ML20070R145

Testimony of DC Bley,Re Henry,S Kaplan,Nj Liparulo,Hf Perla, DC Richardson,Rh Toland,Te Potter,Dh Walker,Bj Garrick & Dk Goeser on ASLB Question 1.1 & Commission Question 1. Certificate of Svc Encl.Related Correspondence

ML20070R145
Person / Time
Site:	Indian Point
Issue date:	01/24/1983
From:	Dennis Bley, Garrick B, Goeser D, Henry R, Kaplan S, Liparulo N, Perla H, Potter T, Richardson D, Toland R, Walker D CONSOLIDATED EDISON CO. OF NEW YORK, INC., POWER AUTHORITY OF THE STATE OF NEW YORK (NEW YORK
To:
References
ISSUANCES-SP, NUDOCS 8301270300
Download: ML20070R145 (194)

Text

{{#Wiki_filter:,- e pW9

1. c0

,o# Qfl5L UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION '83 JAN 26 A10:41 ATOMIC SAFETY AND LICENSING BOARD L H >... MdtiAh r Before Administrative Judges: DCC n U thu i. SERVICE James P. Gleason, Chairman BRANCH Frederick J. Shon Dr. Oscar H. Paris ) In the Matter of ) ) CONSOLIDATED EDISON COMPANY OF ) Docket Nos. NEW YORK, INC. ) 50-247 SP (Indian Point, Unit No. 2) ) 50-286 SP ) POWER AUTHORITY OF THE STATE OF ) NEW YORK ) January 24, 1983 (Indian Point, Unit No. 3) ) ) LICENSEES' TESTIMONY ON COMMISSION QUESTION ONE AND BOARD QUESTION 1.1 ATTORNEYS FILING THIS DOCUMENT: Brent L. Brandenburg Charles Morgan, Jr. Paul F. Colarulli l CONSOLIDATED EDISON COMPANY Joseph J. Levin, Jr. OF NEW YORK, INC. 4 Irving Place MORGAN ASSOCIATES, CHARTERED New York, New York 10003 1899 L Street, N.W. (212) 460-4600 Washington, D.C. 20036 (202) 466-7000 l 8301270300 830124 PDR ADOCK 05000247 T PDR 1603 ~

x , TABLE OF CONTENTS I. PRESENTATION AND QUALIFICATIONS OF PANEL MEMBERS........................................... 1 II. I NT RO D U C T I O N...................................... 5 III.

SUMMARY

OF RISR.................................. 22 IV. INITIATING EVENTS................................ 41 V. PLANT RESPONSE ANALYSIS.......................... 52 VI. CONTAINMENT RESPONSE ANALYSIS.................... 72 VII. CONSEQUENCE ANALYSIS............................. 91 VIII. EVALUATION OF MEASURES TO PROTECT THE PUBLIC DURING EMERGENCIES....................... 110 l l l l l i

\\ I. PRESENTATION AND OUALIFICATIONS OF PANEL MEMBERS A. Panel Structure Licensees hereby present three panels of witnesses. Panel 1 will primarily address the overview and conclusions of this testimony and will consist of Dennis C.

Bley, B.

John Garrick, David K. Goeser, and Stanley Kaplan. Panel 2 will primarily address the analysis of initiating events and plant and containment response and will consist of Dennis C. Bley, Robert E. Henry, Stanley Kaplan, Nicholas J.

Liparulo, Harold F.

Perla, Dennis C. Richardson, and Richard H. Toland. Panel 3 will primarily address consequence analysis and evaluation of protective measures and will consist of Dennis C. Bley, Thomas E. Potter, and Dee H. Walker. B. Introduction of Panel Members My name is Dennis C. Bley, Ph.D. I am a consultant at Pickard, Lowe and Garrick, Inc., in reliability, risk, and decision analysis for electrical generating plants. I was a principal investigator on the Indian Point Probabilistic Safety Study. A statement of my professional qualifications is attached. My name is B. John Garrick, Ph.D. I am a principal of Pickard, Lowe and Garrick, Inc., and a specialist in nuclear safety matters. I was a principal investigator on the

) , Indian Point Probabilistic Safety Study. A statement of my professional qualifications is attached. My name is David K. Goeser. I am the Manager of Marketing in the Nuclear Technology Division of Westinghouse Electric Corporation. I was a principal investigator on the-Indian Point Probabilistic Safety Study. A statement of my professional qualifications is attached. My name is Robert E. Henry, Ph.D. I am the Vice Presi-dent and co-founder of Fauske & Associates, Inc. I was a principal investigator on the Indian Point Probabilistic Safety Study. A statement of my professional qualifications is attached. My name is Stanley Kaplan, Ph.D. I am an associate-consultant at Pickard, Lowe and Garrick, Inc. My main area of work is in probability theory, risk and decision analysis, and particularly in probabilistic risk assessment methodology. I was a principal investigator on the Indian l l Point Probabilistic Safety Study. A statement of my pro-1 l fessional qualifications is attached. My name is Nicholas J. Liparulo. I am the Core, Con-tainment, and Sequence Analysis Group Manager of the Risk f Assessment Technology Group in the Nuclear Safety Department i t ,,,y-,__. ,,___.____,_-.m. . ~,.., of the Nuclear Technology Division of Westinghouse Electric Corporation. I was a principal investigator on the Indian f Point Probabilistic Safety Study. A statement of my pro 1 fessional qualifications is attached. My name is Harold F. Perla. I am a structural engineer and an asscciate consultant at Pickard, Lowe and Garrick, Inc., specializing in risk analysis of external events. I was a principal investigator on the Indian Point Probabil-istic Safety Study. A statement of my professional qualifi-cations is attached. My name is Thomas E. Potter. I am a consultant at Pickard, Lowe and Garrick, Inc., in public health conse-quence analysis of radioactive releases. I was a principal investigator on the Ir.dian Point Probabilistic Safety Study. A statement of my professional qualifications is attached. My name is Dennis C. Richardson. I am the Risk Assess-ment Technology Manager in the Nuclear Safety Department of the Nuclear Technology Division of Westinghouse Electric Corporation. I was a principal investigator on the Indian Point Probabilistic Safety Study. A statement of my pro-fessional qualifications is attached.

_4_ My name is Richard H. Toland, Ph.D. I mn the Manager of the Structural Analysis Group of United Engineers and Constructors, Inc. My present work is in the structural analysis of nuclear and fossil power plants. A statement of my professional qualifications is attached. My name is Dee H. Walker, Ph.D. I am the Manager of Nuclear Engineering in the Nuclear Safety Department of the Nuclear Technology Division of the Water Reactor Divisions of Westinghouse Electric Corporation. I was a principal investigator on the Indian Point Probabilistic Safety Study. A statement of my professional qualifications is attached. II. INTRODUCTION A. SCOPE AND PURPOSE OF TESTIMONY The purpose of this testimony is to address Commission 1 Question 1 in this proceeding as well as Board Ques-tion 1.1,2 concerning the level of safety of Indian Point. The major conclusions of this testimony and a summary of the individual and societal risks of the Indian Point 1. Commission Question 1 What risk may be posed by serious accidents at Indian Point 2 and 3, including _ accidents not considered in the plants' design basis, pending and after any improvements described in (2) and (4) below? Although not requiring the preparation of an Environmental Impact Statement, the Commis-sion intends that the review with respect to this question be conducted consistent with the guidance provided the Staff in the Statement of Interim Policy on " Nuclear Power Plant Accident Consider-ations under the National Environmental Policy Act of 1969;" 44 F.R. 40101 (June 13, 1980) (footnote omitted). 2. Board Question 1.1 What are the consequences of serious accidents at Indian Point and what is the probability of occurrence of such accidents? In answering.this question the parties shall address at least the following documents: (a) the Indian Point Proba-bilistic Safety Study (IPPSS) prepared by the Licensees; (b) the Sandia Laboratory " Letter Report on Review and Evaluation of the Indian Point Probabilistic Safety Study" (Letter Report), dated August 25, 1982; and (c) any other reviews or studies of the IPPSS prepared by or for the Licensees, the NRC Staff, or the Intervenors, or any other document which addresses the accuracy of the IPPSS.

