant Os recirculation requires the same set of minimum components.

(b) The following two simplified schematics are provided to identify the configuration differences between coolant injection and coolant recirculation. Coolant recirculation has the potential for a wide variety of return paths to the containment which increase the success of the recirculation function, llowever, the dominant contributors to failure of coolant recirculcation are included in either the coolant injection function or containment heat removal function (not shown here).

COOLANT INJECTION AND ONE MODE OF Tile COOLANT COOLANT RECIRCULATION RECIRCULATION e entainment c

brey

_ f

~

= ~

l\

A

~

Nector w e si w

\ minst w I g y[~ PalNperession

\7--)g s-- }\ 1 LKl or 3 $ () ECW [ L . - rl

\ ul cs ws Q-44 Rev. 5, 9/82

l l

It should be noted that the coolant recirculation function is a carryover from the WASil-1400 PWR

,_ terminology and is not a BWR system.

s- )

(c) Failure of coolant injection / recirculation functions over the period 0-20 hours is included in the evaluation

, ot the conditional probabilities of component-failure. .

In this way the failure of components to run are l included in the quantification. It must be noted that the dominant contributors to the calculated conditional probability of system failure are demand failures.

4 (d) The most likely scenarios following reactor shutdown are that the required ECCS or PCS equipment are available to safely cool the core and containment and that no d

significant degradation of containment or reactor ,

building environmental conditions exist. The PRA does however consider the possibility that an initial failure ,

to start or a subsequent failure to run m.y occur in the long term containment heat removal process (includes recirculation as a function). If this occurs, a conditional probability for successful repair within'20 '

hours is also incorporated. The degraded conditions ,

which might exist were taken into account insofar as they may affect repair. The degraded conditions, i.e.,

high suppression pool temperatures and potentially high (s Reactor Building temperatures, are within the envelope of ECCS equipment operating capability. liigh

() containment pressure conditions were modeled to include  ;

an appropriate high exhaust pressure trip of IIPCI and RCIC turbines.

/

7

• Core spray can recirculate through the reactor vessel only. ,

2 G

Q-45 Rev. 5, 9/82

QUESTION 3.22 O What is the probability of failure for tbt secondary containment (p. 3-50)?

Civen the unity probability for a number of the branches with MSIV not open, what do TW, TWE, TA, TAE, TQ, and TQE signify?

RESPONSE

(a) The question relates to the lack of a probability value for secondary containment failure on page 3-66 (Figure 8.4.7). This figure is modified in revision 5 to the PRA to clarify the meaning. The presence of the function, " Secondary Containment", on the event tree was superfluous. It was originally intended to distinguish between cases with relatively small leakage even though the rapid pressurization of the containment during an ATWS condition without mitigation generally precludes obtaining significant benefit from the secondary containment. Ilowever, in the most likely scenario in which the intent of Alternate SA is accomplished, the following will occur:

• feedwater will be successfully runback and the recirculation pump will be tripped, O

• the turbine bypass will open and accommodate the steam flow,

• the condenser will be available as a heat sink, e the MSIV's will remain open, and

• ARI or SLC will eventually be used to bring the reactor to a shutdown condition.

For this scenario, the secondary containment remains intact.

(b) Again the secondary containment branches are superfluous and are not used in the quantification of the event tree. They have therefore, been deleted by Revision 5 to the PRA.

O Q-48 Rev. 5, 9/82

QUESTION 3.23

/ h The report states (p. 8-56) that with multiple relief valves

-/~ failed open, the RHR is required to operate successfully.

In there a time limit on how long multiple relief valves could stay open before exceeding the capability of the RIIR system? Has this been accounted for in the PRA7

RESPONSE

f The referenced statement has been revised in Revision 3 to the PRA and is now on p. 3-72. The statement now reads as follows:

"For those cases where multiple relier valves fail open, the analysis conservatively requires the RilR to operate successfully on the assumption that the MSIV's will close."

The above statement is in reference to a turbine trip ATTS event. For cases where the MSIV's do not close (or are reopened), there would be no definitive time limit (at least

, 5-6 hours), since the reactor would depressurize with most of I

the generated steam going to the main condenser. Credit for i this case was not taken in the analysis (with relief valves i open).

The cases analyzed assumed an isolation and a requirement for both RIIR's to operate when multiple relief valves are open.

' This a somewhat conservative treatment as discussed in Footnote 11 of Section 3 of the PRA. With one relief valve open, the suppression pool heatup rate would be 2-3*F/ minute for the conditions of this event. No analysis was performed for mulltiple valves stuck open.

The probability used in the event tree for operator j initiation of RllR was 0.99, based on Table 21-1 in Swain and Guttmann t'3. The referenced table can be applied in several ways, i.e., with or without a dedicated operator, and with or without shift operator backup. In an ATYS event, RHR initiation is a vital function which must be performed manually. It is expected that this will be stated clearly in the Emergency Operator Procedures and understood by the operator and other control room personnel, so that necessary actions can be expected to be taken within 5-10 minutes resulting in peak suppression pool temperatures below saturation. At 15 minutes, with multiple relief valves open, it may be assumed that pool temperatures would peak at a temperature.above the pool saturation point and containment pressure would rise (at 250*F, containment pressure would be VO ~15 psig) l Q-49 Rev. 5, 9/82 m , ._, ,.

QUESTION 8.24 O)

(

The IT CM C2 sequence (p. 8-57) does not use COR due to "high radiation associated with incipient fuel failure". Why is there no incipient fuel failure with the TI CM R sequence on that same page? A related question is to give the basis of l the 90% MSIV isolation assumption for the IT CM C2 sequence. l l

RESPONSE

The referenced statement has been revised in Revision 8 to the PRA and now appears on p. 8-78. The TT CM R sequence is l treated as a Class IV sequence; i.e., containment fails prior to core sett (due to the high rate of stems flow to the suppression pool). This treatment also applies to the IT CE R sequence.

The statement regarding 90% MSIV isolation is not applicable to Revision 8 of the PRA.

(Note also that COR is not included in the analysis.)

m U

Q-51 Rev. 5, 9/82

QL'ESTION 3.25 l.(,mj The TTI CM R sequence (p. 3-57) states that it is " assumed" l \~ / that RPT and FW runback are tripped from the sane set of logic and sensors. Are they in fact tripped from the same logic and sensors? What flow rate does the FW run back to?

lias the case been investigated in which the FW runback does occur, but the RPT does not? This would seem to be a more liniting car.e, since vessel inventory would be rapidly decreasing.

RESPONSE

The referenced statenent is on p. 3-73 of Revision 3 to the PRA and has been revised as follows:

"Since RPT and feedwater runback are tripped from the sane set of logic and sensors it was conservatively assuned that RPT failure would also result in failure of feedwater runback and recriticality due to dilution of the boron."

RPT and feedwater are tripped from the sane set of logic and sensors, but could still fall independently. Independent failure was nodeled for feedwater runback given successful g RPT, but RPT failure was treated as always resulting in a i Class IV core melt.

J Feedwater runback is to zero flow.

The case where feedwater runback occurs, but RPT does nct, has been investigated and is found to be the more limiting case in regard to the effect on the core. Ilowever , the connon failure of both feedwater runback and RPT has the greater affect on risk since it results in a Class IV event, whereas feedwater runback with RPT failure would result in a Class III event.

O

\

V' Q-52 Rev. 5, 9/82

l l

QUESTION 3.26

(N Page 3-60 states that ARI is successful if, and only if RPT

\_,) is successful. Provide detailed information on ARI.

RESPONSE

(The statement is on p. 8-86 of Revision 3 to the PRA.) The referenced statement is the following:

"b) ARI is effective if and only if RPT is successful."

The reason for this is that ARI requires 25 seconds (maximun) to insert control rods. Therefore, in the absence of RPT, the reactor would remain at full power for 25 seconds. For cases where the MSIV's are closed, the RPV pressure would rise to approximately 1400 psi with all safety relief valves open. In the Limerick PRA, this was c6nservatively assumed to result in a LOCA and Class III core me it.

ARI is a diverse means of providing a scran signal to the control rod drives. It uses different sensors, logic, and valves than the reactor protection system. The ARI signal is generated by the same sensors and logic as the RPT signal.

Both are initiated by either reactor water level 2 or RPV

-- high done pressure.

u.)

O Q-53 Rev. 5, 9/82

5 QUESTION 3.28

/~

. '( (Top Paragraph, p. 3-86) The statenent is made that the diaphragn floor is drained into a sump and the downconer pipes. This drainage capability clininates the possibility of a noiten core dropping in one large nass from the vessel directly into'a pool of water. Ilow does this statenent apply if containment spray is used? The downconers are approximately one foot above the floor level so a large amount of water can accunulate on the floor prior to the molten core dropping. It is realized that no credit for containnent spray has been assumed, but have negative effects, such as the above or excessive stean production, been accounted for?

RESPONSE

There are three possible scenarios which could lead to an l accunulation of a large amount of water on the drywell floor, i These incluie:

I

1) A degraded core accident initiated by a loss of coolant fron a pipe break in the primary containnent which results in the prinary coolant j'~'g discharging into the drywell region.

V 2) A core melt accident where the containnent sprays are initiated but fall prior to the RPV Sotton head i failure, and

{

8) A core melt accident where the sprays work and renain functional throughout the degraded core ace! dent progression.

For these postulated core nelt accident scenarios, the core debris could potentially fall into a large pool of water.

For stean explosions, the inportant parancter to consider is the maximun quantity of nelt which could interact with the coolant and efficiently nix before the nelt solidifies or an l Interaction occurs.

Some Sandia National Laboratory exper ts indicate that the relative volume fraction of the melt anall conpared to that of stean and water at the tine of e spontaneous explosion ('). Based on the total anount of water that could accumulate on the drywell floor, it seens likely'for stean explosion to occur for the three scenarios stated above.

However, it is inportant to note that the maxinun anount of nelt available for nixing would be that portion of the core nelt mass which is notten at the fine the interaction occurs, since this wculd deternine the potential for containnent

[V) failure.

Q-55 'e v . 5, D/82

Considering the BWR Reactor pedestal geometry, the CRDM ard its associated support structures represent a large heat sink. The thermal capacity of these structures should allow O some of the core melt mass to solidify prior to fuel coolant mixing.

In addition, the geometry of the drywell floor

• is such that an efficient core-coola'nt mixing and fragmentation may not be likely in a shallow pool. Based on the above, a steam explosion that could generate enougheenergy which could create a missile that could fail containment is judged to be unlikely.

It may be possible, however, that the steaming rates for the first two scenarios may be sufficient to fall the containment by overpressure, depending on the accident class. That is, the required steaming rate to fall the containment is reduced if the accident class is such that the containment pressure is already elevated at the time of RPV bottom head failure.

For the third scenario, where the sprays are functional at the time of the interaction, the steaming rate required to fall containment must be much greater than the high condensation rate on the spray droplets, in order to fall the containnent by overpressurization.

These types of scenarios are implicit in the ex-vessel steam explosion failure probability used in the PRA, based on the analysis given in Appendix II,Section IV.A., pages 59-00.

• The downconers lip extends approximately 1 1/2 feet above the floor which limits the amound of debris and water mass that can remain in this area.

(') -Sandia National Laboratories, Light Water Reactor Safety Research Program Quarterly Reports for the following periods: July-September, 1979, October-Decenber, 1970 April-June, 1980, July-September, 1980.

O Q-50 Rev. 5, 9/82

QUESTION 8.80 What are the bases for the selection of the probabilities on

( {\'- the containment event tree? Address each containment failure mode in detail.

RESPONSE

General Response The containment event tree for Class I, II, and III is Figure 8.5.6a on p. 8-114 of Revision 8 to the PRA. The Class IV CET is Figure 8.5.6b on p. 8-115. These figures contain numerical errors as submitted in Revision 8. Corrected figures are included. Conditional probabilities as utilized in the Limerick containment event trees (CET) were developed utilizing:

• analysis and data extrapolated from WASH-1400 e deterministic and probabilistic analysis from the literature or performed sinc = WASH-1400 by a variety of contractors and national laboratories, including the Limerick GS architectural engineering firm, Bechtel; and PEco consultant, Fauske

\s,, Associates e engineering judgment and expert opinion Two sets of CET conditional probabilities were developed, each containing a spectrum of potentiat containment failure modes extending from small leaks within the capability of the SGTS to large energetic failures of containment. The following distinction can be made between the treatment of the static overpressure failures:

• for Classes I, II, and III, accident process sequences were predicated upon the fact that pressure would build slowly inside containnent and that the eventual failure of containment due to static overpressure could involve any of a specturn of potential leakage path sizes.

• for Class IV it was predicted that even a " static" overpressure failure would occur sufficiently fast to preclude the likelihood of leakage before failure and; therefore, the failure would most probably correspond to a large size containment failure.

O Q-58 Rev. 5, 9/82

In the Limerick PRA, it was conservatively modelled that essentially all tPC.9%) core melts would lead to containment fs failure by one of the postulated failure modes.

Conditional Probabilities for Specific Containment Failure Modes (CFM) a - in-vessel steam explosion - this CFM refers to failure of the primary containment as a result of a large scale molten core-water interaction in the vessel which produces a blast wave and/or energetic projectiles. In WASH-1400 this event was given m. frequency of 0.01 given a core melt. Since that time, significant efforts have been made to identify conditions under which such a release of energy would occur.

At the time the LGS PRA was performed, no probabilistic data ,

was available other than WASil-1400. Reference deterministic j data from Sandia indicated that such reactions were extremely unlikely under conditions of high in-vessel pressure and high coolant temperatures. Work by Fauske & Associates (Appendix H) further indicated that the configuration of BWR internals and the additional amount of channeling in a BWR core made the likelihood of a " coherent" oxidation reaction very unlikely. Based upon conversation with Corradini (Sandia), a conditional probability of in vessel steam explosion 1 sufficiently energetic to simultaneously fall containment was assessed to be 10-"/ core melt. This probability is a factor of 10 less than that used in WASil-1400 to characterize this event.

r-ex-vessel steam explosion - this CFM corresponds to

. n failure of the primary containment as a result of_ a large scale core / water reaction taking place in the containment after failure of the reactor pressure vessel. In WASil-1400, j values for the frequency of this CFM were assessed only for a limited number of sequences, principally sequences initiated by large LOCA's with a significant amount of water in the drywell. Non-zero values estimated ranged from 0.01 to 0.18.

For the LGS MK II over-under containment design, the potential for in-containment stean explosions was assumed to exist for all sequences resulting in core melt. Direct access of a molten core to the wetwell pool in the LGS containment would have to occur through the downconer vents or through small drains to penetrations in the floor of the CRD room (vessel pedestal region). Access is limited since the risers on downconers would have to be failed or the drain cover melted through. Fauske & Associates ( Appendix II) work Indicated that there would not be sufficient core / water interface in the drywell to allow a major reaction.

Furthermore, reactions in the suppression pool would be limited in scope and the large amount of steel and concrete structural components would tend to cause a non-coherent reaction to occur. In light of the above qualitative observations a value of 1x10- / core melt was used to reflect the judgment that the event of an ex-vessel steam explosion

( is considered highly unlikely.

Q-59 Rev. 5, 9/82

l 9'-H 2 burn failure - for this CFM, failure of.the primary containment is assumed to result from increased containment gs . pressure'due to a reaction of hydrogen in the primary

( l containment. The TMI-2 accident indicated that potentially l \' large releases of hydrogen are possible given a core overheating event. Normally the LGS containment is'inerted, and even in a' core overheat scenario insufficient oxygen would exist in primary containment for hydrogen combustion.

It was assumed that the containment may not be inerted during reactor-operation for up to 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> per year. Therefore, for the amount of zirconium available in the LGS core and the size of the primary containment, it was determined that a hydrogen burn, when the containment is not inerted, could be

generated with sufficient pressure increase to fail the containment. Since it can be construed that a core melt during this potentially uninerted time would likely be accompanied by hydrogen conbustion, a conditional probability of 0.01/ core melt (70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br /> /7000 hours) was conservatively

• chosen for containment overpressure failure due to hydrogen

, combustion.

p' - H 2 *xPl osion - This CFM is instantaneous overpressure due to a pressure spike caused by a hydrogen explosion. The probability of an explosion and the size of the resulting pressure spike are both controlled by the degree of H2 concentration. It was estimated that no more than 107. of the

. time would conditions exist to provide sufficient hydrogen to produce a pressure spike large enough to fail the containment.

6 ,

containnent leak sufficient to prevent overpressure -

In the event that no steam explosion or H2 e abustion induced

] failure occurs, the containment may fall by overpressure. g 4

These CFM's refer to a failure of the containment with an {

equivalent cross sectional area greater than 2 ft2 in a variety of locations including y (in the drywell), y' (in the wetwell and y"(in the wetwell containment wall below the j water line such that the suppression pool inventory may be drained into the Reactor Building). In lieu of any deterninistic or probabilistic infornation, an overall probability of 0.5 was assigned for large energetic failures ,

in Class I through Class III CET's, and a value of 0.999G was used for Class IV for the reason discussed above in the general comments.

l V, y', v"- containment overpressure failure - Given the g fact that the two most likely containment failure locations were identified as:

t

• at the interface between the diaphragm and the primary conatinment wall, or i

• mid height in the wetwell a s

i. -e l

.Q-60' Rev. 5, 9/82

kn the y and v# failures were estimated to be equally likely, with the v" failure mode having a probability reduction factor of 10.

(/6 -

large leak - The 6 and ( CFM's refer to conditions in which significant leakage may occur to prevent energetic containment failure. These are failures of the containment for which secondary containment decontamination may be significant; 6 refers to the smallest size break equivalent to less than a 8" diameter hole and ( to a larger break equivalent to a hole 0.5 ft2 in cross-sectional area.

Without further information on the leak before failure, these two modes were evaluated as equally likely.

(c , ec -

large and small leaks with SGTS failure - These CFM's represent large and small primary containment breaks in which the standby gas treatment system fails to operate resulting in structural failure of the secondary containment and direct leakage to the outside. Reliability of the SGTS is estimated on the basis that it is similar to systems designed to minimum single failure criteria operating in an unusually hostile environment.

For the small (6) break a conditional probability of 0.1 that the system will not be effective is estimated. For the larger (() break som'e further degradation of system effectiveness would be expected and the probability of SGTS failure is doubled.

OK - Containment failure does not occur - the possibility exists that if no significant leakages occur, some sequences would not result in containment failure because of the

_ passive containment capability or active damage control measures. Since no credit was taken for active recovery measures such as recovery of coolant makeup or containment sprays, the probability of this CFM was estimated to be quite small (0.0005 for Class I, II and III, and 0.001 for Class IV.)

• It is unlikely that the reactor core will be at full power during times when the containment is not inerted.

l O l Q-G1 Rev. 5, 9/82

l QUESTION 3.31 m

i Why was an average value of 10-* per event used for a

-(b coherent in-vessel steam explosion when more detailed values of 10-2 for a steam explosion during a LOCA event and 10-*

for a steam explosion during non-LOCA events were stated on

p. 8-1147

RESPONSE

The value of 10-8 per event used in the Limerick analysis is based on the Sandia Laboratories analyses and small scale experiments. The Sandia evaluation concluded that steam explosions could occur but with insufficient energy to fait containment. Therefore, the WASH-1400 value of 10-2 with a reduction factor of 10 was used in the Limerick PRA. Lower values (e.g., 10-*/ challenge) have been identified for certain sequences at high reactor pressure. However, a value of 10-* for non-LOCa events was judged not applicable since for BWR's, the emergency procedures guide calls for the operator to depressurize the primary system during all non-AIWS transients.

O c)

L Q-G2 Rev. 5, 9/82

QUESTION 3.32

,n (N' ) Provide supporting analysis and/or calculations to show that RCIC (as stated on the bottom cf p. 3-104) alone or HPCI alone is adequate for coolant inventory makeup during an ATWS condition and does not result in core meltdown.

RESPONSE

The basis for the success criteria for llPCI/RCIC during an ATWS (Table 1.3) was extrapolation of licensing design basis transient analysis to realistic conditions. Subsequent to the issue of the PRA report, an analysis was perforned for the Susquehanna BWR/4. (1)

The NSSS for Linerick is very similar to Susquehanna. The only major differences are that Lincrick has greater HPCI capacity, and HPCI is split between core spray and feedwater sparger in Limerick; whereas HPCI enters entirely through the feedwater sparger in Susquehanna. These differences have no effect on a case in which HPCI is failed, so the results of the Susquehanna study are directly applicable to Limerick for the RCIC-only case. The REDY computer code was used to simulate an MSIV ATWS with IIPCI failure. Power values fron this REDY run were then input to the SAFE-0G computer code to

'~' calculate transient water level. It was found that the mininum water level was 0.8 ft above the top of the active fuel. The conclusion based on the Susquehanna study is that RCIC alone is capable of maintaining water level above the active fuel.

