ML20028G402
| ML20028G402 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 02/07/1983 |
| From: | Weatherwax R PUBLIC INTEREST RESEARCH GROUP, NEW YORK, UNION OF CONCERNED SCIENTISTS |
| To: | |
| Shared Package | |
| ML20028G401 | List: |
| References | |
| ISSUANCES-SP, NUDOCS 8302090279 | |
| Download: ML20028G402 (24) | |
Text
-
9 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD
)
In the Matter of
)
)
CONSOLIDATED EDISON COMPANY OF NEW YORK, INC.
)
Docket Nos. 50-247-SP (Indian Point Unit 2)
)
50-286-S P
)
POWER AUTHORITY OF THE STATE OF NEW YORK
)
7 February 1983 (Indian Point Unit 3)
)
)
b UCS/NYPIRG TESTIMONi* OF Robert K. WEATHERWAX ON THE INDIAN POINT PROBABILISTIC SAFETY STUDY Q.
Please state your name, your position, and your business address.
A.
My name is Robert K. Weatherwax.
I am Presider:*. of Sierra Energy and Risk Assessment Inc., located at 1100 Howe Ave., Sui te 459, Sacramento, California 95825 Q.
Have you prepared a statement of professional cualifications?
A.
I have prepared a statement of professional qu:.~;ifications which is attached to this testimony.
Q.
To which issues in this proceeding is your tes*,1 ony addressed?
A.
My testimony addresses the issues of assessing *.he risks posed by potentially serious accidents at Indian Point (IP) 2 ar.d 3 nuclear power 8302090279 830207 PDR ADOCK 05000247 T
plants.l Specifically, my testimony addresses the extensive probabilistic 2
risk assessment (PRA) recently undertaken for the IP plants.
This PRA is particularly important because the Indian Point plants have within 10, 30,
and 50-mile radii, the largest population densities surrounding any U.S. LWR's (Light Water Reactors).
Potential outcomes of these deliberations encompass plant closures, addition of safety equipment as retrofit, modification to existing operating schedules, and no change in the current plant design and operating procedures.
Q.
How do you plant to address the issue of assessing the risks within your testimony?
A.
My testimony will assess the credibility of the IPPSS.
I will present my own judgments on the Indian Point Probabilistic Safety Study (IPPSS) and I will review the critiques of the IPPSS p'rovided by by the Sandia National Laboratory (SNL) and NRC staff.
f Q.
Can you summarize briefly what you consider to be the principal-findings of the IPPSS?
A.
Yes. The IPPSS results indicate that (1) the expected frequencies of accidents that result in core melt are comparable for IP2 and IP3, and somewhat larger than estimated for the WASH 1400 PWR; (2) the contributions i
from external environments and internal failures are roughly comparable in frequency of meltdown and resulting societal risk;.and (3) the containments along with their evaluation procedures and features for 1 NRC Docket No. 50-247-SP and 50-286-SP, Memorandum and Order, April 23, 1982 2 Indian Point Probabilistic Safety Study, PASNY and Consolidated Edison Company of New York, Inc., Vol. 1-12, 1982
___ attenuating radionuclide releases provide the key defenses to unacceptably high societal risk from these plants.
Q.
What conclusions do the IPPSS authors draw concerning the reliability of their estimates for risks from the Indian Point plants?
A.
Based upon the discussion found in Section 0.20.1 (et seq.) the IPPSS authors clearly feel that they have addressed the question of completeness.
Through their "other" category "the study team feels that the uncertainty bounds and final curves include a reasonable and determinable contribution from the 'other' category."1 Thus, the authors do not claim that they have included a statistically valid estimate of physical uncertainty associated with the IP plants. With that assessment I concur. The IPPSS appears to have systematically striven to accommodate completeness as well as could be expected by the most competent analysts, but it could not attain completeness due to generic methodological limitations.
Q.
Based on your analysis, do you agree with the IPPSS conclusions?
A.
Based upon my own review of IPPSS, the SNL evaluation of IPPSS, and testimony and deposition by licensed representatives, SNL personnel and NRC staff, it is clear to me that substantial controversy surrounds the completeness and the accuracy of this PRA.
Questions still remain regarding the many sophisticated procedures utilized in the report.