, Units 2 and 3 plants are presented in Section III. This testimony is drawn from the Indian Point Probabilistic Safety Study (IPPSS Reference II-1) and other analyses. Significant aspects of the IPPSS1 are summarized in Sections IV-VII of this testimony. An evaluation of measures to protect the public during an emergency is discussed in Section VIII, B. PROBABILISTIC RISK ASSESSMENT Substantial portions of this testimony are based on an analytical method known as probabilistic risk assessment. This is an advanced technique for quantifying the risks associated with complex systems such as nuclear power plants. The purpose of a probabilistic risk assessment (PRA) is to develop explicit numerical calculations of the probabilities and consequences of accidental events. In recent years, probabilistic methods have developed rapidly and are being applied with increasing frequency in the nuclear industry, particularly to those accidents which go beyond the design bases on which the plant was licensed. The Commission has an active program for using PRA methodology. For example, the Commission has, in the past, required PRAs of new plants such as Limerick, and is 1. The IPPSS is attached hereto as an exhibit, to the extent not superceded by this or other testimony filed with the Board.

---

m

---e conducting an Interim Reliability Evaluation Program (IREP) on a number of operating plants using these methods. Since publication of the Reactor Safety Study (Refer-ence II-2 ), at least 26 studies have been performed or init-lated on nuclear power plants using PRA methods. Examples of completed studies are those for the Limerick, Big Rock Point, and Zion plants in this country, and the German Risk Study. These techniques have also been used in studies of complex systems in other industries. Examples of these include the Canvey Island study in Great Britain (a public health risk assessment of a major chemical industrial facil-ity), National Aeronautics and Space Administration pro-grams, commercial aircraft studies, and studies on protec-tive systems for chemical plants. The methodology used in PRA addresses the two compo-nents of risk: probability and consequence. In general terms, risk is defined and quantified by answering the following three questions: 1. What could happen; i.e., what accident sequences, or scenarios, are possible? 2. What are the probabilities of these accident scenarios? 3. What would be the consequences of such scenarios? In the case of a nuclear power plant, the important steps in answering these questions are: l t 1. Identification of " initiating events," that is, those events that could start an accident scenario. 2. Assessment of the probabilities of the response of the plant equipment, opera-tors, systems, and structures following an initiating event, based on knowledge of the plant, human factors, and data obtained from experience with similar events and related experiments and analyses. 3. Calculations, based on plant and site specific data, of consequences of each of the postulated accident scenarios. There are two general classes of initiating events described in the IPPSS, " internal" and " external." " Internal" events are those which originate with malfunc-tions or failures of plant equipment or systems, including those caused by operator error. " External" initiating events originate from other causes and include earthquakes, fires, high winds, and floods. The response of the plant equipment, operators, systems, and structures is generally described in a risk analysis by the use of " event trees" and " fault trees." An event tree is a diagram that shows the various possible scenarios that could' result from a given initiating event, l including those which could possibly lead to core damage or to containment failure. The branches in the event trees represent the success or failure of the various safety i i l systems in the plant. The likelihood of success or failure of the individual systems is investigated using fault tree

diagrams, block diagrams, and cause tables. Fault trees and block diagrams express the logical relationships between the functioning of the system and its components. Cause tables summarize the frequencies of possible " candidate causes" which could conceivably result in failure of the system. Information obtained from the past operation of compo-nents, systems, and structures in the facility being analyzed, supplemented by information from the industry as a whole, forms the data base from which the frequencies of candidate causes are calculated. These data are incorpor-ated into the detailed f ault and event trees which are then analyzed mathematically to produce the scenario frequencies for each of the initiatinc events. PRA also considers human errors, system dependencies, and the unavailability of equipment due to testing or maintenance. The potential for common cause failures, that is, the simultaneous failure of more than one component or system from events such as earth-quakes, fires, human errors, or special plant conditions'is also evaluated. After identifying, developing, and quantifying the accident scenarios which lead to a degraded core, the impact on the containment during these scenarios is assessed. This step considers the affects of temperature, pressure, and other conditions resulting from the accident on the con-tainment. Event trees are used to describe and calculate the likelihood of those scenarios which could lead to

, containment failure. For those events which could lead to containment f ailure, the magnitude and type of radioactive material that could be released is calculated according to the containment and core conditions. Releases which are similar in magnitude and timing are grouped into a " release ca tego ry. " Several release categories are sufficient to adequately describe all o' the accident scenarios. Using these release categories, the potential conse-quences can be calculated in terms of the frequencies of various health effects and of property damage which could result from the accidents considered. These calculations employ detailed analyses of the site meteorology, demo-graphy, and topography, and the effectiveness of evacuation and sheltering in reducing consequences. The final results of such analyses can be presented both in terms of risk to an individual, as well as societal risk. C. THE INDIAN POINT PROBABILISTIC SAFETY STUDY The IPPSS, which forms an important basis for this testimony, was submitted to the United States Nuclear Regu-latory Commission in March 1982, following more than two years of intensive effort. The IPPSS is being amended in response to various peer reviews.1 While this study was 1. One review of the IPPSS was prepared by Sandia

e performed by consultants, the utilities played an integral role by supplying plant and site specific information. In addition, an independent review panel composed of prominent nuclear scientists provided critical peer review. The IPPSS is a comprehensive PRA which encompasses both internal and external initiating events and includes a detailed treatment of consequences specific to the Indian Point plants and site. The key portions of the IPPSS are: o Identification of Initiating Events. Identification of internal and external initiating events. (See Section IV of this testimony.) o Plant Response Analysis. From initiating events (e.g., power transients, LOCAs, earthquakes, etc.) to degraded core conditions. (See Sections IV and V of this testimony.) o Containment Response Analysis. From degraded core conditions to vessel failure to containment failure condi-tions. (See Section VI of this testimony.) o Conse7uence Analysis. From containment failure conditions to the release and transport of radioactive material offsite and its consequences in terms of health indices. (See Section VII of this testimony.) National Laboratories. Letter Report on Review and Evalu-ation of the Indian Point Probabilistic Safety Study (Aug. 25, 1982). The utilities' response to this review is contained in Letter from John D. O'Toole and J. Phillip Bayne to Steven A. Varga (NRC) (Oct. 6, 1982) and attached Response to Sandia Letter Report of September 1, 1982 on the Indian Point Probabilistic Safety Study.