Since HPCI capacity is nearly an order of nagnitude greater than RCIC capacity, HPCI alone is also capable of naintaining adequate coolant inventory. The differences in HPCI injection method do not materially change the success criteria evaluation.

Reference 2 discusses fuel clad analysis for the worst case ATWS MSIV closure event with IIPCI/S failure. This event was for a BWR/G with 8G CPM SLCS. Less than I ft fuel uncovery was experienced. The peak clad temperature calculated for the covered portion of the fuel was 1784*F, well below the 2200*F linit for fuel integrity. The peak clad temperature in the uncovered portion of the core was even lower, since the power level was lower. Since the fuel remains covered in the BWR/4 (Susquehanna) analysis, the fuel conditions are much better, and neltdown will not occur.

fN )

Q-63 Rev. 5, 9/82

r_- _ . - - - . _ _ - - _ _ - _ _ _ _ _ - _ _ - - . .. ..

f pasalbly trus, is covered by the pestulatad split in containment failure modes between wetwell and drywell.

(

Appendix J indicates on page J-7 "The predicted failure above 140 psig is a split along a meridional (vertical) crack at the wetwell wall midheight. The verticle crack failure is contained to the midheight of the containment by the restraint of the base slab and the diaphragm slab. However, at the failure of the diaphragm slab connection (across liner), the wall loses its restraint at the diaphragm slab and the vertical crack will propagate very rapidly towards l the top of the wetwell wall."

On page J -G it says "An evaluation of the finite element analysis concludes that the' ultimate strength capacity can be increased due to the influence of the base slab and diaphragm slab" "However at approximately 170 psig internal pressure, the diaphragm slab containment wall connection becomes overstressed and a general yield state occurs in the midheight of the containment wall."

It was concluded from this discussion that the increasing internal pressure would result in the formation of a liner tear along a meridional crack at the wetwell wall midheight. l This would occur at approximately 140 psig. However, a l significant pressure increase would still have to occur prior j to failure of the diaphragm slab. Hence the 140 psig criteria and the statement, "llowever , at the failure of the

) diaphragm slab. . . ." Indications are that such a liner tear would not propagate after pressure relief. occurred due to the tear. It is stated in a WASil-1400 analysis of a reinforced concrete structure that "When this [a concrete failure extending to the liner] happens over a large enough I area, the combined tension and bending will cause a blowout

with the possibility of the crack propagating several feet before the sudden release of the internal pressure will cause itsto stop." Appendix J also states that the crack will propagate "towards the top of the wetwell wall." The distance between the midheight and the drywell volume is nearly 30 feet. Since this is much larger than "several feet" and since a tear is likely to occur prior to the pressure reaching a value sufficient to fall the diaphragm slab (first quotation), it was felt with reasonable confidence that the crack would remain within the wetwell volume due to pressure relief.

Since the most likely identified failure would be in the wetwell a 50/50 split between wetwell and drywell represents a responsable conservatism.

' \.

Q-68 Rev. 5, 9/82

' QUESTION 3.36 Where in the report is the propagation of uncertainties for the dominant sequences T qUX, p ATWS and LOCA documented *t

RESPONSE

The characterization of uncertainties in the Limerick PRA is addressed in Section 3.8. The progagation of uncertainties for the dominant sequences is described briefly in Section 8.8.2.

i i

?

i 1

O Q-69 Rev. 5, 9/82

QUESTION 3.38

/

(m s_/

) Provide discussions as to how the following parameters in Table 3.6.5, which were part of the inputs to CRAC, were determined.

Time of release Duration of release Warning time Elevation of release, and Energy release What were the values of the above mentioned parameters for the sequences C2 Y #

and C3 v' in the same table?

l

RESPONSE

Data on release parameters as given in Table 3.G.5 are extracted from several sources including LCS design,WASit-1400, and the LGS in plant consequence analysis. Reference should also be made to Table 3.G.3 of the LCS PRA Volume 1.

Generally, release parameter data definitions are those utilized in WASil-1400:

A. time of release - the time at which a hypothesized release from the plant occurs relative to shutdown.

( This is the time at which release from the plant

~

can begin, which is assumed to be either of the following two cases:

1. At the initiation of gap release and core melt, for those cases in which coitainment may have failed prior to placing the core in jeopardy, i.e., Classes II and IV

2. Following containment failuie, for sequences in which the containment is challenged substantially after core melt initiation.

B. Duration of release - the time over which a release actually occurs. This is the time over which release of radionuclides would be dispersed and it is influenced by the rate of nuclide release as well as the time and energetics of containment failure. Although only puff releases are utilized in the ex plant consequence model, this parancter is used to establish an effective plune width allowing for plume expansion as a result of variations in wind direction and speed over a specific period of time. For energetic and fast reactions the release duration is short since

[ nuclide release occurs quickly following an abrupt

}-

\._/ containment failure.

I Q-71 Rev. 5, 9/82

For release in which containment fails after core melt occurs, containment failure initiates the release. The duration of the release is O approximately the time necessary for complete discharge of the containment.

For releases in which containment failure precedes core melt, the duration of the release will be approximately the time from gap release to the end of the fuel solids vaporization.

C. Warning time - the time available for initiation of an evacuation. This is the time available between the determination of an iminent release and the time when the release occurs. An evacuation is initiated at the time the determination of an imminent release is made and the effectiveness of the evacuation is influenced by the length of time available. There is some imprecision as to the time when an evacuation would be initiated. In the LCS PRA, for those sequences in which the containment is postulated to fail first (i.e.,

Classes II and IV), the warning time is the time available from the decision that the containment could be in danger until the time that the release occurs. For sequences in which core melt precedes containment failure, evacuation was presumed to be initiated at the time core melt becomes imminent.

D. Elevation of Release - the height at which a release of materials from the plant is assumed to occur. The height of release is of significance since the wind direction and speed are often quite different at an elevated location beyond the ground level wind shear. The two types of likely release

-location at the Limerick site include the followings a) blowout panels in the secondary containment and; b) through the HVAC system which discharges through a vent from the release treatment system, but which is not assumed to be effective for massive releases, the ducting and vent provide an exit path from secondary containment. For the LCS PRA, two elevations of wind data were available: a) at essentially ground level and; b) at 25 meters in height. These releases were divided into those which were presumed to fall a low blowout panel and those which would likely initiate failures of an upper level panel or be channeled out the vent.

E. Containment Energy of Release - the amount of energy in terms of thermal energy (sensible heat) which is available as a~ driving force for release of nuclides from a failed containment. Release 0 energetics are a significant influence since a highly energetic release tends to elevate the Q-72 Rev. 5, 9/82

radionuclide plume and reduce fatalities near the plant for some accident sequences. For energetic and fast releases, the release energy is expected

.(s)J to be high. For releases which are the result of overpressure after the completion of core melt and substantial vaporization, the initial energy of release would be high. For releases which occur after failure of the primary containment, the available driving force of release from containment is essentially only that of the core melt process, which is small.

Specific estimates of release paraneters for the LCS PRA are defined as follows using the preceding general criteria and Table 3.6.3 of the LGS PRA.

A. Time of release

• in vessel steam explosions - the time of release is estimated as the time at which the steam explosion occurs. In keeping with WASH-1400, the steam explosion for sequences where the containment is intact (such as TQUV), is assumed to occur when core melt is half completed. For cases in which containment fails first (such as Class II and IV) it is assumed that core melt reaches completion and that the steam explosion occurs in the bottom p head. Estimates from RACAP for expected core

( / melt initiation times are used to estimate the time of the steam explosion.

• ex-vessel steam explosion - again the time of release is estimated as the time of the explosion. It is assumed that the explosion 1 immediately follows vessel failure and the tines of vessel failure are taken fron RACAP.

• overpressure failure of the drywell - this data is taken directly from RACAP data. For sequences in which containment failure occurs first, the start time is based on the assumption that all makeup to the reactor core becomes unavailable at the time of containment failure.

B. Duration of Release - only two values were utilized, depending on whether or not release and containment failure were simultaneous. Thus, all steam explosion events were assumed to be distributed over a half an hour, with overpressure events taking approximately two hours.

C. Warning time - Warning time is estimated separately

[h

%. /

for each accident class. For Classes II and IV, where containment failure initiates melt down, the Q-73 Rev. 5, 9/82

l warning time is the period following containment ,

failure through the start of substantial melt down f-ss and is taken from RACAP data. For Classes I and III, the warning time, as illustrated in Table

('-} 8.6.3, is taken from RACAP as the time between the

' initiation of substantial melting and the time of containment failure.

~

D. Elevation of Release - Only two elevations of i release are considered. All o , p, y and v' releases are assumed to fall secondary containment -

blowout panels high up or be released through the vent. For the V" failure mode, release is assumed to be at ground level.

E. Containment Release Energy - A value of 130x108 ,

BTU /hr for steam. explosion was extracted from WASH- '

1400. Containment overpressure failures preceded by core melt are assumed to be almost as energetic as early failures of containment followed by core melt. Data are again taken from WASil-1400.

Table 3.G.5 is revised by Revision 5 to the PRA.

f S

t .

4 l

t i

i F

1 Q-74 Rev. 5, 9/82

,.____..,..___,,____-..,_.--....___t

OUESTION PRA 8.40 What is the probability of failure of fast transfer of non-vital bus power from the unit auxiliary transformer to the station startup bus? Has this failure been accounted for?

RESPONSE

The probability of failure of fast transfer is small (in the range of 0.001 to 0.0001) relative to other non-vital system (feedwater) failures. Operating experience data used in the PRA for loss of feedwater includes such possibility, but is dominated by other system failures.

I l

O Os Q-75a Rev. 5, 9/82

1 1

QUESTION PRA 3.41 l Page 3-31 states that all 4 RHRSW pumps were assumed to be

[\ -) available for non-loss of offsite power transients. Page 9.2-9 of the SAR (last sentence of third paragraph) states that during Unit 2 construction, the C and D RHRSW pumps will not be available since they sre powered from Unit 2 buses.

(Pumps A and B from Unit 1 buses A and B and pumps C and D from Unit 2 buses A and B as stated in that same paragraph.)

Table B.5.1 on p. B-44 of the PRA shows all RHRSW pumps to be powered from Unit 1. Explain these discrepancies and state if all 4 RHRSW pumps will be available for Unit 1 even'during Unit 2 construction.

RESPONSE

The PRA is correct. The FSAR will be changed. PRA Table B.5.1 will be modified with a clarifying note that C&D RHRSW pumps are powered from Division I and II of Unit 2 and that all four pumps will be available for Unit 1 operation while Unit 2 is under construction.

\

x Q-75b Rev. 5,'9/82 e

, e - -

m- v w

QUESTION PRA 3.42

-On p. 8-78, statements are made on the contribution of certain sequences to be degraded core condition Class III and Class IV. Provide further discussion on the process used in determining the. contribution to each class. Provide the basis for selecting the 80-20% allocation of Class III and IV which is reported in alI of the ATWS event trees.

RESPONSE

The discussion which foilows describes this process and its basis. One plant feature contributing to the outcome of the postulated ATWS event is the operating range of HPCI and RCIC. Both of these turbine powered high pressure injection

sources have a number of trip points. One of these trip points is the setpoint on turbine exhaust pressure. If the containment pressure is higla (greater than 25 psim for RCIC and 65 psia for HPCI), these turbines wiiI he tripped, and restart will not occur unless the operator manually overrides the trip. Instructions to perform this action are not anticipated to be incorporated into the Limerick procedures i nor do they exist in the Emergency Procedures Guides (EPG).

There are two basic scenarios for the sequences IT1 CM C2, TF2 CM C2, TES CM C2 and TI4 CM C2.

I. Following loss of SLC, HPCI/RCIC run and keep the core covered. Continuous operation at high power results in increased containment pressure. HPCI/RCIC is expected (with probability 0.80) to trip on high turbine exhaust pressure and not be recovered by the operator. With no coolant make up, the core then melts, and sometime later containment fails (Class III).

II. Following the loss of SLC, HPCI runs and keeps the core covered. The water keeps boiling off so that containment pressure increases. If HPCI continues to run (probability 0.20), then the containment may be breached while the core is still covered. Later, the core may melt, with a release directly to the atmosphere (Class IV).

The determination of the HPCI ability to continue operation despite the continued deposition of steam into containment was made with consideration of the follcwing possible conditions:

Q-75c Rev. 5, 9/82 1

1 1

. _ . _ . _ . , _ . . . . _ - . _ _ _ _ . . - __ --- --- .- - --l

RESPONSE TO QUESTION PRA 3.42 - CONTINUED O 1. Containment leakage so large as to limit containment pressure below 65 psia despite approximately 30% power and steam generation. Conditional. probability approximately 0.05*.-

2. Probability of the operator overriding the HPCI interlock oithout a written procedure and without any training approximately 0.15*.

8. Failure of the high pressure turbine exhaust trip approximately 0.002.

Conservative values are used to avoid Anderestimating the contribution to Class IV, which has the largest radionuclide release fractions.

• These are conservative estimates, significantly larger than any data source would indicate.

O O Q-75d Rev. 5, 9/82

QUESTION PRA 3.43 O

V On p. 8-78, a paragraph was devoted to address the operation of the HPCI systes and its relation to the classification of degraded core classes for the TF CM C2 sequence. In the ATWS feedwater event tree, (p. 8-78) the unavailability of the BPCI system is not considered. Provide the rationale for including HPCI when the sequence is evaluated for accident classes but not includir.g it in the relevant event tree.

RESPONSE

In Revision 8 to the LGS PRA, the ATWS Event trees were revised, based upon deletion of the Bridge Tree. The method chosen for display of information was a footnote and text, rather than a modification to the event tree structure. The information presented is equivalent for either method of

. presentation. The footnote states that some sequences (sequences leading to high containment pressure), are 80%

Class III and 20% Class IV. This split is based on the probability of continued operation of HPCI/RCIC. See the answers to Question PRA 8.42 and PRA 8.47.

O i

Q-75e Rev. 5, 9/82

u.

QUESTION PRA 3.44

/,, \.

D The Limerick PRA, Rev. 4 assumes a single value of 0.5 for the split between containment leakage failure and overpressurization failure in the containment event tree.

Perform a parametric study to, determine the sensitivity of the accident consequences (risk) to different values of containment leakage / containment overpressure split fraction, e.g., 0.1 and 0.9.

RESPONSE

The requested parametric study was performed. The parameter delta on figure 3.5.6a (page 3-114) was assigned a value of 0.9 (the probability that no containment leak sufficient to prevent overpressurization occurs). The containment failure mode splits for Class I, II, and III core melt sequences were then recalculated. Using the existing release category groupings, and applying the recalculated splits resulted in an increase in the OPREL frequency from 6.98E-6 to 1.246E-5 (a factor of 1.785). The results of a re execution of the OPREL CRAC case

• shows that the total risk for latents and cost were increased by factors of 1.71 and 1.75 respectively.

f-~ Acute fatalities were not affected as OPREL has no

( j contribution to the acute fatality CCDF.

• The other four leakage cases typically run with CRAC

. (0XRE, C4 GAMMA, C4 GAMMA PRIME and C4 GAMMA DOUBLE PRIME) are not affected, since OXRE does not contain delta, and the Class IV cases were run with delta equal to 0.0004; i.e., a low probability that the containment would leak fast enough to' prevent overpressure failure for ATWS sequences.

i i-O Q-75f Rev. 5, 9/82

QUESTION PRA 8.45

.V Page D-12 (top paragraph) discusses the Reactor Building blowont panels which are located roughly at ground level.

-The third paragraph on the same page discusses blowout panels inside the SGTS exhaust stack which would cause the release at approximately 25 meters. Provide drawings and descriptions of the blowout

• panels and state which one would fail first due to overpressure.

l'

RESPONSE The discussion of a blowout panel located in the SGTS stack on pages D-12 and D-18 is in error. A revision to these two pages is provided in Revision 5.

All blowout panels are set to function at G.25 PSID.

However, which one would operate successfully first would be dependent on the location of the primary containment failure.

An explicit evaluation of secondary containment blowout panel operation was not made in this analysis. A description of the various panels existant in the secondary containment design follows:

() 1. Main Steam Tunnel Blowout Panel to Turbine Enclosure LOCATION - See FSAR figure 1.2-16 and 8.6.6 i

PURPOSE - See FSAR Sections 3.6.1.2.1.2 BLOWOUT SETTING - 0.25 PSID (See FSAR Figure 8.6-11)

2. Main Steam Tunnel Blowout Panel to Steam Release Stack LOCATION - See FSAR figure 1.2-16 PURPOSE - See FSAR Sections 3.6.1.2.1.2 BLOWOUT SETTING - 0.25 PSID (See FSAR Figure 8.6-11)

8. West Stack Blowout Panel LOCATION - See FSAR figure 1.2-71 PURPOSE - See FSAR Section 8.6.1.2.1.5 4

BLOWOUT SETTING - 0.25 PSID (See FSAR Figure 8.6-19) 4 O

, q-75g Rev. 5, 9/82.

-RESPONSE TO QUESTION PRA 8.45 - CONTINUED

4. Southwall Blowout Panel LOCATION - See FSAR figure 1.2-6 and 1.2-16 PURPOSE - Section 8.6.1.2.1.7 & 8.6.1.2.1.8 BLOWOUT SETTING - 0.25 PSID (See FSAR Figures 8.6-28, 8.6-24, & 3.6-27)

O f

O Q-75h Rev. 5, 9/82 l

u

QUESTION PRA 3.46 V

In the May 14, 1982 meeting with PECo, a statement was made to.the effect that in the quantification of the SLC system fault tree, consideration was given to the possibility of an operator failure to reopen valve F036 (p. B-66) after maintenance or testing of the system. Review cf th SLC fault tree indicates a particular value for unavallaallity.

Provide a' discussion on how human error is included in this value.

RESPONSE

The system level fault trees have been carried to the component level. Generic fault trees have been drawn of eac's component type to, define the failure modes included in the evaluated component

• failure probability. The data then used to characterize the conditional failure probabilities is taken from data sources which include these failure modes.

The failure modes of manual valves include personnel error to place the valve in the correct position (see NUREG/CR-1363).

O n

%d Q-751 Rev. 5, 9/82

' L_ -~

$ r

.n, QUESTION PRA 3.47 O What are the high pressure set points for the ilPCI and RCIC

=> ;

+

turbine exhaust trips? What is the error tolerance of these met points? Once the high exhaust pressure set g oint is '.-" .

reached, what are the required operator actions? Are there  ;.

written procedures covering operator action to override this trip? .7

]

RESPONSE ,

The high turbine exhaust pressure setpoints for IIPCI and RCIC ares fs.

~

HPCI -

65 psia _

. t RCIC -

25 pala Q *. -

The error tolerance on these set points is not known at the present time, and was not used (or needed) for the PRA. The ..

operator is not required to override the IIPCI or RCIC high i'

. ., ?

exhaust pressure trips. As indicated in the response t- . . ,,

QUESTION TRA 3.42, there are anticipated to be no '

, e instrucilons for the operator to override these trips.

O V l ,.E e

,y ,

<}

• F-i-

i .)

'2 ei 4 L s, e .

thy 3 ,.

.;. G j _ .- :

's O ,

Q-75) Rev. 5, 9/82 ! y" :. .

.;4g Ai.

+

• r* Y

, 4"

Qt'ESTION PRA 8.48 What capacity was assumed for the SCTS7 The SAR (p. G.5-3) states that the SGTS fans are sized for 8000 CD1 each, but the filter train is sized for 11,000 CDI. What operator action is required to place both SGTS exhaust fans in operation given accumulation on the filter?

RESPONSE

In the accident sequences which included the removal of fission products through the SGTS filter trains a flow rate of 11,000 cfm was assumed. This is the rated capacity of the SGTS filter trains. There are. two SGTS filter exhaust fans with a maximum capacity of 3000 cfm each. In the safety mode of operation the two SGTS fans are initiated automatically.

The flow rate used is higherithan the combined capacity of both exhaust fans. The use of actual flow capacities would not change the results of the PRA. This is due to the fact that all slow leakage accident sequences, with or without SGTS filtration, are insignificant contributors to the calculated risk.

O O

Q-75k Rev. 5, 9/82

,-~ QUESTION PRA S.49 U

For the electric power system fault tree, identify the reference and the assumptions used to obtain the unavailability values of the following basic events a) BATTERY SET UNAVAILABLE b) 4KV BUS OR SWITCH GEAR UNAVAILABLE c) ALL DIESELS FAIL TO START

RESPONSE

m) BATTERY SET UNAVAILABLE - EBY1AINWI (EBY1B1HWI)  : 1.35E-3 (EBY1C1HWI)

(EBY1D1HWI)

Reference:

Table A.2.2 of LGS PRA (WASH-1400 column) median 8.0E-6/hr, EF:8 (log normal) mean: 8.75E-6/hr Assumptions: Assuming monthly testing of battery set, O i.e., T-80 days -720 hrs.

