ML20052A004
| ML20052A004 | |
| Person / Time | |
|---|---|
| Site: | Zion File:ZionSolutions icon.png |
| Issue date: | 01/28/1982 |
| From: | Schott G LOS ALAMOS NATIONAL LABORATORY |
| To: | Okrent D Advisory Committee on Reactor Safeguards |
| Shared Package | |
| ML20052A001 | List: |
| References | |
| ACRS-CT-1410A, NUDOCS 8204260425 | |
| Download: ML20052A004 (6) | |
Text
'.
University of California r-pg a
\\___ \\ 'f D LOS ALAMOS SCIENTIFIC LABORATO Post Ofhee Sex 16S3 Los Alam:5. New MexI:~o'8f6G W/MA inreplyreferto: Explosives Technology 2 F:.' 3 l9 ven step: 9 20 y '.'[ ?[."
January 28, 1982 w i..
Dr. David Okrent, Chairman Reliability and Probability Assessment Subcommittee Advisory Committee on, Reactor Safeguards U. S.
Nuclear Regulatory Commission 5532 Boelter Hall University of California at Los Angeles Los Angeles, CA 50024
Dear Dr. Okrent:
This letter reports my cbservations and opinions pertaining to' assessment of flammable hydrogen hazard in the utility's Prob-abilistic Risk Analysis (PRA) of the Zion nuclear power plant.
These are submitted in response to' instructions and request for consultants' aid in conducting an ACRS. review of the Zion PRA, which were directed to me by your subcommittee's staff engineer, J. M. Gricsmeyer, by a letter dated December 18, 1981'.
My most specific and affirmative findings relate to the mechanistic treatment of hydrogen accumulation and burning in the Zion containment atmosphere.
This treatment is found mainly in Section 4 of the PRA, under the ti tle "Transien t Analysis. "
Im-h6rtant explanatory material occurs in Section II.5 of the Sum-mary Report, most particularly on pages II.5-18 and 19.
The im-portant analytical tool used here is Westinghouse's COCOCLASS9 computer code for. evaluating containment conditions unde ~r the in-fluences of hydrogen combustion phenomena and heat sinks.
For pe r s pec tive, I note that an analogous code to CCCOCLASS9 is CLASIX.
The latter has been widely used and exposed to ACRS scrutiny in the recent modeling of deliberate ignition as a means
~
l s,. ~ ~.... u,...v. w e..,. n.,,,
8204260425-
{
Dr. Okrent January 28, 1982 of protecting the pressure-suppressing containment designs (Ice Condensers and Mark III) against otherwise large, flammable accu-mulations of hydrogen accidentally formed by core degradation.
Both these codes are used in conjunction with Batte11c's MARCH code, which models hydrogen generation and release.
Validation studies of CLASIX have cited COCOCLASS9 as a standard for compar-ison.
From the details ascribed to COCOCLASS 9 in the Zion pRA, I conclude that its assumptipns and procedures are generally sound and that its application to postulated degraded core accidents in a large, dry containment should be expected to produce satisfac-
~
torily conservative results.
In particular, the Zion containment is treated as a single volume with continuously homogenized dis-persal of hydrogen.
This leads to maximum accumulation of hydro-gen" prior.to burning, which is then volumetrically complete over an assumed time of 20 seconds.
Convection of unburned gases in the processes of dispersal and deflagrative burning appear not to be treated.
I believe that omitting these effects which CLASIX includes is appropr'iate for the large, dry containment at Zion, whereas their inclusion would be necessary in a compartmented containment design.
, Reckoning of flammability of the variety of hydrogen-air-steam mixtures is done' internally by the COCOCLASS9 code.
The algorithm used appears to be elaborate (Append,ix 4.4.4 is devoted to it), but it embodies a simple and empirically based principle for apprcximate quantitative discrimination betwebn regimes of flame behavior.
The flammability criterion that is. applied takes the form of a unique minimum value of the adiabatic flame temper-ature.
That is, flammability is measured by the ratio of the la-tent heat of complete combustion to the specific heat of the same gas mixture, with allowance for variation of the sensible heat initially present.