In addition, even when the concerns on specific applications are resolved, there will remain the 1 IPPSS 0-134.
question of how to utilize the PRA results and what credence to pay them. As I will indicate in my testimony below. I feel sufficient questions remain in the most advanced application of PRA so that no results can be viewed as "actuarily" sound and when faced with the need to determine societal risk, PRA results cannot be blindly followed. Rather, they should be utilized and recognized for what they are: the best modeling derived estimates of risk, but far from absolutely acccurate or verifiable.
I i
Q.
How do you plan to structure your testimony?
A.
In the remainder of my testimony I will discuss the generic problems associated with PRAs, to which IPPSS also falls victim.
I will also discuss problems apparently introduced in the IPPSS study; analytical elements, sensitivity cases, and documentation not included in it and needed before an adequate review can be made. And lastly, I will present some recommendations
(
for further actions.
l l
Q.
You will begin, then, with a discussion of generic limitations and problems with PRAs?
A.
Yes.
In this part of my testimony, I will describe problems endemic to l
PRAs and provide examples of them in the IPPSS.
No priority among these problems is implied by the order in which I discuss them.
A.
Common Mode Failures and Completeness he authors of the IPPSS heavily emphasize throughout the report their extensive efforts to achieve completeness in their identification of initiating events and safety system failure modes. Rese efforts are no doubt sincere and certainly laudatory but as recognized in the IPPSS "some causes of
} failure may have been omitted."I In fact, numerous unlikely causes of core disruptive events must have been omitted to permit analysis completion as with any other PRA.
Such omissions are assumed to be of very low probability and may not impact greatly the projected frequency of meltdown.
However, due to the inability to establish completeness, there may well be very unlikely and probably heretofore unobserved causes of failure that can trigger both core damage and concomitantly exacerbate the population risk due to the ensuing radioactive release. The IPPSS identifies an internal equipment failure cause of core melt (i.e., interfacing systems LOCA) which is predicted to be several orders of magnitude less likely to occur than are the more likely minimal cutsets identified in the analysis. Yet this accident would result in the largest contribution to prompt fatalities due to its undermining of containment integrity (i.e., release 2).
Likewise, the severe weather and earthquake initiating events may well disrupt civilian communications and evacuation procedures as well as the core.
This tie-in was not reflected in the IPPSS, nor was the SNL-identified common mode failure featuring steam generator tube rupture accompanied by relief valve failure.
B.
Sabotage PRAS do not deal with sabotage; and the civilian risk associated with sabotage at a nuclear plant, to my knowledge, has never been credibly estimated. We can say with certainty that inclusion of sabotage can only increase societal risk.
And if we assume that the siting of the IP plants does not make them less likely sabotage targets than the average plant I PSS, Pg. 1 3-3
. )
(indeed, IP's higher risk siting and media assessability may well make the Indian Point plants more attractise targets for both saboteurs and PRA analysts), then this risk is greater for these plants than for most others in the country.
C.
Willful Violation of NRC Operation Rules PRA methodology assumes that the NRC rules regarding safe operations of each plant will be observed.
No account is taken for willful violation of rules by the operators.
Unfortunately, ample incentive exists for the operators and their staffs to keep a plant on line even if, for example, the minimum NRC delineated level of availability is not present in the plant safety equipment. The incentive to remain operating is particularly strong in the case of Indian Point. Iower New York state is an oi]/ gas burning region for electricity generation, particularly when the IP plants are unavailable; thus when the approximately 10 mill /kWh variable cost power from an IP plant l
is of necessity replaced by 50 mill /kWh oil-fired generation the cost differential is on the order of $160,000/ day.
This revenue differential is substantially more than exists for the Zion plant, for example, due to the excess capacity of nuclear and coal plants in the Commonwealth Edison region.
Possibly, historical NRC records of fines and violations could be used to quantify the contribution to risk associated with willful violatons. However, such an approach is not addressed in the PRA Procedures Guide and was not apparently done in the IPPSS and would omit any instances where the plant was detected operating while in violation of NRC rules.
1 $30 barrel 10,000 Btu
$.002
$ 05/4Wh x
x
+
=
barrel oil 6.2x10" Btu kWh kWh
1 -
D. Equipment Aging and Pressurized Thermal Shock As in other PRAs, equipment aging effects were not considered in the IPPSS, and constant exponentially distributed failure rates were used throughout. As acknowledged in the SNL review and as is commonly recognized in the reliability profession, aging and wearout are substantial problems that unavoidably must be faced with all types of equipment.
This is particularly true for equipment found in nuclear power plants which have, in general, not been constructed pursuant to specifications that impose verified mean-time-before or between-failure performance requirements upon each equipment producer.