Calculation: U - 1/2 A T -

1/2 x 3.75E-6 x 720

- 1.35E-S.

b) 4KV BUS OR SWITCH CEAR UNAVAILBLE - ESBD11DWI (EBSD12DWI) : 2.0E-5 (EBSD13DWI)

(EBSD14DWI)

Reference:

ANSI /IEEE Std 500-1977, Appendix D 4.5.1 Metal-Enclosed Power Switchgear (Page 182) 1.80E-7/hr recommended 4.6.1 Metal-Enclosed Bus (Page 188) for all 1.16E-7/hr failure modes 2.46E-7/hr Assumptions: Assuming weekly testing, then Calculation: U - 1/2 AT - 1/2 x 2.4GE-7 x 168 l

- 2.1E-5.

]

l O

Q-751 Rev. 5, 9/82

RESPONSE TO QUESTION PRA 8.49 - CONTINUED c) ALL DIESELS FAIL TO START - EALL: 1.4E-4 This basic event is phrased as "all d.iesels fall to start during test, pts.nt being shutdown" in the electrical power system fault tree or "All Diesels in Maintenance" in Fig.

b.5.4. of LGS PRA Appendix B. Thias is a common-mode diesel unavailability due to a Limiting Conditions for Operations (LCO). This requires that when a diesel fail.s a test and is unavailable due to maintenancs, the other diesels are tested.

There is a possibility that other diesels will fall and require maintenance. When this occurs, the LCOs require that the plant be shutdown within approximately one day. It is assumed that all diesels will be unavs.ilable for 12 hrs under this situation, i.e. TD - 12.

From the summary in A.5.5. of LGS PRA, the failure probability per demand of all the four diesels is:

P(1) x P(2/1) x P(8/2) x P(4/3)

- 0.017 x 0.234 x 0.552 x 0.8G

- 1.89E-8/desand Assuming weekly testing, (1 demand /168 hours), then:

U -

ATD - 1.89E-3 x 1/168 x 12 1.85E-4 Alternatively, this can be viewed as a simultaneous unavailability of all diesels for a period of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> every 10 years.

O Q-75m Rev. 5, 9/82

QUESTION PRA 3.50 How have the generic component trees in Section 8.9 been incorporated in the PRA?

RESPONSE

Ceneric component fault trees are used as explained in Section B.9 of the PRA. Their principal use is to provide the reviewer information on the failure modes included in the component failure probabilities. (See, for example, Response to QUESTION PRA 3.46.)

1 O

l t

-Q-75n Rev. 5, 9/82

(. .. .

I QUESTION PRA 3.51 From the diesel dependency analysis (Fig. B.5.5) the conditional probability that diesel 2 falls given diesel 1

, has failed is given a particular value. Has this n lue been used in the loss of electric power anal -is?

RESPONSE

This value and other conditional probabilities, together with the random failure dependency fault trees (Fig. B.5.5), are inserted wherever appropriate in the system level fault trees to quantify multiple diesel failures in the analysis of the loss of electric power, and the application to all system fault trees which depend on electric power. These conditional probabilities are calculated to account for common-mode failuyes which result in failure of multiple diesels. For exanjile, the conditional failure probability of the Boolesn combination ED12CND and ED14CND yields P(BD) -

6.55E-8, instead of P(B) . P(D) - 2.89E-4: and the conditional failure probability of the Boolemn combiaation of ED11CND, ED12CND, and ED13CND yields P(ABC) - 8.37E-8, instead of P(A) . P(B) . P(C) - 4.91E-6.

'O O

Q-75o Rev. 5, 9/82

QUESTION PRA S.52 Bow does LCS-PRA account for diesel's failure to run given start?

RESPONSE

As described in Section A.5.5 Summary of Data Used in the LGS Evaluation (Rev. 8), a diesel's failure to start and failure to run given start are lumped together as diesel's failure to

" start and run", which is quantified as 1.7E-2/ demand for a single diesel. This value is taken from an analysis of the PECo experience at the Peach Botton Atomic Power Station, which resulted in point failure estimates of 7.SE-8 for failure to start and 8.9E-3 for failure to sustain operations (or other failure not associated with starting).

In addition to the operation experience data used to define the failure to start and run'for the individual diesels, there is also a contribution to failures due to failures of the generator or supporting systems to support continued operation of the diesels. These failures are also determined on the basis of failure to start and failure to run. These additional contributors include:

• ventilation system

• personnel errors

• DC supply through the batteries

• generator

• service water l

l i Q-75p Rev. 5, 9/82 h

)

L... -

QUESTION PRA 3.53 (s'- ) Question 8,04 addressed a possible release mechanism due to flashing of the saturated pool at an overpressure containment failure event. What fraction of the suppression pool flashem  !

for each of the relevant containment failure models? Would particulates as well as soluables be released during this time?

RESPONSE I The possible mode of fission product release to the environment of re-entrainment due to suppression pool water flashi g is relevant only to the accident sequence where the >

containment falls after the fission products are released from the fuel and scrubbed by the wetwell pool (Class I and .

III). The CORRAL analyses for these classes assumes that 15%

of the meltdown release (excluding the noble gases) which is scrubbed by the pool

• is re-released back to the containment vapor space, and to the environment, at containment failure.

It was conservatively assumed that particulates as well as  ;

solubles are released during the depressurization which  !

occurs at containment failure.  !

• Reference is made to the response to Question D.08 with f regard to the amount of the gap and meltdown release  !

which could be retained in the wetwell pool water during {

SRV discharge.

i i t

i i

t i

6 I

i jg ,

C f

\~ / Q-75q Rev. 5, 9/82 ,

Cheptar 4 QUESTION 4.01 Explain in detail how Figure 4.8 was generated. What exactly was used to compute the risk of Limerick at WASH-1400 composite site with WASH-1400 data methods?

How was Figure 4.2 " WASH-1400 BWR with updated methods and data" obtained?

RESPONSE

The answer to this qustions was presented at the review meeting in King of Prussia on May 14, 1982, and is repeated herein as a step-by-step pectedure.

STEP 1: Figure 1 (attached) was constructed. This im Figure 4.4 in Revision 8 to the PRA.

In this figure, the upper curve is the early fatality CCDF for the WASH-1400 BWR, and is copied directly from WASH-1400, as published. This curve was not reproduced by the Limerick analysis.

The lower curve is the result of the Limerick PRA O analysis and represents the Limerick early fatality CCDF. This curve was generated from the Limerick final CRAC run.

l The difference between the two curves represents the difference between the Limerick PRA and the WASH-1400 PRA and is due to:

1) Differences between the Limerick site and the WASH-1400 composite site (site differences),

2) Differences between the Limerick plant and the WASH-1400 BWR (design differences), and

8) Differences between the Limerick analysis and the WASH-1400 analysis (data and methods).

STEP 2: Figure 2 (attached) was constructed. This is Figure 4.1 in Revision 8 of the PRA.

In this figure, the lower curve is repeated from Figure 1, and again represents the WASH-1400 BWR, as published.

The upper curve represents the WASH-1400 BWR at the Limerick site, and was generated'by running CRAC with WASH-1400 accident sequence inputs and Limerick site Q-76 Rev. 5, 9/82

~ __--

data inputs (population and meteorology). Evacuation data was the same for both analyses.

p The difference between the two curves represents the effects of the Limerick site to a very close approximation. The site difference is actually slightly greater (<5%), since the upper curve was generated using the Limerick CRAC code and thus includes the difference between the Limerick CRAC code and the WASH-1400 CRAC code. The code difference is small, with the Limerick code producing slighly lower results than the WASH-1400 Code.

STEP 8: Figure 8 (attached) was constructed. This figure is not included in the Limerick PRA report.

In this figure, the lower curve is the Limerick CCDF repeated from Figure 1.

The upper curve represents Limerick without design differences, and was generated by running CRAC with the l accident sequence probability inputs revised to delete the effects of the most significant differences between the Limerick plant and the WASH-1400 plant.

The same release fractions were used as in the basic Limerick run. For purposes of comparison, the upper curve is also equivalent to the WASH-1400 BWR (Line.ick

, O l

with design differences deleted) at the Limerick site, V and using Limerick data and methods.

The difference between the two curves approximates the design differences between the Limerick plant and the WASH-1400 BWR. The exact difference would actually be somewhat greater, since many small design improvements I were not evaluated and the release fractions were not changed to reflect the effect of differences between the MK I and MK II containments.

STEP 4: Figure 4 (attached) was constructed. This is Figure 4.8 in Revision 8 to the PRA.

This figure was constr cted only to allow direct comparison to the WASH-1400 CCDF. In the figure, the upper curve 6 the WASH-1400 CCDF repeated from Figure 1.

The lower curve was not generated directly from a CRAC run. It was generated by applying the difference between the two curves on Figure 8 to the WASH-1400 CCDF, by ratio. Points on the lower curve of' Figure 4 have the same ratio to the upper curve as the ratio between the lower and upper curves on Fig re 8.

p The difference between the two curves represents the same design differences as shown on Figure 3, and that Q-77 Rev. 5, 9/82

la the only difference between the two curves. Thus, for comparitive purposes, the lower curve represents the Limerick plant at the WASH-1400 site with WASH-1400 data and mwthods.

STEP 5: Figure 5 (attached) was constructed. This figure is not included in the PRA report.

This figure was constructed to provide a cemparison between the effect of the data and methose used in the Limerick analysis and the data and methods used in the WASH-1400 analysis. In this figure, the curve that is lower on the left represents the WASH-1400 BWR at the Limerick site using WASH-1400 data and methods. This curve is repeated from Figure 2.

The curve that is uppermost on the left represents the WASH-1400 BWR at the Limerick site with Limerick data and methods. This curve is repeated from Figure 3.

The only difference between these two curves is the difference between data and methods. The data and methods used in the Limerick analysis produced a higher CCDF at the lower consequence part of the curve, and a lower CCDF at the higher consequence end.

I STEP 6: Figure 6 (attached) was constructed. This is Figure 4.2 in Revision 3 to the PRA.

I This figure was constructed only to allow direct comparison to the WASH-1400 CCDF. The curve that is lower on the left is the WASH-1400 CCDF repeated from Figure 1.

The curve that is uppermost on the left represents the WASH-1400 BWR at the WASH-1400 site with the data and methods used in the Limerick analysis. This curve was not generated directly from a CRAC run. It was generated by applying the difference between the two curves of Figure 5 to the WASH-1400 CCDF, by ratio.

Points on this curve have the same ratio to the WASH-1400 CCDF as the ratio between the two curves on Figure 5.

The only difference between the two curves is the effect of differences in data and methods. As shown on Figure 5, the methods and data used in the Limerick analysis produce a somewhat higher CCDF at lower consequences and a somewhat lower CCDF at higher consequences.

O Q-78 Rev. 5, 9/82

l FIGURE 1 O i 1

to~'

TOTAL MAN CAUSED RISK gn-2 w TOTAL N ATUR AL

- R lo 'd i I N l Io W

u 2

io*0 m

io.9 AWASM 1400 SWR O NN N N

'*-s -.

uuERich N

' -e l i to too tooo io.ooo EARLY FATALITIES, x Comparison of WASH-1400 and Limerick D

a f

Rev. 5, 9/82 4-79

FIGURE 2 Effect of Site Differences

-t

% i TOTAL MANf.AUBED RiS8C 2 C l TOTAi NATun a

.s N

4 WASH.teco AT l

' O ., # M !!!- tit,, w [ #"

P Aass 14o0 sem

' 'lil lll P%.,'

j N \,- I! a 1 io ioo icoo 1c.000 EARLY F ATALrilES.X Site Differences Between Limerick Site & WASH 1400 Composite Site i

O Rev. 5, 9/82 Q-80

O- Figure 3 Development of Design Dif ferences e

i

% l TOT AL MAN CAUSED RIS8C l i 10-2 A  !

TOTAL NATUR AL Rt 7

x j ' .4 w

K i l

h 10 5 O -

w E A

~

[

I i

10 4 L ,,,, ,,gg ,

N \ s  ;,ap ermest  !

\ \ Dest (d 4

'7 v \ \ tt8Fe Asacc9$ l

• 10 10*I LIME RICK

\'

10-' .

1 10 100 1000 10.000 h F ATALITIES x ,

Design Difference Between l Limerick & WASH 1400 BWR j

• Equivalent to, WASH 1400 Plant at Limerick Site with Dats & Methods i of Limerick PRA.  !

b v

i i Rev. 5, 9/82 Q-81

FIGURE 4 Ef feet of Design Dif ferences to-t

-2 OT AL MANGUSED RISK TOTAL N ATURAL to-3 to-4 i N b to-s E

O i5 ,0-8 LIMERICK AT THE WASH 1400

• TH E

to-7 M ASw.14aoswR $7,$gojTE S

TA7n HOOS io-a ,& A

,o-9 1

i to 100 k

1000 10.000 E ARLY FATALITIES, X hDesignDifferencesBetween Limerick Plant and WASil 1400 BWR l

O Rev. 5, 9/82 Q 82

O FIGURE 5 Development of Data & Methods Differences 10-'

TOTAL MAN CAUSED RISK gn-2  %

TOTat NATum AL as x

10"#

E $ , WASM 1400 AT x

0 g a

g E-10

.g '

w umamiCK Sitt wtT.M,

.. me Lines.ce6, f

9 1

WE/h ' WASM.1400 AT y 10

- ,s w=n m. SITE =

.LieA.ERICK

-a LiwtnicK  ! 'h I, ' ' ' ' ,

,n-e

• b 1 10 100 1000 10.000 F ATALITIES. X QData&MethodsDifference O

N3 Rev. 5, 9/82

FIGURE 6 Effect of Data & Methods Differences

'*-1  :

% l TOTAL MAM:AUSED RISK 10-TOTAL NATUR AL RISK 10'I u

i'4

=

N b 10-5 5

s E -

so

• E WASH 1400 BWR WITH UPDATED METHODS O AND DATA AT WASH 1400 SITE A

, 10~

M l WASH-1400 BWR

) 10-8 10'I 1 10 100 1000 10.000 EARLY FATALITIES X Data & Methods Difference Between Linerick PRA (revised)

& WASH 1400 Analysis O

1 q._8h Rev. 5, 9/82 '

i

Appendix A QUESTION A.01 Tables A.1.2 and A.1.3 list.the anticipated transients considered in the EPRI-SAI study and GE assessment. Provide clarification as to why transients #14-19 and #22 of Table A.1.2 do not appear in Table A.1.3 In Table A.1.3, under Turbine trip with bypass, transients

1. 36 and #37 are indicated: there are no corresponding numbers 36 and 37 in Table A.1.2 In view of the EPRI survey and the GE assessment, dit:: cuss the major differences noted in Table A.1.3, e.g., loss of condenser inadvertent opening of bypass, turbine trip with bypass. . . etc.

RESPONSE

(a) Revision 3 of the LCS PRA has provided revised tables which correct the typographical errors in the original PRA. These changes have no effect on the identified frequencies.

l (b) The EPRI survey from EPRI NP-801 (July 1978) included

, transient initiators for 12 BWR's for operating

! experience prior to that time. The GE evaluation includes additional data beyond that which is included I

in EPRI NP-801. This additional data includes other BWR's, more recent year of operation, and the initial year of operation is homogenized in the data base.

l

[

f l

O .

-Q-85 Rev. 5, 9/82 1

__ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ___ _ _ ._________]

QUESTION A.03

[U ) In the footnote on page A.12, a statement is made to the effect that due to the controlled nature of manual shutdown, there is an increased reliability of feedwater to maintain reactor inventory. What is the qualitative and quantitative basis for such a statement?

Provide clarification for the statement: "However, coolant injection functions', AWS, and LOCA sequences are not affected by these initiators when they are quantified (p. A-l 12)."

RESPONSE

(a) Transients (i.e., scrams) lead to the abrupt interruption or diversion of normal power conversion operation. Specifically, MSIV clos'ure and loss of offsite power initiators lead to the immediate loss of the main condenser as a heat sink and feedwater as a coolant makeup source. Relative to these initiators a manual shutdown has a benign effect on these functions, and the reliability of FW and PCS for manual shutdown is significantly higher than for these isolation initiators.

l (b) The discussion in Appendix A.1 is provided only to give the render a qualitative assessment of the impact of including a unique event tree for manual shutdown l

initiated events. The quoted statement is an interpretation of the impact of the manual shutdown event tree which is:

• ATWS is judged not to be a contributor to risk during manual shutdowns. Scram challenges induced f by improper manual shutdown procedures are included in the transient frequencies quoted in Appendix A.1.

e A LOCA is not considered as a potential outcome of sufficiently high probability following a manual shutdown to affect the LOCA event trees. The likelihood of a pressure or temperature transient sufficient to induce a LOCA is quite small.

• Coolant injection is explicitly quantified in the manual shutdown event tree. The impact on core melt frequency is approximately two orders of magnitude less than the total core melt frequency.

O Q-87 Rev. 5, 9/82

QUESTION A.05 In addition to pipe rupture, there are other causes which O- could lead to LOCA, for instance, valves failed open, failure of recirculation pump seals. Vere they addressed and properly included in the analysis as LOCA initiators?

RESPONSE

The LOCA initiating frequencies used in the LCS PRA are derived from operating experience data. The data exanined included all failures which could lead to a loss of coolant accident inside containment. Therefore, based upon the data source used for these initiators they are considered to characterize the spectrum of possible failures which could result in the release of primary coolant to the containment.

For exanple:

Snall LOCA's e leaks in large diancter pipes

• Instrument line break

• recirculation pump seal failure

• CRD hydraulic line breaks

• Lenks from valves or other equipnent Medlun/Large e large flow fron pipe leaks LOCA

• large dinneter piping breaks

• Punp casing leaks / breaks In general the failure of a valve to close (i.e., failed open) does not lead to a LOCA condition. There must be another failure in addition to the failed open valve. Stuck open relief valves are considered in the analysis. llowever, since they are piped directly to the suppression pool, they are treated differently than LOCA's which release directly to the drywell.

In addition to LOCA's developed as a class of initiators, pipe rupture is also included in the fault tree developnent.

In the fault tree quantification the conditional probability of this input takes into account not only the pipe and weld failures but also external ruptures of najor conponent 1.e.,

punps and valves. These failures in ECCS equipnent do not O. lead to LOCA's but rather to leaks in the ECCS equipment.

Q-89 Rev. 5, D/82

GUESTION A.07

[' Table A.1.6 gives the probabilities of a LOCA for various 7 cases. Discuss the method, analysis and criteria used in the  ;

selection of the Limerick values.

i RESPONSE l i

The following facts must be considered is the assessment of  ;

LOCA probabilities: 1) Based on estimates from other sources l (e.g., RSS, Bush), a pipe rupture leading to a large LOCA is  ;

expected to occur once every 10,000 plant year. . With this i estimated frequency and the fact that U.S. canulative reactor j experience used was only approximately 270 reactor years,'It t is difficult to to assess the probability of a LOCA accurately by only considering LOCA sensitive pipes 2) there  :

have been pipe ruptures occurring in high integrity piping in secondary systems of nuclear plants (see Table A.1.10 of Ref. -

I23). Based upon these rupture failures, a probability of a e pipe rupture failure in LOCA sensitive piping can be  !

estimated using the aussaption that LOCA sensitive piping -

represents approximately 10% of the piping in a reactor l ,

plant. [

I

} -

The following discussion specifies how each of the estimates of LOCA initiator were derived from the observed pipe failure  !

in nuclear operating experience. l l

Large LOCA  !

}  !

There has not been a single large pipe break (LPB) event in l 4

over 150 reactor years of BWR operating experience.

l Estimates of failure probability based on chi-square distribution are as follows.  ;

?

l At 50% confidence level, -

A LPB - 1.886 - 4.6x10-*/Rx Yr f 2x150 A LPB (LOCA) - 4.6x10-' x 0.1* - 4.6x10-'/Rx Yr f

I i

,

• 0.1 - LOCA sensitive factor.

s Q-92 Rev. 5, 9/82

r- . .

At 90% confidence level, A LPB - 4.005 - 1.5x10-5/Rx Yr p 2x150 A LPB (LOCA) - 1.5x10-2 x 0.1* - 1.5 x 10-3/kx Yr The 50% confidence level value was used as the mean value estimate of the large LOCA initiating frequency.

Medium LOCA:

The evaluated frequency of a medium LOCA is derived from the medium size pipe break frequency. There is one instance of a 4" diameter pipe break in 125 reactor years of domestic BWR operating experience in this data base. A Bayesian approach is adopted to evaluate medium size pipe break frequency per reactor year.

Assuming an exponential pipe break model, we make use of the natural conjugate prior, gamma distribution for the pipe i break frequency I.

Let TT(A) be the ganma prior probability density of X ,

l 1.e.,

a a-1 -b A V TT ( A ) - b A e r(a)

It is shown in [1] that the posterior probability density (A/D) is also gamma, and a+k a+h-1 -(b+T))(

A e TT( A/D): ( b+T) TWM where k is the number of observed failures and T is the total time on test.