The repeatedly stated value of this flame e
e
i Dr. Okrent January 28, 1982 temperature criterion, 710 C = 1310 F, is evidently associ-ated with'8.5% H in dry (or nearly dry, the distinction is in-2 significant) air at ordinary room temperature, about 70 F.
These values coincide closely with the inflection in the plot of measured pressure rise versus per cent hydrogen as. reported by A.
L. Furno, et al. (Safety Research Center, U.S. Bureau.of Mines, Pittsburgh, PenWsylvania,13th Combustion Symposium Pro-
^
ceedings, 1971, pg. 593) for a large sphere of stagnant, uniform-0 ly mixed gases at 18 C (64.4 F) mildly ignite.d at the cen-ter.
The 710 C criterion thus represents the boundar~y between regimes of omnidirectional propagat;.a of flame and substantially complete consumption of combustibles in more highly flammable gase's and of gravitationally restricted occurrence of flame under less flammable conditions.
These regimes are denoted, re s pec-tiv'ely, ap those of "significant pressure rise" (if adiabatic and unvented, by a factor of at least four) and of " benign burning."
In COCOCLASS9, this flammability boundary is taken to pre-cent 50% probability of inflammation over 30 seconds of time.
A distribution of probabilities is then assumed, which increases to unity or decreases to insignificance over displacements of 100 F above or below the nominal boundary temperature.
I esti-mate,that these displacements correspond to H2 percentage dis-4 picc'ements of about 0.*7t.
Thus, 9.2% H2 in dry cir, orsome-what more or less than this at an elevated containment tempera-ture with non-negligible humidity, is calculated as assuredly fl amm a ble, and7.8%Hj is. correspondingly computed by COCO LASS 9 to be nonflammable.
Without seeing or doing.a calcu-lation myself, I do not know how closely this formul'ation of the fimraability boundary agrees with the measurements at 300 F for
.high steam concentrations that are included in the triangular composition diagram presented by shapiro and Moffette l
(WAPD-SC-5 4 5, Fi g. 3).
However, the allowances for steam and/or 9
~
i
4 Dr. Okrent January 28, 1982 initially elevated temperature are assuredly qualitatively cor-rect.
Thus, I judge that the COCOCLASS9 formulation is at least
'as satisf actory as the CLASIX approach of parametrically assign-ing the % H at the flammability boundary at 8, 10, or 12%, and 2
handling the inerting effect of excess steam independently.
Thus, in the Zion PRA, temporary i'ne,rting by steam is fac-tored into the mechanistic analysis, hydrogen is considered to accumulate up to the largesl amounts, which, by being uniformly dispersed and stagnant, might escape combusti6n, and finally, as-suredly flammable accumulations of hydrogen (or equivalent compo-sitions including some carbon monoxide as fuel) are reckoned to burn until the fuel (or oxygen) in the mixture is exhausted.
In determining the pressure excursion of a burn, credit is taken for real-time heat transfer between the burned gases and active or pas's'ive heat sinks in accordance with the defined accident sce-nario. It is only the numerical application of the flammability
' criterion to the unburned gas that makes hypothetical use of adiabatic flame considerations.
This is all as it should be.
The molecules experiencing a flame f ront have only milliseconds in which to burn or extinguish; the burned gases have, on the average, about ten seconds over which to lose heat before the last of such gases are formed and the peak pressure develops.
' Having begun with'a matter that I understand well enough to trust, I turn -now to one that I do not. Much of Section 4.3 of the Zion PRA is devoted to mechanistic treatment of some 50.
'" bounding cases" that are discussed alongside the "most probable cases" for the six sequence classes.
I judge these. bounding to be. satisfactorily conservative, provided I suppose that cases they are f actored into the probabilistic treatment with an aggre-gate weight that is non-negligible.
Indeed, some of these bound-ing cases do lead to expected containment failure, and a good many others might be expected to produce temporary leakage from the containment while the pressure is above the design value,
Dr. Okrent January 28, 1982 even though no irreversible rupturing of containment is likely.
What I find to be ambiguously presented, and to warrant further scrutiny, is the relative weighting given to these bounding cases in comparison with the most probable ones.
As symptoms of this ambiguity, I quote Section 4.0.1, third paragraph, final sentence (with underlining added for emphasis):
"For each of the sequence classes, the principle (sic) parameters used and some alternative cases investigated are disc'ussed." Section 4. 3, final sentence, is similarly vague in stating, "These were us'ed to bound the phenomena that might occur within the containment and to aid in assigning probabilities to the unlikely paths in the containment event tree."
From what I have seen, I simply cannot tell what there statements mean.
Are these bounding cases a smoke screen?.
The third matter I raise for attention is the apparent disparity *between seemingly major findings of the Zion PRA and of the NRC Staff's Preliminary Report, Volume 1, NUREG-0850, pub-lished November, 1981.
In the former, hydrogen burning is a con-spicuous contributor to peak containment pressures only in the vast majority of core degradation sequences that do not, result in containment failure.
Sec tion 3. 3. 6 of NUREG-0850, however, finds that gamma-mode failure of containment (Combustible Gas Burn /-
Detonation, summarily, ascribed to hydrogen but, in. fact:, in-cluding possible carbon monoxide as well) is of the highest re-cognized degree of concern among a set of modes that includes the delta-1 and delta-2 modes, with lesser degress of concern.
In
'the Zion PRA, these latter failure modes are fo un'd to pose the l
l S
O e
s a
-4 Dr. Okrent January 28, 1982 highest likelihood of containment failure.
The basis of,this reversal of the order of seriousness between these two non-neglibile fai. lure modes should be scrutinized further, and th'e
.results reconciled if possible.
Sincerely, f
s a Garr L.
Schott I
GLS:mg
~
cc:
Dr. J. M. Griesmeyer, ACRS/NRC.-
J.
C. M a r k, T-DO, M S 210 J. E. Boudreau, EP/NP, MS 671 L.
D. -G ri tzo, M-DO, MS 915 G.
L. Schott
- M-1 File CPRO'(2) 9 0
O e
9 0
e t
e i
l r
n,.
4 1
Sandia National Laboratories Attuguercue. New Venice 871ES s
February 15, 1982 Professor. David Okrent 5532 Boelter Hall University of California i
at Los Angeles School of Engineering and Applied Sciences Los Angeles, California
$0024
Dear Professor Okrent:
In resp 6nse to Mr. Griestneyer 's letter of December 18, 1981, I've enclosed a brief review and personal observation about
~
the Zion PRA.
I hope it provides food for thought.
' Sincerely, h&
Ym
.Q (I dack W. Hi ckb.a n, Supervisor
~
Nuclear Fuel Cycle Systems Safety Division 4412 JWH:4412:ep Enclosures Copy to:
BNL A.
J.
Buslik USNRC J. M.
Griesmeyer l
USNRC F.
H.'Rowsome USNRC, A.
C. Thadani 1223 R.
G.
Easterling
.4410 D.
J.
McCloskey 4412 D.
D.
Carlson 4412 G. J.
Kolb E
G.
f f
)" '
,.+' " ()7 p
z+
Sandia Laboratories date February 9, 1982 m #ca w ve.ieo Lwef mC'e ca M.**n a to-J. W. Hickman, 4412 1
'/5h $
from.
R. G. Easterling,1223 subject.
Coments on the Zion InferTacing LOCA Analysis The interfacing LOCA (pp.' 1.3-72,77) is dominated, by PLG's (Pickard, Lowe, and Garrick) estimates, by the rupture of two motor-operated valves in the RHR suction path. The scenario is that first the upstream and then the downstream valves rupture some time during a one year period between refueling outages.
Let A denote the hourly rate of valve rupture (assumed to be constant). Suppose further that both valves are subject to the same rupture rate. Then the scenario probability is Q = 1 - e-AT(1 + AT),
where T = 8760 hrs. (This is a ' basic reliability result for the case of standby redundancy.) For small AT, Q - ( AT)2/2.
PLG erroneously took Q = (AT)2/4.
Since our purpose here is to explore their use of WASH-1400 information, for the sake of comparison we will use their expression (which,' incidentally, is not in the report but was elicited in conversations with the authors).
In PLG's Bayesian analysis A is assigned a prior di tribution. That l
distribution is lognormal with a mean of 2.66 x 10-0 and a variance of 4.32 x 10-15 The basis for this distribution is not given, bu$ it turns out that if one takes the WASH-1400 bounds of 10-9 to 10-' on the hourly rate of valve rupture and equates them to the 5th and 95th percentiles of a lognormal distribution, this mean and variance result.
.This prior distribution is not modified by Zion data., in contrast to PLG's usual procedures, so it is the basis for their subsequent results.
I Given Q = ( AT)2/4, and the assuned distribution of A, the mean of Q is 2
2 mean(Q) = (T /4) maan (A )
= (T /4) [mean2( A) + var (A)]
2 y
= 9.7 x 10-8 (Another scenario considered is a leak of the upstream valve followed by rupture of the downstream valve.to the above yields PLG's estim Adding its for the probability t
J. W. Hickman, 4412 February 9,1932 of the interfacing LOCA, p.1.3-77).
The second equality above is a standard relationship among moments of a random variable and is not a consequence of the lognormality assumption.
PLG's stated methodology was to treat WASH-1400 bounds as the 20th and 80th percentiles of a lognormal distribution Suppose we do this here.
Then the prior mean of A would be 4.28 x 10-I and the variance of X would be 3.35 x 10-10 Substituting these values into the above expression for mean (Q) yields
' mean(Q) = 6.5 x 10-3, Part of a surprising five orders'of magnitude larger tha'n PLG's result.
this difference is due to approrfmating 1 - exp(-AT/2) by AT/2. We did a 5000-run Mgnte Carlo and estimated the mean of (1 - exp(-AT/2))2 to be.3.9 x 10-4, so there are stil) four orders of magnitude attributable to the seemingly innocent change from 5/95 bounds to 20/80. This change results from the change in var (A) and the way in which var (A) contributes to PLG's mean value, their point estimate.
Let,v and o denote the mean and standard deviation of In(A). For FLG's In both casei u = in(10-8). _g the 20/80 assumptions yield's e =
assumptions e = 1.40.
Usin18,42. The mean of a legnormal distribution is exp(v + c /2). By increasing a from 1.40 to 2.74, the mean is increased z
by a factor of 16. The variance of a lognormal distribution is exp(2u + c )(exp(e ) -1).
Here the increase in a results in increasing 2
2 the variance by a factor or 77,719.
In the above calculations for mean(Q),
var (A) overshadows mean2(A) and thus th.e large' difference is obtained.
The figure below shows the two lognormal distributions, just discussed, drawn on arithmetic scale.
Innocent-looking normal distributons on log-scale transform to greatly skewed distributions on arithmetic scale.
Whether they accurately depict anybody's state of knowledge is open to question. From this figure, the large increase in the variance of A' using the 20/80 assumptions, rather than 5/95, is not.at all apparent. However, the 20% of the distribution beyond A = 10-7 in the former case versus the 5% in the latter exerts considerable leverage.
This analysis shows the extreme sensitivity of PLG's results to their assuned prior distributions (and the advisability of having data) and also illustrates an unrecognized, though conservative, flaw in their Bayesian To see this, suppose one began with a noninformative prior nethodol ogy.
distribution for A, then modified it by data consisting of f failures in.
Then the posterior distribution of A would have (approximately)
T hours.
2 a mean of A' = f/T and a variance of A*/T.
The posterior mean of A would be naan(A ) = A*2 + A*/T 2
4 e
- v..
o.
h J. W. Hickman, 4412 February 9, 1982
~
If we regard this as a point estimator of 12 and take its expectation with respect -to the sampling distribution of f, the result is E [mean(A )3, x? + 2A/T.
2
^
f s
2 Thus, as an(estinator of 1, the posterior nean is positively biased c' k and can be-.seriqusly so, as the above results illustrate. Alternative estimators of A4 based on non-Bayesian methods wguld be A*2, if one wanted a maxinum 1itelihood estimator, or A*' - A*/T, if one wanted an unbiased estimator (though this can turn out negative, so it night not be-used in such cases).
i s a
h t
RGE :1223:k, p' t
.N s s
c
% M
,4S%!"5EptW<$tNeasvJEr1Fingap-+va,nso wnt ev-*mN., g i., -
.=
I.,,7 k
~
M.,l____m w. -_44p L As.4----
e
.l
\\
.c
~
~
f,$
's.
~ -
s y,.
g e
,./
e
$88 kh
- %=
g EC/6 f **I+'!"b ', [Nd /#ev/p 4 4/ h 1 - J.
- J S J.7 T) ' e/$r
/I M* #WE'd
- es
+
se nr.,
p[ g,,f u ' fresl./ of h r C,f yro*
e N
s 4'\\
.s
%. gp hs Tyfob, Y * /* *'U b j Gb) N
- *
- N *0
- G Slf f /**** ** ' *** J S,5
.f f
%...W y l / ;/y of
- 7. G w re> <l./ of h i /.V !/o
, y v'
j \\,
4 f"
^
3 4
s i
l %-
n.
n
?
A
../
Q
- '\\,'
+
a l
k I'g i
t s
w a
E 1
g e
a 4
.s,i e
s
.s w
gs
^-
f, %
e.
n
~
+
l
's
~
.s h
~;
.~
P
/
s w
i.
~
s^.
g g, j \\
'^
'pf
~.3
- f'#
..d. g\\
e
(
b, s
, *,e P
, _'p p wg.
r s
~
pj'
/
A
~
' w:
4 Review of Zion'Probabilistic Safety Study
....:...ir::c Systems Analysis r
- -- - s
-s u
--.. ~., c : -=:
I e
Jack W. Eickman
- r -..:
, Nuclear Fuel Cycle Safety Research Departrnent Sandia National Laboratories February 15, 1982 1
4 6
4 4
9 po kk0
~
4 Introduction (few days) review of the Zion This report summarizes a briefThe review was carried out for Probabilistic Safety Study.(1)
The review focuses on comparing the methodology and results of that part of the analysis which leads to a prediction the ACRS.
of the core melt f requency with other published or ongoing PRAs.
Containment response and consequence analysis were not reviewed.
the methods and results of this study are To provide perspective, studies o# PWR power plants; contrasted with several NRC sponsored (Oconee)(3}, and IREP namely, WASH-1400 (Surry)(2), RSSMAP but (Arkansas Nuclear One).
The latter ctudy is unpublished, nearing completion.
The Zion study had a ' broader scope than the NRC-sponsored The addition in any previous PRAs.
studies or, for that matter, to this review was the more detailed modeling scope most important Thus,,the most of external events, particularly seismic events.is between the nonexternal-meaningful comparison with other PRAsfrequency and the methods and s event core melt in the regulatory This may also be of some significance ing to it.
since nonexternal-event core melt calculations may see in the near term than
- arena, in the regulatory environment greater use other parts of the PRA in general.
of this review are Section 0, The sections covered as part Probabilistic Rir@ Assessment Methodology (Modules 2, Volume 2);
Section 1, Plant Analysis (Module 3, Volume 2).
The review consisted of reading the appropriate sections and drawing from previous meetings with the representatives of Common-Lowe and Garrick, and discussing the wealth Edison and Pickard, study with colleagues having PRA expertise in human reliability,The views data analysis, and systems analysis.
are my personal views only, however,
~
t General Comments l
Based on meetings with representatives of Commonwealth Edison Lowe and Garrick both in the cours'e of reviewing the i
Zion study and interfacing with them in preparing the Industry /
and Pickard, my impression is that this study has I
NRC PRi Procedures Guide, been carried out'by competent people and has made significant methodological contributions to PRA in the area of external events.
Despite its many thousand pages, however, the document does notThe met in scrutability.
represent an advancementand the many apparent numerical errors makes th i
d to follow and raises questions about the quality assurance pract ce on the study.
In general, their estimated core melt frequency does frequencies seen in previous differ significantly from core melt section makes some of not The next studies or other current studies.
these comparisons.
0
[
{ i
4 Comparisons with Other Studies Core Melt Frequencies For comparison, the estimated core melt frequencies from several studies are given below.
For convenience, I've arrived at these by merely summing the dominant core melt sequence frequencies be they advertized as means, medians, or point estimates.
It is recognized that means and medians may vary by a factor of two or so.