Pressurized thermal shock causing rupture of the pressure vessel is one example of the aging problem that was excluded from the analysis.
E. Severe Operating Environment Accelerated Failure No provision is made to account for the accelerated rate of failure that is observed during the more extreme operating environment experienced during projected reactor operations.
In Department of Defense reliabilty studies, it is standard practice to apply an environmental or "k" factor to the assumed I
exponential part failure rate to account for increased failures of equipment observed during utilization in severe environments.
Accelerated failure is most common with mechanical and electro-mechanical parts.
These k factors are applied even though each part was designed for operation in the stringent environment in which it is being used.
Possibly the SNL personnel were contemplating such considerations when they suggested that the operability of the containment spray and fan cooler systems be ignored following a core meltdown. While an effectiv :ly infinite k factor, as implied by the SNL suggestion, or even a k factor of 1000 as is used for peak dynamic pressure regimes during missile launches, may be too high for this Indian Point application, it is nearly universal that
substantial acceleration of failure rates arise from equipment operation in extreme environments including containment spray and cooling equipment.
F. Design Adequacy PRA's assume that the engineers have designed the components to work at all times while under their spectrum of design. environments.
Un fortunately,
not all combinations of potential design environments and resultant failure modes can ever be anticipated during the components's initial design phase.
This necessitates extensive testing of designs.
Realistic testing of safety equipment performance following LOCA's or anticipated transients without SCRAM have not been done for full-sized reactors, and the assumed operability of LWR safety equipment is based upon modeling extrapolations from substantially smaller scale testing, such as at the Loss of Fluid Test Facility (LOFT).
Evacuation planning and implementation is also fraught with uncertainty since such actions can never be fully tested except during a real emergency.
G. Perfect Design Implementation Assumed No accounting is made of intentional or accidental blunders that occur during the construction and quality control activities on site.
The absence of "rebar" in the Trojan control room and the confusion betweeen pipe reinforcement locations for the Diablo Canyon reactors bear strong witness to the existence of such deviations from plants to "as built" units. Assuming perfect design implementation does not factor in the risk of such errors, i
H. Unquantified Uncertaianty For the above and other reasons, it is not possible to accurately scope the uncertainty in the risk computed by a PRA.
The most that can be
_9_---
accomplished is to accurately superposition the uncertaintites assigned in the PRA model, as distinct from the uncertainties in actual risk posed by the plant. Even the ability to calculate this much less societally important measure is doubtful in view of the fact that the tails of the lognormal failure probabilities haie to be arbitrarily fixed both for equipment failure and human error. When compared with the IPPSS, the SNL report demonstrates the variations in assumptions as to the human error rates as well as the range of uncertainty found between different sets of competent professionals.
Q.
Does this complete your discussion of generic problems with PRAs?
A.
Yes, it does.
Q.
And you will now address problems of the IPPSS specifically?
A.
Yes. In this section of my testimony, I will describe elements in the IPPSS that appear erroneous or unduly simplified and are correctable within the PRA methodological structure.
Sources of Risk A careful review of the results of either the IP2 or IP3 risk assessment highlights the fact that though the initiating events (IE's) are quite conservatively high, and though the probabilities of core damage or melt are consistent with observed reality, the overall risk levels are remarkably low.
This fact can be more clearly seen on the following table.
This table presents the expected results for the IP2 plant as predicted by the IPPSS with some inconsequential rounding.
The left-hand column lists each initiating event identified, and Column 1 lists each IE's predicted annual frequency of 1 These results do not reflect very recent modifications to the IPPSS risk levels arising from the SNL review.
But, these changes will not modify the point made herein.
_10-IPPSS PREDICTIONS OF 2:1 CASUALTY FROM INTERNAL EQUIPMENT FAILURE FOR IP2 (1)
(2)
(3)
(4)
(5)
(6)
INITIATING IE CORE
' CORE FATALI-FATALI-Eb 1 EVENTS FREQUENCY MELT MELT TIES TIES FATALITY GIVEN(1)
GIVEN (1) GIVEN (3)
- 1. Large LOCA 1 95-3 8.2-3 1.6-5 1.6-6
- 2. 0-4 3 2-9
- 2. Medium LOCA 1.95-3 6.7-3 1.3-5 1.5-6 2.2-4 2.9-9
- 3. Small LOCA 1.85-3 8 9-4 1.6-6 9.0-6 1.0-2 1.5-8
- 4. Steam Gen.
1.74-2 5.2-6 1.4-7 8.0-7 1.6-1 2.2-8 Tube Rupture
- 5. Steam Break 1.95-3 1.0-4 2.0-7 2.7-8 2.6-4 5.2-11 Inside Containment
- 6. Steam Break 1.95-3 1.0-4 2.0-7 2.7-8 2.6-4 5.2-11 Outside Containment
- 7. Loss of 6.7-0 1.3-7 8.7-7 3 9-9 3.0-2 2.6-8 Main Feedwater
- 8. Loss of one 1.75-0 1.2-7 1.5-7 3.9-9 3 0-2 2.6-8 MSIV
- 9. Loss of RCS 1.36-1 2.2-7 3 0-8 3.5-9 1.6-2 4.8-10 Flow
- 10. Core Power 2.21-2 8.5-14 1.9-15 1.4-15 1.6-2 3.0-17 Excursion 11.C Turbine 7.32-0 2.4-7
- 1. 8-6 4.0-9 1.6-2 2.9-8 Trip 11.B Turbine 1.82-1 1.8-4 3.3-5 5.5-6 3.0-2 1.0-6 Trip, Loss of Offsite Power 11.A Turbine 1.95-3 3 1-5 6.0-8 1.8-6 5.8-2 3.5-9 l
Trip, Loss of Service Water 12.A Reactor 6.84-0 1.2-7 8.2-7 3 9-9 3.3-2 2.7-8 Trip 12.B Reactor 1.95-3 1.9-5 3.7-8 7.7-9 4.1-4 1.5-11 Trip, Loss of Component Cooling V. Interfacing 4.58-7 1.0 4.6-7 1.0 1.0 4.6-7 System LOCA TOTAL St6 23 N/A 9.0-5 N/A N/A 1.5-6 Assumed to come only from releases Z-1, 2 and/or 2RW
1 ---
occurrence. Columns 2 and 3 list the predictability of a core disruption accident due to each initiating event, and Column 6 lists the expected frequency of acute fatalities or cancer deaths due to IE.
Column numbers (2) and (4) give probability of core melt and overall fatality risk given that the IE event occurs. Naturally, (1)x(2) = (3) and (1)x(4) = (3)x(5)=6.
The reactor cooling system containment failure, (IEV), is of a different nature than are the other internal failure events, each of which requires containment failure.
The magnitude of the IE probabilities range from reasonable in the case of nuclear and turbine trips, to conservatively high in the case of large and medium LOCAs.
Further, the likelihood of core melt at
-5 9x10 / year is consistent with experience and not subject to credible increase by more than a factor of 10.
Thus, these probabilities appear " reasonable".
However, the other columns convey conditional probabilities that are substantially smaller in general, particulary those in Column (4) which estimate the conditional probability of one or more casualities given an IE.
These numbers appear very low and therefore questionable.
For instance, one might find a taker who would bet that in 630,000 large LOCAs, only one would end in a fatality.
However, it seems extraordinarily unlikely in the case of human affairs to experience only one fatality scenario in ten trillion cases of core power excursion.
These extremely low mean probabilities of greater than or less than one fatality given each IE are mainly attributable to:
- 1) The assumption of independence of equipment from IEs, pa'rticularly the core and containment cooling equipment,
- 2) The relatively mild core state predicted after core melt,
- 3) The extremely high projected failure point for the containment overpressure, and
f 4) The projected early warning and extremely efficient evacuation procedures assumed.
All of these factors share the common property of not being statistically subject to verification. In fact, as we shall discuss subsequently, much additional analysis and verification is required before these expected values are used (if they are correct) and their appropriate uncertainy factors established.
Of particular methodological concern to me is the substantially reduced role played by fault tree analysis (FTA) in the IPPSS. FTA was developed to model rare events in complex systems in which common modes were considered likely but undetectable by standard reliabilty techniques.
The WASH-1400 work relied substantially upon event trees as well, but had a substantial FTA effort and actually quantified the different modes of failure by restructuring the top level event trees with each events' subordinate fault trees combined with a single fault tree, thereby assuring through proper FTA quantification, that no common modes were overlooked.
FTA is complex and labor intensive, and presents substantial computer quantification problems. Thus, it is not surprising that the IPPSS has tended to try and accentuate event trees and relegate fault trees to a substantially reduced role.