• 0.1 - LOCA sensitive factor.

m f) sm-Q-03 Rev. 5, 9/82

It is cet:d that k med T tagathzr cro cufficient.

The posterior mean of T is An( A /D)d A - a+k o b+T We have assumed a uniform improper prior, i.e., a- 1 b - 0; then the posterior mean for T is k+1 I

Applying the result above to our data, we have the posterior mean of the medium size pipe break frequency for the entire plant as t

1+1 e 2x10-2 125 l Ilowever, as assumed in WASH-1400 [21, only 107. of the pipes l are LOCA sensitive and the medium LOCA frequency is evaluated

to have a mean of 2x10-8/ reactor year.

I t

Small LOCA:

The initiating frequency of a small LOCA has been conservatively estimated using the available data from all LWR primary systems. Specifically the three incidents cited in the table below are used along with the corresponding accunulated reactor operating experience to calculate a mean estimate of the initiating frequency. By use of the Bayesian analysis presented above, we can derive similarly the posterior mean of the initiating frequency of a small leak / rupture in the primary system as follows:

8+1 7 1x10-2/ Reactor Year 270 Rx Yr

, The probabilities of a LOCA in a BWR are summarized in Table l'

A.1.6.

b' O

Q-94 Rev. 5, 9/82

QUESTION A.08

/N g Table A.2.1 conpares median and mean values. It is further N- stated on p. A-22 that "mean values of failure rates ur,ed in WASil-1400 appear lower than mean values reported in other sources". Where is this shown?

RESPONSE

Table A.2.1 is an attenpt to present comparable values used as point estinates of component failure rate. The WASil-1400 values have been converted from the medians presented in WASil-1400 to means*, so that they can be consistently compared with the values fron the GE and NRC LER data which were interpreted as mean values.

P. A-22 contains the quote'"Much of the data from the three sources ** are sinitar; however, the mean values of failure rates used in WASil-1400 appear lower than mean values reported in the other two data sources mentioned above."

This conclusion is based upon a comparison of the mean values presented in Table A.2.1.

L

• In order to convert from medians to means, the formulas presented in Appendix A.2 and the error factors given in WASil-1400 are utilized.

• • NRC, WAS11-1400, CE as noted in Table A.2.1.

p V

Q-98 Rev. 5, 9/82

QUESTION B.03 Figure B.9.2 depicts a generic fault tree of a MOV. How are

\

redundant demands on a MOV modeled? If one assumes a situation in which the first demand is to close the valve and the second demand is to open the valve, how is this modeled in the study?

RESPONSE

l The MOV's modeled in the LCS PRA for operation in the short l term. .e.g., for coolant injection, are such that the MOV's are demanded to remain as is or to change state. In several identified cases multiple demands on MOV's to change state several times are included (e.g., HPCI and RCIC operation).

These multiple demands are modeled such that the failure probability of the valves to answer the subsequent demand challenges is less than the initial demand. Since there is as data available which can be used to characterize a subsequent demand failure probability during an accident f sequence, an engineering judgment was made that the failure probability for the second demand wais 1/2 that for the initial demand, given that it operated successfully during the first demand.

<O l

-j Q-107 Rev. 5, 9/82

Appendix C

..p QUESTION C.01 How was the metal water reac+1on of the fuel bundle zirconium channels considered?

Which core melt model and metal-water reaction model is assumed?

RESPONSE

The model chosen is the core meltdown model A, which assumes that the heat in the molten pool is transferred downwards.

The core material slumps downwards once predicted to be molten (Reference 1). The melt progression downwards is maximized, as was done in WASH-1400.

The cladding-water reaction is calculated from either the Baker rate law or a gas phase diffusional model, whichever predicts the limiting rate. The model is the same as that used in NURLOC (Reference 2). The reaction is stopped: a) once the fuel rod node is predicted to be molten, b) if the l steam is totally consumed, or c) if the zirconium cladding is totally oxidized.

? f%.

l (,) (1) WASH-1400, Appendix VII (2) Walters, E. T., and Genco, J. M. "NURLOC 1.0 a Digital Computer Program for Thermal Analysis of a Nuclear Reactor Loss of Coolant Accident" BMI 1807, July 1967.

/T U

Q-110 Rev. 5, 9/82

OUESTION C.03 I ,~

l (N/ ) that is the basis for assuming that the diaphragm floor fails at 2/3 of the floor penetration (70 cm) (p. C-19)7 What happens to the core after floor failure?

RESPONSE

(a) The diaphragm floor was assuned to fall when the rebar, the major load bearing structural member, was contacted by the melt. There are two groupings of the rebar in the floor, at about 1/3 and 2/3 of the floor thickness.

It was felt that contact of the second grouping would result in complete loss of load capability. This could result from rapid heating of the steel and loss of f u n c t i c.n . The steel would previously have been l insulated by the concrete which has low thermal conductivity. INTER calculations, (core concrete attack model used in the Limerick PRA), indicated that a very, short thernal boundary layer existed (a few centimeters) such that heating of the rebar was unlikely to occur before this tine. IIad the floor been assumed to fall earlier, the non-condensible gas generation loading on the containnent would have ceased. Additionally the vaporization release mechanism would have terninated, no

'N longer providing the only mechanism for the release of s ,) the long lived Lanthanum group (includes Pu). If the floor had been assuned to fall at'1/3 penetration, or the time of first rebar contact, the tining of the accident would have been accelerated only 1/2 hour.

Therefore, warning tines for emergency response would have changed only 1/2 hour out of G hours. This can be demonstrated to be insignificant. Therefore, it is felt by the analysts that this 2/3 floor penetration failure assumption is conservative with respect to non-condensible gas loading on containment, and the release of some long lived radionuclides. Further it is insignificant with respect to overall warning' times and accident response times.

(b) After floor failure, the combined mass of core debris and concrete slag is assumed to fall,into the wetwell pool. This results in rapid steam generation. No I credit, however, was taken for the impact of the concrete slag on fragmentation. Increasing the viscosity, which occurs fron intermixing of the concrete, has been shown to suppress rapid fragmentation. Therefore, the resulting containment response is likely to be conservative. In the CORRAL analysis, a puff release of the containrent inventory of

,-- radionuclide occurs at this point in the accident

( ) sequence. Since the total core debris is assumed to

\- / . fall into the wetwell pool, the vaborization release Q-112' Rev. 5, 9/82

QUESTION C.04

[ Please provide the modification that was done to INCOR which tracks the water level in the vessel and assigns 307. power to covered modes and decay heat power to uncovered nodes (p. C-15).

RESPONSE

The water level in the vessel as calcualted in BOIL was brought into the main routine as a common block. During core uncovery, the water level, Y, relative to the BAF, was used as the measura of the fraction of core which would be covered; thereby producing approximately 307. power. The core power level above the decay heat level is input as a table of energy source vs. time in CONTEMPT. This energy source J

corrected by the' fraction of the core which is covered, is then added directly to the primary coolant.

i f

I

! Q-114 Rev. 5, 9/82 I

E Appendix D E

E OUESTION D.01 Provide the basis for the assunption that 98% of the secondary containment building air flow is filtered and 2% is not (p. D-13)?

RESPONSE

-_ The values of 98% and 2% were obtained fron nodeling using the INCOR code package. The SCTS was nodeled as a normal leakage by the CONTEMPT containnent analysis subroutine and a the design basis leak rate was modeled as a flow through an orifice. In this way a large break in the prinary containment led to a calculated pressu- e driven flow through the secondary containment which is partitioned as flow through the SGTS and through the secondary enclosure leaks.

g This was found to result in DS% and 2% partitioning, for

+

flows which do not lead to secondary enclosure pressures y beyond the pressure capacity of the blowout panels.

I h -

i m

=

O W _

r k

T E

w, 1

5 N

w L

V ki ()

E Q-116 Rev. 5, 9/82

00ESTION D.03 ff -(m) In the' tabulation of nuclide species, iodine is listed as elemental and/or organic. In the fission product transport calculations, however, iodine is assumed to be Csl (Appendix D). In the estimatioh of SGTS effectiveness, different DF values for elemental and organic forms are quoted (Appendix

_D). Please identify what forms of iodine were assumed in -

what proportions, and why; then determine decontamination

~

factors. consistently for this form (s).

(b) . Indicate the applicability of the decontamination factors of Table 3.6.4 with respect to fission product element and physical / chemical form.

(c) Section D.2.3.1 states that the SGTS was assumed to achieve certain decontamination factors independent of the accident sequence. The evaluation of filtration systems as ESFs in NUREG-0772, in contrast, indicates susceptability of these systems to plugging as a result of high acrosol loading for some sequences. Discuss the particulate loading capability of the SGTS, and compare with the expected aerosol loading (including non radioactive materials) for the various accident sequences.

(d) What is the basis of the statenent that the three conditions listed on page D-8 " dictate" the degree of suppression pool decontamination? Indicate the relative inportance of such O variables as degree of subcooling, gas conposition (non-condensible gas. fraction), gas flow rate, and iodine concentration.

(e) On page D-D it is stated that the reason for increasing the saturated pool DF for Csl is the greater solubility of CsI.

Since saturated pool DFs are linited by reduced surface interaction, as stated on the previous page, explain how a difference in solubility of highly soluble conpounds can produce an order of magnitude change in DF.

(f) Since any cesium iodide reaching the suppression pool is in particulate.forn, explain why Cs1 is treated differently than other particulates.

(g) Quantify the " additional credit" in decontaninntion factors discussed on p. D-D and explain how this additional credit is achieved by pli, particularly in view of the discussion of Csl in the previous paragraph.

RESPONSE

(a) Since the question of the forn of iodine was raised during the study an exanination.of both forns was nade. The CORRAL O calculations assuned elenental iodine as the only forn considered. A study of the decontanination factors expected Q-118 Rev. 5, D/82

for subcooled and saturated suppression pools and for the SCTS-indicated that elemental lodine and CsI, or all l-particulates, should receive the same DF's. Wh1le CsI and I 2 would involve different natural renoval mechanisms, natural removal was secondary to the above mentioned pool f

. considerations. Therefore, the study results on the conservative calculational basis employed should be assumed to be independent of iodine form. If a best estimate analysis were performed one would expect the iodine form to be more important and Csl would be likely to further reduce the release fraction, particularly for an intact containment during release.

( -(b) As was indicated by the above response, the decontaminatloa factors were applicable to all physical / chemical forms of iodine. Data were used for elemental iodine and particulates to determine those DF's. The DF's apply for all iodine and l particulates, but not to the inert gases.

(c) It was expected that aerosol loadings to the SGTS would be substantially less than the estimates in NUREG-0772. These values ware derived for an in containnent nerosol loading. g The aerosol loading for these accident sequences, where the  !

' flow path from the primary system to the containment is through the suppression pool, is expected to be lower due to suppression pocl scrubbing. Additionally leakage out of the l containment could be limited due to plugging. Using a crack width and length used in the study for containment failure and equation 2 in reference 1, a few tens of kilograms of aerosol will leak prior to plugging of the hole. Also, aerosol diameters wo,ld be increased. The additional path to the SGTS filters would likely result in small amounts of aerosols reaching the filters. Therefore, if they did plug, it is unlikely that much aerosol would subsequently escape since plugging the filters could account for much of the {

aerosol mass. Ilowever, a specific analysis of this was not performed. Qualitatively, it is felt that the filters would be likely to be effective and actual release fractions reduced using an aerosol model.

(d) The three conditions listed on page D-8 were derived fron references 2, 3, and 4.

The relative-importance of gas conposition (non condensible gas fraction), gas flow rate, and iodine concentration were considered in the above analysis. Ilowever, the specific accident sequence analyses did not identify parancter ranges for the above values that would result in a reductiorcof DF's, i.e., the non condensible gas fraction gas flow rates and lodine concentrations were not high enough to impact the DF's. It should be noted that these are identical to WAS!!-

1400 assunptions. The most important paraneter assumed in the Limerick PRA for differentiating anong decontaninntion factors was the degree of pool subcooling. Each of the accident classes, I through IV, were defined such that the Q-110 Rev. 5, 9/82

ouppracalen p ol was eithar subcooled cr naturatad as follows:

Class I - Subcooled Class II - Saturated

-Class III - Subcooled Class IV - Saturated Based upon these conditions, the DF's were assigned. The degree of subcooling was treated as subcooled or not with a saturated pool receiving a smaller DF. Since pool saturation resulted from containment failure (TW) or occurred rapidly (TC) the degree of subcooling was not considered important.

(e) The greater solubility of CsI was only one of many factors in the analysis. In actuality the particulate nature was the -

most important and lead to the DF chosen [33.

(f) Csl particulates were treated in the same manner as other particulate forms.

(g) The additional credit led to the choice of increasing the DF  !

from 2-5 to 10 for a saturated pool and elemental lodine.

Devell [4] indicated that for a pil increase associated with l about 507. of the Cs in the pool, the DF's for etenental iodine were measured at 45 and 120. It is felt that 10 is conservative.

I O

O Q-120 Rev. 5, D/82

REFERENCES O [1] Leakage of Aerosols from Containment Buildings H. A.

Morewitz, Health Physics, May 29, 1981.

[2] Diffey, H. R. et. al., " Iodine Cleanup in a Steam l Suppression System," CONF-650407,2 (1965) 776.

[3] Hillary, J. J. et. al., " Iodine Removal by a Scale Model of the S.G.H.W. Reactor Vented Steam Suppression l System," TRG Report 1256 (1966).

[4] Devell, L. et. al. , Trapping of Iodine in Water Pools at 100*C," Sweden 1967.

l L ,

1 O

Q-121 .Rev. 5, 9/82

-QUESTION D.06 j' The first paragraph of p. D-12 states that RB

\m - overpressurization results in ground level releases, while the last paragraph states that pressurization of the RB would result in release via the SGTS exhaust stack. Please clarify.

RESPONSE

RB overpressurization above the differential pressure capacity of the blowout panels results in a direct leakage path to the outside, elevated or a ground level release. On the other hand, pressurization of the RB (without reaching the blowout panele pressure capacity) will result in an

elevated release via the SGTS exhaust vent. All releases.

l except v", are assuned to be elevated releases. That is, the l i blowout panels on the refueling floor (i.e., at the top of l

the Reactor Building) and the vent are treated as approximately equivalent in height.

i i

l l \_

l' kJ Q-124 Rev. 5, 9/82

QUESTION PkA D.08 9 Calculations with BOIL indicate that for certain accident sequences a signficant quantity of the gases formed during core heatup and melting may not actually be released from the primary system via safety relief discharge into the suppression pool. Consequently, significant quantities of the fission products (including volatile species associated with the melt release could be discharged from the primary system after vessel failure directly into the drywell. Based upon the above consideration should the DF values in the table on page D-9 he applied to the entire melt release?

Identify all other potential suppression pool by pass paths, including loss of SRV discharge line, that have been considered and state your conclusions regarding them.

RESPONSE

In the calculations of fission product transport in containment and release to the environment using the CORRAL code, the containment modeling scheme included the primary system as a compartment, in addition to the containment (drywell and the wetwell), and the reactor building. The gap and meltdown release components of the fission products released from the fuel during the core meltdown time period were modeled as a fission product source term into the primary system compartment (RPV). Mass flow out of the RPV 9 was explicitly modeled in the CORRAL analysis as volumetric flow from the RPV to the wetwell. Decontamination factors (DF) associated with this flow path were also modeled.

Fission products released to the containment via the safety relief valve dische.rge prior to the vessel bottom head failure would be attenuated due to suppression pool scrubbing. The fission products which are still airborne in the RPV at the time of the RPV bottom head failure would be j discharged into the drywell and not be scrubbed by the suppression pool.

Based upon the above discuselon of the CORRAL modeling, the values on page D-9 are applicable. The DF values applicable during the meltdown release would not change. The amount of fission products released from the fuel during core meltdown which would be discharged to the wetwell space prior to f vessel head failure and so scrubbed by the pool is less than the total gap and meltdown release components. The fraction remaining in the vessel at bottom head failure which would not be attenuated by the suppression pool before its release to the drywell varies according to the accident sequence.

Other potential bypass paths include LOCA sequences which result in a direct discharge to the drywell, Q-125a Rev. 5, 9/82

l J-1 RESPONSE TO QUESTION PRA D.08 - CONTINUED i .and in-vessel stream explosions which result in an assumed failure of the RPV prior to total core melt. The LOCA sequences were distributed probabilistically throughout the four accident classes. The in vessel steam explosion source terms were extracted from WASH-1400.

{

\

i d

i ,

J E

t J

k I

Q-125b Rev. 5, 9/82

_ _ .. - - . _ , . . - . - _ . _ . . _ _ . _ _ _ . . _ . . _ , _ _ _ . _ _ _ _ . _ . _ _ . _ . . . . . , . _ - . ~ . .

Appendix E QUESTION E.01 O

i \

V (a) What effect does the formation of CsI have on the postulated accident sequences? How much Tellurium is oxidized during the various sequences?

(b) Why is there no Co-58 or Co-60 at the Limerick plant? Why are Cs-134, Cs-13G and Cs-137 inventories so much smaller than WASH-1400 (p. E-30)7

RESPONSE

(a) Since the more significant attenuation factors used for CsI and 12 are equal, the formation of Cs1 would not have a najor g impact on the consequences of the postulated accident sequences. It should be noted, however, that for an accident where the containment is failed prior to meltdown release from the fuel, the removal rate calculated for 1 2 is slightly higher than those for particulates. For this case, the results may be conservative.

The Tellurium released upon fuel oxidation for various sequences follows the WASil-1400 formulation for oxidation j s, release following fuel fragmentation due to stean explosion.

(,

'"' f WASil-1400 considered that 607. of the Te radionuclide species remaining in that portion of the fuel.which participates in steam explosion is released due to oxidation.

(b) The fission product inventory was calculated using the RADCICINDER code system.

Cesium variations are due to the manner in which the core was modeled and the BWR fuel loading. The core was modeled into separate bundle groups

• and each bundle group followed through its respective power history and fuel down tine.

The activation products were not calculated for this systen of codes, therefore, C0-58 and C0-60 we.re not included.

Ilowever , activation products are not significant in comparison to the fission produ .t- and transuranics.

• The WASil-1400 core inventory was calculated by means of the ORIGEN progran for a s'a00 MWT PWR core, where the core was represented by three regions only. The BWR nodel

(}/

\m , considered more fuel bundle groups than this.

Q-12G Rev. 5. D/82

QUESTION E.02 X

( /')

N-In accident' sequences in which the containment building fails due to steam overpressurization, there is the chance of a large amount of " fog" or vapor formation around the building due to the expanding stean. What effect would this have on the release fractions as calculated by CORRAL?

RESPONSE

This effect was not considered in the analysis, llowever, a

'large amount of " fog" around the building would allow the released radioactive aerosols to forn nucleation sites for condensation. Therefore, acrosol mean diameters would increase. This would result in a much more rapid fallout rate. Reference E.02-1 indigates that fogs are characterized by aerosol diancters in the range of 5 to 40 nicrons with nists resulting in dinneters greater than 40 microns. The CORRAL calculations performed assumed aerosol diameters in the range of 5 microns at this time in the accident. If 40 microns was used the natural renoval rates would increase to a value sinilar to the largest leakage rate and four times the smallest leakage rate assumed for a major reactor building failure. Therefore, the existence of a fog could decrease environmental release fractions as much as a factor

,( of 2 to 5. (Mist would be nuch more.) Furthermore, the fog

( would reduce the mean transport distance away from the reactor. Assuning a larger aerosol mean diancter could easily limit transport such that the offsite consequences would be significantly reduced.

nN. /

Q-127 Rev. 5, 9/82

QUESTION E.0@

c

( Clarify as to which is the spatial interval over which the

'- shielding factors for sheltering in Tables E.2a, E.2b and E.3 were used in CRAC analyses and as to the impact on the Limerick site-specific consequences.

RESPONSE

All spatial intervals for non evacuating regions received the shielding factors described in Appendix E. This might impact the amount of latent cancer fatalities beyond the region of expected evacuation. However, it should be noted that latent cancer fatalities are dominated by chronic health effects in the CRAC model. Acute fatalities would not extend beyond the region of expected evacuation. Revision 5 of Appendix E deletes these tables since they were not used in the PRA.

O

(

r l

s% s a

I Q-131 Rev. 5, 9/82

QUESTION E.08'

.(n ' ' Provide the following additional information for use in

- staff's confirmatory Limerick site specific consequence calculations:

a)- Population input for CRAC standard spatial grid, i.e.

for each area element generated by the 16 direction sectors of the compass and the 34 rings of outer radii _

as specified in the description of the Subgroup SPATIAL  :

in page 40 of the CRAC Manual, for the year 1970 and the year 2000.

b) State code and habitable land fraction for 2ach area element of the CRAC spatial grid, and c) Estimates of evacuation times including the notification times, and travel (response) times for clearing a 10-mile plume exposure pathway Emergency Planning Zone under normal and adverse conditions, consistent with the expected traffic loading on the existing road net-works and for various segments of the population (in schools, factories, hospitals, etc.).