5 4.4(10 5)(mean))
mean Zion Zion (exclu_ ding seismic) 3.8(1g-)((medianorpointestimate)
Surry (WASH-1400)
,- 8(10-5))
6(10-
=
Oconee (RSSMAP)
(point estimate)
ANO (IREP) 9(10-5)* (point estimate )
As can be seen by this comparison, the Zion re'sults are at the I
lower end, but not markedly different from results of these other studies.
Dominant Accident Initiators (excluding seismic)
It is also interesting to compare which initiating events lead to accidents either dominatirg risk or dominating the core For purposes of comparing the systems analysis, melt frequency.
I've left out the seismic initiator which was only included in the Zion study.
/
f o
o 4=e 4
f.'y
!'c &?
r*R ~ f e
N g
ff g?sg a
I ri : y e
5/
.h c fJ V
e,
'g '
oc$0 e
c0 c?
eie 5 $
E e
e, l
JLc' E.Cff v' l-r
- icn T
- X X
X X' x Scrry,(VASH-1400)
X X
X X
X X
X X
X Ocence (RSSMAP)
X X
X X
XX X
X X
X g
ANO (IREP) x x.x x x X1x x
. X Initiators identified Initiators Identi-important to risk.
fled as important as to core relt probability As can be seen on the right of.the above table, the initiators identified in the Zion study which are important to the frequency
' Draft Results
u a
of core melt are not appreciably different from those identified in other studies.
Two noteworthy differences are the absence from the' Zion list of " Loss of Offsite Power (LOP) transients" and the " transients without loss of MFW. "
The latter does not show up since the main feedwater (MFW) was assumed in.the Zion study to be lost, a somewhat conservative assumption.
The lower importance of the LOP transient, no doubt, stems from the lower LOP frequency predicted at Zion.
They have never had an LOP and have high redundancy in the grid system.
Thus, the differences in initiator importance in this case can be found rooted in conservative assumptions or apparent plant / site differences rather than method-ology.
The LOP initiated sequence has been questioned, however, and will be discussed at greater length later.
For the left side of the above table, only two nonceismic initiators are identified as important; the interfacing system and LOP transient.
The explanation for this appears to
- LOCA, stem not from a system analysis methodology difference,. but from differences in containment response.
Since the study indicates there exists a low probability of containment failure unless both containment sprays and fans are lost, the only important initiators are those which bypass containment (interfacing system LOCA) or ones which represent a common cause failure between the fans and
- Thus, even though LOP transients are predicted to be very sprays.
infrequently, they give rise to station blackout which is a common -
cause failure set for both sprays and fans and thus become important to risk.
The point here is that the differences in what initiators to risk between the Zion study and other studies is are important so much a product of system differences or system analysis not differences as it is a product of the significantly different containment response predicted in the study.
is of interest to continue the comparison into lower sub-It sets of the analysis.
The next chart compares, as an example, auxiliary feedwater system (AFWS) failure probabilities for loss of MFW transients between the four studies.
~
Plant AFWS Failure Probability 4.6(10-6) (as best we can tell)
Zion Surry (WASH-1400) 4(10-5)4) 2.4(10-Oconee (RSSMAP)
ANO (IREP) 3(10-4)
The numbers above include operator recovery of the AFWS to that extent operator recovery was considered in the specific studies.
It is at this level we begin to see significantNUREG-0611(4),
differences in results frcm what one might expect.
which included a comparison of all AFWSs of Westinghouse-designed.
identified Zion as having an unavailability operating plants, this principally stemmed from As I recall, higher than Surry.
the Zion plant having a single manual valve at the condensate The "lon study stcrage tank which is shared by all three trains.
actimates that failure of this value.can be detected, diagnosed
)
\\
(failure andmanuallyswitchej)overwithaprobabilityof.993 probability of 7x10-At first glance, this appears to be a large amount of credit for this complex a series of human actions.
Apparently, this stems from the fact that the pumps will trip off under these conditions, thus will not be damaged and therefore significant time is available for recovery.
Several factors may influence behavior, however, including diagnosis time, the undesirability of valving the backup lake water into the steam generator, or the potential for trying " feed and bleed." Ihis more favorable analysis in the Zion study than in NUREG-0611 may warrant further investigation. ' -
To compare the treatmedt of human reliability in general, a comparison is made of human failure to switch from injection to recirculation during a large LOCA:
Failure Probability Zion 0.004 Surry (RSS) 0.003 Oconce,(RSSMAP)
'O.003 ANO (IREP) 0.001 These numbers are, of course, highly dependent upon plant design, particularly the switch-over time available after the initial alarm.
The numbers derived in the Zion study are con-sistent with predictions in other studies, although, again, slightly on the lower side.
Methodolocy The following are general observations about the motheds being used in the systems analysis:
Initiating Events Zionstudyteamappearstohavetrehtedtheidentifica-The tion of initiating events quite thoroughly and more formally than the other studies.
Their identification and categorization of initiating events should prove quite useful in future studies.
System Modeling As with other studies, the Zion study team turned to event trees and' fault trees for cataloguing accident sequences.
How-their use of event trees and fault trees is somewhat
- ever, different.
They have chosen to carry several support system faults (e.g., AC bus failures) in-the event tree.
Such an approach uc,ually limitssthe number of support system failure states that can be explicitly modeled, and which ones are modeled is decided by the analyst based usually on a probabilistic argument.
As you
~
may recall, a.similar thing was done in WASH-1400 with electric.
power failure. 'My personal experience is that when such simpli-fications are made, the models then have limited utility for future studies and thus this is not usually the method-of-choice.
Nevertheless, if competently applied, this method should yield
/
valid results.
Similarly, the fault tree analysis took on an abbreviated character.
As I understand it, the front line systems were redrawn in block diagram form, and simplified fault trees depicting the most important cut sets were then drawn.
The system cut sets were derived, apparently by hand, for each sequence reflecting the dependencies for that.s,equence.
The sequence cut sets were
~
apparently not derived.
A similar technique was used in an earlier RSSMAP study (which I was involved in), and if competently, carried out, it should yield valid results.
Our experience has been, however, that such abbreviated models result in analysis that are diffi-cult to follow and, therefore, difficult to use and draw insights from.
Component Data The interpretation and use of component data has emerged as a contro.versial issue.
Some have argued that the Zion report reflects a new philosophy that must be evaluated carefully.
Others have argued that this "new philosophy" yields similar results:
therefore, is unimportant.
Easterling has written a few words on the treatment of the V sequence, a dominant sequence in the Zion and many other studies, and has shown that the sequence mean changes about four orders of magnitude depending on whether the WASH-1400 parameter bounds are used as 5th and 95th percentiles, or as 20th and 80th percentiles, a choice that seems'to be highly subjective if not somewhat arbitrary.
If this choice is arbitrary i
i and if the Easterling calculations do reflect what was done in the Zion study (it is not always easy to tell), then one must conclude that the methodology allows one to get any answers one wishes within the four orders of magnitude.
If that in true, then the meaningfulness of the results must be judged. highly suspect.
I believe this is an area that should be further investigated.
With Bob's permission, I have attached a memorandum with his findings.
Sequence Quantification The matrix a.lgebra formalization of quantification is new to PRA and novel.
It appears to be a useful contribution to PRA.
initia
- Although it does allow one to determine the most important e
-ting events, we,have found it difficult to use it, or anything else,
in the study, to find the most important sequence cut sets.
- Thus, 2
, hat fault events cause a sequence to be important is difficult to g l f
w ascertain.
e -
\\
~
4 I
I Seismic Analysis I have not delved into the seismic analysis in detail.
I do know that this is pioneering work in PRA.
The question of the acceptability of this methodology has been discussed at length within the development effort of the PRA Procedures Guide, particu-larly the IEEE/NRC Review Conference on the PRA Procedures Guide.
It was the purpose of that conference to bring the PRA com= unity together to judge acceptability of the methods covered in the Guide, and my reading of their conclusions is that this method of evaluating ~
seismic risk'is being 'j'udged acceptable at' least by the majority of'the practitionerc.
I would have to admit, of course, that this methodology has not yet see'n the test of time.
~
Human Reliability The human reliability methods appear to follow NUREG/CR-1278(5) and I believe represents the state-of-the-art.
Swain has indicated that most of the estimates of human error probabilities appear to be relatively conservative.(6)
Some exceptions to this are noted later.
Specific Seenarios Three accident sequences have come to my attention which ultimately will need clarification.
f g t has'to do with an ATWS sequence and has been reported The by Buslik.
As he points out, the human error probability of 0.004 was used that the operator would fail to open a necessary block valve in the 2 to 10 minutes time required following an ATWS. ;This, as he points out, appears extremely optimistic.
Buslik also suggests that a human error probability of 0.64 to 0.95 may be more appropriate in which case the ATWS/ core melt sequence becomes 5.8x10-5 and therefore an important sequence.
I would agree with Buslik's conclusion that this should be reviewed more closely.
The second area which has been pointed out by Kolb(8) is the credit given for spray injection given a core melt due to recircula-tion failure following a LOCA.
This credit is given on the basis l
that 100,000 gallons of water will remain in the Refueling Water Storage Tank (RWST)whenswitchovertorecirculationfrominjectionk occurs.
This injection water provides another source of water to A
insure spray operation and reduce the probability of containment lk failure.
The procedures we have indicate that an injection spray
!I pump will be left on tntil the RWST is emptied and we have found no LOCA procedural steps for refilling the RWST.
Thus, the RWST may be depleted of water when needed during core melt for containment pr'ote ction.
This could impact,significantly the plant damage bin probabilities and perhaps the risk.
Again, this has the character of providing credit for operator action beyond that which is typical of PRAs and therefore may de' serve further review.
- 7..
e
d
=
The third accident sequence, Station Blackout due to a LOP transient, is a dominant contributor to risk.
The calculation is or has been pursued by Buslik, Easterling, and Kolb.
The questions arising have to do with several f actors,-including the treatment of the increasing trend in the unavailability of the turbine driven pump, the appropriateness of the LOP transient frequency prediction, and the onsite emergency power restoration assumptions,.
Depending on the way some of these are treated, the mean for this sequence could be approaching two orders of magnitude higher than the study predicts.
This also deserves further investigation.
Summary In summary, I believe (admittedly based on a somewhat limited review) that the systems analysis portion of the study appears to be an adequate methodology carried out by competent practitioners.
Perhaps the methodology requiring the closest further scrutiny is that used to arrive at the component failure distributions.
Three sequences, the ATWS/ core melt, the LOCA sequence with late melt, and station blackout, should receive further study.
Obviously, a final opinion en the appropriateness of the study methods will require a more detailed review than completed to date.
I believe, however, the i.nterpretation of the data in this study should be carefully considered.
For example, had the WASH-1400 data bounds, used to calculate the V sequence (see Easterling's paper attached), been interpreted as 20th and 80th percentile values as was done throughout most of the rest of the.I study, many insights advertised as resulting from this study I
would have been dif ferent.
The mean core melt frequency would I
not have been less than 10~4, seismic would not have dominated risk, and the sequences dominating core melt frequency would have also dominated risk.
These seem like significant insights to rest on an interpretation of the appropriate use of the WASH-1400 bounds, an interpretation which appears to lie some-where between highly subjective and somewhat arbitrary.
e e
~B-
7
~
~
~
w a
p References
'(1)- Zion Probabilistic Safety Study; Commonwealth Edison Company of Chicago,-1981.
(2)
Reactor Safety Study, WASH-1400 (NUREG-75/014), USNRC, October.1975.
(3)
Reactor Safety Study Methodology Applications Program, Oconee.(3 PWR Power Plant, SAND 80-1897/2, NUREG/CR-1659, Vol. 2; Kolb, Hatch, May 1981 Generic Evaluation of-Feedwater. Transients and Small Break (4)
Loss-of-Coolant Accidents in Westinghouse-designed Operating Plants, NUREG-0611,,USNRC, January 1980 (5)
Handbook of. Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications; Swain, Guttman, NUREG/CR-12978, SAND 80-0200, March 1980.
(6)
A.
D. Swain, Sandia National Laboratories, personal communica-
- 'l tions.
(7)
Medorandum:
ENL Peer Review of the Zion Probabilistic Safety s
- Study, A.
J. Busiik to R.
A. Bari, 1/18/82.
(8)
G. J. Kolb, Sandia National Laboratories, personal communica-tion.
f
'k e
f i
[
i l.
g_
I
.