l D. PRA ADVANCEMENTS INCORPORATED IN THE IPPSS The IPPSS incorporates many advances resulting from the continuing development of PRA techniques by the authors; from the contributions of other consultants and from govern-ment agencies in this field; from thoughtful critiques of previous PRAs by members of the scientific community; and from the increasing body of nuclear power plant operating l experience. These advances are found in all areas of the 1 report and include the following: 1. Use of Matrix Formulations The complex problems of structuring the accident scenarios are made visible and systematic by dividing them into four distinct parts, i.e., the initiating event analysis, the plant analysis, the containment analysis, and the consequence analysis. The last three of these analyses result in matrices whose elements are the transition fre-quencies from various input conditions to various output l states; for example, the plant matrix aamits as input the various possible initiating events and has as output the various damage states of the plant. The matrix formulation makes the final process of assembling the information from the different parts of the analysis more visible and, there-fore, easier to understand. Because the scenarios are divided into four distinct parts, each aspect of the study can be isolated for further systematic anslysis. Therefore, the contributors to various damage states, release cate-gories, or aspects of risk can be identified, assessed, and ranked for significance. Figure II-l shows the way in which matrix formulation is applied in assembling the results. 2. Master Logic Diagram A master logic diagram (see Figure IV-1) assists in identifying initiating events. This diagram shows the thought processes that have led from the event of interest, such as an of fsite re. lease, to the list of initiating events that could start that accident sequence. 3. Expanded Data Base, Including Plant and Site Specific Data The data base developed for the IPPSS included Indian Point plant and site specific data, data collected for the Reactor Safety Study, and more recent industry-wide nuclear plant operating experience data. The process began with the collection of industry-wide data. Additionally, plant records, drawings, and system descriptions were reviewed to i construct an appropriate Indian Point plant specific data base. The industry-wide data were then integrated with the available plant specific data using Bayes' theorem. This process permits use of all relevant information in a rigor-ous way to reflect the current state of knowledge. The IPPSS data base includes component failure rates, component unavailability due to testing and maintenance, human error i rates, site seismicity, and frequencies for initiating

l 'i 'El ""OoE rans: IN,T, ATIN. ,m,e n u A.E EVENT STATE CATEGORY STATE l l- -l StTE MODEL CONTAINMENT MODEL PLANT MODEL SEGMENT PLANT - HO CONTA,NMENT MODELS: EVENT --) EVENT .CR ACIT TREE TREE CALCutATIONS 1P ,r p 3, td FREQUENCY'-4,;.,1._i

1. v-i,;.,f._i

,a - i,;..;. _i .=-i.t..;.._i vEcron: # 8 (INITIATING (PLANT STATE VECTOR) (RELEASE VECTORI EDAMAGE VECTOR) EVENT VECTOR) 3r Il 12*** ' ll

• 12 * * *

'll 812 * *

• TRANSITg 8
• 21 e

25 " 21 C. 5 MATRICES: M. IPLANT MATRIX) ICONTAINMENT MATRIXl is TE MATRIX) l l Fiqure II-1. Overall View of the PRA Assembly Process Showing Relationships of Pinch Points, l Event Trees, Frequency Vectors, and Transition Matrices l l events such as wind, tornado, and fire. Meteorological, topographic, demographic, and evacuation site specific data are also included. 4. Uncertainties The IPPSS introduced a framework in which uncertainty is included as an integral part of the presentation of. risk. Uncertainties in the occurrence rates of internal and external initiating events, hardware failures, human errors, and equipment unavailability due to maintenance and testing are quantified based on all relevant evidence, experience, and information available. Uncertainties in containment response, source term, and offsite health consequences are also included. These uncertainties are combined and propa-gated through the analysis by a method known as " discrete probability distributions." This process of retaining uncertainties throughout the calculation allows construction of a final family of risk curves, which not only display the occurrence frequency of each level of cor. sequence but also the uncertainty or confidence band associated with that fre-quency. This form of display is called the " probability of frequency" fo rma t. 1 5. Common Cause Faily.res Multiple failures of safety equipment can result from a common cause. Section V of this testimony discusses the treatment of common cause f ailures in more detail. Among the advances incorporated in the IPPSS in the area of common 1 cause f ailures is the treatment of human errors, discussed below, and the advanced modeling of external events, such as eartcquakes, that can produce multiple failures. Another advancement is the use of the beta factor model. The para-meter beta is defined as the fraction of common cause failures experienced in particular components that were not accounted for elsewhere in the analysis. This model is used for analyzing certain common cause failures where there are intercomponent dependencies. 6. Human Errors The IPPSS recognized the importance of the operators in affecting risk. In the analysis, the Nuclear Regulatory Commission human reliability nandbook (Reference II-3) was the principal source of human error rate information. The degree of dependence among operators was assessed for each analyzed event. Additionally, for certain events such as fires, the human error rates were increased to account for j the relatively high stress or other special circumstances such as competing demands on the operators' attention. The availability of Senior Reactor Operators and the fact that Indian Point operators benefit from their training on a plant specific simulator were considered. The resultant human error rate distributions were used in the quantifica-tions of the plant and system logic models. 7. External Initiating' Events Detailed models that considerably advanced the state of the art were developed for earthquakes, fires, and winds. 8. Containment Analysis A major advance of the IPPSS is the treatment of acci-dent progression phenomena and the physical processes involved. Thus, containment analysis examines damaged core phenomena and the role of the containment engineered safety systems during an acc'ident. Detailed containment evtat trees permit tracking of containment response to the pro-t gression af a degraded core accident. Many studies, exper-iments, and analyses provide a technical basis for quanti-fying the contaimment event trees. Examples of such analyses include: hydrogen generation and combustion, steam explosions, core coolability and dispersion, and containment heat removal. Another important feature of the IPPSS is the detailed assessment of the strength of the cantainment. 1his assessment found that the Indian Point containments have significantly greater strength than previously believed with resultant higher containment pressure limits. The strength of these containments is a major factor in minimiz-ing the risk at Indian Point. 9. Consequence Analysis l l The objective of the consequence analysis is to esti-l l mate the potential for health effects on the surrounding l population due to radioactive releases. Fission product i I release values were modified to account for retention of certain radioactive material in the containment for late overpressurization scenarios. In the IPPSS, discrete proba-bility distributions were used to express the extent of conservatism in the radioactivity release values which were calculated based on Reactor Safety Study methodology. Another improvement is the more realistic modeling of long duration releases. The atmospheric dispersion models em-ployed are a refinement over earlier work in that they account for variations in plume transport according to changes in the wind direction. The variable direction evac-uation model employed to depict the actual evacuation plan prepared by Parsons, Brinckerhoff, Quade and Douglas, Inc. is another refinement. E. HOW RISK IS EXPRESSED In this testimony, the risk of the Indian Point nuclear power plants is expressed in terms of six indices and their probability of occurrence. Offsite property damage and five health indices Are analyzed. There are four individual and societal health indices, which are: 1. Early fatalities, which would tend to occur within about 60 days af ter expo-sure. 2. Radiation illnesses, called " injuries," which do not result in fatalities. 3. Thyroid cancers (which are curable in approximately 90 percent of the cases).