RESPONSE

, g a) Attachment I lists the Limerick population used as CRAC

input in.the Limerick PRA. This is 1970 population

, data. The data is presented with radial distance l vertically down the page and with columns for each 22 1/2* sector oriented on the Limerick Grid Structure.

The data is given for intervals and cunulatively. Year 2000 population distribution data was not used in the study. Ilowever , this. data can be found in. Tables 2.1-12 and 2.1-13 of the LGS-EROL.

b) Attachment 2 lists the state code used for each area element in the Limerick PRA CRAC runs. The states corresponding to the codes are as follows:

1. Marine 13. Michigan

2. New llanpsh ire 22. Delaware

4. Massachusetts 23. Maryland G. Connecticut 24. Virginia

7. New York 25. West Virginia

8. New Jersey 2G. North Carolina

9. Pennsylvania 30. Kentucky

10. Ohio 51. Ontario Attachnent 3 lists the habitable land fraction for each grid area.

Q-135 Rev. 5, D/82 R

. . . _ _A

c) Site specific maximum-evacution time estimates were made.for a 10 mile plume,' exposure pathway EPZ. These range from 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> in normal weather to 11.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> in adverse weather. The notification time portion of these estimates is 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

i Q-13G Rev. 5, D/82

QUESTION E.09

[m

\~-

\ Provide a basis for the " conservative estimates cf saturated pool DF". as well as a reference for the "other data evaluations." ' Provide the data for these evaluations and discuse their applicability to the accident conditions at LGS.

RESPONSE

The referenced quotations are on p. D-8 of the PRA.

4 During the course of performing calculations for the Limerick PRA,' an extensive literature search to define suppression pool decontamination factors appropralte for use in BWR risk assessments was being conducted. Based on results of that review, [1] the following conclusions were made: l

1. Suppression pool decontamination factors of at least 100 for elemental iodine and particulates and 1000 for cesium lodide are justifiable for ,,

subcooled pools.

2. For saturated pools, decontamination factors of at least 30 for elemental iodine and 100 for

, particulates and cesium iodide are currently justified.

3. The above values were recognized as minimum values which could justariably be increased several orders of magnitude by testing at conditions more representative of degraded core conditions.

Subsequent to the PRA and the review discussed above, a predictive first principle model has been formulated for the calculation of accident sequence-dependent decontamination factors for use in PRA's. Suppression pool scrubbing tests have been performed by General Electric. These tests have provided data which directly verifies the model. The model and the tests.confirn the use of suppression pool decontamination factors of 102 - 10' for saturated pools.

The value used in the Limerick PRA for saturated pools (10) is conservative, based on the above results.

' f%

O Q-145 Rev. 5, 9/82

i QUESTION PRA E.08(a)*

The conclusion that formation of fog would significantly reduce the consequences of a given radioactive atmospheric release as stated in applicant's response to the staff Question E.02 needs further clarification as would be apparent from the following considerations:

While, by applicant's reasoning, formation of fog may reduce the range of the distance over which radiological consequences would occur, the radiological dose within the reduced range would likely be higher due to higher ground concentration from enhanced fallout of radionuclides in the fog particles. Additionally, the internal dose conversion factors may be higher due to inhalation of moist and large-sized fog particles containing the radionuclides. Therefore, possible reduction in the spatial range over which early health effects would occur may be partially offset by increases in the intensity,of these consequences within this reduced spatial range. Further, evaporation of the fog would restore the still airborne particulates back to the fines which would then be transported to farther-out regions; thus, stretching the spatial range of impact.

Provide an assessment of the effect of natural draft towers on the formation fog at the site and on atmospheric dispersion of radioactive plumes (including the effect of increased moisture in the atnosphere due to evaporation from 9 the cooling tower)

RESPONSE

The discussions which follow deal with effects which were not considered in either the WASII-1400 or the Limerick PRA consequence analysis.

(a) The increased aerodynamic diameter of the radionuclide particles due to particulate adsorption of moisture could affect the consequences of a given atmospheric release in terms of the potential decrease in the inhalation doses and potential increase in ground exposure radiation doses to an individual located at a specific spatial distance from the source.

1 l

• Ihis question r. umber has an added suffix so as not to confuse it with the existing Question E.08. l O

Q-14Ga Rev. 5, 9/82

RESPONSE TO QUESTOIN PRA E.08(a) - CONTINUED The increased size of the particles would tend to increase the deposition velocity of the radionuclide particles, increasing the depletion rate of the airborne radioactive plume. This increased depletion mechanism of the airborne radionuclide material would tend to decrease th'e amount of radionuclides inhaled per unit volume by decreasing the airborne concentration.

Therefore, the amount of inhaled radionuclides could be decreased. At the same time,.the prediction of radionuclide deposition on the various regions of the lung as modeled in the ICRP Task Group on Lung Dynamics (Figure 1)* could lead to a decrease in the fraction deposited in the pulmonary region of the lung where the significant fraction of the inhaled radionuclides is l absorbed in the bloodstretr.

(a) Na yngest Resean (N P) 1 D Region Pathway (D) (W) (Y)

N-P

, r (a) 0.01 d/0 5 O.01 d/0.1 0.01 d/0 01

. gone "

(d) tbl 0.01 d/0.5 0 4 d/0 9 0.4 d/0.99

' '******a Blood T-8 (c) 0.01 d/0.9'a 0.01 d/0.5 0.01 d/0.01 O.

T other > (d) 0.2 d/0.05 02 J/O 5 0 7 d/0 99 P (e) 0 5 d/0.8 50 d/0.15 500 d/0.05 (f) (9) (f) -

1 d10.4 1 d/O 4 le) - 50d/04 500 d10 4 (hi 0.5 d/0.2 50 d/0.05 - 500 d/0.15 I'I Put y Region L M 0.5 d/1.0 50 d/1.0 1000 d/O 9 5 (h)

'd "

' 'v7 l (a) First value is the biological half-life and second value is the regional fraction.

FIGURE 1. ICRP Task Group on Lung Dynamics Retention Model The range of deposition fractions in each compartment of the lung is shown in Figure 2 for various particle sizes. This figure shows that the deposition in the nasal pharynx region increases markedly with increased particle size, but the deposition in the pulmonary region d. creases..

The tracheobronchial region deposition shows only slight change. The significance of the varying fractional deposition in the different regions of the lung on the radionuclide retention by the body may be assessed as foilows.

O Q-14Gb Rev. 5, 9/82

RESPONSE TO QUESTION PRA E.08(a) - CONTINUED

,;,'. ~~

090-

....r 000-  !

0-NASAL-P 060- ,'g,,j. ,. PULMONARY 050- ' 0-0.40 < }, .

1030-Q20-I- , , ,

, T-BRONCHIAL

• t_ . -

0.\0 - .

a.

l d " m ..

I 0.01 Od5 dl 0.5 I.0 5 IID S'O Ido j MASS MEDIAN DIAMETER-MICRONS FIGURE 2. Variation of Compartment Deposition in the Lungs as a Function of Particle Size Ins assed deposition in the nasal pherynx region would

! increase the fraction of radionuclides rejected to the GI tract. These radionuclides would be absorbed by the bloodstream in a similar manner to the ingestion pathways. This would be a less important avenue than direct absorption by the bloodstream through the lung.

Decreased deposition in the pulmonary region would decrease the fraction absorbed directly by the bloodstream. The fraction absorbed directly by the bloodstream determines the amount of radionuclides which could be retained by the individual organs. The net effect of the above considerations would be a decrease in the inhalation dose conversion factors per unit volume inhaled.

The passing cloud of radioactive materials would deposit material on the ground via dry and wet scavenging mechanisms. The increase in aerodynamic diameter of the radionuclides affect the scavenging processes by increasing the dry deposition velocity of the particles.

This could lead to higher ground concentration levels over a limited spatial range, beyond which the reduced a8rborne concentration would' offset the higher deposition velocity and reduce the ground contamination levels.

l l

i

\

l 1

l 4

Q-14Ge Rev. 5, 9/82

RE5PONSE TO QUESTION PRA E.08(a) - CONTINUED The competing effects on radiation doses discussed above could potentially result in a net reduction of offsite consequences.

Our response to Question E.02 is' revised as follows to provide additional clarification: Add sentence at beginning of response as follows "this effect was not considered in the analysis". The word "offsite" is added to the last sentence between "the" and

" consequences".

(b) An assessment of the effects of the natural draft cooling towers at Limerick on the formation of fog at the site is addressed in the Limerick EROL Section 5.1.4.2.2. - The conclusion of this section is that there '

will be no increase in the frequency of fog at the site as a result ,of the operation of the natural draft towers. This' conclusion is based upon the results of several observational studies at sites with similiar natural draft towers, as well as a literature review by Carson [1] which encompassed over 190 references.

An assessment of the effects of the natural draft cooling towers on-stmospheric dispersion of the radioactive plumes was not performed for the LCS-PRA.

The potential effects may be considered as occurring O- under two circumstances. Neither of these circumstances were considered in WASH-1400 consequence model nor were they considered in the LGS-PRA.

I. Cooling Tower Not In Operation This is the most likely case during the release phase of an accident since all effects due to operation of the cooling tower (see item II below) are reduced under accident conditions and operation of the cooling towers would be reflective of successful heat rejection through the condenser.

The only effect under these circumstances would be the increased turbulence due to the cooling tower conplex wake. Consideration of the orientation of the reactor building and the cooling tower complex indicates that this effect would be applicable for wind directions out of the three sectors from the' south for plumes emanating from the reactor building and being affected by the reactor building and associated building wakes, the cooling tower complex, and the cooling , tower complex wake. The wind frequencies from these three sectors O

Q-116d Rev. 5, 9/82

r RESPONSE TO QUESTION PRA E.08(m) - CONTINUED as obtained from Table 2.8.2-26 of the LCS-EROL for the 80 ft sensor for directional sectors SSE S, and SSW are 4.8%, 6.9%, and 6.0% respectively.

Therefore, the total frequency of this case would be 17.7%. The magnitude of the specific effect would be different for releases from the reactor building roof and ground level releases, A similar effect would be applicable for wind directions out of the three sectors from the north for plumes emanating from the reactor building and being-affected by the cooling tower complex wake and wake effects of the reactor building and associated buildings. Again, the magnitude of this specific effect would be different for releases from the I

reactor buildsmg roof and ground levet releases.

The sum of the frequencies for directional sectors

, NNW, N, and NNE (From Table 2.3.2-26 5.2%, 4.4%,

and 3.5%) is 18.1%. Not considering the potential for on site variations in consequence and using this conservative assessment of frequency of potential impact, use may be made of field studies by Start et al. [2] which have shown that the atmosphere in the region immediately downwind of a natural draft cooling tower can be one Pasquill class more unstable than the surrounding O mimosphere. This effect, of an increase of one Pasquill class 30% of the time, would introduce an insignificant bias in the reported consequences of the LCS-PRA.

II. Cooling Tower In Operation This case is consirlered unlikely during the release phase of an accident for the reasons given in item I above. Potential effects are:

1. Merging of the radioactive plume with the cooling tower plume.

This effect would be expected to occur only for wind direct 1ons from the south or norin

~

(assessed above as 30%) and for plumes with sufficient rise to reach the elevation of the top of the cooling tower. If the radioactive plume were to become merged with or entrained into the visible cooling tower plume, the O

Q-14Ge Rev. 5, 9/82 L... .

RESPONSE TO QUESTION PRA E.08(a) - CONTINUED O primary effect would be an increased rise of the radioactive plume due to the buoyancy of the cooling tower plume. The visible cooling tower plume is formed inside the cooling tower due to the recondensation of water vapor in the rising air stream. These plumes are composed of very small droplets which simply rise and evaporate, and have no potential for washout. It is possible that the radioactive effluent could merge with the cooling tower drift droplets. However, only the larger drift droplets reach the ground before evaporating, and any washout which might occur in this situation would be within close proximity of the plant.

2. Entrainment of the radioactive plume in the flow of air to the cooling tower base.

This effect would be expected to occur only for wind directions from the south (assessed above as 17.7%) and for plumes which have the correct dispersion characteristic to come within close proximity of the cooling tower base. For releases from the top of the reactor building the plume must fall O. approximately 80-145 ft. For ground level releases the plume could follow the terrain or rise approximately 50-110 ft. If the plume were entrained in the flow to the cooling tower a portion of the radioactive constituants of the plume would be expected to merge with the water circulating through the cooling tower, plate out on cooling tower structures, or to become merged with the cooling tower plume. The characteristics of the cooling tower plume are described in Section 5.1.4 of the LGS-ER0L.

3. Increase in moisture due to the evaportion from the cooling tower.

Significant increases in moisture from operation of the cooling tower are confined to the area immediately surrounding the visable plume and therefore, will have no other effect than that discussed in plume merging (Item 1.

above).

O Q-146f Rev. 5, 9/82

RESPONSE TO PRA QUESTION E 08(a) - CONTINUED

4. Wake effects as 4;scussed in item I above.

(

These effects are the same whether the cooling tower complex is in operation or not.

[1] Carson, J. E. , Atmospheric Impacts of Evaporative Cool.ing Systems, Argonne National Laboratory Report ANL/ES-53 (October, 1976).

[2] Start,-G. E., et. al.: Rancho Seco Building Wake Effects on Atmospheric Diffusion, NOAA Technical Memo ERL ARL-69 (November, 1977).

i k

N Q-146g Rev. 5. 9/82-

OUESTION PRA E.00(a)*

O' Applicant's response to the staff Question E.04 is not adequate. The applicant's response states that the CCDF of early fatality in Figure 4.13 of Rev. 8 to PRA shows the results of a 10 mile vs. 25-mile radius evacuation zone.

However, the applicant has not used a delay time before evacuation to produce the results in Figure 4.13, while the applicant's response to the staff Question E.0S(c) states that the estimated delay time is about 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> for this site.

Provide an assessment of the effect of the delay time (Range of 2 to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />) on the CCDF's of early fatalities, for both 10-mile and 25-mile radius evacuation zones.

(Perhaps the current status of emergency planning for evacuation of the Limerick site is still in a preliminary stage and it may become possible that the anticipated delay time before emergency planning will fully mature. However, the staff will review the sensitivity of early fatality predictions represented by CCDF's to the delay time before evacuation.)

RESPONSE

Incorporation of a delay time into the calculation which produced the results shown on Figure 4.13 of the LGS-PRA O would be expected to increase the early fatalities CCDF for both the 10 and 25 mile evacuation zone. As noted in our response to Question E.04 the analysis assumptions used in the PRA where purposely selected to provide as direct a comparison of LGS with the WASil-1400 analysis as possible.

Inclusion of delays in the present analysis, which used the WASil-1400 evacuation model, would produce incorrect and misleading results since the effects of evacuation delays were indirectly included in the WASil-1400 evacuation model.

• This question number has an added suffix so as not to confuse it with the existing QUESTION E.09.

O Q-14Gh Rev. 5, D/82 e - .. -. _ _ _ _ _ _ - _ _ _ _ _ -

1 QUESTION PRA E.10 From the latest listing of CRAC input (dated 4-21-82) provided by the applicant to the staff it is observed that:

(a) Justify that use of an input of thyroid cancer fatality 10-7 per milIlon thyroid person rem, instead of the WASil-1400 value of 1,84 x 10-8 per million thyroid person rem.

(b) Provide the results of CRAC runs varying the year during which the meteorology was taken. Limerick release categories are evaluated for meteorologies for the years 1972, 1978, 1974, 1975 and 1976; for comparison the WASil-1400 release categories BWR 1 thru BWR 5 are evaluated.at the Limerick site only for the year 1975.

(c) Provide the results of CRAC runs varing the elevations-of meteorological data (30 ft. and 175 ft.).

(d) Describe the methods for combining the res,ults from the release categories (i.e., Limerick plant specific as in Table 8.6.5) done outside of the CRAC code.

RESPONSE

(a) The values given above as being used in the LGS-PRA and WASil-1400 are in units of (incidents of fatal thyroid cancer / person rem) not per mi1Ilon thyroid person rem as stated.

At the time of WASil-1400, the CRAC code did not provide the capability of including fatal thyroid cancers in the latent fatality results. Information available at the time of the LGS-PRA indicated that the effects of fatal thyroid cancers were not included in the CCDF curves presented in WASil-1400 for latent fatalities. Since the CRAC code used in the LGS-PRA includes a thyroid model, which would impact the calculo d CCDF, a value of 10-7 was used to eliminate the effect of fatal thyroid cancers and provide a direct comparison of CCDF's to WASil-1400. The best information available at the present time indicates that the WASil-1400 CCDF's for latent fatalities were modified by a procedure which is described in section 5.5.4.2 on page 74 of the WASil-1400 main report. As stated above this procedure was not used in the LGS-PRA; therfore, it would appear that adjustment of the LGS-PRA results would be appropriate j for comparison to the WASil-1400 result. l O

Q-1461 Rev. 5, 9/82

.v. , ' , .-

^ '

.n s _ ;- _ u n 3 e _ - :- .

, . . ey r . , .:. +i:n' = . -' ^' - :- %

RESPONSE TO PkA E.10 - CONTINUED

-( O Increasing the value used in the LGS-PRA from 10-7 to 1.34E-5 results in an increase of approximately 207. in the latent fatality total integrated risk from 1.06E-2 fatalities /80 years to 1.27E-2. This result has no impact on the conclusion as stated on page 5-5 of the LGS-PRA: That the analysis shows the risk from Limerick to be below those of WASH-1400 (2.1E-2 fatalities /30 years).

(b) The question contains an erroneous statement. The evaluation of the WASH-1400 BWR at the Limerick site was based on all five years of data (averaged), as were all other results in the LCS-PRA final report. In the evaluation of the comparable risk of the WASH-1400 reactor at the Limerick site, a two step process was used. Those steps were:

1) The WASH-1400 BWR accident sequences were run using the GE CRAC code with the original WASH-1400 data with the exception of the substitution of the LGS site file and 1975 meteorology file.

2) The results of 1) above were then scaled by the ratio of results from runs of the LGS reactor at LGS for 1975 and the 5 year average. -From these ,

comparisons, a curve for the WASH-1400 BWR at LGS I for the 5 year average was produced, saving the l cost of running all five years. As an example, the attached table shows the production of the WASH-1400 BWR curve at LCS for early fatalities. This was done by first ratioing the LGS 1975 (1) to the LCS-5 year CCDF values (2) and then using this ratio (8) to adjust the WASH-1400 BWR 1975 (4) to a 5 year average curve (5).

O Q-14GJ Rev. 5, 9/82

RESPONSE TO PRA OUESTION E.10 - CONTINUED EARLY FATALTIY CCDF - WASil-1400 AT LIMERICK FREQUENCY FREQUENCY WASil-1400 WASH-1400 Magnitude LGS-1975 LCS-5 Year Ratio BWR 1975* BWR 5 YEAR *

(Fatalities) (1) (2) (3) (4) (5) 1 5.21E-8 4.73E-8 0.91 2.71E-7 2.4GE-7

, 2 4.37E-8 3.94E-8 0.01 2.60E-7 2.34E-7 j' S 3.90E-8 3.46E-8 0.89 2.56E-7 2.27E-7 5 '3.31E-8 2.93E-8 0.89 2.46E-7 2.18E-7 7 2.94E-8 2.56E-8 0.87 2.365-7 2.06E-7 10 2.46E-8 2.15E-8 0.87 2.30E-7 2.01E-7 20 1.69E-8 1.40E-8 0.83 2.08E-7 1.72E-7 30 1.37E-8 1.08E-8 0.79 2.00E-7 1.58E-7 50 9.49E-9 7.24E-9 0.76 1.74E-7 1.33E-7 70 7.72E-9 5.49E-9 0.71 1.56E-7 1.11E-7 100 5.74E-9 3.82E-9 0.67 1.35E-7 8.98E-8 200 2.55E-9 1.71E-9 0.67 1.02E-7 6.84E-8 300 1.69E-9 1.01E-9 0.60 7.57E-8 4.52E-8 500 5.08E-10 4.04E-10 0.80 5.12E-8 4.07E-8 700 3.70E-10 2.65E-10 0.72 4.31E-8 3.09E-8 1,000 1.91E-10 1.59E-10 0.83 3.96E-8 3.09E-8

• GE CODE

\

/ (c) In the LCS-PRA, 30 ft. meteorological data was used in the CRAC runs for the C4 y , C4v' and C4v" cases, and 175 ft. meteorological data was used for the OPREL and OXRE cases. The basis for this choice was the energy of the release - low for C4y , C4 v' and C4 v" , and high for OPREL and OXRE. CRAC runs varying the elevation of meteorological data were not made in the LCS-PRA.

(d) Each of the five accident sequences were run using CRAC for each year (72-76) on an individual basis, and upon completion of each run a formatted version of the TAPE 10 file was saved onto a permanent file. A separate program (RESULTS) was then executed wh8ch reads as input the individual CRAC files and a table of accident frequencies derived from Table 3.5.14 to produce the total CCDF. The algorithm used in RESULTS is the sane as found in CRAC routine STORE, entry FSUM. The program RESULTS has been verified to perform the required calculations correctly and will reproduce results using the STORE routine in CRAC to six significant figures, j

Q-146k Rev. 5, 9/82

___ __ ____ _a

OUESTION PRA E.11 O Provide one copy of complete output (with format description) of the CRAC run (4-21-82) containing the printout of any' recompilation of CRAC performed during the run, the print-back of all the inputs used in the run and the printout of the results (including the three integrated risk values) that are reported in Limerick RRA, Rev. 4.

RESPONSE

A copy of the output files and results were provided to the NRC at the conclusion of the meeting on September 8, 1982 at the NRC offices in Bethesda, MD. The integrated risk values mentioned above were not reported in Revision 4 to the LGS-PRA (submitted June 11, 1982). Integrated risk values were provided verbally during the June 24-25, 1982 meeting in Pottstown, PA. These values, as cosrected, are submitted formally in Revision 5 to the LGS-PRA and may be found on pages 5-1 and 5-5, of Section 5, Volume I of the document.

O O

Q-1461 Rev. 5, 9/82

_ _ _ _ _ _ _ _____._ . - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ ____m

QUESTION PRA E.12 Response to the staff Question E.08(a) is incomplete in that O' demographic data in CRAC format for the plant midlife year is not provided. Provide an estimate of site demographic information for the midlife year.

RESPONSE

Estimates of site demographic information are provided in the.

LGS-ER0L Section 2.1.2. Estimates of future population distributions were not used in the LGS-PRA analysis.

Specific inputs to CRAC were not generated. See response to item (a) of QUESTION E.08 as revised in Revision 5 to the LGS-PRA.

s a

t s

i

~

y f-

\ _ .

/

O ,

s i

Q-146m Rev. 5, 9/82 O h

__#_ =_ _A

' Appendix F QUESTION F.01 O\

Most of Appendix F is spent in justifying why Gamma distributions were used as priors instead of lognormals. On the other hand, it is stated that the prior distributions were discretized. Given that, it should not have made any difference (from a mathematical convenience point of view) whether Gamma or lognormal distributions are use.d. A list of all the prior distributions (for each input parameter) along with-the important charactern tics (like mean, median, or other parameters) should be provided.

RESPONSE

l Appendix F discusses the choico of probability distributions which may be used as priors if a Bayesian analysis is to be used to construct a probability distribution. One conclusion l from the discussion is that: "Two obvious choices for a l

distribution are gamma and lognormal; both have advantages and disadvantages, but there is no inherent reason to choose one over the other. Both are equally ' correct'." It is further stated that: "there is no theoretical foundation for I or against either the gamma or lognormal distributions, and there is little data for either choice. . . . . ."WASil-1400 d id

., ) employ lognormal distributions to represent the distributions of some parameter;, however, both gamma and lognormal distributions appear as possible alternatives of continuous prior distributions.

In the practical application of Bayesian analysis to update the priors, discrete formulation would probably be used to construct the priors. The main advantages of discrete formulation are' discussed in Section F.4. It is noted that the discrete priors are not established through discretizing some other prior distribution (e.g., gamma or lognormal);

instead, they have in the past been defined by the opinions of a panel of " experts"; this is primarily due to the lack of

, data responses on"which to base a distribution. It is recognized'that "the method of' defining a discrete prior is subject to ntch debate."

For-the LGS PRA the Bayesian analysis technique was applied i in selective' cases. The decision not to perform extensive r

~

data manipula'tlon using Bayesian Techniques was based unon _

three principal factors:

I' 1.

There is a limited amount of plant specific data s applicable to Limerick.

2. Bayesian manipulation of generic data sources (see Appendix A Section A.2.3) does not have large

[ Q-147 Rev. 5, D/82

1:

QUESTION G.02 t (,.

In order to compare results of the Limerick PRA to those of WASH-1400, median values were estimated for the Limerick results based on mean values. What distributions were assumed in this process? Are the Limerick median results shown in the report?

RESPONSE

Median values were not used for comparisons, and, in fact, were not calculated in the LCS PRA. In order to compare the calculated frequency of core melt between the Limerick PRA and WASH-1400, mean values were estimated for WASH-1400.

Figure 3.5.4 shows the resulting comparison.

The mean values for WASH-1400 were estimated using the following procedures:

l

1. The median core melt frequency was taken as that )

presented in the Appendix V summary Table V.

2. Release Category 8 has a frequency of core melt

• containment failure of 2x10-"/ Reactor Year where the containment failure prob. - 1.

Therefore, core melt median - 2x10-*/ Reactor Year

8. The probability distribution of the core melt l

frequency is taken to be lognormal similar to that for the impact quantities.

4. The median and mean of a lognormal distribution can be related by the following:

mean - median *EXP ( a 2/2) where o- In (Error Factor) 1.64 From Table V in WASH-1400 the error factor on the core melt frequency can be conservatively estimated to be determined by the ratio upper bound (95% value) - SE-5 -4 median (50% value) 2E-5 1

\

Q-151 Rev. 5, 9/82

QUESTION PRA H.06 Describe the core degradation / core melt process that yields the temperature, the composition (include amount of each constituent), and the total mass of the corium at the time of vessel failure. In particular, provide the calculations that led you to a corium temperature of 2200*C. What roles do the channel boxes and the CRD coolant flow piny in the above determination?

RESPONSE

l (a) The core heatop and degradation was calculated by the INCOR i system of codes as described in Section C.8 of Appendix C.

In the BOIL subcode, the fuel and cladding are considered as individual constituents even though they have the same temperature. The code calculates the core heatup behavior with axial and radial variations according to the bolldown process and the respective power distributions. However, at .

the onset of material melting, the user must specify a core heatup model'which either allows material to drip into tLs l l water retained within the lower plenum or essentially remain l

In place. At elevated temperatures, uranium dioxide and the zirenloy cladding can combine to form a mixture with a melting temperature substantially below that of the molten fuel. This process has been extensively discussed in ,the literature references as a fuel liquification process, i.e.

O. the fuel rods can be liquified and relocated well before t.5 e fuel reaches its own melting temperature of approximatley 2850*C. Tc represent this potential for liquification at lower temperatures, the discriptive analyses in Appendix H masumed that substantial liquification could occur at tem 3,eratures as low as 2230*C. This argument was also used to justify superheat in the mixture, which was assumed to be 200*C. Under these conditions, the melt would have considerable fluidity with its movement into the lower plenum of the RPV, the diaphragm floor and the suppression pool governed only by the available static heads and the time to l

failure of each barrier. As discussed in Appendix H, this was a conservative evaluation. If the melt was close to its freezing point, the behavior of the material would be more l restricted and the transport of the debris would her delayed.

Such migration would decrease the threat to the containment integrity as discussed in the responses to Questions PRA H.0S(a), H.08(b), and H.08(c). The analyses in the Limerick PRA (See Appendix C and D) utilized a more conservative approach.

LO Q-156a Rev. 5, 9/82

RESPONSE TO QUESTION FRA H.06 - CONTINUED

~s (b) With respect to the roles of the channel boxes and the CRD floe, the channel boxes represent a significant mass of zircaloy within the core. The CRD flow also represents a limited water source continually added to the RPV for those accident nequences in which off-site AC power is retained.

The combination of the channel boxes and the CRL flow could somewhat enhance the hydrogen production within the primary system, but since the oxidation process is the major heat source driving the material toward rapid degradation, this additional augmentation is only applicable for a short period of time. When the assemblies begin to undergo substantial melting and deformation, the surface area available for continued oxidation is minimized and the supply of water / stems to the overheated region would be bypassed due to the core deformation and blockage. Consequently, the additional zircaloy in the channel boxes and the availability of CRD flow may nagment the core heatup process. Neither the analysis performed in Appendix C or the evaluation in Appendix H explicitly accounts for these factors.

l l

l 1

l t

Q-15Gb Rev. 5, 9/32

QUESTION PRA H.07 I' Ti.e arguments leading up to discussions about fuel debris attack of the control rod penetration lead us to expect a sery cool (near,its solidus) slurry. Justification as to why this is not the case is needed if the three-dimensional attack of the control rod penetration is to be claimed as the dominant mode of interaction.

RESPONSE

This issue is linked to the statement made in Appendix H of the PRA (Section III, page 42, 16th line of the first paragraph) with regard to three dimensional thermal attack of the control rod and incore instrument penetrations.

At the outset it should be noted that the above referenced sentence relates ta both control rod and incore instrument tube penetrations and states that "these penetrations would be the first element of the primary system pressure boundary to fall". The dominant mode of interaction with either the penetrations or the vessel wall is ariven by the temperature difference between the corium and the steel. The existance of a somewhat cooler corium temperature would increase the I time to failure but not the location. The location of I failure is determined by the smaller amount of steel needed to be brought near its melting point to fail the penetrations versus that which would be needed to fall the vessel wall and the fact that the penetrations themselves, as shown in Figure 3-1 of Appendix H, extend upward into the lower plenum, thereby subjecting them to three dimensional attack by any accumulation of corjum in the bottom head.

The subject of the temperature of fuel debris is discussed in the Response to Question PRA H.06.

Q-150c Rev. 5, 9/82

OUESTION PRA H.08

) (a) Discuss the possible changes in the progression of the accident and the resulting consequences if the core material is near its solidus (or a slurry) after it leaves the vessel.

l (b) The long-term interactions section starts off with the -

premise that the fuel material is distributed on the diaphragm floor, llow much would the conclusions change if the diaphragm floor gave way or the floor and equipment drain system failed early in the accident such that a larger fraction of core debris reaches the suppression pool shortly after vessel failure. Provide an assessment of ex-vessel steam explosions, damage to the pedestal, and steam spikes leading to the containment pressure rises of consequence.

(c) Under the conditions postulated above, the core material may pile up in the pedestal reglen of the suppression pool.

Discuss the potential for dryout of the core material, h, tat-up of the central portions of the core material and penetration of the basemat. Discuss the influence that dryout could have on sparging of the fission products to the environment.

(d) Provide a discussion of the potential effects of containment O- sprays on the accident consequences for the following cases:

(1) prior to diaphragm failure (2) after diaphragm failure Discuss the effects of pool temperature ranging from near room temperature to saturation on the DF and the failure modes.

RESPONSE

(a) The progression of the accident and resulting consequences (Appendix C, INCOR) would not be materially affected by the core material being near its solidus (or a slurry) after it leaves the vessel. The analysis performed for the LGS-PRA in Appendix C (Section C.2.4 INTER, page C-10) would be affected somewhat in that the pressure increase in the drywell at vessel failure would be reduced due to energy content of the melt. The descriptive analysis presented in Appendix II, if modified to lower the temperature of the corium, would predict longer times for ejection of the material from the O vessel, longer gas phase blewdown, Q-15Gd Rev. 5, 9/82

RESPONSE TO OUESTION PRA H.08 - CONTINUED-reduction of the pressure response of the drywell, longer residence times for the melt material in the pad-stel region of the diaphragm, and the potential for greater core debriv inventory in that region at the time of diaphragm failure.

The-location of diaphragm failure and the progression of the accident from that point would not be substantially changed from that described by the analysis as presented in Appendix H.

(b) The LG5 PRA conservatively assumed that the core material remained on the diaphragm floor. In general, the INCOR code  !

system, assumed the additional conservatism that the material remained within the pedestal. region (see Appendix C). A discussion of the interaction of the molten core debris with the suppression pool and basemat after floor and equipment drains fall is provided below. This discussion is consistent j with this failure occuring shortly after vessel failure as discussed in Appendix H.

As the material drains into the wetwell/ suppression pool region, the high temperature debris would likely contact and j splash off of the storage tanks for the equipment and floor drains and their associated piping and contact and flow through the steel grating floor supporting these tanks.

l These structures are immediately below the failure locations ard would affect the size of the debris upon entering the O suppression pool and the initial quenching rate of the debris. The effects of these structure would be to initially break up the material into centimeter scale fragments or smaller. With these size particles, the thermal interaction j upon entering of the pool would occur within the time frame j of 1 to 2 sec. As a result, the rapid thermal energy release from this debris would provide for steam formation within the pedestal region below the diaphragm and would also affect the liquid level of the suppression pool in this region. This phase (initial entry into the suppression pool) will be referred to as Phase I.

As material enters the suppression pool water inside of the pedestal region, the driving pressure for the flow is the pressure in the drywell plus the static head of the core debris ininus the pressure within the pedestal region of the wetwell.

O Q-15Ge Rev. 5, 9/82

RESPONSE TO QUESTION PRA H.08 - CONTINUED O

py 2 subscript:

pDW + p ghF "F

_p P

.FF2 F core material Entry of material into the suppression pool water would cause steam formation within the pedestal region. The resulting pressurization would cause flow through the passagewey and parts connecting the wetwell regions inside and outside of the pedestal at:the elevation of drain tanks. In addition, ports in the pedestal below the water level would also enable flow for pressure relief. The principle feature to be assessed for this phenomena is the self-limiting nature of the processes since pressurization of the pedestal region below the diaphragm would decrease the supply rate of core debris to the suppression pool. If it is assumed that a quasi steady flow is established with the core material being quenched and alI the steam is vented through the passageway coupling the wetwell regions inside and outside the pedestal, the energy balance can be expressed as:

O p subscript:

U EF^D F F "EAUhgggfg=gAUhg g fg f . water g - steam and the resultant pedestal pressurization'can be estimated by considering the steam flow to be incompressible as described by the Bernoulli equation. ,

2(P p -Py a p, With appropriate substitutions, the above equations can be combined to provide for an expression relating the pressurization within the pedestal region to the drywell pressure, the static heat of the core debris, and the wetwell pressure.

Ah DW E8 F F

~

P" pp c AT

~

RT P ww Q-15Sf Rev. 5, 9/82

l RESPONSE TO QUESTION PRA 11.08 - CONTINUED O As illustrated, this expression involves the discharge area for core debris through the diaphragm (Ao ), the available area for venting of the gas from the pedestal region (Ag),

the latent heat of saporization (h,g), and the sensible heat contained within the core debris (ep A T) . Since the driving pressure difference would be a maximum at the time of initial diaphragm failure (deepest pool), a calculation can be performed to determine the pressurization of the pedestal region, which is approximately 0.05 MPa. This level of pressurization would not threaten the integrity of the pedestal and the net result would be to depress the collapsed liquid level within the pedestal region by forcing water out of the submerged port holes. Ilowever, it is also important to evaluate the hydrodynamic stability associated with the steam flows involved in this calculation, and since a pressure differential of 0.05 MPa would provide for steam velocities of 800 m/sec, the translation of this flow rate into a superficial velocity within the pedestal region results in superficial steam velocities of about 30 m/sec.

This value exceeds the stability limits for both annular and droplet flow and would imply that the delivery of such steaming rates to the passageway would result in a different flow regime than steam being vented from a collapsed pool.

Since high steaming rates would cause the levitation of water and a two phase mixture would result, an approximate analysis O can be perforned assuming that a homogeneous mixture is boiled up and the energy removal from the pedestal region is by steam with quality less than 1.0. For such an analysis, the flow rate through the passageway would be given by Wf = A [2[3p + (1 - E)pg] (Pp -P )

ehere a is the average void fraction of the boiled up water pool. The energy equation can be expressed as pAU#

pDFF AT = (1 - x)W2$ (h g - hg) + xW24 8(h -b) g O

Q-15Gg Rev. 5, 9/82

RESPONSE TO QUESTION PRA H.08 - CONTINUED i The principal differenew is that for reasonable steam

\ qualities (x), significant energy is removed from the y pedestal region by the liquid phase. If the flow rate is now translated into a superficial velocity within the suppression 4 pool, the resulting stemming rates are approximately 1 m/sec  ;

which is characteristic of the superficial velocities  !

required to achieved boiled up pools with a 50% void r fraction. Therefore, in this boiled up state the suppression pool within the pedestal region can absorb the energy l deposit 8on resulting from the quenching of the core debris and the resulting pressurization is still approximately 0.05 MPs.  !

Break up of the core material as it enters the suppression pool can be estimated from the hber number stability .

criterion.  !

W=kfe , = /2 -

I Since the debris entry volocity is estimated by the incompressible Bernoulli equation, the Weber number criteria can be translated to i i

Thf OW f f f I

The maximum potentist for break up would exist at the time of ,

initial diaphragm failure where the pressures in the wetwell i and drywelI would be essentially equal and the driving forco j could be a liquid pool within the pedestal region having a v depth of about 1 m. Under these conditions, the hydrodynamic 1 stability criterion provided by the Weber number would [

predict particulate sizes of 800 microns. In this case the  !

debris entering the pool would be rapidly quenched and the  !

pedestal region would pressurize due to steam formation with l the subsequent discharge of core debris being limited by this j pressurization. With the subsequent pressurization to levels .I of 0.05 to 0.06 MPa, the flow into the suppression pool is substantially Ilmited and the velocity of the material is also decreased such that particulate sizes would have sizes l' 1

of 1 to 2 mm. This hydrodynamic stability criterion assumes that_the material is sufficiently above its solidus point.  ;

With a reduced core debris temperature, , fragmentation would -;

be considerably less than predicted by this criterion. The j energy release rates from the core debris would also be reduced.  !

l J

l L .Q-156h Rev. 5, 9/82  ?

- - . . , ~. ..-. .,-- - . - . - - .,-m.- . . - - . , s .-t --.:, ..n, . . , - - . ,,,n,,

l .

. , ,< [ h t.I .

. ~ 6 .h _ '. N . ,y ' ._ [ k . ', .) ' . h " . i '

l. i.$l.[.$,5 RESPONSE TO OUESTION Ph'411.08 - CONTINUED O Given the rate at which pedestal pressurization would occur for systems with sufficiently low viscosity that fragmentation could occur, it is extremely difficult to accumulate significant quantities of molten debris within the pedestal region in a finely fragmented state to provide a I steam explosion of sufficient magnitude to threaten the pedestal integrity. In addition, mary experiments have been carried out to demonstrate that explosive interactions are difficult to initiate in very deep water pools or with long fall heights which produce substantial entrance velocities.

This is in keeping with the hydrodynamic stability criterion discussed above since materials with substantial entrance veiocities would undergo rapid surface reactions and therfore, r event the accumulation of significant quantities of core debris at the basemat. Systems with very deep pools make the initial triggering of steam explosions difficult since the material is frozen or nearly frozen by the time it reaches the bottom of the water pool. In this system, the pool depth is approximately 7 m. and with the substantial fall height and driving pressure differential, strong surface reactions would certainly be anticipated as discussed above.

If the debris which is accumulated within the pedestal region above the diaphragm is near its solidus point, fragmentation of the debris into the general particulation sizes of interest for large scale steam explosions would be extremely difficult, and with lower temperature, freezing of the outer O surface of the debris would rapidly occur, providing another wubstantial reason why fragmentation to the sizes mentioned above would not occur.

For the several reasons listed above, fine fragmentation of large quantitles of debris within the pedestal region below the diaphragm would be most difficult as would initiation of an external trigger. Consequently, large scale steam explosions of sufficient magnitude to threaten the integrity of the pedestal would be highly unlikely even under these circumstances.

(c) As discussed in (b) above, for systems with ter.peratures substantially above melting such that hydrodynamic stability criteria are applicable, fragmentation sizes as small as 800 microns would be anticipated for the first quantities of debris entering the suppression pool with the later portions of the material having fragment sizes from 1 to 2 mm or larger. Should the material be close to its solidification point, fragment sizes larger than these values would be anticipated. The dryout heat fluxes within the pedestal region could be evaluated assuming an internal bed limitation as designated in Fig. 1.

O Q-15Gi Rev. 5, D/82

RESPONSE To QUESTION PRA H.08 - CONTINUED PARTICLE DED DRYOUT MODELS O

WATER I I 10' -

0 BARLEON & WERLE HYDRODYNAMIC D SOUARER ET. AL. STAalLITY

(

~

E A TRENBERTA & STEVENS

} O ANL DATA x

d a o O J

ti. I 3- COMPLETE O o b 10' -

SOLUTIONS a LIMITATION o WITHIN THE BED

>- LAMINAR +

cc o ASYMPTOTE dO O

10'

' O.1 1.0 10 100 PARTICLE DIAMETER, mrt This evaluation assumes that the limit to coolability is presented by the counterflow condition of water flowing l downward in the presence of upward flowing steam. This is a l one-dimensional characterization of the bed, which is conservative, and given this limitation, the accumulation of all the core material within the pedestal region below the diaphragm would be coolable at 1% of nominal power if the particle size was 4 mm or larger. If half of the debris were accumulated within the pedestal region, at 1% of nominal power, the debris would be coolable if the particulate sizes were larger than 1 mm. It should be noted that when core debris has approached its melting point (consistent with the migration of material out of the core region and out of the reactor press.are vessel) the noble gases and volatile fission products within the debris would have been released such that the specific energy generation would be 2/3 of that normally subscribed to the total fission product inventory at various times after. reactor shutdown. Consequently, if the material is transmitted into the suppression pool approximately 1 1/2 O's hours after reactor shutdown, the release of the more volatile fission products from the fuel would imply that the QL156f Rev. 5. 9/82

occrgy gocerotica rats within tha core debris would be sufficiently low that 100% of the core debris, if accumulated within the pedestal realon, would be coolable with particle sizes of about 1 mm.

Considering the average particle sizes Jetermined by the hydrodynamic stability criterion and the potential for cooling of the debris in a conservative one-dimensional manner, the potential for achieving a permanently coolable state within the pedestal region is very likely. Another effect is the ability of debris that is fragmented to this scale to remain within the pedestal region given the rapid quenching and bollup of the pool. Under these conditions, 4

the levitation of particles, which again is a conservative evaluation of the ability for.the boiled up water pool to levitate, transmit, and relocate' fuel particles, suggest that two phase mixture velocities of 1 m/see are sufficient to levitate the fuel particles and tranfer such particles out of the pedestal region into other parts of the suppression pool.

In enunce, this calculation shows that if particulate. sizes of 1 to 2 mm are created, the material cannot remain within the pedestal region unless the molten material delivery rates to the suppression pool are very low causing little pool boilup. Low delivery rates would be typical of conditions where the debris was close to its solidification point at the time of diaphragm failure, such that considerable fragmentation could not occur, in which case the particulate sizes would be quite large and would represent a coolable debris bed.

Given the above evaluation for debris bed dryout heat fluxes, the one-dimensional character of the bed is a conservative evaluation. With the large diameter of the pedestal region and the port holes in the pedestal, some two-dimentional character of the bed would certainly be anticipated. In a two-dis:ensional system, the water can be supplied from the sides of the bed and a counterflow configuration is not required. Given this behavior of the particulate bed the dryout heat flux can be increased by factors of 2 or 8 over

that represented in Fig. 1 for an internal bed limitation.

This would also provide for additional cooling of the bed and result in the conclusion that bed dryout would be highly

, unlikely.

Should bed dryout occur, the basic reason would be fine particulation of the debris. For such fine particulation to occur, the debris would have been quenched upon entry into the suppression pool. Therefore, dryout would be initiated from a temperature close to that of the water. As a result, direct attack of the basemat concrete would require that the material melt the steel liner. Heating up of the debris to levels sufficient to attack the steel would require at least I hour. Should concrete attack be initiated, the gases l released from the concrete would promote debris

!O l

Q-156k Rev. 5, 9/82

RESPONSE TO QUESTION PRA 11.08 - CONTINUED configurations with larger particulate sizes and would thus O- tend to make the system more coolable. This could potentially be a self-limiting process should such concrete attack occur. It should be noted, however, that the debris bed could not completely dryout, i.e. mignificant heat removal would be taking place from parts of the debris bed while other regions could potentially dryout and overheat.

As indicated by most experimental data, these dryout locations are in the central to upper portions of the debris bed and as a result would not provide immediate conditions for attack of the steel liner and the basemat concrete.

(d) Core debris, after it has been released from the reactor pressure vessel, but prior to entry into the suppression pool or if it is retained on the diaphragm floor could be cooled with the drywell sprays. Activation of drywell sprays, flooding of the diaphragm floor, and spill over of the water into the downcomer pipes or through failures in the diaphragm at the floor and equipment drains would allow material on the diaphragm floor outside of the pedestal region to be cooled in place. This core material would be that portion of the debris which' flowed out of the passageway to the CRD room prior to failure of the floor and equipment drains. If a substantial fraction of the debris released from the RPV is retained wit.hin the CRD room, then activiation of the drywel1 sprays could potentially retain some additional amount of O- debris in this region as compared to that which would be retained without the activation of drywell sprays, but spray activation would not likely prevent the thermal attack and failure of the floor and equipment drains. Following such failures, debris would be transmitted into the suppression pool where it would be covered by the pool water.

While activiation of the drywell sprays would not necessarily prevent breaching of the diaphragm, it would be a positive action toward preventing containment failure in such severe core damage sequences. Drywell spray activiation would cool the debris on the diaphragm floor outside the pedestal region ,

and thereby prevent or minimize the extent of thermal attack l on the concrete in this locale. l In the LCS-PRA, no credit was taken for the :ontamination effects of containment sprays (drywell or 4 all). At the time of the PRA, drywell and wetwell sprays had never been credited in unfety related analysis. Based on subsequent analysis and review of the evaluations

• for accident cases where containnent sprays are available, a decontamination factor of 100-1000 could be expected for' airborne contaminants.- This would apply to cases of spray activation both befere and after diaphragm failure. ,

O Q-15SI Rev. 5, 9/82 y- # g

RESPONSE TO OUESTION PRA H.08 - CONTINUED  !

O r For all accident sequences resulting in containment overpressure failures ( y , v# , v") drywell sprays prior to

\

significant generation of non-condensibles from core concrete interaction, would provide effective depressurization, debris bed coolability and maintain containment integrity. Wetwell sprays could, if activated after diaphragm tallure, provide an effective means of vapor suppression, and DF's associated with its operation could compensate for the loss of pool scrubbing DF's described below.

Recent analysis and tests ** indicate decontamination factors of at least 10a for unsaturated pools and at least 10* for saturated pools can be expected regardless of the chemical form of the species or the ph of the pool. This analysis assumed, for sequences where pool DF was applicable, valves of 102 and 10'.

Reference:

NUREG/CR 0000, " Technological Bases for Models of Spray Washout of Airborne Contaminants in Containment Vessels," October, 1978.

Reference:

GESSAR II, App.15D, Attachment A " Suppression Pool Scrubbing Tests".

m

\

Q-15Gm Rev. 5, 9/82

Appendix I 4

. -, QUESTION I.01 V

Provide a description of the process used to discover Limerick plant specific intersystems dependencies and common cause failures. For example, those compromises in redundancy due to maintenance and testing procedures, HVAC dependencies, AC power dependence ,upon DC control '(DC control of EDG start), EDG support systems dependencies, the assumption that equipment can perform in the hostile environment resul' ting from the accident initiator, and location dependent failures.

Include a summary of the contrasts between the process used to discover intersystems dependencies at Limerick versus the process used in WASH-1400. Provide a description of the mathematical and graphical (EI/FT) methods used to accommodate the increased probabilities of failure due to the discovered dependencies.

i RESPONSE (a) WASil-1400 identified common cause failures of redundant systems as a possible contributor to o.ra melt frequency.

Subs quently the incident at TMI-2 demosatrated that adverse effects on safety systems could be caused by unforseen system interaction. In recognition of this potential for important accident sequences to be dominated by ccamon cause or systems interaction problems, the LGS PRA affords PECo the following:

1. A quantitative assessment of the risk associated with the plant.

2. A logic model of plant systems which can be evaluated both qualitatively and quantitatively.

8. A framework within which systems interactions can be identified and assessed.

The PRA LCS methodology affords a systematic approach to the identification of postulated accident sequences and the

, failures which can cause accident sequences including those attributed to systems interaction or common cause.

The event tree / fault tree methodology augments the other more 1 deterministic approaches used by PEco to ensure plant safety.

A major advantage of the use of the event tree methodology is that it provides an overview of the postulated accident sequences and the plant functions required to maintain public safety. This overview-is useful in assessing the impact of sequence dependent functional failures of systems. In  !

addition to the functionally induced failures there are also

( system interfaces, support systems, human interactions, and l

Q-157 Rev. 5, 9/82

~ ,e ..,,e, --,e --,--a y -,r.r, , ,,,mr- -,- - - - -w - m v-= , , , - - -

other systen interactions which are accounted for in accident sequences via the systen level fault trees.

The types of systems interactions which have been classified thus far include the foilowing (2):

1. Functionally coupled

2. Spatiallv coupled

8. f yniv coupled These effects have been investigated in the LCS PRA using the fault tree event tree approach as limited by the groundrules and are discussed below and in the LGS PRA.

Event tree / fault tree techniques are one of the nature methodologies available today to gain additional insight and perspective regarding the potential for as yet unidentified systems interactions affecting the public safety. The use of fault tree /crent tree logic models provides the best l

available method for identification and evaluation of systems ,

interaction. This methodology represents a highly structured  ;

franework that has the following desirable attributes; it is e systematic

• flexible e reproducible

• simple

• understandable Within the context of the PRA the following techniques were used to isolate systen dependencies and interactions:

1. Systen walkdown and plant familiarization.

2. Previous PRA/ Systems Interactions Study reviews.

8. Evalrations of containment interactions as they affe t plant systens.

4. Review of LWR operating experience, e.g., LERS.

5. Incorporation of the above in a fault tree event tree franework for consistent evaluation.

(b) Specific Itens Requested to be Discussed:

i (b) Specific Items Requested to be Discussed:

i '

O' ITEM METHOD USED IN PRA Maintenance Procedures A two fold approach was taken to on-line and Test maintenance:

(a) Those cases in which maintenance occurs on-line~ are modeled explicitly along with the dependencies of other systems based upon LCOs.

(b) The possibility that LCOs would be violated and multiple systems would be unavailable as also incorporated.

In addition the possibility that maintenance actions would lead to disabling of equipment re-quired for safe shutdown and also included. Fur-ther, test and maintenance errors which could dis-able multiple channels of instrumentation were accounted for in the construction and quantification of the fault trees. However other components p

Aj do not have intercomponent dependencies due to common mode maintenance errors were modeled as stated in the Groundrules.

HVAC Dependencies HVAC is not required for the operation of Limerick equipment, in fact HVAC is isolated in accident signals so that it will not be in general available.

Component cooling is provided through the emergency service water system which is explicitly modeled in the fault trees.

AC Power Dependence Each system is directly dependent upon both AC and Upon DC Power DC power. This direct dependency is included within each system fault tree.

DC Control of Diesel Generator Start DC power depmds upon the power and therefore the diesel generators through battery charging and inverter circuits. AC power depends upon DC power.

These dependencies could result in fault tree cir-Emergency Diesel cular logic unless care is taken to imp'ement the Support Systems dependencies within the system level fault trees with pk some care. Therefore the DC power dependency of each system is explicitly modeled at a higher level within each system fault tree. It should be noted that for R-161 Rev. 5, 9/82

the diesels a detailed fault tree was not performed but rather operating experierce data was used to model these systems. The resulting probability of single and multiple diesel failure which was used in the event tree quantification is far higher than the calculated contribution from loss of a single DC bus or multiple AC buses.

Equipment Peformance Several cases of equipment required to operate in in Hostile Environment potentially hostile environment are included in the LGS PRA. These cases include:

(1) If containment is breached due to overpressure because of the inability to remove heat from ,

containment, (this could be either a Class II or IV** accident) then the environment present in the reactor building following this has been assumed to lead to an unacceptable envir-onment in the reactor building. Therefore continued coolant makeup to the reactor is con-servatively assumed as unavailable. (the result is the same as WASH-1400 assumptions)

(2) The environment inside containment may exceed O- the qualification envelope for ADS valves and electrical support systems. This has been accounted for.

(3) No recovery from degraded core conditions has been treated since the environmental conditions existing following severely degraded cores are not easily identifiable. (same as WASH-1400)

TW ATWS O

Rev. 5, 9/82 q-162

~. - ._ . .. .~- _. - - - .. .

1 Apptndix J QUESTION J.01 A

Provide documentation showing that the suppression pool water

( ]-

static load does not affect the containment failure pressure.

' Provide documentation showing how the dynamic loading, due to blowdown of steam into the suppression pool (either through the downcomers or from SRV's), has been factored into the failure pressure. Additionally, how do the dynamic forces on the diaphragm floor, during blowdown of the core through the vessel, effect the containment fai!ure pressure?

f RESPONSE The containment design includes provision for the static load of the water in the suppression pool. This loading is l included in all the structural analysis associated with the ,

containment design. Since the containment was designed to '

meet the requirements of appropriate codes and mpecifications, the PRA did not verify the containment design i analysis. I 1

l The structural analysis performed on the Limerick PRA was a static analysis to deternine the ultimate pressure capability of the containment. Pressure loading input to the structural analysis was provided by the INCOR analysis and is discussed

,. In Appendix C, with bounding pressure-time curves shown an Figures C.3, C.4, C.5, C.6, C.8, C.10, and C.12. Areas of i

uncertainty in the analysis (associated with RPV failure) are shown on the curves and discussed in the text. For Class II and Class IV accidents, the containment is assumed to have failed prior to RPV failure. For Class I and Class III accidents, the containment is intact at the time of RPV failure. Containment failure was assumed to occur at the time of failure of the diaphragm floor due to dynamic forces and weakening of the containment structure.

Dynamic loading due to blowdown of steam into the suppression pool was not evaluated as a contributor to containment failure. Blowdown loads would be localized in the suppression pool and would be attenuated so as to be insignificant in their effect on containment structure relative to the static pressure load and capability.

s/ ,

Q-164 Rev. 5, 9/82

O t

l PROBABILISTIC RISK ASSESSMENT LIMERICK GENERATING STATION Pf1ILADELPHIA ELECTRIC COMPANY l

t

"~'

O SEPTEMER,1982 DOCKET NOS. 50-352 50-353 0

(s Table A.l.3 l

SUFNARY OF THE FREQUENCY OF TRANSIENT f.NITIATORS AND THE CATEGORIES INTO WHICH THEY HAVE BEEN CONSOLIDATED Freevency (Per reactor feer)  !

Eper surver of tr sws: swa op. Esp.  !

All fears Esclude fear ! ' '*F l CIf5 D r OE A"'""I 1 N5tV Closure 1.34 .57 & M Closure of all M5!Ys (5)** 0.57 0.19 0.13 1.00 Turtine Trip Without 8ypass (2.4) 0.00 0.00 0.00 0.01 l Less of condenser (8) 0.67 0.38 0.22 0.067 2 Turetne Tr9s M 4.17 2.98 M Partial Closure of M5!Vs (6.7) b.12 0.14 0.12 0.20 furbina Trip with Sypass 3.78 2.01 1.24 (3.13.30.12.33.34.35.36,37) 1.33 Recirculation Problem 0.38 0.08 0.05 0.25 (14.15.16.17.18.19)

Pressure Regula tor Fa flure (S.10) 0.43 0.35 0.31 0.67 Inadvertent Ocentne of Bypass (12) 0.04 0.0$ 0.00 Rod Wtthdrawel/ Insert ton 0.00 (27.28.29) 0.14 0.14 0.06 0.10 (n ' otstureance of Feedwater (20.21.23.24,25.26)

Electric Load Rejection (1) 1.39 0.70 0.53 '0.64 3 tossofOf,f).[te, Power (3U 1.04 0.70 0.63 0.75 f' 1 2 0.09 .38 4 faaevertent Osea felfef Valve (11J y .0g .03 g 5

tos, of Fea?weter (22) a y g g TOTAL 9.29 5.09 3.51 6.2

• Modifies to 0.07 based upon 4JRIC-0626.

• • haears in parentheses refer to trsasient numbers from Table A.1.2.

4. Inadvertent open relief valve which may lead to an initial heat up or pressurization of containment prior to any attempt to shutdown

5. l.oss of Feedwater. The loss of feedwater initiator was separated out, but later combined with MSIV closure.

l l The consolidation of these transients into groups is defined in Table A.1.3.

l t r

!b i

A-10 Rev. 5, 9/82 l

B.l.2 Reactor Core Isolation Cooling (RCIC) System (See Figure B.1.2)

[O]

Purpose The purpose of the RCIC system is to assure that sufficient water inventory is maintained in the reactor vessel to permit adequate core cooling

~

during the following conditions:

e Transients that include the loss of normal feedwater  ;

l e LOCAs with break sizes that do not depressurize the reactor j e Hot shutdown conditions.

Hardware Description The RCIC system consists of the following components:

e One 100% capacity turbine and accessories e One 100% capacity pump assembly and accessories o Piping, Valves, and Instrumentation for the following:

- Steam supply to turbine

- Turbine exhaust to suppression pool

- Makeup supply from the condensate storage tank (CST) to

' pump suction Makeup supply from the suppression pool to the pump suction Makeup supply from the RHR steam condensing heat exchangers

- Pump discharge to the feedwater line, spray nozzle, including a test line to the CST, a minimum flow bypass line to the suppression pool, and a coolant water supply to accessory-equipment.

B-6 Rev. 5, 9/82 ,

4

..m _

V LA

,i

- d!

Table B.5.1 ENGINEERED SAFEGUARD SYSTEMS LOAD DIVISION SEPARATION

• DIVI 51045" 5fN5085/5v51[H5 p I  !!!  !! IV Sensors A .E .J ,4.T. I C.G,L.R,V 8.F.K.P.U,V D.H.H,5.W Core Spray A C B D RHR A C 8 D RHR$W A.C 8,0 E,k A C B D I

ADS and HPCI AM- A ADS-C HPCI-08V HPCI.18V N55 Isolation Valves (Output Logic and Inboard .. Outboard ..

}

Valve Circuits)

RCIC RCIC-08V RCIC-18V .. ..

Diesel Generators and Class 11 Busses Unit I Dil 013 D12 Die Unit 2 021 D23 022 D24 0-G Enclosure

1. 4WAC System A C 8 0 SCTS A .. B ..

k RERS HVAC System A --

8 ..

Control Room HVAC System .. A .. g Post-LOCA Recombiners .. A .. p Spray Pond Purnp Structure HVAC A C B D System HVAC system Unit Coolers RCIC A,8 .. .. ..

HPCI .. ..

A.8 ..

RHR A.f C.G B.F D.H Core Spray Af C.G B.F D.H Drywell A1.C3.11,G1 A2.C2.t2,G2 81.01.Fl.H1 82,02.F2,H2

• 5ensor logic, and actuator suffia letters and divisional allocation for 155 and RCit and energire to operate portions of the N555.

• • The corresponding channel identification for raceways and cables relating to divisions is as follows:

Division I !! Ill IV Channel A B C D

+00V

• Outboard isolation valve and logic IOV = Inboard isolation valve end logic

• • • C and D RRRSW pumps are powered from divisions 1 and 2 in Unit 2

/ \

f 4 B-44 Rev. 5, 9/82

p_

' Turbine: Both RCIC and HPCI utilize a steam turbine to supply the motive power for the high pressure pumps. Therefo.'e, one of the failure mechanisms of HPCI & RCIC is the failure of the turbine. Figure B.9.6 is the generic fault tree of the turbine and displays the potential failure modes considered dominant in the evaluation of the turbine failure rate.

Pump Room Cooling and Ventilation: For long-term emergency core ccoling system operation, adequate pump room cooling is considered l necessary. The RCIC, RHR, HPCI, and core spray pump rooms have two sources of cooling:

i e Reactor Enclosure HVAC (offsite power required) e Pump CompartmentUnit Coolers (emergency power source).

Figure B.9.7 displays some of the potential failures which could disable the ventilation systems and preclude adequate pump room cooling. Little data is available on the performance of pump room cooling systems; how-ever, loss of these systems is felt to be a relatively small contributor to pump failure compared to the other failure modes cited in the pump or turbine generic fault tree.

Instrumentation: Instrumentation and control failures have been recognized to be a contributor to plant or system unavailability (B.9-2) and a major contributor to plant trips (B.9-3). The fault tree model constructed in this analysis accounts for failures of instrumen-tation channels in the following categories:

o Failure of Sensors (failure modes are discussed below) e Miscalibration of Sensors (basically a human error or faulty procedure) e Logic Failures 0

-d B-79 Rev. 5, 9/82

Th3 CRAC modal uscd in WASH-1400 used disparsion parametera bacid en Pacquill-Gif ford curvaa which wara dsrivsd from data obtaintd et distances less than 1 kilometer from the point release source, for near surface releases of 3 minute duration, and low surface roughness

[v') (r) approximately equal to 3 cm. The Limerick site specific parameters used a roughness adjustment as suggested by Briggs which is of the form (sigma Z2 / sigma gZ ) = (r2/#1) . SP ecifically, the vertical diffusion coefficient (sigma Z) was altered from a lower surface roughness (r=3cm) to a rougher surface (r=10cm) . This is still somewhat conservative for the region around Limerick since the effective sigma Z for forested regions is still larger than the value used. The Limerick site specific parameters also include adjustment factors for the release duration (T) )

to account for the assumed minimum accident release duration of 0.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> as suggested by Pasquill, which is of the form (sigma Y2 / sigma Yg

) =(t 2 l}

• Figure E.5 shows a top view of the plume path. The width of the high dose region varies depending on several conditions including meteorology. On a clear day, the plume will spread out faster than on a clear night primarily due to wind fluctuations and turbulence. I RELEASE ON CLEAR NIGHT WIND DIRECTION J /

.:S1

, giW'

.t'-

/ MOVING REACTOR RADIOACTIVE CLOUD REGION OF DEPOSITED RADIDACTIVITY

.:c, r."' .h gj[$;h.;. . WIND DIRECTION

.E)IO.Typ.6,J;r

\

REACTOR \

\

RELEASE ON CLEAR DAY Figure E.5. Top View of the Plume

• The plume expansion correction factor used for longer than 0.5 s is the same d el hour releases is of the form (t2!*1 .

in the CRAC code which was used in WASH-1400 E-11 Rev. 5, 9/82

E.2.2 Plume Rise

(-

V WASH-1400 made use of the plane rise fornula developed for smoke stack plumes to predict the effective vertical size and dispersion of a release. However, there are many p1tane rise formula and they rarely agree outside of their specific range of applicability. In NASH-1400 the Briggs pitzne rise i formula was used in the consequence code. L1 the Limerick analysis, the Briggs formula was used with a power of 0.33, to gemrate pitane rise data. '1he Briggs formula is also in keeping with the NRC's site-specific review [E-2]. In calculating plume height rise for the Liwrick site, two wind data measure-ment elevations were used depeixling on the release energy rate, t

E.2.3 Meteorology p The CRAC calculations for Limerick incorporate seasonal data -

V on stability, wind speed, precipitation and a wind rose. These values  :

were obtained from five years of data (1972-1976) taken at the Limerick site by PECo.

t E.2.3.1 Wind .

, i For the WASH-1400 composite site BWR analysis a wind rose was defined which assigned equal probability to wind coming from all sectors, with population variations by sector used to factor in the probability of a high population area corresponding to the wind direction during an accident. Variation of wind direction in the plume calculations, and wind shear with altitude were not considered in WASH-1400. (It has been since shown [E-5] that wind shear variations do not significantly affect the plume dispersion calculations.) The Limerick analysis, uses seasonally varying wind roses.  ;

I

{V\

E-12 Rev. 5, 9/82

= . . - .. - . . - - -

, (;. 'f E.2.3.2 Precipitation (

(- Another consideration is the effect of precipitation on the dispersion of the plume (E-4). As rain falls th' rough the plume, '

radioactive material falls with the rain to the ground. Thus, ground -

concentration of radioactivity is raised. The effects of rainstorm on dispersion are controlled by the following variables: q s

e Washout coefficient - the cmount of radioactivity ,

interacting the rain e Runoff - the amount of the water not absored into i the ground

! e Rain intensity - the variation with time 'W ,

) e Intersection - the distance'from the reactor at -!

i which the plume intersect with the rainstorm. s i

4 Occurrence of rain will tend to . increase the number of early fatajities,

. p and decrease latent fatalities since the radioactivity is dispersed in V a smaller area in more concentrated amcunts. The WASH-1400 precipitation model, which does not consider runoff or time-varying rainfall intensity, was used'in the Limerick analysis.

i r

i l

4 E-13 Rev. 5, 9/82

, . . - . . .- . - . - . - _. . ~ . . - , , , ,-, -,- - - . , - , . , ,

, ?.; l 6<s

/~

Since[ structures have regionally related characteristics, an

, assessment was made for the a'rea around Limerick. The WASH-1400 shielding f actors for the Pennsylvania region were used in the analysis, this '

(') assumes that 'the people around the site would not actively seek protec- t tive sheltering.'. The values for groundshine and cloudshine dose shielding J

f actors used in the Limerick analysis were 0.29 and 0.71 respectively.

When compared with thc shielding factors of 0.33 for groundshine and 0.75 for cloudshine as used in WASH-1400 (for the composite site) the

, Limerick shielding f actors are enhanced somewhat, because of the effect

'of regional l shielding characteristics in Pennsylvania as listed in

WASH-1400.

E.2.2.2 Inhala tion The ef fective inhalation rate for the population af fects the latent consequences of a nuclear accident. When the radioactive plume "n passes, over a populated area, people may inhale radionuclides from the passing cloud. The breathing rate input to the CRAC code is an ef fec-s tive breathing rate; it is a measure of how much radiation the public v

receives thr'ough inhala tion. The breathing rate used in WASH-1400 and 1

O. ,-- the Limeriqk PRA was 2.66 x 10'"4 m3 /s.

~

x _

\

t k  %

Y i-

[

I

?

l f r

f 4

,10,

\s,/ -

! E-16 Rev. 5, 9/32 L

-~

3 '

O 1

5 l

' t t

s l

7, f

i  ;

i i

1 i TH I S P AG E I NTENT I ONALLY L E FT BLANK' j

O i i

a i!~

i e

l i

4 i

i ,

F i

l

,1 l

9 l

O i

E-17 Rev. 5, 9/82

-_ _ ---------___.______ _ _ _ _ _ _ . . .....m..w.._,_.r, ,,n,......,,.m,,.m#,%._,w_,,.,,, ,,,,,.p.wwm,.9.,%,,w.

~

9 T 'H I S PAGE I NTENTI ONALLY LEFT B LANK v.

, to f

r s

ep .

E-18 Rev. 5, 9/82

4 e

i i

i i

}.

1 I

i

, I

! )

)

{

t THI S PAGE I NTENT I ONALLY LE FT B LANK I

j I

1 4

e

. r i

1 B

i-t

.i  !

F 1

[

< i 4

b f ,

s

> +

1 L

i t

i i

I E-19 >

Rev~. 5, 9/82

• 1

. + < . n.-,,.,---- - . . . - - , . . . - .- A n - - - , - - - , - - - _ _ _ _ - , - - _ - . ~ . - ~ - - . . _ _ _ _ _ _ . -

E.4 HEALTH EFFECTS MODEL One of the measures of consequences of a nuclear power plint A accident is health effects on the public. Figure E.7 gives a summary of the isotopes which affect the consequences to the public. Health effects can be divided into two categories; short term (early) effects, which are apparent within one year from exposure, and long term (latent) effects, which can show up during the remainder of a lifetime. Cumulative Complenentary Distributf or. Functions (CCDF) are ultimately obtained in the Limerick analysis for early and latent fatalities.

~ ~

EXTERNAL DOSE FROM GGOUND WITHIN 1 DAY

.. s n 10 3 -

e ,3 EXTERNAL DOSE FROM e CUMULATIVE DOSE FROM -

PASSING CLOUD INHALED RADIONUCLtDES _

_j .n

_..n m, j ...> .. i n p I j -.".y Q .... .. .

'O' ~~"". _

c. ,u

- .. , n , , "

_ , , , _ ',',','l <

a ..n -

..'1'<"<'.". ~C _

" ~

a" ,'"'. . ,,,gg,g-i oA n s_

o o

S i "

im

, , T iso 200 250 200 Days Afler Acc. dent Figure E.7. Relative Doses to Bone Marrow at 0.5 Miles from Reactor (Reference E-1, App. VI, Fig. VI 13-1) 4

( .

(- E-20 o

Rev. 5, 9/82

/

A

S 7 .

Q . J '%J Table E.4 COMPARIS0N OF THE WASH-1400 COMPOSITE SITE DATA WITH THAT FOR LIMERICK WASH-1400 COMPOSITE SITE LGS SITE-SPECIFIC

" TOTAL WINDROSE*

RANK OF ORIGIN P 08 V ONDITIONAL Ranking of 30 FT 175 FT  !

SECTOR BV 0F 0F SECTOR WikD Ih8 Sectors SLMtER WINTER POPULATION SECTOR 8EING EXPOSED ROSE I

BEING EXPOSED l974 1974 l m' ' l e .00446 1 1 1.0 .00446 (G) ** .06 .2 l

[ 2 2 .00446 1.0 .00446 (F) .12 .15 3 3. 4 .00893 1.0 .00893 (H) .05 .05 4 5. 6 00893 1.0 .00893 (P) .03 .04 5 AVG. of NEXT 6 .0268 1.0 .0268 (8) .04 .04 6 AVG. of NEXT 6 .0268 1.0 .0268 (E) .10 .06 7 AVG. of NEXT 12 .0536 1.0 '

.0536 (J) .04 .06 8 AVC. of NEXT 22 .0982 1.0 .0982 (0) .07 .04 9 AVG. of NEXT 22 .0982 1.0 .0982 (A) .09 .04 10 AVG. of NEXT 23 .1030 1.0 .3030 (K) .03 .05 II AVG. of NEXT 22 .0982 1.0 .0982 (C) ,06 .05 l

12 AVG. of NEXT 22 .0982 1.0 .0982 (Q) .05 .04 13 AVG. of NEXT 20 .0893 1.0 .0893 (R) .05 .02

& 14 AVG. of NEXT 20 .0893 I.0 .0893 (M) .05 .05 15 AVG. of NEXT 21 .0948 1.0 .0948 (N) .07 .08 i 16 AVG. of NEXT 22 .0982 1.0 .0982 (t ) .06 .03

• Also conditional probability of sector being exposed

• • Po'pulationsectordesignator(TableE.7) 0

O with the wind blowing in the direction of highest population. Table E.5 reflects the approximate increase in the conditional probability of +he wind blowing in the direction of highest population.

Table E.5 TOP TWO(2) SECTORS WITH MAXIMUM POPULATION CONDITIONAL PROBABILITY OF 5ECTOR BEING EXPOSED By COMPOSITE SITE FACTOR LARGER FOR POPULATION FROM WASH-1400 LIMERICK SITE LIMERICK 1 .00446 .2 '45 2 .00446 .15 '34 E.6 CRAC INPUT The inputs to the CRAC code are summarized in Table E-6.

Wind roses for the LGS site are shown on Figures E.8 and E.9.

Table E-7 shows the sector designations and the population by sector.

Table E-8 compares the radiological core inventory used in the Limerick analysis to that used in WASH-1400. The amounts are'similar for the majority of the isotopes between Limerick and WASH-1400. The major diff-erence is seen in the particulates. The Cesium (Cs), Antimony (Sb) and Tel-lurium (Te) isotopes are generally greater for WASH-1400 than Limerick. How-ever, the Rubidium (Rb), Ruthenium (Ru), and Americium (Am), isotcpes are generally greater for Limerick than WASH-1400 isotopes.

.O Rev. 5, 9/82 E-24

r

{ l

,Q; '

.( } ' APPENDIX G v

i The question arises as to whether the-mean or median should be used~'to characterize or display the point estimate results of the accident sequence probability calcu,1ations. The following points are

'. important in this discussion:

1. The fault tree quantification is performed using mean values for all input parameters in the point value calculation. The mean values propagate through the fault tree to accurately represent the top event for independent input events (see Section G.2).

2. The question of which measure. Of central tendency to display (mean or median) is more philosophical than mathematical. In the case o a nonnal (Gaussian) dis-l tribution, either one would-siff'ce since the mean =

median. This is not true for as3mmetric distributions (see Figure G.1).

lp -

i 3. This appendix discusses the appliubility of using'

! , the mean or median valve of a probability distribution l as the point' estimate 16 accident sequence probability '

calculations for the Limerick PRA *

% /

\ /

/

%de Mec tan Mean Mean. Medtgn Mean Median Mode Mode .

Log-Normal Distributton Normal Distr m ttan

, Figure G.1 Schematic Comparison of Three Possible Distributions I Which Would Alter the Relationship Between the tiean 9 and Median.

1

%/

g_1 Rev. 5, 9/82

________._____E._.___.__.

O

-Q G.I. ~ COMPARISON OF MEAN AND MEDIAN VALUES-

'Mean There are a number of advantages' associated =with using mean-values as opposed.to median values. The mean value has several. proper-  !

ties which maka'it suitable for use in the calculational phase of a ,

problem. For example, means will propagate through the Boolean algebra calculation-requi_ red to combine "a group of sequences" to determine the final probability (see Section G.2). Medians cannot, in general, bb used in this calculational phase. They can be multiplied (AND gates) if the distribution is known to be log-normal, but they canno,t be added(ORgates).

Also, mean values provide more infonnation than do median values about the effect of extreme values which may be present in a ' skewed dis-

• tribution(such as hypothesized nuclear power plant risk curves).

The ultimate use of the failure rate, however, may be in a value-impact analysis. In such an analysis, where consequences asso-ciated with failures are combined with the probabilities, the. distribu-

tion may be. skewed. In such cases (where a value-impact analysis is involved), it appears to make more sense to use a mean value as the

^

parameter representing central tendency.

i p Median ,

l

'The median value has properties which also make it desirable, ,

as,noted in the matched quotations below:

c " the median of ten is an appropriate measure of central tendency

..for random variables that are not symetrically distributed (G-1). *

...particularly if it 1: desired to eliminate the effect of~

E extreme values.(G-2).

sO g ,

G-2 Rev. 5, 9/82 i-

_ . . , . . . . , . . _ , , . - , _ . . ,. ., ._m..; _ ..._4,. . . . _,,_. -

9' t

1 ,

/

V( 3- Despite the equal usefulness of both the mean and median when the distN bution 's known, criticisms are still'made against one or :Se other. It is argued by Kendall (G-6) that if only the median is used (dropping the context of the log-normal distribution and the 90% and 10%

. points), nuclear reactors would have the appearance of being safer than they really are. This is true, since_the "best estimate" sequence pro-bability estimates for each category are calculated as a median; if the -

mean is used to represent the sequence probabilities, the point estimate will appear higher (see Figure G.2). However,~this discussion' ignores-a point that is repeated several times in WASH-1400: "One cannot gen-erally use point values and treat them as being exact, since there will always be variabilities and uncertainties" (Ref. G-7). The method of analysis used requires that some fonn of distribution or spread be stated. Any statement of the result is incomplete if the associated uncertainty is not specified, i.e., as a variance.

It is believed that the use of either a mean or median for display purposes is technically correct aid can be justified. An es -

timate of the medians could be provided to display the results for consistency with WASH-1400. However, the median values could only be estimated, based upon calculations using the mean values, and assumira a distribution for the final calculations using the mean values, and assuming a distribution for the final sequence values.

It cannot be overenphasized that the real inportance of any cont-i parison of sequence probabilities lies in the conparison of the total uncertainty range established in WASH-1400 versus the range estab-lished in the Limerick study, and not in a conparison of the central tendency or best estimate values. Median values for the Limerick analysis were not generated.

t

. G.2 PROPAGATION OF MEAN VALUES THROUGH A B0OLEAN ALGEBRAIC EXPRESSION (i.e. , Fault Tree)~

e a.

The following section describes the mathematical basis for the p propagation of mean values through a fault tree, assuming that all basic

~ C/

i G-5 Rev. 5, 9/82 4

- - ., , _ - _ . . .~. . , , , ,-

'S

/^\

V_ input components are independent. Many computer codes, such as WAMBAM, will propagate any set of pointwise input values to generate a point estimate of the top gate. Here it is shown that if these input values are means, then the output for the tcp event will be a mean value.

-In the following discuss' ion it will be useful to adopt the following notation' (G-8):

1. P(A) = the probability of event A occurring. This has a value between zero and one. P(A) will be considered as an " uncertainty variable" (see Appendix F) which has the same properties as a random variable.

2. For convenience let X = P(A) and Y = P(B). X and Y will be treated as though they are random variables with 0 5 x, y < l.

l 3. X and Y have probability density functions g(x) and h(y)

[ respectively with the following properties:

a) g(x) > 0, 0 < x < 1 a') h(y)> 0, 0< y < 1 b) /[ g(x)dx = 1 b') fo 2

h(y)dy = 1 b

l c) P(a<X<b) -fa g(x)dx c') P(a<Y<b) = /,b h(y)dy.

4. X and Y% ave a joint probability density function f(x,y) ' '

such that:

a) f(x,y)> 0, 0 $ x,y 5 1 b) / f(x,y)dxdy = 1 l

o c) P(X,Y) c S) = /s / f(x,y)d$dy.

5. Two events are independent if, and only if, P(A and B) = l P'T) . (P(B). Two random variables are independent if, "

ano only if, f(x,y) = g(x)h(y) where:

g(x) = fo f(x,y)dy marginal distri'bution of X l

h(y) = fo f(x,y)dx marginal distribution of Y.

2

6. The mean of a random variable X is defined as fo 2

The mean of a function of two random variables A(X,Y) is defined as fo fo A(x,y)f(x,y)dxdy. i l -

b.A. '

P G-6 Rev. 5, 9/82 L' _ - _ - - - - _ - _ _ _

H - 87 CALCULATION OF Ta, Pa, Ma, Pw, (Portion of Subroutine PRESS)

! f~

(

P , AP , AM , T v v v ao i f My = My + AMv C mT +C mT '

Ta = PV V V Pa a ao Cm +C m pv v pa a m

P =

aaa P =

"v v a aa V va V P =P +P a na va if

A No O N N /'.ar- w V Yes y AP = P -P -P + Go to P calculation a w av g P P ~

1. " #8 AP = AP x , AP = AP x

, na P va Pa AP V AP V AM aa = RT *M va = RT aa va %/ AM RT - , 3p _ aa w.w .. w V y w AP A = AP + AP + AP aa va w S/ P =P + (1 - A)AP w 1 w w l p P =P + AP a w aw - m =m - Amaa(1 - A) a a "y " "y - Amy ,(1 - A) > Go to Pg calculation . Fig. 4-6 (Continued) ' _.. . . . - - - - - - - . . ~ . . . _ . _ . . _ , . _ _ . - . - . H - 88 results are' illustrated in Fig. 4-3 for the combined relationship between bs I the reactor vessel pressure, pedestal pressure, drywell pressure andLwet-well pressure as a function of time. These calculations were carried out for a superheat in the melt (temperature above melting temperature) of 49 100 C and a final vessel breach diameter of 0.3 meters',-which resulted' from the ablation calculation for the flow of degraded core material through the initial breach of a control rod drive penetration. As illus-trated, the maximum pressure within the drywell at the time of equilibra-tion between the reactor vessel and the drywell itself is approximately 0.63 MPa with the wetwell pressure being approximately 0.56 MPa. This pressurization of the drywell occars over a time frame of approximately 200 seconds which is longer that the time required for spreading of the molten degraded core material on the diaphragm floor. Thus, while the <"'s - fled of the high pressure gas may act to accelerate the distribution of f 1 rhe moiten material within the drywell, the distribution of the material would have occurred in essentially the same time frame, to approximately the same locations, even in the absence of the high velocity gas. Given this distribution of the material on the drywell floor, the next features to be addressed are the time frame for developing a path for material discharged from the drywell directly into the wetwell, and 'the corresponding cooling behavior of the material retained on the dia-R. e - phragm floor. H. Summary . In considering the sequence of events following the postulated ves-sel failure for these hypothetical accident conditions, the following con-7-~ clusions can be made: .N., ' Rev .5, 9/82 + t i.v. - .-- .-. , ,, _ _- , _ . ,- .. ._ , H - 89 i i h 3 1. While ex-vessel steam explosions could occur, the amount of material ) j involved would be quite limited and the major influence of such events would be in the distribution of the material throughout the drywell and wetwell regions.

2. The accumulation of material within the control rod drive room would occur over a time interval of 20 to 30 seconds and could accumulate to a depth of approximately 1 meter.

l

f. As the material accumulated within the control rod drive room, the potential for flow onto the diaphragm floor would be determined by the height of the accumulated pool and the calculations for the flow of this material out of the CRD room and around the floor of the dia-phragm show that this occurs in an interval of approximately 2 min-m

( ') utes. N__/ l

4. Estimates of the amount of material which could be entrained by the ,

blowdown of a high pressure steam / hydrogen mixture show that.an up-per bound on this material would be approximatsly 15% of that accumu-lated within the CRD room. This material would be dispersed through- j out the drywell and some of it could potentially be deposited in the wetwell. > l

5. Calculations of the integrated behavior show that the pressure with-

) in the drywell immediately following the postulated vessel failure - reaches a maxinum of approximately 0.63 MPa when the drywell and re-ja actor vessel pre'asur,es have equilibrated. This is for a transient ., in which the pressare at the postulated vessel failure was 7 MPa di (m) , (nominal operating pressure of the boiling water reactor), wliich pro- . Rev. 5, 9/82 _ _ _ . _ _ _ _ _ . _ _ _ _ - _ _ _ _ _ _ . . _ _ _ _..m .. _ _- - , . . - . _ _... - -.. .~ . . - .. .. - .. .- .. . ... . G H'- 90 = vides an. upper bound on this containment pressurization as a result f. 4 , e D of the vessel failure. 6 .' The onset of vessel failure does not provide an overpressurization of the primary containment and the time response for pressurization ~ 'of the wetwell is slow compared to the pressure rise rate within the !: i drywell. i- , i i 1 j - i: 1. I i b G A / I I l 'O - ~ Rev. 5, 9/82' d h ..__________.--____-.2. - . _ . , _ . , _ . , - -