However, since event trees do not protect against common modes it is wise to use the cause tables and very careful cross checking by analysts to preclude overlooking of common modes and important yet rare minimal cutsets.
As is seen by the interfacing systems LOCA, common mode failure can be both very unlikely and very severe.
I must suspect that the very low likelihood of a casualty scenario following an IE is due to the overlooked failure combination, that though rare and almost certainly unexperienced to date, may pose the greater risk.
- 2. Containment Failure Modes Following Core Melt As concisely stated in the IPPSS, "one of the most important results of the (IPPSS) is that for the vast majority of core melt sequences containment integrity is maintained.
This is a distinct difference from the RSS."
We agree it is a very significant difference, and a substantial contributor to the resulting very small estimated risk from IP meltdown.
This conclusion is critically dependent upon:
- 1) Assumed operability of containment spray and fan-cooling systems,
- 2) An extremely " tight" assumed containment overpressure failure mode distribution, and
- 3) The projected limited energy releases and absence of steam explosion behavior The SNL review in its final version equivocated as to whether or not any credit should be given to the benefits from continuing operation of the containment spray and fan-cooling systems after a core melt. The IPPSS assumes that the operability of these devices is not affected by the core-melt-caused high pressure and high temperature environment. 'This assumption results in substantial reduction in the source term magnitudes and substantially reduced containment failure probability. Unless substantial, realistic proof testing is done, it is very unconservative to presume no acceleration of failure probability for those pieces of containment equipment.
The IPPSS includes an analysis by United Engineers and Constructors (UE&C) that projects ultimate containment overpressure failure at 140 PSIA.
This estimate is coupled to an apparent deposition-revealed guesstimate that suggests the probability of containment failure is nil at less than or equal i
to 130 PSIA.
In addition, it is assumed that for all late releases the overpressure results merely in cracks in the containment though which
l I
i 14-radionuclides must be emitted as opposed to more gaping containment failures that afford larger releases.
This treatment substantially reduces risks and is questionable for at least all of the following reasons:
- 1) The containment is never tested above 60 PSIA so projections above that are speculative at best,
- 2) The UE&C hand analysis used to derive the 140 PSIA ultimate failure pressure was justified by invocation of unspecified previous analyses used *o reconcile the hand calculations to unspecified computer codes of unvalidated accuracy,
- 3) It has been a common practice in aerospace reliability theory for at least 15 years to presume a normally distributed structural strength distribtion and in many applications a normally distributed load term also; then the engineer calculates the superposition integrative stress and strain as the probability of failure.
- 4) Eliminating the possibility of blowouts through penetration or other weak spots in the containment for late overpressure is very non. conservative.
- 4. Use of Reduced Source *ierms l
The IPPSS used a Discrete Proba'oility Distribution (DPD) for each source term in order to try and capture the uncertainty in repults extending all the f
I way from core melt to casualties. This approach seems unreasonably simplistic and would necessitate ' substantial justificatien.
As it stands, it is questionable because it 1) appears to completely ignore uncertainty in core phenomenology, containment response and dose response, and 2) reduces-the l
1 Weatherwax, R.K., " System Safety Analyses FB-111" (Weapon System 140A)
Boeing Report D2AGM 13030-4, July d,1968.
l 3
I
,-e,-
--m n
n.
..gs
,-ve~,,,
n e
. expected source terms for the only important releases Z-1, Z-1Q, 2, and 2RW by about 305, 30%, 355, and 225 respectively below those used in WASH-1400. l
- 5. Fire Modeling The IPPSS authors are to be congratulated for their effort in this normally avoided area of PRA.
However, the fire modeling, along with the PRAs on externalities, share the onus of newness and the need for seasoning and peer reivew.
There exist some particularly weak aspects of the fire analysis.
- 1) The assumption that actual combustion of cables is required to interrupt the function is to ignore the hot gas mode of damage as is properly identifed by SNL,
- 2) No consideration is given to the impact of control room fire, and 2
- 3) According to IPPSS, fires were only considered in areas where they could trigger an IE, whereas IEs are so common that higher risk could well result from the comoination of an IE and a separate fire undermining selected safety or containment systems.
- 6. Evacuation Modeling Weaknesses The approach and implementation of the evacuation methods seem flawed in the following ways:
- 1) Efficiency of evacuation is not coupled to occurrence of external core melt initiators including earthquake, flooding, or wind even though the common mode aspects are quite obvious.