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 4. Cancer fatalities, other than from thyroid cancers. There is an additional societal health risk index: total population dose in terms of whole body man-rem. (Note: Both thyroid and other cancers are distributed over a 30 year period and can occur after an initial latency period of about a year.) In this testimony, when the results for these five health indices and for offsite property damage are expressed in terms of societal risk, they are displayed as a family of curves. They are Figure II-2 explains how to read these risk curves. Societal risk expresses the health effects on a population group, that is, the likelihood of any given number of people being affected by a nuclear power plant accident. Results for the first four health indices are also pre-sented in terms of individual risk, that is, the likelihood that a person in the Indian Point vicinity would be affected by an accident. Individual risk is expressed in terms of point values, such as once in x years. Offsite property damage estimates, in 1982 dollars, were calculated using the Reactor Safety Study model. This potential damage is expressed in a similar manner to the health indices, +s0 I S U P = 0.90 m% M w o P = 0.50 05g.3o g P = 0.10 u. X, HEALTH EFFECT x NOTE: ANY POINT ON A RISK CURVE CAN BE EXPRESSED IN THE FOLLOWING MANNER: THERE IS "P" PERCENT CONFIDENCE THAT A LEVEL OF HEALTH EFFECTS, "X," WOULD NOT BE EXCEEDED MORE OFTEN THAT "*" TIMES 0 PER REACTOR YEAR. FOR EXAMPLE, SUPPOSE ONE WANTED TO DETERMih!, FOR A 502 CONFIDENCE LEVEL, THE FREQUENCY OF EXCEEDING A HEALTH EFFECT OF LEVEL Xo. THIS WOULD BE FOUND BY ENTERING THE DIAGRAM AT Xo, DRAWING A VERTICAL LINE UPWARD UNTIL IT INTERSECTS WITH THE P = 0.50 CURVE, AND READING THE CORRESPONDING FREQUENCY OF EXCEEDANCE, *50. ON THE VERTICAL AXIS. CURVES OF P = 0.50 ARE ALSO KNOW AS *BEST ESTIMATE" AND " MEDIAN ESTIMATE" CURVES IN THE IPPSS. CURVES AT THE 90% CONFIDENCE LEVEL (P = 0.90) ARE ALSO KNOWN AS " UPPER BOUND ESTIMATES." Figure II-2. How to Read'a Risk Curve

-- A number of plant improvements have been made to Indian Point 2 and 3 both before and after publication of the IPPSS, largely as a result of the IPPSS analysis. The indi-vidual and societal risk quantifications presented in this testimony reflect those improvements which have been or are being implemented, and further amendments of the IPPSS will reflect these changes. F. REFERENCES II-l " Indian Point Probabilistic Safety Study," Power Authority of the State of New York and Consolidated Edison Company of New York, Inc., March 1982. 'II-2 United States Nuclear Regulatory Commission, " Reactor Safety Study: An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400, 1975. II-2 Swain, A. D. and H. E. Guttman, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications," NUREG/CR-1278, October 1980.

22 - III.

SUMMARY

OF RISK A. MAJOR CONCLUSIONS on both an individual and a societal basis, the health risk from an accident at the Indian Point nuclear power plants is extremely small and, as will be testified to under Commission Question 5, within the range of riska posed by other nuclear power plants. The health risk from the Indian Point plants is within the Commission's individual and societal safety goals and, in fact, for release category 2 scenarios, these goals can be met with no protective actions for 24 hours. Assumptions about the amount and composition of radio-accive material which would be released to the environment during serious accidents are referred to as the " source term." Depending.upon assumptions one makes about the amount of radioactive material released, it may be that such accidents would have no widespread health effects. Reduc-tions of a factor of about 15 in the source term used in the IPPSS could effectively eliminate early fatalities, assuming evacuation as modeled in the.IPPSS. Additionally, the reduced source term would also significantly reduce all other health effects risks, property damage, and the usefulness of any mitigating features. More specifically based on the source term used in the IPPSS we find: o The risk of early fatalities is extreme-ly small, and only results from an acci-dent scenario with a prompt release of radioactive material. The best (median) estimate of the frequency of accidents causing one or more early fatalities is once in 110,000,000 years of operation of Indian Point 2 and once in 140,000,000 years of operation of Indian Point 3. o The risk of latent fatalities is small. For example, the median frequency of having a one percent increase above the background cancer fatality rate is about once in 10,000,000 years at Indian Point 2, and once in 100,000,000 years at Indian Point 3. o Major fractions of the small latent fatality risk would be associated with rare and severe natural events which have not been observed in this area. These events in themselves would put the public and property in the region sur-rounding the site at considerable jeopardy without any contribution from Indian Point. o A reactor core melt is an infrequent event. For Indian Point 2 the median frequency of core melt caused by inter-nally initiated events is once in 16,000 years of operation, and the core melt frequency from all initiating events is once in 7,100 years ct operation. For Indian Point 3, the comparable numbers are once in 26,000 years and once in 17,000 years. o Core melt frequency is a poor indicator of public risk. This is demonstrated in two ways. First, about 65 percent of the postulated core melt scenarios at Indian Point 2 and 90 percent of those at Indian Point 3 do not lead to signif-icant releases of radioactive material to the environment. Second, over 95 percent of the early fatality risk at each plant is determined by a scenario, (the interfacing systems LOCA), which contributes less than one half of one percent to the core melt frequency. o The containment has much greater strength than previously assumed, enabling it to maintain its integrity during most of the severe accident con'- ditions that might occur. As long as containment integrity is maintained, offsite consequences are insignifi-cant. Even if a core melt should occur: o It is extremely unlikely that the containment building would fail due to steam or hydrogen explosions. o overpressurization failure of the containment should not occur under minimal containment heat removal conditions (i.e., one of five fan coolers or any one of six contain-ment spray modes). o Most accidents evolve slowly. After accident initiation there would be a minimum of 12 hours, and more likely about a day, before the containment would fail from an overpressurization. l Much can be done in this time, including operator action to terminate the pres-sure increase altogether; evacuation could be implemented if required; short-l lived isotopes would decay away; various chemical and physical processes which do not require any actions'by the operator or by safety equipment would result in retention of much of the fission pro-ducts in the containment. The median frequency of overpressurization failures is about once in 30,000 years for Indian Point 2 and about once in 170,000 years for Indian Point 3. o A rapid containment failure is much less likely to occur than a delayed failure at Indian Point and does not signifi-cantly contribute to risk. o Containment bypass failure due to an interfacing systems LOCA would occur less frequently, about once in 2,000,000 i

. years of operation based on best esti-mate analysis. o Because more than 95 percent of the early fatality risk is within four miles of the plant, evacuation of areas beyond the 10-mile Emergency Planning Zone (EPZ) is at best of marginal overall societal benefit. Based on this and reductions in the source term, a smaller j EPZ may be justified. o Even if early containment failure should occur, emergency response measures could be taken to protect the public. i o Evacuation beginning prior to re-lease would be most effective. Even low evacuation speeds (about 3 mph) would then be sufficient to. prevent early fatalities among the evacuees. o As an alternative to evacuation, sheltering followed by selected relocation would require less public transportation. After an accident, affected areas would be identified by monitoring teams and the people in the affected zones would be moved to minimize radiation doses. Be-cause these zones would be small, the travel distance necessary to leave the area would be small (nor-mally 2 miles or less), and the number of people needing relocation l would be limited. i B. INDIAN POINT SOCIETAL AND INDIVIDUAL RISKS The societal risk curves for Indian Point 2 are shown in Figures III-la through III-lf for each index analyzed. Similarly, the societal risk curves for Indian Point 3 are shown in Figures III-2a through III-2f. l

O b U2. et 23 7., ~: g ac an a - *g .8 s wa -i E u ' ~S T l N = g a U , o E e I g y - ga s ! 2 I 2 ' '8 N8 ~ i s. N I -*g e "e ,- e n g g e a 3 3 3 2 g g g g 3 3 g g uv3 A uGA0v3m und 83Nv0053x3 do AIA4003md uvsA uCA3vam med 33Nva903x3 do Ashenctue

• 3
• S e.

-*g. 4 M. .*8 - * , e e - A 85 " $3 ~ a ~ 6 R 8 ~

== 'a $5 M S 5 8-a. 8 i s 9 g ]i.8 I"W 5 s zg g -W i Ir L// 9 7 9 T E =2 ? i e T T i a 2 2 5 2 2

• g

~g 'g 't 2 2 2 2 2 2 2 uvaA moA3 van use s3=vons3xa do A3=anosed uv8A uOA3vlu Wad 33Nv088353 do ADNBnOSud e .e . *g - *g - *. E 3 - 't 3 ~5 1 .{ . a, ; i 2 N g o = S. e w s* g' s . a, g - a =

• g 8

"2 e e 3 e e e e = a 's s a 'e 'n 's 8 8 8 8 8 8 8 8 uvaA WoA3,am und 33mvosa3xa do Ashanosud uv5A WQA3TBu mBd 33Nv0BB3x3 do ADNSAOBud M e

a e sg .5o

a. e EE

-s1" -1 ad "- $3

• g "2

~ a . =2 5 N.R

• "3

. %,,5 u u I 4 3 8 = = e \\ g w = w

• g g

o 5 1 e N s - Vg w N<s 5 E ) . *g s i I i "3 t, e e a 9 y 9 9 a 9 3 S S S E I I I 's s s s S uva4 meAnvou us4 asuvosaann eo Annanosu4 uva A moAsunu una aanvosasua no Annanoaus -g -!.. {. 5 -*g. e ~2* 2 w a< lll e .cs a g :: a

• 8

.a .a . I: A I

s..

s,' a 2

a. s

<=

• 8 2

~ Eq g V ;s

s. 2 = t.

.a. g .a 5= - g C -~s E' ! E3 a _ r r e = = 2 S S S 5 's 's 's 's 's ,3 ,3 3 "a ,3 uvnA woAnwsu med nonvassaxa so Aonanosue uvaa meAnysu und samvessous so Ammanoame I

• a en e

a M n . *. lll - *g - C N s v

• 2

_a. 2 ~ . 2 - agg ~* ~ { 3 3 4 = 5

• g

' "2 g f ~ 8 -"a i 6 2 g e a. - han g g i 9 9 9 9 2 2 2 ':2 2 2 'g 'g 's 'g 'g g g g 's g 9 T uvaA meAsysm was sonvoassus so ADNBholme uv8A woA3tBu mae 33nvo333x3 so A3hanotud M 3-Societal risk results can be read directly from Figures III-l and III-2. For example, Figure III-la shows that for Indian Point 2 the median (50th percentile) frequency esti-mate of accidents causing any early fatalities is about 1 x 10-8 per reactor year, that is, once in 100,000,000 reactor years. With 90 percent confidence (certainty) that frequency is no greater than about 1 x 10-7 per reactor year or once in 10,000,000 reactor years. In the case of latent cancer fatalities, as shown in ~ Figures III-le and III-2e, the horizontal axis also shows the percent increase above the background (i.e., non-nuclear) cancer fatality rate. These figures illustrate i that the latent cancer fatalities that could result from an accident at Indian Point represent only a slight increase above the naturally occurring cancer fatality rate. For the purpose of estimating the cancer fatality rate, these latent fatalities are assumed to occur over a 30-year period and within a 50-mile radius of the plant site. For example, for Indian Point 3 (Figure III-2e) the median (50th percentile) estimate of the frequency of accidents resulting in an increase of 0.1 percent or more above the natural cancer fatality rate is roughly 3 x 10-6 or once in 330,000 reactor years. The frequencies of exceeding different levels of var ious health effects shown in Figures III-l and III-2 are presented in Tables III-l and III-2 for Indian Point 2 and I

1 3, respectively. Both the curves and the tables show that the likelihood of the accident decreases sharply as the severity of the accident increases. Economic impacts, as shown in Figures III-lf and III-2f, were computed using the model from the Reacto'. l Safety Study, updated to 1982 dollars. This model is described in Section 12 of Appendix VI of the Reactor Safety Study. The economic impacts estimated include the cost of evacuation, relocation, interdiction, decontamination, and l crop impoundment, but exclude costs associated with damage to the plant. The curves are read the same way as are the health effects curves. The best estimate curves show that the frequency of occurrence of any property damage is no greater than once in 6,700 reactor years for Indian Point 2 l and once in 17,000 reactor years for Indian Point 3. I Tables III-3 and III-4 present the average individual r.isk for four health effects. In these tables, individual risk for each type of health effect was calculated by l I l dividing the total number of such health effects within one mile of the plant by the population within the same area. 1 C. CONTRIBUTORS TO RISK The IPPSS was performed in such a manner that the final results can be " backtracked" to identify the contributors to \\

- TABLE III-l FREQUENCY OF EXCEEDI!G DIFFEREtE LEVEIS OF HEAL'IH EFFECIS - INDIAN POI!E 2 Upper Dound llealth Effect Level Median

• Estimate **

1 Once in 110,000,000 years Once in 10,000,000 years Early 100 Once in 500,000,000 years once in 50,000,000 years Fatalities 1,000 Once in 40,000,000,000 years Once in 800,000,000 years 1 Once in 2,000,000 years Once in 400,000 years Radiation Illnesses 100 Chce in 20,000,000 years Once in 2,000,000 years 1,000 Once in 750,000,000 years once in 40,000,000 years Cancer 1 Once in 15,000 years once in 7,300 years Fatalities (other 100 Once in 23,000 years once in 9,200 years than thyroid cancers) 1,000 Once in 42,000 years Once in 13,000 years 1 Once in 8,500 years once in 4,200 years- 'Ihyroid Cancers 100 Once in 24,000 years once in 16,000 years 1,000 Once in 54,000 years once in 16,000 years Percent Increase 0.01 Once in 23,000 years Once in 9,200 years Above Background Cancer Fatality 0.1 Once in 50,000 years once in 17, 000 years Rate 1.0 Once in 10,000,000 -years once in 1,000,000 years

• 50% Confidence Invel
  • 90% Confidence Level 1

1 l l t

. TABLE III-2 EREQUENCY OF EXCEEDING DIFFEREtE LEVEIS OF HEAUIH EFEECTS - INDIAN PODE 3 Upper Bound Health Effect Level Median

• Estimate **

1 Once in 140,000,000 years once in 10,000,000 years Early 100 Once in 700,000,000 years once in 60,000,000 years Fatalities 1,000 Once in 45,000,000,000 years once in 1,000,000,000 years 1 Once in 6,400,000 years Once in 1,500,000 years Radiation Illnesses 100 Once in 45,000,000 years Once in 5,400,000 years 1,000 Once in 950,000,000 years once in 70,000,000 years Cancer 1 Once in 58,000 years Once in 18,000 years Fatalities (other 100 Once in 170,000 years once in 38,000 years than thyroid cancers) 1,000 Once in 290,000 years Once in 61,000 years 1 Once in 25,000 years once in 4,600 years '1hyroid Cancer 100 Once in 180,000 years Once in 41,000 years 1,000 Once in 350,000 years once in 75,000 years Percent Increase 0.01 Once in 170,000 years once in 38,000 years Above Background Cancer Fatality 0.1 Once in 330,000 years once in 80,000 years Bate 1.0 Once in 100,000,000 years once in 10,000,000 years

• 50% Confidence Ievel
  • 90% confidence Ievel TABLE III-3

' HIE AVERME INDIVIDUAL RISK FOR VARICUS HEAL'Hi EFEECTS - INDIAN IORTT 2 Health Effect Probability Per Year Early Fatality 7.1 x 10-9 Or Once in 13,000,000 Years Radiation Illness 7.4 x 10-8 Or once in 10,000,000 Years Curable 'Ihyroid Cancer 2.4 x 10-8 Or once in 37,000,000 Years Latent Cancer Fatality 6.2 x 10-8 or once in 10,000,000 Years (includirg thyroid cancer) l l l l l e 1

- - - TABIE III-4 TIE AVERAGE INDIVIDUAL RISK FOR VARIGJS IIEAL2: EFFECTS - INDIAR POINT 3 11ealth Effect Probability Per Year Early Fatality 6.4 x 10-9 Or Once in 66,000,000 Years Radiation Illness 2.1 x 10-8 Or Once in 39,000,000 Years Curable Thyroid Cancer 1.5 x 10-8 Or once in 64,000,000 Years Iatent Cancer Fatality 1.6 x 10-8 Or Once in 35,000,000 Years (includirg thyroid cancer)

_ risk. That is, specific initiating events, accident scen-arios, system f ailures, and release categories can be ident-ified to determine their contribution to the overall risk and to identify those which dominate the risk. The dominant contributor to early fatality risk at both plants is an interfacing systems LOCA, an internally initi-ated event with a mean frequency of 4.6 x 10-7 per reactor year, or about once in 2,000,000 reactor years. This accident is initiated by failure of two valves that isolate the residual heat remova.1 (RHR) system from the primary coolant system. Since the primary system is usually at much higher pressure, the failure of these valves can result in an overpressurization of the RHR system, which is a low pressure system, and the loss of primary system water. This rupture also bypasses the containment. Because of the very low frequency of this event, the absolute risk is low. Nevertheless, this event dominates the early fatality risk because the risk from all other contributors is even lower. The major contributors to latent fatality risk at Indian Point 2 are externally initiated events. The largest contributor is severe wind (hurricane), well beyond the highest level ever recorded in the Indian Point area. The i hurricane is assumed to cause loss of AC power which, assuming no recovery, would lead to a late melt and subse-I quent containment overpressurization. The mean frequency of this scenario is 2.7 x 10-5 per reactor year, or once in l 37,000 reactor years. The second largest contributing scenario is initiated by a tornado which causes loss of onsite and offsite power and also other safety related equipment. The mean frequency of this scenario is 1.6 x 10-5 per reactor year, or once in 63,000 reactor years. The next largest contributor is a seismically induced complete loss of power scenario which, assuming no recovery, would lead to a late melt and delayed overpres-surization of containment. The mean frequency of this scenario is 6.9 x 10-6 per reactor year. The major contributor to latent fatality risk at Indian Point 3 is a possible fire in either the switchgear or the cable spreading room, leading to the loss of AC power which, assuming no recovery, leds to late melt and subsequent containment overpressurization. The mean frequency of fires leading to latent fatalities is 6.9 x 10-6 per reactor year or once in 140,000 reactor years. The next largest contri-butor is a large seismic event which causes a loss of control power or a loss of AC power leading which, assuming no recovery, leads to late melt and subsequent containment overpressurization. This scenario has a mean frequency of 2.4 x 10-6 per reactor year or once in 400,000 reactor years. Among the calculated dominant contributors to latent fatality risk at both units are rare and extreme natural events (earthquakes and extreme winds). Some of these

. events produce forces that are far beyond the design capability of most residential, commercial, and public structures, such as bridges and dams and, thus, would by themselves result in substantial fatalities and property damage. For example, the critical structures at Indian Point have estimated wind capacities well above 100 mph, many above 200 mph. By comparison, most residential and commercial structures _ have either not been engineered to resist lateral wind or tornado loadings, er have been designed to a building code to withstand wind loadings of about 15 to 20 pounds per square foot, which corresponds to windspeeds of about 75 to 88 mph. Therefore, damage to residential and commercial facilities will occur at much lower windspeeds than would affect the Indian Point plant structures. In these cases it is more accurate to view the risks at Indian Point as an increment above the direct effects caused by these events. The IPPSS conservatively does not take this approach. D. COMPARISON WITH NUCLEAR REGULATORY COMMISSION SAFETY GOALS On February 17, 1982, the Nuclear Regulatory Comm'ission issued NUREG-0880 " Safety Goals for Nuclear Power Plants: A Discussion Paper," (Reference III-1) which proposed safety goals for nuclear power plants. On January 10, 1983, the Commission adopted primary and secondary safety goals for nuclear power plants. The primary safety goals are set forth with respect to individual and societal risk. The secondary safety goal is set forth with respect to the risk to the plant (core melt frequency). This section compares the risk of the Indian Point plants with the primary safety goals. A discussion of the secondary safety goal is pre-sented in Section V-D of this testimony. 1. Individual Risk The Commission safety goals state that the early fatal-ity risk to an average individuall in the vicinity of a nuclear power plant should not exceed one-tenth of one per-cent of the early fatality risk to that individual from non-nuclear accidents. Similarly, the individual risk of latent fatalities from a nuclear accident should be less than one-tenth of one percent of the risk of cancer fatality to that-individual from non-nuclear causes. To translate these goals into numerical form, we observe that the United States national average non-nuclear accident risk (Reference III-1) is five fatal accidents per 10,000 people per year (5 x 10-4 per year). One-tenth of one percent of that risk is five fatal accidents per l 1. The average individual in the vicinity of the plant is defined as the average individual biolcgically (in terms of age and other risk factors) and locationally who resides within a mile from the plant site boundary. This means that the average individual is found by accumulating the esti-mated individual risks and dividing by the number of indi-viduals residing in the vicinity of the plant. l .~.

. 10,000,000 people per year, i.e., 5 x 10-7 per year. The national average cancer risk for a person in the United States (Reference III-1) is two deaths per 1,000 people per year (2 x 10-3 per year), and 0.1 percent of that is two deaths per 1,000,000 people per year (2 x 10-6 per year). For the purpose of individual risk, the Commission defines " vicinity" of the plant as a one mile radius. For this radius from the Indian Point plants, the average individual risk of early and latent fatality has been cal-culated based on the evacuation model used in the IPPSS and is compared with the Commission goals in Table III-5. The risk of the Indian Point plants is well within these safety goals. 2. Societal Risk For societal risk, the Commission goal is that the risk to the population in the vicinity of a nuclear power plant should likewise be less than one-tenth of one percent of the non-nuclear risk. For early fatalities, vicinity is defined as one mile, and for latent cancers it is 50 miles. The population within one mile of Indian Point is about 2,500 and within 50 miles it is 17.5 million (Section 6 of the IPPSS). Within these radii the early and latent cancer fatality rates are: Early fatalities frm non-nuclear = 5 x 10-4 x 2,500 = accidents within one mile radius 1.2 fatalities per year Cancer fatalities fran non-nuclear = 2 x 10-3 x 17.5 x 106 = sources within 50-mile radius 35,000 fatalities per year TABLE III-5 COMPARISON OF INDIVIDUAL RISK

• FROM INDIAN POINT PLANTS WITH NRC SAFETY GOALS Indian Point Indian Point NRC Goal 2

3 Early Fatalities 7.1 x 10-9 6.4 x 10-9 5 x 10-7 Latent Cancer Fatalities 6.2 x 10-8 1.6 x 10-8 2 x 10-6 Average probability of fatality per year per person for people living within a one-mile radium of the Indian Point site. 1 1 TABLE III-6 COMPARISON OF SOCIETAL RISK FROM INDIAN POINT PLANTS WITH NRC SAFETY GOALS Indian Point Indian Point NRC Goal 2 3 Early Fatalities

• 1.7 x 10-5 1.6 x 10-5 1.2 x 10-3 Latent Cancer Fatalities **

2.1 x 10-1 5.0 x 10-2 35 Average number of (early) f atalities per year among those people living within a one-mile radius of the Indian Point site.

• • Average number of (latent) f atalities per year among those people living within a 50-mile radius of the Indian Point site.

t l l

.._ l The safety goals are one-tenth of one percent of these numbers. The risk from the Indian Point plants is well within these safety goals. i 1 1 l E. REFERENCES III-l NUREG-0880, " Safety Goals for Nuclear Power Plants: a Discussion Paper," February 1982. .l I i f 1 1 l {

. IV. INITIATING EVENTS A. INTRODUCTION The first step in a risk analysis is to compile a list of initiating events. Initiating events are occurrences which cause a departure from normal plant operation, and can arise from circumstances either internal or external to the plant system. Internal initiating events include items such as loss of feedwater flow, loss of AC or DC power, turbine trip, operator error, and pipe failure. External initiating events include events such as earthquakes, floods, high winds, aircraft crashes, and transportation of hazardous materials. Fire, flooding from plant systems, and turbine missiles are also classified as external events. B. INTERNAL INITIATING EVENTS A number of information sources were used to help identify those internal initiating events that could cause a departure from normal plant operation. They include the Indian Point 2 and 3 Final Safety Analysis Reports (FSARs), Licensee Event Reports (LERs), Electric Power Research Institute (EPRI) reports, the Reactor Safety Study, various Westinghouse studies, and Indian Point plant specific reports. Each of the identified internal initiating events was placed into one of 12 initiating event categories ~ according to the logic displayed in Figure IV-1. Specific internal initiating events are listed in Table IV-1. C. EXTERNAL INITIATING EVENTS Before a nuclear power plant site is approved, engi-neers and other experts conduct detailed site investigations which consider all external events that could potentially damage the plant. The results of these investigations are contained in the FSAR and were used as a basis in the IPPSS for identifying external occurrences that might be initiating events. In addition, updates of information and data bases were obtained from agencies in Federal and local Governments, and from appropriate industrial and commercial organizations. The following external initiating events were considered in the IPPSS: o Seismic o Fire o External Floods o Flooding from Plant Systems o Turbine Missiles o Wind and Wind-Induced Missiles o Aircraft Accidents o Transportation and Storage of Hazardous Materials o Gas Pipeline Rupture +

LE W L ' Cont OAuAGE I I I CORE COOLING l g uCE $5 LOSSOF LavtL 88 I CDeeponte Q l l PneuARV COOLANT tN5Uf f ectENT CDat U YI L '" 00UNDA AY F AILuaf Det AT AtuovaL Q l I OIRECT $NO3AtCT 0 LEVtL 8V INITIATORS INITtATOAS b OJ l I I I 7 I I I I I i 1

uvat, 9.

3. x 4 S. 9. 99. II. LAaGE MtOIUne suALL LE AE AOS LOSB OF LOES OP LOSS OF Tune NE atACTOR Sit Au STt AM Cont LOCA LOCA LOCA to PaiuAaY Ft t Owaf t h ST E A M T AIP T AIP

1. 8LEASg at LE A38 POwtA SetDNDARY COOLANT FLOW FLOW INSIOg IOtuaNOB INCAEASE COOLA86 FLOW CONTasts.

'0,I , q, Mthf stNT 3,9 3.3 13 41 SI 89 3.1 S.t 91 le 1 11.9 13 9 g,3 32 33 43 $3 63 7.3 49.9700 3e.9.170101 10 3 31.3 53 3 9.3 3.3 3.3 S3 43 3.3 et e3 10 3 19.3 13 3 9.4 3.4 34 84 83 93 10 4 18.4 13 4 LivtL VI g 83 as 69

• KtFER TO TASLE 8V4 FCG IOt NTIFICATION OF Nuut meCAL COOTS Figure IV-1.

Indian Point 2 and 3 Core Damage Master Logic Diagram

INDIAN POINT UNITS 2 AND 3 SPEClFIC INITIATING EVENTS AND INITIATING EVENT CATEGORIES 1. LARGE LOSS OF COOLANT ACCIDENT (blowdown greater than 6-inch pipe 8.1.3 Loss of condenser vacuum rupture) 8.1.4 Loss of circulating water 1.1 Pipe Failures 8.1.5 Throttle-valve closure / electrohydraulic control 1.2 Valve Failures p oblems 1.3 Vessel Failures 8.1.6 Generator trip or generator-caused faults 1.4 Other Large LOCAs 8.1.7 Turbine trip due to overspeed 8.1.8 Other turbine trips 2. MEDIUM LOS$ OF COOLANT ACCIDENT (blowdown in range of 2 to 6-inch pipe rupture) 8.2 Turbine Trip Due to Loss of Offsite Power 2.1 Pipe Failures 8.3 Turbine Trip Due to Loss of Service Water 2.2 Pressurizer Safety and Relief Valve Failures (multiple) 2.3 Other valve Failures 9. REACTOR TRIP 2.4 Other Medium LOCAs 9.1 Reactor Trip 9.1.1 Control rod drive mechanism problems and/or rod drop 3. SMALL LOSS OF COOLANT ACCIDENT (Blowdown less than 2-inch pipe 9.1.2 High or low pressurizer pressure rupture) 9.1.3 High pressurizer level 3.1 Pipe Failure 9.1.4 Spurious automatic trip--no transient condition 3.2 Pressurtzer Relief Valve or Safety Valve Failure 9.1.5 Automatic / manual trip--operator error 3.3 Other Valve Failures 9.1.6 Manual trip due to false signal 3.4 Control Rod Drive Mechanism Failures 9.1.7 Spurtous safety injection. 3.5 Reactor Coolant Pump Seal Failure (4 or less) 9.1.8 Spurious trip--cause unknown 3.6 Other Small LOCAs 9.1.9 Primary system pressure, temperature, power tabalance 9.1.10 Other reactor trips 4. LEAKAGE TO SECONDARY COOLANT 9.2 Reactor Trip Due to Loss of Component Cooling Water 4.1 Single Steam Generator Tube Rupture 9.3 Reactor Trip Due to Loss of DC or AC Power 4.2 Other Steam Generator Leaks I

10. STEAM RELEASE IN510E CouTAINMENT 5.

LOSS OF REACTOR COOLANT FLOW 10.1 Steam Pipe Rupture Inside Cont.inment am 5.1 Loss of Reactor Coolant Flow in One Loop 10.2 Feedwater Pipe Rupture Inside Containment 5.2 Loss of Reactor Coolant Flow in All Loops 10.3 Steam Relief valve or Safety Vavles Open Inadvertently 5.3 Other Losses of Reactor Coolant Flow (included with inside containment group for functional reasons -- leak upstream of M51VS) 6. LOSS OF FEEDWATER FLOW 10.4 Other Steam Releases inside Containment 6.1 Feedwater Pipe Rupture Outside Containment 6.2 Loss / Reduction of Feedwater Flow in One Steam Generator

11. STEAM RELEASE (DEMAND) DUTSIDE CONTAINMENT 6.3 Loss of Feedwater Flow in All Steam Generators 11.1 Steam Pipe Rupture Outside Containment 6.4 Feedwater Flow Instability - Operator Error 11.2 Throttle-Valve Opening / Electrohydraulic Control Problems 6.5 Feedwater Flow Instability - Mechanical Causes 11.3 Steam Dump valves Falling Open 6.6 Loss of One Condensate Pump 11.4 Other Steam Releases Outside Containment 6.7 Loss of All Condensate Pumps 6.8 Condenser Leakage

12. CORE POWER INCREASE 6.9 Other Secondary Leakage 12.1 Uncontrolled Rod Withdrawal 12.2 Boron Dilution--Chemical volume Control System Malfunction 7.

PARTI AL LOSS OF STEAM FLOW 12.3 Core Inlet Temperature Drop 7.1 Full Closure of Main Steam Isolation Valve (MSIV) 12.4 Other Positive Reactivity Addition 7.2 Partial Closure of Main Steam Isolation Valve 7.3 Other losses of Steam Flow 8. TUR8INE TRIP 8.1 Turbine Trip (general) 8.1.1 Closure of all main steam isolatten valves 8.1.2 Increase in feedwater flow in one or more steam generators

r The three most significant external initiating events are earthquakes, fire, and wind. The remaining external initiators were found to have either extremely low fre-quencies of occurrence for events greater than the design basia or their effect on the plant was minimal. An example of the latter is external flooding. The grade elevation of the buildings at Indian Point is higher than the maximum sustained water level that could occur from external flood-ing even if dam failures occurred concurrent with spring high tides, a hurricane, and wind-driven waves. It has been estimated that the frequency of water levels exceeding grade is somewhere between once in a hundred million years to once in a trillion years. To place this in perspective, the Earth is approximately four billion years old. Conse-quently, external flooding is not an important contributor to the risk. For the most important external initiating events, var-ious degrees of severity were postulated, and the capacities of buildings and equipment to resist these conditions were analyzed. Logic diagrams similar to those used for analyz-I ing internal initiating events were used to evaluate the effects of the possible building and equipment failures on the plant systems and containment. The characteristics of the important external initiat-ing events are discussed below. A detailed discussion of the effects of external initiating events on the plant and containment appears in Section 7 of the IPPSS. 1. Earthquakes Two stadies v7re performed to assess the seismic activ-ity in the regions around Indian Point. In these studies, earthquake magnitudes larger than those which have actually occurred in the past were considered and frequencies for various levels of effective peak ground acceleration corre-sponding to Cifferent sized earthquakes were developed along with uncertainty estimates. Ground acceleration was then used as a parameter against which to estimate the probabil-ity of f ailure of plant structures and components from all these earthquakes. Earthquakes with effective peak ground accelerations up to.8g were postulated in the IPPSS to occur in the vicinity of Indian Point. The largest acceler-ation expected within a 500-year period is less than.lg. The largest earthquake experienced in the New York Highlands did not exceed Intensity V (Modified Mercalli Scale) and several events in the New Jersey Highlands were Intensity VI. These represent the largest historical earth-quakes that could have affected Indian Point. By defini-tion, the most damage that earthquakes of these intensities could inflict on residences and other structures is come possible breaking of glass windows, items falling off shelves, and cracking of weak plaster or unreinforced masonry.

1 To put some perspective on earthquakes of the magnitude necessary to cause serious damage at the Indian Point site, we can consider the possible damage.to residences and other conventional structures and storage-vessels in the vicinity of the site from the acceleration levels. The older structures were not engineered to resist lateral forces, particularly earthquakes. For guidance, however, the Modified Mercalli Scale indicates that these types of [ structures can be expected to be heavily damaged or destroyed at earthquake Intensities of VII or VIII, with elevated tanks (such as gas storage tanks) and underground pipes also likely to fail. While not exact, these inten-sities relate to ground accelerations of about 0.19 to 0.39 Earthquakes of this size can be expected to cause heavy damage to residences and other conventional structures-i and would result in injuries and loss of life to the public, 1 i while hardly large enough to threaten even the weakest Indian Point critical structure or equipment.1 2. Fires An evaluation of the plant was performed to determine critical locations where a fire might damage important equipment or cables, thereby initiating an accident s.cen-ario. The frequency of fires in the-plant was established-1. Pickard, Lowe and Garrick, Inc., "A Perspective on the Seismic-Initiated Hazard from the Indian Point Nuclear ~ Generating Station," December 1982. from information obtained from American Nuclear Insurers, LERs, and technical literature as cited in the IPPSS. Historical evidence on fires was augumented by engineering judgments and conservative assumptions to estimate the frequency and effects of large fires. Fires in critical locations are unlikely because of precautions that have already been taken, particularly fol-lowing the Browns Ferry fire, such as emphasis on nonflam-mable materials, administrative controls, fire barriers, and fire detection and suppression systems. Only fires involv-ing large quantities of combustible materials in critical locations could lead to serious plant damage. Such condi-tions do not exist at Indian Point. Therefore, only large quantities of transient combustibles are of concern. 3. Extreme Wind The frequencies and magnitudes of extreme winds that l could occur at the Indian ~ Point site were studied. Historical data on tornadoes, hurricanes, extra-tropical cyclones, and other extreme winds were obtained from the National Bureau of Standards, National Oceanographic and l Atmospheric Administration, Environmental Sciences Services Administration, and other United States Government and local organizations, as well as from the technical literature cited in the IPPSS. The highest recorded wind gust at the site is 81 mph at a height of 400 feet above ground. Sustained windspeeds of

! 100 mph are predicted to have a me6ian occurrence rate of once in 1,000 years. The most vulnerable critical struc-tures at Indian Point are estimated to have wind capacities I well over 100 mph, most over 200 mph. Forces-associated with extreme wind sufficiently intense to cause damage to critical structures at Indian Point would be very rare. In the case of hurricanes,,the incremental risk due to the operation of the Indian Point plants would be small because 1 l widespread offsite damage would occur as a direct result of the event before there would be any failures at Indian l Point. D. UNIDENTIFIED SCENARIOS The IPPSS constitutes an extensive and systematic attempt to identify and quantify all conceivable accident scenarios which have the potential to significantly threaten the public health and safety.1 Nevertheless, it is prudent I to assume'that other scenarios exist. Although these scen-arios are by definition unidentified, important genere.1 con-clusions aLout' their frequencies and consequences can be made: 1. These scenarios must have a low fre-l quency of occurrence because an exhaustive search was made to identify all initiating events and equipment l l 1. War and sabotage, however, were deliberately not l included in the IPPSS. i 1

d failures that have occurred at operating nuclear power plants. