ML20064K051
| ML20064K051 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 10/31/1993 |
| From: | Tony Brown, Kmetyk L, Miller L SANDIA NATIONAL LABORATORIES |
| To: | NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| Shared Package | |
| ML20064K019 | List: |
| References | |
| CON-FIN-L-1679, RTR-NUREG-1489 NUDOCS 9403220207 | |
| Download: ML20064K051 (256) | |
Text
{{#Wiki_filter:m ' ' 1 a. 1 p
SUMMARY
REPORT OF: GRAND GULF LOW POWER AND SHUTDOWN ABRIDGED RISK' ANALYSIS
- i. POS 6: Early Refueling FINAL LETTER REPORT Thomas D. Brown 2 LeAnn A. Miller' Lubomyra N. Kmetyk'
.; 12nny N. Smith 2 Donnie W. Whitehead' John Darby' John Forester2 October 1993 Sandia National Laboratories Albuquerque, NM 87185 Operated for.the U.S. Department of Energy Contract DE-AC04-76DP00789 Prepared for Division of Safety Issue Resolution Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555 NRC FIN L1679 t
'Sandia National Laboratories 5
2 Science Application International Corporation
' Science & Engineering Associates, Inc.
9403220207 940309 PDR NUREG (fQq } 1489 C PDR 7
g . .. 4 CONTENTS
1.0 INTRODUCTION
...................................... I 1.1 Study Obiectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Scone of the Study . . . . ............................. I 1.3 M e th od s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.4 Limitations and Strengths of the Study . . . . . . . . . . . . . . . . . . . . . . 4 2.0 ACCIDENT PROGRESSION ANALYSIS . . . . . . . . . . . . . . . . . . . . . . . . 8 2.1 Anoroach ........................................ 8 2.2 POS 6 Plant Conficuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2.3 level 1 Seauence Description . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.3.1 Se.auence Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.3.2 Plant Damace State Description ..................... 11 2.4 Event Tree Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.0 SOURCE TERM ANALYSIS ............................... 20 3.1 Approach ....................................... 20 3.2 pescription of Parametric Model . . . ..................... 20 3.3 Re sults . . . . . . . . . . . . . . . . . . . . .................... 21 4.0 CONSEOUENCE ANALYSIS ................................. 24 l 4.1 Onsite Conseauences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ~ 24 4.1.1 Buildine Doses . . . ............................ 24 4.1.2 Parkine let Doses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 4.2 Offsire Consecuences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.0 INTEGRATED RESULTS CONDITIONAL ON CORE DAMAGE . . . . . . . . 34 6.0 INSIGHTS AND CONCLUSIONS .... ....................... 37-
7.0 REFERENCES
........................................ 40-I 1
el
y_. [f, FIGURES 1-1. Scope of abridged study .................................. 6 1-2. Summary of abridged methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . 7- j
'2.4-1. Grand Gulf POS 6 abridged accident progression event tree (APET)- ..... 19 4.1.1-1. Containment and auxiliary building dose rates for selected paths ........ 28 4.1.2-1. Parking Lot dose rates for .Ramsdell and Wilson / Regulatory Guide models for distances from 10 - 500 meters from the reactor: First Release Segment . . -32 ,
4.1.2-2. Parking Lot dose rates for Ramsdell and Wilson / Regulatory Guide'models for distances from 10 - 500 meters from the reactor: Second Release Segment 32 . 5-1. Grand Gulf POS 6 offsite consequences for LOSP and nonLOSP PDSs . . . . . 36 1 - 1 TABLES I 2.3-1 Grand Gulf LP&S POS 6 Initiating Events . . . . . . . . . . . . . . . . . . . . . . 11 2.3-2 Grand Gulf LP&S POS 6 Plant Damage State Attributes . . . . . . . . . . . . . . 12 2.4-1 Accident Progression Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 -1 3.3-1 Mean Source Terms for Accident Progression Paths (Total Release) ...... 23 4.1.1-1. Transit times through the contaimnent and auxihary I building for Grand Gulf POS 6. ............................ 25 ; 4.1.1-2. Grand Gulf POS 6 mean containment doses and dose rates. . . . . . . . . . . . . 26 4.1.1-3. Grand Gulf POS 6 mean auxiliary building doses and dose rates. ........ 27 j 4.1.2-1. Grand Gulf POS 6 mean doses and dose rates at 100 m based on the Ramsdell building wake effect model. . . . . . . . . . . . . . . . . . . . . . . . . . 29 i 4.1.2-2. Grand Gulf POS 6 mean doses and dose rates at 100 m l' based on the Wilson building wake effect model. ............ ..... 30 4.2-1 Grand Gulf POS 6 Offsite Mean Consequences ................... 33
)
l l gj e 1
)
i
.l 1
ii I i
, 4 , --
s i
-ACKNOWLEDGMENTS We wish to thank the many people who worked in various capacities to support this analysis:
Fred T. Harper (SNL) who provided many. helpful technical suggestions in the development and application of methods and who provided a much needed sanity check on the analysis and results; Jay Johnson (GRAM) who performed the MACCS calculations for the offsite consequences; David I. Chanin (Technadyne Engineering Consultants) who provided helpful - ideas for assessing onsite consequences; and Ann W. Shiver (SNL) who provided support in the data preparation for the uncertainty analysis. We would also like to thank Chris Ryder (NRC) for his program and management support and for his words that form the introduction of this report. Finally, we would like to thank the Source Term Advisory Group, which consisted of John E. Kelly (SNL), Hossein P. Nourbakhsh (BNL), Dana A. Powers (SNL), and Trevor Pratt (BNL), for their review of the source term analysis and their many helpful suggestions. iii
ACRONYMS AND INITIALISMS ADHR Alternate Decay Heat Removal System APET Accident Progression Event. Tree , BNL Brookhaven National Laboratory BWR Boiling Water Reactor CCI Core Concrete Interactions CDS Condensate System CF Containment Failure CNT Containment CRD Control Rod Drive System ECCS Emergency Core Cooling System FW Firewater System HIS Hydrogen Ignition System HPCS High Pressure Core Spray System HRA Human Reliability Analysis LHS Latin Hypercube Sample LOCA Loss of Coolant Accident LOSP Loss of Offsite Power LP&S Low Power and Shutdown NRC Nuclear Regulatory Commission PDS Plant Damage State POS Plant Operating State PRA Probabilistic Risk" Assessment PSW Plant Service Water PWR Pressurized Water Reactor : RFO Refueling Outage , RHR Residual Heat Removal System RPV Reactor Pressure Vessel SBGT Standby Gas Treatment System SBO Station Blackout SDC Shutdown Cooling System l SPC Suppression Pool Cooling System SPMU. Suppression Pool Makeup System SP.V Safety Relief Valve , l SSW Standby Service Water TAF Top of Active Fuel .; TBCW - Turbine Building Cooling Water j
.VB Vessel Breach
'l iv ll
1 I 1
1.0 INTRODUCTION
1.1 Study Obiectives H The Office of Nuclear Regulatory Research at the U. S. Nuclear Regulatory Conunission established programs to investigate postulated accidents during low power and shutdown (LP&S) operations of a BWR (Grand Gulf) and a PWR (Surry). One such program is a risk study of accident progressions and consequences. ; The objective of this study is to make a preliminary risk determination of the progressions (I2 vel 2 analysis) and the consequences (Level 3 analysis) of accidents during low power and shutdown operations in the Grand Gulf plant. The study was designed to obtain results for regulatory 1 decisions. This letter report documents the methods, findings, and implications of the study done under NRC FIN L1679. A sister study of the Surry plant is reported separately by the staff at Brookhaven National Laboratory (BNL) under NRC FIN L1680. s 1.2 Scone of the Study The abbreviated risk analysis took place from January through April 1992. The study has been referred to as an abridged risk analysis. The term abridged means that simple event trees (about nine top event questions) were developed and used with assumptions and other approximate methods to compute rough estimates. The term risk means conditional consequences (probability of the various events during the accident progressions multiplied by the i consequences), given that core damage has occurred. Traditional risk estimates, computed by . multiplying the conditional consequences and the frequency of the sequences, could not be made ; 1 at this time because the core damage frequencies have yet to be determined in companion Level 1 and HRA studies. Uncertainty has been taken into account in a manner consistent with the detail of the abridged study. j This study investigated the possible accident progressions and the associated consequences of a single plant operating state, POS 6, an early stage of refueling, where the reactor vessel head , is removed, the steam dryers and separators are removed, the drywell is open, and the -l containment is open. The sister study at BNL investigated mid-loop operation. The scope of both studies is illustrated in Figure 1-1. l j 13 Methodji l The abridged process of computing conditional consequences is shown in Figure 1-2. In l general, both the study reported here and the study done at BNL follow this scheme. Some : differences in the details of the procedure exist and are noted at the end of Section 1.3, The i process used here is an abbreviated form of the NUREG-1150 study [1]. j i 1 1 l 1
I 4
, 1 I
a Accident procressions
]
The calculations begin with the assumption that core damage has occurred. Given core' damage, the reasonable accident progressions are delineated with the accident progression event tree i (APET). Much of the delineation is based on information obtained from PRAs of full power operation, knowledge of severe accident phenomena, and deterministic calculations with codes used to compute source terms, such as MELCOR [2]. The likelihood of the various accident ! progressions is reflected vis-a-vis branch point probabilities. Branch point probabilities were assigned to reflect the likelihood of various pathways thought to exist. In large scale risk studies, the assignment can be done by groups of expens knowledgeable in severe accident issues. Here, because of resource limitations, most of the assignments were done by the project staff. The probabilities are not as rigorous as they could be but this is one of many limitations of the study to be discussed. Some lack of rigor in ; determining the probabilities is taken into account by repeating the calculations with other i possible probabilities; taken together, the repeated calculations constitute an uncenainty analysis. Through the uncertainty analysis, distributions, instead of point values, were assigned to selected branch points. The distributions are subjective but account for many possible values of the branch points. Point values are selected from the distributions with a form of Monte Carlo sampling known as Latin Hypercube Sampling (LHS) [3] After inaking sets ofinputs, each set, consisting of point values, is assigned to the branch points and multiplied through to the ends of the APET. The calculations are repeated using the sets of inputs, building a probability distribution at the end of each pathway. Source terms Having delineated accident progressions with the APET, the source terms of the progressions were calculated with a parametric code [4]. The parametric code is a collection of simple mass-balance equations designed to mimic detailed source term codes. The parametric approach is not meant to be a substitute for detailed, mechanistic computer simulations codes. Rather, it is a framework for integrating the results of these codes together with experimental results and expert judgment. The parametric code determines source terms, given the characteristics of the accident progression and other inputs (e.g., fraction of the inventory a) leaving the reactor vessel; b)' , involved in core concrete interactions; c) entering the containment). Because these .other L variables are imprecisely known, many reasonable values can be assigned to the inputs. As in the APET calculations, distributions are assigned to the variables and sampled with LHS to form many sets of input values for repeated calculations. The result is a distribution of source terms for each accident progression pathway. Because the estimation of the source terms is a critical component of this study, an internal advisory group, call the Source Term Advisory Group, was formed to support this study. The 2
'J members of the advisory group included: John E. Kelly (SNL), Hossein P. Nourbakhsh (BNL),
Dana A. Powers (SNL), and Trevor Pratt (BNL). The role of the Source Term Advisory Group was to 1) provide guidance on the identification of phenomerr: that may be important to the
; formation of the source term during these modes of operation, and 2) assess the adequacy, relative to the study's objectives and scope, of the assumptioits, methods and data used in this study. The results of the accident progression and source term analysis were presented to and discussed with the advisory group in two meetings during the course of this analysis.
Consecuences Three sets of radiological consequences were determined: building dose, onsite dose (so called parking lot dose), and offsite consequences. o Buildine dose was determined based on source terms derived from the parametric source term expressions. Doses in the containment and auxiliary building were estimated, o Parkinc lot dose was based on relative concentrations computed with the Ramsdell model [11], in which the release concentration is somewhat proportional to wind speed, and a combination of the Wilson model [12] and the model in Regulatory Guide 1.145 [13], in which the concentration is inversely proportional to wind speed. o Offsite consecuences were computed using the MACCS code [5,ti,7]. Uncettainty was not propagated through Ge consequence analysis as it was through the APET and the source term calculations. While a sample size of 100 was used in the onsite analysis to propagate accident progression and source term uncenainties, a reduced sample size of 12 was used in the determination of offsite consequences. Conditional offsite conseauences Conditional risk was computed by multiplying the offsite consequences by their associated accident probability that was determined with the APET. This product of probability and consequences was computed for each accident progression pathway. The products of the pathways were summed. This process was repeated for each of the few samples of the source terms. Then, high, medium, and low results were reported. Differences This study differs slightly from its sister program at BNL in three ways. (1) Here, one hundred : samples from the uncertainty distributions were propagated through the accident progression and
- source term analyses whereas, in the BNL study, two hundred samples were taken. (2) Here, twelve samples were propagated through the APET to offsite consequences whereas, in the BNL study, twenty samt es l from the source term distributions were used in consequence calculations and traced back through the APET for thc probabilities needed to compute conditional risk.
3
y (3) Here, doses in the containment and auxiliary building were calculated whereas, in the BNL study, these calculations were thought unnecessary since the releases were assumed to pass from the containment directly into the environment. 1.4 Limitations and Strennths of the Study In order to place the calculations in proper context, it is necessary to understand the strengths and limitations of the study, Limitations o The subject of the study is one POS, early refueling. This POS was selected for study , because it was identified in a preliminary level 1 study, known as a coarse' screening analysis (8], as potentially occurring at a relatively high frequency. Also, the POS had characteristics (i.e., reactor vessel head removed) of interest to the staff in the Office of Nuclear Reactor Regulations at the NRC. o The abridged study is based on the coarse screening analysis where accident sequences , potentially having high frequencies were identified. The consequences of these sequences were determined in the level 2 and 3 abridged study reported here. The frequency is not merged with the Level 2 and 3 calculations to determine risk because the numerical value of the frequency estimate is believed to be too rough for such use. 1 o The simple APET accounts for a limited number of factors. The APET consisted of nine top event questions, compared to about one hundred questions in a large scale PRA. o The onsite dose estimates stem from simple equations yielding rough estimates. ! o Variables were selected and assigned distributions for the uncertainty analysis by the project staff. o Because of gaps in knowledge of the plant configuration and operator actions, assumptions were necessary. The assumptions are documented in the sections to follow. 1 Strencths l o Even with the limitations noted above, the abridged study is a systematic evaluation, l which includes a limited treatment of the uncertalaty in severe accident progressions ~ o The source term analysis was reviewed by an interna' advisory group.
-1 o The project staff and the NRC project staff believe that the APET represents the' l occurrence of key events during accident progresions. I 4
l O 1 i J
.a ' . o The relationship and timing of accident progression events and factors have been determined to at least a first approximation, o Estimates of both onsite and offsite conditional consequences were made. The sections to follow document the abridged study of the Grand Gulf plant. The discussion above is expanded, providing important details and results. , h I l l l 1 l 1
'l 5
'l
.3
.1 4*
e a.
- s Plant i
POS 1 POS2 - - - POSn F (P)(C)
'~"
. ' (P)(C)
-F
~
- (P)(C)
~
' (P)(C) -
-F .. (P)(C)
(P)(C) ' F Level 1 Level 2 & 3 R = F]-[P] [C] . F = sequence frequency -
-t P = accident progression probability C = consequences Figure 11. Scope of abridged study 6
. + ,
= _
1 c__ t
~
Parametric Source Term Equations / APE,. Code MACCS s Conditional Source Probabillties identifler Tor ms hue"n*c*e's l.*,_ i i d ABCDEF O_l :l O d . g_ l .l c C k _ ' % ,i d BABBCC Dl 'l D t_l- :l o C , g *
,.((P , #][G ]
CD d ADCCDE o l -: l c d -a l- lO C c::::!7 3 d ABBDEF &l l@ dW j' l4C 4 Uncertainty in Conditional Consequences H---
--M I~ t-Figure 1-2. Summary of abridged methodology _
7
- p
_ _ __ .m. - __ ,_.._.__,..___.________m _ . _ _ _ _ . _ _ _ . _ _ . _ = _ _ _ _ _ _ _ _ _ . _ . -~ - 4 b-
a !
- e
[ 2.0 ACCIDENT PROGRESSION ANALYSIS E ;
. 2.1 _ Apnroach l
The progression of accidents following core damage are analyzed in the Level 2 portion of'the PRA. In this chapter the development and quantification of the accident progression scenarios will be presented. The input to the accident progression analysis is the core damage sequence
. definitions de" eloped in the Level 1 analysis [8]. The core damage sequences define the -
successes and failures of equipment and human actions that have resulted in the loss of core , cooling and me onset of core damage. The sequence definitions provide information on the status of core cooling systems, contaimnent cooling systems, and containment integrity at the time of core damage. From this infonnation the possible accident progressions, which identify the response of the core and the containment following core damage, are determined. These accident progressions are developed and displayed using an esent tree. In this abridged analysis only the most imponant events that affect the timing and the magnitude of the radionuclide release are addressed. The outputs from the accident progression analysis are the accident
- progression path definitions and the likelihood, conditional on core damage having occurred, of each path. In the source term analysis, the fission product release associated with each path is estimated. The estimation of the source term is addressed in Chapter 3 and the resulting consequences are presented in Chapter 4.
In the following subsectivas the configuration of the plant during POS 6 will be presented, the important characteristics of the Level I core damage sequences will be identified, and the development of the accident progression paths will be discussed. 2.2 POS 6 Plant Conficuration < The configuration of the plant at the onset of core damage is important because it will determine the framework within which the accident will unfold. That is, the plant configuration will define - the boundary conditions for the analysis. For example, it will define the mitigative features of the plant that will be available during the accident (e.g., containment, suppression pool, containment sprays). The abridged risk analysis was performed on the early portion of the refueling mode of , operation, referred to as plant operating state 6 (POS 6). During a refueling outage the plant will enter POS 6 prior to loading fresh fuel (i.e., going down) and then following fuel transfer on the way back up to power conditions (i.e., going up). In the Level 1 analysis, the sequence , def'mitions are bastd on the " going down" phase because (1) more systems ~ are likely to be unavailable (i.e., on the way back up, maintenance and repairs may already have been performed on many systems) and (2) the decay heat levels are higher and, therefore, there is less time to respond to events in the going down phase versus the going up phase. Thus, in this study only the " going down" phase is analyzed. POS 6 begins when the vessel head is detached and ends when the upper reactor cavity has been filled with water. During this POS the following tasks are performed: 8
3 p#
- 1. Steam dryers are removed, i' 2. Vessel water level is lowered to the bottom of the steam lines and the steam lines are plugged,
- 3. Water level is raised and the steam separators are removed, and
- 4. Vessel water level is raised to fl.ood the upper reactor cavity.
Prior to this mode of operation, the containment equipment hatch and personnel locks have been opened, the drywell head has been removed, and the drywell equipment hatch and personnel locks have been opened. Thus, the suppression pool is effectively bypassed both from the vessel and from the drywell (i.e., steam lines are plugged and the drywell is open). F Timing information for the initiation of the accident in POS 6 is based on Grand Gulf refueling - outage (RFO) data. Information was available for the first four RFOs. However, because of the number of special tests that were conducted during the first refueling outage, RFO-1 was considered atypical and, therefore, data from this outage was excluded from the analysis. Thus, only RFO 2,3, and 4 data were used in this study. Based on this data the fastest the plant will enter POS 6 from full power is approximately four days after shutdown and the longest the plant has been in POS 6 (in the " going down" phase) is approximately 12 days (i.e.,16 days from shutdown). In the Ixvel 1 analysis the time window from the initiating event to core damage was based on the decay heat at four days. This assumption is carried through the I2 vel 2/3 analyses. 2.3 Ixvel 1 Seouence Description 2.3.1 Seoucace Description The initial conditions for the accident progression analysis are the core damage sequence descriptions from the level 1 analysis [8]. That is, a list of attributes that describe the status of systems that can be used to mitigate the accident and the configuration of the plant at the time of core damage. In the Level I coarse screening analysis the sequences were placed into three groups: potentially high likelihood group, potentially medium likelihood group, and potentially - low likelihood group. Only sequences from the high likelihood group were analyzed in this ~ stady. Fourteen different initiating events are associated with these sequences. A list of these 14 initiating events is presented in Table 2.3-1. The initiating events can be divided into four major groups: Loss of Offsite Power (LOSP) Transients, less of Support System Transients, Loss of Coolant Accidents (LOCAs), and Decay Heat Removal Challenges. The accident sequences that form the input to this study all progress to core damage in the following manner. The initiating event leads to the loss of the operating shutdown cooling system,. subsequent random failures and unavailabilities complete the loss of core cooling and injection. Without , a means to keep the core cool, the vessel inventory is lost via boiling and core damage ensues. In the level 1 screening analysis both the emergency core cooling system (ECCS) and Makeup (i.e., CRD and CDS) were assumed to be unavailable or unable, due to some postulated failure, 9 ; I a h
4 f'+ to prevent core damage. Thus, only the firewater system (FW) and the standby service water (SSW) cross-tie were considered as potential injection systems. In POS 6 the suppression pool can be either at its normal level, partially drained, or empty. Furthermore, the suppression pool makeup system (SPMU) is not available. Because a supply of water to the SP is not available, ECCS systems that draw water from the SP could not be used in a continuous mode and, therefore, it was assumed in the Level 1 analysis that these systems were not available to cool the core. Because the containment spray system is one mode of the residual heat removal system (i.e., part of ECCS) and draws water from the SP, it is also - unavailable during these postulated accidents. The CRD system has insufficient capacity to prevent the core inventory from boiling and, therefore, was not considered as a means to cool the core in the Level 1 screening study. (It . should be noted, however, that if this system was used, the energy removed from the core via steaming would be sufficient to prevent core damage.) While CDS has more than enough capacity to cool the core, its unavailability due to random failures and maintenance precludes its use as a means to cool the core. - A general description of the core damage sequences for each class of initiatcrs is presented below. LOSP Transients j The LOSP initiating event leads directly to the loss of the alternate decay heat removal system (ADHR). Subsequent random failures lead to the complete loss of shutdown cooling (SDC), ; makeup, the standby service water and the firewater system. With ECCS unavailable in this POS, as a result of support system failures, the accident proceeds to core damage because of the ; lack of core cooling. Loss of Supnort System Transients
.l In these sequences the initiating event leads directly to the loss of ADHR, makeup, and the j firewater system. Subsequent random failures lead to the complete loss of SDC and the SSW !
system. H 1 Decay Haat Removal Challences I In these squences the initiating event leads to the loss of the operating shutdown cooling system. In some of these sequences this system is recovered. However, subsequent random failures lead ! to the complete loss of SDC, the firewater system, and SSW. j i
.l 1
I 10
)
LOCAs That Can Be Isolated In these sequences the isolation of the LOCA also isolates the SDC systems. Subsequent random failures lead to the loss of both the firewater system and the standby service water cross-tie system. Table 2.31 Grand Oulf LP&S POS 6 Initiating Events l Imtiating Initiating Event Event Group Nomenclature Description LosP Tl Loss of offsite Power (LosP) Transient less of T5B less of all TBCW septv tt system TSC less of all PSW (includes Radial We!!) TIA Loss of allInstrument Air Decay ElB Isolation of sDC loop B only lleat Removal E2B less of sDC loop B only EID ! solation of ADHRs E2D Loss of ADHRs only EIT Isolation of sDC Common suction Line E2T less of sDC Common suction Line Elv Isolation of Common suction Line for ADllRs E2v less of Common suction Line for ADEIRs isolated 111 Diversion to suppression Pool via R}IR LoCAs J2 LOCA in Connected system (RilR) i 2.3.2 Plant Damace State Description The 12 vel 1 sequences were divided into two plant damage state (PDS) groups: LOSP and nonLOSP. This distinction is made because of the effect that the LOSP has on , injection recovery and containment closure. In the analysis of the nonLOSP PDS it is assumed that if injection is not recovered prior to core damage, it will not be recovered during core damage. The reason for this assumption is that there is a considerable amount of time from the initiating event to core damage for the operators to align and use injection systems to cool the core. If this has not been done by the time of core damage, there is no reason to believe that they will recover core cooling during core damsge. Recovery of injection is considered in the LOSP PDS. In these sequences offsite power is unavailable and, therefore, non-emergency systems are unavailable to provide injection to the core. Thus, for the LOSP PDS it is assumed that if 11
r ,
') .
1 j' offsite power is recovered, injection can be recovered. The availability of ac power also affects the likelihood that the containment is closed prior to core damage. The crane that is used to position the equipment hatch is powered with offsite ac power and, therefore, without offsite ac - ; power the containment cannot be closed. If offsite power is available during the accident, ' closure of the containment prior to core damage is addressed in the evem tree analysis. The key attributes associated with these two PDSs are presented in Table 2.3 2. ,, Table 2.3-2 Grand Gulf LP&S POS 6 Plant Dam sge State Attributes samm unan - PDs Attnbutes Plant Darnage states (PDs) LosP nontosP offsite Power Not Available Available vessel licad off off Containment Integrity open open Drywell Integrity open open suppression Pool Makeup Not Available Not Availabic Containment sprays Not Available Not Available Containment Closure Possible? No Yes Injection Recovery Possible? Yes No From Table 2.3-2 it can be seen that the main differences between the LOSP and nonLOSP PDSs are 1) the containment can be closed only in the nonLOSP PDS and 2) injection can be recovered only in the LOSP PDS. Because sequence frequencies are unavailable from the Level 1 screening analysis, the relative likelihood of the two PDSs is unavailable. The remaining . analysis that is presented in this report is conditional on the occurrence of these PDSs. ' 2.4 Event Tree Analysis A simplified APET was used in this analysis to delineate and quantify the likelihood of the possible accident progression paths. The selection of events to include in the accident progression analysis was based on (1) insights gained from the NUREG-1150 full power PRAs , [1,9], (2) results from MELCOR calculations specifically performed for this analysis, and (3) t the plant configuration during POS 6. Events deemed important for inclusion in the APET were , events that related to containment performance and the estimation of the radionuclide release, i The APET addresses three general time regimes: prior to core damage, during core damage, and l following vessel failure. In the first time regime the issue of containment closure is addressed. Injection recovery, core damage arrest, in-vessel steam explosions and early containment failure are all addressed in the second time regime. The characteristics of the interaction between the core debris release from the vessel and the reactor pedestal are addressed in the last time regime. 12 0
I' 1 The times associated with these time regimes are based on results from a series of MELCOR calculations that were performed to support this analysis. The timing of key events in the accident progression analysis is presented in Table 2.4-1. Table 2.4-1 Accident Progression Timing Calculation Timing of Key Events frorn Initiation of Accident (hours) Time to Core Vessel l Conuin. Aux. Blds TAF Damage Failure Failure failure PRA MoDEL INPUT PRA Model: Containment open 13.0 18.3 25.4 21.1 Cat openG) PRA Model: Containment Faus 13.0 19.4 28.6 No Fall. (3) 30. MELCoR RESULTS . Base Case (BC)-No Aux Bldg 12.7 18.3 25.4 (1) (2) BC w/ Small Aux. Bldg 13.0 18.8 24.5 21.6 G) BC w/ Big Aux. Bldg 13.0 18.8 28.6 28.6 G) BC w/ Containment Closed 13.6 19,4 28.6 (1) 22 - 80. BC inuinted 15 days after SD 19.7 28.3 39.8 (1) G)- Notes:
- 1. Auxiliary building model not included ,
- 2. Containment is open dursng the accident
- 3. Containment failure bypasses the auxihary budding
- 4. MELCoR Pos 6 BC Calculation:
Accident Initiated 4 days after shutdown Contamment is open (i.e. equioment hatch and both personnel locks)
. Injecuan. shutdown coolmg. and containment sprays are all unavailable
- 5. Core damage is defmed as the first gap release
- 6. TAF = Collapsed water level at the top of the active fuel i
In this table both the times estimated with MELCOR and the times assumed in this PRA are presented. From this table it is apparent that the timings of tliese accidents are quite different . from accidents initiated at full power. For example, it takes approximately 18 hoars to progress from the initiation of the accident to the onset of core damage. In comparison, a fast station : blackout initiated from full power progresses to a similar point in approximately 1 hour. Another notable entry in this table is the predicted time of auxiliary building failure for cases with the containment open. The building is predicted to overpressurize and fail from'the accumulation of steam and noncondensibles during core damage. The exact timing of building failure depends on the volume assumed for the auxiliary building (i.e., various' rooms in the 4 building can isolated) and the building failure pressure. For this abridged study, the auxiliary building is estimated to fail approximately half way through the core damage process. 13
, 'Nine events are used to characterize the accident progression. A graphical depiction'of the APET is presented in Figure 2.4-1. The first nine paths are associated with the LOSP PDS and the remaining 7 paths (i.e., paths 10 through 16) are associated with the nonLOSP PDS. The mean probabi"h for each path is also presented in this figure. The path probabilities for each PDS sum to 1.0. The nine events and a brief description of each event are presented below.
- 1. Is the containment closed prior to core damage?
The containment equipment hatch has been removed prior to entry into POS 6. For the LOSP PDS the lack of offsite ac power precludes containment closure prior to core damage.110 wever, for the nonLOSP PDS it is possible that the plant personnel will close the containment after the initiation of the accident but prior to core damage. The-containment can be closed if the operators recognize that a problem exists early in the accident and decide that containment closure would be prudent. Because it takes between 8 to 12 hours to completely close the hatch,'it is necessary that the operators begin the closure tasks within the first few hours of the accident. The equipment hatch is a pressure seating hatch which requires the personnel closing the hatch to be in the containment. Thus, the environment in the containment during the bolloff is an important parameter that will affect the personnel's ability to close the containment. MELCOR calculations performed for this analysis indicate that the temperatures in the containment during this j phase of the accident will be high (i.e., range from 100 to 140 degrees F) but not so high l that it would preclude the personnel from carrying out their tasks. It was also assumed that the radiological environment in the containment will not preclude the closure tasks from being performed. These assumption will have to be verified in future analysis. In this analysis it was assumed that the containment was habitable up until the time of core uncovery (i.e., approximately 13 hours).
- 2. If the containment is closed prior to core damage, does it fall prior to vessel failure?
The Grand Gulf plant utilizes a Mark III containment to house its BWR-6 reactor. The containment has a volume of 1.6 million cubic feet and a design pressure of 15 psig. The : mean e.stimated failure pressure is 56 psig [9]. Since the containment has a relatively low failure pressure, the pressure rise from the accumulation of steam and noncondensibles can pose a threat to the containment integrity. Actions must also be taken to prevent the combustion of large quantities of hydrogen. Containment venting was not considered in this analysis as a means to control pressure because venting would still result in an open containment. In POS 6 the suppression pool is bypassed and, therefore, the steam and noncondensibles are released directly into the containment atmosphere. Furthermore, the containment sprays are not available. Thus, the containment will pressurize during the core damage process. The peak pressure during this phase of the accident depends on the steam generation rate, the condensation rate in the containment, and the presence and magnitude of hydrogen burns. MELCOR calculations indicate that the containment yessure can exceed the lower range of the containment failure pressure distribution if a bur.' M steam 14
p- p 3 4 . occurs at the time of vessel failure or if discrete hydrogen burns (not diffusion flames) occur during the core damage phase of the accident. Because steam and hot hydrogen are released directly into the containment in this POS, the effectiveness of the HIS to control the accumulation of hydrogen is uncertain. Thus, it is possible that for some accident scenarios the containment will fail early in the accident. If the contaimnent does not fail - early, calculations indicate that it will take several days to reach the mean estimated failure pressure of 56 psig. Therefore, it was assumed that if the containment does not fail early, it will not fail in the time frame of this analysis.
- 3. If the containment falls, is the failure in the form of a leak or rupture?
The failure size will determine how fast the radionuclides are released from the containment and the amount of radionuclides deposited within the containment.
- 4. Is the auxiliary building bypassed?
This question distinguishes the accidents in which the releases pass through the auxiliary building from those accidents which result in a release from the containment directly into the environment. The release path is important because it will affect the amount of mitigation that the release experiences before entering the environment. Accidents in which ; the containment equipment hatch is off will result in a release that passes through the auxiliary building; accidents in which the containment falls bypass the auxiliary building. ; Based on previous structural analysis of the Grand Gulf containment, it was concluded that i the most likely location for failure is the region near the junction'of the dome and the cylindrical wall [9). A failure in this location will result in a release to the enclosure building that surrounds the containment dome. The enclosure building has virtually no pressure retaining capability and is essentially isolated from the auxiliary building. Therefore, it is assumed that following containment failure, the release goes directly from l the containment into the environment. The retention in the containment will be fairly small in this case because the containment fails early in the accident. The result will be essentially an unmitigated release. If the containment is open to the auxiliary building, the majority of the radionuclides will quickly enter the auxiliary building and the retention in the containment will be small. For these accidents, the only significant mitigation feature will be the auxiliary building which acts as a large holdup volume allowing time for natural processes to remove radionuclides from the building atmosphere before being released into the environment. The auxihary building is predicted to overpressurize and fail from the accumulation of steam and noncondensibles during core damage. The exact timing of-building failure depends on the volume of the auxiliary building that will pressurize (i.e., -. some rooms within the building can be isolated and therefore will not pressurize) and the building failure pressure. For this abridged study, the auxiliary building is estimated to fail approximately halfway through the core damage process. 15 l
o I t. . E.-
' 5.~ Is injection recovered prior to vessel failure?
d This question is used to identify those accidents in which injection is restored to the vessel l during the core damage process. The recovery of injection allows for the possibility that . l the corc damage process will be arrested in the vessel (i.e., prevent vessel failure). Injection can only be recovered for the LOSP PDS. The probability that injection is recovered is based on the probability that offsite ac power is recovered during core damage.
- 6. If injection is recovered, when is it recovered?
The timing of injection recovery during core damage affects the likelihood that the core 1 damage process will be arrested before the vessel fails. For this analysis, the in-vessel phase of the accident (i.e., core damage) has been divided into tl,ree time regimes: very early, early, and late. The very early time regime ranges from the initiation of core o damage to the onset of autocatalytic oxidation. If injection is recovered during this phase' of the accident the core damage process will be arrested in the vessel and the releases will be limited to the inventory in the gap. The early time regime ranges from onset of autocatalytic oxidation to 30% core damage. Based on extrapolation of analysis performed in NUREG-1150, if injection is recovered before 30% of the core has been damaged, it is very likely that the core damage process can be arrested. Because MELCOR calculations indicate that core damage progresses rapidly from 30% to full core damage, the late time regime is defined as'30% core damage to vessel failure. Recovery ofinjection during this phase of the accident will not prevent vessel failure. The time windows for each of these time regimes is based on results from MELCOR calculations. The possibility of the reactor roing critical following the restoration of injection was not addressed in this abridged Lnalysis.
- 7. Does an in-vessel steam explosion occur durhig core damage? -
In-vessel steam explosions are treated in a very limited fashion in this abridged analysis. A primary motivation for including this question in the APET is to highlight the fact that in-vessel steam explosions are possible. The effect of the steam explosion on the accident progression can be quite different from in vessel steam explosions that occur at full power because the steam and radionuclides that are generated during this event are released directly into the containment atmosphere. In this analysis the treatmer.t of in-vessel steam explosions was limited to the estimation of the source term that is associated with the debris that participates in the steam explosions. Neither the pressure loading from in vessel steam - explosions aor the relocation ofintact fuel from the steam explosion was addressed in.this ' study. Both issues were beyond the scope of this abridged study. Ex-vessel steam explosions were not considered in this analysis because the pedestal cavity below the vessel L wih be essentially dry at the time of vessel failure. f-16
( . L 8. Is the core damage process arrested in the vessel? This question addresses the coolability of the core debris following injection recovery. If the core damage process is arrested before the vessel fails, the core debris will remain in the vessel and core-concrete interactio'ns (CCI) will be prevented. Because only a portion of the core is damaged and CCI is prevented, the source tenn associated with recovered accidents is typically less than the source term as.,ociated with full core damage accidents. If injection is not restored during core damage, the accident always progresses to vessel failure and the core debris relocates to the pedestal cavity below the vessel. The likelihood that the core damage process is arrested before vessel failure depends on when injection is restored during the core damage process (see question 6). Ifinjection is restored during either the very early or early time regimes, analysis indicates that it is very likely the core damage process will be arrested. If, on the other hand, injection is not restored until the late time regime, it is very likely that the vessel will fail and the core debris will relocate to the pedestal cavity.
- 9. Do core-concrete interactions occur following vessel failure?
Core-concrete interactions consist of the thermal and chemical interactions between the core debris and the concrete pedestal. During this process the concrete is eroded and gases and radionuclides are released from the core / concrete mixture. For the accidents analyzed in this study, the vessel will fail and the core debris will enter the cavity if 1) injection is not 1 restored to vessel during core damage or 2) injection is restored during the' late time l regime. The presence of water can affect CCI in two different ways. First, water can quench the debris and prevent CCI. Second, if the debris is not quenched, the overlying pool of water will retain some of the radionuclides released during CCI and thus, tend to mitigate the release. Thus, for the accidents in which injection is restored but the vessel still fails, there is some probability that the core debris will be quenched and CCI will be prevented. The probability of this occurring is based on information from the NUREG-- f 1150 study (9]. If injection is not restored during core damage, CCI will always proceed j in a dry cavity. l From inspection of Figure 2,4-1 it can be seen that there are several important differences f between the LOSP PDS and the nonLOSP PDS. In the LOSP PDS injection can be recovered allowing for the possibility to arrest the core damage process in the vessel. If the vessel does fail, it is still possible to quench the core debris in the cavity (i.e., no CCI). Thus, in many of the LOSP accidents the ex-vessel radionuclide release is prevented. The containment, however, cannot be closed in the LOSP PDS and, therefore, the releases always pass into the auxiliary 1 building and then out into the environment. In the nonLOSP PDS, the containment can be i closed, however, injection cannot be recovered. Thus, all of the nonLOSP accidents identified in the APET progress to full core damage, vessel failure, and involve CCI. In some of the scenarios the containment is closed. However, because containment cooling (i.e., containment r sprays) is unavailable and the suppression pool is bypassed, even if the containment is closed it is possible that it will fait early in the accident from pressure transients associated with events 17
p' . - accompanying vessel failure and hydrogen combustion. Based on information from NUREG-1150, it is expected that the containment will fail above the auxiliary building roof. Thus, the releases from the containment will enter the environment without first going through the auxiliary building. Because so many of the mitigative features of the plant are bypassed in this POS (e.g., suppression pool, containment sprays, containment), the auxiliary building plays an L important role in reducing the amount of radionuclide material that is released into the environment. Thus, for the nonLOSP accidents there are two extremes: 1)if the containment is closed and remains intact, the releases to the environment are expected to be very small and !. 2) if the containment fails, the releases to the environment are expected to be quite large becaus: all of the accidents involve full core damage and CCI and the releases bypass the auxiliary building. The scenarios in which the containment is not closed are very similar to the LOSP accidents in which injection is not recovered. l l 1 k u
'I 18
j I
~l
, v E 3 M 2 6 6 2 9 0 2 8 5 7 3 T 3 0 8 3 t 1 3 0 0 0 0 0 2 0 1 0 1 0 4 1 0 _ C T 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 U D 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6
. 1 1 1 1 1 1 1 o
W
* ' * " ' v v eI n" n " n t
" t N N " " m r r 7
d C maC a m a M a B I b 'Ib D D 0 B D' e B a
)
i de t s a " a a n a a a a a a a a a r Dt n n a n m n h n C s T' n M e r f f A ( r A e e r t e?p n m n n o a s e a e e t n ea a e e n e i6 t wf r e n T ! b v u Y v II n Y !l u Y e v t S e v n t r y i o y a e eg r l l r a t a s v l o e v E L g i i c s e T o r [ p nJ t n oe & ir t e , a e n a e cv y d m u m " d jc eo dc ne is - ~ a d 9 I d B e g 1 _ n ee ad s s n u a a
" d i
r I s is ap b y B a n 6 e n S r r oer k. e O k u t
. i m P et f ep l L us u G
d sl t
? se n eey a Y , " ar oF t m
D t ra G nE c . 1
? n -
4 t d ne C so n m a t e ~ 2 e r l C u g i F P s t o o t P
d 10 SOURCE TERM . ANALYSIS 3.1 Aporoach A source term is estimated for each accident progression path identified in the APET (see Figure 2.4-1). The simple parametric source term approach that was used in NUREG-1150 to estimate source terms is used in this study. The parametric source approach is used because 1) information from a wide variety of sources can be used in the model,2) it is easily incorporated into uncertainty analysis, and 3) thousands of source terms can be estimated with this model in a very efficient manner. The parametric source term code GGSOR that was developed in NUREG-1150 [9] was modified for this analysis. The modified parametric code is called GGLPSOR. Modifications were made to the code to incorporate the unique plant configuration associated with accidents initiated in POS 6. Wherever possible, data from NUREG-1150 was used to quantify the model. Results from MELCOR were compared with both the input distributions and the final source terms to verify that distributions developed for full power accidents could be applied to shutdown accidents. A limited uncertainty analysis was performed in this section of the analysis. For each accident progression path, the model A .s repeatedly exercised with different combinations of selected input variables. The distributit is for these input variables were obtained, when applicable, from NUREG-1150. 3.2 Description of Parametric Modgl The parametric source term model GGSOR that was developed in NUREG-1150 was modified to account for unique features of POS 6 that have a strong impact on the source term. In POS 6 both the drywell head and the vessel head have been removed and the steam lines have been plugged. Thus, during the core damage process radionuclides released from the core debris will bypass the suppression pool and directly enter the containment. Furthermore, because most of the internal structures above the core (e.g., steam dryers and separators) have been removed and the steam lines are plugged, there is very little deposition of radionuclides in the vessel. Thus, the mitigative features of both the vessel and the suppression pool, which are present in many full power accident scenarior,, are absent in this POS. For scenarios in which the containment i hatch is open, the residence time of the radionuclides in the containment atmosphere is fairly short and, thus, there will be limited deposition (i.e., from gravitatior,1 settling) of radionuclides in the containment. In this POS the drywell is open to the containment (i.e., the drywell hatch - is open) and, therefore, an ex-vessel release will also bypass the suppression pool. For these - accidents, the containment sprays are not available and cannot be used to scrub the releases. Tims, the mitigative features of the vessel, suppression pool, containment spreys, and possibly the containment, are bypassed or unavailable. For scenarios with the containment open, the only major mitigative feature of the plant is the auxiliary building. The auxiliary building encompasses a very large volume and, therefore, acts l as a hold up volume for the radionuclides which allows time for the radionuclides to deposit on ; 20 I l
d surfaces within the building. The auxiliary building can play an important role in POS 6 because so many of the other mitigative features of the plant are absent and the characteristics E of the radionuclide transport to the auxiliary building are different from the transport associated with full power accidents. In full power accidents the containment pressurizes to the ultimate failure pressure and then blows down into the auxiliary / reactor building (i.e., Peach Bottom analysis in the NUREG-1150 study). Following containment failure the auxiliary building rapidly pressurizes and fails (the failure pressure of the auxihary building is only a few psi). Thus, the releases are swept through the auxiliary building fairly rapidly. In the POS 6 accident scenarios the steam and radionuclides are released to the auxiliary building much more slowly allowing more time for condensation and deposition. The scenarios that involve containment closure followed by containment failure will not benefit from the auxiliary building because the containment failure location is assumed to be above the roof of the auxiliary building [9]. Thus, the releases will bypass the auxiliary building essentially resulting in an unmitigated release. Neither the normal ventilation system nor the standby gas treatment system (SBGT) were modeled in this analysis. The filters and charcoal beds in the SBGT system could act to mitigate the release or at least delay the release of radionuclides. Before credit can be given to this system, the capacity of the system and the performance of the filters under severe accident conditions will have to be addressed. The analysis of this system was beyond the scope of this study. 3.3 Results A source term is estimated for each path through the APET. In addition, because an uncertainty analysis was performed, a distribution of source terms is available for each path. For the sake of brevity, only the mean source terms, expres:ed as fractions of the core inventory, that enter the environment are presented in Table 3.3-1. When reviewing this table, it must be remembered that the initial inventory of radionuclides four days after shutdown is different from . the inventory typical of full power accidents. Inspection of Table 3.3-1 confimis that many of the releases are essentially unmitigated and, therefore, are quite large. Table 3.3-1 also highlights some of the differences between the various accident scenarios (i.e., paths). Paths 1 through 3 correspond to accidents in which injection is recovered early in the accident and the core damage process is arrested in the vessel. Thus, because only a portion of the core is Amaged and there are no ex-vessel releases (i.e., no CCI), the source terms associated with these accidents are relatively small compared to the other source terms presented in this table. The notable exception is Path 14 which corresponds to the scenario ;n which the containment is closed prior to core damage and remains intact throughout the accident. Because the containment remains 5 tact, only nominal leakage occurs and the resulting source term is quite small. Paths 4 through 9, on the other hand, correspond to full core damage accidents that have the containment open to the auxiliary building. The source terms associated with Paths 4 and 6 tend to be lower than the other full core damage source tenns because the core debris is quenched in the pedestal cavity and, therefore, there are 21
y , no relcases associated with CCI. This difference is fairly minor, however, and the fact still remains that these are large source terms. Paths 10 through 13 are nonLOSP accidents in which the containment fails around the time of vessel failure. All of these accidents progress to full core damage and CCI. The containment fails via a leak in Paths'10 and 11; the containment ruptures in Paths 12 and 13. In all four of these scenarios the containment fails directly to the environment (i.e., the auxiliary building is bypassed). The source terms associated with the leak failure mode are similar to the source terms when the release passes through the auxiliary building. In the leakage cases, the radionuclides are held up in the containment for a period of time thus allowing a fraction of the radionuclides to settle out of the containment atmosphere. For the run'me cases, hcwever, the containment quickly depressurizes following containment-failure an onsiderably less deposition occurs. Thus, the source terms associated with the rupture cases are quite large. Paths 15 and 16 correspond to the nonLOSP cases where the-containment is not closed prior to core damage and the radionuclides pass through the auxiliary building. These source terms are essentially the same as the LOSP full core damage source terms. i 22
.; . x .,
4 Table 3.3-1 Mean Soulte Terms for Accident Progression Paths (Total Release)
- Path Rationuclide Release Classes Timing of Release (hr.s) 7 NG I~ Cs Te Sr Re La Ce Ba TW Tl DTI DT2
~
LOSP PDS l 0.015 0.002 5.9E-3 1.2E-5 LO 0.0 0.0 0.0 1.2E.7 163 . 21.1 24.0 0.0 - i 2 0.072 0.012 0 011 63E-3 2.lE-3 33E-4 - 1.4E4 6.7E-4 2.2E-3 16.3 21.1 - 43 0.0 3 0.0'72 0.012 0.011 63E3 2.IE-3 33E4 1.4E-4 6.7E-4 2.2E-3 16.3 21.1 4.3 0.0 4 0.79 0.17 0.15 0.085 0.027 0.012 3.0E-3 8.7E-3 0.033 163 21.1 43 .10.0 ' 5 1.0 0.25 0.19 0.11 0.042 0.012 4.0E-3 0.011 0.047 16.3 21.1 43 10.0 6 0.74 - 0.15 0.13 0.075 0.022 4.9E-3 1.5E-3 7.lE-3 0.026 16 3 21.1 4.3 1J.0 7 1.0 0.25 0.18 0.11 0.041 4.9E-3 2.7E-3 9.653 0.042 16 3 21.1 4.3 10.0-8 1.0 0.25 0.25 0.16 0.08 0.012 6.9E3 0.012 0.084 163 21.1 43~ 10.0 9 1.0 0.25 ' O.25 0.17 0.088 5.4E-3 63E3 0.011 0 089 16 3 21.1 4.3 - l 10.0 nonLOSP PDS .- 10 1.0 0.27 0.27 0.18 0.094 ' O.013 6.8E-3 0.011 0.083 17.4 . 30.0 2.0 10.0 -' il 1.0 0.28 0.28 0.19 0.10 ' 6.153 6.2E-3 0.011 0.086 17.4 30.0 2.0 10.0 14 1.0 0.62 0.63 0.40 0.22 0.029 0.016 0.027 0.19 17.4 30.0 - 0.05 10.0 13 1.0 0.62 0.63 0.43 0.24 - 0.013 0.014 ' O.025 0.20 - 17.4- 30.0 0.05 10.0 - 14 5.0E-3 4.lE-7 4.lE-7 2.9E-7 1.4E-7 - 9.4E9 9.7E-9 1.9E-4 1.4E7 163 21.1 43 10.0 15 - 1.0 - - 0.25 0.25 0.16 . 0.08 0.012 6.9E.3 0.012 - 8.4E-2 16 3 ~ 21.1 '43 10.0
- 16. 1.0 - 015' O.25 0.17 0.088 5.4E . 63E-3 0.011 0.OR9 163 21.1 - 43 10.0 sores:
I. TW = Warning nme
- 2. T1 = Timing of first release '
- 3. DTl= Duration of first release
-4. DT2= Duration of second release (start imrnediately after f:rst release ends) 23
*i r--
_ __-___m-__-____--_m-+_ m _ . *-.__-.# #- '. _. F .11,. y - __ g, ~ g --
,__ y g,y-- _ y
m k
,+s 4.0 CONSEOUENCE ANALYSIS The consequences of a severe accident during POS 6 were calculated as part of the abridged study. As is typically done, the offsite consequences were estimated. The onsite doses were also estimated, which is not typically done.
An important difference between this analysis and those previously performed for full power-accidents is that the radionuclides in the fuel have had at least four days to decay resulting in a different inventory than that present at shutdown. ORIGEN2 [10] was used to calculate the inventory in three different fuel assemblies, one which had been irradiated for three fuel cycles, one which had been irradiated for two fuel cycles, and one which had been irradiated for one fuel cycle. All fuel assemblies were then allowed to decay for four days. Based on information from plant personnel, a fuel cycle consisted of 540 days of irradiation and 55 days of decay. The inventory for the whole core four days after shutdown was then summed This inventory, which was reduced to include only the sixty radionuclides currently available in the MACCS code [5,6,7], was then used as the basis for both the onsite and offsite consequence calculations. This inventory, which does not include short-lived radionuclides, is appropriate for both the onsite and offsite analyses since the reactor has been in shutdown for at least four days at the beginning of the accident thus allowing decay of the short-lived radionuclides. ~+ The following sections detail the methodology and results for the onsite consequences, both in the buildings and in the parking lot, and the offsite consequences. 4.1 Onsite Conseauences Onsite consequences have seldom been considered in the analysis of severe accidents at nuclear power plants. During shutdown there will be hundreds of onsite personnel and, thus, onsite consequences could be large. For this reason a method for estimating the potential doses to onsite personnel had to be developed as part of this study. The primary simplifying assumption of the analysis was that radioactive decay was neglacted during the exposure time. This assumption is justified by the fact that the accident under analysis typically occurs no earlier than .i four days after shutdown by which time the decay heat curve is fairly flat. Other assumptions' l were employed in the two aspects of the onsite consequences: (1) in building doses and (2) parking lot doses. The method, assumptions, and results of 'he analyses are discussed in the following two sections. ; 4.1.1 Euildine Doses The onsite consequences for POS 6 were estimated based on the source terms to both the containment and the auxiliary building that were determined with the parametric source term code, GGLPSOR. Ilowever, since GGLPSOR calculates integral releases, the time dependence of the two release segments of the source terms was determined from MELCOR calculations. Three different sets of residence times (i.e., estimated time airborne material spends in the building) were used based on the status of the containment. The first set of residence times was 24
p. used if the containment was open to the auxiliary building at the time of the accident. The residence times through both buildings were based on a MELCOR calculation modeling this scenario. The residence time of the radioactive material in each building was directly proportional to the volume of that building. The second set of residence times was used if the containment ruptured directly to the environment. For this case, the same residence times were used as in the previous scenario, however, the residence time in the auxiliary building was set to zero. In other words, the amount of time the material spent in the containment was the same for both of these scenarios, but in the latter scenario the material did not pass through the auxiliary building. The third set of residence times was used if the containment leaked directly to the environment. In this case, the residence time for the first release was increased by two hours, and again the resid:nce time in the auxiliary building was set to zero. The residence times used under the various conditions are summarized in Table 4.1.1-1. Table 4.1 1-1. Residence times through the containment and auxiliary building for Grand Gulf POS 6. Accident Progresuon Conainment Residence Comainment Residence Auuhary Budding Auxihary Buildmg . I Path Number Time: First segmer:t Time: second segment Residence Time: First Residence Time: (hours) (min) segment (hours) second segment (hours) LosP PDs Paths 1-9 3.4 47 6.1 1.4 i nonLosP PDs Path 10 4. I' 47 0.0 0.0 Path 11 4.1 47 0.0 0.0 Path 12 3.4 47 0.0 0.0 Path 13 3.4 47 0.0 0.0 Path 14' NC NC NC NC Path 15 3.4 47 6.1 1.4 Path 16 ' 3.4 47 6.1 1.4
' Buildmg doses were not calculated since the contauunent is not open.
To estimate the doses in the buildings, the average release fraction of each chemical group was determined for each building. The integrated concentration of each radionuclide in the buildings was then based on the average release fraction of its chemical group and the amount of time spent in that building. Using the integrated concentration for each radionuclide, the immersion and 50 year committed inhalation dose were calculated over the entire exposure time. ;In addition, the immersion and 50 year committed inhalation dose were calculated for the first 30 minutes of exposure. These doses should be viewed with caution since the integrated concentration in the building was based on an average concentration in the building and therefore the time dependence of the dose is not well represented. The final result estimated in the 25
, . . ..~ . . . . . .. - m., , ~
m, y s buildings was a dose rate. These results should also be viewed with caution since they are also ; j
; based on average concentrations'in the building 'In addition, the dose rates were calculated.by dividing the total dose during a release segment by the transit time through the building. This results in a conservative estimate of the inhalation dose rate. ' The mean dose due to the entire release, the first 30. minutes of exposure, and the mean dose rates during the first and second j
> release segments in the containment are shown in Table 4.1.1-2 for each of tne paths through. l
. the APET. Similar estimates are shown in Table 4.1.13 foi :hf aaMary building. , Table 4.1.1-2. Grand Gulf POS 6 mean containment doses aiid dose rates. - Accident Path Conditional Consequence Measure . Progression Path Probability Number 30 minute Dose Dose Rate First Dose Rate second Total Dose (rem) (rem) segment (rem /hr) segment (renVhr) b LosP PDS c Path 1 0.10 1.81E + 6 2.69E + 5 5.38E + 5 0.0
>i Path 2 0.48 4.27E + 7 6.35E + 6 1.27E + 7 0.0 r Path 3 0.08 4.27E + 7 6.35E + 6 1.27E + 7 0.0 i
.?
Path 4 0.02 5.38 E + 6 7.95 E + 7 1.59E+ 8 0.0 Path 5 0.09 5.69E + 8 7.95E + 7 1.59E + 8 4.04E + 7 i Path 6 0.003 4.27E + 8 6.35E+7 1.27E + 8 0.0 . { Path 7 0.01 4.66E + 8 6.35E + 7 1.27E+ 8 J - 5.05 E + 7 - Path 8 0.18 6.16E+ 8 l 7.95E + 7 1.59E + 8 1.01E + 8 Path 9 0.03 5.25E + 8 6.35E + 7 1.27E + 8 1.26E+ 8 nonLosP PDS - Path to 0.16 5.78E + 8 6.35E + 7 1.27E + 8 7.74E + 7 N Path 11 0.02 4.88E + 8 5.05E+7 - 1.01E + 8 - 9.68E + 7 Path 12 0.16 6.16E + 8 7.95 E + 7 1.59E + 8 1.01 E+ 8 ' Path 13 0.02 5.25E + 8 6.35E + 7 1.27E+ 8 - ' l .26E + 8 . Path 14' O.37 NC NC NC NC-f Path 15 0.23 6.16E + 8 7.95E + 7 1.59E + 8 ' l .01 E + 8 Path 16 0.04 5.25E+ 8 . 6.35 E + 7 1.27E + 8 ' 3.26E + 8 8 Duildmg doses were not calculated smce the containment is not open. 26 < s< w,. ,,4 ~+-,-n-,-e ~ . , . , - - v, .- , - -. - .n -- a - n- w
P Table 4.1.1-3. Grand Gulf POS 6 mean auxiliary building doses and dose rates. Accident Path Conditional Consequence Measure Progression Path Probabihry Number Total Dose (rem) 30 rninute Dose Dose Rate First Dose Rate second (rem) Segment (rern/hr) Segment (rem /br) LosPPDs Path 1 0.10 9.41 E + 5 7.70E + 4 1.54 E + 5 0.0 Path 2 0.48 2.13E + 7 1.74 E + 6 3.47E + 6 0.0 Path 3 0.08 2.13 E + 7 1.74E + 6 3.47E + 6 0.0 Path 4 0.02 2.80E + 8 2.28 E + 7 4.56E + 7 0.0 Path 5 0.09 2.98E + 8 2.28 E + 7 4.56E + 7 1.31 E + 7 Path 6 0.003 2.20E + 8 1.79E + 7 3.59E + 7 0.0 Path 7 0.01 2.43E + 8 1.79E + 7 3.59E + 7 1.64E + 7 Path 8 0.18 3.23E + 8 2.28E + 7 4.56E + 7 3.06E + 7 Path 9 0.03 2.74E + 8 1.79E + 7 3.59E + 7 3.83E +7 nontosP PDs Path 10 0.16 0.0 0.0 0.0 0.0 Path 11 0.02 0.0 0.0 0.0 0.0 Path 12 0.16 0.0 0.0 0.0 0.0 Path 13 0.02 0.0 0.0 0.0 0.0 Pas 14' O.37 NC NC NC NC Path 15 0.23 3.23E + 8 2.28E + 7 4.56E + 7 3.06E + 7 Path 16 0.04 2.74E + 8 1.79E + 7 3.59E + 7 3.83E + 7
' Buildmg doses were not calculated since the containment is not open.
To illustrate the uncertainty in the dose rate in the containment and the auxiliary building due to the uncertainty in the source term, the 5*,50*, and 95* percentile dose rates as well as the mean dose rate for two pathways through the APET are shown in Figure 4.1.1-1. The first of these paths represents a scenario in which injection is recovered very early in the accident, thus arresting core damage. Note that in the recovered accident, CCI does not occur therefore the source term consists of only one segment and only one dose rate was calculated. The second path represents a scenario in which full core damage occurs. 27 o
L L. -Hullding Dose Rates for Recovered Accident (Path 1) and Full Core Damage Accident (Path 8) 1080 , , , , , , Full Core Damage Accident Catment Aus. Bldg I 10e e let Reten ee and Reteeso ist Release 2nd Release , 95th . 10s - u,.. o 3 7 60th - 4l 4 . 3 { 107 - Recovered Accident g
$ Catment Ava Bids Stli .
5 10e . 3 g o - E p ' 105 r , t 04 r , 103 Figure 4.1.11. Containment and auxiliary building dose rates for selected paths 4.1.2 Parkine let Doses The dose due to immersion and inhalation was also estimated for several distances from the reactor. The source terms were obtained from the parametric source term code, GGLPSOR. In contrast to the building doses, the timing of the source terms was taken directly from GGLPSOR. For comparative purposes, three different wake effect models were used to estimate the relative concentrations downwind of the reactor. These models were developed by Ramsdell [11], Wilson [12], and the NRC [13]. For simplicity, the directional dependence of the weather u , was ignored and doses were calculated for several distances from the reactor. The weather used - in each of the wake effect.models was chosen to represent conservative values for the model. L
'In the case of the Ramsdell model the relative concentration is somewhat proportional to the wind speed and the stability class. For this reason the highest wind speed and the corresponding -
stability class in a year of weather data at Grand Gulf was chosen as input to this model. In addition, the relative concentration is predicted to be somewhat inversely proportional to the area of the building, therefore, the minimum area was utilized. In the case of the Wilson and NRC models the relative concentration is predicted to be inversely proportional to the wind speed. 28
Therefore, a wind speed of 1 m/s and a stability class of F (i.e., moderately stable meteorological conditions) were used in these models. Using the integrated air concentrations for each building wake effect model, the dose and dose rate due to immersion and inhalation for the entire source term was determined for each of the unique accident progression paths. As with the building dose rates, the dose rates in the parking lot are very conservative since the inhalation dose rate was determined by dividing the 50 year committed dose by the exposure time. The dose due to 30 minutes of exposure was also estimated. Table 4.1.2-1 contains the mean total dose, 30 minute dose, and dose rates for each segment of the release based on the Ramsdell building wake effect model at 100 meters from the reactor. Similar estimates of the mean doses and dose rates at 100 meters based on the Wilson model is shown in Table 4.1.2-2. , Table 4.1.2-1. Grand Gulf POS 6 mean doses and dose rates at 100 m based on the Ramsdell building wake effect model. Accident Path Conditional Consequence Measure Progression Path Probabihty Number Total Dose (rem) 30 mmute Dose Dose Rate First Dose Rate second (rem) segment (rem!hr) segment (rem /hr) LOsP PDs Path I 0.10 4.23E + 2 8.80 17.6 0.0 Path 2 0 48 9.42 E + 3 1.09E + 3 2.19E + 3 0.0 Path 3 0.08 9.42 E + 3 1.09E + 3 2.19E + 3 0.0 Path 4 0.02 1.32E + 5 1.53 E + 4 3.06E + 4 0.0 Path 5 0.09 173E + 5 1.53 E + 4 3.06E + 4 4.08 E + 3 Path 6 0.003 1.(M E + 5 1.21E + 4 2.43 E + 4 0.0 Path 7 0.01 1.55E + 5 1.21 E + 4 2.43 E + 4 5,10E + 3 Pa:h 8 0.18 2.16E + 5 1.53E + 4 3.06E + 4 8.44E + 3 Path 9 0.03 2.10E4 5 1.21 E + 4 2.43E + 4 1.05 E + 4 . nontosP PDs Path to 0.16 2.26E + 5 3.41 E + 4 6.83E + 4 8.94 E + 3
]
Path 11 0.02 2.19E + 5 2.68E + 4 5.37E + 4 1.12 E + 4 Path 12 0.16 5.24 E + 5 3.20E4 5 6.22 E + 6 2.13 E + 4 Path 13 0.02 5.10B + 5 2.56E + 5 4.88E + 6 2.66E + 4 Path 14 0.37 0.899 5.2$E 2 0.105 4.50E 2 Path 15 0.23 2.16E+ 5 1.53E + 4 3.06E + 4 8.4tE + 3 Path 16 0.04 2.10E + 5 1.21 E + 4 2.43 E + 4 1.05 E + 4 29 I
? ,
.h,
' Table 4.1.2-2. Grand Gulf POS 6 mean doses and dose rates at 100 m based on the Wilson building wake effect model.
Accident Path Conditional . ~ Consequence Measure Progression Path Probability
- Number Total Dose (rem) 30 minute Dose ' Dose Rate First Dose Rate second (nm) segment (rem /hr) segment (rem /ht)
' LoSP PDS l
Path 1 0.10 9.48 E+ 3 1.97E + 2 3.95E + 2 . 0.0 Path 2 0.48 2.l lE + 5 2.45 E + 4 4.91E + 4 0.0 - Path 3 0.08 2.1 I E + 5 2.45E + 4 4.91 E + 4 0.0 - Path 4 0.02 2.95 E + 6 3.43E + 5 6.86E + 5 0.0 Path 5 0.09 3.56E + 6 3.43E + 5 6.86E + 5 9.14 E + 4 ' Path 6 0.003 2.34 E + 6 2.72E+ 5 ' 5.44E + 5 0.0 ' Path 7 0.01 3.48E + 6 2.72 E + 5 5.44E + 5 1.14E + 5 - Path 8 0.18 4.84 E + 6 3.43E + 5 6.86E + 5 1.89E + 5 Path 9 0.03 4.70E+ 6 2.72 E + 5 5.44E + 5 2.36E + 5 nonLOsP PDs Path 10 0.16 5.06E + 6 7.65E+ 5 1.53E + 6 2.00E + 5 l Path 11 0.02 4.91 E + 6 6.00E+ 5 ' 1.20E + 6 2.50E +5 Path 12 0.16 1.17E + 7 7.16E+6 1.39E + 8 ~ 4.77E+5 Path 13 0.02 1.14E + 7 5.72E + 6 1.09E + 8 5.%E+5 Path 14 0.37 20.1 1.17 2.34 1.01 Path 15 0.23 4.84E + 6 3.43E+5 6.86E + 5 1.89E + 5 l- l Path 16 0.04 4.70E + 6 2.72 E + 5 5.44 E + 5 2.36E'+ 5 Figure 4.1.2-1 contains the 5*,50*,95* percentile as well as the mean parking lot dose rates.~ ; for the first release for both the Ramsdell and Wilson / Regulatory Guide models for distances of 10 - 500 meters from the reactor. A similar plot for the second release is shown in Figure M 4.1.2-2. The uncertainty in both the building wake effect models and the source term is shown - by the wide range of dose rates at each distance. 4.2 Offsite Conscauences 0 1
- The MACCS code [5,6,7] was used to estimate the consequences' to the general public. MACCS' models the transport and dispersion of plumes of radioactive material released from the plant.
As the plumes travel through the atmosphere, material is deposited on the ground. Several of the pathways through which the general population can be exposed are considered. Emergency 1 I 4 30 l 1 a.-.
.? -
(Q i
}s e s ,. r if;- '
t..,,.. [f "
.3 h
. Fint Segment (Path 8) .
K ' 8 0e , , , i i. j
- i. 95th -
gos , 4 Remedell 3
.,Mean .A , Tdson . -
"50th "
! .- 1 01 -
]
T - 4 5th o l 1 08 - 1 e o : . 5 o - 106 -
-3
- i. " "
t h - 104 - il 1 - lt ti 1 08 1 1 08 10 W S0 W 100 W 250 W 600 W otet.nce ena ae.etor U Figure 4.1.21. Parking Lot dose rates for Ramsdell and Wilson / Regulatory Guide models for distances -t from 10 - 500 meters from the reactor: First Release Segment Second Segment (Path h) 3p- ., , g3g q l diMean 4 R.msdell - s 10' - A' Tuton 1 60th , t 1 08 ,, 1 T ~ d' 1, ,5th 1 08 A o. o : 3 104 . r <>
,' ~1 q>
E. i' 5 108 -
'1 a C .
102 -
.]
108 .-
]
i e gy , i i 10 W 60 W 100 W 250 W . 600 W - Dietence from Reactor ,; Figure 4,1.2-2. Parking Lot dose rates for Ramsdell and Wilson / Regulatory Guide models'for distances ,
- X
- from 10 500 meters from the reactor: Second Release Segment 31
,rj i.
t j s y n.r. . .' ..U... e. - - , eui . ~v2
response and protective action guides are also considered as means to mitigate the extent of the public exposure. The input used in this study is identical to that used for Grand Gulf in the NUREG-1150 study [9] with the exception of the core inventory for which the inventory four days after shutdown was used and the source terms which resulted from GOLPSOR, The emergency response assumptions were not changed for this analysis, Table 4,2-1 contains the estimated mean number of early fatalities, latent cancers, 50 mile population dose, and 1000 mile population dose for the sixteen paths through the APET along with the conditional probability of that path, The mean number of early fatalities ranged from 0 to 3,9 x 10-2 while the mean number of latent cancers ranged from 0 to 1940, Table 4,2-1 Grand Gulf POS 6 Offsite Mean Consequences Accident Path Consequence Measure Progression Conditional Path Number Probability Early Total Latent 50 rnile Population 1000 Mile Fatahties Cancers Dose' Pop, Dose' LOsPPDs Path 11 0.10 NC NC NC NC Path 2 0.48 1,3E 5 102 77,000 591,000 Path 3 0.08 1,3E-5 102 77,000 591,000 Path 4 0.02 4.8E.3 684 330,000 4,010,000 Path 5 0.09 4.8 E-3 984 4 % ,000 5,800,000 Path 6 0.003 4.0E-3 588 293,000 3,450,000 Path 7 0 01 4.0E 3 940 479,000 5,560,000 Path 8 0.18 5 2E-3 1270 652,000 7,480,000 Path 9 0.03 4.7E-3 1260 662,000 7,460,000 nonLosP PDs l Path 10 0.16 8.9E-3 1190 624,000 7,090,000 Path 11 0.02 9.3E 3 1200 640,000 7,130,000 Path 12 0.16 3.7E 2 1920 939,000 11,300,000 Path 13 0.02 3.9E-2 1940 966,000 11,$00,000 Path 14' O.37 NC NC NC NC Path 15 0.23 5.2E.3 1270 652,000 ~ 7,480,000 , Pa;h 16 0.04 4.7E-3 1260 662.000 7.460,000 Tabic Notes:
' Dose is in Person Rem 3
offsite consequences were not evaluated for these paths because the offsite consequences associated with these paths were assessed to be negligible.
- 32
5.0 INTEGRATED RESULTS CONDITIONAL ON CORE DAMAGE In the previous section the consequences associated with individual accident progression paths were presented. In this section the offsite consequences conditional on the occurrence of the LOSP PDS and the nonLOSP PDS are presented and are compared to full power PRA results extracted from the Grand Gulf analysis presented in NUREG-1150. Onsite consequences were not evaluated in NUREG-1150 and, therefore, an analogous comparison is not provided. The consequences 1 e a given PDS are calculated by taking a weighted average of the consequences for the individual paths. The weighted average is based on the conditional probability of each path. The PDS consequence is the sum of all of the " weighted" path consequences for the given PDS. The offsite consequence distributions associated with the LOSP and nonLOSP PDSs are presented in Figure 5.1. Because a relatively small LHS sample was used in the evaluation of offsite consequences, the presentation of exact quantiles (i.e.,95*) is inappropriate. Instead of quantiles, the high, low, median, and mean values are presented in this figure. From this figure it can be seen that the consequences associated with the nonLOSP PDS tend to be higher than the consequ:mces associated with the LOSP PDS. This stems from the assumption that injection cannot be recovered in the nonLOSP PDS and, therefore, all of these accidents proceed to full. core damage and CCI Although the probability that the containment is closed during this PDS is significant, the lack of a means to control the containment pressure results in a significant probability of early containment failure. Containment failure bypasses the auxiliary building and - results in, essentially, an unmitigated release. Also presented in Figure 5.1 are the conditional consequences from the Grand Gulf full power PRA. The full power results are for internal events and are " averaged" over all of the accidents analyzed in the study. In addition to the global consequences, the mean consequences associated with a selected full power accident are also presented (i.e., triangle on'the full power distribution). This selected accident is a fast station blackout that progresses to full core damage. The containment is ruptured during core damage; the containment sprays are ; unavailable throughout the accident. Thus, this accident is similar to the accidents analyzed in 'j this abridged study in that many of the mitigative features of the plant (i.e., the containment and sprays) are unavailable. In this full power accident, however, the in-vessel releases are typically scrubbed by the suppression pool. From Figure 5.1 it can be seen that the number.of early fatalities associated with POS 6 are very similar to the number of early fatalities associated with full power accidents. This may seem somewhat surp- ing at first because the inventory of radionuclides important to early fatalities during POS 6 is less than the inventory at full power. However, this difference is compensated by the lack of mitigative features in POS 6. In POS ' .; 6 the inventory has been reduced by decay but because of the lack of mitigative features, a i significant amount of the radionuclides are released to the environment. In the full power l accidents, on the other hand, there is a large inventory, however, mitigative features of the plant ~ limited the size of the release. In full power accidents, for example, a considerable fraction of these radionuclides are retained in the suppression pool. The net effect is that the number of 33
. carly fatalities is roughly the same. The number of latent cancers associated with POS 6.
~ accidents is greater than the number oflatent cancers associated with full power accidents. The radionuclides that are important to latent health effects are long lived isotopes and, therefore, four days of decay will not have a significant impact on the radiological potential of the release to cause latent cancer fatalities. Thus, the magnitude of the release is the driving factor for latent cancer fatalities. Because in POS 6 the releases tend to be higher than the full power accidents, the number of latent cancers associated with POS 6 are greater than the number of latent cancers associated with full power accidents. The factors that influence latent cancers also affect the population dose.
'I
}
l i i l 1 34 l
- p. . - - .. > + . , .
.r.
_s._ r ~,.. , [."
, .1 '
g I N I
'% f o
- r I- !
< ' 'i Early Fatalit'les Total Latent Cancers ,
a Ib-8 : , ,
~
o"r .. - H
* ~
103- - o una jM u sSth ,: 10** r , .u _ e
,d -
E o Mon -
- E <> Ween 2 y- -
s 4 -
,t 3 ' il Mean e'- " """
10-8 m e
- *L 6ett -
. Mth _
- r. i....
s y .L. - 2 - 103 - 10-4 r s 6
- 6 s
I
* .62 10-6 - s : -
i
- a 3
g 6th _ 108 10-8 LOSP nonLOSP NR-il50 IDSP nonLOSP NR-il50 pula n a 1 og mHu Wejun Rem) 104 pulau n w 0 yn Wnon km) .
' 107 n : -
'N :
?
t 4 -
'N -
6 ,, Wean
.H 6 g
- o unn e W -
4 g '95th - d'
, , , Mean $; 95th , ,
W W
.t L
- a -
O M"* 1g o una .. tL ' SOS
. soth 1 05 106 9 7
- s e
~
6
~
0 < j
- 4 ;7 4
s J Sth' - s 1 04- 105 LOSP nonLOSP NR-il50 LOSP nonLOSP NP.-Il50 '
- r. woo-scr.ts ..cs 4.- ;
Figure 5-1. Grand Gulf POS 6 offsite consequences for LOSP and nonLOSP PDSs
't 35 $
A I
6.0 INSIGHTS AND CONCLUSIONS The results and insights presented in this study are conditional on the occurrence of core damage. Thus, this study gives no indication about the likelihood of these postulated accidents, but rather what could be expected given that core damage does occur. The input to this analysis' is the core damage sequence definitions from the Level I coarse screening analysis. In this .' Ixvel 1 scoping analysis conservative assumptions were made with regard to the availability of certain systems and the performance of the plant operators. These assumptions provided the necessary simplifications such that the dominant sequences could be identified and still keep the scope of the study manageable. While the calculated frequencies from the Level 1 study are used to rank the sequences, the absolute values of these frequencies were not reported due to the . conservative nature of many of the necessary simplifications. Thus, frequencies were not propagated through to the Level 2 and 3 analyses. It is within this framework that the abridged study was performed. Therefore, when interpreting these results it must be remembered that frequency information is not available to indicate the likelihood of accidents and simplifying assumptions were made in both the Level 1 and the Level 2/3 studies. The following is a list of insights obtained f om this study: o During POS 6 the majority of the mitigative features of the plant are bypassed or are unavailable. The vessel and drywell are open to the containment and, thus, the suppression poolis effectively bypassed. Furthermore, the containment spray system is unavailable during these accidents. Thus, steam and radionuclides are released directly into the containment atmosphere without being scrubbed by either the suppression pool or the contaimnent sprays. i For the accidents in which the containment hatch is removed, the only significant. plant mitigative feature is the deposition that occurs in the auxiliary building. If the containment is closed but then fails during core damage, the auxiliary building is also bypassed. ; o Because of the lack of mitigative features associated witn these accidents, the source terms tend to be quite large. , o The consequences associated with these accidents are also significant. Offsite consequences are comparable with consequences associated with full power accidents. Onsite consequences are large. o The time from the accident initiation to the onset of core damage is significant (i.e., from 18 to 28 hours). Thus, there is a considerable amount of time to restore core cooling and to close the containment. If offsite ac power is available, it is likely that the operators will close the containment prior to core damage. I o The pressure suppression features (i.e., suppression pool and containment sprays) of the Mark III design are bypassed during POS 6. Since the ultimate pressure capacity of the, containment is fairly low, the plant is vulnerable to pressurization events accornpanying vessel failure and 1 36 1
l j 4 3.- associated with hydrogen burns. Failure to avoid or mitigate pressure excursions from these events could result'in early containment failure. o Because of the large recovery potential associated with these accidents (i.e., which were not fully accounted for in either the level I analysis or' this abridged analysis because of . simplifying assumptions), POS 6 offsite risk could be significantly lower than the risk associated with full power accidents. o Recovered accidents can pose a significant threat to onsite personnel. o Because of the lack of mitigation features associated with accidents initiated in this POS, the auxiliary building and the SBGTs could play a significant role in the mitigation of the release, especially for recovered accidents. There were many issues that were identified in this study that could affect the possible accident progressions and consequences. The resolution of many of these issues was beyond the scope of this abridged analysis and will have to be addressed in any more detailed analysis that is performed in the future. The following is a list of potentially significant issues: o Containment Closure. The effects that the temperature, humidity, and radiation have on the plant personnel's ability to close the containment needs to be addressed in more detail. Containment closure is a critical issue that will affect the consequences associated with these . accidents. o Containment Loading. Hydrogen combustion phenomena ' associated with this plant configuration need to be investigated. In this plant configuration steam and hot hydrogen are released directly into the containment atmosphere. The amount of steam blanketing and air ingression and the availability of ignition sources will all affect the likelihood and magnitude of hydrogen burns. The effectiveness of the hydrogen ignition system in this plant configuration also needs to be investigated. Tne loading from in-vessel steam explosions is another issue that needs to be addressed. With the vessel head off in this POS and the relatively low failure pressure of this containment, in vessel steam explosions could be a significant mechanism for early containment failure. o Source Term. There are several events that can enhance the source term that were not included in the PRA model. First, the role that air ingression plays'during core damage needs to be investigated. If significant air ingression does occur, the in-vessel phase of the core damage process could be significantly altered and the release of certain radionuclides enhanced. Second, the relocation of intact fuel from an in-vessel steam explosion could also result in the enhancement of an early source term.' This issue was not addressed in this' analysis. Third, for recovered accidents the embrittlement and failure of the clad could lead to a release earlier than what is currently modeled. This' could be particularly important for onsite consequences. i 37
- p. , , , 7 ,
. z ,t . ,
, ?
-[ _, jf ,
}
- w..t . s "
)
,. -2 j
.o Auxiliary Building. For accidents in which the containment is open during core damage, thel
, 9- ' auxiliary building could play a major role in mitigating the release. The radionuclide retention capabilities of this building need to be assessed in more detail than what was done in this.
. abridged analysis. Furthermore, the effectiveness of the SBGT system to mitigate the release,-
especially for recovered accidents,' also needs to be assessed.' ;
, j o Onsite Consequences. Only 'a scoping type analysis of onsite consequences was performed
, in this study; In the calculation of doses in the building, the integrated concentrations'were based on average' concentrations from GGLPSOR and on crude estimates 'of the residence
- times in the buildings. More detailed information on the concentration as a function of time and on the residence time would produce more realistic dose estimates. .
t 4 1 P t 7 l f
.k
-i n
I 38 1
- - y ,- J4e
r,
- q
7.0 REFERENCES
- 1. U.S. Nuclear Regulatory Commission, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," NUREG-1150, Vols.1-3, December 1990 -January 1991.
- 2. R. M. Summers, et al., "MELCOR 1.8.0: A Computer Code for Nuclear Reactor Severe Accident Source Term and Risk Assessmen; Analyses," NUREG/CR-5531, SAND 90-0364, Sandia National Laboratories, January 1991.
- 3. R. L. Iman, "A FORTRAN 77 Program and User's Guide for the Generation of Latin Ilypercube and Random Samples for Use with Computer Models " NUREG/CR-3624, SAND 83-2365, Sandia National Laboratories,1984.
f
- 4. P. Cybulskis, " Assessment of the XSOR Codes," NUREG/CR-5346, BMI-2171, Battelle Columbus Division, November 1989.
- 5. D. I. Chanin, et al., "MELCOR Accident Analysis Consequence Code. System,"
NUREG/CR-4691, SAND 86-1562, Sandia National laboratories, Vo? 1. February 1990.
- 6. II-N Jow, et al., "MELCOR Accident Analysis Consequence Code System,"
- NUREG/CR-4691, SAND 86-1562, Sandia National Laboratories, Vol 2, February 1990.
- 7. J. A. Rollstin, et al, "MELCOR Accident Analysis Consequence Code System," .
NUREG/CR-4691, SAND 86-1562, Sandia National Laboratories, Vol 3, February 1990.
- 8. D. W. Whitehead, et al., "BWR Low Power and Shutdown ' Accident Frequencies Program: Phase 1 - Coarse Screening Analysis," Vols.1-3, Draft letter Report, October 1991 - November 1991. Available in the NRC Public Document Room,2120 L Street, NW.
- 9. T. D. Brown, et al., " Evaluation of Severe Accident Risks: Grand Gulf Unit 1,"
NUREG/CR-4551, SAND 86-1309, Vol. 6. Rev.1, Sandia National Laboratories, December 1990.
- 10. A. G. Croff, et at, "ORIGEN2: Isotope Generation and Depletion Code," RSIC, Oak Ridge National Laboratory, Oak Ridge, TN, CCC-371, September 1989.
- 11. J. V. Ramsdell Jr., " Diffusion in Building Wakes for Ground-level Releases,"
Atmospheric Enviromnent, Vol. 24B, No. 3, pp 377-388.1990. 39 m
t
- 12. Wilson in' " Atmospheric. Science and Power Production," Ed. Randerson, D., ,
. DOE / TIC-27601, 299 (1984).
- 13. U. S. Nuclear Regulatory Commission, Regulatory Guide 1.145, Revision 1, November 1982. ,
'I h
l 40 i i
'I
,, 'r A RIGO f.k %, c . 5 :h POLICY ISSUE October 1, 1991 SECY-91-309 For: The Conmissioners From: James M. Taylor Executive Director for Operations
Subject:
DRAFT SAFETY EVALUATION REPORT ON THE GENERAL ELECTRIC BOILING WATER REACTOR DESIGN COVERING CHAPTER 19 0F THE STANDARD SAFETY ANALYSIS REPORT, " RESPONSE TO SEVERE ACCIDENT POLICY STATEMENT"
Purpose:
To inform the Conmission of the staff's intent to issue Chapter 19 of the draf t safety evaluation report (DSER) on the General Electric Company's (GE's) advanced boiling water reactor (ABWR) design. The staff's DSER addresses open items needing closure as identified by the stuff's review of Chapter 19 of GE's Standard Safety Analysis Report (SSAR). b F _Ba ckground: In SECY-91-1S3, "Draf t Safety Evaluation Report on the General Electric Company Advanced Boiling Water Reactor Design Covering Chapters 1, 2, 3, 4, 5, 6, and 17 of the Standard Safety Analysis Report," the staff discussed the ABWR review process and the Commission guidance that it is following. Discussion: The enclosed DSER addresses the ABWR Probabilistic Risk Assessment (PRA) discussed in SSAR Sections 19.1 through 19.6 and Appen-dices 190, 19E, 19H, 191 and 1*.,J. The issuance of this report, will facilitate the resolution of a number of open items identi-fied by the staff's review. The staff is contii.uing its review of Chapter 19 and will issue supplements to this DSER to document the review and evaluation of the appendices not presently included. This DSER focuses significant attention on the quality of the ABWR PRA rather than on insights developed from the PRA. The staff believes that knowledge of how PRA insights were employed in the ABWR design underscores the significance of design features NOTE: TO DE MADE PUBLICLY AVAILABLE CONTACTS: OCTOBER 4, 1991 V. McCree, NRR X21121
/
D. Scaletti, NRR X21104
]Q h 3
v. 3
.ig ' .
!. The Comissioners which eliminate dominant contributors to the estimated core damage frequency and offsite consequences, and facilitates a balancing of preventive and mitigative design features. In its remaining review of the SSAR, the staff will include an assessment of (1) how GE used PRA insights in the ABWR design process, (2) what ABWR design features, if any, GE included as a result _of PRA insights to reduce risk significant sequences and phenomena, (3) how GE factored plant operating experience into the ABWR PRA, and (4) how GE used PRA insights to address severe accident phenomena. The staff is currently engaged in dialogue with GE to reach closure on open items which have been identified from the staff's review of other ABWR SSAR chopters. The staff believes that resolution of some open items may be advanced by the PRA and has begun an examination of these open items using PRA insights. The staff also expects GE to employ PRA insights to support issue resolution. The staff will provide copies of this DSER to the Advisory Comittee on Reactor Safeguards.
Conclusion:
The staff concludes that the enclosed DSER contains no' new policy issues. However, GE has not provided sufficient information in
;]'
many areas to allow the staff to assess the reasonableness of the ABWR risk estimates and the effect of certain severe accident phenomenological issues. In writing the final safety evaluation report for the ABWR, the staff will discuss the status of all issues includir,g those issues previously open, but subsequently resolved. Senior NRR technical staff plan to meet with GE at San Jose on-October 8, 9 and 10, 1991 to discuss the-issues identified in this DSER. The staff plans to issue this DSER by October 4, 1991 to facilitate those discussions. The staff would also place the enclosed DSER in the NRC Public Document Room at.that time. Coordination: The Office of the General Counsel has reviewed this paper and has no legal objection.
/
,' m'es"M.Tpybor xecutive Director for Operations
Enclosure:
DSER Chapter 19 DISTRIBUTION: 1 Commissioners OGC EDO j ACRS l OCAA ASLFP ; OIG SECY ! GPA b
f,yi$ ', ,, ; ,a 1 - u , g# [ W < ' 4
.o'
.: .;.'+ ., -. s -,
! <;g t ps, ,
n , . f..
,I ENCLOSURE'
' i: I
-j s
i e DRAFT SAFETY EVALUATION REPORT .i.
'ON CHAPTER 19 OF THE GENERAL ELECTRIC COMPANY'S' APPLICATION..
FOR CERTIFICATION OF THEIR ADVANCED' BOILING WATER REACTOR DESIGN I' prepared by the O'E ' Office'of Nuclear Reactor Regul'ation , , g, U.S. Nuclear" Regulatory Commission' September 1991 M
,e i r ' ,,
t i af i
.j s ?
-i
'l i
n
..a; f :
. . _f I'
- ~ '
[i o < o .d.
4 1 s
- 19. PROBAmT.TRTIC RISK ASSESSMENT IIST OF TAMFS ,......................,,.... yli IJST OF FIGURES . . . . . .. . .. ............ .. ..... ix
,f , -
19.1 DTIPODUCTIQi ........................... 1 1 1.1 Background .. .................... .. .. 1 1.2 Licensing Review Bases .............. ..... 1 1.3 Review Cbjectives . . . . . . . . . . . . . . . . . . . . . . 3 1.4 Review Proocss .............. ......... 3 19.2 RISK-SIQiIFICANT AIER EESIGI FFMt.1RIE . . . . . . . . . . . . . .. 6 2.1 AIER Safety System Featurns . . . . . . . . . . . . . . . . . 6 2.2 ADWR Human-System Interfaces ......... . ...... 11 2.2.1 Introducticn . . . . . . . . . . . . . . . . . . . . . 11 2.2.2 Gereral Description of the AIMR Human-System Interfaces . . . . . . . . . . . . . . . . . . . . . . 12 2.2.3 Risk Significant control Roca Innovations ...... 14 2.3 control Rocn Technology Innovaticos . . . . . . . . . . . . . 18 19.3 CA14UIATION OF CORE DAMAGE FREQUDiCY CUE 'IO DTTEPJ&LIX DTITIATED EVDTIS .............................. 21 3.1 Introductico .............. .......... . 21 3.2 Initiating Event Frequency ................. 21 3.3 Sucocas Criteria ............ ..... .... . 23 3.4 Acx:Ident Sequenm Definitico ...... .. .... .... 24 3.5 System Modeling . . . . . . . . . . . . . . . . . . . . . . . 25 l 3.6 Data Analysis . . . . . . . . . . . . . . . . . . . . . . . . 27 j 3.6.1 Hardware Reliability Data Analysis . . . . . . . . . . 27 3.6.2 M and Maintenance Data ADalyS15 . . . . . . . .... 28 I 4 L a
_ - .. . , . . . - . .s [',f.-' .,
.,, I\'
13 c p.1,
# l' +
. -' 'i
; 'f. 'a ,.
,..'[- -
a , 3 "4;$ ', r (1 . , : e 3.7 Human Reliability Analysis . . . . . . . . . . . . . . . . . , . 28 3.7.1 HRA Review Methodology . . . . . ' . . . . . . . . . . . . 29
, 3.7.1.1 ABWR PRA/HRA Review Critaria . . . .:.m . . . '29 .-(
3.7.1.2 h nantation Sources ..........c. . 30 M 3.7.2 HRA Review Results'. . . ... . . . . . . . . . . . . . . . 31 3.7.2.1 WM arx1 Coupleteness of the W=antaticx1 . . ............. .
' 31' 4-3.7.2.2 Mstarial Available to Support the HRA . . . .33 3.7.2.3 Human-System Analyses M rformed . . . . . .
~
33" 3.7.2.4 Types of Human Task Acticais' Analyzed . . . 33 s 3.7.2.5 MaqM of.the Human Action Madalling . . ' 34' , 3 3.7.2.6 Quantification Methods Used to Estimate Human D ror Probabilities . . . .-. ..... . 34- : 3.7.2.7' Performance Shaping Factors.Evaluatad' .- . .. 34' 3.7.2.8 Treatment of Advanced Technology . . . . . .- . 35 .. 3.7.2.9 Generic Human Error Data Sources . . . . . . 35 3.7.2.10 Generalization frun Earlier PRAs . . . . . . -35 3.7.2.11 Sensitivity and Uncertainty Modelling Approach . . .....:. . . .... . . . ._. . .. .36 ^ 3.7.2.12' . Insights Gained' from the Analyses .:..... . .. . :.36 - + 3.7.3- HRA Review Conclusions . .e.,..... . . . . ... . ... . . 36-3.8 Quantification of Accident Sequence Frequencies . ..:. s. .. .. .. 37' .
. 3.9 Quantification of Accident Sequence Class Frequencies..J. .:.:, 37:
- j. 3.10 Sumary of GE's Estimates of Core Da:E e' Frequency ,
L Due to Internally Initiated Events . .n...;.,...,.,;.;.:.... 38; ii ~ r-3.10.1 Initiating Events and Principal ' Contributors '. . .- . ,. . 38- . f 3.10.2 Accident Sequences . . . . . . . . . . ... '. . . .t. . 39-3.10. 3 Observaticals . . . . . . . . . . . . . . . . '. . . ;- . . 39'- 3.10. 4 Conclusion . . . . . . . . . . . . . . . - . . . . . . , , 41' s l:
.n 19-11 @ l j g -
- p. . . - -- , _ _ . . ~ _ _ _ _ _~ _.c e_ _l?4 -
J t. L . i. " 19.4 CAICHATI0ti OF CORE DAMAGE FREE, U DCl DUE 'IO EXTERNAUX INITIATED EVDTIS ............................... 49 4.1- Introduction and Paview of the Socpe of External Event Analyses in the AEHR PRA
. . . . . .. . . . . . . . . 49 4.2 Tornado Strike Analysis . . . . . . . . . . . . . . . . . . . 51 4.3 Selsmic Events ....................... 52 4.3.1 Introduction and Overview . . . . . . . . . . . . . .
52 4.3.1.1 AIER IPA Approach and Assunptions . . . . . 53 4.3.1.2 Ocupariscri with the AIMR Requil-ruds rw ,= ant . . . . . . . . . . . . . . . . . . 54 4.3.1.3 Overview of ABWR PRA Results . . . . . . . . 54 4.3.1.4 Review Approach . . . . . . . . . . . . . . 55 4.3.2 Hazard Analysis ................... 56-4.3.2.1 ABWR PRA Hazard . . . . . . . . . . . . . . 56 4.3.2.2 Hazartl Review Approach . . . . . . . . . . . . 57' 4.3.2.3 Evaluation of AIMR PRA Hazard . . . . . . . 57 4.3.3 Fragility Analysis . . . . . . . . . . . . . . . . . . .57 4.3.3.1 ADWR Appreadi ............c. . . '57 4.3.'3.2 Review and'valuatict) E . . . . . . . .. . . 59 , 4.3.3.3 Summary Evaluaticr1 of Fragilities . . ... .' 65 4.3.4 System Modeling .......... ,........ 66 4.3.4.1 Seismic Fault Trees . . . . . . . ... . . . 66 ' 4.3.4.2 Seismic Event Trees . . . . . . ' ' . . . .. . . 67 g
.g 4.3.4.3 Sunmary Evaluation of SysF/m Modeling . . . 68 4.3.5 Accident Sequence Definitia) . .. . . . . .. . . . .. 68 4.3.6 Quantification of Accident Class Frugtmncies -
and Margin Values .................. 70 4.3.6.1 Reassessment of the AIMR Seismic Core l Danvje Frtquency - System Modeling Issues ' . 70 .I 19-1ii 1
F ; , 4. p a , , 4.3.6.2 Moan CDF for 'Ihree Selected Sites Usirq E LUIL or EmI Hazard Curves . . . . . . . . . . 71 4.3.7 Uncertainty and Sensitivity Analyses . . . . . . . . . 73
'l' 4.3.7.1 Urcub:dnty Analysis . . . . . . . . . . . . 73 4.3.7.2 Sensitivity Stniles ............ 73 4.3.7.2.1 Specific ard Generic Fragilities . 73 4.3.7.2.2 Alternative Pragilities ..... 74 4.3.8 Sumary of Results, Interface Requircumud.s, and Conclusiers ..................... 74 4.3.8.1 Stranary of Results . . . . . . . . . . . . . 74 4.3.8.2 Seismic Review Corrlusions . . . . . . . . . 77 4.4 Interface Eoquiremerts for Other External Events ...... 78 19.5 I!TTRODUCTICH 'Io ' die IEVEL 2/IEVEL 3 REVIDf ............ 96 19.6 00tTIAINMEtif PERFORfRNCE . . . . . . . . . . . . . . . . . . . . . . 98 6.1 Introduction ........................ 98 6.2 Methods Discussicn ..................... 98 6.2.1 GE Analysis ............I.......... 98 ;
6.2.2 Staff Review . . . . . . . . . . . . . . . . . . . . . 100 6.3 Atsm=nt of the Methods . . . . . . . . . . . . . . . . . . 102 6.4 CET Results . . . . . . . . . . . . . . . . . . . . . . . . . 104 6.4.1 Presentation of CET Results frun this GE FRA and the Staff Review . . . . . . . . . . . . . . . . . 104 6.4.2 Discussicn of the CET Results . . . . . . . . . . . . 113 6.4.2.1 Drywell/Wetwell Bypass ....... .... 113 6.4.2.2 Overpressure Protectico Systan (OPS) .... 118 6.4.2.3 Passive Flooder Systan ........... 126 6.4.2.4 Irwer Drywell Ocarpositicn . . . . . . . . . . 128 19-iv L a
{ r , [ . 6.4.2.5 Containment Structural Integrity ...... 129 6.5 Otrclusions ......................... 130 , 19.7 SOJRCE TEBM ANALYSIS ....................... 133 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 133 7.2 Methods Di e t"icn . . . . . . . . . . . . . . . . . . . . . . 133 7.2.1 E Analysis ..... ................ 133 7.2.2 Staff Review . . . . . . . . . . . . . . . . . . . . 133 7.3 Aew=nt of Methcds .................... 135 7.4 Source 'Ibrm Results ..................... 135 7.4.1 Presentation of Source 'Ibrm Results frorn the E PRA and the Staff's Review . . . . . . . . . . . . . . . . 135 7.4.2 Dimi"icn of the Source 'Ibrms . . . . . . . . . . . . 138 7.4.2.1 Relese Fract.icns . . . . . . . . . . . . . . 138 7.4.2.2 Accident Progression Timings ........ 141 7.4.3 System Effects . . . . . . . . . . . . . . . . . . . . 145 7.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . 147 19.8 CCNSKUDIC'C ANALYSIS ....................... 149 8.1 Introducticn . . . . . . . . . . . . . . . . . . . . . . . . . 149 8.2 Methods Di e 1" icn . . . . . . . . . . . . . . . . . . . . . . 149 8.2.1 E Analysis . . . . . . . . . . . . . . . . . . . . . 149 8.2.2 Staff Review . . . . . . . . . . . . . . . . . . . . . 151 8.3 Staff Aerx W ...................... 152 8.4 Otrclusions ......................... 152 19.9 INIHERTED RISK ESI'DRTES . . . . . . . . . . . . . ........ 155 ' 9.1 Introducticn . . . . . . . . . . . . . . . . . . . . . . . . . 155 9.2 Methods Di e t"icn . . . . . . . . . . . . . . . . . . . . . . 155 9.2.1 E Amlysis ..................... 155 i i 19-v d
- m. ,
.y : .9
;y
.c '_g_
u _
- 9. 2. 2 Staff Review . . . . . . . . . . . . . . . . . . . . . . . 155 9.3 AS - nt of Methods . ..................... , 155
- 9.4 Presentation 'and Di=wlan of the Rink Results ' . . . . . . . . 156' 9.5 Carclusicms . . . . . . . . . . . . . . . . . . . . ... . . . 178 19.10 OPIN TID E . . . . . . . . . . . . . . ... . . . . . .-. . . ... . . -180 19.11 CDICWSIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . -'190-19.12 REFERENCES . . . . . . . . . . . . . . . . . . . . . .... ... . . ; 19",
INEEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
./4 e
i t 3 19-vi L__._ __
t LIST OF TABIES Table 19.3-1 A Sumary of Initiating Event Fregaency Estimates For 'lhe ABWR Design . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Table 19.3-2 A Snmury of GE's Assiwamud. of Accident Classes for Various Acc; dent Sequences . . . . . . . . . . . . . . . . . . . . 43 Table 19.3-3 A Stanary of Staff Review Finiings cn GE's System Unavailability Estimates . . . . . . . . . . . . . . . . . 44 Table 19.3-4 A Simrnary of GE Results and the Staff's Review Finiings on Dczninant Sequence Frequency Estimates .......... 46 Table 19.3-5 A Sumary of Relative Ct:1tributions of Various Initiating > Events to the Overall Cbre Damage Frequency ....... 48 Table 19.4-1 Otmparison of Seismic Cbre rhwy 2 Frequency Using G.E. Hazard and Fragility Data (ABRR PRA Best Estimate Values vs. Staff-Sponsored Mean Values) . . . . . . . . . . . . . . . . . . 80 Table 19.4-2 AIMR Seismic Fragility Sumary . . . . . . . . . . . . . . 81 Table 19.4-3 Alternative Fragility Values for Salected Ccuponents . . . 82 Table 19.4-4 Randam Failure PIcbabilities Used in Quantifying Seismic Cbre Damage Frequency (Staff Requar.tification) ........ 83 Table 19.4-5 Advanced Boiling Water Reactor Design - A Sumary of Mean Care Dunage Frequercy Based on ENL (Internal Events) ard EQE-ENL (Seismic Events) Requantifications . . . . . . . . . . . . 84 Table 19.4.6 Otmparison of Mean Annual Sequence Frequency Ordering for Different Seismic Hazard Curves . . . . . . . 85 Table 19.4-7 IXrninant Cbntributors to Accident Class Frequencies Based cn Calculations Using Mean IINL Seismic Hazard - Curve for Pilgrim Site . . . . . . . 86 Table 19.4-8 HCIPF Values for Accident Classes '
. . . . . . . . . . . .- 87 Table 19.4-9 Annual Cbre Durage Sequence Freq@.ncies Calculated using LINL Seismic Hazard Curves for the Pilgrim Site . . . . . . . . 88
-l Table 19.4-10 Otmparison of Cbre Dunage Frequency for '
Different Sequences using ( , #,, p,) ard (4 p,) with Full Set of LINL Se - c Hazard Curves i for Pilgrim Site . . . . . . . . . . . . . . . . . . . . . 89 Table 19.4-11 Accident Class Frequencies for Different Sites with Mcdified Fragilities (LINL Hazard Curves) . . . . . . . . . . . . . 90 l 19-vil !'
*m Table 19.4-12 Mean Cbre Damage Frequency Based cn HE (Internal Events) ard EQ.E-SE (Seisnic Events) Uncertainty Analyses ...... 91 Table 19.6-1 Descripticn of Sequence Groups in Figures 19.6-1 ard 19.6-2. . .. .. ................... 109 Table 19.6-2 'Ibe Staff's Ventirs Outcme Frequencies for Inte_rnal an-1 Seismic Events. . .................... 120 Table 19.7-1 Descriptico of the Accident Progression Source 'Ibrms in Terms of the Cbre Durage Frequency Fractions of Table 19.6-1 (in Section 19.6.4.1) and Figures 19.6-1 and 19.6-2. . . . . . 136 Table 19.7-2 Cesium and Iodine Release Fracticns, as Estimated by the Staff and GE for the Staff's Accident Piupassicn Bins. .... 140 'i !
Table 19.7-3 Timing of Key Events in an Accident Frugussicn. . . . . . 142 Table 19.9-1 GE's Point Estimates ard the Staff's Mean Estirates of the Interm1 and Seisnic Events Risk. . ....... .................. 159 Table 19.9-2 Staff Point Estimate of Risk fr m Seismic Events . . . . . 163 Table 19.9-3 Staff Estitrates of Uncertainty in the Risk Measuries for Internal Events ...... ............... 165 Table 19.9-4 Staff Estimates of the Uncertainty in the Risk Measures for Seismic Events, for the Pilgrim Site, usire the IDE Hazard Curve. . . . . . . . . . . . . . . . . . . . . . . . . ... 167 Table 19.9-5 Description of the Risk Results. . . . .......... 171 Table 19.9-6 Staff Estimates of Containment Failure Probability and Conditional Cbntairment' Failure Probability Showing the Effect - of the Overpressure Protection System. . . . . . . . . . . 176 Table 19.10-1 Cbnfirmatory Items . . . . . . . . . . . . . . . . . . . . 181 1 Table 19.10-2 Staff Cbrrecticas ....... ............. 182 l Table 19.10-3 Outstanding It ms ........ ............ 185 Table 19.104 Interface Requirments . . . . . . . . . . . . . . . . . . 188 1 l l l 19-viii
LIST OF FIGURES Figure 19.4-1 ABWR Seismic Harani Curve .92
..t Figure 19.4-2 rvvnparison of Various Harard Curves Used in Evaluation . . 93 Figure 19.4-3 Mean Fragility Curve for Sequence IB-2 . . . . . . . . . . .
94 Figure 19.4-4 An Exanple of Percent Cbntrihrtion of Different Acceleration Ranges to Mean Frequency of Sequence IA (IINL - Pilgrim Site)95 Figure 19.6-1 GE's and the staff's breakdown of the conditional probability of accident prtgression groups given core dam'92 for internal events. .............-............. 111 ; Figure 19.6-2 GE's and the staff's breakdown of the corviitional probability of accident gugassicn groups given core darage for seismic events. ......................... 112 Figure 19.6-3 Schematic diagram of the AS4R containment ........ 116 ^ Figure 19.6-4 Wetwell pressure as a function of bypass flow ; (ax) and time (hours) ................. 117 Figure 19.6-5 Hypothetical distributions illustrating the uncertainty in the vent setpoint and the containment failure pressure. . . . 125 Figure 19.8-1 Inportant times of consequence calculations ....... 150 . Figure 19.9-1 Plot of internal and seismic events risk results (NRC Quantitative Health objectives and NRC AIHR Requirements). 169 Figure 19.9-2 Plot of internal arr! seismic events risk results' Requirements) . . . . . . . . . . . . . . . . . . .(EPRI.... AIRR 170 i b s k 19-ix
y py 3. ,
'WJ; 4 y i
s s IL r Draft Predicisionet
, " '- .19.1 IN5000CTICE o -1.1 Background f
,.. As part of the ABR Final Design Approval-(FDh). application,: General Electric has perfrmand a Probabilistic Risk Ameessesnt (PRA) in response to the tv-ni==irm's Policy statement en severs Ranctor Accidents Regarding Future Designs and Eristing Plants dated August 8,:1991 and the ABR Licensing neview Bases, and has suhaitted the PRA for the : staff's review. < r % Unlika deterministic" evaluations of plant design,1diere an applicant's - guy. . 3 design is evaluated against regulations in the manner described in the standard Review Plan and is found " acceptable" ce "not acceptable," the review of the IRA is not governed by W 4r it formal . criteria. PRAs and their.svaluations are used to assoas, in a realistic ) rather than ocneervative manner, the safety profile of.the proposed i-design as =n --d in tarse of the frequency of severe core damage accidents, the consequences of a spectrum of such accidents of varying severities,'and the _ integrated risk to the public; the ECA in these parameters; and insiWits into the safety profile.' 'In addition, a PRA and its evaluation can be used to make deterministicjudginents of the safety of the gt,-:- :1 design. 1.2 Licensing Review Bases
'Dn licensing review Mean for the Asm design were h====ited in'a letter dated August 7,1987, . frtan T. E. Marley of U.S. NRC to R. Artiga '
of General Electric G=yi-Tf (E),- " Advanced Boiling Water Reactor Licensing Review Bases".(Reference 19.1). A an= nary of these review M aam'is as follows:- A. 'Dw licensing. review bases ' include applicable portions of the . . balance of plant (BOP) and'an enveloping sita.for.the approved
~
ABR design.. E, as part of the 'SAR and PRA subnittals, is expected .to provide humanitation related to the interface-requirunents of various BOP features," including;the 'characteris-tics of sita envelope paremataru. "As'part of the ABR FDA approval, the staff is expected to zwview and make a finding (withL respect to risk-significance) as to;whether the proposed plant-specific design parameters and sit; W ific envelope parameters
, are within design interface requirements and sita envelope e requirunents, as applicable.~ +
B. Because E 'is expected to provide 'its PRA subnittald in the form of magnetic nwwiin (in addition to the hard copies), the staff's
" review of E's risk subnittals will be rh'w=nted in the form of magnetic media also..
- c. As' part"of the ABRhreviewf E is required to provide. adequate resolutions to a list of unresolved open.itans ancyor issues (such
? -.a -- .- -. -.
s i l Draft Predicisional , as unmodeled severe accident pherswrslogical i== applicable to the ABWR design) with respect to safety goals, if any, for the staff's review. 'Ihe staff will review them with respect to their risk significarx:e in the context of safety goals. D. GE is required to subnit, in additicn to the level 3 PRA suhaittal, bourrling risk analyses of external events (incitxling seismic events, fizus, internal floods and torrwha). 'Ihe staff will review than with respect to the overall risk significance of applicable external events, including maiarnic events, in the centext of safety goals. E. GE's method to calculate the containment respcamie and the source term estimates will be based cn the IDER-developed )hblar Accident Analysis Piw tam (MAAP) . If the staff's review of GE's 1%AP analyses finds significant deviations in contairroent loadings and source term estimates, additional sensitivity snalyses will be performed by the staff to irs.virstate these deviations into the overall risk estimates and to gain insight into the ura at.ainty estimates on these critical parameters. F. 'Ihe results of the PRA will be compared with the &mniasicn's safety goals, including the quantitative health objectives,' and the' quantitative design goals p.y@ sed by the Electric inner Research Institute (EPRI) in its Advanced Light Water Reactor (AIHR) Requirements Wn=1t. 'Ihe AIHR design goals cover core damage prevention, containment performance, and severe accident mitigation w npus (dia' = ad in detail in the following sections). 'Ihe staff's review will evaluate the ABWR design against these goals. G. 'Ibe ABWR PPA will be applicable to all ABWR plants to be built ' within the ABWR design and site erwelopes. 'Ihat is, as part of the operating license, individual ABWR applicants will not have to subnit a sepuate PRA for. the staff's review. However, the
~
licensee of an ABWR plant should submit a revision to the approved AWR FRA within 2 years after an ABWR plant is licensed. GE has agrued to follow, to the extent possible, the design requirements documerited in the Electric Power Researth Institute, " Advanced Light Water Reactor Requirements Wn=1t," dated F-M 1987, for the ABWR design (Reference 19.2). 'Ibe staff's resolution of the applicabilities of these design requirunents and the n=ninaion's guidelines regartling deviations of the ABWR design requirunents frun those hw=1ted in Reference 19.2, are h ==1ted in the U.S. Nuclear Regulatory Ctmnission, " Resolution Process for Severe Accident Issues on 19-2 L Draft Pre &cisional
i Draf t Predicisional . Evolutionary Light Water Reactors," rw=n!"ico Paper FFCY-89-311, dated rwv +=r 15,1989 (Reference 19.3) . 'Ihe staff's review of the AIER PRA has followed these guiM ines, as applicable. 'Ibe staff has also incorporated into its review, the i== and acceptance criteria outlined in the U.S. Nuclear Regulatory tw=ni"icn, " Evolutionary Light Water Reactor (IHR) Certificaticn T== and their Relationship to Current Regulatory Requimaits," thmnimico Paper SECY-90-016, dated January 12, 1990, to gain insights into the acceptability of the AEER design (Refererce 19.4) . 1.3 Review Objectives
'Ibe overall objective of this project is to assess the reasonableness of the risk estirates @mpnted in the PRA and other risk related h==nts sutraitted as part of the FDA, applicaticn package. In addition to this overall objective, there are several secondary objectives:
- 1. 'Ib a- the reasonableness of the accident frequency estimates of the major sequences (for both internal events arx! external events), identify mLwqths and weaknesses of certain design features, and identify major ccritributions to the uncertainty in the core damage frequency.
- 2. 'Ib A- the reasonableness of the proposed ABWR containment failure probabilities for early and late failure modes, identify failure mechanisms for various potential failure modes consistent with staff-developed oore melt phencunenological knowledge, and provide design-specific risk results along with urcertainty estimates.
- 3. To cxmpare the ABWR risk results with the Ocxtanission's safety goal and the " safety margin basis design requirements" provided in the EPRI A1HR Requirements Th'm=rit.
- 4. 'Ib provide an integrated perspective cn the cverall risk estimates with respect to the impact of certain severe accident preventico and mitigation features applicable to the ABWR design.
1.4 Review Frecxss GE initially submitted on January 27, 1989, Airsidisit 4 to Chapter 19 of the ABWR Safety Analysis Report," Docket 50-605, the risk analyses of the ABWR design (Reference 19.5). 'Ihe staff, with the help of Brookhaven National laboratory (INL) and Sanila National Iaboratories (SNL), otxtpleted a preliminary review of Airuincrit 4 of the ABWR PRA. As part of this review, a letter dated November 28, 1989, from D. S. ! Scaletti, NRC, to P. W. Marriott, General Eltctric Ccrpany, " Request for Acklitional Infonnation (RAI) regarding the General Electric'Ompany Applicatico for Certificatico of the ABWR Design" (Refercrce 19.6); and a meeting with GE was corrheted on September 12 and September 13, 1989 at GE Headquarters (San Jose, California) to discuss ard resolve matters 19-3 or,,, ,,,,,,,,,,n,i L_. . >
, . - . ~ ,
...n. v .
' i '
f,
' nQ t ,
, j 0 i G 3
Draft Predicisional presented in the staff's RAI. . E submitted its response to the staff's RAI' m Jarmary 9 and January 11, 1990 . (References '19.7s and .. ., . . Referenos 19.8).: As a result of the ongoirg developnent .of:,the revised M PRA h==rrtation and incorporaticn' of additional severe accident preveryticn and mitigation systans (sus asla. gas turbine-generator, tan 4 AC-irdep -4.iit firewater additico capability, .an ' improved versicn of the-containment vent systen, 'and a passive ex-veseel corium flooder system)- + ' to the referunoe ABHR design, E subnitted,.' on July 28,' 1990,' Amendment * ' 8 to the Chapter 19 of the ABWR Safety Analysis Report,"' Docket 50-605 :; (Reference.19.9). 'Ihis amendment made ' substantial modificaticos to the'~ ; original PRA Versico (Amendment 4), W additional: analyses in the. ' area of external events, and, most importantly, modified analyses of. oertain plant improvements important to public risk. 'Ihe staff notes - that Amendment 8 of the IM application,'. including the PRA, responds " y only partly to the staff's RAI. 2 In order to understand the' complex cperatirg characteristics of the containment mitigation systans during a postulated core melt scenario,-
~
the staff initiatad additional researth to investigate the adequacy cf E's methods ard assunptions (related to cm. ;..lt phencanana)!using the staff-sponsored MEICOR code at Sandia National:Iaboratories by letter dated November 12,1990, ' frun M. . Carnal (SNL) to Jae Jo (INL) (Reference 19.10). As part of this work, the staff:also developed an ' RAI and l issued it to E on November 28,1989 (Reference 19.6), ard' . . conducted a meeting with .E in neenhar,1989,' to h== and clarify ' the RAI with E. E h==nted its response to the above RAI in ;' AHw.i.iuit 10 to Chaptar '20 of the AIMR Safety Analysis Report, Docket 50-605, dated Mards 28,1990 (Reference 19.11) . 'Ihis version of . Chapter 19 reflects the design through Amendment 8, except where otherwise noted.
'Ibe staff's review of the seismic risk analysis rM==nted in'.
. Reference 19.9 and Reference 19.12,l" Amendment 9 to Chaptar.19.'of the ABWR Safety Analysis Report," Docket 50-605, dated Novestber. 17, ;'1989, a resulted in an' additional RAI, and this RAI was'issusd by letter dated; a May 1, '1990, frun D. C. Scalettii NRC, to .P.; W. Marriott, General
#~ Electric Cbnpany, . " Request for Additicnal Information regarding .the '
)
General Electric Ctzpany Application for certification of-the ABWR -'
- _ Design" '(Reference 19.13) . ' E has h==rrtad its is spcissesin letters dated July 3,1990, "ARw.3Esit D to Chapter 20 of the AIMR Safety.
E ~' Analysis Report," Docket 50-605 and ot+r*=2 2,1990, "Auerdment 14 to. Chapter 20 of the AIHR Safety Analysis Report," Docket 50-605 ';
'(References 19.14 and 19.15). ,
In addition to the above, due to the advanced nature of the AIMR ocntrol l room design, the staff identified additicmal review work related to the . ' risk significanoe of critical human factor issues and human reliability ; issues, ard initiated additional work with BNL to obtain technical , assistance in this area. 'Ihis human reliability review also result ed in . . j an additional RAI which was issual to E on February 28, 1990 a L (Reference 19.13) . 'Ibe staff also conducted a meetirg with E on i 19-4 1, orett Preoecisional 6 i. -- i_-e . ..-- , , = = ,----a i - --
4
~.
Draft Predicisional March 6 and 7,1990, to discuss the staff's FAI ard the sunnary details of the representative K6 and K7 control rocxn designs (located at 'Ibkyo Electric Power OccEnny, Japan) . 9 hwy, GE provided, as appropriate, its response dated July 3, 1990, "Ameninent 13 to Chapter 18 of the ABWR Safdy Analysis Repart," Docket 50-605 to the abcne RAI in Reference 19.M. 'Ibe staff's review of Refereroe 19.16 resulted in an aMitional human factors related RAI, and this RAI was Med frun D. C. Scaletti, NRC, to P. W. Marriott, General Electric Wny, " Request for Additional Informaticri regarding the General Electric Ctxtpany Applicaticn for Certificaticn of the ABWR Design"- (Reference 19.17). GE th'ented its response to the above RAI dated August 31,1990, "Arauhd.14 to Chapter 20 of the ABE Safety Analysis Report," Docket 50-605 (Reference 19.18).
'Ibe staff notes that, as part of nost PFA reviews, a plant walk-down ard/or plant walk-thrcugh of najor systeos, cacponents, structures, the main cxntrol roca and remote shutdown systan panels, incitriing operator interviews ard sinulater tests (if any), is a critical ard useful step to cbtain a full urderstanding of postulated accident scenarios ard to harvest qualitative safety insights into potential acx:ident vulnerabilities, if any. Bccause the licensing review of the ABWR design involves a plant design cnly, the staff could not perform such walk-dowr1 activities. However, GE has irdicated that it will make use of nest of the design features of the K6 and K7 control roczn (Japanese design) chapus in designing a control roam for the ABWR plant to be built during the prtduction Itase in United States (Reference 19.16).
'lhus the staff reviewed the Japanese K6 and K7 cwitrol recans (inspected neck-ups, observed operator perfornance tests in training sinulators, ard conducted walk-dwns of tasks determined critical to risk). Data collected fren these reviews provided a framcwork for evaluating the adequacy of the ABWR PFA, urder the assunption that the ABWR control roarn instrumntation and workplace layout will be similar to those of the Japanese K6 ard K? control rooms.
'lhe probabilistic risk review performed by the staff primarily involves examination of the A3m IPA, as oppcsed to unking reanalysis ard recalculatico of selected sequencxs and release categories. 'Ihis '
apprcach was adopted for the review of the AIMR PRA ard is consistent with the guidelines th,wnted in a uvrorandu:n dated Mrch 14,.1988, frun E. S. Beckjord ard T. E. Hurley to V. Stello, "Honorardum of-Agreenent of the RES Role in the Review of the Standard Plant Design-NRR/RES" (Reference 19.19). Detailed technical findirgs'in the above review areas have been rb-nted in NUPE/CR-5676P, "A Review of the General Electric ABWR Probabilistic Risk Assessment" (Reference 19.20) . 19-5 ,,,,, p,,3,,,, ion,g
. s 5
f Draft Predicisional 19.2 RISK-SIQiIFICNTT ADWR DESIQi FFEIURES 2.1 ABhR Safety Systm Features
'Iho following are the frontline ard support systes that have been explicitly nodeled in the ADWR PRA by E. Durirq the ocurse of the review, the staff found that, cocpared with earlier IER designs, many safety systes have substantial design nodifications strich contribute to ;
reductions in syst a unavailabilities and thereby a reducticn in the i core damage frequerry for the ADWR design, cmpared to these earlier I designs. Detailed deterministic reviews of these systens, and firdirgs reganiing their acceptability, can be fourd in Chapters 3 through 10 of this h e nt. 'Ihe follcwing are scue major highlights:
- 1. Reactor Protection Systs (RPS)
'Ihe reactor protection systs (RPS) refers to the overall couplex of instrument channels, trip logics and signals, manual controls and trip actuators that are involved in generating a reactor trip (or scram) to brirq the reactor subcritical. 'Ibe RPS of the ABWR, which has four-division redundancy, is designed in such a way that the failure of any single element will not hinder the actuation of a required trip. Although E has significantly improved the RPS design ccxqpared to all earlier designs, E did not make an attempt to quantify the RPS unavailability following a transient or a postulated IOCA event. Instead, an unavailability estimate of '
1 E-7 per demand has been assigned based on the reliability arnlysis performed as part of the solid state RPS design for the Clinton facility. [
'Ihe staff roted that E's use of an RPS unavailability estimate I for the Clinten facility is contradictory since the staff has evaluated the adequacy of the AIHR PRA under the assunpticn that i
the control rocn layout will be similar to K6/7. Furtherrore, the design of the Clinton RPS and the ABWR RPS are essentially dif - ferent. 'Ibe Clinton design uses analog trip modules and isolaticn i devices, whereas the AIMR design uses micrcprmws (software), l rultiplexors ard fiber cptics. Other design features such as the l control rocn layout, operator interface, recirculaticn punp trip, i and data transmission are also different. 'Ihese design dis-similarities result in PRAs with fundamentally different failure nochanisns and comen rode cmsideraticns.
'Ihe study for Clinton irdicated that the unavailability of the RPS is essentially dcninated by ocxmon cause failures of the divisional nultiplexors ard the system logic. E - mut that similar failures will dcminate the ADWR RPS tunvailability. . 'Ibe staff noted that this unavailability estimate is significantly lower than the estimate @wnted in the results of the staff's analysis dated April 1978, " Anticipated Transients without Scram for Light Water Roactors," WRID-0460 (Reference 19.21) . 'Ihe Draft Predecisiorsal
7 (f , f-s Draft Predicisional staff also noted that E used the E NUMAC line of equipnent, which is not used as the basis for either the Clinton or K6/7 designs, as the example of the type of equipment that will be used for ABRR I&C systems. The staff ocncluded that E should justify the use of the Clinton reliability estimates in the ABWR HtA be-cause the ABWR RPS design is significantly different frun the Clinton design. This is an outstancling item.
- 2. Control Rod Drive System (GDS)
'Ibe control red drive system (CRDS) of the ABWR design differs significantly from that of NAR-II, 238 Nuclear Island, IER/6 Standard Plant Probabilistic Risk Aem--nt, 22A7007, dated March 1982 (Refererce 19.22) or currently operating plants in that it -
utilizes electric-hydraulic fine motion s.hul red drive (FMCRD) - mechanism rather than lockirg pisten nechanisms. 7he AIER CRM consiste of FHCRD mechaniw: ard the CRD hydraulic system, which inchdes pxps, filters, hydraulic s hul units, instrumentation and electrical centrols etc. The hydraulic pcuer required for scru is prwided by high-pressure water stored in the individual hydraulic control units (HCU). A single HCU contains a nitrogen-water accunulator charged to a high precsure and the rwa =can valves and w.ud.s to power the scram action of two FNCRDs. Rod insertion cLn be alternatively achieved by drivini all the rods in slaultaneously with the FMCRD electric motors. . The ABRR CRDS can be used, in canjurction with the red control ard infor-ration system (RC&IS) and the reactor protection system (RPS), to perform a rumber of important reactivity s hul functions.- For exanple, uptn receiving manual or automatic signals from the RPS, it can prwide rapid control rod insertion (scram). Another function prwidea by the GDS is alternate rod insertion (ARI), an alternate means of actuatirg afwr-driven red insertion in the event of electrical failures follcuing a' failure-to-scram event'. The FMCRD mechanism used in the ABWR CRDS psesses several meritorious featurus which enharne both the reliability of the scram system and plant marouverability. Some of these features are highlighted belcw:
- 1. The INCRD permits insertien either hydraulically or electrically. Upon receiviry a scram signal, the FMCRD is '
inserted hydraulically by the energy stored in the nitrogen-water accumlators of the hydraulic control units. At the same time, a signal is also sent to insert the FMCRD electrically via its notor drive. This enhanced design feature increases the diversity of the scram systan.
- 2. The FMORD does rot enplay a scram discharge volum .(SDV).
This enhanced design feature eliminates certain h.ur-se-le failures (applicable to other IMR designs) ard the SDV IOCA. Draf t Predecisional
4 Draft Predicisional
- 3. Stardby Licuid Control (sic) System The SIC systan is a backup mans to shut down the reactor to subcritical o::rditions by injecting sodium'pentaborate solution into the reactor. 7his systen ocrisists of two 100 percent capacity trains, each containing a positive displarwwnt ptmp (with a flow rate of 50 gpn). It is marually initiated by the operator if it is determined that the reactor has not successfully sua-si followirg an anticipated transient or a small IDCA event.
The staff notes that, except for the manual initiation feature, the design features of the SIC systan are consistent with design requirements Jpecifled in the EPRI AIRR Requit==uLa Mwant (Reference 19.2) . E has quantified the SIC system unavailability using fault trees ard historical operatirq data. It is about 0.2 per demard. The system unavailability is dczninated by the human failure to initiate the systan on demand.
- 4. Reactor Cbre Isolation Cbolino (RCIC) System The RCIC system in the AWR design is a systen designed to provide coolant makeup to the reactor when the reactor is at high pressure following a transient or a postulated IOCA. It is.also capable of prwiding caolant makeup to the reactor at high pressure during a station blackout.
E has quantified the RCIC systan unavailability using fault trees and historical operating data. It is about 0.04 per demard (without rea coolirg dependency) for the vessel isolation event (Table 19.3-3, page 19-44). The system unavailability is darainated by: (A) medianical failure of the purrp-turbine, (b)' unavailability due to maintenance, and (C) ptmp failures.
- 5. Hich Pmssure Core Flooder fHPCF) Systen The HPCF systan of the ABWR design is scrnewhat similar to the High Pressure Core Spray (HPCS)- systan of the.GESSAR-II design except that it consists of two indepeJdent high-pressure trains (HPCF-B and HPCF-C) rather than one train. It is designed to prwide coolant makeup to the rector vessel under postulated IOCA events and anticipated transients. The staff notes that, although the ADWR design has two HFG punpsf the flow rate per punp (800 gpn) is actually cnly about half of that provided by the single-train GESSAR-II HPCS systan (1550 gpn) (Reference 19.22) ard a still smaller fraction of the capacity of the single-train HPCI system (5600 gpn) of older plants, as described in the FRA for Limerick Generatirg Staticri, Thiladelphia Electric Co., Docket Nos.50-352 ard 50-353, dated Septaber 1982 (Reference 19.23) . The staff also makes note of the rodundarry with respect to electrical, 19-8 oref t Predecisional
Draft Predicisional mchanical and physical separation characteristics of the two i train HPCF systan. GE has quantified the IGCF systan uravailability usirq fault trees ard historical operating data, as applicable. It is about 2 E-3 per demani for transients, 3 E-3 per danand for IOCA events, and 5 E-3 for loss of AC power events (Table 19.3-3, page 19-44) . (
- 6. Reactor Decressurization Function In the event of the failure of all high pressure coolant makeup sources, the reactor rust be depressurized to a primary systan pressure sucil that one of the three trains of the MR systan g the condensate transfer systan g the AC-independent firewater systan could provide lw pressuru coolant makeup to the reactor.
'Ibe purpose of the Automatic Depressurizaticri Systan (ADS) is to depiussurize the reactor pressure vessel to allw use of the MR system (in the core floodirq mode) for reactor water makeup in the event that the RCIC system and the HPCF systan fail to provide coolant makeup to the reactor. 'Ibe ADS of the ABRR design is similar to that of the GESSAR-II design (Reference 19.22).
GE has quantified the ADS systan unavailability usirg fault trees ard historical operatirg data, as applicable. It is about 0.002 per demand for transients and less than 1 E-6 for IDCAs. 'Ibe systan unavailability for transients is dcaninated by the human failure to depressurize the reactor in a timely fashion follcuirg the coset of a transient. In order to wwsate for this dczninant failure mode, q) crating BRRs have charged their actuation logic such that Icw reactor water level will initiate the system followirg sczne time delay. Hcucver,'no charge has yet been gW for the ANR.
- 7. Residual Heat Removal (MR) System
'Ihe ANR MR system consists of three closed irdeperdent locps, and eacti loop has one mm pu:rp ard crie Mm heat exchanger. 'Ibe purpose of the RHR is to provide coolant makeup to the reactor, containment coolirg, and heat transport frun the suppression pool to the RCH systan for the ocuplete spectrun of IDCAs and transients. Each of the MR loops is equipped with the rewy pipiJg, valves, ptmp and heat excharger to inject water into the reactor vessel ard/or remove heat frun the reactor vessel or containmnt to the ultimate heat sink.
GE has quantified the Hm syntan unavailability usirg fault tre and historical operating data, as applicable. . For los Pressure Flooder (IPFL) mode followed by a mweful scram event, it is
, about 5 E-5 per ckmud. For suppression pcx>l coolirq node followed by a successful scram event, it is abcut 5 E-4 per demard 19-9 oreft predecisionet
b,N, 5 ' S; :? g
+
, , , , :s , ,
r
. , (" 3 '#'
e
?- 1
,y l.O *
}s y.
.Dreft Predicisionet-f,f (Table'19.3-3). ':he thme-train system unavailability:is ;
dcaninated by: (A) =4=e=11bration failums of the flow transmit-tars, and (b) cavitaHem failures of the RHR punps due to'a drop q in suction pressbure. ' x-a
- 8. Cbrtair-t 0% m Dali=f .m In the event of failure of the RHR systen, the ABER oorstainment
', pr===we will be ==ar+=d to increase &as to in-vessel steaming.
At 80 psig the ~ overpressure protection system (OPS)Lwill autcamati- 9 onlly open to relieve the - ive contairunant pressure in order , h to prevent gross structural; failure of the contalment. 1he' OPS + p can help prevent oorm'da=wya for scane mr id=1t. sequences and help r mitigata the consequences of other sequences. 1his section will , briefly mention the preventative role of the OPS. The mitigative F capability is <H= = ==d in Section 19.6.4.2. ~ ' For those accident sequences with =-ful core cooling ~but an; J ' ! unavailable'RHR system, the. containment pressure will increase and ' v eventually fail the'ocntairment,: allowing the possibility of dama-l: ging the core cooling systems and causing core damage. The~ 0PS .a '. will help relieve contairunant pressure in a W. Lulled nuriner and l- reduon the potential' for containment-failure-irtSuond failure of.' \. the care cooling systans. I i 9. Electric Power Systern the ABWR design consists of a three train electrical' system to ,, provide power sqply to ensite in-plant electrical loads'.G1he AIMR design will be designed to'take'offsite AC power from a' mini-
+ mum of two' independent ~offsite power scurons.j In the event'of -
E faite power sources are ' lost, the an-site emergency power sources, JC L ocaprised of three emergency diesel ~ generators and four DC: . .
. batteries,'are _ designed to fulfil the^ power requirements of the L y, safety-related systems to adtieve cold shutdown.ilha AIMR gas l L turbine generator will have a black-start
. tulated station blackout. '.She staff belie. ves capability å a pos-;
that~ this' additional' Ac power source will significantly reduce the contributice of sta-tion blackout events to the' core damage frequency,and .the <likelih . ood of.early containment failures.- 2
" GE developed fault treesLto quantify the failure rambilities of4 125' AC buses,125 DC buses, associated '480V sotor control omntars ' .~
,. ()cc), M00s for service' water system u v. d4 and 6.9KV buses L (including the 4W of failures of ansite energency sources,: and" h normal and preferred'offsite power sources)' Itan GE =M:_4.ly [ aMad the gas turbine generator to the AIMR design,:it.was incur-f rectly. incorporated into the PRA model in an opHmistic manner. 1his was corrected in the staff review quantificaticm. She' staff notes'that these fault trees have been linked with the frontline [' u
- 19-10 ,,,,, ,,,,,,,,i,n,g l- ,
y, ,
Draft Predicisional system fault trees, constnr edt for various other safety systems, in the evaluation of their unavailabilities.
- 10. Service Water System
'Ihe ABRR reactor M1 ding cooling water (RCW) system, which cen-sists of three in$ependent divisions, is designed to Imove heat fran essential equipment in the reactor building, such as RHR heat extangers, heating, ventilating and air conditioning (HVAC) emer-gency cooling water system refrigerators, diesel generators, ani other equipnent.
During normal operation, one RCW and cne SW punp in each locp (primry and secmdary) in each division and cne RCW heat exchanger in each division are operating. 'Ibe ABWR IPA assumes that, under these conditions, sufficient cooling eareity is available to provide seal and motor bearing' cooling water for the core cooling punps. It further assumes that, if all three loops are operated in this m nner, sufficient cooling capacity is avail-able to remove heat fran tim RHR heat exchangers during a postu-lated LOCA. E has developed fault trees to quantify the failure probabilities ! of the RCW trains and SW trains, including the inpact of failures l of support system dependencies (such as power failures and air ' systan failures). 'Ihe staff notes that these fault trees have been linked with the frontlim system fault trees, u.u:hocted for various other safety systems, in the evaluation of their un-availabilities. 2.2 ADWR Human-Systan Interfaces 2.2.1 Introductico Section 2.2 will: provide a description of the Advarced Boiling Water Reactor (ADWR) Control Rocra arx1 other significant human-system inter-faces (HSIs), e identify the new and ocnventional human-systan interface technologies with potential risk significance, and identify how the General Electric (E) design approach has (or will) managed the risk.
'Ibe' reader is referred to Secticn 19.3.7 of this Chapter, "Humm Reliability Analysis," and the previous Chapter 18, " Human Factors Engineerirg" for additional information related to ABWR human-systan interfaces and potential risk related to tinse interfaces.
~ll Draf t Predecisional
Draft Predicisional 2.2.2 General Description of the ABWR Ihman-Systan Interfaces
'Ihe following hiption of the ABWR IEIs is based upcn informaticx1 pmsented in GE's Stardard Safety Analysis Report (SSAR) Chapter 18 (Reference 19.24). It should be noted that the design of the IEIs is rot caplete. . Rtrther design development and testing may result in changes to the description provided beloW.
One of the most significant human factors differences in the design of the ABWR when capared with " traditional" Boiling Water Reactor (BWR) plants is the design of the human-system interfaces in the ocotrol rean. A major drivirg objective of the control room design is the operational philcsophy of sirgle operator nonitordig arxi nul during normal plant operations, incitx11rg startup, power operaticns, ard shutdown. However, during noroal plant operations, the control roca staff will also include an - assistant centrol roca supervisor, a cxrstrol.rocan shift supervisor, arx1 two auxiliary equirnent operators. 'Ibe pwwmd operational philosophy leads to two significant design require-ments. First, all controls and displays need to be located in a ocupact workstation so a sirgle operator can perform all required tasks. Secord, increased autenation is required to relieve the ' operator fran tedicus, labor-intensive, and repetitive tasks. 'Ihus, rather than having direct control over ocuponents, the operator acts as a supervisory controller monitoring 'ard authorizing autanated task performance. 'Ibe ABWR will have a control roorn _ (CR) Whose main elements, fran an operations standpoint, are a centralized cxxmand and control workstation and a wide screen display panel. 'Ibe CR provides for sirgle operator nonitorirq ard contitl frun the centralized workstation durirg normal operations. . During emergencies, the workstation can acc.- uiate additional operators. 'Ibe main control beard is a "capact," ocnputer-based console where all the infonnation (displays) and controls needed by the operator are available at the board and/or frun the large-screen display. 'Ibe detailed design of the control recu has not yet been finalized. The control board nay unke use of many advarced technologies, incitriing color graphic displays on high resoluticri CEs, flat panel displays (e.g., electroluminescent techrology), touch screen irp:t devices, data display location flexibility (e.g., capability of locate displays on different cathode ray tubes (CRTs), and a variety of dedicated controls. Toudi panels may be used for the control of non-safety systan cxmponents such as valves, punp untors, etc., as well as other functions. Ibt all controls will be acccuplished via caputer input devicts, however. For'exanple, narry safety systan functions (such as Standby Liquid Control (SIC) injecticn, Emertjency Core Coolirg Systen (ECCS) initiatiorVruset, 19-12 ,,,,, ,,,,,,,,gon,i
e Draft Predicisional mnual scram, turbine trip, and M3IV controls) will be controlled with hardwired switches. The wide screen display panel is used for the display of top-level plant status inforation, important paramter, arxi important alarm. This is'information that will be available to the entire control rocn crew. The wide display will consist of three panels, one non-safety grade, pr==-driven panel will ocntain sumaries of important plant inforntion such as displays for reactor start-up and load charges. The other two panels are used for the display of top-level alarms ard fixed mimics of inportant NSSS ard B3P systems. These displays will utilize safety-grade equipnent driven indeperdently of the prrma ccxap2ter. The alarm systan design description incitr$es dieseciars of basic design u.eayLs, alarm classificaticos, configuration of alarm I systems and alarm system implanentation (wide display device vs. mrs) ard su;pression of alarus. Ocupared with other aspects of the control roczn, the alarms are dieW in ocmsiderable detail. Of particular note is the critical parameter alarm display, which is part of the wide display device hardware alarm group along with plant trip sequence ard safety-systan status displays. It is
)
rxfaworthy that the critical parameter alarm display is intended to annurciate entry ecoditions to the synptcetic emergency operatirg procedures (fdps). As for the safety paraneter display systan (SPDS), "the ASE is not to have a separate SPDS, but rather, the principal functions of SPm are to be integrated into the overall u.u'aul roca display capabilities" ard displayed on the " wide screen display panel." This approach is consistant'with NRC expectations for new plant designs. SPDS functions should be integrated into the overall display design. Assistarm functions will also be available to select appropriate sumary displays based upon plant nula. In additicn to providing a major design driver to v.u^uul board and m design, the sirgle operator control philosophy also increases the requirement for autcaration to assist the operator with traditicnally difficult cperations characterized by heavy workload (such as plant startup and operations for the various Rim operating nulas). The ABWR nco-safety systems are coordinated via the power generaticn control system (MCS) during normal !i operations. Neither the PGCS nor any other autcanated non-safety .I systan can automtically change the status of arry safety system. The PGCS is a redety systan, which provides automatic plant startup ard shutdown, ard which autcanatically alerts the Senior Reactor Operator (SRO) of specific abnormal conditions being detected. If a change in a safety systan is required, the EGCS notifies the operator ard the charge is made manually. When appropriate, the FGCS autcutically disengages its autcznatic node of operation. Therefore, any required charges in the operaticnal 19-13 oreft Predeelstonet
Oraft Predicisional Status of airf AUR Safety Systan uust be perforIned by the SRO or an autcznatic safety-related initiation. According to Ciapter 18 of the AIER SSAR, the rmote shut &wn system (RSS) will "use acrrventicx1al, haredtsd v.miuvls ani irrlicators to maintain diversity frcr- the min s iuvl recun." GE's Request for Additicxial Information (FAI) RE= fr.ase 620.32, dated November 2,1990, (Reference 19.25) provides a rationale for the diversity which includes protection "against the improbable event of oca:roon mode hartrare or software failure in the plant irstrumentation and control systans" ard that it is " typical of all BWRs." Regardirg other local control station (ICS) designs, RAI Respcnse. 620.33 (Reference 19.25) provides that their " man-machine interface design...will be definal as part of the ABWR design inplementation equipoent activities." As for the design of local valve operations, RAI Response 620.34 (Reference 19.25) states in part "The ABWR design philosophy regardirq local valve operations is similar to previous BWR designs" ard that " local' position indicaticn will. be provided alarg with parallel mntrol room position indicatical." 2.2.3 Risk Significarit Oontrol Rocra Innovations
'Ihe design of the ABWR control Itczn includes many features which have potential rink significance. '[he ADRR operaticral philosophy and methods of operator interface are quite different frtan more " conventional" U.S. BWRs ard esplay approaches for which the U.S.
nuclear industry has very little experience. 'Ibese differences between the ABWR and conventional BRRs increase the degree of uncertainty with respect to risk implications. 'Ihis is not meant to imply that the AIER design is associated with greater risk; however, evaluating the risk is more difficult ard urcertain. A preliminary identification of the aspects of the A34R design that are most potentially risk significant is preserrted below.
- 1. Sirnie operator Fhilcserhy: It appears to the staff that the' goal of single operator ocntrol for normal operaticns is a major design driver influencirg decisicos for increased automation as wil as control corsole ard control recun layout -
ard design. Yet, the' linkage of this ' goal to overall safety ard reliability of operators was not provided. Nor was the desirability of this approach adequately supported by analysi-s, tests, ard evaluaticns. It is unclear, for exanple, why the high level goals of safe, efficient, ard reliable operator perfomance are fostertd by sirgle operator control. RAI Question 620.20, dated Dececber 17, 1990, (Reference 19.26) acktressed the importance of single operator control and its raticrale. GE's respcnse to the gaestico offered three Draft Predecisional
c' Draft Predicisional points: elimimtion of comunication errors, elimimtion of coortiimtire activities across operators, aM the low workload levels resulting frm increased autcx:ation (i.e., there will rot be enough work at the rain console for two cperators) . With respect to the first two points, while ccumunicaticn ard coordinatico can ocotribute to human error'as indicatal, ernmnilcation arx1 ocordimtion also prtnide an inportant check on the control pr- aM check cn the performance of the other operators. 'Ihe net effect cn reliability of the drawbacks and benefits of rrmmniicaticsy' coordination would have to be investigated. Also, the shift frm norm 1 to mergency operations may be prob 1matic with only cne operator. Under a:ntgency conditions, the operator will receive additional assistance. Precisely what this assistance will consist of and how the tasks will be allocated and coordinated between operators is unclear. 'Ihc second operator will be "cmirg in cold" ard will have very poor situation awareness, thus, the comunicatioycoortlination burden cn the first operator my be excessive at a time when workload is already high (the emergency condition) . 'Ibe secord operator's effectiveness may be limited for an extended period of time. Considerire the several reported instances of operators in' U.S. ruclear plants ret beirg alert and attentive to their duties, thereby potentially u.mudsing plant safety, it is the staff's opinion that an appropriate analysis shculd be provided to justify how one operator, the senior reactor operator (SFO), at the main cxnsole will remin attentive to his duties. In addition, the RAI 620,20 Response . (Reference 19.26) about one-person cperations durirq normal corriitions does not rention that operator comunication be'c ween several licensed operators nonitorirg plant conditions has historically prtnided a systan of " checks ard balances" to cxxnpensate for irectivity durirq extended periods of - monitoring without any required ocntrol. In essence, the net effect cm operator ard system reliability needs to be evaluated for nornal operations ard for the shift frm normal to emrgency cperations. - However, the <b'~nta-tien in the SSAR does ret provide this informaticx1. With respect to the third point, operator workload, GE irdicated that ABWR workload analyses irdicate that "because the high degree of plant autmaticn which is available durirg rormal operations reduces the operator workload to a level easily sustained by a sirgle operator.b2t one which may provide a lower level of stinulus if divided between two 4 operators" thus affectirg alertness, etc. 'Ibe staff agrees with concerns over low workload levels. Hcucver, without docurrentatico of the cited studies, we do rot know if the concern is warranted in the ABWR. Iku was workload defined in 19-15 ,,,,, ,7,o,,,,,,n,g
Draft Predictsional the cited sttdies? Was the cumitiv_g workload associated with systm mcnitorirs evaluated? 'Ibe studies of workload presented in the Japan briefirgs defined workload in terms of the ntmber of tasks performed per unit of tine. . 'Ihis approach is typically insensitive to the captitive workload associated with supervisory ocotrol tasks and nonitorire activities. Ing-term systs acnitorirg is difficult for operators, and perhaps havirq two operators would be preferable to one in six21 a situaticn. Ibr eads operator, monitoring ' duties could be shared with other more actively-oriented tasks to achieve acceptable workload levels for both operators, thus removing the heavy ncnitorirg burden frm a sirgle operator. 'Ihis issue also relates to the first two points in that higher workload perhaps increased by ocaunicaticos and coordination might provide more stimulation for the operators ard a more reliable control rocn. Also, the workload argument is somewhat cirt:ular. A single operator control approach leads to increased autmatico so one cperator can perform all needed tasks. 'Iben, when a seccnd operator is considered, it is rejected by irdicating that due to extensive autmation, there is cnly enotgh work at the main console for one operator. 'Ibe noze appvpriate questico to address is what level of staffing, automaticn, ard allocation of functicn will meet the goals of safe and reliable performarce of the operatire crew ard the overall systs.
- 2. Hiah
Dearm of Autmation:
'Ihe increases in automation (automaticn of tasks traditionally performed by an operator) ard enhanced decisico aidirq in the ABWR results in a shift of the operator's functicn in the systs from a direct manual controller to a supervisory ocotroller ard system ncnitor (largely remcned from direct control). 'Ibe shift in a human operator's role away frca direct control is typically viewed as positive frm a reliability standpoint since the human operator is considered one of the more unpredictable ca ponents in the syste. It is generally presumed that .
autcmaticn will enhance cuerall systm reliability by removing or nducing the need for human action. 'Ibe operator's perfomance in the system is believed to be imprcned by freeirg him frm tasks whicia are routine, tedious, physically cknarding, or difficult. 'Ihus, the operator can better cm ;ud.wte cn supervisirg the overall performance ard safety of the systs. homer, rather than renovirg error, such a charge has frequently been associated with a shift of human error to higher levels in the system which are more difficult to detect and quantify. For exanple, evaluations of increased autantico in civilian aviation has led to the identification of several new categories of error that were introduced. 'Ihe potential for "new" types of errors that can occur in an advanood system shculd be reflected in the risk analysis. Draft Predecisional
O Draf t Predicisional mis shift in role has inplirmtions for a wide range of factors of concern in HRA incitdMJ operator selecticn, training and procedures, and human-systan interface design to adequately support the new role. Sirce these effects are ret well understood, it my be difficult to assess thern.
- 3. Disolav Ibrm ts: Much of the data m plant performarce will be presented to the operators on oc IpatAh CRT screen displays. mese displays will replace ocnventional indicators such as gatges and meters. mus, the methods by which these data are presented is very irportant. Yet, design requirments were retably absent for the display of data ard informtion (human-software intedace). Much detail is presental on the hardware aspects of the HSI, e.g., use of CRTs, hardware switches, and console design; however, the methods and formts by which information is displayed is rot dimm=M. Nor is the operator-interface transaction methodology dimmW beyctd indicating that a direct manipulation interface is planned. B e staff considers this a major limitation since, in a cmputer-based control recen, display methcdologies are at least as (ard probably more) significant to safety ard reliable operator performance as the hardware design.
- 4. Advanced 'Ibchnoloov Huten System Interfaces: As irdicated in itan 3 abcve, alrest no information was provided regardirg the display of plant data ard infornticri. For these aspects of the control rocan r%=ad.s that wre described, many represent inncuative approaches for U.S. IMRs. As roted in the introducticn, their significanoe with respect to risk mainly lies in uncertainty abetzt their inpact on human performarce ard reliability. Since the control rocan design is rot final at this time, the tedinologies irdicated below were only described at a "requiruments" level, ret a design implenentation level.
Omrect Workstation Console - 2e workstation console has been designed for a sirgle operator control during normal ' cperations ard more than one durirg off-normal corditions. However, it Irmains to be validated that multiple operators can perform their tasks at the canpact console without interfering with each other. CRT Displays - We primary display devloes at the workstation are the seven CRrs. Fbw, if any, traditicrial indicators will be used. mus, not all data is presented to the operator at all times. Se acceptability of prtniding " glass wirdows" on the process rather than conventional inlicator displays will have to be evaluated. Draf t Predecisional I L .__
;. 'f ' P Draf t Predicisional - ,
Overview sunmuv Disclavs - Since only seven CRrs will' be used at the cmsole to provide plant status informaticn, tamag or .
. overview displays will have to be used (in contrast to' .
individual indicators cn conventional boards). 'Ihe success of these displays to present hierartitical status informatico will. impact the operator's ability to maintain adequate situation' , awaIeness. Soft Switches 'Ihe primary means of whul will be through the use of software generated whuls (soft whuls) presented cn the CRrs and flat panels and activated through toudi screen input. 'Ihe inpact of. this made of a hul cn operator performance will have to be evaluated. Oxouter-Based Alarms - While sczne alarms will be presented ett - the wide panel in a conventional tile format, the predominant-display of alarms will be on CRT. 'Ihe methods by which alarms are presented (e.g., lists or graphic tiles) and the way in-which the cperators interact with the cxmputer-generated alarms may affect safety. 'Ihe impact of alarm sqppression - technology on safety will also require evaluation. , Iarue Wide-Screen Disolav 'Ibe large overview displays represent an innovative technology now to the U.S. nuclear industry. 'Ibe allocation of display'information to the wide - screen display versus the console CRIs and the way in which .. the wide-screen displays are~ formatted may inpact. safety ard will have to be validated.
'Ihere may be further design potentially safety-significant-inncvations as the control roam design pr*E to final -
implementation.
.3 Control Roam 'Ibchnology Innovations. ,
'Ibe introduction of advanced and inncvative techno1cgies into the control rocn may be acoacplished at various points in the design process, includirg: ~
'Ihorcugh well-an'wmted, tqx5cun systau 'malysis assuring appropriate'allocatien of functicn to system and operator control. '
'Ibchnology a--nts ard iterative design testing to evaluate operator ard systan performance.
Use of human factors engineering guiMines and standards to assure that the design conforms to currently aopepted human engineering principles. Dcplicit design objectives for develcpirg error resistant ard error tolerant design. 19-18 ,,,n ,7 % , %
. Q. Draft Predicisional verificatico and validatim (V&V) testing of the fiml design in afull-missico" scenarios. Based uptn the infomation provided in SSAR Chapter 18 " Human Factors Dryineering" describing the wd.wl roca design, it is difficult to determine the extent to which these risk managment elements are being addressed. 'Ibe design process is dia-ai in detail, but no results of system analyses, techrology ae==nts, trade studies, tests and evaluations, etc., are provided. Further, since the design is at the stage of requil==ars only (and ret final design), no check on the final design is possible.
'Ihe only aspect of the risk management activities elaborated in SSAR Chapter 18 (Reference 19.24) are those assx:iated with the tws --arased V&V approach in Sectico 18.5. However, VC7 activities related to the ADRR control room are identified as the applicant's responsibility.
'Ihey are centered on basically three related sets of activities. First, the design is evaluated with respect to the general design criteria of 10 CFR Part 50 - Appendix A' (Reference 19.27) ard the NRC requirements and guihiines as reflected in U.S. Nuclear Regulatory rwnmimion, "Stardard Review Plan," NUREDs-0800, Washington, II)C, Revisicm 1,1984 (Reference 19.28), U.S. Nuclear Regulatory rh=imion, "GMM11nes for Control Roca Design Reviews," 1FJREG-0700, Washington, DC,1981 (Reference 19.29), ard U.S. Nuclear Regulatory rh=imion, "Clarific-ation of 'IMI Action Plan Requisusts," NUREG-0737, Supplement 1, Washington, IX:,1980 (Reference 19.30) .
Socord, systenvoperaticns analyses are performed for rermal and emergency situatims. 'Ihe objective is to evaluate plant operation with a specified crew size and specific control roca design including interface design, piu uiures, etc. 'Ibe validation activities are to be i performed cm a functional prototype or sinulator, or by walkthrough ' where apprcpriate. 'Ibe acceptance criteria are scuewhat vague but acilress reasonable high-level performance dimensions.
'Ibe third aspect to evaluaticm is a human reliability amlysis (HRA) regairement. For each " primary cperaticn action" modeled in the IPA, specific refarence to the acticn (1).will be clearly identified in the IDP, (2) the associated controls and displays will be evaluated by an indeperdent control room design review team to be free frta any significant Human Ebetors Engineering (IDT) discrepancies, ard (3) . the HEPs ammwvi in the FRA will be evaluated as to their reascmableness by an indeperdent HRA review team. Primary operator actions are those expected to minimize the adverse consequences of an event merieled in the PRA.
While (3) above shculd not inpact the hunun engineering design, ard (2) should be done for all interfaces, it is a good practice to pay special attention to significant hunan actions. (A similar amlysis is pcotulated for other icman actions modeled in the PRA.) 19-19 or,,, p%i,ig
Orsft Predicisional Riile the-overall plan is reascoable, it is urclear why. (or how), all of these activities.can be the respcrisibility of the a;plicant, since test and evaluation activities such as these are' integral to thf iterative design arr$ analysis pmc depicted in Sectica) 18.3 : Mrmy of the test activities hibed in this sectics) should not be perfonmd as part of a final test. Fcr exauple,'it seems inru u.vr iate for GE to evaluate the adequacy of. the HSI design for a specified czw' size at the final design inplementation validation or to wait until final design . implems itation to a==we cxmpliance with NRC guidance such as NCREG- ' 0700 (Br lerence 19.29) . Crw size validation is critical' to ocritrol recan and svcolare development and.should be determined only in the design. Yet,' these 'inportant design considerations are to be validated by the licensee applicant at the validation phase. .In the staff's opinion, these design features should be evaluated such earlier. O i i 5 E l , 5 r. l> 1 l l 1
' O Draft predecisionet
s .i i l Draft Predicis{onal 19.3 CAILUIATION OF CDRE DAMNE FREQUENCY IUE 'IO INIERNAILY INITIATED EVD7IS ' 3.1 IrWden Internally initiated events are those which originate within the plant itself, as W_ to earthquakes and other events generally considered "extemal. " Intemally initiated events include transients and ID::As. In addition, loss of offsite power events are mnsidered internal events for PRA pirposes. Accidents initiated durirg full power operaticn wero included in the sutznittal and this review. 3.2 Initiating Event Frecpency ; E's analyses of various initiating events, incitrlirg unplanned manual shutdowns, are provided in Apperriix 19D.3 of the PRA. 2e fracpency estimtes of the various initiatirg events are provided in Table 19.3-1 3 of this rey.d., alorg with the staff's c.mmis. % e detailed findings are as follows: I
- 1. 2e frequerry of snual shutdowns (planned and unplanned) is based en the results of the analyses @wnted in NURD:/CR-3862 ,
developed by the Idaho National Engineerirq Iaboratory (INEL). '
%e staff noted that this frequency (one unual shutdown event per rea'c tor-year) is based on operating reactor experience (through .j calendar year 1985) in the U.S. However, the new E ANR design will have more redundancy in safety systems and nny have better operatire characteristics (with respect to inprovements in calibration and naintenance pwcedures affectirg human reliability issues) than existirg NR plants. B us, it is possible that the l actual experience for the ABWR will be scanewhat better than that -i estimated in the PPA. % e staff finds E 's estimate to be appropriate at this design stage. ,
f
- 2. E's estimate for the frequency of vessel isolation (including loss of feedwater events) is about 0.2 per reactor-year, h"M on the EPRI AIRR requimmis @wnt (Reference 19.2) . mis 1 estimate included contributions due to PSIV closure events, losses of condenser vacuum, and pressure regulator failure events. %e )
frequercy of vessel non-isolatico events (i.e., a reactor trip i with bypass valves available) is about 0.68 per reactor-year. . E clains that these frequercy estimates are consistent with the predicted scram frequency and correspondirg design requirtsnents eented in the EMI AINR Requirements fw'ent (Reference 19.2). %e staff noted that current operatiry reactor experience indicates a value close to about 2.4 per reactor-year.
- 2 has provided neither highlights of the ABWR design inprovements in the balarne of plant (BOP) systems nor applicable references to such DOP improvenents in the AWR IHA to support the estimate of cnly one reactor trip per year, which is lower than current experience in the U.S. %e staff also roted that, due to lack of ,
design dchiln at this stage, the staff has used one event per Draft Predecisional l 1
, gg ,
- - ~ , - + -
~ '
- ~ e -m m o --- - - ~ n -
-sv ~ " " > > - > - ~~n " : ' ~ '
gy'p; J9s i '
," l 4
- ~n '
' r.
,1: y ab .
,( s y.
y ;' s >^
' ' n: s
.n ; . ,
f, g, i ,
~.i
.q , x 4 44 r 7
, , <g. 7,
.i :::
q. f' A ' 4 . :
^
Draft Predicisional >1 . N ' year.for the loss of feedwater frequency and one' event per year for the MSIV closure event frequency in-its review of the AIER q {, PRA. Unless 2 can provide norv justification for its estimates,. O the. staff's estimates were considered to be egu.wu.iata at this ! design l stage. <
-' . ,. ..G J .
Jl. 3. "" E's estimate for the inadvertant open relief valved (ICRV): '
', frequency is about' 0.01 per reactor-year. 1hef staff notes that - F
;j this estimate is 'substantially lower than the value;(0.07 per ' ~
reactor-year) used for the Limerick plant'(Referenos 19.23)J E' 9 has not petwided detailed riar===ntation regarding any design tz improvements sede to the multi-stage ' relief valves' to berinstalled '
?
'M in the future to support this Icwor unreliability value; 'In the aboenos of evidence to the. contrary, .the staff has used.a.hi@er W
value (0.1) for the ICRV event for its independent aseasement.- , y l- 4. The staff's review of the AIHR PRA indicatas.that'E did not docuennt the details of the contribution of support system , failures (such as loss.of DC power, Ices of service ~ water system) +' . L as initiating events. This is an outstanding' item. E should .f i consider the 4-=r+ of the partial an#ar total failure of ths , p support systems (such as the AC power system,athe:DC power system, a the heating and ventilaticm systas, the service water systemi the : reactor Wi1Mng cooling water system,;the reactor service water system, 'and other applicable =~414=vy systems)' cn plant trips as y applicable, including *-7--a dependent failures of the ," mitigating systeem needed .to provide a veneel coolant makmq . function anyor contairunent. heat removal function.' . ;' r of failure.of the sqpport systems ,(as anLinitiating.1he frequency u
~
event) should- 3
' be estinated based on the historical frequency of one support m system train failure in ocabination' with the failure of the other d 114.pei.b4 trains of the support systmas >(including ev=mrwi cause - ;
failures of the rest of the s@ port systems),' and operator l e c i reocwery of the initially lost sigport system train.' Ins o L_ L developing an'avant true for the'agpart system failure'as an " initiating . event, attentien 'should be given to ttholdeperdent ' a faults of various uwviimes of the mitigating systems to be- :Q : modeled in the accident sequenoms. . 4 > - i
- 5.
w ; E's estimate of the loss:of offsite-power frequency is about. - E ' O.1 per reactor-year. 1his estimate is based onithe values for an '
?
- h. average.'alta h=antadiin the NSAC report, "Insa of Offsite Power i ik at U.Si Nuclear Power Plants - All Years through 1986," NSAC-111, s '
L EPRI NSAC, dated May '1987;(Reference 19.31)'.3 However,- for the L '
'f purpose of frequency estimation of the Ices of AC power event, E , a should ocnsider site-specific parmasters (as. indicated in the j
. staff's' licensing review' basis rinrunnant), such asLapacific causes . J; (e.g., a severe storm) of the loss of power, . and.their inpact cm .
l recovery of Ac powar in a timely fashion). The staff has . 1 L considered the impact of site variations (parametric variaticm in '
- the loss of grid power frequency) on the core rhaae= frequency by ' l l- .
19-22 o,,n ,, g.,,n,i y i.,ig- y ?.4-F $ w. v rg- .-g,.h.r$ vWDes tc'*W d - T'u "TM"'* - N S F w, wp a,-. ww w-a w 4m.o--. -- - - * - - * ^ - - - * --- ~ ' - ~~ ~ - ^ - ' - ^ ~
<,-n.. 9, s- - , , , . , . .~ . .~ v- - - ~~ - > ""' '
$p.
> ' '7:
f.h 8 [] ? l. # '
'd yyX:.' . '.L,'
>p3 ' ' ' ,
a s 7 , 1
' j k?{ ,'
. Draft Predicisional 's j '
including it in the uncertainty analysis, as reported'in Section 8 : of Reference 19.20 (see Table 19.3-1) .- 'D11s is an interface 1 requirement. , < 0 6. i GE's estimates for varicus postulated lIX3.svents'are also shown in Table 19.3-1. 1hese frequency estimatas are the same as those i ;'
'Munanted~ and accepted in the GESSAR PRA: (Reference 19.22)'. ;.The,
/ staff finds'GE's estimate to be aa w late at the design stage.. ' '
7 7. The staff noted that CS did not provide results' of accident j analyses of postulated interfacing IDCh events as' applicable'to.
- l the AIMR design. 1his is an outstanding.itant. Special~ attention l Jr should be paid '.a investigating various ways.of obtaining an j
' interfacing IDCR event. .Itans to be considered should include,Las' ;] a minimum, the following:' the number of valves, if any, connected 'L at hips an' 'w preneure boundaries of the reactor primary systset; 9 the types o. illves; provisions of the' design specific t e& in cal-specificaticru, " Amendment 9 to Chaptar 16 of the AIMR Safety ! Analysis Report," Docket 50-605, dated November 17, 1989,. (Referanos 19.32) with IW to tasting and maintenance inted ' vals, and pe=hq=ted post-tasting and maintenance errors; valve ' a : position indication an4/ce:its equivalent in the main control _ rocai; pressure rating of the downstream piping, provisions of the reactor primary system goczastry with rW to conservatics) of; 'O mass of the primary systami;. and continued core cooling with1the .. -: unaffected system, 'if any, during an interfacing IDCh event.' .GE ~ must estimate the frequency of interfacing IIX3 events to account y for the above considerations'and historical- data (su& as the- 11 event W11ch occurred at the Hatch facility).- ' ' 'd B.
.. . . - . . T J She staff also noted that GE did not document the results of the M accident analyses.of postulated IDCR events outside the? ' !
... . containment (in particular, staan line breaks ~in the RCIC steam .
piping and the R*17 lines) in ocabination with failure of the- 3 , i; isolation valves. 1his is an'cutstanding item.. < 3.3 Snerman Criteria? q
-]
q GE's core cooling avma criteria for transients,' postulated IIX%
- W events, and failure-to-scram events are provided in Sections 19.2 and 19.3 of the AIMR SAR. She staff's review indicates .that GE has il 1
% determined design-specific core cooling-=n=ma criteria Whim are based ' d !F cn realistic thermal-hydraulic (NI) calculations and assumptions, and ' '
%~ has <Munanted this 'as part of its revised sutzaittal to the staff's RAI. ' i (References 19.9 and'19.11)'.- FM 'aManple, following the"IGW and stuck ' ,;
H cpen relief valve events,' GE has dotarniined that'the RCIC' system alone . s cannot provide sufficient coolant makeqp to;the' reactor-(due to lack of-3 ' sufficient ' steam) ard has unialed the system characteristics accordinglyn , g for the 10W event and station blackout events (ha=artcri availability of H battery power for only eight hours). However,the' text that riaacribesi ^ 1 a Draft Predeclstonal . V ' _'(. , < y , a ^
,: , +. '
,q g., ,y g ,,, e -e 'd # ~" ~ ' ~ ~
4 Draft Predicisional the IORV event is inconsistent with the IORV event trees (Table 19.3-3). 'Ihis is a confirstery item. As part of the risk zuview, the staff raised questicns (Reference 19.13) regardirg the adequacy of cne of the three RHR trains to remove heat frtro the suppression pool following a. failure-to-scram event in ccanbination with a vessel isolation event and the failure of boran injection. As part of the staff's reactivity accident analysis efforts, detailed calculations were performed in NUREG/CR-5368, " Reactivity Transients," dated January 1990, (Reference 19.33) to predict the aucunt of heat prrAmi following a vessel isolation event and the additional demand on suppressian pool coolirg system. The staff thereby determined that two (rather than cne) of the three RHR trains will be recpired to prwide adequate pool cooling followirq a failure-tmcuu event with a failure to provide poison injecticn. In a response to the staff's RAI (Q725.65), E provided the results of its thermal-hydraulic calculations for this ATHS scenario. This rer.pcar,e confirm the staff's findirg regardirg the minim.un suppression pool cooling requileusts.of the AWR RHR system. The staff also notes that adiitional investigation is currently underway to determine the logical minimum injection flow to the vessel needed to avoid core dam ge following a vessel isolation event coupled with failure to scram and failure to provide poison. injection. Preliminary calculations indicate that a flow rate of 800 gpn frun a HPT train alone may not be sufficient to' keep the water level above the top of the active fuel for the above scenario, naanwhile, the staff has used E 's ses criteria for the PEIV closure event in its requantification of the ATHS-induced sequence frequencies. However, if the final thermal-hydraulic calculations dew = Late a need for two or note trains of the high pressure injection systems (that is, more than an 800 gpn flow rate) to avoid core damge 'for the above scenario, then the overall AWR core damge frequency and risk oculd increase significantly. This is a confirmatory item. E should provide further hwatation in the area of sumr-m criteria, as rWv ribed in this secticn. i 3.4 Accident Sequence Definiticn E's d%=icn of accident sequence definition is provide 1 in Secticn 19.2.3 of the A W R SAR. The assunptions used to define and develcp accident sequences are the same as those hwnted in Appendix A of Reference 19.2. Basically, all of tha accident sequences are amwami to emir when the reactor is at normal full power operation, ard a L trarrsient and/or a postulated IOCA challerges the safety systems. E has made use of traditional (WASH-1400, NURID-75/014, " Reactor Safety Study, An Aw=nt of Accident Risks in U.S. Otanercial' Nuclear Power , Plants," dated October 1975 - see Referunoe 19.34) event trees to l develop core damge accident sequences follcuiry an anticipated i transient or a postulattd IDCA. This event tree method used to develcp 19-24 ,,,,, p,,3,,,, ion,g
e e- , Draft Predicisional sequences is acceptable to the staff. 'Ibe following are the staff's general observatims on E's application of event trees:
- 1. Se developnent of event trees for various'initiatirg events (anticipated or postulated) has reflected operational characteristics of the reactor primary systen as it is interded by the ABWR NSSS design ard has also reflected realistic core coolirq criteria (as previously dieW). Se staff ntes that the timing of various danards for safety functions has been reflected aw % tiately. 'Ibe staff also notes that the mMirg of the present state of a particular branch point (in particular, systen unavailability ard failure of human recovery or restoraticn) in any given event tree, has reflected the previous states (success or failure) of the prunurg branch points, incluiirq the initiating event. Se staff did, however, find scoe minor errors in the E event trees. 'Ibese errors are addrmcwl later in this sectico ard in Reference 19.20. All staff calculations have been bas 4d upm the cwia teci event trees.
- 2. 2e staff rotes that the sequence development has been terminated when the failure or success of achievement of hot shutdown ocniitions (as defined in the AIER design-specific Technical Spocifications 'h'manted in Refererce 19.32) occurs. In other wortis, the sequence develcpment (like that of the RSS analysis'
<h'monted in Referenos 19.34) has not been carried out to cold shutdown conditions.
Se staff also notes that-(as in nest PRAs) E has not applied event trees or equivalent toethods to develcp sequences that could occur durirg operatirg no%s other than full power, such as the startup and refueling noras. S e staff believes that risk (due to certain scenarios) could be incurred during the'refuelirq opera-ticnal conditions as permitted by existing regulaticns. We evid-ence for this belief is fran detailed sequence analysis perforned (Referarce 19.33) for the refuelirg mode of a typical'IER plant. For exanple, one of the critical sequences involves inadvertent loadiry of fuel assemblies with two (mininum logical) adjacent ocntrol rais withdrawn fran the core with the vessel top head ard the reactor erolosure beirg in an cpen mndition. E has subnitted a separate evaluation, Chapter 19, Appendix L, "ABWR Shutdown Risk," to address these i m . 'Ihis apperdix is cur-rently urder staff review and will be addressed in a supplanent to- ' this SER. An adequate treatment of shutdown risk will be required prior to design certification. 'Ihis is an outstaniirg issue. 3.5 Systen Mxleling E has used the traditional fault tree method to develcp various systan failure models (ccabinations of camponert. failures) which are used to develop an estimate of various systan unavailabilities. A condensed version of these fault trees (17 trees in terd) for various safety 19-25 g,,,,, ,,,o,,,,,,n,g
Draft Predicisional systems is docurreated in Apperrlix 19D.6 of the ASE SAR. A stmrary description of system design features affecting unavailabilities, ard the staff's evaluaticos of them, are providod'in Sectico 19.2 above.
'Ibe staff notes that these systan models am grouped based on four basic safety functicos (described in Section 19.2.1), rely, reactor coolant makeup, ocntainment heat removal, reactivity control, and other auxiliary supports. 'Ibe staff finis E's method of employire fault trees to develcp functicnal failum nodels to be acceptable. 'Ibe system nodel develcped by GE also incitdes cmbirations of train level cuugisents or sto-wents for systems such as the High Pressure Cbru Flooder (HFCF) and the 104 Pressure Cbre Flooder (IKF) systan. 'Ibe staff also finds that the limit of resoluticn employed in the system failum model is comistent with the availability of failure data for a cxxaponent or a enhpent. 'Ibe staff notes that GE has considered varicus cperational (normal crerating and stardby) characteristics of all the front line and support systems as part of the developnent of the systan failure nodels. In particular, the LPCF systan failure acdels have reflectai design-specific capabilities (e.g., unioue RHR recen coolirq design requirements), and enertjency procedures to characterize the available minNim recovery time (a critical parameter in containment heat removal analyses) to be modeled in the systan ekl .
The staff requested that GE hent all critical M9mptions affectirg the system failure nodels. GE provided, as part of the ABE SSAR Amerdments (References 19.11 and 19.14), its responses to the staff's RAI in this area. 'Ihe staff finds these respcisses acceptable. As part of the staff's review, the systan failuru models (hented in the fonn of fault trecs) were requantified for various safety systars - ard systan cxxtbinations (such as HPCF train B and train C) and the requantified results wem hented in Section 4 of Reference 19.20. These results, with staff coments, are provided_ in Table 19.3-3 of this report. It was noted durirg the review that aantren mode failures were irx:orporated into the GE model at the train level of each systan. Due to the fact that the calculated core damage frecpercy for the ADWR is quite low due, in part, to the exi.h of nultiple redundant'systens, ocumon rode failure probabilities could possibly dcrainate the results. 'Ibereforu, the staff requins fLrther justificaticn frczn GE that its train-level ocamon node failtuu analysis was able to capture the full contributicn to cottnan mode failum probability had it been calculated at the ocmponent level. 'Ihis is an outstandiny itan. Except where explicitly rotal above, GE has adequately and appropriately generated fault trees for the various systems, ard has calculatM estimated uravailabilities with which the staff has fcund no tauco to diraJroe. 19-26 oren PrM w
e '4 Draft Predicisional In developing the ABWR IEA, G has hvi to mke assu::ptions about the design and Iv3iability of systans outside of the ABE design certification. Sirce the design of these interface systa:s are outside of the socpe of the certified design ard are the responsibility of the utility / applicant, it is irportant that the reliability a=='tions ard risk-significant insights used by GE in developing the ABR PRA are transferred to future applicants. 'Ibe staff ruouires that 2 provide a list of these interface systas, the a=M reliability for each interface system, and any safety significant insights GE believes are inportant to designirg the interface systes to met the assunpticos of the PRA. 'Ihis is an Outstandirg Item. Future applicants m st dmonstrate hcw their design for interface systars outside of the ABE certified design neets the reliability assunptions and design insights provided by GE. 'Ihis is an Interface Requirement. 3.6 Data Analysis 3.6.1 Hardware Reliability Data Analysis GE's reliability data for various ccanponents are provided in Appendix 19D.6 of the ABR SAR. GE's systenatic h=mtation of the ABE design-specific data for various safety systems includes: (A) General Electric hwnt 22056, Rev. 2, " Failure Rate [hta Manual" (Reference 19.36), (B) GESSAR II SAR (Reference 19.22), (C) DOE ADHR ECCS Instrumentation Fault Trees,1987 (Reference 19.37), and (D) IEEE Standard 500, 1984 (Reference 19.38). Tae staff notes that, Wherever the design-' specific data for certain ASE ccmponent are not readily available, GE has employed GESSAR II data and IEEE 500 data for simLlar ABWR ocarponents. 'Ihis method is acceptable with respect to system unavailability quantification purposes. However, GE should provide hentatico on the justification regardirg the applicability of ocrtain generic ocmacn cause/ node failure data to ABE design-specific gud.s (such as the diesel generators, the HPCF punts, the IlCF punps, ard the Rim boat exchargers) involved in the system unavailability modeling. Such justificatico should also incitde the conditions under which generic ca: men cause/ node failure data were evaltated, ard the ABR design-specific ocrponent data as mcdeled in the PRA. 'Ihis is a confirmatory item. Our review also irdicates GE's use of the reliability data for the individual ocrpcnents of the ABR design seems reasonable with the excepticn of the adequacy of use (in the ADWR design) of the following cn:ponent data:
- 1. 'Ibe Rim punp nochanical failuru.
- 2. 'Ibe HPCF purrp (no experience on such a conponent) .
GE should provide justificaticn for the use of its data for the above couponents. 'Ihis is an cutstandity itan. 19-27 ,,,,, ,,,e,,gion,g
g. Draft Predicisional
'Ihe staff, as part of its review, performed an uncertainty analysis of certain critical parameters, but based cnly on systa level and human failures, and h=nted the results in Section 7 of Reference 19.20. 'Dierefore, the staff's uncertainty estimates on the AIER core dange frequency do not include the inpact of larue variations, if any, in the above critical conpanents.
3.6.2 Test ard Maintenance Data Analysis E 's estimates on unavailability due to test and maintenance are provided in Appendix 19D.6 of the AIMR SAR. GE's systmatic h=ntation of the ABWR design-specific test and maintenance , data for various safety system u.agasnts (the HPCF puup, RCIC ~ turbine lubricaticn systs conponents) includes: (A) General Electric hwnt 22A6278, Rev. 2, "HPCF 'Ibchnical Specifications" (Referurce 19.39), (B) Cm%R II SAR (Referen 19.22), (C) r Ceneral Electric h=nt NEDC 30936p (Reference 19.40), (D) IMROG Trx:hnical Specifications Irprovement Nthodology, Part I,1985 (Reference 19.41), and (E) the AIER design-specific Technical Specifications (Reference 19.32). GE has also documented the methods of analysis and results of data on unavailability due to test ard maintenarce for certain critical AIER wycir.its. It is also noted that, for certain ABWR weiruds (the RCIC turbine pump, the HPCF pmps, the RHR puups), GE has employed the use of GESSAR II design information to obtain data on unavailability due i to test and maintenance. However, GE has not provided l justification reganliJrJ the applicability of CM%R II design inforrraticn to the ABWR design (on a train basis). Such jus-tification should also include the differences in design features,. if any. 'Ihis is a ocnfirmatory item. 3.7 Human Reliability Analysis
'Ihe purpose of this portion of the review is t'.> we the ABWR Probabilistic Risk Awwnt (PRA) relata$ Fanan Reliability Analysis (HRA) on 12 review item. 'Ihese itms reMe to HRA h=ntation, the aterial available to sigert the HRA, the types of analyses performcd, che quantification methods ard performance shaping factors utilized, the.
cxxpleteness ard types of human actions modelled, ard the sources of generic data used. In additicm, sirce the ABWR will include nore automatico ard advanced human-systs interface technology than previous nuclear power plant designs, the review also fncuses on how the effects of the advarced technology '(on the operator's . .e/ tasks) are addressed in the HRA.
'Ihe review methodology, results ard conclusicats are presented in the followirg sections.
19-28 ,,,,,,, g , %
, . ,. ~-, -. ,- . ~ . . ~ .-
.. ~ .~ s ,. ,
-. ' ..-{ I-t" ' ,
? \
o i ..
.a nc , e i I't '() -
e
-V .
; wq
~
Draft Predicisional 3.7.1 HRA Review Methodology , 3.7.1.1 ABWR PRA/HRA Review Critaria- ' 1. t-Adequacy and ompletanass of the humaritation - Se.
'M=nanitatica of tho'HRA should provide a-description y of the analyses, an audit trail'for and analysis' performed and and himan errur WMility (NEP) '
; derived, supporting reticnale,. and source materials.
- 2. Material Available to support the HRA'- Se 'antarials <
a, (su& as g - t.wal guidance andwhol room panel , design informaticn) available to the HRA' team should . provide a clear u-4=.Unnding of human involvement in:
.M the ABWR. '
y;
- 3. Human-System Analyses Performed . Se human-system analyses parformed (aud as detailed taak analyses)-
should provide a clear urd .L Jing of the task requirements and.deennes on the cperating staff, their a interfaces with plant ==ir- a, and the time . h e within whis critical tasks must be , acocuplished. Also,L the husen-systasi analyses should provide a clear urem.ianding of how this knowledge was used to support the PRA model development for the ' 'H inclusicm of hinan actions.in the event and' fault ' trees.' Finally, the human-system analyses should denonstrate how state of knowledge te&niques were , used to evaluate the utilization of screening analyses-and other tamniques to identify important human ' " actions.- *
- 4. Types of. Human Task Acticms Analyzed - 1 2 e extent'to. ,'
L' whi&.the variety of human interactions with the plant' a systems and + is were considered and how they .,' were modelled.- As per the PRA Review Manual,: . . , e ' NUREU/GR-3485, dated 1985' (Reference 19.42)',- the human . ; actions.should include " operating, calibrating,. testing, acmitoring, ocueunicating, responding,
,' inspecting,- deciding, and managing." E Attenticm was : '
directed to the following types of actions: , Pn =--M=it and å-accident human actions, Errors of rumianicn.and trunniasion, Mi=e=14hration and misrestoration (ww A. restoraticn errors
- Cognitive errors, a)n,d BeOOVery errors.
- 5. - Adequacy of the Human' Action Modelling - Human acticos ,
should be modelled within the event arri fault trees. 19-29 oreftpredecialbi # _ _ . - , ~ - - - ~ - - - * - ~ ~ ~ ~" *"
^"~ ^ ^' ^ ^
i y --p og @ , ..f ; , . > s i' , M g 1
;,l b <
Dr
, 3:
m Ll, '
.R ,
fi Draft Predicisional-t
- 6. Quantification Mer. nods Used' to Estimate HEPs - 'Ihe -
PRA should use HRA methods (such as: Technique for ' . , Human Error Ra e Praiiction ['IHERP]' or Human cognitive ,
;" Response [H m ,j to quantify'the errors in terms of _J h, HEPs and specify idnat types of behavioral / performance 4 unials (such as action dependency)~ were utilized. . t >
- 7. Performance Shaping Factors '(PSPW)' Evaluated ' PSPs should be used to identify human errors, how they are .
& aracterized, and how their offacts'are' quantified-and used in the analysis.- ,
y
-)
- 8. Treatment of Advanced Todinology 'Ihe influences of.
the advanced te&nology aspects of the ABWR should be- ~ accounted for in the analysis. .. In addition, the PRA , model should reflect the changes.in the aparator's' 4 e tasks and role 'in the system resulting from the . <. .. increases.in system autenatiari. 'the HRA methods and ~ data should analyze any advanced technologies. .,
- 9. Generic HLanari Entr Data Sources 'IheHRA'should use
. ganaric source detaffor H E estimates.- _.
, 10. Generalizaticn tram Earlier PRAs 'Ihe analyses and: i data fran earlier Hus should have a rationale to >
f ' justify any generalizaticms, and ifjWy/how,the values y 7 were unitfled for une'in the ABHR. ,
~
- 11. Sensitivity Modelling huach'- Sensitivity'or ' <
[ uneartainty analyses should be. performed on tlw HEP , values; arrl should state how error' factors were : determined, .and what criteria were used for performing , the analysis ~- .
- 12. Insights Gained fram the Analyses - Human actions' 1 impacting plant risk and' insights should be. factored' , ' l
. into systaVaperational; design.' .Utdike most PRA/HRAs,
-whim are performed after the plant.is' designed, the 4 ABWR PRA/HRA can be utilized.to provide;information on '
, significant or sensitive human' acticos'whi& can be- <
used as an imput to design of hardware, software, and' , r uc.dares. . l 3.7.1.2 ' W==qtation Sources - !' 'Ihe main source of information on the HRA was the A34R , Standard Safety Analysis Report (SSAR) (Reference 19.24) .
'Ihe pertinent sections in the SSAR were frun Chapter 18,-
L ll, 3. 19-30 ,,,n ,, g ,
.}
i_.._o-. . _ , , - ie, 4
. , - . 7 . .. ~ . .y ~ . --
~ ~ - . . .- -
,, , ?,; . .
~, , a ,y
..gj
- 1. ,
M 3, 9 i i,
-c
. Draft Predicisional i
N[ ' " Human Factors Engineering," and Cha;ter 19, "Essyasse to , SevereLAccident Policy Statement."' - In additicut to the SSAR, several other scmarces of a information were used:
+
GE's responses to the Request for. Additional Information' (RAI) questions' 620.6, ' dated. October 9, . 1990..(Reference 19.43), GE respaise ;to RAIs 620.7..and. -4 620.13, dated October 9,~19901(Reference 19.44), and'. ] ' GE response to RAIs 621.1 throu@t 621'.11, dated > nsu, amber -17,1990 (References 19.24.and 19.45) . . 1 '[ f Information obtained'cn advanced technology AM = ofL the AEHR obtained in the " Foreign Travel Trip Report l-- 3 Japan" in Ovvier 1990 dated namnher 12, 1990 by the review team to Hitachi. ard 'Ibshiba (Reference 19.46)'. .. ;
+
GESSAR II IEA ~ (Reference 19.22) . . ah a Handbook.of Human Reliability Analysis with Euphasis cm Nuclear. Power Plant Applications," NUREQ/m-1278,; Draft Report' for Interim Use and,0cumnant dated 1980 4
; t and Final Report dated 1983. (References '19.47 and ' -
19.48)., , Systanatic Human Action Reliability Procedure '(SHARP),' EPRI NP-3583 dated 1984 (Reference.19.49). -
+
Ibst Event Human Decisicm Errors: ' Operator Action- I Tree / Time Reliability Corrulation,1 NUREG/m-3010' dated
~
,l 1982 (Reference-19.50). '
3.7.2 HRA Review Results , y 3.7.2.1 Wwy and' Ctspleteness of the ~ M Documentatica ~ (Itan 1)
^
' s
+
+
. Review Itam'1'is fcund to be an 'cutstanding itan, N'~ '
'Ibe HRA-related @=aritation provided in the AIMR I Standard -
Safety Analysis Report -(SSAR) was found to be1incoupleta . ' and,' therefore, not adequate in tarus'of. providing thei t, 1 information nw to evaluate the appmedi taken to human ' : action modelling- in~ the. PRA. - Detailed _ raticmale 'ar - diar == ion for. the HEP estimate was providad for only!six of - , the human' actions perialled in the' PRA. In general,; the - >
'd documentation did not identify the; type of analyses used,- '
l how the HRA analysis methods were inplanented .(sudi as
'I specific reference' to' parts of Swain ls ' Handbook of Human Reliability Analysis - NUREG/m-1278, Reference 19.48.and : H . , , ,)
9 y 19-31 cre'ft Predecielonet - 4 - u^ Y
, a' ,
l
. = . . a u .__Y__A. ,_m ! +
- t> ba
, , . ~ , . -- . .. .,
- 9) z t b
;_ . : A-
-..n -
'O 1
t ,. ? ,s 1
.. Oraft Predicisionet
- 19.43), what performance arrbla ard performarzae'shapirq factors waru considered, or how HEPs were quantified.'
- Saveral human actions identified in %g uit failure rate
' data" tables were not identified in fault trees and human
'v actions found in the fault trees that.were rot listad in the. tables. For' example, Pault Tree Figure 19D.6-16a,
" Reactivity Ccntrols" lists " Operator Fails to Inhibit ADS" ,
(AMIN) but was not listed in Failure Data Table 19D.6-4,
" ADS Failure Data,". whicta lists or should list' all failures newiated with ADS. - <
L 4
.?
9 l
~!
, . F(
-i. p h
1
+
1 o
.i1 T
19 . Draft Predecisional ., 4 4 g ,
~ ' ~ ' ' ' ~ '
QW1;p
' , , r lj Q R4 g ,
i j. ) ' 7,
'ki t 3 !
n ,
' 4 Draft Predicisionet' q;
.w 3.7.2.2 Material Available to Support.the HRA (Item 2) ,
Review Itan 2 is' found to be an interface requirement. ' Based upon the information ocntained in SSAR Chapters 18 and 19 ard E's respmse to RAI Questica 621.2,. it was not 3 possible to determine esther the material available to the - HRA team was adequate for.a detailed evaluaticm of human 'i
' action or an estimate of the HEPs.' m ile.RAI--Question'621.2-specifically asloed for this infonnation,' 2's' response did -
not directly address the request.- In Section'18.5.3.1 and'
~
the respcose to RAI Questian 621.2, GE indicated that the', HEPs are to be validated by an independent HRA~ tamm after - . additional design detail is 'available. - 3.7.2.3 Human-System Analyses Performed (Item 3) Review Itan 3 is found to be an interface requirement.
'Ihe available h=aritation provided little. evidence that l . f d thorough human-system analyses were perfoonned in support of... DJ ABWR PRA/HRA activities. . RAI Questicm 621.11: was a; direct i ,
request for information related to the hinnan-systems j i analysis approaches including use of task analysis,~ HEP estimation methods, screening.' analyses, 'and HEP modification
, m for the ABWR. E's respmse to the question'did not address e
task analysis. ;In response to Questian 620.6,jit was .
- indicated that' system-levelL operating p<-etwas and- s emergency r.-~etwe guidelines were used as 'a' basis for task Y' analyses (in support of man-medline interface design)'. , .l However,4 as indicated in' GE's response to'Questim 620.13, "
the sample task analysis which was1provided for review was' not to a suitable level of detail to support the HRA.' ;In' response, GE ' indicated that the task analyses;will g - i' '
?
and harma more detailed lin an iterative fashion as the? . 2 ' ' design' harman better devel@ed. Further,lit is' indicated
' that task ~ analyses for transient and accident scenarios - i
, estimated will be performed. , a
. 3.7.2.4 r
m . Types m. of Human Task Acticms Analyzed .(Item 4): '
,4 Review Item 4 is found to be acomptable.
[ 3m,
# naaatcm an analysis and classification of the human actions , .m I identified in the: fault and event trees (Reference 19.20),- 'i
/ there appears to be a good mix of types of human q, 1 interactions in the ABWR.
]
1 l 19-33 Draft Predecisionel: ,! s . < f!
, ,, _, # , , ma + <-; , - - ~i.
- "- * , ~
** x1
R 4 S ,
/ag '
s- .
>4
,4 t
0-a Draft Predic{sionet 3.7.2.5 Adequacy of the Human-Action Modelling- (Item 5) Review Item 5 is found to be an interface requirement. e The ABHR inanan action medalling appears'to be, reasonable in - terms of ocalventional m.Lul boards. However, since'the AER has an advanced main ocsitrol board, there is a ocricern about the adequacy of human action modelling with regard to L its incran d automation and advanced te & nology. Also,- there were event true brand points depicted as hardware ' failures that should include inportant human acticris, but . apparently do not. . For mle,.:.the failure to recover p offsite power or cute diesel in either two-. or'eivi.L-hcur. branch points,, described in SSAR Table 19D.4-7 for loss of. offaite power and' station blackout-(SIC). event trees, should have a dmanarrted human action' w .t. 3.7.2.6 Quantification Methods Used to'Estimata HL nan Error Probabilities (Item 6) Review Item 6 is found to be an cutstanding item. the ABWR human action ardalling app 9ars'to be reasonable in taras of conventional wakul. boards.: However, since the ABWR has an advanood main contro) coard, there is a.ccricern rj about the ~ adequacy of human action modelling with' regard to its increased automation and' advanced technology. Also,. there were event tree brarx:h points depicted'as hardware fallurr.m that should include important humaniactions, but'
-Wy do not. For ammple, the failure to recover offsite power or one diesel <in either two- or eight-hour branch points, described in SSAR Table 190.4-7 for loss of' offsite power and station blackout. (SID) event trees, .should -
.have a human action w i-it which-is not dmanartted.;
X 3.7.2.7 Parforinance Shaping Factors Evaluated (Item 7); , W t-Review Item 7 is found to be an interface requi,_.t... Based tpon the available dem=ntation,;it' did not appear that performance shaping factors:(PSPs) were considered in. the HRA.: PSFs for ABWR human actions were only daanribed ' within the context of three errors. Even for these three errors, the treatment of PSFs in the dmmentatiart' wqts inacrtplete. For errors taken frum the um%R:II.PRA, PSPs were only considered for the calibraticr1 of sensors actims, and this was limited to stress and 'deperdence. Due-to- " L innaturity of the design, important PSFs such as emergency
~4 .: 0ref t Predecistorist 1
(-_N
i Draft Predicisional operating precedures (IDPs) ard human-systm interface (HSI) design were rot analyzed. 3.7.2.8 Treatant of Advanxd Tedinology (Its 8) Review Its 8 is found to be an interface requirement. As presently @~nted, the HRA is limite:1 in its treatment of the advanced technology aspects of the ABRR and little evidence exists that the changing role of the cperator due to increased autmation was analyzed for its HRA inplications. RAI Questions 621.9 and 621.10 specifically requested information cn these iamaa, lowever, E's responses were sparse and did not address the questions in a , direct namer. In the response to RAI Question 621.10, E iniicated that an independent HRA team will validate the ABWR lEPs (see also Section 19.3.7.2.3) and that this team will also amlyze potential "new" operator errors. 'lhe identification of new operator errors could potenHally require PRA renedelling ard/or cause'significant changes to the HRA/PRA results. 3.7.2.9 Generic Human Error Data Sources (Item 9) Review Itm 9 is found to be an outstarding item. In general, the h=ntaticn in the SSAR provided general inforation on the source data used for IEP estimates. While methods Weru identified, such as NURED/CR-1278-(Reference 19.48) which contains sudi data, references to specific data tables were generally not'in the hmnta-tion. In addition to NURIU/m-1278, four other generic sources were identified. However, two of these turned cut to be secondary sources, both of whichidentified the sam tire-reliability correlation ('IRC) figure originally published in J. Wreathall's " Operator Action Trees: An Approach to Quantify 1rq Cymrator Error Prtbability Durirq Accident Sequermes," NUS-4159, dated 1982 (Refereroe 19.51) . E should also justify the use of hu:ran error databases which are largely based on simple manual control tasks (such as is providcd in NURIE/G-1278) for estimtion of (monitoring and supervisory control) operator tasks in an Mvanced reactor. 3.7.2.10 Generalizaticn from Earlier IPAs (Itm 10) Review Item 10 is fourd to be an interfaoa requirument. As indicatcd in the SSAR, acst of the IEPs were taken firm the GESSAR II PFA (Reference 19.22). 'Ihe use of these values was judged acceptable by E because of imprtned 19-35 o,,,,,, g , w 1
Draft Predicisional humn-systs interface design ard greater autmation. In general, the IEPs were not nodified for use in the AIMR.
'Ihe staff has ccrrlude that GE should justify the use of GEESAR II IEPs since e, detailed analysis of human acticns in the ABWR has not beum ocmpleted and the design and suxdcral detail has not been ocarpleted.
3.7.2.11 Sensitivity and Uncertainty Modelling Approach (Its 11) Review Its 11 is fourd to be an outstanding item.
'Ihe available hentatico did not indicate that IEP sensitivity analyses or IEP uncertainty bounds (or error factors) were analyzed or calculated for the effect on core damage frequency.
3.7.2.12 Insights Gained frm the Analy wa (It s 12) Review Its 12 is fourd to be an confirmatory itm.
'Ibe staff has concluded that GE has developed a reasonable
. plan to use information and insights gained fra the HRA to support the systaVoperaticnal design. 'Ibe acceptability of any insights realized frm the HRA however, must avait further design developnent.
3.7.3 HRA Raview Cbnclusions Although there are seWral strorg points in the ABWR PRA/HRA process, the HRA~ hwntation is generally lackirg: there is little evidence of detailed analyses, many IEPs are assimilated. into the ABRR HRA frm an earlier PRA with little cbjective analysis-based justificaticn, and at present, there does not appear to be much consideratico of the advanced technology' aspects of the AIER control roca. With respect to the latter two issues, GE plans to " validate" its HRA with the irdependent analysis of an HPA ruview panel, but this has not been acccmplished. In this sense, the HRA is still incouplete. 'Ibe identificaticn of significant "new" cperator errors could potentially require EA rmodellirg arryor cause significant changes to the HRA/PRA results. In sunTnary,11 of the 12 review itms were classified as either "Outstardirg Itms" requirirg additional informatico (Itms 1, 6, 9, ard 11), " Interface Requirments", (Items 2, 3, 5, 7, 8, and
- 10) or "Cbnfirmatory Itas (Ita 12) . It m 4 was found to be
" Acceptable." b Draft Predecisional
Draft Predic(sional 3.8 Quantificatico of Accident Soquerce Frequercles E's quantification approach used in ccrbimticn with its design-specific ard generic data to quantify the sequence frequezey estimtes is provided in subsection 19D.4. These traditional ard conventional m thods are acceptable to the staff. The staff notes that this pr- was carried out by developirg a sirgle set of branch point probabilities for the varicus system (and combimtions of system that appeared side by side) in the event trees.
~
This is an acceptable but somewhat cumbersome approach with respect to assuring that there has been no cbuble counting of failure probabilities (i.e., an underprediction of overall sequence failure frequency). Based upon the review, the staff believes that E took sufficient precautiens within the modeling to minimize the possibility of double counting. The staff did, however, find scme minor errors in the E event trees. In the staff's requantification effort, these errors were corrected. This is dimwud in detail in RefeIence 19.20. As part of the staff's review, an uncertainty analysis using NURB3-1150 type methods was performed en the corncted model to evaluate the inpact of the variations of certain critical systan failures, human actions, l and initiatirg events en the AIER core damage frequency. These results l are dienwi in detail in Section 7 of Reference 19.20. The results are provided in Table 19.3-4 alcrg with a sumary of mean frequency l estimates for varicus accident classes. Table 19.3-4 also lists a relative rankirg of dminant sequence frequency estimtes. 3.9 Quantificaticn of Accident Sequence Class Frequencies As is done in most PRAs, 2 has grouped postulated accident sequences into a small set of classes of accident sequences. E's analysis of the I classificatico of postulated accident sequences is provided in Subcecticn 19D.5.2 of the ABWR SAR. An itemization of the definitions used t naracterize these accident classes is provided in Table 19.3-2. The staff's review of these accident classes irxiicates that the classification of accident soquences is based on the suppressicn pcol conditicns (subcooled or saturated) and the timing of the contaiment failure due to loss of decay heat rmoval systens follcuirg a postulated 1 accident sequence. These definiticos sem reasonable. ' 1he staff notes that these definitions are scracshat consistent with those used in the Limrick PFA, although sme accident sequences have been regrouped into other classes. Ibr exanple, soquences involvirg - failure-to-scram events followed by the failure of boren injectico ard 1ccs of high pressure coolant makeup to the reactor, have been grouped into the Icos of coolant inventory makeup (with successful scram) sequences for which a subcooled suppression pool condition is expected for a longer time. The staff notes (Refereroe 19.13) that the amount of heat dumped into the suppression pool for these two groups of accident sequences will be ccmpletely different and will result in a cxrpletely 19-37 ,,, , , ,,g g
"J ;
A'
,~
~ e - - - - -
- --- ~~ - + ---
-~y"* '
s 4g , J ~ _ g.
' ,,.7 y,
.Y J
p Draft Predicisional-different omtainment respctase and different demarxi on the suppression pool cooling systams. hirther diealan of containment states will be . found in Section 19.6. - 3.10 mmmary of E8s Estimatas of Core Damage Frequency Due to Internally Initiated Events , 3.10.1 Initiating Events and Principal contributors n , . E's PRA has estimated the relative omtributions of various ' 4 initiating events (transients and IDChs) to the total core damage o J frequency. An estimate of the relative ocntributions of these ' D F initiating events to the'overall care damage frequency (transients. ,9 and'IOch events only) is provided in Table 19.3-5. Because 2 has . < not performed an uncertainty analysis,' the relative omtributions - are based on point estimates. 'Dtis is an cutstanding item.'.- '- However, as part of the staff's review, an.t.C@' analyses i, was perfnmad (using the staff's NUREG-1150 methods) of major- J sources (critical system failures, critical tanaan' failures, and F major initiating events) of uncertainties ocntributing to ' postulated core damage events. 'Dius, the staff has 'obtained estimates of the relative contributions of various initiating events idticit, . in addition to using revised failure probabilities, , are based on arithmetic mean estimates of the core damage .l frequency. 'the staff's estimates'of the relative contributions of initiating events are also provided in Table 19.3-5. . 'Dtis table l iniicates that failure-tc h events following anticipated . transients are the largest contributor-(about 31.5 i--.L) to the' 1 point estimate core damage frequency.1 'Ihe second dominant .' "j ; contributor >(about' 26.4 p .i)- is the Ices of the main feedwntar system. 'Atrbine trip events, reactor isolationLevents, and:. inadvertent open relief . valve events contribute equally. (about 3 to 4 percent) to the' core damage frequency. '!he collective' (' , contributim of all postulated IDOL events.is found to be very aman .(abcut 3 percent). . > u
' It should be noted that, althoudt E has provided substantial 7 design Iw- ds to the scram system, failure-tc a.- events 1
still centribute significantly, to the: total core damage frequency.
' 'Diis is primarily due to the staff's.tpward . revision'in the demand
- failure pd bility of.the overall scram system.
- 2In view of recent experience (a failure event in ene .of.the West ELuva er, n-nations) applicable to a similar scram system diammaad in the '
October 12, 1991, editim of Nucleanics Week-(Referenos 19.52) ~ , , , the staff judges this revision of the scram danand failure' L probability.to.be appropriate. 'Ibe ' staff also finds 'that, unlike currently operating BWRs, station blackout events do not , contribute significantly to the core damage frequency. 'Dris is
' primarily due to irwaation of the ansite gas-turbine generator as part of the AEHR design. - With raa-t to station blackcut 19-38 ,,,,,,, g , w J
f r + &-n n sm- k .m Y-e +,m--
i. e l Draft Predicisional events, the staff notes that the decrease in reliability due to removal of a steam-driven high pressure systm (such as the HPCI systs in earlier designs) in the ABWR design is well cmpensated by a substantial reliability inprweent due to the ack11 tion of a gas-turbine generator in the AIER design. Iraum.u.ation of an additional motor-driven high pressure system train (the C train of the HPCF systm) in the ABWR is fcund to have an insignificant lEpact on the ContributiCX1 of IOCA events to the oVeIull Core damage frequency. 3.10.2 Accident Sequences E's d!=wnicns regarding accident sequence hiptions are provided in Appertiix 19D.4 of the ABRR SAR. As previously indicated, this section prwides only descriptions of groups of accident coquences, that is, accident sequence classes. 7he same information is also prwided in Section 19.3 of the ABWR SAR. .A descriptico of these accident sequence classes alcarf with the frequency estimates used in the PRA ard in.the staff's review is provided in Table 19.3-4. . 'Ibe staff notes.that both the PPA and the staff's review did not attempt to develop a ranking of all irrlividual ao::ident sequences. 'Ihis is primarily because neither GE nor the staff attempted to develcp sequence leval Boolean equations which would have yielded the detailed information required. Ikwver, the staff's revised frequency estimates prwided in Table 19.3-4. indicate that the high pressure core melt sequerces (Class IA) involvirg loss of all high pressure coolant makeup to the reactor, dcaninate the overall core damage frequency. 'Ihe numd ckxninant accident class ocnsists of the high pressure core relt sequences (Class IV) involving failure-tcr-scram events coupled with boron injecticm systan failures. 'Ibe third dczninant accident class consists of the low premire melt sequences (Class ID) involvire loss of high pressure and 1cu pressure coolant makeup to the reactor. Both Class II sequences (scanetimes referred to as "2W" sequences as in the WASH-1400 nmenclature) involving loss of the containment heat removal functicn (prior to - the failure of Icss.of coolant inventory makeup to the reactor), ard station blackcut sequecea (Classes IB-1, IB-2, and IB-3), are-fourd to be insignificant contributors to the overall core damage frequercy. 'Ibe staff notes also that the most cksnimnt accident class (that is, Class IA sequences) contributing to the overall core damage frequency, is the same for both GE's risk analyses a'd the staff's review of them. 3.10.3 Observaticos
') 'Ibere appears to be substantial imprwement in the reliability of safety.systa s. The reliability inprovements irc1trie enhanoonents in rodurdarcy ard diversity applied to the design 19-39 ,,,n p, u ,,,n,g
,'l
, y,
- 15 .,j i '
.. . - .. . .n. . . - ~ . - - . ,. ~ - + --
s -
, ym - . +
. ). '
a f
'r
, J ' '
, ;<.~
4 p , ?Mg 9, ,
;; 4 j
g 4 Draft predief'ione.t s q; 1 of the safety systems. Iack of detailed infomationlin the areas of instrumentation and md.wl systems precludes'the ' 4 staff frtan drawing similar conclusions.in those areas.- (2) Our zwiew of the prt:bebilistic analysis ~of the SIC systen " (needed to mitigate failure-to-scons events) indiates that this system is manually initiated.. : Dalative to currently , operating BWR designs (such as YAmerick), the above. feature isi not a design enhancement, ocmsidering the very short time ' available for the . operator to initiate the SIC system following a- failure-to-scrust event.S E claims that the- e addition of the PHORD along with the independent electrically-driven-oczitrol rod' insertion feature minimizes the~ demand on: the SIC system, har==== of the lower likelihood.of a need'for - sir initiation. In a meeting with the staff en August 6,
~ _
1991,' E indicated that'the SIC system design has been changed for autcznatic initiation. 'Ihe staff has' requested that E < , docket this information. "Jhe*=*=hility of SIC initiation is currently under staff rwiew and is diamamad in empter 4 L of the SER. i d 'h L (3) m en care damage frequencies en the order of 10'7. per reactor-year are calculated,'the question of the physical.significanoe of such an extremely low pahar naturally arises. : To r . understand such a n=her, it is par =amary to understand the: context in which it'is p .. d.ad.' y a
'Ihe main reason that the runber is so low is that tho' '
. designers have intentionally done' their best to address.allu known accident scenarios." 'Ihus, it is expected that the l
- core damage frequency estimate would be low.--'It would be far more disturbing if it were not low.
4 Like most other disciplines, it is a' limitation'of-
, probabilistic. analysis that it~can only addreas jgMast '
accident scenarios and' failure modes.' 'thus, 'any new generic' - , issue or plant-specific issue that may-be diamvered'in-the' ' future, anos aMad into theWebilistic analysis,icould revise the core da= arya frequency upward'by perhaps an order R < 4 5- of magnitude ce more. . Of course, the same new issue,: adding
, the amma pahar to the GF,' mit$t change the core damage
- freqq of a present day plant by only a few piuma., - -
since the W._, A. day plant would start cut with'a hitper 'i haea value of the G F.' < .' h Realistically,'one must allow for this possibility of scue new imm changing the core danw= frequency anoe it11s
~
discovered. Nevertheless, until it is discovered, the core danw= frequency estimate properly remains at a very low value. . I 19-40 ,,,,, ,,,,,,,,,,n,g wz .
, n_ ,L ., r~ '
7 3
..,-- f ( ,' '
T g- ".-- l y L, 1 . $ 6(' > , ; ry g g ;N .'E, 4 j . s; .,.. ,
, j t c
m .7' Q ': x , ,.
"4 a
h r
., -m Draft Predicisional; I C 5 * ' 'Ihe entire' PFA is based upon the -=ntion- that lthe plant ' '
b will be built exactly as h ibed in the SAR.- ' ']
'Ihus,y the "
.{
low core damage frequency. estimate is contingent upon there F _ be i ng nois gnificant deviations' dur i ng'-imrtion, ard no . C surprises diamvered during subsequent system walkdowns. 'R 1
'Ibe core da=== frequencies Mad by all PRAs id&Ed.ly < a have large urzertainties.; 'Iherefore, ocuparisons of l frequencies between PRAs or with absolute limits or goals !l
. are not simply.a matter of.ccaparing two numbers. -If a" '
probability distributim is available, 'it is more ' appropriate to r+=arve how nudt of the probability , , distribution' lies below a given point,:which translates into
, syy e a mammwe 'of the probability that the point-has not been ,
avnaadsd. 'Ihus, although the ~oentral tendency of a ' , s o calculation may be very low, therz is stilla finite . . <, probability of:a higher core damage frequency. Even in the; q case of the AIMR PRA, where E did not"calmlate a 'a' m' probability distributicrt, it must be recognized that thel , uncertainty range'will exterd significantly above s's estinte. , 7
.r..
All of these points should be considered when using core damage frequency estimates sudt as these. ' 3.10.4 Conclusion A review'of the findings, dm= anted in previous ' sections of this ~ ii . report indicates that no unique highly dominant scenario exists 1 with respect to core damage frequency-(that is within the enhanced !" design umbrella as demanted in
Reference:
19.2).! 'Ihistfinding is: - based on the level,of design detail. applicable to the'ABWR NSSS ' and amamiated BOP systems as dm=antedlin tha- AIMR SAR.? < Resolution of the' outstanding items inLthe IPA (asidimmaad above* '
... j
. and surmarized in Secticri 19.10 at'the end.of: thisTavaluation: , 4; report) may result in a significant increase.in;the. estimate cif '
; :i .
core dawwy frequency. ' j 1 i i , 3 i
'; b
. -u
,JJ l
s 1
-s j
'u
'19-41 Draf t Predecisional - ;1i 4 <
s il a li[. ' m , L' - , j . <
1 Draft Predicisional i Table 19.3-1 A Suwary of Initiatire Event Frequency Estimates For The , AURR Design ) I 1 Initiating Event Frequency (Per Reactor-Year) PRA Raview Cbments Manual Shutdown 1 1 V Isolation Event 0.1 1. 2/,2/ Icss of Feedwater 0.1 1. 2/,2/ iurbine Trip 0.68 1. 2/, 2/ Inadvertent open Relief Ralief Valve 0.01 0.1 2/, f/ Ioss of Offsite Power 0.1 0.1 3/ Small Icca event 1.2 E-3 1.2 E-3 Mailum IOCA Event 6.7 E-4 6.7 E-4 Iarge IOCA Event 2.1 E-4 2.1 E-4 Anticipated Transient 0.99 3.2 2/, 2/ Notes: 1/ The staff has used the same value in its accident wxlueme requantification efforts. 2/ For ruview cuments, refer to Sectico 4.1 af Reference 19.20. 2/ E's estimates are not based on historiced data. 3/ E's low estimate (relative to historical data) oculd be justified thrugh rimmntation of the inprovonents made to the ABWR uniti-stage i relief valves. 5/ E's estimate does not consider the characteristics of all applicable f grids in the U.S. I Draft Predecisional
A Draft Predicisional Table 19.3-2 A Summary of GE's Assignment of Accident Clarems for Various Accident Sequences Accident Class Descriptico IA Transients followed by failure of the high pressure coolant m keup to the reactor and a failure to depressurize the reactor in a timely fashion. ID-1 Short term Station Blackout (SBO) events with RCIC failuru, onsite power is recovered in eight hours. ID-2 SD0 events with RCIC available for core coolant mkeup for approxistely eight hours. IB-3 SID events (more than eight hours) with RCIC failuru. IC ATNS events without borun injection with failure of coolant makeup to the reactor. ID Transients followed by failure of high pressure coolant mkeup to the reactor, successful dep*.essurization of the reactor, and failure of low pressure crolant mkeup to the reactor. IE ATHS events followed by failure of high pressure coolant makeup to the reactor r rl failure to depressurize the reactor. II Transient, IDCA, and ATHS (with borun injection) events, with successful coolant mkeup, but with potential prior failure of containment. IIIA Smil and medium IOCA events, followed by failure of high pressure coolant makeup to the reactor and failure to depressurize the reactor. IIID All IOCA events follcued by failure of high prussure coolant makeup to the reactor, successful depressurization of the reactor, and failure of Icw pressure coolant makeup to the reactor. IV ATHS events followed by failure to provide boron injection ard mesful high pressure coolant mkeup to the reactor; ATHS events followed by successful boron injection, but failure to keep the vessel at high pressure, resultiry in boren dilution. i V All core damge events followed by failure to prevent suppression pool bypass. 19-43 oreft Predecisional
- [
Draft Predicisional , 1 Table 19.3-3 A Sumary of Staff Review FirriirxJs on GE's System Unavailability Estiinates System Otubination Transients IDCA Irss of Events Offsite Cumarits Power Peactivity Control Scram & ARI 1 E-8 1 E-8 1 E-8 2/ Hiah Pressure Occlant Makeun . RCIC & HPCFB & HFCFC 1 E-4 3 E-3 7 E-4 V HPCFB & HPCFC 2 E-3 E-3 5 E-3 V, 2/ HPCFB or HPCFC 4 E-2 6 E-2 4 E-2 V, V RCIC 4 E-2 4 E-2 h/ 4 E-2 V Irv Pressure Coolant M*euo AIE or Manual Depr. 2 E-3 ' kxJ11gible 2 E f/ H EA & RHRB & RHRC 5 E-5 1 E-4 E-4 V MmA or RHRB or RHRC 3 E-2 4 E-2 ? ~-2 V Suncression Pool cooliin Mode MBA & RHRB & RHRC 5 E-4 2/ 5 E-4 2 E-3 V (Start and Run) Notes _t V h staff's requantification of the GE fault true has prtnided similar results. 2/ The staff's review has prtwided scnewhat lower credit for the AIMR design < inprovements and resulted in a conditional probability of 1E-6 per demand. 2/ The staff's requantification of the same fault tree identified a modeling error and corrected it. This resulted in a probability of 7.95E-3 per demand. 3/ The staff's requantification of the sama fault tree identified a @lhxJ crror and corrected it. This resulted in a probability of 7.33E-2 pcr demand. 5/ GE has taken credit for the RCIC system for small IDCA events culy. The staff's review agrees with this. b~44 Draft Predecisional
p r. e
] ,y,.'
l4 - t t1 , ..o
;r r :( ,
. Draft Predicisional Table 19.3-3 (Contimed) 6/ 'Ibe staff's review provided an alternate estimate of 2E-2 per demand. . >
2/ 'Ihis estimate is ranannable for transients with av==ful scram. However, . ' this unavailability could be higher dependirg on minima cooling-requirements for A' INS events (in particular, isolation events followed by failure to scram)'.- -
'Ihis is an open item for GE to resolve.
i t a t I 9
- ?
.i i
I
..]
's 1
i v l
. t i 19 1 Draft Predecis'lonet I l
r - L J 2
b
.s Draft Predicisional Tablo 19.3-4 A Summary of 2 Results arxi the Staff's Review Finiings on Dcaninant -
Sequence Frequency Estimtes Class Frequency Point Staff's Haan Ranking of V Estimtes (per RY) y Estinte F Staff's EW Staff y Estimate Q IA 4.3 E-8 2.4 E-7 3.4 E-7 1 IB-1 1.9 E-9 1.9 E-8 1.8 E 5 IB-2 1.6 E-9 7.9 E-9 6.1 E-9 7
'IB-3 6.4 E-11 6.9 E-10 6.4 E-10 9 IC 2.6 E-13 6.5 E-10 8.0 E-10 10 ID 1.5 E-8 9.5 E-8 1.1 E-7 3 II 2.5 E-10 2.5 E-8 2.8 E 4 IIIA 4.4 E-9 4.4 E-9 5.3 E-7 8 IIID 1.3 E-8 1.3 E-8 1.3 E-8 6 IV 2.7 E-9 1.8 E-7 2.3 E 2
.y y y y
'Ibtal 8.1 E-8 5.9 E-7 7.5 E-7 Notes:
V. For a description of accident class definitions, refer to . Table ,19.3-2. F 'Ihese . frequency estimates are tne same as those 'hmarrted in Table-19.3-9 of the ABWR SAR. , y 'Ibese frequency estimates are these h==rited in Table' 6.8 of . Reference 19.20. 'Ihese n.mbers are point estimates rather than means, to permit meaningful cartparisons with E's numbers.- y 'Ihe staff's' estimates are based on E's reference ' design, including an onsite gas-turbine generator and an AC-independent firewater (low pressure ' crolant makeup to the reactor) system.
~
Oraft Predecisional-1
- m. s-. .__ _ . . _ _ _ _ _ _ .-
1 Draft Predicisional ff With respect to frequercy estimates, the ADWR HM did not docurent a ' quantitative eva]uation of these sequences. Although'the staff has qualitatively evaluated these sequences, a quantification of them was not performed. h/ These mean estimates are those %manted in Table 7.2 of Reference 19.20 i
,i Oraft Predecisional
Draft Predicisional Table 19.3-5 A Summary of Relative Cbntributions of Various Initiating Events to the Overall Oore Damage Frequency
+ +
Event Description Relative Cbntribution (percent) based on designator of Event Staff Point Estim te V 2/- Maan 2/ + + T(M) Nornal Shutdown 1.9 2.0 T(T) 'n.trbine Trip 4.4 5.1 T(ISO) Reactor Isolation 3.4 3.3 T(FW) Inss of Feat. vater 26.4 29.8 T(I/P) Ioss of Offsite Power 20.2 19.1 (With Partial Onsite Power) T(I/S) Ioss of Offsite Power 5.7 4.1 (Without etisite Power) T(I) Inadvertent Opn Relief Valve 3.5 3.4 T(FE) Failure-to-Scram Events 31.5 30.2 A large IOCA Events 0.5 0.4 S(1) Mxlium IOCA Events 1.6 1.2 S(2)- Smil IOCA Events 0.9 0.3 + + Notes: 2/ 'Ibe point estimte for the total core damage frequency is about 6 E-7 per reactor-year. 'Ibese estimtes are t.he same as those provided in Table 6.10 of Reference 19.20. 2/ 'Ihe mean estimte for the total core damage frequency is about 8 E-7 per reactor-year. 'Ihese estimtes aIn the same as those rtuvided in Table 7.3 of Reference 19.20. 40 Draft Predecisional
Draft predicisional
'19.4 CAIUJLATICH OF CDRE DAMAGE FRIUJDKN DUE 70 EXfERNALIX INITIATED EVDTIS 4.1 Introduction aM Paview of the Scope of Dcterml Event Amlyses in the ADWR PFA In the AIER PRA, quantitative troatment of exterml events was performed only for tornado strikes ard earthquakes. Diece two exterml accident initiators have been identified by EPRI in the PRA Fey Assumptions ard GrouM rules Wmont (Reference 19.2) as events that may requiru quantitative "r m ont for each ALHR. Other external events are considered not to be inportant contributors to AIHR core damage based on improved design, proper sitirg, or low probability of ocx:urrence.
Tornado strike aM seismic amlyses are evaluated in Sections 19.4.2 ard 19.4.3. The staff is currently reviewing Peference 19.2, ard may not wrally conclude that only calp and tormdo strikes need quantitative evaluations. At the staff's request, GE has provided two hments (References 19.53 and 19.54) which were prepared to support positions roccanmended in Reference 19.2. These references, one of which is an interim report, atterrpt to identify external events that will be integrated into the external event PRAs, and those that can be excitded fIun the detailed analyses. This identification was carried out usizg a screening analysis which rulled upon the review of existing PRAs for the current generation of plants, ard then assessing whether the severe accident vulnerabilities found in the existirg plants have been elimimted in the AIER design. The other screenirg criterion used was whether the event had a significantly lower nean frequency of occurrence than other events with similar uncertainties and could not result in sorse consequences than those events. The conclusiens' drawn in these references aru that the scismic event needs to be analyzed in detail, and a limited evaluation of a tornado strike at the plant resulting in a prolcrged loss of off-site power is also needed. GE concludes that all other external events (imluding fire and floodire events) can be excitded frun detailed quantitative analysis in the PPAs based on inproved plant design ard siting criteria. Huwever, these references further conclude that exclusicx1 of unny external events requires that a-design and site verification be performed after a site and design azu selected to ensure that the design ard site do irdeed meet the criteria used to excitde these events. The staff, in developirg the draft guidance for the Irdividual Plant Dcamimtion for Exterml Events (IPEEE) (Reference 19.55), had also used a similar approach to identify the.extermi events which necded scrne quantitative amlyses for the operating plants. The following five external events were identified as requiring scen examination at all plants (interml floods have been included with the intermi events evaluation): (1) fire; (2) exterml floods; (3) seismic; (4) high winds; ard (5) trargartation ard nearby facility hazartis. 19-49 oreft Predecisionat
0 ). Draft Predicinional i Given the above sttriles ard their finiings, the followirg aboervations i aru made in the context of the ADWR PRA review. Um argument of the low I frequency of occurrence or low frequency of consequences par
- to be examined in conjunction with the overall results. For exanple, the umn core damage frequen::y (CDF) due to internal initiators is estimated to- .i be 7.5 E-7/ry; based on the current external flood design criteria,'the [
staff has estimated the frequercy of the occurrence of the design basis flood to be 1.0 E-5/yr, with this initiator frequency it is rot clear , why the CDF frm the external floods could not be in order of 1 E-7 or ' greater, ocuparable to the internal events. Thus, even though the estimated mean frequencies may be low, insights with respect to contributors to the overall results may be significantly affected by' 1 incitriing these " low frequency" external events. Therefore, the staff,. I consistent with the re.umerdations of Reference 19.53, pending the staff Inview of the AIWR Paquirements Document, r+>-snds that a site ard design verification be performed when a specific site is selected for the external events, such as external floods and transportation hazards, for which no analyses can be performed at this stage. This is an intarface requirement. The staff, based m its past experierce, does not agree with GE that no severe accident examination is needed with resp 6;t to the fire hazard (reqxase to the staff Q.725.74, Reference 19.56) . This hazard is not , truly " external,"'and can be evaluated to some extent at the design l stage. This is an outstardirg item. ! Fran past PRA review experience (e.g., unique design features of the i Shoreham facility), the staff also believes that various cambinations of htman failures and hardware failures could yield a relatively significant oore damage frequency due to rocan-specific floods. The staff also believes that the large release goal may rot be affected significantly due to the requirement of. additional failures needed to fail the containment. ~ Because the details of the plant and _equipuent j layout aru needed for_ such an evaluatical,~ the probabilistic analysis for internal- floods should be perfonned when details.of .the plant design are 1 ucre cx:cplete. This is an interface requirement. H i 1he staff's tuview of the ABRR tornado strike and seismic PRA was assisted by RE (as a primary contractor to the staff) and its. , subcontractor, ICE Engineering, Inc. (EQE), with RE nainly responsible ' for reviewirg syntan analysis and developirg alternative Boolean - i equations for seismic accident sequernes. The staff has ruviewed,. 1 accepted, and adopted the revis.:s by its contractors as its own. The remainder of the task, includirg a critical ruview of both the seisntic hazard analysis and the equipment ard structural fragility analysis presented in the ABWR seismic PRA, re-quantification of seismic ' core damage frequency using different, staff-provided seismic hazard curves, and an uncertainty analysis was perforncd by EQE. The detail of the rusults of Ut&'s ard IQE's review and irdeperdent estimates of .! 19-50 oceft predecision i
'I
[ . c Draft Predicisional , accident sequence frequenciec as well as the conclusions drawn frm the study are demonted in Reference.19.20.
'Ihe following SER sections on tornado strike and seismic events are i ,; based on the technical evaluation oordvN by INL and EQE. Results of this evaluation, insights, and safety findings are highlighted here.
4.2 'Ibrnado Strike Analysis
'Ibe tornado strike analysis performed in the ABWR PRA essentially follows the EPRI PRA Fay Assumptions and Groundrules (YJG) position and approach (Reference 19.2) . (As noted earlier, the staff is separately y reviewing Reference 19.2). EPPI, with the technical assistance of thel
[ Advanced Reactor Severe Accident Pwgmu (ARSAP), has ace =cM the AIHR vulnerability to tornado-irduced events and concluded that the dminant , effect of a tornado strike is likely to be a prolonged loss of offsite po wr (Reference 19.54). Most of the vulnerabilities'found in past PRAs ; f are not expected to occur in the AIRR design. 'Ihe EPRI position, ' therefore, is such that it deems a sinplified model sufficient for the
- i assessment of tornado strike inpact, provided that it addresses randa ,
failures in cambination with loss of offsite power. J As a support to EPRI's effort in developing the AIHR Requirements ! Document, ARSAP carried out the evaluation of AIHR designs to identify their tornado vulnerability and developed a method to quantitatively .. estimate AIHR tornado strike core th== frequency. Expected tornado strike frequencies were calculated based on regional historical data ' summarized in an EPRI report on tornado missile risk accxmmnt. 'Ihe frequencies of tornado strikes with~ intensities large enough to lead'to core damage events were cmbined to generate total regional frequencies i, per square miles per year. 'Ibe regional value is, then,' nultiplied by ~ g the plant area, assumed to be about 0.14 L squaru 211ea,. to yield the expected tornado strike frequency. 'Ihe staff ftas not evaluated'the adequacy of 0.14 square miles assigned for the plant area. 'Ihe plant , area consisting of critical safety systems, cupants, and structures , (e.g., ultimate heat sink) may exceed this assigned _ estimate'of 0.14 ' square miler. .However, because of the low CDF estimated for the tornado .
' initiating events, even increasing the plant area substantially. is not likely to make the tornado ' events major contributors.- :
Sime the resulting regional site strike frequencies were found to be ; relatively insensitive to the regicri specified, the mavim= ancmcM , regional value of 2.86 E-05 tornado strikes per year was' conservatively [ chosen as the basis for the ABWR tornado strike analysis.
'Ihis value was used as the initiating event' frequency in the Icss of offsite power and station blackout event trees developed for'the internal events in Section 19D.4 of the AIMR PRA for estimating the core '
damge frequercy attributable to tornado strikes. In calculating the i core damge frequency, the follcuirg assumptions, restdting frm the .; ARSAP qualitative evaluation of the expected AIRR tornado strike 19-51 ,,,,, , % ,gon,i
e Draft Predicisirsial vulnerabilities, wru further hgwW by properly nodifyirs the event L trees: . (i) no credit is given to either the cordensate storage tank or the unin cordenser due to t: heir vulnerability to' tornado effects; (ii) both the power conversion system ard the feedwater system are unavailable due to loss of offsite power; aM (iii) offsite power restoration is rx)t expected within 24 hours following a tornado strike. All other assumptions and cxniitions ruain t6 same as those used in the internal events aralysis. Quantification of these event trees on this basis yielded a. total core rh m ge frequency attributable to tornado-initiated events of l'.1 E-08 per year. Due to its relatively insignificant contribution to the overall core rhmge frequency, no further detailcd analysis was carried out for tornado-irduced events. 4.3 Sei mic Events 4.3.1 Introduction and Overview
'Ihe AEHR seismic event analysis, described in Section 19.4.3 of ABRR SSAR, was performed in part to satisfy a requirement set forth in Appexxiix A to the Advanced Light Water Reactor Requirementsr h'mont (Reference 19.2). Such an analysis is called for to assure that the standart11 zed plant at the certificaticx1 stage has a balanced design frczn a seismic risk standpoint as well as to daus. Late that the ch=kelon's safety goals (includirg quantitative health objectives) can be fulfilled.
'Ihe main objectives of the seismic event analysis are stated as follows in the ABRR PRA:
(1) 'Ib assure that the ABRR standard plant meets the intent of the IGC policy statement on severe accidents which includes consideration of seismic events as requirements for plant certificaticzi. (2) To gain insights and urn *erstaniirxy of the relative ' contribution to seismic risk of.the individual umpents and structures of the plant. (3) 'Ib understard, within the uncertainty limits, the relative - degree of risk cxxitribution frtzn seismic events in caparisan with other events. (4) 'Ib identify the most probable sequences of events follovirg a seismic event as well as any vulnerabilities (if any) to seismic events. GE's approach to carry out seismic event analpis is described in the next secticri. 19-52 3r,,,p, u , %
, 9Y .. a Draft Predicisional 4.3.1.1 ABWR EA Approach and Assumptions
'Ibe general appInach and methods used in the ABWR PBA seismic event analysis am essentially identical to those uscd in the McRAR II PRA (Reference 19.22) . 'Ihey are generally consistent with the guidelines provided in the FRA Procedures Guide (NUR m/CR-2300,' Reference 19.57) and the PSA Procedure Guide (?UREG/CR-2815, Reference 19.58). GE has also a m ed that the sei mic PRA approach meets the-requirements set forth in the EPRI AIRR Requirements tw , ment (Reference 19.2). Note that, as was the case with internal event analysis, the ABWR seismic'PRA only analyzes com damage sequerces frun power operation up to hot shutdown cordition. Also, no explicit uncertainty analysis was perfortned by GE.
Four major tasks are involved in the aemeemnt of seismic-initiated core damage freqxarcy. 'lhey are: (1) the establishment of a seismic hazard alrve; (ii) the determination of the seismic capability of critical canponents and structures; (iii) system modeling; ard (iv) quantificaticn of accident sequence frequerx:les. Each of these major tasks are dim,W and evaluated in separate sections of this report.
'Ibe AmR seismic event analysis has been conducted makirg use of the several grourd rules ard assumptions as follows:
(i) No credit is given to recovery of'offsite power when lost due to seismic events. (ii) No credit is given to repair or recovery of . mechanical failure of camponents caused by seismic events. (iii) Structural failure.of a building containirg important equipment results in functional failure of all-contained equipment. (iv) Seismic failure of identical redundant ccrrporents at similar locations are treated as deperdent failures, i.e.,, all oaqxnents fail together.-
'Ibe followirs lists saae of the key assumptions described in the AIRR Requirements tw, ment (Reference 19.2) which are also used in the ABWR PRA:
(v) It was ammod that the primary seismic hazard is due to greurd shaking ard that there is no soil failure potential in the rarge of ground motions considered. 19-53 o,,,, ,,,3,,,,,,n,i
m
} .
1 Draf t Predicisictut (vi) 'Ihe seismic hazartl for potential AEHR sites in the future wars characterized by a sirg7- hazarti curve. (vii) Seismic fragilities for a few structures ard ccxtponents were estimted usirn specific design infornation. For the rest of the structurus' ard cortponents, fragilities were assigned on a genaric basis with the' assumption that'they ve achievable jn light of the ABRR evolutionary seismic' design criteria. GE's general appmsch ard assumptions (i) thrtugh (iv) are consistent with the-state-of-the art apprcaches, ard tN past PRA practi s. Assu:tptions (v) tnrough (vii) r-itate frcra the fact that the ABNR seismic IFA is beirq conductrd j for a standard design which has not been built or Incated at j a specific site. 'Ibese assumptions have sweral implica- : tions, ruinly in the area of interface requirurents, and are di m = a later. -t 4.3.1.2 Cerqparison with the AIRR Requim Was Wwe i Based on a preliminary review ard a conference call with GE on January 31, 1991, the staff has ryked the following three differences umong the requirements outlired in i Reference 19.2 arri those used in the AS4R Pi%. J (i) 'Ihe sei.snic hazard curve used in the AB4R PRA is different than that ruccznteix3od in the AIRR Requirements n,r w nt. (ii) Seismic induced fires have not been addressed in the ABWR PRA. (iii) Seismic induced floods have not teen addressed in the ABWR PRA. As will be discussed in Section 19.4.3.2, the staff has'used alternate hazard c22rves in its quantification. 'Ibe impact of using different curves on results is also dic:esmed. GE is in a process of performing.a screening analyses to address items (ii) ard (iii) abcve. 'Ibe staff will review this information when it W- available. 4.3.1.3 Overview of ABWR PFA Results
'Ibe seismic core damage frequencies calculated for various i I'
accident classes in the ABWR FRA are mmraarized in ' ( Table 19.4-1. Roughly speaking, Class I events aru transients with loss of core coolirg, Class II events are 19-54 or,,, p,,o,,,,;,n,g .c
e a Draft Predicisional events with successful core coolirg, but with loss of containment coolirg, ard Clus IV events are anticipated transients without scram (A7h5) without boron injection, but with core cooling available. The total seismic core damage frequercy was calculated to be 2.5 E-7 per year in the ABRR mA. The largest contributien (about 95 percent) to seismic care damage frequency ccures frun Class I sequerms, which have a total seismic CDF of 2.4 E-7 per year. The staff does rot agree with the treatment of Class II sequerces in the ABRR PRA end this issue is di m e d further in Section 19.4.3.5. 4.3.1.4 Review Approach The seismic hazard curve used in the ABNR PRA was reviewed as to its applicability to potential ABWR sites in the central ard eastern United States in light of recent seismic hazard study results. Three representative sites with high seismic hazard were selected to estimate the charges in seismic accident frequercles frm the ABWR PRA values. The methodology used in estimatirg the seismic fragilities of structures ard ccruponents was reviewed. The calculations of fragilities of specific structures and ccrnponents performed by GE were reviewed. The reascriableness of the assignment of gernric fragilities for structures and components was a ed in light of the A&R seismic design criteria. In the systen modelirg area, accident sequences, rardcru failure rates ard human acticris reported in the ABWR PRA were reviewed, ard modified appropriately to be consistent with the findirgs frcan the internal events evaluation ard other seismic related firdings dimmvi later in this chapter. Boolutn equaticris for different accident sequences were developed ard used in requantification. In the review, it was amwd that the systan cutsets developed in the ABRR WA accurately represent the systems. The staff cLid not' develop the fault trees ard cutsets irdeperdently. The results of this review ard xequantification ircitde seismic accident class frequercies estimated usirs different seismic hazard curves, seismic margins for different accident classes ard identification of dczninant contributors in terms of cmponent failures ard accident sequences. Uroertainty analysis usiry families of hazard ard fragility curves wre also carried out. nirther sensitivity studies wre corducted to assess the impact of alternative seismic fragilities for scrne selected ccxtponents. Draft Predecistor.at
r p p ' L" Draft Predicisional-
'Ihe staff review of the AEHR Pfm has focused on both the romerical results ard other insights such as the plant capacity to withstard a large seismic event' . Consistent with the staff guidance (Reference.19.55) to 'ccMuct individual plant examinations for external events (IPEE2:),
the staff has developed margin (High Senfidence of Ipa Probability of failure - IKIPF) . information for the various accident classes. During the review process, the staff aM its contractors: have also focused on identifying the indu-face requirements which will have to be addrW cr1 a specific application; when a plant is built. 4.3.2 Hazard Analysis 4.3.2.1 ABWR Pf% Hazard
'Ibe seismic hazard curve used in the ABWR seismic risk ,
analysis is taken from the m%R II seismic event analysis, except that the effectiva peak ground acceleraticx1 used in the GESSAR hazard curve was converted to peak gru2nd acceleraticx1 (ICA) . 'Ihe ICA was used in the ABWR analysis - in order to be consistent with the ground motical definition for seismic fragility.
'Ihis bamti curve (Fig.19.4-1) was shown in the N%R II seismic event analysis to be a bounding curve of the ' '
best-estimate hazard curves for the Idmerick,, Indian Point, Zion, ard Oyster Creek sites based on the information-available at that time. Fbr the ABWR application, this curve was further ocupared to the marHati hazard curve of the Ooonee site ard found to be bounding -(see GE's response to staff question 725.68, Reference 19.56) . ' 'Ihe soil-structure interaction effect on seismic' risk is not included.in the hazard curve but is treated in the seismic ~ fragility. ' estimate. ' i No uncertainty estimates were made'for the use of a sirgle best-estimate seismic hazard curve for theABWR..'Since the AIRR top-tier requirement states that the mean annual CDF' should be canpared with the goal, this single best ' estimate curve is inferred to represent the mean' value of M=nic '; hazard.. 'Ibe hazard curve does not reflect the more recent ' studies, results ard scientific cpinion concerning , seismicity and seismic hazard for the Eastern United States < (EUS). l 19-56 ,,,,,,, g , g
c l Draft Predicisional 4.3.2.2 Hazard Review Approach To understard how representative the ABWR seismic hazard curve is of EUS sites, ard to sttdy the effect of site variations on the calculated mean CDF, .three different sites, Pilgrim, Saabrook and Watts Bar, were selected and the hazard curves develcred by both the Lawrence Livermore National I.aboratory (IINL) (Reference 19.59) ard the > Electric Power Research Institute (EPRI) ' (Reference 19.60) for these sites were compared with the AIER hazard. 'Ihese three locations in the BJS were selected because of their relatively high seinmic hazard. A omparison amorg thece various hazard estimates, ircltriing that of GE's, is shown in Fig. 19.4-2. 4.3.2.3 Evaluation of ABWR FRA Faind - In Fig.19.4-2, all LINL curves indicate a much larger seismic hazard than the values used in the ABRR analysis. Generally, the EPRI seismic hazard for sites in the HJS is an order of magnitide belcM the LINL hazard. However, even the EPRI mean hazard for Pilgrim ard Seabrook was found to be larger than the ABWR best estimate hazard. 'Ihcreforu, the ABWR seismic hazard cannot be considered to be'a conservative estimate of seismic hazard for the eastern United States, ard does rot appear to account for the large uncertainties which exist in the hazard estimation. 'Ihe AIER seismic hazard curve also irdicates a different sicpe characteristic at accelerations greater than 19 'Ibe impact of different hazard curves on CDF ard identification of derninant ccr:ponents/segw is dierovl in Section 19.4.3.7. 4.3.3 Fragility Analysis
- 4.3.3.1 ABWR Approach *
'Ibe seismic fragility of cupents in the ABWR is redeled usirg a legnormal distributicn with the parameters as median peak grourd acceleration capacity (4) and logarithmic stardard deviation-(8,) hasusenting randcraness in capacity ard urcertainty in the inndian capacity. Note that this representation is equivalent to using a mean fragility curve. 'Ibese parameters are generally estimated using the design information, qualification analyses ard test results.
Seismic fragilities of structures in the reactor building omplex were evaluated follcuirg the nuthcds employed in previous seismic PRAs (Refereroes 19.57 ard 19.58) for:
- Reactor buildiry chear walls
- Cbntainment
~
Draft Predecisionet
Draft Predicisional Reactor prussure vessel pedestal i Detailed fragility calculations for other structures such as the control building and turbine building could not be made at this time. These fragilities were assigned by ocuparison wit.h similar structures in past malmic PRAs. Seismic fragilities of safety-related amem nts were assessed for the following two categories of camponents: u ABWR specific umpreits whose fragility evaluation was m
- according to existing design information.
m Generic cornponents whose fragilities are based on data ocapiled in the "Cortpilation of Fragility Information frun Available Probabilistic Risk A=-nts," dated , September 1988 (Reference 19.61). ABWR Specific Cua4Fr.ud.s Detailed seismic fragility evaluations were perfonned for the follcuing ABRR specific cornponents: Reactor pressure vm1 (RPV) Shroud support Control rod drive (CRD) guide tubes cad housings mel ace.nmalies Generic cua; Ors d.s Detailed fragility evaluations for safety-related ccarponents other than those specific um ra nts presented above could not be rade by E at this stage. The fragilities for generic act:ponents re->-+rded in the Advanced Light Water Reactor (AIMR) Requinusits W*=1t (Reference 19.2) were adopted for the ABWR standard plant. These generic fragilities were chosen based on a review of prior PRAs ard. fragility data. These are considerrd by GE to be achievable for the ABWR with an evolutionary improvement in the seismic capacities of the corponents designed to a 0.3g. Safe Shutdown Earthquake (SSE). Both design specific ard generic fragilities used in the AWR PPA are surtrnarized in Table 19.4-2. (Table 19.4-2 of the ABWR PRA) . Dcs rc,kation that the plant aT i Prrt/ structures have the netwa - capacities is an interface 'Irquirement. [ 19-58 l ,,,,, ,,,g,,,,,,n,g
4 i Draft Predicisional 4.3.3.2 Review and Evaluatico Snecific Structural Fragilities In the fragility evaluation, structums are considered to. fail functionally when inelastic deformtions of the st2mture under seismic load ircrease to the extent that the operability of the safety-related ocrnpanents attached to the structure cannot be assured. 'Ibe ductility limits chosen for the structures were estimated as com:cporaling to the - onset of significant structural damge. 'Ibese definitions of failures Incx3es are ' consistent with the seismic PPA practice.
'Ihe potential of seismic-induced soil failures such as liquefactico, differential settlement, or slope instability is not evaluated at this time since these are highly site dependent. 'Ihese nodes should, however, be considered when an ADNR location is fixed. 'Ihis is an interface requirument.
'Ihe calculations for the following structures were ruviewed:
Median capacity h }K:LPF (9) (9) Reactor Buildirq Shear Walls 2.8 0.45 0.98 Containment 4.3 'O.44 1.54 RW Pedestal 7.9 0.44 2.83
'Ihe HCLPF capacity stated above is calculated by the staff usirg an approximate relationship for inPF as equal ..to 4 times exp (-2.33 B,). 'Ihis approximatimi is consistent with' that In> - era 3ed by the staff in the draft IFEEE guidance hwnt (Reference 19.55) .
'Ibese structural fragility parameters appear to be -
reasonable;' especially, the wwlian ard HCTF capacities of
-the reactor buildirg shear walls and containmnt are judged to be achievable. 'Ibe high capacity of the RW podestal would m &.e its failure contribute negligibly to seismic the CDF.
snecific Cu:vormt Practilities Detailed seismic fragility evaluations were perforrr:d by GE for the follcuing ABWR specific ocupnents: Reactor pressure vessel (RW) 19-59 ,,,,, p o i, w
f :: Draft Predicisional j Shroud support . ;
- Control rod drive (GD) guide tubes ;
GD housings j Fuel assemblies 'i Reactor Pressure Vessel:
'Ibe adian capacity and HCTF capacity of the RPV are 5.3g and 2.4g, respectively. 'lhe value of 8, = 0.33 used 'in the ASE FRA is judged to be low. A later sensitivity study by-the staff assigned a lower mvilan capacity and a higher value of 8,.
RPV Internal Ctrnpanents:
'Jhe internal ocrnpanents examined for seismic fragilities include the shroud support, GD guide tubes, GD housings, and fuel w e lles. Failure of these otmponents could potentially result in inability to insert the control rods to shut down the reactor.
'Ihe critical failure nodes and seismic capacities of these ocupenents are:
Median R:LPF Ocuponent Failure Mode Capacity, c Capacity, a Shroud Support Buckling 1.90 .O.82 GD Guide 'Ibbes Buckling 1.70 0.88 CRD Housing Plastic Yielding 3.90 1.34 Fuel Assemblies Channel Buckling 1.30 0.58 Althcugh these capacities are generally higher than those reported' for these camponerfs in past Boiling Water Reactor (&R) seismic PRAs, review of E's calculations did not reveal any reascns for zuvising the above capacities except for fuel assemblies.
'Ibe seismic capacity of the fuel assemblies was calculated by E as corresporx31ng to a center deflection of 55 mn, .at which scram can be achieved. Hcm'.ver, the u.amait couesruling to this deflection is not the collapse sunst -
as used in the calculaticos. It is some value between the yield moment and the cx)11 apse hu=4t. 'lherefore, the rvvilan ultimate capacity of the fuel assemblics is less than the nrviian value of 1.3g. In a sensitivity study,-the staff has-used a value of 0.92g median capacity to estimate the acx:ident sequence frequencies. l 19-60 ,,,,, ,,,,,,,,,,,,,
~
[ih , 3
~.
Draft Predicisional Generic Camponents Detailed fragility evaluations for many safety-related cmponents could not be made; themfore, GE has assigned generic seismic fragilities 'for these ocuponents ~ consistent with design requirements of the ~AIRR Requirements rh'= ant (Reference 19.2). Table 19.4-2 shows these generic assignments. %ese capacities am considered by GE to be
. achievable for the ABWR with evolutionary inprovements in '
the seismic capacities of wit s s fa designed to SSE of O.3g. 2e review of these fragilities focased on~ the reasonableness'of these estimates in light of the' ABWR seismic design' criteria and based on actual performance of similar equipnent in tests and real earthquakes. 2 e aa4=mic capacities assigned to the following five , ccuponents diffend frcan the AIHR Requirements Dr= ant: cable trays, large flat-bottom storage tanks, accunulators, air-operated valves, and hoat exchangers. 'Ihese capacities' are generally much higher than those reported in past ' seismic PRAs. If credit is taken for these higher j capacities in the PRA, their values should be proved later " when the design and installation am ocmpleted. When + considering the inpact on CDF'and risk, it is notable that only large tanks, Memaa4 further below, are considered to , be inportant. m is is due primarily to the relatively low' seismic capacity of large tanks and their past contribution to risk in PRA accident segaenoes. Details' regardi1g' evalu-ation of other ww=::ut.s can be:found in Refemnoe 19.20. As d4mmaa$ in Sectico '19.4.3.3, the staff. has juckJed that : the generic fragilities for the following cupsits arx! r structures used in the ABWR PRA are opHmia: tic. Although, the staff sensitivity analysis did not ' indicate a major. inpact on the CDF or HCIPF estimates, rk=mstrating that these cuiersits do have assumed capacities may be a. difficult task on a specific. application. .. mis'is.an interface m quirement.' 'Ib assist GE in its response, the staff has included a list of wrE=uds for which . specific information should be developed now. 3 1 19-61 oraft Predecisionat L
.e Draft Predicisional Cerroonent/StmeJt1 rg Fracility Fstimatg Review ADWR Diesel Generators 1.5 2.5 480V HCC (also SW HOC) 1.5 2.5 Batteries and Racks 1.5 3.0 ABWR Fbel Assemblies 0.9 1.3 MIR Heat Exchangers 1.4 2.0 Fire Water Tank 1.4 2.8 '1he issue of "achievability" should also take into account the fact that, for some systems, the fragilities of u g esits at various locations is' represented by a single value. 'Ibe standardization of all Category I stuctures needs to be cxmfirmnd so that the applicability of structural fragilities calculated in this H % to all future ABWR plants can be a - M .
Iarge Flat-Dott m Storage Tanks: Although the ABWR H M ler.ai. (Table 19H.4-6) states that the median capacity of these tanks is 2.lg with 8,' of 0.45, the only tank used in the seismic system analysis (see GE's Insponse to Question 725.72, Reference 19.56) is the fire water tank, with a generic assigned median capacity of 2.8g and a B, of 0.45. 'Ihis makes the HCLPF capacity equal to 0.989 Experience with design and actual performance (Referunae 19.61) of these large yard tanks is that this high capacity is not generally achieved. 'Iherefore, use of ' a W ian value of 1.43g with a HCLPF capacity of 0.50g is made in a sensitivity analysis. 3;!m other snecific cwwrmts of interest are direwd below. Diesel Generators: GE has assigned a median capacity of 2.5g with a B, of 0.45 to the diesel generators. 'Ihis means that the HCIPF capacity is about 0.88g. Although diesel generators by thencelves have high seismic capacities, the peripheral equipment required for the diesel generators to operate can-have low capacities. 'Ibese irclude diesel oil day tanks, control cabinets, air receiver tanks, accunulators, ccuprussors and motors, lube-oil coolers, fuel oil transfer pumpo, heat exchangers, heating and venting equipnent, etc. Scrae of these aceponents have been medeled in systa "PW" (defined as loss of offsite power, loss of emergency power 19-62 ,,, , , p,, , , w
r Draft Predicisional and loss of service water) in the systems analysis; hcuever, other ccruponents such as the diesel day tank, the air receiver tank are not modelal. These ccxuponents could have lower capacities. 1herefore, the staff concludes that the diesel generator fragility is rather optimistic. In a later sensitivity study, the staff has assigned a nucts lower capacity (mr<hn of 1.5g and HCIPF of 0.479) to diesel generators in acknowledgement of lower capacity cxxnpanents in the system. Electrical Eqpipaent: Electrical equipnent incitries switchgear, motor ccritrol centers, inverters, battery chargers, instrumentation racks, load sequencers, control systan cabinets, and other cabinets containirg electrical sensors, switches, or wdaul instruments. Potential failure redes include relay chatter, breaker trip, and structural failure. Relay chatter is addressed below. The seismic capacities assigned to the electrical ecpipment in the structural failure mode are generally higher than the specific capacities calculated in previous seisnde PRAs. For example, the HC7PF capacities of rotor control centers (0.88g), relay switches (0.62g) an-1 battery and battery racks (1.05g) appear to be too high. In the sensitivity analysis the staff has assigned different fragility values to these ccuponents. Dessttation of these capacities is an interface requi m uut. Pelay Chatter GE has stated that the potential for relay chatter was treated in the follovirg manner: Only the scram system function is required durirg a seismic event. This function is fail safe, so relay chatter would cause a safe-state failure (scram). even if relays were employed. For the ABWR, the scram actuating devices are solid-state power' switches with no failure node similar to relay chatter. The scram function is supplemented by an alternate scram mthed (energizing the air header dunp valve) to prtnide diversity. This method uses relay actuation, but no credit was taken for this capability in the seismic analysis; Switchgear ard motor control centers do include relays whose failure could prruent safety actions after the seismic event. It was a m w d that the iniicated capacit'y for this equipment (2.5g) was note representative than the specific relay chatter value (2g). Also, the type of auxiliary relays used tard to be the nost rugged of relay types and would have a capacity abcne 2g. The nultiplexor output devices for ECCS ard RHR operation have been assumed to be 19-63 Draft Predecisional
e Draft Predicisional solid-state devicxs (rather than relays), so that the relay chatter failure node does not apply. Danonstration of these capacities is an interf ace requirunent. Heat Exchangerr.: Because the seismically-intx:ed failure of the RHR heat exchanger could result in a su;pression pool drainage scenario and loss of nelt-release scrubbing capability, the seismic capacity of this exchanger is very inportant to risk estimates. It is the staff's understanding, based cm discussions in a ocnfe.runce call, that GE may increase the median capacity.of this cmponent to 2.8g frm the current median capacity of 2.0g. Other Fracility Related Issues 3he potential of seismic-induced soil failures such as liquefaction, differential settlement, or slope stability is not evaluated at this time since these are highly ~ site dependent. Ikuever, these modes should be considered when the ABWR is sited. This is an interface requironent. No analyses were conducted in the AIER PRA for the potential failure of non-safety related structures and equipnent which could affect safety-related functions. GE stated in response to Question 725.70 (Reference 19.56) that a walkdown of the final wo^uccted plant as well as a review of wo^uoction drawirgs ard h=nts will be performed to verify that the a==i seismic capacities are met or eW. The staff concluded that the plant specific walkdown is one of the most inportant interface requirements and shculd address the potential for failure of non-safety as w.ll as safety related w w ents. The walkdown should focus on potential seismic vulnerabilities such as system interactions, marginal anchorage of.equipuent and gross deviations from the design <h'wnts, and identification of failure modes not analyzed at this time. This is an interface requirement. GE irdicated that ABWR fragilities are achievable and designed to withstand a Regulatory Guido 1.60 design response % Lum with a zero period acceleraticn of 0.3g SSE. Hcucver, the staff finds that this design ground notion may not envelope the site-specific spectra for sites 4 l near same areas in the eastern ard central United States (such as sites near the New Madrid Seismic Zone ard diarleston, South Carolina) and sites in the western U.S., in addition to sites along the California coast. Included in the staff finding is the sigrtificant role that soil l 19-64 oreft predecisionet
Draft Predicisional amplification plays at sites whezu the bedrock is overlain by a layer of soil. It will be rm=un for applicants to subnit a plant-specific pIrbabilistic seismic hazard amlysis in conformans with Section 2.5.2 of the Stardard Review Plan. At sites share the design spectra or the probabilistic hazard curve in the ADWR FRA are eyrm dad by the corresporriing site-specific parameters, the adequacy of the structural design uust be denanRuted by the applicant and subnitted for review and approval by the NRC staff. 'Ihis is an interface requirement.
'Ibe operator L : tion probabilities (dimmM in 19.4.3.4) assume that the operators are not injured in a seismic event to prevent them frun performing these actions. 'Ihe one failuru mode that may disable the operators is the failure of the suspended ceilirg in the control room. In response to Question 723.69, (Reference EE.6), E has stated that the design of the ceilings will be nede to ensure that the ceilirgs are properly braced and equipnent above the ceilirgs is adequately anchored against the design SSE. 'Ihe plant walkdown should focus on this aspect of the spatial systems interaction. 'Ihis is an interface requirement.
4.3.3.3 Summary Evaluation of Frag 111 ties c 's general approach used in developing design specific fragilities is consistent with past PRA practices. 'Ihe staff has cnly identified one camponent (fuel assemblies) where altermte values are suggested for the sensitivity stahr.
'Ibe staff review finds that for several components in the generic cmponent category, the ABWR fragility estimates are optimistic, ard special attention will be regaired on a site specific applicatico to assure that these fragilities are achieved. As a result, the staff has identified several interface requirements dimmead in Secticr119.4.3.8, and also corducted a sensitivity analysis using alternate fragility values. Table 19.4-3 comparts the altermte fragility parameters for scrne ca:Tponents used to study the .
effect of fragility assignment cri the scismic-induced CDF. Results of this sensitivity study are dimmeal in Section 19.4.3.6. Draft Predecisional
Ikh I Ig-p'l-
, i v. p.. a s
*~
w
-Draft Prediclsionat
[ 4.3.4 System ?bdeling ' A 4.3.4.1 Seisntic Fault Trees ;I b , - U
- Seismic fault trees were developed in the ABWR PRA for the . ~
following seven inportant frontline and support systeros that contain couponents having relatively low ~ fragilities: HPCF,
- RCIC, IPFL, RHR (suppression pool-cooling mode), fire water,; ,
service water and electric power. Ack11tionally,'a fault-1 tree is presented to show structural failures thatLoculd-contribute to seismic core riamat= frequency. . No fault tree was w=kocted for the autcmatic depressurization system (ADS), ~ the standby liquid control; system '(SICS): or the 1 reactor' scram system.. The ADS is r W to depressurize the' reactor so that the AC-indepeidiust' fixe water could be used to provide coolant makeup to the reactor.1 The. staff. notes that the structural failures'of.the ADS -wwAs could l also play a role in addition to the human: failure of the' ADS ' system, which only has been' considered in the PPA at this time. Because the PRA has assigned a higher probability-for the human failure of the ADS system,-incorporation;of the, structural failures via a system fault tree will not significantly increase the overall seismic CDF.- Feedvater - ard condensate systens, which require offsite power, were also not nodeled because offsite powerfis conservatively.
- a====4 to be lost to these systems as a result.' of .an p earthgaake.'
Since these fault trees were specifically ' developed for evaluation of. seismically-induced failures,. only those , wi g wits potentially vulnerable to seismic failure ~are2 included. Randczn failures were not explicitly shown as basic events in the fault trees, although they were 'incitded a in the quantification of seismic core ~rlamM= frequency. Also, the assunption of ocuplete depenience,: 1.e., when one: w w wit fails, all like Gm g w d.s fail, made it-untmeary to carry out multi-divisicnal analysis ~ or otroman-cause failure analysis. critical human errors are. identified and 'incitded;in the ' ; analysis; however, they appear mainly in the. event trees.: ^
'Iha important operator actions modeled in~the front-end seisntic analysis incitde the following: y (1) Operator fails to inhibit ADS during an'ATHS (ii) Operator fails.to initiate SILS during an:AIWS (iii) Operator fails to control flow during an A2ES Draft Predecisional r-
Draft Predicisional (iv) Operator fails to depressurize the reactor in a contzulled manner, to permit use of low-prussure injection (v) Operator fails to inject firewater into the RPV (vi) Operator fails to isolate failed RHR heat exdiargers 7he staff's detailed evaluation of fault trees, in general, is described in Section 19.3.5, Calculation of CoIe Damage Frequency Due to Internally Initiated Events. Several seismic specific observaticns with regards to fault trees are described belcw. At this tim it is not possible to in:ltde any spatial-interaction type of failure modes (e.g., valve stem impactire a near by piping or vall) or ficw diversion failure redes whidt may have an 12npact on the total system availability. The use of a single fragility value to represent, say all valves in the system, does trat taPa into account locatico effects. In other words, when a fragility is characterized by a' failure prrhnhility conditioned on the occurrence of the peak grourd acx:eleration; theoretically, the same component on different locations should have different fragility curves as different locations will-experience different 1esy ses to the same gruind motion. The staff assumes that the generic fragility values used in the ADWR PRA represent the cxxaponent location which will experience the most adverse response; fragilities for other locations shculd be lower. This observation is important in light of the win.=:pi. of "adlievable" fragilities dimmW in Section 19.4.3.3. . The above two observations highlight the need for interface requirements and development of guidance to implement these requiruents. Some interface requirements azu dimmced in Section 19.4.3.8. The staff has requested GE to provide a dimmnion on the " design come true (DCT)" principle to . assure the achievability of the estimated fragilities based on the current design practices. 4.3.4.2 Seismic Event Trees The seismic event trees ocnsist of a seismic support state event tree and three seismic front line trees. These trees are described in Appendix 19I of the ABWR PRA. 'The seismic support state event tree starts with seismic events (low, rederate to high intensity). The first event troe top event inquires about whether structural failuru has occurInd, the second top event considers whether or not offsite power is lost and so on. Iws of structural integrity is assumed to 19-67 oran prew
in ] l F. ... l e Draft Predicisional lead to core damage bascd on the grunirules of the analysis and the relative values of seismic . fragilities, ard survival of offsite pcuer results in a p-mful event termiration.
'Ihe three frunt line trees represent the diverse entry corsiitions frun the support state true and various operator actions as follows: (1) loss of offsite power (LOOP) with scram; (2) IDOP without scram with several operator actions to initiate the standby liquid control'(SIC), and initiate low pressure injection at a later tir.e in.same sequences when the high pressure injectica fails; ard (3) IDOP without scram with no initiatico of SIC, but with operator action to achieve shutdown by controlling flow to prevent reactivity increase by borun dilution.
'Ibe seismic contairment event trees, per se, are not evaluated in this section. Ilowever, in certain sequences in which there is initial si-ful core cooling, the li}caliM of core damage deperds on whether the containment heat remcyal functions are available or not. 'Ib this extent, the evaluation of the containment event trees is described in the next section, Accident Sequence Definition.
4.3.4.3 Su:mnary Evaluation of System M11rg As dimmM carlier, the fault tree modelirg essentially includes only the seismic-irdmaa hardware related failures (both structural ard furctional); no spatial. interaction failurus are irwirarated at this time.
'Ibe non-seismic failures are integrated in the quantification at the system level. .Ibe human actions are incorporated as top events anto the event trees.
4.3.5 Accident Sequence Definition Accident sequences are developed usim the event trees described above. 'Ihe accident sequences are classified into three basic classes ard several subclasses as shcwn in Table 19.4-1.- Roughly speakirg, Class I events are transients (or A'IHS) with locs of core coolirg, Class II events are events with stx:cessful corn cooling, but with loss of containment coolim, ard Class IV ' events are anticipated transients without scram-(ATWS) without boron injecticm, but with core cooliry available.
'Ihe evaluation of Class II sequences is d4wW below. As was the case with internal events,. the Class II events frequercy obtained frcxn the event tree analysis was further pr-mi through a seismic containment event true (see Fig.1R7.5-6 of. the ADWR PRA) to give crtdit to RHR recovery for contairunent heat rer:cval (failure protability = 0.66), continued core ccolirg 19-68 ,7 g ,
h Draft Predicisional (failure probability = 0.01) and fire water (failure probability = l 0.1). In the GE seismic analysis, the frequency of Class II events input to the CET is 4.8 E-06. Through consideration of the potential for recovery of containment heat rmoval, continued core cooling, containment venting, and firevater system gxtration, the core damage frequency for this accident class is estimated by GE to be 3.2 E-09. (Note: On page 19.4-11 of the ABWR PRA, the Class II' total seismic CDF is shown to be 4.8 E-9 per year, which appears to be scrnewhat inconsistent with that shown in Fig.13I.5-6 of the ABWR IRA) . 'Ibe staff believes that the benefits of firewater addition are overstatcd in the GE Class II CET, and that a release , frequency of E-07 is more appsvptiate. Specifically, the Class II events entering this seismic containment event tree consist of three types of events, i.e., (i) station blackout sequences with RCIC failure at eight hours and low pressure makeup with the, fire water system; (ii) station blackout sequences with initial failure of RCIC but with successful operation of firewater; and (iii)~ lons of offsite power (D.G. available) A' INS sequerces with sesful high and low pressure cooling but with failure of suppressico pool cooling. 'Ibe bulk of the Class II sequences are type (i) events, which have already enployed fire water as the cnly available means of core cooling. Accordingly, for these Class II events, it is , inconsistent to give credit to firewster as a means of containment cooling given the failure of continued core cooling. An essentially similar seismic containnent event tree (see Fig. 1AT.5-7 of the AIER IBA) was also cmdructed for all the Class IV events, including Classes IV, IV-1 and IV-2,3,5. Credit was given to RHR recoveIy for containment heat removal (failure probability
= 0.93), continued core cooling (failure probability = 0.17) and fire water (failure probability = 0.1). If continued core cooling fails, however, the sequence is considered to lead to core damage '
regardless of whether fire water is 9-ful. By processing thrcugh this seismic containment event tree, the total Class IV events frequency (including Classes IV, IV-1 and IV-2,3,5) was reduced from 7.33 E-8 to 1.16 E-8. .(Note: On page 19.4-11 of the ABWR PRA, the total Class IV seismic CDF is shown to be 7.34 E-10 per year, which appears to be inconsistent with that shown on Fig.- 19J.5-7 of the AIMR PRA) . 'Ibese charges are reflected in the seismic core damage frequency shown in Table 19.4-1. It should be remrked that more than 90 peroant of the Class IV raguences entering the class IV seismic containment event true involve failure of injecting borun into the reactor due to either failure to initiate SICS or failure of flow control / alternate borm. Reactor power will, therefore, remain high and, regardless of whether continued core cooling is available, core damage may ensue. 19-69 Draft Predecisional a
o Draft Predicisional In the AEEE PRA, the largest contribution (about 95 percent) to the seismic core damage frequency ccanes frm Class I sequences, which have a total seismic CDF of 2.37 E-7 per year. However, because of the different treatment of Classes II ard IV sequences, the staff requantification di e l"ed in the next section has resulted in two different contributions. 4.3.6 Quantification of Accident Class Frequencies ard Margin Values In this section, the results of the staff requantification of accident class frequencies are h ibed fr m two perspectives: .; (1) 'Ihe first requantificatico is based cn the " system mbHrg" issues identified by the staff's review. The treatment of Class II ard Class IV sequences is nodified as dia-cod in Section i 19.4.3.5 above, and some of the non-seismic failure probabilities ("rardcut" failures) are revised to be consistent with the staff evaluation of the internal event analysis; (2) 'Ibe secord requantification die _L"ad here is with respect to several alternate hazard curves based on the LIRL and EPRI Eastern Seismicity studies (Paferences 19.59 ard 19.60). I The staff approach to requantification is scmewhat different than the ABWR IPA approach. Details of ard differences between the two approaches are diam "ad in Reference 19.20. Both approaches give essentially the same results usirq the same data verifying the adequacy of the quantification approach. The staff has performed the requantification using the Doolean equations developed for various accident classes. The use of the Boolean equations has allowed the staff to develop accident class level fragilities to develop rargin information. - 4.3.6.1 P===nt of the ABWR Seismic Core Damage Frequency - System Modelirg Issues The mean annual frrxiuencies for the nine accident classes calculated by using E's lumti curve . (extended up to 2g) ard fragility data are shown in Table 19.4-1,' where E's best-estimate values are also shown for ocuparison. . The total seismic CDP obtained by the staff is 1.3 E-06/Iy, alxut a factor of five larger than that obtained by E (2.5 E-07/ry). The cmbined mean annual frequency of all Class I sequences is 6.2 E-07 ccmpared to E's value of 2.4 E-07. The larger values obtained in the staff study can - be attributed, in most cases, to nodifications of sequences I ard changes in random failure probabilities (Table 19.4-4) ard contributions fra earthWas beyond 1.25g. The mean annual frequercy calculated for Class II events is 5.7 E-06 compartd to the A W R PRA value of 4.8 E-06. The staff value was rtduced by an order of magnittxle to 5.7 E-07 by givirg crtdit to containment venting. (The failure probability of 19-70 ,,,,, p,,,,,,,,,n,g i 1 J _ _ _ . _ _ _ _ _ _ _ .._________m___ _ _ _ _
s .
'4 oraf t P edicisiorial 0.1 minly includes functioral failures of the ventirn system, such as the failure of the rupture disc, for which data is scarte. Note that the ABWR seismic HM does not explicitly analyze containment venting).' The AEMR PPA value was reduced to 3.2 E-09 by processirg throtgh a seismic containment event tree, givirq credits to ER recovery, continued core cooliry and fire water.' As explained in-detail in Section 19.4.3.5, the staff believes that GE has-overestimated the credit for firewater addition for Class II sequences and that a value of 5.7 E-07 is more appropriate.
A representative mean fragility curve for one accident class is shown in Fig. 19.4-3. A more detailed dimmion of accident class fragilities is in the next W aM. ion. 4.3.6.2 Hean CDF for Uhree Selected Sites Using LUE or EPPl Hazard Curves Ib study the effect of site variations on the calculated mean CDF, three different sites, Pilgrim, Seabrook and Watts Bar, were selected and the hazard curves developed by b:tJ1 LU E and E mI for these sites were applied. These three locations in the ms were selected because of their relatively high seismic hazard. By ocnvolvirq LUE nean hazard curves with mean fragility curves for different seque:res, the mean annual frequencies of the nine accident classes were calculated for the three dosen sites. Table 19.4-5 shows the caparison of total and accident class core damage frequen::les obtained frta the use of various hazard curves (with the sequences nodified as dimmed above) . From the observations of results in Table 19.4-5, it 'is quite clear that the CDFs are greatly impacted by the choice of a hazard curve. The use of the LUE hazard curves predict nuch higher CDFs than the E MI hazard curves. . Inplications of these estimtes en conparison with the. AIHR ' Requirements Eh'mont CDF and the Nrnbion's subsidiary GF goal are dimW in the conclusion section. More inportant to point cut here is the fact that the rankiry of the scquerres is retust for different hazard curves as highlighted in Table 19.4-6. (This may not be apparent at the, first glance until it is realized that the mean CDFt for-the first two classes differ by a factor of less than tie. Given the rarge of umurtainty in the CDF estimates, this difference is insignificant). The dcminant contributors to various seg w a are listed in Table 19.4-7.
~
19-71 oref t Predeelsioriat
Draft Predicisional The staff further investigated the accident class frequerries to identify the ranges of acceleration that contribute noot significantly to the ovent11 frequency of ocxsirrence of the accident class sequence. A representative example for one hazard curve ard one accident class is shown
'in Fig. 19.4-4. Observations frun this figure charact.erize the general trerd; as seen the contributicn from the acceleration rarges belcw 0.5g is very small. This irdi-cates that very large earthquakes must ocx:ur in order for any significant damage to be done to the ABRR and that the' design is capable of resistirg earthquakes significantly larger than an SSE of 0.3g.
The above observations are not surprising in the light of HCIPF values for the accident classes. Table 19.4-8 lists the HCIPF values for various accident classes. The lowest value of the accident class HCIPF is 0.64g. In.the margin sense, thir,can be interpreted to indicate that there is a very high confidence that core damage would not occur for acceleration levels as great as 0.64g. Further, the HC PF values do not i m u snt a cliff beyond which the capacity decreases sharply. In fact, for the fragility of the IB-2 soquence shown in Fig. 19.4-3, the median value is ap-proximately 1.8g. It is also important to_ note that the proper accounting of the randam failurus in the ccubinations where both seismic and randam failures are involved to cause an accident sequence is essential. For exanple, for Class II sequences, if containment venting is not combined with the fragility of seismic-induced failures, the. inferred HCLPF value for the Class II sequences will be 0.43g rather than 0.739 This point is also highlighted in the staff's draft IPEEE guidance ament (Reference 19.55) . The above dimmion shculd highlight the fact that the numerical CDF results for the ANR design are controlled by nuch larger earthquakes which are nest open to speculations because of the lack of recorded data. The mean CDF frequencies ~are dcninated by uncertainties' in the high hazard estimates. At the same tine, the ABWR plant, with ? the assigned fragilities, is shown to be a rugged plant with respect to a 0.3g SSE. Therefore, the staff, consistent -. with the rectr1merdaticns in the draft IPEEE guidance tMent, believes that the use of bottom line numbers should not be a sole governing criterion to determine the - adequacy of a design. 19-72 ,,,n p, % g
l l [.- . Draft Predicisional -' 4.3.7 Uncertainty and Sensitivity Amlyses 4.3.7.1 Unocrtainty Analysis
'Ibe AWR seismic risk analysis used a sirgle seismic hazard curve with no eglicit ocmsideration of uncertainty.
Similarly, variability in the w1ian soimic capacities of the occponents and structures was also not explicitly aoocunted for. %e results frtan previous PRAs indicate that there is large uncertainty in seismic hazard and in scue of the atmponent median fragilities, often resultirg in orders of mgnitude variability in core damage frequency. %e uncertainty in seismic core damage frequency was estimated in the following by eg licitly treating the unocrtainties in seismic hazard curves for the three sites and seismic - fragilities of ocuponents. Variability in the capacity, 8,, for different ccmponents was split into ranlomness 4 and uncertainty 4 parts, ==ing equal contributim frtu each.
'Ihe representative results of seismic risk quantification for the Pilgrim site seismic hazard curves are given in Table 19.4-9. Note that the mean values in this table agree closely with the results obtained by a convolution of mean hazard and Inan fragility curves, given ,1n Section 19.4.3.6.
l
'Dtis, in part, provides a confirmation for the staff re..uuuuidation made in Reference 19.55 regardirq the use of mean hazard and mean fragility curves to aFproximately cbtain mean CDF values.
In order to differentiate between the contributions of uncertainty in fragility from the uncertainty in hazard, seismic risk quantificatim was repeated using median (4) and 8, values for fragility with a full set of hazard curves. Ccmparison (Table 19.4-10) . of the annual frequency values with the original results iniicate that the contributico of uncertainty in fragility is negligible ard most of the uncertainty in core damage sequence frequencies is due to uncertainty in the seismic hazard. 4.3.7.2 Sensitivity Studies 4.3.7.2.1 Specific and Generic Fragilities In the ANR standard plant seismic PRA, 'a limited number of structures and components were analyzed for specific fragilities; the rust of the ccwts were assigned fragilities generically.
'Ihe structural fragilities specifically evaluated in the ANR sefunnic PFA are for the reactor building shear valls, containment, reactor Draft Prececisiona',
L-
i 4 4
- Draf t Prediclsional pressure vessel and podestal. These appear in the system called SI, i.e. , seismically irduced structural failure. Only the Class IE frequency is affected by structural failures. . 'Ibe mean annual frequency of this sequence is calculated usirg the ABWR sejsmic har.azrl curve as 5.3 E-08; if only the SI system is retained in this sequerce, this frequency is decreased slightly to 4.9 E-08. About 50 percent of this frequency ccans frm the u. shul building and the rest ocznes frm the reactor buildirg. -
only Class IB-2 is directly affected by the RPV - related failures, i.e., ABRR specific components such as the RW, shroud support, GD guide tubes, CRD housinJs, and fuel mamblics. . When these cor:ponents were renoved frm the Boolean equation of this Class, the nean annual frequency dropped from 4.1 E-07 to 3.9 E-07, demonstrating that the generic camponents provide the dminant contribution to the class frequency. 4.3.7.2.2 Alternative Fragilities The accident class mean frequemies were calculated using different seismic hazard curves an$ alternative seismic fragilities frm Table 19.4-3. Table 19.4-11 shows the results, includirq HCIPF values resulting from the use of different fragilities. It is seen that the mean annual frequency of Class IB-2 increased by about a factor of two; this is because of changes in the fragilities of the reactor internals and the fire water tank. The mean annual frequercy of Class IE increased by a factor of 6 to 8. This increase is mainly due to the revised value of the ' control buildirg fragility. The Class II frequency ircreased by about a factor of two. ' The Class IV frequency also increased by a factor of two. 4.3.8 Summary of Results, Interface Requirements, and Cbnclusions 4.3.8.1 Summary of Results Table 19.4-12 sumarizes the nean CDF of various accident classes cbtained in the seismic requantifications usirg IDTL seismic hazard curves, alorg with the mean CDF estimated by the staff for internal events (with the original fragility values). Note that all of these results are cbtained from urcertainty analysis. The total CDF of all accident classes due to seismic events ranges frm 4.6 E-05 to 8.5 E-05. If
~
Draft Predecisional
n b-e. Draf t Predicistorial they are combined with the firquency due to internal events, the total CDP fmn both interml events ard seismic events would rarge fmn 4.7 E-05 to 8.6 E-05. liowever, the three sites chocen for the evaluation represent sites where higher hazard estimtes have been predicted using the IINL unthodolcgy. Tbr the sam three sites, the resultirg seismic core damge frequencies using the EPRI hazard , l estimtes rarge frm 1.1 E-6 to 2.9 E-6, with the range of the total caru damge frequency being 1.8 E-6 to 3.6 E-6. Also, for nany other WS sites, particularly those in the low seismic areas (e.g. Florida or the Gulf Cbast Region), the seismically-indu d core damge frequencies can easily be one or two oniec of mgnittrie lower than that cmputed above. As an exanple, results are also shown for a
~
midwestern site in Table 19.4-11. . 'Ibe calculated CDF for this site is 2 E-5, even with the alternative fragility values. 'Iberefore, it is r-my to recognize that: (1) even for the sane site, hazard predictions can be vastly . different usirs different, but equally acceptable, nothods; (2) maan hazard predicticos are driven by the large uncertainties arri outlier estimates; and (3) in a vast area, such as the WS, seismic hazard varies a great deal fmn site to site. It is rmwy that any conclusions regarding site suitability or design suitability not be governed by usiJg numerical results in the absolute sense. Other insights, such as the plant Itygedness, the nature of predicted sequences, and identification of failures contributing to the sequences should also be taken into account. It should be rararked that the annual frequencies of Class II seismic events shown in Table 19.4-12 are those after givirq cru11t to containment ventirg by aneming the failure probability of ventity to be 0.1. For Class II seismic events, about 79 percent of the contributico'to the mean frequerry ccmes frun earthquakes, with peak greurd acceleration less than 19 Under these accelerations, the contalment structural integrity is' preserved since the liCLPF capacity of the containment is abcut ig. It .is, therefore, reasonable to aem= that the cperator would be able to vent the contalment if the ventiJg is to be 'done manually. A review of the liCLPF capacities for different accident classes also ruveals the importance of certain classes. Frun Table 19.4-12, it can be secn that the two classes with the lowest liCwF capacities are Class IB-2 (HCTF = 0.64 g) and Class II (HC TF = 0.73g). With the altem3tive fragility estimtes, these HCTF capacities are charged to 0.63g arr$ 0.7g respectively, which are still abcut twice the plant SSE. 'Ihese capacities, therefore, appear to have 19-75
,,,,,p, % g i.
s
. 1 oraft Predicisional-considerable nargins. It is inportant to note, however, that for sequences where the ambient containment pressure is not rdM sufficiently to allow the operationLof steam-driven punps, the HCIPF value for the plant reduces to L
- 0. 4 3g. - 'Ihe robustness of the rankiry of sequences,l and hence contributity failures, was dia' W in the previous-sections.
Finally, the ABWR w i mic PFA considered isolation of a pimically induced RHR heat exchanger failure to prevent draining of the suppression pool. However, seismic' events 1 Ming to an early failure of omtainment isolatim are not' explicitly analyzed. Although failures'of the ECCS lines' and related valves appear to be inplicitly. treated, failures '
,l of other contalment penetration lines. (e.g., inert lines,
, IIRP lines, and purge lines) or containment isolation valves due to seimin events are not addressed. 'Ihis may have see. inpact on risk integration. 'Ihe staff has concluded that CE should provide an evaluation of the probability and consequences of contalment persLation lines or contalment isolation valves failing durirg a seismic' event. 'Ihis is an cutstanding ih. r
,r e
l
- l. 19-76 oreft predecielenet l8
m - 4 4-Draft Predicisional 4.3.8.2 Seismic Review (bnclusions Frcan this review, the follcwiry conclusions are drawn: (1) The study identified the dcaninant sequences contributirg to seismic risk and demarstrated that the high confidence-law probability of failure accelerations (seismic margins) for these sequences are 0.64g or-greater. It is concluded, therefore, that the ABWR standard design for structures and equipnent exhibit seismic capability significantly beyond Safe Shutdown Earthquake acceleraticri levels (approximately twice the SSE) as larg as the assigrxd seismic capacities are achieved, and unanalyzed failure nodes do not have adverse impacts. (2) By convolving the accident class fragilities with the seismic hazard curves, the annual frequerries of the accident classes were obtainal. The results usirq the IINL seismic hazard curves' demonstrate that the mean annual occurrence frequency of seismically irduced core damage for the AWR stardard design is in the rarge of 4.9 E-05 to 7.5 E-05 for the three sites stuited. The correcpcniirg values usire the EPRI hazard curves range frun 1.1 E-06 to 2.9 E-06. For the sites chosen, the use of the LINL hazard estimates indicates that the AIMR design goal of 1 E-5 for the CDF is exceeded; however, for the same sites the use of the EPRI hazard estimates iJrlicates that the CDF estimates are quite below the goal. Even with the alternate fragility values and the higher of the two hazard estimates, CDP for high seismic sites in the Eastern United States is in the order of 2 E-04. For a nere representative site, this estimate-is in order of 2 E-5. (3) An analysis of the contribution of different peak ground acceleration rarges to the core damage accident. class frequencies deram> Lated that the contribution of earthquakes up to 0.5g pga is not significant. This supports the conclusion.that very large earthquakes must occur in order for any significant damage to be done to the plant. (4) The influence of uncertainty in different ammptions made in the fragility modelirg and seismic hazard on the core damage class frequencies was investigated. From , this, it is corclud(d that the results are fairly irsensitive to uncertainty in fragility and are driven by uncertainty in seimdc hazard. 19-77 ,,,,, p, g
W j i* [7 . Draft Predicisional 1 (5) 'Ihe sensitivity of the accident class frequencies to j seismic M ard was a& trussed by cogarity the results , obtained using the hazard curves develoral by IJJTL ard I EPRI for the Pilgrim, Seabrook and Rstts Bar sites.' 'Ihe ! results showed that, while gross differen::es in hazard models can significantly affect the accident class frtquencies, the inportance or ordering of different classes in terns of their contribution to the total coir damage frequency is not significantly affected. (6) For the three alternative sites examined, the accident { classes IB-2,' IC arti II were identified as dczninant in their contribution to the total core damage frequercy. (7) 'Ibe seismic margins expressed as the High Confidence'of Iow Probsility Failure capacities for accider.t classes IB-2 ard IC are 0.64g and 0.88g, respectively. For accident class II, the seismic margin is 0.73g. (8) 'Ibe rankiry of the sequerces, and hence contributing failures, are insensitive to the hazard seier.t. ion ard is, therefore, relatively robust. In sumary, pending the resolution of open items, the ADRR plant design frcan the perspective of sei'mim11y-induced severe accidents is dem:nstrated to have a significant capacity beyond the design basis. With the a = =vi fragilities, the camputed range of seismic CDFs dercimkate that the plant design cnlld be located at many of the W S 4 sic s with the likelihood that the CDF will be less than 1 E-4. In order to deicrobate such a suitability, a number of interfacing requilments will have to be met, aM a site / plant specific seismic PRA will have to be parformed such that failure modes not considered at this stage do.not invalidate the above conclusions. 'Ibese conclusions are based on the core damage accident sequences Arduced by the seismic events,.the' review of consequence analysis ard other deterministic design reviews contained in other parts of this SER may have separate requirments ard conclusions. 4.4 Interface Requirements for Otter Dcterral Events
- 1. 'Ibe staff, consistent with the rre----rdstions of a
Reference 19.53, pendirg the staff. review of the AIRR Requirements nv= cat, requires that a site ard design verification be performed when a specific site is selected for the external events, such as external floods aM transportation hazards, for which to aralyses can be perforrred at this stage. {
- l l 19-78 ,,,,, ,, , .
L...
- 4 p- ._
- g
;1i '
l , Draft Predicisional. 4 2.. 'Ihe probabilistic amlysis for interm1' floods must be, .: perforned when a specific site is selected and the plant is ' built. 4.5 Deternal Events Review Conclusions Review findirgs for the tornado strike and seimnic events are diemaul in Sections 19.4.2 and 19.4.3.8.3, rWdvely. . ' With . respect to other events, GE has not ocnducted any quantitative analyses. It is concluded that scue quantitative amlyses should be performed for fire and - interml flood hazards. :Jbr other external events, suc21 as external , floods ard transportation accidents, site specific evaluations will have to be performed to dew = Late no adverse inpact cn the risk from these " events. Walkdowns are the major interface requiimed.= for the external y events. For the seismic and. tornado events, the design, with the assigned fragility values, has been shcun to be rugged for the beyond design , basis events.. 'Ibe ocmputed CDPa indicate- that the design can be placed - 1 at noot of the Els sites. However, a considerable interface requirement ' evaluation will be needed on a site-specific application to d= w = L ate that assumptions made in the PRA are not grossly violated and the site - ? specific features do not adversely affect the cxmputed CDFs or other insights. t
.)
.r
?
r t l. I' , 19-79 Draft Predecisional L,
, .. ,- . . - - . .. , , +
, .'i 4
Draft Predicisional y. Table 19.4 1 Caparism of Seisde' Core Darage Fruprcy thiry G.E. Itazard and Fragility Data (MW PRA Best Estinate Values
. vs. Staff 55mnsoraf steun Values) .
Alp MIA Stoff-kxrsoral : Acciderit test-Estinste (N Raz.aritt ficatim Mari (2)F rdegg Descriptim yfy,) MId IA Trursteits follmed ty felltst of high grummte ' 24 E 9 - 4.8 E-9 core coollry arti feiltre to dgrise*' *ie remetw. 18 2 Station tdeckout eats with ACIC o e6 . fw 7.2 E-8 4.1 E-7 corv coollrg fw appulas'.ely 8 hon. , IC AM eats withe term inject 'on, coLpled 9.0 E-8 9.5 E 8 with loss of corv coolity. Vamorl feiltes et' . Low pressore. ; ID Transients follcued by loss of h gh pressure 2.3F 5.5 E 8 corv coollry, en==ful dgneau lastion, but loss of lcw preesisu cars coollrg. 11 AM ewnts without term injectim, czapled 5.0 E 6 5.3 E-8 with loss of core coollrg. Vessel feiltst at high presare. -
!! Transient, LCCA sid AM (with bortn ir jection) 3.2 E-9 " 5.7 E-7" -*
events with stcomesful corv coollrg, tut with possible felltre of carteirwent. IV AM eats without baron in}ection, tut with 2.'. 5 4 E-8 corv caollrg swelldde. ? IV-1 AM with one injectim pap runtry. 9.9 E 10 1.3 E 8 :
*==aful flow centrol. ,
IV-2,3,5* AM with 2,3 or 5 pJgs runirs. Operwtor 7.9 E-9 , 4.1 E-8 falls to cxritrol flew. ' Total 2.5 E-7 1.3 E 6
- IV 2 AM with RCIC feiltre 2 IPCF paps are ninity. Quretor falls to cetrol flow. . ;
IV 3 AM with 3 pumps (RCIC + 2 teCF, or 3 LML) runire.' Quretor fails to emtrol flow. IV 5 AM with an ADS actuation or e attsk-gun SIV. All leCF ard LML pass art annued to be in cperation. Operator falls- , to cetrol flw. -
" This value reflects the falltse pntability of contairwant untire, ibl& ses taken to be 0.1. The frwaarry tuforv '
giviry crvdit to contalruert writics was 5.7 E 6.
'" The fratarry tefore prtressire thrtagh eeisnic cxritalruunt egnt tree nas 4.8 E-6.
l l l I: J P !L f 19-80 nr.ft pr.4eci.i.n.l l , [ m b 1 y !., _~ . -.
q , s gy
. . ~ ,
r ,( b - i $ c
',, ,Y
t
; ; ) . '- '
OV ,.. ., d Draft Predicisional,
.N : y _
Table 19.4-2 AaJt selenic Fragility sumwy . (Tdde 19.4 2 c' the ASA s*A) stnzttrWDmconents Feiltre Pto* Cocacitvl fa). . Canbinad 2~
-ltoertainty neector bido sheer a lls samr 2.8 0.45 C '
.Containannt Shear 4.3 0.44 RPV Pudestal Flemsst 7.9 0 44 Ccritrol Mlding Flearal 2.0 0.50
- futine AAldire . Flearal 1.0 0.50 meneter priestre veneet mirt arder bolts 5.3 0.33 Shrud st4 port tzklire 1.9 0.36-
' 00 spide tthes kzkling 1.7 0.36 00 hasites Plastic yieldiry 3.9 0.46 Fuel Aa==Nies Owwwl tu:klity 1.3 0.35 Cable trays . 24 port 2.0 - 0.60 Betteries and bettery racks Marage/LOF 3.0 0.45 Bettery chargers /irmertens LOF 1J 0.45
- Elwtric acpAsmarst (chetter) ftreticr1 recpired drire event Relay chatterfra 0.8 0.50 -
ftirticn recpired after eient heley chatterire 2.0 0.50 Punctbosnk/!rutrusuntetten purels Furtionst/Stru:tirol 3.0 - 0.45 awitegmarpetor control cariters Fu1ctieml/strtetirst '
' 2.5 0.45 <
Trrsfonners. Fuictional/strtetural 1.5 0.45 Diesel emerators & st4 port systems 24 port 2.5 0.45 Tiabire-* hun pu ps Andieruse 2.0 '0.45 letardian pumps ArW! speller drf te 1.6 0.45 hast enchargani/siell tarks Anderuse 2.0 0.45
' Air-sperated wles stee birdirWAir tire 3.0 0.40 8twor-eparated welws
@erster distortion 3.0 0.60' tefety relief, suruel & ched
'wtws Interrei chnuse 3.0 0.60 Ivtuulic cerwrol mits LOF 2.0 0.50 h = dstars 24prt 2.0 Large flat-botten storage ts*s 0.45.
M orage 0.9 0.45' iscsLeting 24 port 2.0 i 0.60 Air turdllry mits Black rtibire 2.0 Pipire 0.50 84 port 3.0 0.60 -
' tried eselchd steel pipirg skzklirs/ Sport 2.0 0.40 i
f 4
' Capacities are in terms of median ground acceleration.
2 ' Combined uncertainties are composite logarithmic standard deviations of : .j uncertainty and randomness components. 19-81 Draft Predecisiotul.
- { .
5 e
- h. (
- 1 L C , g, , ; i ;- ,
w> , i. ,
- .;J{. ' '
> t f . . ..
' Draft Predicisfonal L .
Table 19.4-3 Alternative Fragility Values for. Selected Ccuponents Alterretiw voltas . O inirmi Vetues carrrures Camcity f a) Carbitud - EM(g) CapacitWa) . Cotined NCLPF(G) trcertainty ttreetainty . catrol 1.5 0.50 0.47 2.8 0.45 0.98 Buildire
- Diesel 1.5 0.50 0.47 2.5 - 0.45 0.5 Gerwrotori Trwufonuer 1.1 0.45 0.39 1.5 0.45 0.53 (4M V E) estteries and 1.5 0.45 0.52 3.0 0.45' 1.05 kacks Bettery ther- 1.1 0.45 0.39 1.3 0.45 0.46 gers Irwrters hetsy Switches 1.3 0.50 0.40 2.0 0.50 0.62 ,
(120 V) Trarsfonners 1.1 0.45 0.39 1.5 0.45 0.53 ~ (4tD V 1W) Mor Cmtrol 1.5 0.50 0.47 2.5 0.45 0.2 + Ctr (4l10 V IW) Fuel Asessly 0.9 0.35 0.40 1.3 0.35 0.58 Most Ederger 1.4 0.45 0.50 2.0 0.45 0.70 Tarts (sLC) 1.1 0.45 0.39 1.5 0.45 0.53 Twt 1.4 0.45 0.50 2.8 ~0.45 0.96 (fire teter) r nant Excharger 1.4 0.45 0.50 2.C' O.45 0.7D '" (1W) Room Air Cord. 1.2 0.50 0.37 2.0 0.50 0.62 Unit. , Map, Mor 1.6 0.45 0.M ' ' 1.6 0.45 0.% ; lore: Reforwoe 19.2D crreairs emplanstles for attemate frrellity asslysurts. t E
+
?
?
1 I i i 19-82 oreft pr e ist a t [
^
g? l. y Draft Predicisiona! Table 19.4-4 Randan failum Probabilities Used in Quantifying Seismic Com Damage Frequency (Staff Requantification)
- Seismic Randan Failure Error Factor Event Tree Probability for Lognonnal Top Event Definition (Mean Value) Distribution C Scram and ARI failure. 1.0 E-06 5 C4 Failure to initiate SLC. 0.2 3 C42 Failure to initiate SLC follosing 0.3 2 failure to inhibit /DS.
FA Failum of fim water. 0.1 3-FCTR Flow control /altemate borun. 0.2 3 HX R m heat exchanger failure 6.0 E-03 3 LOP Loss of offsite power. 0 - LPL SRVs fail to open. 1.0 E-02 3 PA Failure to inhibit ADS. 0.1 3 PC SRVs fail to reclose. 3.0 E-03 5 PC2 SRVs fail to reclose during ATWS. 0.1 3 PW Emergency power / emergency service 0 - water. SI Structural integrity. 0 - U1 8.0 E-03 Failure of HPCF (1 out of 2). 3 UR Failure of RCIC. 4.0 E-02 3 UR2 Failum of RCIC (ATWS). 5.2 E-02 3 V 7.4 E-02 Failure of LPFL (1 out of 3). 3 W1 1.6 E-03 Failum of RHR (1 out of 3). 3 W2 3.9 E-02 Failure of RHR (2 out of 3). . 3 X Failure of manual depressurization. 2.0 E-03 3 XI Failum of tranual depmssurization 2.0 E-02 5 (station blackout). X2 Failum of manual depressurization 1.0 E-01 5 (ATWS). Draft Predecisional r
m ,. ,
,, x, , , , ,
p,9 p ., ; . . a . hk Draft Predicisional
.LTable 19.4-5 Advanced Boiling Water Reactor Design - A Slcmary of Mean Core Damage Frequency Based on RL (Internal Event 5) and EQE-BL (Seismic Events) Requantifications Maan _
Mom Core Danage C.D.F. de Fraprey Due to . to Intemel Sefanic Ewnts
'Accidmt Events
-. Claus Ury)
Seismic Nazard of .LINL, Mann EMtl Maan. ant MtA hazard Cme Nazard QJrW Pilgrim Soutruk htts har Pite le ' Sestruk htts Bar i
. i 1A 3.4 E 7 4.8 E-9 2J E 7 15E7 2.6 E 7 9.9 E-9 6.3 E-9 3.8 E-9 M p t(2) 1.8 E 8 - ~ - -- -~ --- ~~-
~~- --~
' 18 2 6.1 E-9 4.1 E-7 2.2 E ' 1.5 E-5 2.3 E-5 9.5 E-7 6.057 3.6 E 7 ,
18-3 N3 6.4 E-10 ~~- -- ~ ~ - --- - - - ~~- ~ ~ . IC 8.0 E 10 9.5 E-8 1.8 E 5 1.2 E-5 1.7 E 5 3.3 E 7 3.4 E 7 ~ 2.0 E-7 ,o ID 1.1 E-7 5.5 E 8 3.5 E4 2.3E4 3.7 E-6 1.2 E-7 8.6 E 7 5.1 E 8 IE --~ 0) 5.3 E-8 7.3 E4 5.1 E4 7.0 E4 ' 1.6 E 7. 1.5 E 7 8.6 E 8
'11 2.8 E-8 5.7 E /') 1J E-5('I 9.9 E4('I 1.7 E-5(') .1.1E4(') -5.5E-/'I 3.4 E 7(') 4
!!IA(5) 5.3 E 9 ---- -- -~~ -~~ ~~- -~ ~~-
-IIID OI 1.3 E 6 ~~- -, -- ---- - - - ~ - -- ----
IV 2.3 E-7 5.6E-8 4.2 E4 2.7 E4 4.3 E4 1.2 E 7 ' ' 9.3 E 8 .5.6 E-8 <
;IV-1(6)' ~~-
1.3 E-6 7.1 E-7 4.5 E-7 7.5 E 7 2.5 E 8 1.7 E-8 ' 1.0 E-8 IV-2,3,5(6) ---- 4.1 E-8 1.5 E4 1.0 E4 1J E4 . 8.1 E-8'- 4.7 E 8 2.8 E-8 I
'Totet 7.5 E 7 1.3 E4 7.0 E-5 4.9 E 5 7.5 E 5 2.9E-6' 1.9 E4 1.1 E-6. ,
(1)' This is C.E.*s tunfiry hazard cww takan from EssaR 11 MtA. . . G) For seismic ewnts, core enuse fruprries da to etenses 101 ard 15 3 (statim idadmut with RCic fellwe) are censidered , , rustigible. Q) For interval ewwits, to distirctim is sede betnam class IC (AM, _msel fellwe et low preneure) ard Class IE (AM, weset failure et high pnesswe). >
- (4) These wluss reflect the failure snbability of contairsurit untirg, iAlch nas take to be 0.1. . .
d) Class !!! selenic CDF is rustigitdy sell h =a of rotetlwty Lcw selsnic fragility of the pipire ard other presswe tantuy - coup - ts. C) Thane sLtelasses of Class IV ennts ears rot ccrsidered in the ant MtA iriterrut ownt armtpis. IV-1' AM orith one inje-tim psp runirs. en=aafut flaw centrol. "
. IV-2' AM with RCic falture.' 2 IFCr paps one tunirg.
IV-3 AM with 3 punps (nCIC.+ 2 IFCF or 3 LML) runirg. IV-5 AM with sos acusted or a stui gun stV. All IPCT ard LPFL pays art nanirg. ,
..for IV-2, IV 3 ard IV 5. gerster falls to cmtrol ficw.
19-84' Draft predecisionet b
' ~'
m 3.; i [. v. Draft Predicisional-li- :19.4.6. Carperism of Men knat seame Fraurcy onwire fcr Diffenrt seismic hazard arws -
- I
, Lut Hazard , , EPRI Hazard ,
AmJt Msuni Pilrie sadrai Watts Bar Pitrie Sadruk htts Bar - s .- p Seurre frugaricy* Rark Fesprey Rar* Fraprry Aark fruprry Rs* Frugarry Rark Frapuncy Asr* . . Fruptcy Aark 1A , 4K@ 9 2.3E-07 9 1.M @ 9 2 4 9 9.9E@ 9 6.2-OP 9 3K@ 9' 18 2 4.1E @ 2 2.15 @ 1 1.5E4 2.X4 9.5E-07 -2 1 1 5.9E @ 2- - 3 R -07 2-IC 9.5E 4 3 1R4 2 1.2 4 2 1.7E 4 3 3.E-07 3 3.4E-07 ' 3 1.9E-07 *3 L ID 5.5E @ $ 3.M@ 6 2.1-06 6 3.7E-06 6 1.5 07 6 8 4 -08 ' 6 5.1E-08 '6. IE 5.3E-m 6 7.24 4 5.1E 4 4 7.0E 4 4 1 K -07 4 1.MW 4 8.6E-05 4:
!!" 5.7E4 - 1 1.X 4 3 9.9E 4 3 1.7E 4 2 1.1E-06 5.5E 07 ,1 3 4 -07 1
1. IV 5.6E 05 4 4.3@ 5 2.7E4 5 4.3E 4 5 1.2-07 5 9.5E-08 5 ' SR@ $
'IV-1 1.E@ 8 7.1E-07 8 4.5E 07 8 7.M-07 8 2.M@ 8 1.7E-0B 8 1.0E-M 8
,3,5 4.1E 4 7 1.5E-06 7 1.0E4 7 12 4 7 8.1E-08 7 4.7E-CB ' '7 2 A -08 7 j
.]
')
I i Draft Predecisional fl l
-i
(
g ., H. .. e p , if Draft Predicisional ' 1 Table 19.4-7 Daninant Contributors to Accident Class FWies Based on ! 1 Calculations Usirg Mean IIRL Seismic 1hmti - Curve for Pilgrim Site m . Rank Order of Accident , Mean Annual Class Accident Frequency class Daninant contributors
- L IA 2.3 E-7 9 Mostly high capacity doubles and triples IB-2 2.2 E-5 1 Inverters, 480 V AC transformer, Service Water Punp IC 1.8 E-5 2 Ibel MM14es ,
ID 3.5 E-6 6 Notor driven punps IE 7.3 E-6 4' Reactor buildirg, ccotrol bd1dtrg II 1.3 E-5 3 Inverters, 480 V AC transformer,. service water punp,. motor driven punp IV 4.2 E-6 5 Mostly doubles
-1 IV-1 7.1 E-7 8 Mostly doubles IV-2,3,5 1.5 E-6 7 Mostly doubles e
h Total 6.9 E-5 l
- Inss of offsite power is amW to occur at small earthquake aMeration values.
I l t l: Draft Predecisional 1 l. l-
' Draft Predicitional..
,i' y 4 .;
'{ Ju j Table 19.'4-8 - HCLPF Values for Accident Classes Classes HCIPF(a).
IA : IB-2 0.64 IC- 0.88 ID 1.01 l IE 0.91 II 0.73
. IV 0.86 IV-1 -
IV-2,3,5 - e MIE: Failure probability of containment venting (0.1) 'is included in OaSS II RDRlySiS. 9 n a I .)' k Draft Predecisional
't. , -
r .-,- .m ,
., s + - , , , . '.i--s e o
e Il Draft Predicisional L Table 19.4-9 Annual Cbre Damage Sequence Frug.lencies Calculated using LUE Seismic- ! Hazard Curves for the Pilgrin Site Sequence HCIFF(g) Hean Median 5% Cbnfidence 95% Confidence IA - 3.6 E-07 1.1 E-08 5.6 E-11 8.0 E-07 IB-2 0.64 2.7 E-05 1.2 E-06 6.5 E-09 6.7 E-05 IC 0.88 2.3 E-05 6.8 E-07 8.5 E-10 5.1 E-05 ID 1.01 3.8 E-06 1.4 E-07 7.2 E-10 8.7 E-06 IE 0.91 9.5 E-06 1.8 E-07 2.0 E-10 1.9 E-05 II* 0.73** 1.3 E-05 8.6 E-07' 1.1 E-08 3.7 E-05 IV 0.86 5.6 E-06 1.6 E-07 3.8 E-10 1.2 E-05 IV-1 - 6.6 E-07 1.8 E-08 5.5 E-11 1.5 E-06 IV-2,3,5 - 1.9 E-06 5.8 E-08 2.4 E-10 4.3 E-06
- Failure prttability of containment venting (0.1) is included
** HCLPF without containment ventirg is 0.439 Draft Predecisional 5
s' g._g &
'.we' '
Draft Predicisionet Table 19.4-10 Oceparison of Cbre Dmage Frequency for Different Sequences usirg (4, B,, B,). aM. (4, S,) with Full ~ Set of IDE Seismic Hazard Curves for Pilgrim Site i - With (4, S,, #,) i i With (4, B,) i
-5% 95% 5% 95%
Sequen Mean Mailan Cbnfidence cbnfidenm Mean Median Cbnfidence confidence IA 3.6E-07 1.1E 5.6E-11 8.0E-07 2.42E-07 1.31E-08 8.80E-11 6.5E-07 IB-2 2.74E-05 1.15E-06 6.46E-09 6.65E-05 2.59E-05 1.24E-06 7.97E 6.61E-05 IC 2.28E-05 6.78E-07 8.51E-10 . 5.10E-05 2.29E-05 7.74E-07 1.29E-09 5.63E-05 ID 3.76E-06 1.37E-07 -7.17E-10 - 8.74E-06 3.89E-06 1.86E-07 1.02E 1.00E-05 IE 9.45E-06' 1.82E 2.04E-10 . 1.86E-05 1.03E 3.60E-07 9.50E-10 2.49E-05. ' II* 1.30E-05 8.58E 1.05E-08 ' 3.71E-05 1.05E-05 8.82E-07 1.49E-08 3.29E-05 IV 5.57E-06 1.63E-07. 3.75E-10 1.23E-05 4.42E-06 2.00E-07 6.48E-10 1.13E-05 IV-1 6.58E-07. '1.84E-08 5.54E-11 1.46E-06 6.72E-07 3.43E-08 ' 1.54E-10 1.78E-06 IV-2,3,5 1.88E-06~ 5.82E-08 2.43E-10 4.33E 1.51E-06 9.25E-08 6.63E 4.19E-06 Draft Fredecisionet
.i s s s . ~, . h. -
e I Draft Predicisional
. Table 19.4-11 Accident Class Frequencies for Different Sites with Modified'Fragilitiies (LINL Hazard CLirves)
Class Pilgrim Seabrook Watts Bar . Zion HCIPF , IA 1.88.E-07 1.38 E-07 -2.39 E-07 4.10 E-08. - IB-2 5.59 E-05 3.99 E-05 16.38 E-05 6.79 E-06 . 0.63
^
IC 2.14 E-05 1.42 E-05 2.18 E-05 1.89 E-06 0.85
- ID 3.43 E-06 2.34 E-06 3.95 E-06, 4.07 E-07 -
II 5.24 E-05 3.71 E-05 5.90 E-05 5.44 E-06 0.66 II 1.96 E-05 1.59 E-05 2.79 E-05 3.20 E-06 0.70 IV 9.84 E-06 6.72 E-06 1.14 E-05 1.37 E-06 0.89 IV-1 5.21 E-07 3.87 E-07 6.76 E-07 7.34 E-08 - IV-2 1.92 E-06 1.58 E-06. 2.80 E-06 4.31 E-07 - Total 1.65 E-04 1.18 E-04 1.91 E-04 - 1.96 E-05 4 i,, 19-90 Draft Predecisional a- , ______ - w - - '
t,i_ c 1
= ^
Draft Predicisionat Table 19.4-12 Hean. Core Damage Frequency Based on BNL (Intemal Events) and EQE-BNL
-(Seismic Events) Uncertainty Analyses l
Hean C.D.F. Due . .Nean Com Damage Frequency to Internal .. Due to Seismic Events HCLPF Accident Events Using LLNL Seismic Hazani Curves * (g)- l ;- Class (/ry) (/ry) Pilgrim Seabrook Watts Bar IA 3.4E-7 3.6E-7 2.lE-7 3.7E-7 IB-1 1.8E-8 18-2 6.lE-9 2.7E-5 1.6E-5 2.6E-5 0.6 ,- IB-3 6.4E-10 - IC 8.0E-10 2.3E-5 1.2E-5 1.8E-5 0.9 ID 1.1E-7 3.8E-6 2.2E-6 3.6E-6 1.0 IE 9.5E-6 4.7E-6 7.5E-6 1; 0.9 II 2.8E-8 1.3E-5** 6.9E-6** 1.2E-5** 0.7-IIIA 5.3E-9 { IIID 1.3E-8 IV- 2.3E-7 5.6E-6 3.IE-6 5.2E-6 0.9 , IV-1 6.6E-7 3.9E-7 6.7E-7 . IV-2,3,5 1.9E-6 1.2E-6 2.0E-6 Total 7.0-E-7 8.5E-5 4.6E-5 7.6E-5 All sites considered are enveloping sites with mspect to' postulated seismic events. For Class II seismic events, cmdit is given for contaiment venting by asstaning the failum pmbability of venting to be 0.1. This reduces the Class 11 seismic CDF by a . factor of ten. 1 19-91 oratt predecnolonet
,s .
. . , a
. .~g- , , .-
g .- .j l l I *
~ -
JG 3 , . Draft Predicisional 7:
-a 10 - -
.) i e>= ..-5 l j.- 10 - -
- ).
'C, 4 l)
- ;3 -
,.) ')
.)
.). Il' - 10 6
-7 10 -- _
to
-8 \ l' 1 I l I
-C 0250 0 500 0 750 1 00: 1.250 1 500 PE AK GROUND ACCELEUTOt1(a)
Figure 19.4-1 A& R Scisr.ic Hazard Curve 19-92 or,,, pe,o,ciston.t -
--_.-.-.L----____-___---_.______. ..-_.-.-----_.---a.
g . * ' '
s, '7
, 3 ., 5 g .- -
... i 3
Draft Predicisional ( '9, s . 1 1e -
~
10 -'s - 1 t gg : f' w
~
>- j Q ~2 3 ~
Untes Bar CC l W ~ 0- .
y -
Pilgrim
- u 10 _31: .
-2
< ~
n O - w w jQ "'S Seabrook ,
.l
~~
U -
' Lt.N*L Pilgrim w -
- o u
O 10-*= . s . brook
~
S j g ~8 Vatts Bar - 'EPRI '
~
to o- . . > o cc
. n. 10 -,- p 4.3en 10 -' . . i i i i.i i iiiiiiii-iiiiiiiiiiioi ii.. .
/ 0.00 0.'40 0.80 . .
' 1.2 0 -
PEAK GROUND-ACCELERATION (g)' > , Fig. 19.4-2 Comparison of.Various Hazard Curves Used in Evaluation ,
~
Draft Predecisional, a
$ h h w
/
~ :p; ;-
.g- _ ;-: - - - .
- = =--=- ;
;9; gp: -
= -
.44 ;g. , ;;[. ;
~, - - mg.
s q w,-
,s.
. s
,?? _- gp
. g - : '
E y . s.-
>m.
H-
- c. -
.. Q g'
. 5--
?
w
' lL o -.
2 m me F- s-. m H 5
]
H
; r* ' 4 E.
* (D **'
n O
.c p 7 E'
- 2 1 W % ~
A O j .b' m m L. m -O E' s H F- , g-- - , e H w W e - w n .O = 0 ,0- : -
~
.5-
~
.0 . 1.0 .1.5 - 2. 0 '
L e
- PEAK GROUND - ACCELERATION ;--(g) o.
~ . _
r . . .- 3 ,
-g.
~
a - . 1
=
x.O _ . ._ .
~~
~
f. c *
- 4 -
+ -
c 3 s , . 3 -O ~
- - - 'f.~
f _
.s ^': .
^-'
- ;) '": . ;L ; -i L': .___._!'_
_ -. : 2 ~: 1 -
-- - = - - -
' ~
' ^ ' ' ' ' '^--' ""
1
,' F
' Draft Predicisional 40 Class lA SE 30 -
E o o-o Lt
~
E e> 2
.9 C
._9 20 -
is.3 o
.O 5C' n.1 16 4 O
O _ C h 12.8 5 CL 10 - - e4 . 7.0
,, 4e 32 2.5 1.1 1.2 0 I I I 'I ' I I
' ~
0.5 1.0 1.5 2.0 ' Peak Ground Acceleration (g)
-Fig. 19.4-4 An Example of Percent Contribution of Different. Acceleration, Ranges to Hean Frequency of Sequence IA (LLNL - Pilgrim Site)
. Draft Predecisional
.a
, . . .o , - . - - - , , _ . . .c 4
Draft Predicisional 19.5 INITODUCTION 70 7HE If/EL 2/ILVEL 3 REVIEW The ' accident secuence event tree analysis, level 1, primarily determines the various combination of system actions to shut down the reactor, cool the core, and prevent its damage. The accident proaression event tree analysis, IcVel 2, potentially involving a core melt, vessel breach,. and containment
- challenge, detennines the various ccanbinations of actions and systems that enter into the determination of the containment failure probability ard source term releases.
E's level 2 analysis began with the developnent of a containment event tree for each of the accident sequence classes and subclasses frun the Invel 1. analysis. Accident progression pathways through each GT were determined along with their frequency and fission product releases. The numerous pathways were consolidated by grouping their outomes accordirg to the various factors, such as the mitigating systems involved in the events (i.e. passive flooder, firewater sprays system), the mechanism of the release to the environment (i.e. nonnal leakage, leakage through penetrations),_ the magnitude of the release (low, medium, high), and the timing of the release, into groups of source terms. Groups that had negligble frequerx:les were ocanbined with other similar grmps, instead of being discarded, to account for the entire core damage frequency. For each group, source terms were calculated with the MAAP code. In E's Isvel 3 analysis, off-site consequences were calculated with the GAC2 code. Cbnsequences were determined at five sites, each representing a geographic Irgion of the U.S. The results of the -five sets of consequence calculations were averaged and then ccmpared to various safety goals. E's risk integration apprmch was to quantify the ccrs with point estimates which were nultiplied together to determine the frequency of each source term group. Averaged consequences for each such group were nultiplied by the frequencies of the groups ard m=nM to determine 'a point estimate of risk.' The staff's approach was different. At each stage .of the analytical process (with the exception of off-site consequences), uncertainties in a few key . _ parameters were estimated ard crmbined to estimate the uncertainty in the risk estimates. These individual uncertainty estimates are described in-the section on containment performan (Section 19.6) and source terms (Section 19.7) and compared to E's relevant point estimates. For the risk integration (Section 19.9), an' approach similar to that used in' the NURFr,-1150 study (Paference 19.62) was used. E's PRA is based al information as of Amendment 8. Interactions between the NRC staff and E have resulted in design modifications dim"xM in subsequent amendments of the SSAR; however, the FRA was not appropriately upiated. Specifically, the follcwing featurns are to be added to the ADWR but not included in E's PRA: 19-96 ,,,,, p g g
"r c,.. * , 'f-y , -e
'.e .
E' . ,
't t
Draft Predic'sionet i
-o . Strengthened drysull head such that the ultimate strength is increased frun 100 psig to 134 psig.
o ~ Iower drywell wall and floor ocuposition of hamaltic concrete, instead of limestme him.
'Ihe analyses serving as the basis for the NRC staff's' review were done at the Brookhaven Naticzial' laboratory ard adopted by the NRC staff. L'Ihese analyses
' were based on' Aiusat-i.it 8 of GE SSAR (Reference 19.63) and included
- information frun the NUREG-1150 study (Reference 19.62); the findings are d die >M in greater detail than appear here in "A Review of the Advanoud '
Boiling Water War Probabilistic Risk Assessment, ,Vol. 2: Internal and- ' External Events,; Cbntalment,: arid Offsite . consequence Analysis," Brookhaven Naticrial Tahnratory, dated'1991 (Reference 19.64) . - In addition, ~ the staff's_ '
. review was die 3W with several staff members of Sandia National Tahnrutories who participated in the analyses of the NUREG-1150. study (Reference 19.62).
i i 4 i 1
>i A
U
'J (j
.)
-l l
I , 'I 19-97 Draft Predecisional. r7
+ , !
f
'.."t
, . .. . ...._.m.. _ . . - . - . _ _ . , _ . , , . . , _ _ . _ . , ., , . . - - . - . ,
F7 7 ; t I' -1 pf ,
- 1. . .
y . t , Draft Predicisional' 19 6 COtTIADNE2TT PERFDFMANCE 1
, , 6.1 Intrcduction The review of the A WR containment performance utilized several types of
~
calculations. A stochastic acea===rtt of the overall' performance was done in the containment avent tree analysis. . Deterministic acaaaaaants . were done with the MEIIER (Reference 19.65) and the SICP (Reference 19.f6) oodes. 6.2 PLM DMmion A review of the ABWR CE7T is pa'aana"y to evaluate the ' robustness of GE's assessment of accident sequence progression characteristics following the ' onset of core damage and to evaluate the nature:and the frequency of the threats to the containnent and source term releases. The objectives , of reviewing the CET then are to aamawaa the reasonableness of the CEr, ' assess the significance of ANR features and operator actions to CET results, and assess GE's conclusions based on the outcome of.the CET 1 analysis. The. analysis and the review are described, the findings are presented, ard inp11 cations and relationships are d%1==ad. The parts of the CET that were reviewed are the general approach, the structure of the CErs, the data, and the an==;t.icns. 3 The CE7T should represent a logical and consistent way to' ascertain the 1 various accident pww wien sequences. There are four aspects to this,- namely, characterizing accident progressiom,' determining the - relationship between severe accident phenomena, quantifyiry the : , probability of accident progression groups, and quantifying scurue terms. In the Imvel 1 portion of the FRA, both GE and the staff estimated the core damage frequencies (CDF) Maad on several aw=tt. ions regaitling the . availability of the gas turbine. generator and the fire water system.. Among,the possible ccanbinatico of =====tions, GE selected the case where only the gas turbine generator is assumed ~available, not the firewater system.' In the staff's base case, both the gas turbine generator and the firevater systee were ===wnad .available. The . significanoe of this is dWaad in Section 19.6.4.1. . Here, it. suffices to say that the assunptions influence the' contribution of' various types of' accident sequences. and the cutput of the CErs. w
'6.2.1 GE Analysis .
The results of the Invel 1 portion of the. PRA are grouped into similar outoames, called accident. classes or plant damage states (PDss), that describe the condition of the plant at'the onset of core damvpa. In GE's analysis, each PDS has a separate CEP (all of which have a similar structure), and which includes Incovery actions where appropriate. Calculations from tim MAAP code 19-98 ,,,,, p,,,,,,,,,,,g !1
< '. a b . n .h . - , . , , . , . . , . .-
j- . . f Draft Predicisional. (Referunce 19.67), an industry code, weru used as tJm basis for developiry ard analyzirg the CETs. Ocupared to the CETs in the NUREG-1150 study (Refererm 19.62), where there are 125 questions in the Grand Gulf amlynis, the CETs built by GE are small ard are md of a minimd number (usually nine) of more general questions definity the branch points of the accident progressions. . Most of the CETs have nine strh questions relatirg to the following areas of an accident progression: o Depressurization of the RCS. o Availability of containment heat rumoval. o Core melt arrest in the reactor vessel as a result of troovery of one of the ECC systems. o Cbntainment failuru at tlm time of vessel failure as a direct ard immodlate consequence of vessel failure. o High temperature failure of the containment as a result of core debris in the upper drywell. o Prior to reachirg the containment failure pressure, cere melt arrest in the lower drywell as a result of recovering'an ECCS function or the addition of firevater. o Quenchirq of the core debris in the lower drywel) by the passive flooder system, o Recovery of containment heat removal prior to containment failure. o Ventirg.
'Ibe branch point prcbabilities of the CETs were quantified with point estimates which in turn were nultiplied together to determine the likelihood of the accident progression.
GE did rot analyze uncertainty. In contrast, the 10 RED-1150 study (Referunoe 19.62), propagated probability distributions thrtughout the CETs to estimate risk. In adiition, several phencuena were not included in GE's CETs but which the staff considered important in containment perfonnance. Such phencmem incitdo in-vessel fuel / coolant interaction, ex-vessel finl/ coolant interaction, core /corcrete interactions, _ direct containment heating, and drywell/wetwell suppression pcol byfass. Draft Predecisionat
e e e l Draft Predicialonal 6.2.2 Staff Review h staff's review consisted of an atriit calculation based on E's CCT. GE's GP structure was noiified by makirg simplifications ; and additions tc the Tr. Modifications to the CErs wru as follows: o outcomes of the Crs were consolidated into fewer, slightly more general groups. o Unrwwwy questions were elimimted, such as when certain thenomem or events always occur. o Questicos were added and a few questions were reworded to account for missing phencraena and events. . Horn important than nodifyirg the structure was the staff's attempt to accourrt for, in an apprtocimte ard prelimimry way, some phencanena known rot to have been taken into account in E's C Ds, such as direct containment heating and ex-vessel fuel / coolant interacticn.
'Ihe staff took into consideration some threats to the containment found in other sttriies, such as the NURIr,-1150 study (Refezeice 19.62) . Scae phenomena, such as hydrogen combustico and liner nelt-through, could be eliminated hu-aw the ABWR containment is inerted and the ABWR reactor oavity is configured to pInvent core debris impirgement, . respectively. Another phenc>-
nons, design basis accident pressure load from a blowdown of the rector coolant system followirg a failure of the reactor vessel, could be elimim ted because the staff a m W that the design strength of the containment (134 psig) is capable of withstandire the peak pressure spike (40 to 50 psig) frun this accident. 'Ivo phencxnena that could not be dienimaal were direct ocotainment heatire and ex-vessel fuel / coolant interaction. As described below, the staff briefly treated these phencnena differently than other phencxnena in determinirg the fractional contributions to the accident progressico group frtquency. h estimtes of containnent Imds associated with direct containment heating and ex-vessel fuel / coolant interacticn were determined with a Monte Carlo sanplirq precedure. 'the pressure loads were obtained as a distribution frcan the NURIr,-1150 analysis (Reference 19.62) of the Grand Gulf plant,. which has a similar power ratirg and drywell size as the ABWR. 'Ibe uncertainty in the ADWR containment uLwyth was estimted to be 20 psi of the unan ultimate containment uLw(4, based cn the NUIUrs-1150 study (Reference 19.62) ard the staff's juckynent. Both distributions weIn sanpled using UIS (Ref 19.67), a type of Monte Carlo 19-100 , ,, , , ,, g , , g
'4 Draft Predicistoral sanplirg. 'Ibe staff's calculations were repeated with an uncertainty in the containment strength of 40 psi; little difference in the distribution of accident progression groups was
- cd. p
'Ibe staff irdeperdently estimated ibut of accident progression groups using the staff's assumptions regardirg the integrity of the containment (intact or failad) and j the status of the RHR systs (available or unavailable) for each pJF class of accident sequences within the accident progression pathways. 'Ibe results of this determination are shown in Figures 19.6-1 and 19.6-2; these are point estiInates, which, except in the tmatment of direct containment heatirg and ex-vessel fuel / coolant k interaction, reflect the staff's engineerirg judgment of a reasonable selection of inputs.
Simplified point estimates of the effects of direct containment heatirg and ex-vew1 fuel / coolant interaction were determined by sampliry the uncertainty in the pressure loadirg and the cxantainment strength forty times. When the pressure loading was greater than the containment stmgth, the sample was counted as a failed containment and vice versa. 'Ihe point estimate of the early containment failure probability was taken as the number of I failure trials divided by the total rumber of-trials. 'Ibe staff's l D analysis iniicated a containment failure probability, otnditional on vessel breach, due to these mechanisms (after the containment design modifications) of 0.11 for the high pressure vessel failure case and 0.04 for the low pressure vessel failure case. 'Ihese point estimates, which were factored into the staff's CE.Ts, replaced GE's probability values of 0.001 and 0.0, respectively, for containment failure at the time of vessel failure. 'the results should be understood as providiry only a rough estimate of the threat posed by direct containment heatirq and fuel / coolant interaction to the integrity of the containment because the staff's analysis is based in part on an analysis of another plant, Grand Gulf. In the review, the conplexitf of scrne phe:xrnena known frun the NUREG-1150 study (Reference 19.62) to repInsent potentially significant threats to the containment precludod the staff frtrn i readily acocunting for them directly in the CETs. These phenamena ' include drywell/wetwell bypass, the effect of in-vessel fuel / coolant interaction on in-vessel core recovery, impulse loads on the reactor pedestal ard quasi-static loads on the drywell frun ex-vessel fuel / coolant interacticri, the effects of a core / concrete interaction _ cri the integrity of the reactor pedestal, and the effect of venting on the' accident progressions. Otmideration of i some pheixxnena, such as drywell/wetwall bypass and vent setpoint, was inferred hit not directly factored into the staff's CETT analysis. 19-101 ,,,,, ,,,,,,,,,,n,g
[ Draft Predicisional
#jh N
It is unclear how the design differences in total betwen the ABWR and Grand Gulf would modify the containment performnce pmlicted for Grand Gulf in the NUREG-1150 (Reference 19.62). For example, the Grand Gulf plant has a standard atmocphere in the containment while the ADWR has an imrted ataccF h eru; this would act to reduce the pressure loads arisiry frun direct containment heating, by elimiratirg the oxidatierVcxxnbusticn ocuponent of DW load. The g Grand Gulf plant has a larger wetwell airspace capared to the l' ADWR, which would affect the pressure loads as the drywell is rapidly pressurized and the downoomers, connectiry the drywell to the wetwell, are cleared. Nevertheless, with these urxiificaticns and inferences, the staff's review shcwed that the cutocanes of the CE P appear to be strmgly influencrd by the probabilities of core melt arrest in the reactor vessel or in the containment and the availability of the RHR system. The staff's treatment of cxantainment failure was further resolved into questions of high terperature degradation of the upper drywell seals due to debris entarirg the upper drywell, ard early containment failuru due to rapid pressurization frua direct containment heatirs an:1 fuel / coolant interaction. Subsequently estimated was the fraction of the CDF resultity in a particular group of accident progression pathways. 6.3 A - nt of the Nethods GE's approach to ucdelliry containment performnoe with E's CE?Ts is a reasonable first atte:rpt at examiniry the design and trying to identify scxne of the prircipal threats to containment integrity. The CETs portray an abbruviated description of how a core melt my be arrested in the reactor vessel or in the contairment. Because the MAAP code was used to develcp the CE7Is, the GE CE7fs reflect assumptims ard views of those who develcped the code. Sczne of the assunptions and views have a significant impact cr1 the outcome of the CE?Is ard differ frun the views of the staff. GE's CE!Is appear to be insufficient for delineating and characterizing accident progressions, asresirq the inportance of severe accident phencrnera, quantifyirg the probability of accident progression' groups, ard quantifying source terns. The smil CE70s used for each PT differ frun the one large CET for all PDSs in the NURID-1150 study (Referunce 19.62) . There aIn advantages and rlbivantages to usily the rmaller CE?Is, i.e. small CETs are nore nanageable than large CEm2, but interactions of various systems can be overlooked with t5e smaller trues. The staff believes that small CErs are only partially m-sful at identifyirg design ha because important interactions between systars my be cuericoked (see also Reference 19.63) . Nt the number of questions ccxnposirg the CEmi is not the only indicator of the adequacy of the CErs. Sufficient delineation of the accident prtgrersion also ruquires a CET analysis havirg questions that allcw for sufficient resolutico (i.e. detail definition or description) of severe accident 19-102 37 m ,, % g
. v ,. . _ _ _ __ - . . . _ , , . ;' ;g; 5 ,q,,
f if r + l r ' j Draft Predicisionell issues. 'Ibe questions cxmposing GE's CCTs are high' level ' questions, lacking tax:h detail that would be r-93 to mndal subtle - i
! interactions.
An exanple of this lack of resolution is'at the portion of GE's TTs
~
pertaining to core melt arrest in the. reactor vessel. : GE's question . . asks only if this occurs. A mre detailed analysis would.also factor'in
, the possibility of in-vessel fuel / coolant interactica). ' In-vessel y fuel / coolant interaction can. alter the progression of an accident'in two ways; it can affect the capability to arrest. the core melt; it can have l the transient effect of converting a low pressure sequence into a high '
pressure sequence. s
'Ihe following inportant design features of the ABWR may make the
' ==Guction of the GTs less ccmplicated than CErs usually found in PIRs for existing INRs:-
4 o Hydw;p.n cabustion.and detonation'in the ocritalment need not be
- inndalled because the contalment is inerted. .i o Direct attack of core debris on the steel shell of the containment is eliminated by the design.
- 3 o Basemat failure is precluded by having a thick (5.5 matare) ;i basemat. 'Ibe staff has evaluated the phencanena-of ocncreta . .
erosion due to corium. attack and,'within the current ocmputational; capabilities, determined that the thick basemat would ame=rviate the expected corium pei-katicn (1.0 matar) . However, the design features of the ABiR do not by thanselves' justify a - simple Tr. 'Ibe purpose of the Tr is to narwrtain arri evaluate subtle. interactions among the features. - , 5 Some inportant phencuena' relevant to containment response are inimaingL from GE's C Ts, mainly because'of deliberate ruinaions'haamd on, , ; engineerirg jufmt. Iarger T Ps would address a more m y dsensive '
. set of possible outcmes before judging which curevnam are most ,
important to risk. Exanples of.potentially.inportant phencanena not { addressed in GE's cts are as follows:.
' ~
y o GE did 'not' address the effacts of in-va=aal fuel / coolant ' j
+
., . interaction on the in-vessel arrest of a core melt.
- i o GE considers that a pressure pulse frm direct containment heating? U is unlikely .to da==ya the cantainment and assigns a low
,' . conditional probability of containment failure by this' mechanism.' d
'Ihe staff considers it an uncertain phencuenon which can a potentially threaten the integrity of the contalment. . 1 Lo -GE considers that an ex-vessel steam explosion due to a-fuel /cxmlant interaction sufficient to threaten the ' containment is -
19-103 , , , , , , % , , ,n, p
: , , i i; ~
r
,_ s , ,. .L.. - r- +r -
-r, -
o Draft Predicisional precluded by temperature / pressure coniitions and enenJy transfers t' due to debris particle size (Section 19E.2.3 of Refereice 19.63).
'Ihe NUREG-1150 study -(Reference 19.62) allows for the possibility of rapid steam generation due to a fuel / coolant intemction which potentially challenges containment integrity; the caff believes that this position is applicable to the ADWR.
o GE considers the effects of bypass areas between the drywell ard the wetwell due to tormal leakage and/or stuck open vacuum breakers to be precluded on the basis of low frequercy ard risk.
'Ibe staff believes that containment threats due to drywell/wetwell bypass events need to be nere fully addressed. .
o E did rot ocrisider that the integrity of the podestal vall is threatencd by an ex-vessel steam explosion. 'Ihis threat was considered in the NURD3-1150 study (Referunoe 19.62); the staff believes that this position is a;plicable to the AIER. o E considers the integrity of the pedestal wall is not threatened once core debris in the lower drywell is covered by water. 110 wever, calculations with FrmR (Refererce 19.65) ard the SICP (Reference 19.66) indicate that a core /cxxcrete inteJaction could continue to degrade the pedestal wall, even when the debris is o/tered by water. 'Ihis leaves open the possibility that containment penetrations would be damaged, should the loss of the pedestal integrity allow the reactor vessel to tilt. 'Ihis 'j
}MP/FrmR conparison is the subject of study in an orgoing code cmparison being done by the staff, o E believes that the weakest point of the containment is the head of the upper drywell (Sectico 19.3.2.5 of Reference 19.9) . It is .)
thought that the principal failure wh is stnctural failure of ~' the drywell head due to overpressurizaticn. Another possible failure mode accounted by E is high taperature degradation of the seals. 110 wever, other locations of a structural failure are ' possible, though perhaps less likely. Because these phencrnena are missing or are minimized in the Crs ard there is to analysis of uncertainty within the context of the cts, the abbreviated E CT analysis is considend to be inomplete. 6.4 Cr Results 6.4.1 Presentation of Cr Results from tim E PRA ard the Staff Review Sequences cming out of the Trs were grouped to show the fraction of the coniitional probability, given core damage, of accident progression groups givirg rise to the expected containment resp 21sc. Figures 19.6-1 ard 19.6-2 show the fractional 19-104 37,,,, ,g, g
,s 4 re, ,e .
1
,e
- 4 Oraft Predicisional. +
b contribution of the . core damage frequency groups for Internal - events.(E 's results are presented with arithmetic.' errors corrected) and for scismic events, respectively.1.Both the' E and ' the staff's estimates of the frequency of the accident progression groups and the nelated containment responses are ,shown. Table. 19.6-1 daarribes the groups in detail. 'Ihe alphabetical naming of the groups links the table with the figures. Differences between the staff's and E 's results frte the i contalment event tree' analyses arise because.of various
====tions made in performing the calculations. 'Ibese -
a===tions include the following: o
~
'Ibe staff took credit'in both the 1mvel 1 and the Invel 2L analysis for a capability. to. inject firewater into the reactor ,r vamaal to prevent oore damar = whereas E took credit crily in'. ,
the Inval 2 analysis (diam--M later in this secticri) .- q o 'Ihe staff attanpted to account for uncertainty in phencanana : potentially threatening-to contaiment integrity whereas 2 did not aoocunt for such uncertainty (diamaaad in Section . 19.6.3). . o E's PRA was based on the design up through Amendment 8 of E 's SSAR (Reference 19.9), i.e. an ultimate containment.
- L: p.h of 100 psig and limestone concrete forming the lower 5 drywell, while the staff's analysis included the. design charges mentioned in a letter frun P.' W. Mariott,' General Electric (brporation, to C. L.1 Miller,- NRC,: dated August 9, 1990, zugarding zuspense to NRC/E May 16:- 17, 1990 Meeting
, Diamaning Topics (Reference 19.69),- i.e ultimate contalment ' ' strength of 134 psig and hamaltic concreta forming the lower drywell, o For seismic events the major analytical ~ difference-is.the seismic hazard curves (annual probability of 'a-ading a, - specified peak ground acceleration)'. ' E used a seismic hazard. curve . developed as the bounding curve of a few selected plant j
. sites. 'Iha staff's' analysis wasL haaad 'on three' sites having-the highest seismic hazard in the eastern and'oentral U.S.
(Pilgrim, Seabrook, and Watts Bar), ~and used two seismic hazard curves, one developed by,-Iawrence Livermore National'.. laboratory (LINL) aM the other developed by' the Electric '$ Power Faaaarth institute '(EPRI) . 'Ibe LINL hazard curves , T generally prtnide a such higher core riamage frequency than ey , either the E or the EPRI curves, while'the.later two curves F give rise to core damage frequencies of about the.same - magnitude. Howver, the uncertainty ranges of the IINL curve ; , are large and erman the other two curves. to a 19-105 ,,,,, ,,,,,,,,,,n,g ,
- i Y I
,_.II f'
6 ., a- , un-
e e Draft Predictsional g[ In Figure 19.6-2, the frequency of accident progression groups of V the. staff's amlysis is the result of usirg the Pilgrim site with its IJEL hazarti curve, selccted because this gives the highest core damage frequency of the staff's six scimic amlyses.
'Ihe following points can be mde frun Figures 19.6-1 arri 19.6-2:
o Groups (A), (B), and (H) represent the requerres which do not result in containment failure or vent actuatim. In these soquences, the core melt is annsted'either in the reactor vessel (Group (B)) or in the lower dryhell (Groups (A) and (H)) since the containment cooling function (MIR system) is recovered befom the containment pressure reaches the vent actuation pressure. Group (A), which appears in the staff's amlysis, is essentially similar to Group (H), which cnly appears in the GE amlysis, the differunce arisi29 frm assumptions about dryWell/wetwell bypass (Section 19.6.4.2.1) and pedestal integrity (Sections 19.6.4.2.3 and 19.6.4.2.4). o Groups (C) and (G) are similar to Groups (A), (B), and (H) in that theru is steaming, either in the ruactor vessel or the lower drywell; the difference is that in the former, the containment coolirs functun of the MIR system is unavailable leadiry to a rise in contairment pressure resulting in vent actuation or containment failure. o Groups (D), (E), and (F) represent early containment failures. Group (F) appears only in the staff's analysis because it represents direct containment heating. GE does not consider direct containment heating to be a crailble phenaaenon.(see Secticn 19.6.3). In the staff's amlysis, a Crtup (C) situation does not arise because of assumptions regarding the availability of various equipment. 'Ibe staff credited the firewater addition system for preventity core damge in Imvel 1. If core damage occurs (Irvel 2), then the firevater syst s could not have been available to prevent oore damage, hence, it unlikely to be available to arrest a cort melt in the reactor vessal.. However, later in the accident progression, the staff took credit for arresting an ex-vessel core melt progression because there is more time available to'restorn the firevater systs than for the in-vessel situation. In contrast, GE calculations did not take crudit in the Invel 1 portion of the IRA to prevent core rbmage using the firuvater system, but they take cralit in the level 2 portion to arrest core . damage in the reactor vessel using the firewater system.
'Ibe treatment of A'Iks sequerres (Class IV) in GE's internal events analysis differs frun the treatment in GE's seismic events amlysis. GE considered the Class IV sequence to result in an early containmnt failure in the interml events amlysis and as 19-106 pesti predecisionet
e ,
-45 Draf t Predicistoral late contairment failvre in the seismic evert.s analysis. The staff's treat 2nent of Class IV se:pences for interral events is similar to E's seismic events treatment of these sequences. As above, this accountirq has an effect on the results of the TT analysis.
l To begin, the staff estimated the frequency of the Class IV accidents to be hjg her than E 's estimate. 'Jhe larger frequency warranted further stn3y of the progression of these accidents.
'Ibe staff reasoned that the class IV accidents are prinarily caused by a failure of reactivity control due to. failure of addity boren, or flushirg or diluting boron4 9 v6 to scram failure. This implies tant the lower plenum of the reactor vessel is filled with water. As the core melt progrusses, the heat generation is eventually rwtrui to the decay heat level, arri since the lower plenum is filled with water, the core debris is coverud-with water, allowirq for the potential to arrest the core melt progression in the reactor ve?,sel. Such an accident sequence.would be grouped in Group B of Table' 19.6-1 ard Figures 19.6-1 an:1 19.6-2.
E treatment was apparently done *w the frequency of the Class IV accidents is small, less than 2 percent in E 's internal events analysis. Thus, they were conservatively grouped with other sequences which resulted in the largest release of fission products (early containment failure). Ucuever, sirce its frequency in the seismic events was significantly higher, 60 percent, E performed a vore thorough analysis, where most of the sequences resulted in late containment failure. Accordirg to 2, water in the 1cuer plenum of the reactor vessel does not merily quench core debris, hence, the core debris can eventually fail the bottcan head penetrations. Orce the vessel fails, the water in the lcuer plenum flows . , into the lower drywell _along with water frun actuaticn of the passive flooder systan. 'Jhe core debris steams in the lower drywell. . Since the availability of the MR system in these. sequerx:es is high, most of these accidents.would rot result in. containment failure. These accidents are classified as Group (A)'of Table 19.6-1 and Figures 19.6-1 and 19.6-2. In the presentaticn of E's Lresults for interml and extemal events ard the staff's H1A results for internal events, the effect of controlled venting on the corditional containment failure probability (CCFP) is not specifically addressed. Until this if % charge is made, the staff's results (for external events cnly, fC L since this is the only place the OTG was credited) will shcu 19-107 oreft credecisionet
E
- . a Draft Predicisional containmnt failuru khencver the overpressure protection system is actuated within the first twenty four hours.
Given the ammptions noted in the Group (A) description of Figure 19.6-1 ard the above definition of containment failure, the point estimte of the total conditional contairnest failure probability (CCFP) for internal events is 16 percent in the staff's analysis ard 12 percent in the GE analysis (i.e. Grcups (C), (D), (E), and (G) in Figure 19.6-1); the difference is minly due to the consideration of direct containment heating in the former analysis. 'Ihe corditional containment failure probability for early failures in the internal events analysis.is predicted to be p 13 percent by the staff and 3 percent by GE (Groups (D), (E), and (F) in figure 19.6-1) . For external events,' the point estimate of the total conditional containment failure probability is 78 J percent in the staff's analysis and 82 percent in GE's analysis,
'Ihe higher conditional failure probabilities in the seismic events
/ analysis relative to the internal events analysir are largely due h#[f to the ar @ cn in both the GE and staff analyses that the loss of pcuer is non-Itcoverable after a seismic event. Note that the GE values reported above inmrporate correcticais to a number of arithmetic and logic errors identified through the staff's review.
Ilence, these values differ from the (urx:orrected) GE point estimates presented in Table 19.9-1. P 19-108 g,,,, p,g i, g
t: Draf t Predicisiorut Table 19.6-1 Description of Sequence Groups in Figures 19.6-1 and 19 . 6<-2 . Accident Pingussion Group in Figure 19.6-1 and. Ilaum 19.6-2 Descriction of Accident F1wtession Grouns A Sequences result in an uncertain response to the containment in the staff's analysis when the passive flooder system introduces water to the core debris. Although the MIR system is operable to remove heat delivered to the sw=.sion pool as a result of the steamirx3 fran of the core debris, containment response is uncertain as a result of two factors. First, drywell/wetwell bypass flow may circumvent the suppression pool. Unless the wetwell sprays are marndly aligned and available, the contain:nent will pressurize at'a rate that deperds on the extent of.the bypass flow (Figure 19.6-4), ard vent actuation could occur. Also contributing to the uncertainty in the containment response is the uncer' tinty in the integrity of the pedestal vall due to core /concmte interacticm, even given the operation of the passive flooder systen. Should the wall fail, the reactor vessel would tilt and could danage penetrations. The damaged penetrations constitLte a containnent failure. B Sequences result in arrest of a core melt in the vessel by. the recovery of same form of in-vessel coolire. The RHR
~
system is operable to renove decay heat frm the suppression pool. The containment dcy,s not pressurize because of an operable RHR system. Hence, the containment remains intact. C Sequences result in arrest of a corn melt in the vessel by the recovery of scue form of. core cooliry.- Steamirg fran the core debris goes through the SRVs and the T querxters dnto the suppression pool. Because of a failure to recover the RHR system, the sgyression pool heats, alloviry the containment to pressurize. In a vented containment, the ovcipissure protection system would actuate. In this group of sequen::es, the overpressure protection system is of ro consequence because the suppression pool is along the release path, whether or not the systan is present. D Sequerocs result in core debris beirg ejected out of the reactor vessel at high pressure. .Scme of the debris settles in the upper drywell and heats the penetration seals and pressurizes the containment. When the temperature reaches about 500 degrees F and the prussure is 52 psig, the seals are n==vi to fail. The leakage is sufficient enotqh to constitute a containment failurn but may be insufficient. 19-109 ,,,,,,,,,,,,,,,,g
e Draf t Predicisional Table 19.6-1 (continu(d) Accident pit:gression Group in Figure 19.6-1 and Ficure 19.6-2 Dgs;riotion of Accident Pamession Groups enough to relieve the pressurization. Should the containment continue to pressurize, the overprussure protecticn system would actuate E Segaences result in core cooling being maintained, but without the RHR system, tM containment pressurizes. - A . failure to vent is amM leding to containment failure. The debris fmn the damaged cxxitainment dimbles the systems maintaining core cooling. With the loss of cooling, core damage results. Because the containment fails prior to core damage and vessel failure, the containment failure is considered an early failure. F Sequerres result in a rapid pressurization of the containment. 'Ihe pressurization comes fmn the blowdown of the reactor vessel, direct heating of the containment atzo-sphere- (decay heat and exothermic civ=bl reactions), and fuel / coolant interacticn. In the staff's review, ' as in the NURID-1150 study (Reference 19.62), a fuel / coolant interac-tion is not receswu-ily a shock wave; it may be rapid pres-surization. '1he pressure rise in the drywell is too rapid for the drywell/wetwell ccnnecting vents (down::craera) to clear. A structural failure of the containment in the drywell results. G Sequences result in arrest of a core melt in the containment when the passive flooder system intrr*m water to gaerch the core debris. Unlike in the Group (A) or Group (C) sequeroe, the RHR system is inoperable. Hence, the steaming fmn the core debris heats the suppression pool ard prtasurizes the containment. . Evenhm11y, the overpressure protection systan actuates. !UTE: Fbr these.segaenoes, early action of the overpressuru protectico systan depends on the extent of bypass f1cw. H Sequences result in arrest of a core melt in the containment when the passive flooder systan intrtam water to quench the core debris. '1he RHR system is recxyvertd to rurove heat : delivend to the suppression pool _ as a result of the steaming from the core debris. '1he containment does not pressurize, herx.e, it rumains' intact. IUrE: For these sequences, the overpressure protection system could be actuats.d early, depending on the extent of bypass ficw. 19-110 o,,,, ,,,,,,,,,,,,,
. :. + ,,a
- ;.y 4 Containment Challenges '& Responses - Internal Events (A) Same as tH)subiect .
GE .s
. M r**:II"%*w"eio ** Jl,',, Staff
,. ' & 90003101 In tog ty (s) No preneurtretion
! CDF = ~ 5.9 x 10 '
when core debris is steeming Wo! *tA**Rif4 UUe*l, \
~
',flen,l'a:till*N'*"
steeming In the reactor ps $'k systens i (D) High tesaporature
- i on penetration seele
<W 4 slow presourlaation 1 -
n from deurss e .: 1 1 ,, s',t,o,sqy aoo**lection e<s
) p(E) Slow resourtantion fllfu',1*du"e* 1 ' -
~
n loss of ttse RHR system J subsequent 2 / loss of core coollog (F) Replat pressurlantion
,w . a$re"c1* sn'fj!X:ei1
- nesting fG) Slow pressurlantion o !'i"e%'*e?'Er'*o's AW""
the RHR system non c$re dab s steeming Wiis*:i *RIen's'r;*i'm K _~I\/,. Percentages
~ (Letter) refers to Table 19.6-1 for detailed description.
are fractions of the total core damage frequency (CDF). Bold gothic type indicates the rate of pressurization. llatic type indicates causes of containment pressurization. hunmm = late containment f ailure or venting. M = 'early containment f ailure(relative to the time of vessel f ailure).. I i= no containment f ailure.
- n i= grey area-where the predicted outcome depends on drywell/wetwell bypass &
pedestal integrity assumptions: If there is bypass. then late ( s n )' containment f ailure or venting.
--Il the pedestal f alls, then possibly late ( M ) f ailure of containment' penetrations.
Elf there is no bypass and no pedestal f ailure, then no ( l 1) containment response.- Figure 19.6-1 GE'.s :andl the staff's breakdown ~ of the. conditional; probability of accident progression ~ groups _given core damage for internal events..
- w
'-. - a
I Containment Challenges & Responses - External Events GE (A)*Same se (H) sub/'ect ggg CDF = 2.5 x 10-r ifty'Mfli41,yees, 8 0808888' dat88' r (B) No presserization
] CDF = 7.3 x 10 when core debros Is steeming 6% lor vessel in thethe with reegHR system 10 %
? \
11 wta rYY steeming In the reactor
](: ,
i vesset without the as ? y [ l RHR system {;U U (D) High temperature i:
;-- .l I
[ on penettetton eeste 4 elow preneutizetten j)t
}! (}
'1 l 10% '
fQ* ydebros ectton p pp ns _y __ , m ,g
\ \ \
dr y weII 1% l l * [ W.lll llly
'S (E) Slow -
pressuttretton
!p"' 4% l dg ^{. -
\\isi ii 9'ifu'rl*d%*18' ui , , ,W j
,, foss of the RHA wu%_
~
lb ycs f . - O system 8 subsecuent loss of core cooling
%gimwm ----
f y et
. . J,)
L"% " g ) J ' J - i {F) flapid presourlastion i I .
~ 1. V '
'""'~S I
yse 1,elgeyom / l heeting (G) Slow pressurizetton when core debris is steeming in the lower drywell without
/ NOTE the RNR system Based on calculations of the Pilgrim site and the (H) No pressertretton when Coro debris is steeming LLNL hazard curve.
in the lower drywell with the RHR system [/ \/, (Letter) refers to Table 19.6-2 for detailed description. l \ ~._ l . Percentages are fractions of the total core damage frequency (CDF). Bold gothic type indicates the rate of pressurization. Italic type Indicates causes of containment pressurization. M = late containment f ailure or venting. M = early containment f ailure (relative to the time of vessel f ailure). I I= no containment f ailure. i= grey area where the predicted outcome dependson drywell/wetwell bypass 8 pedestal Integrity assumptions: If there is bypass. then late ( M ) containment failure or venting. If the pedestal falls, then possibly late ( E13 ) failure of containment penetrations. It-there is no bypass and no pedestal f ailure then no ( F1) containment responso. Figure 19.6-2 GE's-and the staff's breakdown of the conditional probability of accident prog'ression groups - given core damage for seismic events. ~
~ ~
y. e W UW
a Draft Predicisional' 6.4.2 Discussion of the CET Results In light of the low core damage frequencies coming into the CET, e.g.10 #/ year (interm1 events), there are two positions that can be taken with ruspect to reviewirg the CETs and the subcequent plant risk. 'Ihe first position is that the very low fruquencies are believable, which removes any concam over containment performance and plant risk. For exanple, the containment could be w construed as of little benefit sirce the two NRC Quantitative Health Cbjectives, individual early fatality risk of <# 5x10'#/ yr ard individual latent cancer fatality risk of 5 2x10 /yr are met, even without the containment. 'Ibe second position is that even with such low frequencies, the CETIs take on inportance in the context of balancire preventien ard mitigation as mil as maintainirs defense-12Miepth. 'Ibe balance of prevention and mitigation is adlieved in part through the IEC's coniitional containment failure probability goal of 0.10. It'is in regard to this latter position that the staff pursued its CET evaluation ard as such have identified aspects of the ADWR design that have a major influence on the CET results. Each of there factors is dir - ed in turn. 6.4.2.1 Drywell/Wetwell Bypass A certain anount of drywell-to-wtwell leakage is allowd for in DWR suppression containment as stated in NRC's Stardard Review Plan. In its deterministic analysis, E addressed certain aspects of this drywell/wetwell bypass (page 19E.2-28 of GE's SSAR (Referunoe 19.9)) . E's results supported no further consideration of suppression pool bypass flow effects in the CETs based on low estimated frequercies and risk. Allcued bypass areas (A/K'#) in a plant's +Mcal sp#ifi-cations have historically been set at 0.10 of the p' , m=vi in the containment DBA. Since a large A/K provides for a robust containment pressure design but an increased plant risk due to suppression pool bypass, the need to all of the implications of a rarge of possible A/K values were considerud in the staff evaluation. In GE's SSAR (Reference 19.9), potential bypass paths between the drywell ard the wetwell are identified and M rv,meM. Incitdod amarg those were the eight 20-inch diameter vacuum breakers (Table 19E.2-1 of Reference 19.9) designed to prevent a negative drye.ll preralru (relative to the wetwell) frca erirg followirg a design basis reactor coolant pipe rupturn. As noted above, GE did not include any consideration of bypass effects in its CET,s; howcVer, since there is an allcuance for such leakage bypass flcu, 19-113 ,,,,,p, g , g
oraft Predicisional the staff thought it prudent to investigate this potential problem affecting containment integrity. 'Ihis investigation was motivated in part by operating experience at an existing DWR with a Mark III containment that has shown bypass flows ranging frun 800 to 2500 cfm, which are considerably greater than the design value for the AIER. Calculations were performod (Figure 19.6-4) to investigate the effect of irx:reased ADWR bypass leakage on risk. Results of these calculations indicate that this matter warrants further investigation. Althcu3h an -ud high bypass flow increases the robustness of the containment vis-a-vis the design basis calculation, it appears to have the following negative effects on risk:
- 1. Potentially increases the rumber of sequences where the overpressure protection systan is actuated by reducirg the time available for EHR-recovery.
- 2. Potentially ircreases the aucunt of radioactive release to the envi m m.u4t because the bypass flow would not be scrubbed by the suppression pool.
- 3. Puhm the time available for fission product decay, aerosol settlirg, ard evacuation.
- 4. Places additional reliance en operator action to successfully initiate containment spray. Currently, these sprays are manually operated (Section 19D.6.3.3 of Refereme 19.5) .
- 5. Places additional reliance on the firewater addition system and on the capability to connect a fire truck to the system when the RHR system is unavailable, Figure 19.6-3 is a schematic diagram showing features of the AIER containment relevant to drywell/wetwell bypass. Figure 19.6-4 illustrates the bypass issue by showing the containment pressure as a function of timo for various bypass flow rates in the ABWR. 'Ihe figure was generated with equations that yield only a first approximation to the expected pressures and stggests that bypass flow rates must not be allowed to mM those values that could umpuaise the integrity of the containment system, i.e., early vent actuation followed by frequent manual openirs thereafter. 'the relationship between flow rate ard A/K" shown in Figure 19.6-4 was obtained from data and analysis performed in the NURDG-1150 sttdy of the Grand Gulf plant (Referunae 19.62). Figuru 19.6-4 is based on 19-114 oreft predecisionat
i Upper Drywell
.i l
i l l s Wetwell k
= a umas Lower Drywell muss
] 'c -
4 KEY
=l-l= = Drywell/Wetwell Vacuum Breaker l l - Suppression Pool h =
Overpressure Protection System (Vent) T - quencher I 4 i Figure 19.6-3 Schematic diagram of the ABWR containment 19-116
.i 1
Draft Predicisional simple hand calculations usirg the. ideal' cras equation ard the volumes of the drywell and the wetwell of the ; ABWR. '
~
'1he staff has concluded that GE should provide a u.m p vlensive assessment of the risks associated with
.[ drywell-to m twell bypass. leakage. Such an a=wnt should-include canplete consideration to such matters as.( the basis to support an allowed leakage area (A/K ), and (2) the basis to support an eMMM leakage area durirg the course of a severe accident when the vacuum breakers would be requimd to perform -
several times in a severe envi m melt. 'Ihis is an outstanding item.- P W
'I 19-115 oreftPr e s w
+
pK . V.. ^..
- b. .. ;.i e . . , r b l
Containment 1 3 Pressure (psic)' Iso -
. . 7 iso -
14o - iso -
< 12o -
Vented iio 2500 600 ctm 300 c1m soa .cf m ,34 pgeggu7e ;p SYSteIT) -
---.cm '
os psto' i (80 psto) j so -
'I
- I ;
to : > so - l so - 40 - so o a is is 34 no u. o [ NOTE Time (hours af ter reactor vessel breach) cfm , A 35,000' % Containment ' Pressure (psic) g,y a i'0 600 Containment
'...gg0 cim Follure iso .......................... J5oo ........ Pressure lefm 149 psto (134 psig) leo -
/
iso - 358 '300 iso - cf m
-y-cf m , ,
O1d t Un-Vented
,00 .
c';','fm'n' o, - - 1 Sustem J .. , j
- P ressu re - .
ll5 'psic (100 psic) , , ,
,so -
to - l
'4o -
,- so -
i x 40 - So ~ ' o e 12 to 24 . 30 se 1 Time (hours af ter. reactor vessel breach) - 2 rigure 19.6-4 Wetwell pressure.'as a function of bypass flow (CFM) and time-l (hours). . 19-117 t
< 1
- t, . . , ,
Draft Predicisional 6.4.2.2 Overpressure Protection System (OPS) A containmnt overpressure protection system was not incluiod in the original ADWR design, but was added to the design in Amendment 8. E modified their containment event trees to include the OPS, but in baseline calculations
@ assigned a failure probability of 1.0 for the systan, j
# thereby taking m credit (or penalty) for venting. 'Ihe bulk of the staff's analysis reported herein were already
/ cornpleted by the time of the OPS nodification and do not account for the effect of the OPS on containment' performance arri risk. Although the effect of the venting was addressed in a number of additional staff calculations, as dimimect below, no attempt was made to revise the earlier analyses.to address the effects of the venting system.
'Ihe proposed overpressure protection system (OPS) for the AIMR represents a significant departure frun pruvious BWR design submittals in that the design autanatically activates at a containment pressure above the design value setpoint (currently 80 psig) by venting the wetwell to the enviu mmint. On the basis of E's analysis, this containment pressure would be reached ~ coly in the event that j the IER system was unavailable to remove decay heat frun the suppression pool. 'Ihe system is intended to provide
. protection against rare sequences where containment l integrity is challenged by overprussurization. 'lhe staff's
- l. review supports this view, however, the staff has the following observations that warrant consideration before accepting such a system:
, 1. 'Ihe system would be effective only in a small l percentage of internally initiated severe accident l sequences.
- 2. Pressures oculd develop to actuate the system as a
- l. result of drywell/wetwell bypass flows in the absence of the above mentioned spray operation.
! 3. Unocrtainty considerations'ccmplicate the prediction l of hw this systan would operate, i.e., deternining
- l. the proper setpoint for vent actuation, in view of j adverse effects.
- l. Eadi of these cmxtrns is dimW below:
(1) Pzrquency of Actuation Table 19.6-2 shows a Invel 2 perspective of the relative importance of the OPS. 'Ihe table was derived fIun Figures 19-118 oren Pr e s w l
- i Draft Predicisional 19.6-1 ard 19.6-2 arrl shows the frequency of the accident progression groups in terns of the cperation of the OPS. '
The table is a rotgh approximation, with the other considerations such as plant specific features, drywell/wetwell bypass, and uncertainty aside. Several points are caphasized: Internal events. Because of the high reliability of the RHR :i system, the OPS would actuate in only 3 piu. wit of the accident progression groups sequences. Accortiing to staff. ' analysis, in about 1 percent of the accident r ugt=ssion sequences, the syst s actuates un w rily as a result of pressure dallenges that are sufficient to' actuate the vent but insufficient to fail the containment had the system not-been present. - In 13 percent of the amirh t sugiassion group frequency, i the drywell is predicted to fail'due to rapid overpressure.
'Ihe OPS.is not expected to have a significant effect for these scenaries. -
Seismic events. The OPS is actuated in 71 percent of the accident sujtussicri group frequency, largely due to unavailability of the RHR system. Overall, from a risk put%tive, GE 's analysis does not - appear to make 'a strong case for needing an autmatic OPS, at least for internal events. The overall intent is to provide a "last-ditch" mitigation effort'for rare accidents. Ibr seismic events the relative -3rportance of this system appears greater, due to the unavailability of the RHR - system. In the staff's view, GE should provide' a_ curdensivs . determinaticm of the positive and negative risks mmiated ! with the operation of the OPS. Such a. determination would ' ' irrvolve a thort:up consideration of plant specific design features and a coupling of both the level 1 and'the level2 - analyses, first with the overpressure protection system ard then without the system. 'The determination should answer the following questions: 4
- 1. How does the overprm:nre protection system reduce the core rh aya frequency, and eventually, the ocntainment failure frequent,y?
7
- 2. Given core damage, how are the scurue terns affect, ed?
~ 2his is an outstandirg itm. .. 19-119 3,g , ,,g ,, g
Oraft Predicisional Table 19.6-2 'Ihe Staff's Ventirg Outocne Frequencies for Internal arx1 Seismic Events. Ventirg'- Staff's CDF % 2. Outome Int, Seis. Conditions Owe successibl 3% 71% 'Ihe pressurizstion rate is slow Routes releases from the ventirg when and without the MR system and drywell through the ventirg is containment sprays. suwu=ssion pool. necessary Successful 1% 1% Cbntainment pressure tem =s high h m y release through ventiry when enough to open the vent but would the suppression pool. ventirg is not have been high enough to fall unnecessary the ccritainment if the vent had not opened because of MR system rectnery before containment failure. Potentirdly no 13% 7% 'Ihe contairmient (drywell) Unscrutbed release through impact of pressurizes rapidly due to the drywell failure, l Vervtirg energetic event such as DCII, arx1 assumirq that the vent is ( approaches or eWs its ineffective in preventirg ultimate pressure capacity. Vent overpressure. actuation may or may not occur l dependiry on rate of drywell-pressurization and pool dynamics. , 'Ibe vent is not expected to be effective in these scernrios. Irr;ignificant 83% 21% Operable MR system. None. ) pressure l challerge to the contairnent 19-120 oreft Pr w ist e D
, _ =_____ri___ _
. lI_;
N- _ _. s
- --- ~. j,
/ - - -.-
- Draft Predicisionet - -
> = ;.
- 1. Values r eiund assimne no significant wetwell/drywell bypass flow. Significant bypass,.-if it were to occur, would result in an ir th frequency of venting (zws 1 ard 2 in Table)- and a cou@aling -
decrease in no-vent scenarios (row 4 in Table).
~
- 2. Int; = -internal events. - . Seis. = seismic events. -
- i s s Y
a sn.,,
.p .
N , ,_ J +
._ 'u. ,. - __ 1%-. m-e
1 Draft Predicisional (2) Drywell/Wetvell Bypass
'Ihe effectiveness of the vent can be severely cupunised jy -
unless drywll/wetwell bypass is controlled. Because the V setroint of the vent actuation is lower than the ultimato
. streryth of the containment (Figure 19.6-4), the overpressure protection system may merely cpen the 06- containment earlier than had it not been present. Ibr more discussion about drywell/wetvell bypass, see section 19.6.4.2.1.
(3) Uncertainty GE's analysis in the vent system actuation pressure does not adequately consider uncertainties. 'Ihat is, if the vent setpoint pressure is set at a particular value, GE claims that the OPS will operate only at that setpoint value. GE states (Pages 61-62 of Reference 19.70) that the vent actuation pressure setpoint is based on the pressurization frun a DBA IDCA and 100 percent metal / water reaction as specified in 10 CFR, Part 50.34(f) . 'Ibe resulting DBA pressure of 75 psig cambined with a tolerance of 3 to 4 psi in the vent actuation pressure, therefore, appears to be the basis for the current rupture disk setpoint of 80 psig; no consideration of severe accidents or uncertainty is evident. 'Ihe el of the system in the CET is also > simplistic, consisting of a branch point where there is either ocrrplete success (100 percent reliability) or complete failure of the vent actuation to emw. GE does rot take cruiit for any operation of the overpressure protection system in its sequence develognent, thereby claiming that its PRA is more conservative with this treatment of the overpressure protection systam.
'Ibe staff considered urcertainties in its review of the overpressure protection system. 'Ibe staff finds that considerirg uncertainty in the actual failure pressure of the containment makes a nodel of the overpressure protection system carrplicated. Figure 19.6-5 shows a more ocanprehensive view of the overpressure protection system, illustratirg inherent uncertainties, for a slow pressurization of the containment. 'Ibe overpressure protection system is represented by a narrow distribution to reflect the small uncertainty in the vent actuaticri. 'Ihe staff infers'a small uncertainty because the overpressure protection system is presumably designed within the Im1m of well established ard tested ergineering practices, allcwirg its response to be reasonably ard acrmrately characterized. ' '
'Ibe containment structural recponse is represented by a wide distribution to reflect the large uncertainty in its 19-122 ,,,,, ,,,3,,i,,,n,i
yw' E ,
. g n a k.,
P Draft Predicisional t< response above the design pressure.. Intuitively, the' , failure' probability imediately above the design pressure 'is low ard -ircreases as scme function of the pressure.- This distrilution is a==aa to peak at scnne ultimate containment failure pressure ard decrease to zero accordire .to the best urderstanding of that particular ccntairunent structure.- Setting the overpressure protection system above the^ s containment design pressure allows for a possibilityJof n containment structural failure. ~ 'Ibe lower tailof the containment failure distribution can be superi"maai on the distribution of the vent actuaticm. This. allows for the possibility, although ruote, of a containment failure rather than vent operation. Otmpeting risks develop, where either a vent actuation or a contaiment failure may occur. If the containment is weaker than the setpoint of the vent, then the containment will fail without the vent actuating. . ocawersely, if the containment is st.uaw than the vent setpoint, then the vent will actuate. (4) St =7 The staff has qualitatively identified the following OPS - f k associated risks that are not modelled by E in its PRA: H
- 1. There is a possibility of une=an venting, where the vent may actuate in response to a pressure ciallenge that the containment could have am-.----lated :
had the vent not been present. However, for such-events the releases should be small (given that suppression pool bypass is not'an issue) . and.the -
~
design of:the OPS would allow the operator to manually isolate the vent.-
.i
- 2. In the event there is significant bypass between:the t drywell ard the wetwell, the following can result:-
r (a) a potentially significant ircrease'in the frequency of actuating the overpressure protection. , , system, and '
/ (b) reduced time to overpressure protection' system actuation and fission product decay and aerosol-i settling. H, In its analysis, the staff has identifial the trade-offs
a===irg an all-or-none behavior of containment structural -j failure ard an' initial attempt to quantify the effects of' the bypass on the efficacy of the overpressure protection , system. Based on the review, the staff' believes that E ' chculd justify the setpoint of the overpressure protection , q 19-123 ,,,,, p, ,,,,,n,,. 1
~
p
' #
- v'.Y' ' ' '
,-i ,
' .g i . y ,
/ ,
' . /, - , o
- c .:
M/ '
. Draft Prodlcisionet.
systen, taking'.into account downside riAks,: and carry outl' . 0-
.the & q analysis of the' effects of drywell/wetwell . r.~
bypass on risk before conclusions can be readal that- the systen has a net benefit fran a risk peu.g&dve. - -
..i
.i
.j7 i k e i E - 1
.' i I
'I a
i
~l
.i s
1 5)
/I l ..
1
- t. ,
[ . ,j i i. li p. L t. g, , l .. L-
~
..n- .o.
5.s] r-19-124 ~ oreft predecisionet
. , s
~
's p.,
4'
'. - orsit PrecicislotuL i
t Certainty of t necessary venting E
, Possibility of
)
I l containment failure
- 1 I Possibility of
- l .
- unnecessary venting 1 Possibility of containment i I failure with no chance of venting j l
c
?
- I Possibility of contalnment ;
failure before venting j' E
- Possibility of venting !
I l [ I before containment falluto j' i i I t Certainty of venting
- : .' or containment failure i ! Pr(venting) !
[ j
!! +Area pr \ before[ venting c=ontainment II : f ailure/
- : : = 1 :
Vented ! i i i System i i !
! j ! Maximum !
- : : attainable :
j j j pressure j
- l l
- . E t Uncertalnty in ;
j i l Vent pressure ' i Vent ! j Setpoint j Pressure . 1 i !
! Area = Pr (i.*iUN""'"') = 1 Maximum NOR af talnable
. Vented i !
System l l: i Uncertainly in
' contsInment failure l ### " ###
Containment ' Ultimate' Containment Desion Pressure Failure Pressure figure 19.6-5 Hypothetical distributions illustrating the uncertainty in the vent setpoint and the containment failure pressure. 19-125
f;' ' J- _,
=
, :.9 -
,.,f
'N
.g r
,s Draft Predicisional' V '6.4.2.3 Passive Flooder System '
'Ibe' purpose 'of the passive flooder system'is to-introduce water into the lower drywell to quench the molten debris and produce a safe and stable state by ' forming a coolable debris' j bed. If this debris bed configuration can be actLieved, . the '
~
l core debris tenperature would be.such that the ocricrete
- floor and walls would not be affected,because nearly all of ,
the decay heat would be'used to boil the water.:'In such a- .g configuration, several challenges to the containment f rintegrity would be eliminated: o .High tenperature craam frun extensive core / concrete interaction, which can cause a overpressure and overtenperature failure of the containment. o Mechanical ard thermal degradation of the pedestal by I the core debris, which could allow the vanel to tilt and damage containment penetrations. o Mechanical and thermal degradaticn of the haaamat by the core debris _ (although for the' AB4R design,' this did not appear to be a serious threat due'to the. ' thickness of the basemat - 5 meters). In earlier &Kad-Li of the E SSAR; the passive flooder ; system was not a part of the icwer drywell design.z 'Ihe ABWR y design allowed.the core debris to erode .the pedestal ard, 'in ' E's view, the erosion would be stopped when the, core /uimu^w interaction reached the drywell/wetwell . c.uisctors tw 'in the pedestal wall; at that point, the . ; water frcn the suppression poc1 would enter'the_ lower L drywell;and quench the core debris. 'Ihe passive flerdar system was 9%3=itly added .to the 1cuer drywell design in -
- AKs iiud. 8 to the E SSAR (Reference 19.9) . 'Ibe system was
- ,
l. designed to rapidly deliver water to the molten debris to y' form a coolable debris bed ard keep the pedestal degradation to a mininnn. l E's scenario for the passive fler*r system operation. , ,y L' assumes that upon vmaal breach, the core debris enters ~tho' D l' lower drywell .and is uniformly distributed on:the lower *
- drywell floor. c'Ibe decay heat;and heat frun cocidation -
L' reactions melts the fusible plug actuating the passive ' e flooder system. In about 15 minutes, the ten'4-inch diameter flooder ports fill the lower drywell with . water ~ frun the suppression pool'. Minimal core /u udw interaction as predicted by the MAAP code will occur due to 'g. rapid quenching of theLmolten oore debris. An ex-v m el fuel / coolant interaction due to a rapid energy transfer'fran } the debris entering water in the lower drywell is precluded 19-126 oreft Predecisional
-, - -.~. - -
E-
- a j;
Draft Predicisional by pressure / temperature regimes and the debris particle size (Section 19E.2.3.1 of Refererce 19.9) . Steamirg frun the
/ core debris passes to the typer drymll, through the drywell/wtwell connectors ard into the suppression pool.
'Ibe heat delivered to the suppression pool is rejected to the environment through the MR system. Should the MR system be unavailable, the suppression pool would becte saturated, upon which time the containment would pressurize and eventually actuate the overpressuru protection system.
Focusing for the manent on GE's vics of the passive flooder operation, whem core debris enter the lower drywell and the passive flooder system actuates to cool the debris, the - followirq statements can be made:
- 1. 'Ihe core / concrete interactim would be minimal an:1 prevent pedestal failure, thus, avoiding the risks of containment failuru irduced by the reactor vessel tiltirg and damagire contairment penetrations.
- 2. Radioactive release frun the core debris in the lower dry wll have to pass through and be scrubbed by the flooder water overlying the coritan and the suppression pool. IUTE: Radioactive releases frun core debris ejected out of the lower drywell (i.e. direct containment heatirg) ard releases frun debris' remainirg in the reactor vessel would rot be scrubbed by the water frun the passive flooder system.
- 3. Ambient tenperatures in the drywell are significantly y reduced, thus protecting the operability of eqaipment ard structures.
- 4. Reliance is placed on the MR system to reject heat to the envimm;uit as a consequence of the steaming frun the core debris passirg into the suppression pool. GE believes that the three-train M m system adequately addresses this concern.
- 5. Reliance is placed on other means of pressure ,
sigpression when the mR system is unavailable. GE relies on its marnaally operated firewater system to a<iiress this concern. k Howver, the staff's view of the passive flooder system V operation differs in scrne respects frun GE's. view:
- 1. HEIroR calculations and other calculations d%W in letter report titled, " Effects of Debris Depth, Debris Ccuposition, ard Debris Ptuer on the Limits of Coolability," frun E. R. Oopus, Sandia National 19-127 oreft predeetstonet
_7. r Draft Predicisional Laboratories, to C. Tinkler, U.S. Nuclear Regulatory-Ctzmtission, Marth 13,1990 (Refererce 19.71), indicate signtificantly more concrete degradation of the pedes-tal wall than that predicted by the MAAP code, even after operatic of the passive flooder. Continued core concrete interactions would increase, the poten-tial for pedestal failure would undermine the system's objective for protectirrJ the lower drywell floor and walls.
- 2. MFTITM Calculaticms dcne in support of the staff's review suggest a possibility of the passive flooder system actuating before significant. amounts of the ooru debris enter the icwer drywell. 'Ihis leads to a possibility of a Went fuel / coolant interaction and rapid pressurization, potentially causing an early containment failure. 'Ibe pre-existing water pool, conversely, could increase the likelihood that debris would be quenched upcn entry into the pool and form a coolabic debris bed. (References 19.62, 19.72, and 19.73).
- 3. D<periments mew in a paper by B. W. Berman, et al., "Recent Intermediate Scale Experiments on Riel-Coolant Interactions in an Open Gecznetry (EXD-FITS),"
dated February 1986 (Reference 19.74), suggest that the pcssibility of a fuel / coolant interaction and rapid pressurization also exists when water is pourtd onto core debris in the lower drywell, as during the intended operation of the passive flooder system. g It should be noted that an effective flooder system is MA p# # g* r - w y to maintain safe temperatures within the lower drywell above the core debris followinJ a severe accident. In this regard, the staff believes that GE should further examine this aspect of the design. Such an examination should consider whether to introduce water into the lower , drywell in a controlled or urcad.wlled manner, how fast to '4 intradace the water arri when to introduce the water. 'Ihis is an oatstandirty . item. 6.4.2.4 Iower Drywell Corrpositico
'Ibe ertsion of the podestal wall by a core /ccrcrete interac-l tien may threaten the integrity of the reactor pedestal.
Amendment 8 of GE's SSAR (Referen:e 19.9) indicated that the l lower drywell would be cxmposed of limestone wicute. l ' Ikucver, recent information frun GE (Reference 19.69) irxii-cates that basaltic concrete will be used. 'Ihe staff's l early analyses showed that the cresicn of limestone concrete is more extensive than the crosion of basaltic corcrute; l 19-128 Draft Predecisional l l
a Draft Predicisional nuch of the erosion products of limestone concmte are non-condensible gases which would be driven out of the mit and contribute to pressurizirg the containment. However, the erusion products of basaltic concrute appear to dilute the mit, without posirg an overpressure threat to containmnt integrity. GE's analysis shcus neither type of concrute to be a problem in core / concrete interaction due to quenching g provided by the passive flocder. The staff considers the r [. e use of basaltic concrete to be preferable to limestone concrete. 6.4.2.5 ContLinment Structural Integrity GE did not consider direct containmnt heating and fuel /
# ooolant interaction as cruilble phencuena which could lead to the failure of the ABWR containment. Given this view, GE attributes cnly 0.1 percent of the accident prtgression frequency to this failure mechanism. Nevertheless, GE choce to inc: tease the ultimate strength of the containment frun 100 psig to 134 poig (Reference 19.69).
The staff's view of direct containment heatirq an1 fuel / coolant interaction differs frun that of GE. The staff believes these rapid prussure pulse phemmena can occur urder certain cin:umstances and may possibly be of. sufficient magnitude to threaten the integrity of the containment. The staff's view is based on the Grand Gulf analysis in the NUREG-1150 study (Reference 19.62). Though the ADWR differs from Grand Gulf, tre Grard Gulf analysis of the drywell pressurization appears to us to be applicable as a first approximation. In the Grard Gulf analysis, the prussure loading in the drywell fran high preraire melt ejection was characterized with a distribution having much uncertainty, being as high as 300 psi, with a median value of about 80 psi. Because of similar drywell volumes, the staff incorporated this distribution into the ABRR risk analysis, ammirg that a pressure pulse in the drywell would not be rapidly transmitted to the wetwell. Figure 19.6-1 (see Internal Events as analyzed by the staff) shows that containment failure frun rapid prussure pulses due to direct containment heatirg accrunts for 7 percent of the accident progression frequency; this a m wes the mcxiified ABWR haviry an ultimate containment strergth of 134 poig. In the unrrodified design having the ultimate strength at 100 poig, the containment failed in sequences contributirg abcut 13 percent of the accident prcgression frugaency. Therufore, this modification of the containment rtduced the conditicnal early containment failure probabili-ty by approximately half (frun 13 to 7 percent) . Incremen-tal ircreases in strurgtheniry the containment would further 19-129 ,7,,, p,,o,,,,,,n,g e
m -- r I ' Draft Predicisionat decrease this conditional contalment failure probability; however, the cost of redesignify the containment uny be significant. Other fractions of the accident progression frequency aru not appreciably affected by the incmased containment streryth because either the vent actuates (e.g. the vent setpoint was not increased) or the failure notonism is by arother neans (i.e., thermal degradation of noveable penetration seals). In the seismic events analysis, Figum 19.6-2 shows nuch less inprovement in risk because of the modification. Here, the primary reason for the failure of the containment is the loss of the RHR system. Bis causes slw pressurization, which led to vent actuaticn. j
% e staff believes that the s urgthened containment reduces the corditional probability of early containment failure frm direct containment heating ard fuel / coolant interaction phenwena.
6.5 Conclusions
- 1. We abbruviated containment event trees (Trs) developod by E for the ADWR weru of concern in the staff's review. E's contention was that since many of the containment issues identified in previous PRAs could be eliminated from consideration Wuw of specific ABWR design features and an increased knowledge base, the size of E's Trs adequately portrayed the potential ABWR accident progression. %e staff had the additional concern that E's analysis of the accident progression events in the CDs relied on MAAP code predictions without any uro:rtainty analysis, when the staff's experiences with the NUREG-1150 study (Referurce 19.62) irdicate that Trs should reflect urcertainty ranges which adequately Inflect the current level of understardiry of severe acx:ident crogressions. % e staff has concluded, therefore, that while scrne of the Tr sirplification is justified by specific ADWR design features, such abbreviated trees cmbined with the sole use of MAAP ard the lack of any uncertainty analysis, do not lend confidence that a thorough identification of the i m important to contairnrent performance has been unde. Specifically, with regard to inportant issues such as the identification of the ocuplete spectrum of challenges to containment integrity ard the effectiveness of the mitigation systems in contributirg to ABWR defenso-in-depth capability vis-a-vis the CCFP goal of 0.10, the following differeroes with E's analysis wert found:
(a) De staff considered challernes to the drywell integrity frun accident prugtessions involvirg rapid pressurization frun direct containment heating ard rapid steam generation. Bese phenomena, which received considerable attention in the NUREG-1150 study (Refercroe 19.62), were fourd to inpact 19-130 ,,, g ,,g g
Draft Predicisional the ADWR design's capacity to meet a CEFP of 50.10 in this amlysis. 2 treated these issues to be negligible probability events without sufficient amlytical suport.
'Ibe lack of an urrertainty amlysis by E further proc 1tded their identification as potentially important contalment challenges.
(b) 'Ibe staff was unable to him the potential for nelten corium degradirg the structural integrity of the con: rete reactor pedestal support, as did E, for molten core debris that potentially could continue to attack the concrete even with an overlyirg water pool. E should perfom additional analysis to evaluate this potential contairment challenge within the rarge of possible corium-corx:: rete interacticns, and the resultant capability of the concrete pedestal to structurally perfom its functions under these conditions. An uncertainty amlyses should also be conductal to allow a cmplete assessment of the magnitude of this threat to contairment integrity. (c) 'Ibe staff has identified a potentially sericus threat to the can'ht integrity as a result of bypass leakage frun the drywell to the wetwell airspaces. 'Ihis containment challenge, which was not addressed by G2 in its Trs, could be significant if drywell-to-wetwell bypass a@ roaches tM values aboezved in operatirg experience with similar containment designs. E should provide infomation to evaluate this containment challenge by addressirq the allowable drywell-to-wetwell leakage area and the capability of the vacuum breakers to repeatedly perfom during the course of a severe accident without introducity 6dditional leakage paths. Uncertainty amlyses also are necdal before judgments cm the magnitude of this contalment threat can be m*. (d) 'Ihe staff has concluded that 2 should further amlyze the design of the lower drywell passive flooder system in view of; (1) the possibility of the system creatirg conditicns corducive to an ex-vessel fuel / coolant interaction, i.e., Icwer drywell could be flocxled prior to a ocmplete ejectico of the corium frm the reactor vessel; (ii) the possibility of the system beirg unable to prevent serious degradation of the cancrete pedestal wall; (iii) the possibility of the systs providing sto^Mng rates sufficient to cuerpressurize the containment, soonex than without. the system, via bypass leakage between the wetwell ard drywell; ard (iv) the essential dependence of the syst s on the availability of the RHR system to cool the suppression pool ard prevent steam overprussurization. It should be noted that an effective flocder system is rvmary to maintain safe tenperaturns within the drywell following a severe accident. 19-131 o,,,, p,,,,,,,,,n,g
Draft Predicisional HwcVer, the design should be further examined to allcw consideration of whether to introduce water into the lower drywell in a controlled or urmhulled manner, hw fast to intzuduce the water ard when to introduce the water. (e) The efficacy of the containment overpressure protection system to perform its mitigative function is uncertain in view of (1) the possibility that the system pressure relief setpoint may rot have taken into account the various dwnside rim, i.e., premature (reduces the pocsible time for fission product decay prior to release)- or unmewy (reduces the pocsible time to recovery the RHR systan) releases, and (ii) the possibilit,y of the system releasing unscr,Mvvi fission products to the environment significantly earlier as a result of drywell to wetwell bypass flw without an operable or effective wetwell spray. The deterministic analysis of this system is dimW in wp
""cc' ' -
- 2. Based cn the staff's Er analysis both with aM without the overpressure protection system, the staff believes that the ABRR design could have difficulty meeting the CX:FP of 0.10, for both the NRC goal and the E goal and for both internal and seismic events, even without any corsideration of the potential containment threats previously Mame-ad in 1. (b) - integrity of the reactor pedestal,1. (c) - drywell/wetwell bypass, and 1. (d) -
fuel / coolant interactions, integrity of the reactor pedestal, arri overpressure in the containment frun debris' steaming in the Icw_r drywll. These staff cerclusions are based primarily on the fact that direct contairstent heating and rapid ex-vessel steam generation sequerres were found to be potential containrrent failure mechanisms. Furthermore, it should be noted that a CXTP defined as the quotient of'the accident progression' frequency for sequences affectirg containment integrity and the total core. damage frequency, needs to be evaluated very carefully when used as a measure to make jtx3gments on the adequacy of the plant's level of defense-in-depth (see Sectico 19.11) .
- 3. 7he staff believes that in light of the propoced drywell-to-wetwell bypass flows, E should give additional attention to the design of the containment spray system. Specifically, the cperability and ruliability of the spray system, either via the RHR or the firewater system, need to be addrmenri in terms of safety significance and design basis criteria.
} g $
Draft Predecisional
3 Draft Predicisional 19.7 SOURG TON ANALYSIS f 7.1 Introduction The objective of the source tem analysis review is to anwe G's source tem meth:xis and estimates, to assess G's prediction of ABWR design features for reducirg source term, and to assess GE's conclusions for its estimates of the expected releases. 'Ihis , source term analysis is not used to make a' deterministic evaluaticn of the safety of the propcsed design. Instead, it is used to an = =, in . 7 reanstic a manner, the safety profile of the pr
' design as expressed in terns of the frequency of severe accidents, the
' consequences of a spectrum of such accidents of varying severities, and -
the integrated risk to the public. 'Ihe staff performed a source term calculation with its *, MEIDOR (Reference 19.65) and STCP (Reference - 19.66) to capare to one of GE's source term calculations done with the 1%AP code (Faference 19.67) . Outside of the review of the AEHR, the staff is oirrently doing a detailed caparison of FTmR (Reference 19.65) and the ) RAP code (Refe.rencxa 19.67) . Source term calculations represent a logical plecirq together, usually in the form of detailed cmputer codes, of the knowlecke J of severe accident progressions. 'Ibere is noch uncertainty in that knowledge however and, as a result, more than one source term code exists. 'Ihe use of different, 'i.e. METmR (Reference 19.65) and SICP (Reference 19.66) that were developed by the NRC or MAAP (Reference 19.67) that'was developed by the Ardustry, will result in varying predictions of accident progression. Hence, an understarriing of the _ assumptions and nodelling is r-eny to interpret the results of the calculaticos. 7.2 Methods Discussion 7.2.1 GE An& lysis GE modified the MAAP 3.0B code to account for the unique configurations of the AINR and_ developed a lupusentative input. deck of the reactor ard cmtainment. UGirg this code ard input r deck, GE performed source tern calculations for 12 accident progression groups defined fran the CET analysis (rel- for rormal containment leakage were estimated fran~ design basis leakage). 7.2.2 Staff Review
'Ihe staff's review made use of a variety. of ocrnputer codes to assess source terms. First, _ in an audit, a SICP and a MEIIDR l calculation wru cmpared to a GE MAAP calculation of'a sirgle sequence for the timirg of the accident progression. Second, to determine release fractions, a parametric code similar to that unod in the NURDG-1150 study (Reference 19.62) was developed and Draft Predecisional'
-r 4
r Draf t Predicistorial exercised such that urK:crtainty estimtes oculd be mde. A brief discussion of each of these calculational amlyses follows. Ccmnarison of Acrident. Protnvssion Timira A timim cmparison was done for a sigle sequence. The sigle sequence, i.e. the base case sequence, was chosen frce the-sequences for khich E did MAAP calculaticns. The selection was mde on the basis of the sequence which included phenomena of mlevance to source terms, not on the dcmimnt sequence. 'Ihe sequerre was a loss of core cooling with vessel failure at high pressure. It resulted nestly frun the Class I A (high pressure transients with locs of core coolirg and failure'to depressurize) and Class III A (small to medium IICA with loss of core coolig and failure to depressurize) accidents. 'Ibese types of accidents account for about 30 percent of the core damage frequercy, and represent phencmena that are of particular interest in the review of the source tems. Release Fractions ard Uncertainty Calculations
'Ihe NURD3-1150 study (Reference 19.62) served as the basis for estimtirg the uncertainty in the source terms. Parametric codes frun that study, collectively called XSCR (Reference 19.75), kure used to'develcp a versico called ABSOR for the ABWR review by mkirg the nmmry mcdificaticns to describe the ABWR design.
Frun the experience gained frun the NURD3-1150 study (Reference 19.62), fifteen key inputs of the ABSOR code were chosen and assigned distributions while holding four other parametern constant. While the staff's effort was less detailed than the NURD3-1150 study (Reference 19.62), the staff believes ' that the selection of variables arr3 distribution assigrents serves as a first appruximation to uncertainty and is adequate'for estimtirg source term for caparison with E's calculations. To perform the calculations, reples of these distributions w_re taken with a IES technique, a fom of Mante Carlo sanplirg (Reference 19.67) . One hundred sanples of the input distributions produced one hundred sets of inputs for one hundred runs of the ABSOR code to produce one hundred sets of outputs (sourm tems) for each accident progression group (see Table 19.6-l' in Section 19.6.4.1). 'Ihe one hundred scurce terms for each accident prugressicn group taken together formed distributions that constituted an estimate of the source term release fractions arrt urcertainty. Fran these distributions of rairce term release ~ fractions, the 5th, 50th arx195th percentile were determined for each acx::ident progression bin stemirg frun the staff's CET analysis. 19-134 Oreft Prececisional
f4 9 l Draft Predicisional i 7.3. Assess m nt of Methods L-E's ethod for estimating source term is somewhat differunt frun the approach taken in the NUREU-1150 study (Reference 19.62) . In that f study, strategic groups of pathways were defined for m king mechanistic 'l source term calculations with mdes, such as MimR (Reference 19.65)
~
[ and the SICP (Reference 19.66), in order to adjust the paramtric codes.
'Iben all pathways through the Er had independent source term
[ calculations made with the parametric lKSOR codes. In contrast, E grouped the pathways first, then calculated scuros terms for each group -l with its mechanistic code. 'Ihe staff finds E's method to be acceptable. . However, uncertainty was not acklressed, which ls a major' l deficiency because source term calculaticos inherently hm auch , uncertainty in thorn.
'Ihe staff's mthod for calculatirg source tenns was similar to that used in the NURDG-1150 study (Reference 19.62) . However, as stated above, it was limited in secpe. Nevertheless, it appears to be adequate to determine and assess source term in each of the accident p%sion .,
bim. 7.4 Source Term Results >; 7.4.1 Presentation of Source 'Atrm Results 'frcan the E PPA and the ' Staff's' Review Table 19.7-1 qualitatively shows the magnitude of the source terms (! for the accident prtgression groups in Table 19.6-1 and Figures ! 19.6-1 and 19.6-2. Here, the staff characterized the source terms as ncgligible, low, moderate, and high and present source terms . for both the E and the staff's analyses.
] 4 i
l l 1 1 19-135 3,,,, ,,,,,,,,,,n,g
m, ,
, 41 g
~ ' ~ '
.~ -
~ '
[ l. 4 _
~
~ ; . - . -'S a
- ="
.q -
Draft Predictstonel
}
' A ~ c
. Table 19.7-1 Description of the Accident F1upsion Source Tents in Terns of the Oore Damage Frequency Fractions of Table 19.6-1 (in Section 19.6.4.1) and Figures 19.6-1 and 19.6-2.
Contalment Response and Qualitative Sequence code Magnitude of the - in contairnent Onllerne Source Terms Table'19.7-2. (A) name as .(H) subject to assunptions If the bypass flow is large, then NCL about drywell/wetwell bypass and . irnd source terms,- particularly-of. y n-= 141 failure. rxtle F, occur via cxmtalment failure or vent actuation. If there is 3-#- dal failure, _ then potertially high-source terms dircugh failed contalment p==.=/uatiore: 'If there is no bypass or pedesta' 'V. lure, then the contairunent renal:c .nr act and the source term ares
~
neglig1- m. (B) No pressurination when core debris Becaut- he contalrnent remains intact, NCL-
- is stessaing in the Is=i,ctric vessel the si *
;e tenas are negligible.
with the RHR systein. ~ (C) 81w prenanwination when core debris lhether the contairment fails or the: IO1PIVIN
-is shaming in the twm tur vessel -
vent actuates, .1w source terms because without the PHR systen.- .the suppression pool is in the release path. (Amam no drywell/wetwell. bypass fim.) 19-136 - oraft eredecisionet.-
- -+
'4
~
.' L . _
- ,., _ /
se - w w --.-w, -w , s s , r ,N-- -e- ,s- - ww , .e e ,e s ~ - *-- r -,--r %w, n . . t +
~
;. _ a.
' 2- _
^ -
.gg 7,7 9
^ '
m . ., c
, .- . _ ~
Draft Predictsionst ^ Table 19.7-1 (contimed) ' a:ntalment %s arri Qualitative Sequence code - Magnitarle of the in Contalment Challenae Source Terms Table 19.7-2 (D) .High taeparature on penetration Decessive leakage frun ba&u NSCHPfBI emale and' slow pressurisation frun penetration seals, equivalent to a core debris ejection into the upper failed containment, resultire in high drywell.. source terms. (E) slow pressurisation prior to vessel
~ 'Ihe overpreamwe pressure pulan. ion. IDIPPEHI failure due to loss of the RHR systen fails, allowirq the contalment L systen and =*wunw!nt. loss of core to fail before the rCuA vessel is cooling. breached and fission product release begins. Source terms are high.
(F) Rapid y. -=Isation at . vessel Early structural failure of the NSRCPEDI failure fztmi direct contalment catalment results in high source heating. terms. ~ ^ (G) slow a=--~ isation when core debris -Iate contalment failure results in low IIIPFSDL is staaming in the lower drywell. to medium source terms when:the ICLPPful - without the RHR systaa._ contalment sprays operate and'high source terms when the ~contalment sprays are unavailable. (H) No pressurisation (according to the Because the contalment renains-intact, NCL GE analysis);when core debris is _ . the source terms are negligible. ~ steaming.in the. lower drywell with the RHR systen. : r
+
P-
.+
4 e- w. .-4.w S.[ . [, w . - ,e+,,. e~ , , ., , ,U u . , , h, , a r. .. , .y .c e . -6,. - ,,n . 6 .. . . ,.w.., -y , .e,_.w , ,... ..M
Draft Predicisional 7.4.2 Discussion of the Source 7brms The followiry cli=" ion will focus on the two principal cmponents of radioactive source terms, rnmely, release fractions and timity. 7.4.2.1 Release Fractions Table 19.7-2 cmpares E's and the staff's release fraction estimtes for major sequence groups. The table empares release fractions for cnly cesium and iodine. Noble gas release fractions are essendally 1.0 for both E's and the staff's estimates ard sinply not included in Table 19.7-2. Ikuever, other fissicn product species we not included in the table because E predicted the releases of only iodine and cesium (in addition to noble gases) to environment; other fission product species were either retained in the damage fuel, the reactor vemal, or the containment. During in-vessel core degradation, the more volatile fission product species (cesium, iodine, ncble gases, and tellurium). are mieased frm the fuel. Some of these fissico products are retained en the surfaces of the reactor vessel, but most are deposited in the suppression pool. The fission products deposited in the reactor vaaaal can, over time, heat ard eventually revolatilize. The MAAP code predicts that a significant fracticn of these fissicn products revolatilize and are released to the envinauxht if the containment fails; tellurium is not predicted to revolatilize ard, 1 herce, is not predicted to be released. The refractory fission products are released frm the fuel after the vessel failn if the core debris remains at high temperatures and vigorously attacks the concrde of the l lower drywell. E assumes that the passive Emder system l effectively cools the core debris in the lower drywell to I prevent extensive core /u mute interaction ard fission product release, thus, reducirg fission product releases frun this source. The overlyirg water pool wmld also scrub j (debris.the fission products that would be released from the core The staff's release fractico estimates also ' account for the revolatilization of cesium and iodine; therefore, its umertainty range in Table 19.7-2 cr0_-p" the E results. Ikuever, the staff's estimates differ from the E estimates in that they allow for the possibility of continued core /corcrete interaction, even aftzr the passive flooder systan actuates. Thus, the staff's release fraction estimtes irclude the release of refractory fission products (not shown in Table 19.7-2). Notwithstanding the above Draft Predecisional , l l i
w q %
- 1* ,
y' .; Draft Prediclaional i differences in GE's ard the staff's approach, the followirg - general statements can be mde.rr.gartling the rulease f- fractions shown in Table 19.7-2: ; o Mirdmal sc'. tree term occur when there is normal containmFnt leakage. E's estimtes of iodine releases are generally bounded by the staff's estim tes. E's estimate of the oesium' release is s about three orders of magnitude above the staff's-predictions for the normal case leakage, but both are very small. o other than norml containment leakage, minimm source terms are seen in. sequences where the core ~ melt is arrested in the reactor vaawl, Group (2) . .The E estintes are slightly less than the staff's median estin te, but within the uncertainty range. o 7he mv4== scurce terms are seen in station blackout and ATHS sequences, Group (5), and sequences where the cantainment has failed prior to vessel failure, Group (4); in both maa=, the containment fails early. GE's estimated predictions are near the upper bourds (95 percent) . of the staff's uncertainty bounds. The staff. predicts larger iodine releases than oesium release whereas GE predicts roughly equal amounts of these radionuclides. - 1 o The effect of the firewater system aligned to-the containment sprays is evident in Groups (6) and (7)s (the passive flooder system actuates in both cases). GE claims a reduction in' source terms by a factor of about'50 to 65. The staff predicts, a significantly smaller reduction, a factor of 1 to 3. < Nevertheless, GE's estimates are within the rarge of uncertainty.. o Table 19.7-2 and Figures 19.6-1 ard 19.6-2 show thati GE predicts significant fission product relancan for p same very low frequency accident sequences and failure y nodes. Som of these low frequency source terms ary - ~ towards the high end.of the staff's urcertainty rarge
^
for the volatile fission product groups (As d4=nmau_1 above, GE did not calculate. release of the refractory fission products).- 7 Draft Predecisional
,s
-. -j Draft Predicialonet Table 19.7-2 Cesium ard Iodine Release Fractions, as Estimted by the Staff ard GE for the Staff's Accident Fiu3tession Bins.
Referen Staff's Estimtes GE's to Figures GE Savuence Cbde 5th 50th 95th Estim te 19.6-1 & 19.6 (1) NCL 2.1x10'" 3.2x10# 3.9x10'8 5.1x104 A,B,H l (2) IIHPIVD 2.7x10 4 2.7x10 5.3x10-2 4.0x10'3 C 4 (3) NSCHPFP 8.0x10 2.1x10-2 4.2x10^ 1.0x10^ D Cesium (4) IGPPEE 0.002 0.06 0.75 0.46 E (5) NSRCPFD O.002 0.07 0.75 0.50 F (6) ICIPPFD 8.3x10 4 7.8x10'3 1.7x104 1.7x10 4 G (7) ICIPFSD 6.6x104 2.4x10'3 1.4x104 3.2x10'3 G (1) NCL 3.4x10'" 4 2.3x1044 3.8x10 4 3.8x10 4 A,B,H (2)' IIHPIVD 8.5x10 4 9.2x10 6.1x10-2 2.8x10 4 C (3) NSCHPFP 9.4x10 9.4x10 -2 4.0x10^ 1.2x10 d D-
. Iodine (4) IGPPFE 0.007 0.19 0.69- 0.47 E (5) NSRCPFD O.007" 0.19 0.69 0.50 F (6) IGPPFD 0.002 - 0.10 - 0.16 0.18 G (7) ICIFFSD 4.7x10 9.7x10-2 3.2x10^ 2.7x10'3 G Cbde Description (1) HCL Norml containment leakage (No contalment failure).
(2) IGPIVD Fission product scrubbed by stypression pool before release, included the " venting" H sequences. _ Early contalment leakage due to high teitperature failure of Neuutions, no suppression - (3) NSCHPFP pool scrubbing. . (4) IGPPFE Early antalment failure, no sWsion pool scrubbirq. (5) NSRCPFD Early ocatalment failure due to A' INS, no stppression pool scrubbing. . (6) ICIPPFD ' late contalment failure due to ovempisization, no spray, no stwssion pool scrubbing. (7) ICIPFSD Inte contalment failure due to ovemptsization, spray available, no stppression pool sCruli)ing.' 19-140 oreft predeclaronet s
.b
4. Draft Predicisional 7.4.2.2 Accident Progression Timirgs In Table 19.7-3, three sets of timings frta the MAAP, SICP, ard MF7mR codes are shown. 'Ibe particular sequence
. analyzed involved a less of core cooling, vessel failure at high pressure, passive flooder openire to qmnch the debris in the lower drywell and, as there is no containment cooling, and containment failuru (vent not nodelled) .
Although the calculaticn was done for an earlier version of the ADWR (Reference 19.9, i.e., 100 psig ultimate strength of the containment arri lower drywell camposed of limestone cx:ncrete), the calculations are still relevant to show the degree to which the timings diverge. 'Ibe staff believes that similar divergeroe would a;. pear w.ru the calculations to be redene accounting for the design nalifications. 19-141 ,,,,, p ,g , i g
Draft Predicisional Table 19.7-3 Timing of Key Events in an Accident Progression. # Tire in Hours Event HME .1EE MELO2B Reactor scram 0.0 0.0 0.0 Care uncovery 0.3 0.4 0.5 Fuel begins to melt (c) 1.3 0.9 lower plenum dries out (d) 2.9 4.5 Vessel failure 1.4 4.2 4.7 Passive flocder opens 2.4 4.7 4.7 Vent opens (e) 19.0 11.3 11.9 Con
- h failure 20.9 13.6 15.3 t
(a) Calculations are basM on the AHau AaJit 8 design, where the ultimate strergth of the containment is 100 psig and the lower drywell is V M of limestone m u ule. (b) 'Ibe sequerce is defined as a loss of core cooling, where the vessel fails at high pressure, the passive flocder opens to quent the debris in the 1cuer drywell, and, as there is no containment coolirg, the drywell head fails. (c) Not given by GE. (d) Modelling in the MMP code has the lower plenum fillM with water when core debris drops into it and fails the vessel. (e) Would have opened at this tire if the containment was vented. I 1 1 1 19-142 oraft Predecisionet
5, e r Draft Predicisional dryout does not occur because the assel failure is nodelled as occurriry while water is in the lower plenum. M: 75 percent of the core _h nelten before the entire core slunps; the dryout occurs rapidly because the entire core sitmps into the lower plenum. MEI.CDR: the core sitmps portion-by portion. '1his can influence on the predicted times to dryout of the lower plenum; the portion by portion slumpirg delivern hot debris relatively slower than the sit:P, hence, the boilirg is slower. ' vessel Failure. 'Ibe nodelliry of the vessel failure is inportant huam it determines the aucunt of time that is available for recovery while the core debris is in the vessel, other aspects of the accident progression aside, the differences in the models that cause differences in the time to vessel breach are as follows: 5%P: While the water is in the lower plenum, the core debris heats ard fails the penetrations. M: When the water in the lower plentun boils away,
- the core debris heats the lower head until a gross failure occurs.
MEIIDR: Hben the water in the lower plenum boils away, the penetrations rapidly fail. -l Taking the core degradatics) process and vessel breach together, Table 19.7-3 shows that vessel failure is predict-ed to occur earliest (1.4 hours) frcru the MAAp code followed significantly later (4.2 hours) by the SICP and slightly after that (4.7 hours) by MEILOR. . Vessa.1 breach occurs earliest in MAAP because the water in the lower plenum does not need to boil away prior to penetraticri failure and a large arount of core debris supplies a large amount of decay heat to do this. ' 'Ibe SICP nodels deliver a large amount of core debris for heatirg, but both the water and the lower head must be heated. 'Ibe FrrrR models boil the water but nelt only the penetrations; because a small anount of the core debris does this, the lcrgest times to vessel breach are predicted. Dghris dispersal in the lower drvwell. 'Ihe nodelliry of the debris dispersal is important because it determines the actuation of the passive flooder system and the failure of containment penetrations in the upper dl,ywell. I 19-144 Dre h Pr M s W
m, -
.,- r
) Draft Predicisional f' As expecta:1, differences ard similarities in the timings Were fourri anorg the predictions frtan the MAAP, SICP, and HEIIDR codes. o 'Ihe tim to core uncovery is about the sam because this is little nere than a calculation of boiling off a given arount of water. o 'Ihe SICP and NnmR proiict appruximately the same tim to com melt because, in a simplistic way, this can be viewed as a calculaticn of heating a given amount of metallic mass. o 'Ihe MAAP code calculates vessel failure occurriry at 1.4 hours khile the SICP and NnmR calculate vessel failure <mrrirg at 4.2 hours and 4.7 hours respectively, o Cbntairrent failure is pruiicted at 20.9 hours by MAAP while it is prudicted to be noch earlier by the SICP (13.6 hours) ard MFTmR (15.3 hours) . Mcdels of both the plant ard severe accident. phencanena give rise to the predictions. 'Ibe staff believes that the diffemnces in the plant ehla are small because the SICP and MFimR input decks Were derived fIUn the MAAP input deck developcd by GE. If the staff developed it own input decks, the differences in the prulictions might be further cxmplicated by differences in plant = hin. Also, these calculaticns have a ocosiderable amount of uncertainty, which has not been determined. Such uncertainty would obscure differences in the predictions and the reasons for such differences. - In this revicW, the reasco for. the differences in these tiros is largely due to the wrb111rg of core degradation, vessel failure, debris ejecticn'into the lower drywell, and Core /u.u Lut.a interaction, eaCil of Which are diFmM beloW. Com Dearadation. 'Ibe modellirg of core degradatico is important because it in part determines the anount of debris ' available for mhmqmnt phensaena, such as dirrct containment heatirg (high pressure sequences) or core / concrete interaction (low pressure sequences). Other aspects of the accident pwussicn aside, the differences in the wrb1n that cause differences in the t1Jne to vessel breach are as follows: HMP: core degradation is modelled as a large amount (30 percent) of the core ruraining in the vessel; the 19-143
, , , , , p ,,,,, , , i o,,, g
3;- q l _ 3_
-k ,
'*N l
giy , ON , Oraft Predicisional-e WAP: 'Ihe debris falls. into the lower drywell, even in . h a high pressure sequence where it is also dispersed into the upper drywell', along with water fra the' reactor vessel because the reactor va==1. failure occurs at a va==al per==Lration before the lower plenum : in the vessel boils dry. .once!in the lower drywell, the water over the debris must'be-boiled away before the tenperature can reach 500 deg. F. and actuate the passive flevviar system. ED2: Hot gases and s e e debris enter the lower drywell without water (because the water in the lower ' planum.of the reactor vessel must boil' dry before the va==1 fails.) 'Ihe core debris is dispersed into the upper drywell. 'Ihe hot rpaan and core debris actuate the passive flooder system soon after vamaal failure. MEIDOR: Similar to the SICP, except that it takes slightly larger to actuate.the passive flooder system due to.Fviallirg differences.
.n Core / concrete interaction. In MAAP, the' core /dsde interaction is minimal because the. core debris is modelled as entering the lower drywel1~ where it 'is quenched with '
water. frm the passive flooder. system. ; In S'ICP. ard MF*TmR calmlations, the interaction is more extensive.'
'the above di== ion illustrates sme of the modelling differences '
arrong the source' term codes involved in the PRA and the review.
'Ibese modeling differences give. rise to the differences In the- ,
source term predictions. See of. the differences in the models' 1 are a consequence of the need'to make approximationsJof-these phenomena in order for t!w ocmputer errlaa to operate.on.a reasona-ble amourrt of resources. Eut more important, the modelling dif- ' < ' ferences arise frm inocuplete understanding of-severe accident # phenmena,. both by the staff and the industry. 'Ihough the time to contalment failure was calculate:1 for only.one sequence,;the relatively short times that are predictedi 13,to 15 hours, for ' this " typical" sequence suggests that other credible sequences may.
-have containment failure timaa.less than 24 hours.
7.4.3 System Effects In the staff's review, . the staff began' to 'a==a== the inpact of , sme of the ABWR design features on the source terms. 'Ihough the ' y staff's results are nostly qualitative, they bring out important [j . points. ' i ej W q 19-145 ,,,,, ,,,,,,,,;,n,g , l i
.cr q~
- - :-. .~. . . . + . - :. - . . ,d
_. 1 Draft Predicisionat . Irver Drvwell source term can be affected by the mterial used in the lower l drywell structure. Although limstone concrete ablates at a higher temperature than basaltic concrete, mch of the abletion-products are non-condensible gases that do not dilute the core debris. Basaltic concrete mits at a lower temperature but thrs heat flux in the core /c.umet.e interaction tends to be lower because the core debris is diluted by the ablation products. 'Ihe staff has not thoroughly characterized how the source term would differ for either limestone concrete or basaltic concrete. l Passive Flooder System l l Water is intrr*vwi onto the debris by the passive flooder system in an attempt to quench the core / concrete interaction. Accordig to GE's calculaticos, the core /wmete interaction can be querrhed, herre, the source terms frtzn this core debris are greatly r= W . According to the staff's calculations and limited experlmnts, the core / concrete interaction is not n - mrily quenched rm M1y - a significant interaction may persist until both exidation reactions and decay heat subside enough to allow the heat losses to exceed the heat generation. Assuming for this dimmnion that a fuel / coolant interaction does not occur, the overlyim pool will exert three effects - crust - formtion, scrubbing, ard srmming, o Experiments suggest that a crust may form on the debris bed. However, these experiments may not be prototypical; crust formation is being studied in ongoing research activities.
'Ihis may reduce source terms by trapping certain fission products in the underlying molten debris. Also, it may irr:rease other roirce terms by inhibiting debris cooling, thus helpig to maintain the debris at a high tenperature where fission products are volatilized and driven off of the debris.
o 'Ibe scrubbig afforded by an overlyiq pool of water is deperdent on many factors including pool mh'mling, bubble dynamics ard particle size. Pool scrubbing provided a decontamination factor of 1 to 16 in the staff's calculations. 'Ihis figure gives scue indicatico of the potential source term reduction value of the passive flooder system, as well as the variability inherent in this factor. o 'Ibe steaming exerts a canplicated effect cm the source terms. On the cne hard, it creates a moist envirtoment that would tend to reduce aerosols through crmdensaticn ard agglceration mechanisms. On the other hand, volatile species such as iodine are released along with the steamirg. Also, the steaming pressurizes the containment, reducing the 19-146 ,,,,, p,g , g g i s
Draft Predicisional tim to containment failure, or if the overpressure pIntection systan is present, the tire to ventirg. If cmtainment failure or the onset of venting occur more rapidly, this will shorten the tim available for reducing the source term thru.gh acrosol deposition and radioactive decay. Containment Sorav System Ox1tainment sprays can reduce source term by the scrubbity action of the sprays. E takes imxh credit for this scrubbirq - the release fraction of iodine decreases by abcut two orders of mgnitude, for a sequerre where there is a loss of core coolirg with vessel failure oo::urring at icw pressure (frun 0.18 to 2.7 E-3 in Table 19.7-2). 'Ibe staff's calculaticms with the parametric source term code indicate a typical decortamination factor for containment sprays of 1 to 3 in Table 19.7-2. Overoressure Protection System
'Ibe overpressure protection system is designed to route releases in the drywell through the suppressico pool where scrubbing em ws. 'Ihezu are source tern effects arising due to this system that could increase source term:
o Drywell/wetwell bypass can partially defeat the overpressure protection system by routing a portion of the drywell rulease arcurd the suppression pool to the wetwell air space. At least a part of the release would then be unscrutbod. Also, because the containment pressurization would be enhanced, the time available for the decay of fissicn products prior to vent actuation is reduced. o Nhen ventirg rmms, the ocntainment pressure will drop causirg a porticm of the suppression pool to flash. Fission products can be re-entrained through pool swell ard flashirg, a phenomenco unaccounted for in either the staff's or E 's PRA: E nwia additicnal calculaticos showing it to be of little concern (Reference 19.69). 'Ihe staff Ivviewirg the PRA has not seen these additional calculations nor has the staff unde calculations to a-= the potential effects of flashirg. 'Ihis is a confirmatory itan. 7.5 Conclusicas
- 1. AlthoLgh E's source term estimates appear to be within the range of unmrtainty developed by the staff, based on the staff's limited ocnsideration of scurce term estimates frun E's MAAP code and the staff's ADSOR/SICP codes, the staff believes that predicticns frun these ocdes could show
( considerable differences because of differences in mcdels 19-147 37,,, ,, g g
o. 1 4 Draft Predicisional I and assumptions. The staff themfore concludes.that E should include a treatment of source term uncertainty, as part of its overall analysis of uncertainties, sirre large uncertainties are inherent in these calculations.
- 2. E did not calculate fissicn product release during core / concrete interactions because MAAP predicts that the flooder will quench the core debris. 'Ihe staff is unable to cmpletely die:mine the potential for continued core / concrete interactions (and hence release.of fission products from
, this source) after cperaticn of the passive core flocder.
f [ Accordirgly, as part of the uncertainty analysis E should explicitly consider the potential for continued core v concrete interaction and attendant source term releases.
- 3. The efficacy of the containment overprussure protection system to perform its mitigative function is uncertain in view of the cancerns raised in cbnclusion 1.(e) of secticn 19.6.5 (pool bypass). 'Ibe effect of pool bypass on source terns should also be addressed in the E analysis. E' should also submit their calculations regartiirrJ pool flashing.
l l l l l 19-148 Draft Predecisional
e Draft Predicisional 19.8 CD!iSEQUDICE ANAINSIS 8.1 Intmluction The objective of this section is to provide an as==nt of the consequence analysis, the conclusicns made fmn the mulysis, and the inpact of the ADWR design on pmilcted consequences. The codes for calculatire the consequences were the CRAC2 cn3e (Reference 19.76) used by GE arri a more advanced consegaence code, MAOCS (Reference 19.77), used by the staff. The inputs to the codes and the way in which the calculations were capiled were also ruviewed. 8.2 Methods DiemeAion 7he consequence predictions are the third caponent of .the risk calculation. Here, the fission product release predictions are ccenbined with dispersion patterns, meteorological data, and population data, to yield predictions en the radiological impacts on a population. For this discussion, the times of importance to consequence calculations are. illustrated in Figuru 19.8-1. 8.2.1 GE Analysis GE based its consequeJoe Calculations Cm five sites in the U.S. representing meteorological regions, called northeast, northwest, scuthwest, south, ard west. The meteorological and population data were obtained frun previously developcd information contained in "7bchnical Guidance for Sitirg Criteria Developnent," Sandia National laboratories, NURD:;/CR-2239, dated Whar 1986 (Reference 19.78). The scurce terms Weru determined usirg the MAAP code (Reference 19.67) for each of the 13 release categories (12 accident sequences and tormal containment leakage) as ( di9meeM in Section 19.7.2.1. The five calculations frorn each of the sites, made for each release class, were averaged together. GS did not provide corra]uence results for each acx:ident progres-
/, i I
sion group (See Table 19.6-1) in its SSAR (Reference 19.9), . but separately provided ca.quter output supportirg the SSAR. GE assuned that the elevatico of the Inlease is always 37 meters because of the way in which release paths channel thrcugh the design of the AIMR. If releases were to go thttugh a vent, the rulcase would be thttugh the stack of the standby gas. treatment system, ard hence, it would be scxnowhat higher (about 76 meters) . 19-149 ,,,n p,g g i
m..
,-s DraftPredicisionak. 's u
3 ' h , t-Accident ' Release' occurs begins , L Time to release ' Warning'. ; time
Tim e to ' '
notificaffon - _ ,; of public Delay time c Notifj cation Evacuation .
.to pu blic :begins -
p !- 6 i, , T h e'- ' 4. o , , l' , l- . t l. Figure.19.8-1 Important times of consequence calculatism u 19-150 or,,, ,,, ,,i, ion,( l: l- ,
'l5
*).
., __ . . __ .. - 2- - - '
a 0 Draft Predicisional Scare of the assurptions mde in the consequence calculations varied arcry the imC ard the EFRI risk mnasurus appearirg in Section 19.9. In calculatirg the IEC Quantitative Health Cbjectives and the AUB requirements, E assumed 1 hcur between accident initiation ard public notification, an ack11tional 1.5 bcur delay in evacuatirg, 95 percent evacuation within 3 miles of the plant, at an evacuation speed of 4.47 mters/second (10 miles / hour) . The warniry time, which is defined at the tim between official rotification ard the release of radioactivity, depends on the tim of containment failure, ard varies from 1.7 hours to 20.7 hours. In calculatirq the EPRI AUR reguiluments (Reference 19.2) (involvirg the probability of exceeding 25 ram at 1/2 mile from the plant, i.e. dose definition of containment failuru), E assumed no evacuation ard to shieldity for 24 hours after plume arrival; in both the internal ard seismic events - calculations, the assunptions about the evacuation distance, warniry tim, and speed kere the same as thoce made in calculatirg the imC risk measurus. 8.2.2 Staff Review The staff's consequence estimates were calculated usiIn the MACXS ccde. Ikuever, instead of five sites, the staff used two' sites Impresentirg a Icw pcpulaticri site (Salem Power Station) ard a high populatic 1 site (Zim Ptuer Station) . The consequences were , calculated for each of these two sites, then averaged together. 7he averagiry was done because the low population site was thought to urder-represent typical acrsequences ard the high population site was thcxqht to over-represent typical consequences. Although the staff averaged the consequences, the averaged results do not necessarily represent an " average" site. 7he source terms used for these calculations were derived frun calculations usirg the ABSOR code (Reference 19.75) . As riie'W in Sectia) 19.7.2.2, the uncertainty was expressed as distributions, fran which the 5th, 50th, and 95th percentile source terms were determined for eadi of the seven release categories calculated with the staff's CErs (See Table 19.7-2) . The staff's release height is the same as that of E. As in E's aralysis, scme of the assunptions mde in the consequence calculations varied anong the NRC and the EPRI risk measures appearirq in Secticri 19.9. In calculatiry the }sc Quantitative Health Objectives ard the AUG Requirements, the staff calculated a warnire time and amsvi 99.5 percent evacuation for internal events or 0 percent evacuation for seismic events, within 10 miles of the plant, at an evacuation speed of 4.47 meters /second (10 miles / hour) for the staff's low population site or 1.1 meter /secord for (2.3 miles / hour) for the staff's high poptlation site, with a calculated notification tim. The time between accident Draft Predecisional L.
? o 4 Draft Predicisforal initiation ard the tim of public notification, i.e.1.33 hours, is about the same as E 's asmention. 'Ibese assumptiornt are similar to asewetions in the NUREG-1150 study (Referenoc 19.62) . In calculating the EPRI ALHR requirarents (involviry the probability of esmnding 25 run at 1/2 mile frm the plant, i.e. dose definition of containment failure), the staff amwnna to - evacuation ard no shieldirs for 24 hours, as in c's calculaticns. 8.3 Staff Amenant I CRAC2 (Referencx319.76), and the MAACS (Reference 19.77) are very similar cmputer programs, MAACS beirg the Ev"wr of the CRAC2 code.
'Ihese codes have been shown in previous stniles to produce results within a factor of 2 to 3 for similar input a==ptions and the staff considers that both provide an acceptable characterization of the conse-quences of a severe accident. Acconiirgly, the staff firds E's use of the CRAC2 to be acceptable.
'Ihe staff has also aswna E's input assumptions related to warniry times, evacuation delay time, and height of release. Although some of I
the inputs to E's calculations differ from the inputs to NRC's calcula-
] 'tions, the differences in the results are small. E's warnirs tim is F fixed and begins one hour after a reactor trip. NRC's warnity tim is i j calculated and begins when the level in the vessel drops to 2 feet.below f' the top of the active fuel; this takes about 1.3 hours for sme sequen-ces, based on predictions fran the SICP (see Table 19.7-3) . 'Ihe effect of the differerce on consequences is small.
Ocznpared to the NUREG 1150 sttdy (Reference 19.62), E's consequence calculations appear to be similar in terms of the delay time in evacuat-
! ing ard the evacuation speed. Table 19.8-1 showc these times. E's l release height of 37 meters is reasonable for severe accident calcula-i tions because of the structure of the ABWR and that the likely failure locaticn in the head of the drywell. 'Ibe staff ocncitdes that while sme of the ingIts to E's calculations differ from the inputs to NRC's calculations, the differences in the results are small. 'Ibe differences are rot explicitly presented here, but are reflected in the integrated risk estimates presented in section 19.9. Based en a review of E 's analysis and supplementary staff analysis, ard contingent upon satisfac-tory resolution of source term issues, the staff firds that E's ccnse-quence analysis would produce results that are in general agreement with the staff's calculations.
8.4 Croclusicos
- 1. 'Ibe staff believes that E's consequence calculatico method is reasonable aid is similar to the staff's methed.
/ 2. Qxttingent upcm satisfactory resolution of source term issues (see dienw: ion on Source Term Analysis in section
{ 19-152 p,,n p,g ,,g
F-l Draft Predicisional
' l, l
'Inble 19.8-1 02nparison of GE's, Staff's, and the NURM-1150 delay times and evacuation speals.
Delay Evacuation 11E0 SW GE (ABWR) 1.5 4.47 Staff (ADWR) 2. 3*' 1.1** 1.5b 4,47b NURB3-1150 Grand Gulf 1.25 3.7 Peach Bottom 1.5 4.8 Surrf 2.0 1.8 ; Sequoyah 2.3 1.8 j Zion 2.3 1.1 ] i
}.
I
- a. Value used for high population site, i.e. Zion plant.
- b. Value usal for low pcpulation site, i.e. Salem plant.
19-154 Draft Predecisional
.V ;,; .
,J.
s
' Draft Predicisional'.
s' 19.7), the staff believes that GE's. consequence mthods ard
- a- W iens would produce results that are in general agreemnt with the staff's calculations.
,' 3. GE's consequerce calculations are dcne for an' average site.
'Ihe staff presented results' for high.ard low population
.L.. sites ard also averaged the results. Both p.v-Mares prMm similar results for the given source terus.
i
- 4. EFRI's AIRR requirements hm=nt (Refennoe 19.2) specifies a site which is characterized as at the high end' of the site severity range for population density and -distritxition.'
GE's consequence' calculations do not satisfy to the EPRI ' requirements (Reference 19.2). ni o, a
.I l
, It t' I, V l l: i 1 19-153 ,,,,, ,,, ,,,,,,n,t. j l 1
- f. i 1
4
* - - - +
[' . Draft Predicisienat 19.9 IITIIIEATED RISK ESTIMATE 9.1 Introduction Risk inta3 ration is the final stage of calculating risk. Here, the frequency of the varicus accident scquerces ard the consequences aru L L integrated to give the risk Itsults. 9.2 M3thods Discussion 9.2.1 E Analysis since GE calculated point estim tes, the risk was off M by simply multiplyirg the point estimtes for the source term group frequency aM consequences. 'Ibe staff presumes that GE considers this a best estimate of risk, thotgh there is no mntion of this in GE's documentation. 9.2.2 Staff Review Uncertainties in the risk estim tes were not considered by GE.
'Ibe staff considered them separately. Based on other studies, such as NUR1Te 1150 (Ref 19.62), twenty parameters were selected accordirg to what was thought to be the parametezs having the
*j highest impact on risk; eleven of the parareters were from the Invel 1 analysis ard the remainirg nine parameters were from the I.evel 2 and 3 analyses. . Distributions were assigned to these paramters, scne (such as direct containment heating) frun other sttrlies, and others using the staff's judgments. 'Ihese distributions ard others fran source term were sampled, again with the Latin Hypercube Samplirg (IIG) process (Reference 19.67) cne hundred times, to yield fIrquencies and consequences. Each accident frequency ard consequence value multiplied together yields a risk estimte, ard an estimte of the risk distribution.
9.3 Arment of Mathcds GE calculated a point estim te of risk without an estim te of u 6.1nty. 'Ihough not explicitly called a best'estimte in the SSAR (Refererce 19.9), GE suggests that its estimate is a best estimate (page 65 of Referunoe 19.70), which does not have a statistical defini-tion. 'Ihe staff's review indicates the urcertainty to be at least an order of magnitude ard often times greater; therefore, the use of a 1 point estim te without an associated measure of uncertainty is mislead-irg. In the staff's applicaticm of the concept of uncertainty, the staff used the UE process (Reference 19.67) to propagate the uncertainty in selec-ted inputs of the staff's risk analysis through the varicus mathematical functions to generate an uncertainty distribution in the output, i.e. risk estin te.
'Ibe staff firds that there are numerous reasonable sets 19-155 ,,,,,p, g , g
y,r " N ' 1 s , > 1 Vs' *
,c . . y l: , , 9; ;
-s Vl Draft Predicisionet' l6l l of inputs, each having a degree of credibility. 'Dtts nakes ~ it presunpt .
ucus. to. consider any one set of inputs, ard hence, . output as "best". Therefore, it is pae==wy to characterize the risk results in terns of-uncertainty.
~ ,
g ,
- 9.4 ~ Presentation and Di= m aion of the Risk Results
'Ihe risk results are presented in Tables 19.9-1 through 19.9-6 and Figures 19.9-l'and 19.9-2. Both E's and the staff's risk results are - -
arranged under the NRC Quantitative Health Objectives in Reference . L 19.80, 'NRC AIHR Requirements in Reference 19.4, the EPRI AUGR 4 Requirinnents in Reference '19.2, and GE nnala. 'Ihe EPRI AUGt Requirements goal and the GE goal do not ocnstitute part of the. staff's. 4 evaluation; risk estimates:are ocupared'to these goals only for
,- information purposes.
- ~ .
'Ib understand the results, several points should be considered:
y o Desian. Since E 's original submittal, the design was modified so.
/ ~
that the ultimate mLayth of the containment is 134lpsig and the: lower drywell is rapnaad of a hamaltic ocncrete -(Reference
', 19.75). . GE's results are for the unmodified design of the AIMR, .
where the' ultimate L=gd1 of the containnent is.100 psig and the , 1 .
' lower drywell is rapnamd of a limestone oczicrete. 'Ihe staff's .
analysis takes the GE design modifications into account.. An adiitional feature, the containment Overpt=aume ProtecticmD System (OPS), is also now a part.of the ABWR design, but'only a limited assessment of the effect of this modification has been ' made due to its late addition to the design.1 Specifically, no , credit' for the system has been taken in the staff or GE analyses '" of internal events, with the exception of analyses
- ted iny Tables-19.5-2'and 19.9-6.'. However, credit for the OPS was taken ,
in the staff's seismic analysis, since the OPS Was part 'of.the' system at the time that the review was. performed.- Accountim. GE's analysis armwits for theTfirewater addition o j{ system in the Inval 2' analysis only..whereas the staff's analysis accounts for this systen in both the Inval 1 and the Inval:2 ' ~'
, analyses. As, d4 an2==ad in Sectim 19.6.4.1, the armniting can . .
affect the results through the various inplied assumptions that: : ;" arise. In the seismic events analysis GE used a seismic hazard curve developed as the bcunding mrve s,ame of the nuclear power ' - plant sites east of the Rockies whereas,the staff'used three ' sites - (i.e., Pilgrim, Seabrook, and Watts Bar) having the highest ..
~
ami==ic hazard in the eastern and central United States with two ' nazard ourves (LINL and' EPRI); this is ai=m==ad 'in'Section - P .6.4.1. 7[ o' Arithmetic and Incic Errors. As part of the staff's review of-GE's analysis, a number of arithmetic ard logic errors were 19-156 ,,,n , , g d. r
.L/
_f ! . i_________'__.i_. _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ . . . _ _ _ _ _ . _ _ _ _ _ _ . _ _ _ _ . . . . _ _ _ i + sto,. , i ,_ _.
q o Draft Predicisional identified. These errors were corrected in the staff's analysis, but not in the GE point estimte values ruported in Table 19.9-1. o D3finition of containny?nt failuru. 7%c definitions of containmnt failure were used. Accord 1rg to the first definition, failure occurs when the containment integrity can no larger be mintained as a pressure bourdary; this is known as the pressure boundary definition ard was defincd by both GE ard the staff to emw when the pressum load in the containment ew.mk the ultimte stmifd1 of the containment. The staff also cx:nsidered vent actuation relative to containmnt failuru. For prtper w-nt of ocotainment failure when ventirg.is a consideration, the staff looked to SECY-90-016 for guidance. In general, the goal is to mintain containment integrity, to the extent nracticable, during the initial 24 hours following the onset of core damge without the need to vent. Beyond the 24 hour i guideline, the containmrc should continue to provide a barrier JI against the uncontrolled release of fission products. The staff has viewed this guidarre as a design goal, but does not prtclude the consideration of venting dur1In the initial 24 hour period. The most important consideration is the view that ventiry is a controlled process ard does not constitute an urnulled release. For the overpressure protection system of the ABWR, a controlled release is established by two isolation valves located downstream of the rupture disk. . Once actuated, the operators can cloce these valves to terminate the release and remotely reopen the valves to ruostablish the release if containment conditions warrant such acticn. Howver, in the presentation of GE's results for internal and exterml events, and the staff's FFA results for internal events, the effects of controlled ventirg cm the conditional containment failure probacility (CCFP) is not specifically acMressed. We note l that ventiry in less than 24 hours should not be equated with containment failure. We interd to separate these issues in the FSAR. Until this change is made, the staff's results (for external events only, sirre this is the cnly place the OPS was { crrdited) will show containment failure whenever the overpressure
\ protection system is actuated within the first twenty four hours.
o Descriptions of distributions. The distributions of the risk results are described in terms of'their width and skewness. She width of the distributions are subjectively described as narrow (rarge of not more than two orders of magnitnSe), moderate (range of three to six orders of magnitude), and wide (rarge of seven or more orders of magnitude); it reflects the reproducibility of the results in terms of their sensitivity to inpIts ard assunptions. The mean (influenood by extrume values) ard the nodian (not influenced by extreme values) show the central terdencies of the 19--157 oreft predecisionat
fa ea r. t L r Draft Predicisional distributions ard together irriicate the r, aness of the distrib.Itions. o Uncertainty, me staff's estimtes of urcertainty for' risk acmunt for urrertainty in the level 1 (system reliability), Invel 2 (accident prugression as wdalled by the' CET ard sourm term), ard level 3 (consequences) analyses. .me. selection of variables ard distribution assignments serves as a first apprucimation to uncertainty. Miitional uncertajnty work was -
- t. done by the staff for seismic events; this is not directly reflected in the distributions. Be staff's analysis used the' LIRL hazard curves, whicti generally provide a much higher core damage frequency than either the E or the EPRI curves, while the latter two curves give rise to core +=r frequencies of about the same magnitude. However, the uncertainty ranges of the IINL curve are large and er-me the other two curves. In performing 1 the uncertainty analysis using the IRS method, the core damage '
frequency,.containmnt failuru probability, ard C W P were ranked separately. B us, these numbers for the given percentile are not , frm the same sanple, and, consequently, the CCFP is not ' generally equivalent to the ratio of the contairunent failure probability divided by the core damage frequency. o Seismic hazard. In regards to seismic events, the major 3 analytical difference between E ard the staff is in the seismic hazard curves (annual frequen:y of a-dig a specified peak ground acceleration). % e..-taff's analysis was based on three i sites having the highest sumic hazard in the Eastern and Central - U.S. (Pilgrim, Seabrook, ard Watts Bar), ard used two seismic hazard curves, one developed by lawrence Livermore National Iaboratory (IINL) ard the other develcped by the Electric Power Researth institute (EERI). E used a hazard curve developed as a boundim curve for many nuclear power plant sites east of the Rockies. i-
% e risk results. are presented in Tables 19.9-1 through 19.9-5.. In Table 19.9-1, the animic events are given for the Pilgrim site using the LINL hazard curve is provided for cxxrparison. Table 19.9-2 shows the results of the seismic events analyses.from other sites alcrg with the Pilgrim site. Figures 19.9-1 and 19.9-2 are plots of the risk.~
results for internal events'and seismic events. We risk estimates are interpreted in Table 19.9-5. In accordance with 4 Reference 19.80, the staff determined whether or not the NRC Quantita-tive Health Objectives and the NRC AIER Regairements goals were met by camparing its mean risk estimates to the goals. Mis approach was also used in determinirg whether or rot the EPRI AIRR Requiruments goals ard 4 the E definition of the CCFP were met. Table 19.9-5 also describes the L staff's uncertainty distributicms. ; h . 19-158 g,,,,p, g , w
Table 19.9-1 GE's Ibint Estimtes an1 the Staff's Mean Estimates of the Intermi ard Seismic Events Risk.** Interm1 Internal Events Seismic Events & Seismic Events Point Mean Point Mean Point Pean tmC Quantitative Health Estimte Estimate Estimate Estimate Estimte Estimte Safety Goals Goal G@ Staff *' G@ Staff' G@ Staff Iniividual risk of early < 5x10-7 2.5x10-u 1.6x1042 1.8x10'" 3.1x10# 1.8x10'" 3.1x10 fatality Irdividual risk of < 2x10 4 1.9x1042 4.5x10'" 1.5x1040 8.4x10* 1.5x10d 8.4x10 4 cancer fatality Prtbability of large < 1x10 4 - 7.4x104U - 3.2x10'# - 3.2x10'I release (one or more early fatalities)'- NRC AIHR Reaullunents Core damage frequency < 1x104 1.7x10~7 7.540'7 2.5x10 # 2.9x10'3 4.3x10 -7 2.9x10
-5 4 #
Prnbability of < 1x10 8.5x10 1.1x10'I 1.9x10'I 2.2x10-5 2.1x10'I 2.2x10'S contalment failure - Pressure W - definition-Conditimal containnent < 0.1 0.0@ 0.18 0.81 0.77 0.518 h 0.76 failure probability -' [0.12] [0.53] Pressure boundary definition
- a. Ventirg not taken into account.
- b. Urmodified design - 100 psig containnent failure pressure, limestone lower drywell.
- c. Modified design - 134 psig containment failure pressure, basaltic lower drywell.
- d. ' Pilgrim site mly, based on LINL hazard curve, pIUvided for ocmparison.
- e. FtW goal, with final definition of "large" still under staff consideration.-
~
- g. ,
e Draft Predicisionet s
' Table'19.9-1 (contirued)'
f. g. See " Definition of contairunent failure" in pt@ text for definition. With the ovetyta protection systs, E clains a'value < 0.10.
- h. .
'Ihese rasbers are taken frtan 2 sutznittals and do not reflect staff correction of identified arithmetic ard logic errors. ' Corrected values are in paw,U eses.
t s
.19-160 -,,,,, pg g i,, ,g 4
f e l
. g-.
~
, y - -. = T , o
1
. g .
Draft Predictslonel Table 19.9-1 (continued)*- - Internal
? Internal Events Seismic Events & Seismic Events Point Mean Point Mean Point Mean Estimate Estimate- Estimate Estimate Estim te' Estimate EPRI AINR Reauirements Goal Gd Staff ** GE Staff
# GE Staff
-5 1.7x10# 7.5x10 # #
2.9x10-5 4.3x10#
~
Core damage frequency < 1x10 2.5x10 2.9x10-5
- Probability of a. < 1x10 4 5.0x10'" 8.9x10
-8 3.8x10 -a 1.6x10'5 3.9x10 -8 1.6x10'S containment failure -
- dose definition GE Goal Cbnditional contalrunent < 0.1 0.003" 0.15 0.15 0.58 0.09 0.53 failure r M iJity.-
dose definition
.a. - venting not taken into account.-
- b. Unnodified design - 100 peig contalment failure pressure, lin e lower drywell.-
- c. Modified design 134- psig contalment-failure pressure, haa:altic lower drywell.
19-161 oraftPre&itstonet l' , - .'c-
- ~
m - _ _ c---_ ' _ _______.__9E-i___ -.____-_1-- . _ _ - - _ _ _- '% - ' w
_ _ s . , . _
. r . . -
_"^
._.. - 1 ._ ,
'S_
Draft ProdicIstonet _ -i
- Table 19.9 (coratirmed) 'i
- d. Pilgrim site only,- based on LIRL hazard curve, provided for nuqurism.
- e. :Fivpuse 1 goal, with final definition of "large" still under staff consideration. - i;
- f. See "Definitial of cuitairunent failure" in ytecalirq text for definition.
With the empte protection systen, E claims a value < 0.10. -
- g. -
-- h. 'Ihese numbers are taken frua a sutzalttals ard do not reflect staff wuatclan of identified ~
arithnetic ard logic errors. cvua, tai values are in patanum. f e i-162- - oreft predecisionet
~ '
, , 7
, m -- . ~ , - , y, m .,- ," , 5s- se p
eu Draft Predicisionet Table 19.9 Staff Point Estirate of Risk frtra Seismic Events NRC Quantitative Health LUIL Hazard Q1rve EMI Hazard e m e Safety Coais Goal Pilcrim Seabtrol Watts Bar Pilcrim Seabruck Watts av In11vidual risk of early < 5x10'7 1.4x10'" 7.4x10-12 1.2x10'" 4.2x10'" 2.9x10-0 1.7x10 -u fatality 4 # Inlividual risk of < 2x10 9.2x10 4.9x10 8.1x10 2.7x10'" L 9x10'" 1.1x10'" cancer fatality Prdylbility of large < 1x10 1.5x10# 8.3x10'" 1.4x104 4.6x10'" 3.2x10'" 1.9x10'" release (one or more early fatalities)' hPC ALER Prvrairements Cbre dam,ge frequency < 1x104 7.3x10 4 3.9x10-5 6.5x10 1.9x104 1.4x104 8.3x10'I Prtbability of < 1x104 5.7x10'5 3.1x10-5 S.0x10'5 1.5x10-6 1.1x10 4 6.5x10-7 contairrient failure - pressure boundary definition Corxlitional containmnt < 0.1 0.78 0.78 0.78 0.78 0.78 0.78 failure prrbability - Pressure bcmdary definition *-
- a. Ventirg not taken into accxxtnt.
- b. Fu.M goal, with final definitico of "large" still under staff consideration.
- c. See "_D_efinition of containmnt failure" in precalirg text for definition.
19-163 oreft Predectstonet
a , , . , c - n g =, , .-7,
.=n
;c
- ~ s . -
_ .s;
~ -
--+
Draf t Predicialenet Table!19.9-2. (continued)*- - URL Hazard QIrve EPRI Hazarti Qarve DRI AINR Reaulta-as . .., Goal . Pilarim Seabrbok ~ Watts Bar Pilarim Seatng); Watts Bar- _ i- Core amuge frequency < 1x10' 7.3x10-5 3.9x10 -5 6.5x10 -5 1.9x10 4 1.4x10* 8.3x10
# ~'
Omtairunent failure. 4 ( 1x10 4.4x10'3 2.4x10 -5 3.:nt10-5 1.1x104 8.4x10'# 5.0x10 # probability.- dose ' definition G' Goal Cunditional contaltunent < 0.1 0.60 0.59 0.60 0.60 0.60 0.60 failure prnhabilit dose definition ' y -
.a. Ventirg not taken into account. '- i
- b. See ." Definition of contairunent failure" in an.ecexling text for definition. -
L
$19-164 oraft Predeetatenet
.E a , _
.}
g
. %. ~,......_.....,~.e.
, - - . , , ,. ,e -w-- , = Ak r - +- + * <= -
~
* - " ~~
- - - 4
. .e .
Draft Predictsionet - Table 19.9-3 Staff Estimates of ~Unoertainty in the Risk Measures for Internal Events
- 'NRC Qtantitative Health:
-Safety Goals Goal- 95th 50th Mean -Sth Inlividual risk of early < 5x10'7 1.0x10'" 4.2x10 1.6x10* 1.7x10*
fatality 4 3.2x10* Individual risk of < 2x10 3.0x10* 1.0x10'" 4.5x10'" cancer fatality
, Probability'of large .< 1x104 5.3x104 4.9x10'" 7.4x10* 3.4x10*
release (one or more - early fatalities)' NRC ALHR Reauirenents
- Core danege frequency < 1x10 4
2.5x104 5.7x10'I 7.5x10'I 3.4x10'7 Probability of .. < 1x10 4.0x10'I' 6.4x10
-8 1.1x10'7 3.9x10 -s containment failure -
Pressure bmndary definition cbnditional contairunent '< 0.1-' O.70 0.11. 0.18 0.05 y failure probability - Pressure bmndary definition ** -
- a. ~ venting not taken into account. - .
'. b. - Fwpcesi goal, with-finalidefinition of "large"!still under staff consideraticn..
- c. :See " Definition of containment failure" in sees 11ng text for definition.
.19'-165- orafe Predecisionet .
-, i
-% . 7 s _.. . _
-=m------------ : ,
v.--a 1
.a Draft Predicisionet
+-
Table 19.9-3 (continued)' EMI ALWR Reauliam: d.s Goal 95th -50th Mean 5th
< 1x10-5 2.5x10' 7.5x10~7 Cbre damage.fr w f 5.7x10'# 3.4x10'I Probability of < 1x10 3.4x10'# 5.2x10~8 8.9x10-8 3.1x10-a contalment failure -
, dose definition
. E Goal Cbnditional contalment < 0.011 0.56 0.09 0.15 0.04 failure prrbabilit dose definition ~' y - .
- a. , Venting not taken into. account.
- b. - See " Definition of contalment failure" in .,tecaling n text for definition.
19-166:
. prett PredecI:Ionet-
-a
..e-- r ':"
- t Draft Predicisionel Table 19.9-4 Staff Estimates of the Uncertainty in the Risk Measures for Seismic Events, for the Pilgrim Site, using the IINL Hazard C11rve.**
, NRC Quantitative Health Safety Goals Goal 95th 50th Mean 5th Individual risk of early < 5x10'# 2.3x10-8 4.0x10'" 3.1x10# 5.1x10*
fatality ~
. Irrlividual risk of < 2x10 5.5x10-8 3.7x10* 8.4x104 1.1x10 42 cancer fatality Prtbability of.large < 1x10 4 2.6x10 3.6x104 3.2x10'7 1.4x10*
release (one or more early fatalities)' NRC AIRR Reculmutui Core damage frequency <'1x104 1.7x104 2.5x104 2.9x104 1.0x10-8 Prtbability of- < 1x104 1.tx10 4 1.9x104 2.2x104 6.5x10 4~ containnent failure -
~ Pressure boundary definition' Cbnditional containnent <0.1 0.89 0.77 0.77 0.65 fa11ure probability -
_ pressure boundary definition *'
- a. Venting not taken into account...
b. PtwO6(:d goal,'.with final definition of ."large" still under staff consideration.
- c. See " Definition of contairunent failure" in preacding text for definition.
19-167 oreft Predecisionat. _ _ _ . _ _ _ . _ _ _ ___ _. . _._ -- *. 2 - , . , , - , - , , .-- , ,-. -, , ~ - .
, . . s
-s _
~
,1
~
, 5 Draf t Pred!cisionet a
t
- 'Ibble 19.9-4 (contimed)**
EFRI AINR ReculImarits Goal 95th 50th Mean 5th Cbre dcmuge frequency < 1x10 -5 1.7x104 2.5x104 2.9x10 -5 1.0x10 -s Prtbability of . < 1x10 4 8.6x10'5 1.3x104 1.6x10-5 5.3x10 containment failure -
~ dose definition 2 Goal Cbnditional contalmerit < 0.1 0.75 0.58 0.58 0.36 failure probabilit dose definition ' y -
N
- a. Ventirq r A. taken into account.
- b. See " Definition of contabnent failure" in g@ text for definition.
. 19-168 -
oraft Predectstonet
. ?
k se g_- 7 $- WWW7
- 1 Y 9 M#Y' 'T* T T gg "
Y W 'T* '7 'E y TT? h 1w"'b- P 9IA' ="~-r
t ,. %
~
Yb
+
- , [ ^
Drsft Fredleid onal F J NRC Ouant. Health Objectives. NRC ALWR Requirements
, 4 1.0E-03g 1.0 -
1.0 E-04 j
- 1.0E-05 i 1.0 E-06 l
*
- 0.8 - l g
1.0E-07 h e.m{*m e ,_ . 1.0E-08 i .. 0 0.6 -- 1.0 E-09 I s. Internal 1.0 E-10 j e- --m Events 1.os.1, j __ 7v ,,, _ 1.0 E- 12 ja ;
$m 1.0 E- 13 i 1.0 E- 14 l ,, 0.3 -. a..
1.0 E- 15 'g NOTE b i.0E.1s j 7 , Estimates 1.0 E- 17 0.0 >t suolect to assumptions , e00ut 1 - 2 - 3 4 - 5 6 , or yweil/ --- -- - we t well bypass 1.0 E-03 p 1.0 -
& pecestal {
inte gr i t y. 1.0 E-04 j ,], ' 1.0 E-05 i m z;m
- 0.3 1.0 E-06 f,*,..p - so m 1.0 E-07 y ,_
1.0 E 08 f,{ e.- . .m 0.6 -
.h 1.0 E- 09 g'
-m 1.0 E 10 i
- Seismic 3.o ,_,, ; vm Events 1.0E.12 i .- '
1.0E-13 h 1.0E-14 j ..
~
0.2 -
'1.0E-16 I "
1.0E-16 s l
'1.0E-17 0.0 a KEY.
1.~ Individual risk of early f atality. . c. CCFP - pressure boundar y definition,
- 2. Individual risk of early totality.
- 3. Probabilit of one or more ' #* #* *""'*'
eersy f atalities - a proposed goal. e mean (overage). . t 4 Core damage treguency (compared ma medlen. le NRC goal). +
- goal.
- 5. Probability of containment f ailure - O .OE's asumste (unmodlHed design).
3 pressure boundar y definition NOTEi Thie fleure continued as Figure 19.9 2. Figure 19.9 1, Plot Of- internal and seismic' events. risk results .(NRC... . . ,* . (Ttiantitati'veHealth' Object'ivIs'andNRCALWRRequirements). 19-169' craft predecisionet i-'
=
y , \; p.[, - < - Dreft.Prodlcisionat . F ,
. E PRI ALWR ,
Reautrements GE Goal 'i 1.0E-03g 1.0 - j 1.0E-04 i ? 1.0E-06 g .-
- 1.0E-06 j e m a 0.8 -
}; ~] 1.0E-07 j efm 1.0E-08 j internal 1.0 E-Os j o
** ~
Events 1.0E-io ; y, 1.0 E- 11 j 0.4 - l 1.0 E- 12 g 1.0 E- 13 l
~
1.0 E- 14 f 0.2 -
- j. 1.0 E- 16 p e-NOTED j- [m
[ ! Estimates i.0E-te 1.0 E- 17
~
0.0
^
s.Jbject to assumptions - aoout we l well /
-7 q8 d 9 .
l 0F y well DyDesS E'Dedestal 1.0E-03 I 1.0 - inte g r it y. "" 1.0 E 04 i --
.1.0 E -05 j II **'
1.0 E 06 j Fm 0.8 1.0 E- 07 { p
't.0E-08 g -- s.
Seismic i.0E-Os i - *-
- Events tee-10 i 1.0E-11 h 0.4 -
.1.0 E - 12 i --
1.0 E- 13 g -
~'
1.0 E- 14 [ O.2 1.0 E- 16 j 0 1.0 E- 18 j
~
1.0 E-17 0.0 KEY-N OT E: This figure continues from 9. CCFP - dose definition. 7
. Figure 19,9-1. T . 95 th'percentilec
- 7. Core damage f reQuency (compared .l. 5 t h percentile.
to E PRI goal), aa mean (average).
- 8. Probability of containment f ailure -
~
ma median, dose definition. ta goal. . 0 GE's utimate (unmodified design).
, Figure 19.9-2 Plot of' internal and seismic events risk"results'(EPRI ALWR Requirements).
19-170- ,,,,, ,,,,,y,,,,i
Draf t Predicisionet ' Table 19.9-5 Description of the Risk Results. NRC Quant tive Health Ob kctives State: rent Irrlividual risk 'Ibe mean estimate for interml events is one order of magnitude below the goal. of early below the goal. . 'Ihe mean estimte for 'Ihe width of the distributions is moderate fatality seismic events is below the goal. for internal events and wide for seismic
'Iherefore, the goal is met in both cases. events. Both distributions are skewed Goal: < 5x10# Both uncertainty distributions are well below the goal; for internal events, the towards the lower tail -(smaller values):
hence, the bulk of each distribution is upper bourri is five orders of mgnitude closer to the lower bound, far below the below the goal; for-seismic events, the goal. upper bourri of the uncertainty range is Irx11vidual risk 'Ibe mean estimate for interml events is uncertainty rarge is two orders of of cancnr below the goal. 'Ihe mean estimate for magnitude belcw the goal. 'Ihe width of fatality seismic events is bel m the goal, the internal events distributions is 4
'Iberefore, the goal is met in both cases. narrow and the width of the seismic events Goal: < 2x10 Both uncertainty distributions are well distribution is moderate. Both below the goal; for intermi events, the distributions are skewed towards the lowr upper bound of the uiax1Lxinty rarge is tail (smaller values); the bulk of each
-four orders of magnitude below the goal; distribution is far below the gora.
for seismic events, the upper bound of the Probability of 'Ihe mean' estimate for intermi events is 'Ihe width of the interm1 events large release below the goal. 'Ihe mean estimate for distribution is moderate anl the width of (one or more seismic events is below the goal. the seismic events distribution is wide. early 'Iherefore, the goal is met in both cases. Both distributions are skewed towards the fatalities)"- 'Ibe uncertainty _distributicn for interml lower tail (smaller values) . In the 4 events is well below the goal. 'Ihe seismic events distribution, the position Goal: < 1x10 uncertainty distribution for seismic- of the mean, median, and upper-tail events is inmediately below the goal; (skewness) relative to the goal suggests though the upper tail of the seismic that the bulk of the distrib.: tion is below events distribution is innediately above the goal with the upper tail-touching the the' goal, this tepu=sads a small fraction goal. of the distribution.
- a. Prtposai goal, with fim1 definition of "large" still under staff consideration.
19-171 eraft predecisionat
g Draft Predicisionet Ibble 19.9-5 (continued) NRC AUG Pea, Statement Cbre damige The nean estimte for internal events is internal events distribution is mrrow arri frequency below the goal. The mean estimate for the width of the seismic distribution 'is seismic events is below the goal. moderate. The median ani mean inlicate Goal: < 1x10" Therefore, the goal is met in both cases. that the interml events distribution is The uncertainty distribution for intermi symetrical while the seismic events events is well below the goal. The distribution is skewed towards the lo mr uncertainty distribution for seismic tail (smaller values) . In the seismic events is immcsilately below the goal; events distributim, the position of the though the upper tail of the seismic mean, median, ani upper tail (skewness) events distribution is imediately above relative to the goal su w ts that the the goal, this sepu=sents a small fracticn bulk of the distribution is below the goal of the distribution. The width of the with the upper tail touching the goal. Prrbability of For interml events, the mean is below the width of the seismic events distribution containment goal, saying that the goal is met. For
~
is moderate. The interml events failure - seismic events, the mean is above the distribution is symetrical. The seismic pressure goal, saylrg that the goal is not met. events distribution is skewed towards the boundary The interml events distribution is below definition lower tail (smaller values). In the the goal. ~1he seismic events distribution seismic events distribution, the median bridges the goal; the upper tail of the being imediately above the goal inlicates Goal: < 1x104 distribution is several orders of that about half of the distribution is magnitude above the goal. The width of above the goal and about half is below the the interml events distribution is narrow goal. stile the Cbn11tional The mean estimate for internal events is events distribution is wide arri the width containment above the goal. The mean estimate for of the seismic events distribution is I failure seismic events is above the goal. mrrow. The interml events distritution prtbability - Therefore, the goal is not met in both is skewed towards the lower tail (smaller pressure- cases. The uncertainty distribution for values) and the seismic events boundary interm1' events' bridges the goal with most distribution is symetrical. - In the definition of the distribution being above the goal; internal events distribution, the redian l enly the lower tail is below the goal.- beirg slightly above the goal suggests l Goal: < 0.1 The seismic events distribution is far that the bulk of the distribution is l above the goal. The width of the interml slightly above the goal. I 172 oreft Predecisionet "
~ -
m
Draft Predicitional Table 19.9-5 (continue:1) DRI AGH Reo Statement Core damge For interml events, the mean estimte is width of the seismic distribution is fryg below the goal, sayirry that the goal is noderate. h interml events distribu-met. For seismic events, the mean tion is symetrical and the seismic events Goal:< 1x104 estimate is above the goal, saying that distribution is skewed towards the lowr the goal is.not met. 'Ihe un rtainty tail (smiler values). In the seismic distribution for interml events is below events distribution,'the median being the goal. 'Ibe uncertainty distribution below the goal and the skewness suggest for seismic events bridges the goal; the that although the bulk of the distribution upper tail is one order of magnitude above is below the goal, a fair amount is above the goal- 'Ihe width of the interml the goal. events distribution is narrow arrl the Ocntainment For intermi events, the mean estimate is width of the seismic events distribution failure below the goal, saying that the goal is is moderate. 'Ihe interml events probability - met. For seismic events, the mean distribution is symetrical. 'Ibe seismic dose definition estimate is atme the goal, saying that events distribution is skewed towards the the goal is not met. 'Ibe tin _=2 Lxinty lower tail (smaller values) . In the Goal: < 1x10 4 distribution for interml events is below seismic everits distribution, the median the goal. h uncertainty distribution being imediately above the goal indicates for seismic events bridges the goal; the that about half of the distribution is upper tail is two order of magnitirle above above the goal and about half is below the the goal. 'Ihe width of the interm1 goal. events distribution is mrrow and the 19-173 oraft Predecisionst
- - ----- - - _~ --
t u ft Predletstonet Omd1tional The mean estimte for intermi events is The intermi events distribution is skestx1 contairrent above the goal. The rean estimate for tsards the lower tail- (smaller values) . failure seismic events is above the goal. The seismic events distribution is probability - Therefore, the goal is not met in both symmetrical. In the intermi events dose definition cases. The uncertainty distribution for distributien, the median beirg slightly internal events bridges the goal with most bels the goal irrlicates that about half Goal: < 0.1 of the distribution being above the goal; u. _ne distribution is belm the goal; but only the lomr tail is belw the goal. the mean above the goal and the skewness 7he seismic events distribution is far suggest a large anuunt of the distribution above the goal. The width of the internd above the goal. events distribution is wide and the width of the seismic distribution is moderate. l
~
19-174 Draft Pr e ist a l
Draft'Predicisional Table 19.9-6 shows the impact of the overpInssure protection system on the containment failure probability and the corriitional containment s failure probability. As previously stated, ventirg events have been g incitr$ed as a portion of the conditional containment failure I probability. *e intend to separate these 4== in the FSAR. Only the
, q dose defhtics) of containment failure '(i.e., probability of a dose of /
b rem at 1/2 mile frun the plant) was used in ccuputing the table. Table 19.9-6, tring 1.be dose definition of containment failure, the. In reduction in the contaimuit failure probability and the CUP due to the overpressure protection systan was insignificant for internal event and ' nore pronounced for seismic events. 1
~
p .a ebn. fj $# S w I 1 l
'I 1
l l l l i 19-175 l or.vt predecisional i i i - l
,;~_ Draft Predicisional Table 19.9-6 Staff Estimates of Containment Failure Probability ard Oxditional Cbntairment Failure Probability Showing the Effect of the Ovusessure Fivls:ction Systen. Intemal Events Seismic Events No No Measure -coal ventim ventim ventim ventim Containment < 1x10'5 8.0x10 -8 7.6x10 -a 4.4x10-5 3.2x10'5 failure (?RC) prt:bability - dxe definition < 1x10 4 (EmI) Corditional < 0.1 0.14 0.13 0.60 0.44 contairmient failure probability - dose definition k O '. g w w w +- _ --
p . Draft Predicisional In rregards to the lapact of the evacuation and site asamptions in the seismic events analysis, the staff calculated smn of the risk meatmrus again, with other values of these asstmptions. Evacuation assumption. . Currently, the staff's calculations arn done for an average site (averaged consequence results of the Salem and Zion sites) with 0 percent evacuatico. Additional calculations, based on an evacuation asstmpticn of 99.5 percent, were performed for the average site. Individual risk of early fatality for 0 percent evacuation is belw the goal (see Table 19.9-4); whereas for the 99.5 percent evacuation, this risk measure estimate decreased about two orders of magnitude further below the goal. Individual risk of career fatality is virtually unchanged for either evacuation a==ntion. 'Ibe distribution of the probability of one or more early fatalities is slightly overlapping the goal; by amehg 99.5 pe.muit evacuation, this risk measure estimate decreased by about one order of magnitude. Site assumption. Currently, the staff's calculations are done for an average site (averaged ecosequence results of the Salem ard Zion sites) with rc evacuation. Miltional calculations were done for a high consequence site,' the Zicn site, ard keeping the evacuation asmmption at 0 percent. Individual risk of early fatality is below the goal (See Table 19.9-4); by amming the high consequence site, this risk measure estimate doubled, but it is still below the goal. Again irdividual risk of canmr fatality is below the goal and remained urx: hanged. 'Ihe distribution of the probability of one or more early fatalities is touching the goal; by assuming the high consequence site, this risk measure estimate dcubles, int this is still of no concern. In regards to the CCFP, a careful examination must be unde of the factors going into its estimation. 'Ihe CTP is defined as follows: 19-177 ,,,, , p,g , , g
s Draft Predicisional 11 f, P,i vbere CCTP : f requency veinled C C ,e P . i i Condillonal C0h ;ainm ent f ailure probability. If 1 F: Core damage Irequency. P: C Onditional containm ent f ailure probability. I: Containment f ailure 2000. I: accident class.
'Ihe current low value of OCFP was achieved by eliminatirn, throtgh the design of the ADRR, thrt.ats to the containent, such as hydrogen ccznbustion, core debris directly contacting the shell (known as liner meltthrough), and Met failure. 'Ibe ruainirg threats, such as rapid pressurization frun direct containnent heating and fuel / coolant interaction, are largely inherent to pressure-suppression type containments. Cbnsiderirg those sequences that still occur but do WJt cause a failure of the containment, the reducticrts in the CEFP approach a limit, defined by those sequences that cannot be addressed through design. It is apparent that the CCFP W- an increasirgly diffiallt L Incasure to interpret as the core damage frequency boccanes small.
g 9.5 Conclusions
- 1. 'Ibe staff concludes that the NRC's quantitative health Aum#4 safety goals for the individual risk of early fatality and iniividual risk of cancer fatality along with the goal of 4 1X10 4
/yr for the probability of one or more early fatalities can be met for both internal arri seismic events.
'Ibe staff further believes that these conclusions would still apply even if the containment throats MmW in Sections 19.6.4.2.1, 19.6.4.2.3, and 19.6.4.2.4, and Conclusions 1. (b) and 1. (c) of Section 19.6 were found to be i significant prirarily because of the very low core damage frequencies predicted by GE and the staff. Table 19.9-5 has an interpretation of the uncertainty that was calculated in these risk measures.
- 2. 'Ibe staff concludes 4
that for internal events, the NRC AINR goals of 4 1x10 for the mean core damage frtquency and 1.0x10 /yr for the ocntainment failure probability (pressure boundary definition) can be met. 'Ihe staff believes that for seismic events, the mean core damage frequency is met while the containment failure probability (pressure bcundary definition) goals is not met. 'Ibe mean Draft Predecisional
y ,-
&-)
L;. Draft Predicisional. conditlanal containment failure criterion of 0.1 imuld ret = be met for either internal events or seismic events-(see Section 19.6.5, Conclusion 1.(a)). Table 19.9-5 has an. Interpretation of the uncertainty that was ea_1mlated;in these risk measures.
- 3. 'Jhe staff concludes that for internal events, the EPRI goals of 1x10' /yr for the core +=ya freqJency and'1x10*/yr for the cantainment failure probability (dose definition). can be met. 'Ibe staff believes that for seismic events, the goals. .
are rot met. 'Ibe CCFP of 0.10 is not met. . Table 19.9-5 has an interpretation of the uncertainty that was calculated in these risk measures.
- 4. '1he staff believes that the CCFP goal ($ 0.10) in SECY90-016 (Referarce 19.4), u Load as a measure of the plant's defense-in-depth, sculd very likely rot be met given the unce. W es associated with estimating the goal (see Section 19.9.4). ..
hY$ M , J I q j j l I l Draft Predecisional
r: , <
- t. :
p , .. Draft Predicisional 19.10 OPEN ITENS ,
"Open items" in the review of the m A can be divided into'four' categories: amfirmatory itens, staff correcticris, deficiencies, and interface requirements.
"Cbnfirmatory itans" are defined as areas where the staff does not rwwmarily disagree with GE's submittal, but additional ~
clarificaticn or deisicrokatico is required.
" Staff corrections" are defined as areas where the staff does not agree with a specific numerical value or calculation in GE's subnittal, and has substituted its own value or analysis to investigate the sensitivity of the results to.this value or calculation.
" Outstanding items" are defined as items where the staff (a) disagrees with the subnittal, (b) requires additional supportirxJ documentation, and/or (c) has not yet coupleted its review and evaluation.
" Interface requhowd.s" are defined as areas which must be confi* for a specific application for a u.n=huction permit.'
'Ibe open items found in this review are sumarized in Tables 19.10-1 thrtnJh 19.10-4.
l 8 l l r l. L Draf t Predecisional l 1 ..
e Draft Fredita* % ~' Table 19.10-1 Confinnatory Itats Cbnfirmiary items are defimd as areas where the staff does rot merwrily disagriae with E's subnittal, but additioral clarification or datawLcatiori is required.
- 1. 'Ibe PPA hwultatico exhibits inconsistency with respect to its functionality for the IORV event, in that the event trees are correct, but the amanyiry text is anbiguous. (See dimmion in Section 19.3.3, "Su m Criteria", page 19-23.)
- 2. Aliiticral investigation is currently underway to detennine the logical minimmu injection f:.!N to the vessel needed to avoid core damage follovirg a vessel isolation event coupled with fai_ lure to scram ard failuru to provide poison injection. Preliminary calculations indicate that a flow rate of 800 gpn frun a HPCF train alone may rot be sufficient to keep the water level above the top of the active fuel for the above scenario. Meanwhile, the staff has used E 's success criteria for the HSIV closure event in its requantification of the A' INS-induced sequence frequencies. However, if the final thermal-hydraulic calculations derewLcate a need for two or more trains of the high pInssure injection systems (that is, more than an 800 gpn flow rate) to avoid core damge for the above scenario, then the overall ABWR core damage frequency and risk could increase significantly. (See dimmion under Section 19.3.3, " Success Criteria," page 19-24.)
- 3. E should provide duumentation on the justification regarding the applicability of certain generic ocrm:21 cause/ node failure data to ADWR design-specific cmponents (the diesel generators, the HFCF pumps, the IICF punps, and the RHR heat exdiangers) involved in the system unavailability modelirg. (See dimmion urder Section 19.3.6.1,
" Hardware Reliability Ihta Analysis," page 19-27.)
- 4. E runld provide justification regarding the applicability of ESSAR II design informtion to the ABWR design (on a train basis) for use in test ard maintenance data analysis. (See dimmion under Section 19.3.6.2,
"'Ibst and Maintanaroe Data Analysis," page 19-28.)
- 5. 'Ibe staff has corcluded that E has developed a reasonable plan to use information and insights gainod frm the HRA to 94 port the '
systenVcpurational design. 'Ihe acceptability of ar.y insights realized frun the HRA however, must await further design development. (See Section 19.3.7.2.12, page 19-36) .
- 6. E rJiould provide the calculations it perfonned to chow suppression pool flashiry followirg venting does not lead to significant fission product releases. (Sce Scction 19.7.4.3, page 19-140) 19-181 37,,, ,,,3,ci,,,n,g
o e Draf t Predicisional Table 19,10-2 Staff Corrections Staff corrections are defined as aruas where the staff does not agree with a specific ntunerical value or calculation in E's subnittal, and has substituted its own value or analysis to investigate the sensitivity of the results to this value or calculation.
- 1. E has provided neither highlights of the ADWR design imprcrvements in the balance of plant (IDP) systems nor applicable references to such B3P improvemtnts in the AWR PRA to support the estimate of mly one reactor trip per year, which is lower than current experience in the U.S. Due to lack of design details at this stage, the staff has used crie event per year for the loss of feedwater frequency and one event per year for the MSIV closure event frequemy in its review of the ABWR PRA. Unless E can provide more justification, the staff finds its own estimates, rather than E 's, to be aps vr iata at this design stage. (See Paragraph 2 of Secticn 19.3.2, "Initiatirs Event Frequency," page 19-21.)
- 2. E's estimate for the inadvertent open relief valve (IORV) frequency is about 0.01 per reactor-year. The staff notes that this estimate is substantially lower than the value (0.07 per reactor-year) used for the Iherick plant (Reference 19.23) . E has not provided detailed hentation regarding any design inprovements made to the multi-stage relief valves to be installed in the future to support this lower unreliability value. In the absence of evidence to the contrary, the staff has used a higher value (0.1) for the IORV event for its irdependent exent. (See Paragraph 3 of Section 19.3.2, "Initiatirq Event Prequency," page 19-22.)
- 3. She staff does not agree with the treat 2nent of Class II sequences in the A WR PRA. More than 86 percert of the Class II sequences are typc (i) events, which have already enployed fire water as the only available means of low pressure coru cooling. For these Class II events, therefore, it is considered wrong to give credit to fire water cooe again following loss of core ocoling in the seismic containment event tree. (See Section 19.4.3.1.3, Page 19-55, Sectico 19.4.3.5, page 19-69, ard Secticm 19.4.3.6.1, page 19-71.)
- 4. The staff noted that E did not explicitly analyze contairstent venting in the ABWR FPA. When giving credit to containment ventirg, the staff value for unan annual frequency for Class II events was rrvhrvvi by an order of nagnitude to 5.7 E-07 as cortparud to the ABWR PRA value of 4.8 E-06. (See Section 19.4.3.6.1, page 19-70.)
- 5. The seismic capacity of the fuel assemblies was calculated by E as conuspciding to a center deflection of 55 ntn, at which scram can be achieved. Ilowever, the acinent conuspuliry to this deflection is not the collapse rcment as used in the calculations. It is scme value between the yield ranent ard the collapse scicut. Therefore the median 19-182 ,,,n ,, g g g
Draft Predicislotul ultimte capacity of the fuel asscrblies is less than the nedian value of 1.39 In a sensitivity study, the staff has used a value of 0.92g uniian capacity to estimte the accident sequence fztquemies. (See Section 19.4.3.3.2, page 19-60. )
- 6. Although the AIER PRA report states that the mnrMan capacity of large, flat-bottm storage tanks is 2.lg with B of 0.45, the only tank used in the seismic systs analysis is the fire w,ater tank, with a generic assigned median capacity of 2.8g and a B, of 0.45. 21s makes the IICLPF capacity equal to 0.98g. Experience witn design ard actual performnce of these large yard tanks is that this high capacity is not generally achieved. 2crefore, use of a median value of 1.43g with a liCLPF capacity of 0.50g was made in a sensitivity analysis. (See Section 19.4.3.3.2, page 19-62.)
- 7. GE has assigned a median capacity of 2.5g with a B, of 0.45 to the diesel generators. 'Ihis means that the IICIPF capacity is about 0.88g.
Although diesel generators by themselves have high seismic capacities, the peripheral equipnent required for the diesel generators to operate can have low capacities. 2 crufore, the staff concludes that the diesel generator fragility is rather optimistic. In a later sensitivity study, the staff has assigned a nudi Icwer capacity (nwHan of 1.5g and HCIPF of 0.47 9) to diesel generators in acknowledgement of Icwer capacity ccrnpcnents in the systs. (See Section 19.4.3.3.2, page 19-62.)
- 8. %e seismic capacities assigned to active electrical equipnent in the structural failuru urde are generally higher than the specific capacities calculated in previous seismic PRAs. For example, the 11CLPF capacities of retor control centers, relay switches, ard battery and battery racks appear to be too high. (See Section 19.4.3.3.2, page 19-63.)
- 9. 2c staff has initially incitded within the containment failure category those events where the overpressure protection systs' actuates within 24 hours. In the final SER, we intend to separate the venting issues, since we do not autcutically view ventirg prior to 24 hours as containment failure. Eis will affect the final values of conditional containment failure probability. (See Section 19.9.4, page 19-157.)
- 10. IML seismic hazard curve will be used in the seismic analysis. Se staff's analysis used the IML hazard curve, which generally provide a nuch higher core damage frequency than either the GE or the EPRI curves, while the latter two curves give rise to core danage frequencies of about the same ragnitude, liowever, the uncertainty ranges of the IML curve are large and encompass.the other two curves. (See Section 19.6.4.1, page 19-105, and Section 19.9.4 page 19-158.)
- 11. Crudit was taken for the firewater systs in both the Invel 1 ard the IcVel 2 portions of the PRA, instead of just in the IcVel 2 analysis as did GE. me staff took credit for preventing core danage with the firewater additical system in IcVel 1. If core danage oce (IcVel 2),
19-183 ,,,,, p,,3,,,,,,,,g
i e Draft Predicisional then the firewater system oculd not have been available to prevent core damage, hence, it unlikely to be available to arrest a mre mit in the ; reactor vessel. However, later in the accident progression, the staff tcd. crudit for arresting an ex-vessel core mit progression becaum < there is nere time available to restore the firewater system than for the in-vessel situation. (See Section 19.6.4.1, page 19-106.)
- 12. A7WS will be treated as a late containment failure or :so contairment failure, instead of as an early containment failure (internal events) and late containment failure (seismic events). E 's treatment was apparently done because the frequency of the class IV accidents is small, less than 2 percent in E's internal events a.nlysis. Thus, they were conservatively grouped with other sequences winch resulted in the largest rulease of fission products (early containment failure).
However, since its frequerry in the seismic events was significantly higher, 60 pezoent, E perforimd a more thorough a"alysis, where ucst of the s.equences resulted in late containment failure. The staff estimated fraction of the A7WS seguences to be higher than E's estimate: the larger fraction warranted further study of the prograssion of these accidents, which showed assumptions differirn frup those of E in their l CET analysis, stemming differirs views of accident progressions. The I accountirg of the A7WS sequences has an effect on the results of the CET emlysis. (See Section 19.6.4.1, page 19-106.) 1 19-184 oreft predecisionat
~
)
e 1-I Draft Predicisiotal . Table 19.10-3 Outstaniig Items outstarxiing items aIn items where the staff (a) disagrees with the suhaittal, (b) regaires additional supportirn d&-ntation, and/or (c) has not yet completed its review ard evaluation.
- 1. E must justify the use of RPS reliability estimates for the Clinton facility in the ABRR Pl%. (See Paragraph 1 of Section 19.2.1, "ABWR Safety System Features," page 19-6.)
- 2. E nust evaluate the impact of the partial ard/or total failure of the support systems on plant trips as applicable, incluiing siMW deperdent failures of the mitigating systems needed to provide a vessel coolant makeup function ard/or containment heat renoval furction. (See Paragraph 4 of Section 19.3.2, " Initiating Event Frequemy," page 19-22.)
- 3. E must prtnride an accident amlyses of postulated interfacing IOca events as applicable to the ABWR design. (See Paragraph 7 of Section 19.3.2, "Initiatirg Event FItquency," page 19-23.)
- 4. GE nust provide results of accident analyses of IOCA events outside the containment (in particular, steam line breaks in the RCIC steam pipirg and the RWCU lines) in ocnbination with failure of the isolation valves.
(See Paragraph 8 of Section 19.3.2, " Initiating Event Frequency," page 19-23.)
- 5. GE nust provide justification to support its claim that the train-level rather than component level ccxmon node failure analysis captured the full contribution to cxamon mode failure probability. (See dimmion under Section 19.3.5, " System Modelirg," page 19-26.)
- 6. GE nust justify the use of reliability data for the unchanical failure probability of the RHR pump ard the failure probability of the HPCF pump (See discussion under Section 19.3.6.1, " Hardware Reliability Data .
Analysis," page 19-27.)
- 7. GE nust provide the HRA-related doctumntaticn used to evaluate the approach (es) taken to ucdel human action in the AIMR PRA. 'Ihe docunentation must ircitde the followirq for each human action modelled:
an appropriate task analysis, a description of how the appropriate HRA . analysis method (s) were impicmentcd, a dimmion of what performance nedels and performarce shaping factors were used, and how human actions were quantified (HEP determined). (See Section 19.3.7.2.1, page 19-31.)
- 8. GE nust describe how each identified HRA method is utilized to develop each individual HEP in the AIER PRA. (See Section 19.3.7.2.6, page 19-34.)
19-185 ,,,,,,, g , w
o Draft Predicisional
- 9. E must prtnide a cxxrise riimmion of the use of generic data sources for HEP estimation. In addition, E nast justify the use of these generic sourt:cs of human error data which are based upon sirple manual control tasks for the mnitorirg and supervisory wk.vl tasks of the A N R operator. (Soc Section 19.3.7.2.9, page 19-35.)
- 10. E nust provide the results of HEP uncertainty and/or sensitivity analyses performed in support of the ANR WA and provide the criteria that were used for performing such analyses. (See Section 19.3.7.2.11, page 19-36.)
- 11. E tust perform an uncertainty analysis to address the uncertainty in the relative contributions of the various initiatirg events to the total core damage freqmncy. (See Section 19.3.10.1, page 19-38.)
- 12. E nust perform a severe acx:ident fire analysis. (See Section 19.4.1, page 19-50.)
- 13. E nust factor the drywell-wetwell bypass jnto the CIb and prtnide an analysis of the bypass giving consideration to such matters as (1) the basis to support an allowed leakage area, (2) the basis to support an expected leakage area durirg the course of a severe accident when the vacuum breakers would be required to perform several tim in a severe environment, and (3) unocrtainty in the cypass leakage ficw rate. (See Section 19.6.4.2.1, page 19-113.)
- 14. E must justify the overpressure protection system and, given the system, the pressure relief setpoint, taking into account downside risks. E nust carry out the n-myy analysis of the effects of drywell/wetwell bypass before conclusions can be reached that the system has a net benefit fr m a risk perspective. (See Section 19.6.4.2.2, page 19-118.)
- 15. E nust perform an analysis of the risk reduction associated with the passive flooder system, taking'into acocunt factors such as (but not limited to) the possibility of it failing to quench core debris, the benefits of keeping the area in the icwer drywell above the core debris cool, and potential for fuel / coolant interacticris. 'Ibc analysis should consider whether to intItxhoe water into the lower drywell in a ccotrolled or uncontrolled manner, hcw fast to introducxe the water and when to introduce the water. (See Section 19.6.4.2.3, page 19-126 and Section 19.7.4.2.2, page 19-145.)
- 16. E nust address the threat to containment integrity frm a core /
concrete interaction in the event that core debris is rot gaenched by ' the overlyirg water pool. 'Ibe influerce en the source terms due to - cx:ntinued concrete attack should also be addressed (See Section 6.4.2.4, page 19-128 ard Section 19.7.4.2, page 19-145.)
- 17. E nust Edify the CIb to take into account the follcuing severe accident phencr:nna and severe accident features: DCH, fuel / coolant 19-186 , ,, g , ,g
t b Draft Predicisional interaction, continued core / concrete interaction, pool bypass, ard vamum breaker effects. E should perform uncertainty amlyses associated with these phenonena. (See Section 19.6.2.1, page 19-99, Section 19.6.2.2,' page 19-100, ard Secticn 19.6.3, page 19-103 ard Section 19.6.3, page 19-102.)
- 18. E m.ist include, as part of its overall analysis, a treat 2nent of uncertainty sirce lartje uncertainties are inherent in these calculations (See Sectico 19.6.2.1, page 19-99, Section 19.9.3, page 19-155, Section 19.7.2.1, page 19-133, Section 19.7.2.2, page 19-133, Section 19.7.4.2.2, page 19-141, and Section 19.9, page 19-178).
- 19. E nust provide an evaluation of the probability ard corraguences of containment penetration lines or containment isolation valves faildrrJ during a seismic event. (See Section 19.4.3.8.1, page 19-76.)
- 20. E nust provide a systematic ass-nt that identifies plant ard >
g m- M tre vulnerabilities when the plant is in
- other than full power. (See Secticn 19.3.4, page 19-24.)
- 21. E nust provide (1) a list of systens that were neled/ consider,ed in the ADWR FRA but are not part of the AIER certified design, (2) a description of any risk significant assuqtdons for therx3 systems, and (3) the amW reliabilities for the systems. (See Section 19.3.5, page 19-25.)
- 22. E nust provide infonnatico which describes (1) how PRA insights were used in the AURR design process, (2) what ABWR design features, if any, were included as a result of PRA insights to reduce risk significant sequerres ard phencunena, (3) how plant operating experience was factored into the AIER PRA, ard (4) how PBA insights were used to acktress severe accident phenottena. (See Secticn 19.11, page 19-190.) ,
19-187 craft Predecisionet'
4 Draft Predirisional Table 19.10-4 Interface Requirements Interface requirements are conditions which are specified for those portions of the plant for which E does not seek certification. 'Jhese requirumnts must be ackiressed by an individual applicant who references the ABWR design in an application for a cxxistruction pemit\cperatirq license to ensure that the site ard design otmpatible features satisfy the functional performance and safety requirements of ABWR systems.
- 1. Confirm the estimate of the loss of AC pcwer event, adiress site-specific parameterr., (as indicated in the staff's licensirg review basis document), such as specific causes (e.g., a severe storm) of the loss of pcuer, and their impact on recovery of AC power in a N1y fashion) .
(See Paragraph 5 of Section 19.3.2, "Initiatirg Event Prequency," page 19-22.)
- 2. Provide hmentation which describes the mterial ard/or analysis that were used to support the plant-specific HPA. 'Ihis should incitde the follcwing areas: detailed furction ard task analysis (utilizirg ABWR staffire goals and staffire stillosophy), procedure guidelines, control recra design, ard work station ard display design. (See Secticri 19.3.7.2.2, page 19-33.)
- 3. Provide documentaticri which describes in detail the human-system analyses used by the HRA team to support the plant-specific HPA/PRA.
'Ihis should include the follcuing areas: detailed task analyses-includirg task requiruments on the operatirg staff, their interfaces with plant systems ard components, and any time me,Laints for critical task acccuplishment. Also, E did not explain hcu these analyses supported the inclusion of human actions in the PRA event and fault trecs. Finally, E did not describe the use, if any, of a technique such as screenity analysis to help identify im;rrtant human actions.
(See Section 19.3.7.2.3, page 19-33.)
- 4. Provide documentaticx1, includiry the supporting task analysis, which describes the nodelling of human acticris related to the advanaad technology of the ABWR control ard instrunantation. -(See in Section 19.3.7.2.5, page 19-34.)
- 5. Provide documentation strich describes row performance shapirg factors (PSFt) were utilized to develop each irdividual HEP in the plant-specific PRA. (See Sectien 19.3.7.2.7, page 19-34.)
- 6. Provide adiiticml hentation on the advan d technology aspects of the ABWR pexson-machine interface, aid the human Iuliability analysis results, criteria, or guidelines that were used as the basis for autenating operator furx:tions so as to charge, if not practically eliminate, the cperator's role in system cperation ard response to potential abnormal events. (See Section 19.3.7.2.8, page 19-32.)
Draft Predecisional
a Draft Predicisional
- 7. Provide documentation which justifies the use of ESSAR II PRA human error probabilitie:s in the plant-specific ABWR PRA. (See Section 19.3.7.2.10, page 19-35.)
- 8. Perform a site-specific design verificaticri for the truly " external" events, such as extemal floods and transportation hazards, for which no I
amlyses can be perfonned at this stage. (See Section 19.4.1, Page 19-50.)
- 9. Perform a probabilistic risk amlysis for intemal floods. (See Section 19.4.1, Page 19-50. )
- 10. Confirm the assumed seismic capacities for camponents and structures for site specific applications and ircorporate the generic seismic fragility assumptions in the ABWR design specifications. (See Section 19.4.3.3.1, page 19-58, 61, and Section 19.4.3.3.3, pages 19-60 to 19-65.)
- 11. Perform an evaluaticr1 of the potential for seismic-induced soil failures, such as liquefactico, differential settlement, or slope stability for site specific applications. 'Ihe seismic IPA should be rodified accortiingly. (See Section 19.4.3.3.2, pages 19-59 and 19-64 to 19-61.)
- 12. Perform a valkdown of the fiml wiaucted plant. 'Ibe walkdown should include an a-a st of potential seismic vulnerabilities, such as marginal andlorage of equipment and gross deviations frm the design documents, ard spatial systems interactions, sudt as operators beirg dinabled due to the failure of the control suspended ceilirg in a sM eic event. (See Section 19.4.3.3.2, page 19-65.) 'Ihe walkdown abould also confirm that the ammui seismic capacities are et or exrw*v3 for site specific applications. (See Section 19.4.3.3.2, page ' 19-64. )
- 13. Develop deterministic and probabilistic site specific response spx.h a for all sites. Demonstrate that the seismic design response spectra for the plant envelope the deterministic site specific response spectra and the p W hilistic site spectra used in the ADWR PRA. If the site-specific deterministic or probabilistic response spectra exceed the spectra assumed in the ABWR PRA, perform a plant-specific seismic PRA to confinn that the dcmimnt sequences identified in the AIMR PRA have not been significantly alterud. (See Section 19.4.3.3.2, page 19-65.)
- 14. Confirm the seismic capacities assigned to active electrical equipnent such as motor control centers, relay switches, battery and battery racks in the site specific AEER PRA. (See Sectico 19.4.3.3.2, page 19-63.)
- 15. Demonstrate that the applicant has designed eadi system (i.e., systems modelod/ considered in the AUR PRA, but not part of the ABWR oertified design) to meet the system reliability requirements and risk significant assunptions provided by 2. (See Section 19.3.5, page 19-25.)
I 19-189 ,,,,, ,,,,,,g, ion,i j
Draft Predicisional 19.1 CDNCI.USICUS As was stated in the introduction, the review of a PRA is not governed by explicat forml criteria. The PRA ard its evaluation are used to assess, in a , realistic rather than cmservative nanner, the safety profile of the proposed design as expressed in terns of the frequercy of severe core damge accidents, the consequences of a spectrum of such accidents of varying severities, and the integrated risk to the p2blic, the uncertainty in these pirameters, and insights into the safety profile. In addition, a WA ard its evaluation can be used to help mke deterministic judgments of the safety of a propocod design. The staff's inview fn,wvi significant attention on the quality of the PRA rather than on insights developo-1 frun the FRA. The staff believes, howver, that knowlak Je of how PRA insights were employed in the ABE design urderscores the significanoe of design features which eliminate dcminant contributors to the estimted core damge frequency ard offsite conscquences, and facilitates a balarcirg of preventive ard mitigative design features. 7he staff therefore requires E to provide imVrmation which describes (1) how PRA insights were used in the ABE design pIncess, (2) 1. hat ABE design features, if any, were included as a result of PRA insights to reduce risk significant sequences and phencrnena, (3) how plant operatirq expericrce was factored into the ABE FRA, ard (4) how PRA insights were used to ailress severe accident ytencuena. This is an outstandirg item. The staff also believes that use of PRA insights my be teneficial in resolving open items which have been identified from the review of other SSAR chapters. Therefore, the staff expects E to enploy PRA insights, where feasible, to support issue resoluticn. The staff's review of the IcVel 1 aralysis of the core damage frequercy due to intermily generated events uncovetui a number of deficiencies (See section 19.10 above). Given the existence of these deficiercies, E's analysis has scrowhat urderestimated the core damge frequency. Moreover, the identification ard ordering of the ret of sequences which constitute the prircipal contributors to the core damge frrquercy are suspect, since support system failure initiators are missirg. It does appear, however, that the intermily-generated core damge frequency is quite low. In addition, the analysis did rot find any highly dcninant accident sequerce classes. The staff ruview of the level 1 aralysis of the core clunge frequency due to exterml events also uncovered a number of prtbles:n. Nbst notably, E has rct subnitted a probabilistic analysis of interm1 fire initiated accident sequences. Thus, there is no realistic (as opposed to bounding) analysis of internal fixus, ard no statements as to the relative inportarce of these sequences in the mkeup of the total core damage frequency can be made. It does appear, hcuever, that the ABG design possesses considerable seis:uc mugin at the 0.3g design insis carthquake level. The actual seismically-induced core damge fruquency will have to be calculatal for specific applications, since it is highly site deperdent. Draft Predecisional
- or.vt predicisionat
'Ihe staff's review of the Invel 2 ard 3 amlyses has indicated that nora effort by E ard the staff is needed before it can be concitded that the severn accident sequences for the AEMR plant have bocn sufficiently analyzed. 'Iberefore, the adequacy of the level of defense-in-depth provided for in the AIMR containment system design canrot be corrlusively juijcd at this time, based on the inforntion subnitted. Major iscues are: (a) the abscree of an turertainty analysis present an inacrplete picture of the accident prugression; (b) the limited size of the containment event trues; (c) system nodels have not been fully supported, such as the effects of water frm the flooder system on core / concrete interaction in regards to the pedecil integrity aru uncertain; (d) the assumptions in the analyses trnat accident progressiat events differently, i.e., coru/concreta interaction, thus causing differences in risk results and potential accident mamgement strategies.
Notwithstarding the issues descrilsed above, the following statements en be unde: (1) Acconiiry to E's analysis, the CCFp goal of $0.1 ktlich is intended to provide insights into a plant's level of defense-in-depth is met for internal events, whereas the staff's rough uncertainty calculation irdicates the mean value to be 0.13, the 95th percentile to be 0.70, ard the 5th pertentile to be 0.05. Notwithstanding a question as to whether the AEMR meets this specific goal, the staff's amlysis irdicates that inplications drawn based on this CCFP goal need to be carefully considerud. It is possible that a plant with a very low total core damage frequency nay not noet the 0.10 goal because low frequerry threats to the containment are difficult to rule out and could cause the CCFP to exceed the goal of 0.10. Sirce the AIMR plant's ooru ' damage fruquency is estimated by 2 ard us to be very low, the above considerations need to be addrermed, ecpecially when corclusions ruganliry the plant's level of defense-in-depth is beirg considend in light of this goal alone. (2) Based on the staff's limited scurve term amlysis, the staff believes that the AIUR design could have difficulty roetirg E's criterion of ro containment failuru (i.e., 25 rem at the bourriny) before 24 hours. (3) 'Ihe staff believes that mitigative systems such as the lower drywell passive ficoder system ard the containment overpressure protection systan shculd be designed to perfom their function with a reasomble anxxnt of confidence if they are to be considertd viable lines of defense. Specifically: o 'Ibe design of the passive flocchr system ard the lower dtywell should be such that degradation of the pedestal wall from a core /corcrete interaction ard pocsible damage frm an ex-vessel fuel / coolant interaction does not cmprunise the integrity of the wall ard, herce, pcco a threat to the containment. 19-191 ,,,,,,, g , g
,p , , -
a . , , , - L'b L r a - N .[ ' I
-f Draft'Predicisional' i
o 'Ihe CNeApus5dre PIUtection syStan,: which is designed to -
-provide for a controlled release of scrubbed fission.
products, should address the bypass flows frun the drywell " to the wetwell. airspace, includirs; the design of.the drywell/wetwell spray systan. (4) 'Jhe individual risk of early. fatality and i'tiividual risk of cancer fatality calculated for both internal and aalamic' events by GE and the staff were orders of magnitude below NRC's quantitativeL health safety goals. Since similar results for internal events were also found in NRC's NURBG-1150 study .(Reference.19.62) ~for. ' the BWR Peacti Bottaa and Grard Gulf plants, it would appear to . irxlicate that notwithstanding the inportance of meeting these goals, conformance with.these goals alone does not rwwmarily indicate an inprovement in risk for the ABNR design over that of' several generations past. i I. l' s t t l: l f- !. 1 19-192 ,,,,, p,,,,,,,,,n,g
. . . . ~ - . .
e Draft Predicisional 19.12 Rt.trxu1CES 19.1 Intter, 'Ihcmas E. Murley, NRC, to Richard Artiga, General Electric, "Advanood Boilirg Water Reactor Licensing Review Bases," dated Atqust 7, 1987. 19.2 Electric Ptuer Research Institute, " Advanced Light Water Reactor Requirments rW=nt," Palo Alto, California, December 1987. 19.3 U.S. Nuclear Regulatory m i m ion, " Resolution Process for Severu Accident Issues cri Evolutionary Light Water Reactors," chmimien Paper SECY-89-311, dated %215,1989. 19.4 U.S. Nuclear Regulatory rh mi m ion, " Evolutionary Light Water Reactor (IRR) Certification Issues and their Relationship to Current Regulatory Requirments," Nimion Paper SECY-90-Ol6, dated January 12, 1990. 19.5 General Electric, " Amendment 4 to Chapter 19 of the AIMR Safety Analysis Report," Ibcket 50-605, January 27, 1989. 19.6 Intter, D. C. Scaletti, NRC, to P. W. Marriott, General Electric Ompany, " Request for Ack11ticral Inforraation reganiirg the General Electric Ocupany Application for Certification of the AEMR Design," dated November 28, 1989. . 19.7 Inti er. J. Fox, GE, to D. C. Scaletti, NRC, dated January 9, 199. 19.8 Intte2 , J. Fox, GE, to D. C. Scaletti, NRC, dated January 11, 1990. 19.9 General Electric, " Amendment 8 to Chapter 19 of the AIMR Safety Analysis Report," Docket 50-605, July 28,1989. 19.10 Intter, M. Carmel (SNL) to Jac Jo (ENL), November 12, 1990.- 19.11 General Electric, "Amerdnud.10 to Chapter 20 of the AEMR Safety Analysis Report," Docket 50-605, Marcil 28, 1990. 19.12 General Electric, " Amendment 9 to Chapter.19 of the AIER Safety Analysis Report," Ibcked 50-605, Ncr/ ember 17, 1989. 19.13 Intter, D. C. Scaletti, NRC, to P. W. Marriott, General Electric Ompany, "Rcquest for Additicrnl Information regarding the General Electric Ompany Application for Certification of the AIMR Design," dated May 1,1990. 19-193 or ft Predecisionet
4 Draft Predicisional 19.14 General Electric, " Amendment 13 to Chapter 20 of the AIER Safety Analysis Report," Ibcket 50-605, July 3,1990. 19.15 General Flectric, " Amendment 14 to Chapter 20 of the AIER Safety Analysis Report," Docket 50-605, dated October 2,1990. 19.16 General Electric, "Airmnsit 13 to Chapter 18 of the AIER Safety Analysis Report," Ibcket 50-605, July 3,1990. 19.17 Intter, D. C. Scaletti, NRC, to P. W. Marriott, General Electric Company, " Request for Ailitional Information regattlirry the General Electric Otrnpany Application for Certification of the ADWR Design," July 30, 1990. 19.18 General Electric, " Airs &sJit 14 to OkW 20 of the AIER Safety Analysis Report," Ibcket 50-605, August 31, 1990. 19.19 }imorardum, E. S. Beckjord and Shcuas Murley to Victor Stello, "Meltorardum of Agreement of the RES Role in the Review of the Standard Plant Design-!ER/RES," Martd114,1988. 19.20 A Review of the General Electric ADRR Probabilistic Risk AM-mont, NUREG/CR-5676P, to be published. 19.21 " Anticipated Transients without Scram for Light Water Paactors," NURDG-0460, U. S. Nuclear Regulatory Ctr: mission, April 1978. 19.22 GESSAR II, 2'68 Nuclear Island, BWP/6 Stardard Plant PIrbabilistic Risk A - - nt, 22A7007, General Electric Oc Ipany, March 1982. 19.23 Probabilistic Risk A-ent, Limerick Generating Station, M111adelphia Electric Co. , Docket Nos.50-352 and 50-353, September 1982. 19.24 General Electric Co., " Advanced Boiling Water Reactor Standard Safety Analysis Report, GE rh,mont 23A6100, various amendments updated. 19.25 GE Ictter MlW No. 137-90, 11/2/90. 19.26 GE Intter MIW No. 152-90, 12/17/90. 19.27 10CFR50 - Appendix A. 19.28 U.S. Nuclear Regulatory Cd: mission, " Standard Review Plan," (!AJRED-0800), Washirgton, DC, Revision 1,1984. 19.29 U.S. Nuclear Exp11atory Cuinission, " Guidelines for Control Roca Design Reviews," (tURED-0700), Washirgton, DC,1981. 19-194 p,,n ,, g , %
mI / 4
& 1. '
Draf t Predicisional 19.30 U.S. Nuclear Regulatory Ni== ion, " Clarification-of 'IIC Action Plan Requisuumuits," (NURD3-0737 and Supplements), Washington, DC, 1980.
' 19.31 "Ioss of Offsite Power at U.S. Nuclear Power Plants - All Years through 1986," NSAC-111, EPRI NSAC, May 1987.
19.32 General Electric, "Agasalu=.ht 9 to Chapter 16 of the AIER Safety. Analysis Report," Docket 50-605, November 17, 1989. 19.33 " Reactivity Translents," NURD3/G-5368, Brookhaven' National laboratory, January 1990. 19.34 " Reactor Safety Study, An A-enant of Accident Risks in U.S. Cw.i acial Nuclear Ibwer Plants," WASH-1400, NUREE-75/014, October 1975, United States Atanic Energy n'=nimaion. 19.35 Ameninent 15, Nov. 30,1990, A[p.19L. 19.36 General Electric hwaant 22056, Rev. 2, " Failure Rate Data Manual." 19.37 DOE AIER IXIS Irstrumentation Fault Trees,1987. 19.38 IEEE Standard 500, 1984. 19.39 General Electric hwaant 22A6278, Rev. 2, "HKF Technical Specificaticos." 19.40 General Electric Wnaant NEDC 30936P. 19.41- IEROG 'Ibchnical Specifications Inprovement Methodology, Part I, 1985. 19.42 El-BaGaiani et al., "IHA Review Manual," NURD3/G-3485,1985' . 19.43 GE Ictter No. MIN 129-90, 10/09/90. 19.44 GE Intter No. MFN 130-90, 10/09/90. 19.45' GE letter No. MFN 153-90, 12/17/90. 19.46 O'Hara, J., " Foreign Travel Trip Report - Japan, October 1990," ~'i W .E 12, 1990. 19.47 Swain, A., and G.Ittmann, H., " Handbook of Human Reliability Analysis with Dqphasis on Nuclear Power Plant Applications," NURD3/G-1278, Draft Report for Interim Use ard Cwamuit,1980. s 19-195 Draft Predecisional
4 Oraft Predicisional 19.48 Swain, A. , and Guttennn, H. , "Hardbook of Human Reliabi)..ty Amlysis with D:Thasis on Nuclear Power Plant Applications," IUREG/G-1278, Final Report,1983. 19.49 lbnnaman, G., and Spurgin, A., " Systematic Human Action Reliability Procedure (SHARP)," EPRI NP-3583,1984. 19.50 Hall, R., Fragola, J., and Wreathall, J., " Post Event Human Decision Errors: Operator Action Tree / Time Reliability Correlation," NURDG/G-3010,1982. 19.51 Wreathall, J., " Operator Action Trees: An Approach to Quantifyirq Operator Error Probability Durirg Accident Seg w o," IUS-4159, 1982. 19.52 Nucleanics Week, Vol. 30, No. 41, p. 13, October 12, 1989. 19.53 Interim External Events Integration for the EPRI AIHR Requirements rh-nt, WBS 4.3.3, Harrison, D. G. , January 1989, Advarced Reactor Severe Acx:ident PrWacua, U. S. Department of Energy. 19.54 Estimation of Cbre Demage Frequency for Advanced Light Water Reactors Due to Tornado Events (Task 4.3.2.1), Summit, R. L., _ % .r 1988, Advanced Reactor Severe Accident Pr% tam, U.S. Department of Energy. i 19.55 U.S. NRC, " Procedural and Subnittal Guidance for the. Individual ! Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilitica," Draft Report for Ctmnent, ICREG-1407, July 1990. 19.56 letter frtrn P. W. Marriot of G.E. to C. L. Miller, . NRC, Dated ley 31, 1990,
Subject:
Subnittal of Responses to Additional Information Request of May 1,1989. ,- 19.57 1CREG/G-2300, FRA Procedures Guide. l' 19.58 10RD3/G-2815, PSA Proccitres Guide. 19.59 Bernreuter, D. L., et al., " Seismic thzard Claracterization of 69 Nuclear Plant Sites East of the Rocky Mountains," Vols.1-8, NURm/m-5250, January 1989. 19.60 EPRI, "Probabilistic Seismic Hazard Evaluations at Nuclear l-Plant Sites in the Central and Eash United States: Resolution of the Charlesten Earthquake Issue," April 1989. l 19.61 Campbell, R. D., et al., "Ctrrpilation of Fragility Information l fztrn Available Probabilistic Risk Avmwnts," IINL, UCID- [ 20571, Rev. 1, September 1988. l [ 19-196 oreft predeeistonei
c
- YT Draft Predicisional 19.62 Severe Accident Risks: An A w e nt for Five U.S. Nuclear Power Plants," NURD3-1150, Final Sumary Report (December 1990), Appendices A, B, and C (hJ er 1990), Appendices D and E (Appendices D ard E (January 1991), U.S. Nuclear Regulatory th minsion.
19.63 F. T. Harper, " Current Status, Uses, and Limitations of Probabilistic Accident Prtgression Analyses and Source hrns Analyses," Sardia Naticnal laboratories, CSNI Workshop on PSA: Applications ard Limitations, NURD3/CP-0115, SAND 90-2797, Santa Fe, New Mexico, September 4-6, 1990, published February 1991. 19.64 T. Pratt, et al. "A Review of the Advanced Boilirg Water Reactor PIcbabilistic Risk Aw=nt, Vol. 2: Internal and - External Events, Containment, and Offsite Cbnsequence Analysis," Brookhaven Naticnal laboratory, 1991. 19.65 R. M. Summers, et al. , "MFimR 1.8.0: A Ctrnputer Code for Nuclear Reactor Severe Accident Source Term Analyses and Risk Analyses," Sandia National Tahnratories, NURD3/CR-5531, SAND 90-0364, January 1991. 19.66 J. A. Gieseke, et. al, " Source Tenn Code Package - A User's Guide (Mod 1), Battelle Coltmtus Division, NURD3/CR-4587, IMI-2138, July 1986. 19.67 R. E. Henry, et al., " User's Manual: MAAP'(3.0): Modular Accident Analysis Frup , Pauske & Associates, Burr Ridge, Illinois, (undated). 19.68 R. L. Iman, et al., "A Fortran 77 F m p e ard User's Guide for the Generation of Intin Hypercube ard Random Samples for Use with Otang:ter Models," Sandia National laboratories,-NURD3/CR-3624, SAND 83-2365, March 1984. 19.69 Ictter frun P. W. Mariott, General Electric Corporation, to C. L. Miller, NRC, dated August 9,1990, regartiirg response to NRC/GE May 16 - 17, 1990 Meeting Discussing Topics. 19.70 U.S. Nuclear Regulatory th=4caion, Advisory Ctanittee on Reactor Safogtards, " Official Transcript of. Prr=dLngs," April 5, 1990, pages 1 - 152. 19.71 Letter report titled, " Effects of Debris Depth, Debris Otmposition, ard Debris Power en the Limits of Coolability," frtru E. R. Copus, Sandia National Laboratories, to C. Tinkler, U.S. Nuclear Regulatory th ei e lon, March 13, 1990. 19-197 or.ft pre *elstonet
o Draft Predicisional 19,72 R. E. Bloce, et al., " SWISS: Sustained Heated Metallic Melt /Cbncrete Interactico With overlyiry Water Pools," Sandia Natioral laboratories, IUREG/G-4724, SAND 85-1546, July 1987. 19.73 P. D. Hess ard K. J. Brordyke, "Causes of tbiten Aluminum-Water Explosions aid 'Iheir Prevention," Metal Fw.uss, April 1969. 19.74 B. W. Ecrman, et al., "Racent IIWn M iata Scale Experiments on Fuel-Coolant Interactions in an Open Gecnetry (EXD-FTIS)," IWirgs of the International ANS/DG Topical Meeting on
'Ibermal Reactor Safety, San Diego, CA, USA, Febnlary 2-6, 1986.
19.75 P. Cybulskis, "Aswent of the XSOR Cbdes," Battelle Columbus Division, IN/G-5346, IEI-2171, November 1989. 19.76 Ritchie, L. T., et al., " Calculation of Paactor Accident Consequences Version 2, CRAC 2: Ocuprter Cbde," IURED/G-2326, U. S. Nuclear Regulatory 02tmission, February 1983. 19.77 Chanin, D. I., et al., "MEIIDR Accident Cbnsequence Cctie System (MACCS), IUREG/G-4691, Sarxiin National laboratories, February 1990. 19.78 D. C. Aldrich, et al., "'Ibchnical Guidance for Sitirg Criteria Develc5xmnt," Sanila National laboratories, IUREG/G-2239, M r 1986. 19.79 Severe Accident Risks: An AT x = nt for Five U.S. Nuclear Ptuer Plants," Second Draft for IN:er Review, U.S. lAnclear Regulatory CbtInissicn, June 1989. 19.80 U.S. Nuclear Regulatory himion, " Safety Calls for the Operation of lknlear power Plants; Iblicy Statenent," Federal Register, Vol. 51, p. 30028 August 21, 1986. 19.81 U.S. Nuclear Regulatory Cbumission, "Irplementation of Safety Goal Iblicy," himion Paper SECY-89-102, March 30,1989. 19.82 "Special Otmnittee Review of the lAnclear Regulatory Ctanissico's Severu Accident Risks Report (!UREG-1150)," IUREU-1420, Atgust 1990. 19-198 oreft Predecisionat
r l l Draft Predicisional INDEX ADS . . . . .. . . .. .... . .. ....... 9, 32, 44, 66, 80, 83, 84 AIH1 . 2, 3, 8, 21, 49-51, 53, 54, 56, 58, 61, 71, 77, 78, 151-153, 156, 158, , 159, 161, 163-170, 172, 173, 178, 196 asstmptions . . 4, 23, 24, 26, 27, 49, 51-54, 77, 79, 98, 101, 102, 105, 106, 108, 133, 136, 148, 151-153, 156, 157, 177, 184, 187, 189, 191 A'IHS . . .. 24, 43, 45, 55, 66, 68, 69, 80, 83, 84, 106, 139, 140, 181, 184 autcmatic depressurization systen . . . . . . . . . . . . . . . . . . . 9, 66 balance of plant . .... . . . ........ .. . . .. . . . 1, 21, 182. h-t............................ 103, 126, 178 battery . . . . . . . . . . . . . . . . . . . . . . . 23, 63, 81, 82, 183, 189 DOP . . . . . ... .... .. . . . ....... ... . 1, 13, 21, 41, 182 cavity . ... ............................. 100 CCP . . . . . . . 69, 96, 98, 100-104, 107, 113, 122, 130, 132-135, 158, 184 concretc .
. 97, 99, 101, 103-105, 109, 126-129, 131, 138, 141-143, 145, 146, 148, 156, 186, 187, 191, 198 condensate . .. .... ...... ............... 9, 52, 66 containment event tree . .... . . . . . 68, 69, 71, 80, 96, 98, 105, 182 containment failuru 3, 37, 96, 99, 101-103, 106-110, 113, 119, 120, 123, 125, 127-130, 132, 136, 137, 140-143, 145, 147, 151, 152, 157-168, 172-176, 178, 179, 183, 184, 191 containment overpressure ..... . ...... 10, 118, 132, 148, 156, 191 control rtxi drive . .. . . ... . ........ .. . ... . . 7, 58, 60 control room ... ... . ... 4-6, 11-14 16-20 23 29 36 65, 188, 194 DCH . . . . . . . . . . . . . . . . . . . . . , . . . ,. . ,. . ,. . ,102 , 12 0, 18 6 dependent failures ........ . . . . . . . . . . . . ... . 22, 53, 185 diesel . .. ...... . . . . . 10, 11, 27, 34, 62, 63, 81, 82, 181, 183 drywell . . 97, 99-102, 104-107, 109, 110, 113-115, 118-124, 126-132, 136-138, 141-147, 152, 156, 159, 161, 186, 191, 192 EPRI .
2, 3, 8, 21, 22, 31, 49, 51, 53, 57, 70, 71, 75, 77, 78, 84, 85, 105, 151-153, 156, 158, 161, 163, 164, 166, 168, 170, 173, 176, 179, 183, 195, 196 evacuation .. . . ... ... ...... .... . 114, 151, 152, 154,.177 external events . . 2-4, 49, 50, 56, 78, 79, 97, 107, 108, 157, 190, 196, 197 failure-to-scram ... ..... . . . . . . . . . . . 7, 23, 24, 37-40, 48 firewater . . 4, 9, 46, 67, 69, 71, 96, 98, 99, 105,'106, 114, 127, 132, 139, 156, 183, 184 gas turbine . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4, 10, 98 GESSAR . . .. . . . . 7-9, 23, 27, 28, 31, 34-36, 53, 56, 84, 181, 189, 194 high pressure corn flooder ...................... 8, 26 HFCF - . . ... . . . . . 8, 9, 24, 26-28, 39, 66, 80, 83, 84, 181, 185, 195 HRA . . . ... .. ....... .... 17, 19, 28-31, 33-36, 181, 185, 188 human ruliabi.lity . . . . . . . . . . . . 4, 11, 19, 21, 28, 31, 188, 195, 196 hydrogen ... ........................ 100, 103, 178 interfacity IDCA . ... ............. ...... . .. 23, 185 ICRV . .. . .. . .. . .................. 22-24, 181, 182 licensing review bases . . . . . . . . . . . . . . . . . . . . . . . 1, 193 Idmerick ... ................. 8, 22, 37, 40, 56, 182, 194 LOCA . . . ...... 6-9, 11, 23, 24, 38, 39, 42-44, 48, 80, 122, 134, 185 loss of offsite power . . 21, 22, 34, 42, 48, 51, 52, 62, 68 69 83 86 1 low pressure core flooder . . . . . . . . . . . . . . . . . . , . . , . . , . . , . 95 26 19-199 ,,g p, g i g
g u .\ 4 Draft Predicisional IPFL . . . .......... . ............. 9, 66, 80, 83, 84 MAAP 2, 96, 98, 102, 104, 126, 128, 130, 133, 134, 138, 141-145, 147-149, 197 maintenance . . . . . . . . . . . . . . . . . . . . . . . . 8, 21, 23, 28, 181 marmal shutdowns . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 MFirnt .. .. .... .. 4, 98, 104, 127, 128, 133, 135, 141-145, 197, 198 NURED-1150 .
. 37, 38, 96, 97, 99-102, 104, 110, 114, 129, 130, 133-135, 152, 154, 155, 192, 197, 198 offsite power . . . . . 10, 21, 22, 34, 42, 48, 51-53, 62, 66-69, 83, 86, 195 overpressure . 10, 108-110, 114, 118-120, 122, 123, 126, 127,'129, 132, 137,
, 147, 148, 156, 157, 160, 162, 175,;176, 183, 186, 191, 192 passive flrw k . . 96, 99, 107, 109, 110, 126-129, 131, 138, 139, 141, 142, -2
'144-146, 186, 191
- pedestal .. 58, 59, 74, 81, 101, 104, 106,'109, 126-128, 131, 132 136, 191' plant damage states . . . . . . . . . . . . . . . . . . . . . . . . ., . . 98 principal contributors
. . . . . . . . . . . . . . . ... ... . . . 38, 190 s vc=Jares . .. .... . ... 13, 17, 19, 21, 26, 30, 33, 35, 53, 153, 196 RCIC . . . . ...... .... 8, 9, 23, 28, 43, 44, 66, 69, 80, 83, 84, 185 reactor core isolation coolig ....... . . ... . ..... .... '8' reactor protection s refueliry . . . . . ystem .. ............. . . . . . .... . . .. ...
6, 7 25 residual RHR . heat removal . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 , 9-11, 13, 24, 26-28, 62-64, 66-69, 71, 76, 83, 101, 102, 106, 107, 109, 110, 114, 118-220, 127, 130-132, 136, 137, 181, 185 RWOU .. . ..... . . . . . . . . . . . . . . . . . . . . . . . . - 23,.185 safety goal . ; . . . . . . . . . . . . . . . . . . . . . . . . . . . 3, 198. scram . . 6, 7, 9, 13, 21, 23, 24, 37-40, 44, 45, 48,'55,.60,.63, 66, 68, 83,
.107, 142, 181, 182, 194 '
service water . . . . . . . . . . . . . . . . . . . 10, 11, 22, 63, 66, 83, 86 SIC . . . ....... ................. 8, 12, 40, 68, 82, 83 source tern . . . . . . . . . 2, 96, 98, 133-135, 145-148, 152, 155, 191, 197 ' spray . . . . . . . . . . . . . . . . . . . . 8, 114, 118, 132, 140, 147, 192 . Standard Review Plan ................. . 1, 19, 65, 113,'194 stardby liquid control .................... 8 12, 66, 68 startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . .., 12, 13, 25
- staticm blackout .. . . 8, 10, 23, 34, 38, 39, 43, 51, 69, 80, 83, 84, 139-SICP steam explosion . . . . . . . . . . . . 98, . .'.104 . .,.133 . ,135, 141-145,-~147, 152
.. ... . .. . 103,,104-mv m n criteria .... . . . . . . . . . . . . . . . ...L. . . 23, 24, 181 r test . . . . . ... .................... 20, 28, 57, 181
- transients .. 6, 8, 9, 21, 23, 24, 38,.43-45, 54, 55, 68, 80, 134, 194, 195
' turbine . . . ..... .
t
. 4, 8, 10, 13, 28, 38, 39, 42, 46, 48, 58, 81, 98l ultimate heat sink ............... . . . ' . . . .. . . .. 9, 51 uncertainty analysis 23, 28, 37, 38, 50, 53,'55, 73, 74, 130, 131, 148, 158, 186, 191 ventirg . 62, 69-72, 75,. 80, 84, 87, 884 91, 99, 101, 107, 118, 120, 121, 123, i- 140, 147, 157, 159, 161, 163-168, 175, 176, 181-183 L vessel failure .. .... 80, 84, 99, 101, 110, 134, 137, 139, 141-145, 147 vessel isolation ...................... 8 21 181 walk-down . . . . . . . . . . . . . . . . . . . . . . . . . . . .,. .,.24, .. . 5 wetwell . . 99, 101, 102, 104, 106, 109, 110, 113-115, 117-119, 121-124, 126,.
127, 129, 131, 132, 136, 147, 186, 192 19-200 oreft predecisionet L.
.a r Draft Prediefsfonal M ,,,,,,,, *********** ..... ,a 134, 135, 198 i
1 19-201 Desft Predecial a t}}