- 2) The evacuation notification time is assumed to be eight hours prior to a 2RW release with no uncertainty present in that time estimate, even 1 For Z-1 and Z-1Q releases five particle fractions are reduced separately by a factor of 2 (affects TE and R0 only) 2 IPPSS, page 0-136
though the reluctance of the operator to convey such bad news would be extreme, and at that time, all hope would be lost; therefore, hesitancy would be nearly certain, and
- 3) Assuming that 90% of the people beyond 10 miles would seek and find shelter in basements seems highly optimistic for a bombing raid let alone a reactor meltdown.
- 7. Other SNL Comments Regarding Completeness I will not bother to delineate the additional perceptive criticisms of the IPPSS found in the SNL report, but reflection of these comments seems essential in a re-estimation of risk associated with Indian Point.
Q.
Does this complete your testimony on problems specific to the IPPSS?
A.
Yes it does.
Q.
And you will now discuss additional documentational requirements and sensitivity analyses?
3 A.
Ye s.
- 1. Review of Earlier IPPSS Drafts Review of earlier drafts of the IPPSS report could shed substantial light on the sensitivity of the overall risk to other, possibly more conservative, assumptions previously used. Since there is some suggestion in sworn testimony of an unusual policy by the licencees of destroying all earlier versions of the report, there exists the heightened possibility of particularly interesting reading in the earlier drafts.
I
-17=
- 2. Lognormal Tails In most instances the IPPSS authors took the commendable position that the WASH-1400 95/55 distributional limits would be conservatively placed at 80/205 instead, thereby extending the tails and increasing the expected frequency.
Unfortunately, they failed to follow their own approach for at least a few crucial components including equipment contributing to interfacing systems LOCA and pipe rupture.
Substantial analytical and/or data base justification of these deviations is appropriate since these modifications have a signficant effect on overall risk.
- 3. Discrete Probability Distribution (DPD) Procedure Including Condensation My personal experience supported that of an SNL reviewer in finding it nearly impossible to reproduce the results of the algebraic operations on the discrete approximations to continuous functions.
Further, I feel that the condensation procedure outlined in Section 0 could have the effect of understating the range of uncertainty carried forward in the integration of the minimal cutsets.
Thus, further examples of the DPD procedure, particularly ones using condensation would be appropriate.
- 4. Pressure Vessel Based upon a physical model, the IPPSS staff eliminated the WASH-1400 scenario featuring pressure vessel explosion followed by rupture of the containment. The sensitivity of overall risk due to this currently excluded failure mode would provide guidance as to whether an augmented review of the l
physical modeling leading to the exclusion of pressure vessel rupture is l
appropriate.
l l
l l
9
- 5. Baysian Probability Methods Possibly the Baysian method is both " oversold" and not substantially influential as to overall risk as is asserted by an SNL reviewer. Others, including myself, are not so comfortable with the Baysian approach. The rerunning of the models without the Baysian posterior modifications to failure rates would settle the argument and determine whether the Baysian approach does indeed substantially impact the final results.
- 6. Lognormal Distribution The IPPSS authors indicate in their methodology section that they truncate the lognormal distribution in applications where the broadness of the component failure spread will lead to a nontrivial probability for a frequency greater than unity.
This is an entirely appropriate action from a mathematical perspective, and, as in the circumstances surrounding certain elements of the ATWS scenario in WASH-1400, has substantial impact by increasing the mean failure frequency due to the weight of the distribution beyond unity. Though mathematically correct, this procedure highlights the arbitrary aspects of fitting the probability-of-frequency data to a lognormal i
distribution, particularly where physically nonsensical results, such as frequencies greater than unity result.
1 The IPPSS documentation further suggests that truncation below unity is done also.I Documentation of these instances is needed along with justification for each time the action was taken. This would illuminate the truncation-process, improperly-depressed mean values and high-end uncertainty.
1 "We truncate the lognormal distribution at (failure frequencies] equal one
{
or less."
IPPSS Sec. 0-112.
. h
~
- 7. Dilemma The authors say in cases of operator dilemma they choose probabilities for each of the alternative indicated actions.
A description of the methodology used to select probabilities for each action and the event tree impacts of the dilemma instances is certainly appropriate.
- 8. Main Steam Isolation Valve (MSIV) Failure Rate Apparently based upon the engineering judgment of the IPPSS authors, the probability of each MSIV failing in a closed position was reduced below that which would obtain if data from IP2 and IP3 were used.
If true, then analytical justification is required in instances wherein the basic Baysian method is not applied, as in this instance.
In my view, the information outlined above is necessary for a thorough evaluation of IPPSS.
Q.
Does this complete your testimony on documentation requirements and sensitivity analysis?
A.
Yes it does.
I would now like to present some recommendations.
- 1. Peer Group Review l
l The plant analysis portions of IPPSS represents an impressive effort.
IPPSS appears to represent substantial methodological progress in several l
l l
important areas of PRA, particularly externalities modeling and uncertainty l
accommodation.
Its methods are being applied to various other PWR's and thus l
its influence is substantial.
It merits a more extensive review than that provided by a 20-40 months SNL effort, (depending upon how much Zion plant review credit is included.)
Further, the scope of the review should be v.
~~,._.y...
_ 7.
(,, -... -
3
-.,,.;, y y
broadened to include the post meltdown areas of such crucial importance to IP risk. And the study should be deepened to permit " hands on" use of the IPPSS codes, or similar ones if the IPPSS codes are proprietary, so as to confirm their accuracy.
- 2. Use of IPPSS Even after all questions of uncertainty, common mode failures, containment overpressure, and other problem areas are addressed by meticulous review and further analysis, the IPPSS should not be used as determinative of IP's absolute risk levels.
That is a judgment more properly left to the NRC Commissioners. However, after it has been subjected to adequate peer review and any further revisions, the IPPSS should be used to investigate cost effective design and operational modifications to improve safety including vented containment release.
/
4
1 s
UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD
)
In the matter of
)
)
CONSOLIDATED EDISON COMPANY OF NEW YORK, INC.
)
Docket Nos.
(Indian Point, Unit No. 2)
)
50-247 SP
)
50-286 SP PCWER AUTHORITY OF THE STATE OF NEW YORK
)
(Indian Point, Unit No. 3)
)
)
8 February 1983 CERTIFICATE OF SERVICE I hereby certify that single copien of "UCS/NYPIRG TESTIMONY OF ROBERT K. WEATHERWAX ON THE INDIAN POINT PROBABILISTIC SAFETY STUDY" and "UCS/NYPIRG TESTIMONY OF STEVEN C.
SHOLLY ON THE CONSEQUENCES OF ACCIDENTS AT INDIAN POINT (COMMISSION QUESTION ONE AND BOARD QUESTION 1.1) " were served upon the following by deposit in the U.S. mail, first class postage prepaid, this 8th day of February 1983.
/
Steven C. Sholly Nunzio Palladino, Chairman Victor Gilinsky, Commissioner U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commission Washington, D.C.
20555 Washington, D.C.
20555 John Ahearne, Commissioner Thomas Roberts, Commissioner I
U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commission Washington, D.C.
20555 Washington, D.C.
20555 James Asselstine, Commissioner James P. Gleason, Esq., Chairman U.S. Nuclear Regulatory Commission Adminstrative Judge Washington, D.C.
20555 Atomic Safety and Licensing Board 513 Gilmoure Drive Silver Spring, MD 20901
F' e
, Dr. Oscar H. Paris Mr. Frederick J. Shon Adminstrative Judge Administrative Judge Atomic Safety and Licensing Board Atomic Safety and Licensing Board U.S. Nuclear Regulatory Commission U.S. Nuclear Regulatory Commission Washington, D.C.
20555 Washington, D.C.
20555 Ruthanne G. Miller, Esq.
Docketing and Service Section Atomic Safety and Licensing Board Office of the Secretary U.S. Nuclear Regulatory Commmission U.S. Nuclear Regulatory Commission Washington, D.C.
20555 Washington, D.C.
20555 Janice E. Moore, Esq.
Atomic Safety and Licensing Board Panel Donald F. Hassell, Esq.
U.S. Nuclear Regulatory Commission Henry J. McGurren, Esq.
Washington, D.C.
20555 Office of the Executive Legal Director Atomic Safety and Licensing Appeal U.S. Nuclear Regulatory Commission Board Panel Washington, D.C.
20555 U.S. Nuclear Regulatory Commission Washington, D.C.
20555 o
Brent L. Brandenburg, Esq.
Assistant General Counsel Paul F. Colarulli, Esq.
Consolidated Edison Company of Joseph J. Levin, Jr., Esq.
New York, Inc.
Pamela S. Horowitz, Esq.
4 Irving Place Charles Morgan, Jr., Esq.
New York, NY 10003 Morgan Associates, Chartered 1899 L Street, N.W.
Charles M. Pratt, Esq.
Washington, D.C.
20036 Stephen L. Baum, Esq.
Power Authority of the State Mayor George V. Begany of New York Village of Buchanan 10 Columbus Circle 236 Tate Avenue New York, NY 10019 Buchanan, NY 10511 Jonathon D. Feinberg Stanley B. Klimberg, Esq.
New York State Public Service General Counsel Commission New York State Energy Office Three Empire State Plaza 2 Rockefeller State Plaza l
Albany, NY 12223 Albany, NY 12223 Charles J. Maikish, Esq.
Marc L. Parris, Esq.
l Litigation Division Eric Thorsen, Esq.
l The Port Authority of New County Attorney York and New Jersey County of Rockland One World Trade Center 11 New Hempstead Road New York, NY 10048 New City, NY 10956 Honorable Ruth Messinger Alfred B. Del Bello Member of the Council of the Westchester County Executive City of New York Laurie Vetere, Esq.
District #4 148 Martine Avenue City Hall White Plains, NY 10601 New York, NY 10007 l
T I Ezra I. Bialik, Esq.
Andrew S. Roffe, Esq.
Steve Leipsiz, Esq.
New York State Assembly Environmental Protection Bureau Albany, NY 12248 New York State Attorney General's Office Honorable Richard L. Brodsky Two World Trade Center Member of the County Legislature New York, NY 10047 Westchester County County Office Building Donald Davidoff, Director White Plains, NY 10601 New York State Radiological Emergency Preparedness Group Spence W. Perry, Esq.
Empire State Plaza Office of General Counsel Tower Building, Room 1750 Federal Emergency Management Agency Albany, NY 12237 500 C Street, S.W.
Washington, D.C.
20472 David H. Pikus, Esq.
Richard F. Czaja, Esq.
Stewart M. Glass, Esq.
Shea and Gould Regional Counsel 330 Madison Avenue Federal Emergency Management Agency New York, NI 10017 Room 1349 Spokesperson 26 Federal Plaza Phyllis Rodriguez, /\\
New York, NY 10278 Parents Concerned About Indian Point P. O. Box 125 Charles A. Scheiner, Co-Chairperson Croton-on-Hudson, NY 10520 Westchester People's Action Coalition, Inc.
Richard M. Hartzman, Esq.
P.O. Box 488 Lorna Salzman White Plains, NY 10602 Friends of the Earth, Inc.
208 West 13th Street Alan Latman, Esq.
New York, NY 10011 44 Sunset Drive Croton-on-Hudson, NY 10520 Judith Kessler, Coordinator Rockland Citizens for Safe Energy Zipporah S. Fleisher 300 New Hempstead Road West Branch Conservation Association New City, NY 10956 443 Buena Vista Road New City, f.Y 10956 Renee Schwartz, Esq.
Paul Chessin, Esq.
Melvin Goldberg, Staff Attorney Laurens R. Schwartz, Esq.
Joan Holt, Project Director Margaret Oppel, Esq.
New York Pub.ic Interest Botein, Hays, Sklar & Hertzberg Research Group, Inc.
l 200 Park Avenue 9 Murray Street New York, NY 10166 New York, NY 10007 David B. Duboff Craig Kaplan, Esq.
Westchester People's Action National Emergency Civil Coalition, Inc.
Liberties Committee 255 Grove Street 175 Fifth Avenue, Suite 712 White Plains, NY 10601 New York, NY 10010
Ms. Amanda Potterfield, Esq.
Jeffrey M. Blum Esq.
Johnston & George, Attys-at-Law New York University Law School 528 Iowa Avenue 423 Vanderbilt Hall Iowa City, IA 52240 40 Washington Square South New York, NY 10012 Joan Miles Indian Point Coordinator Greater New York Council on Energy New York City Audubon Society c/o Dean R. Corren. Director 71 West 23rd Street, Suite 1828 New York University New York, NY 10010 26 Stuyvesant Street New York, NY 10003 Ellyn R. Weiss, Esq.
William S. Jordan, III, Esq.
Steven C. Sholly Harmon and Weiss Union of Concerned Scientists 1725 I Street, N.W., Suite 506 1346 Connecticut Avenue, N.W., Suite 1101 Wasinington, D.C.
20006 Washington, D.C.
20036 6
l l
_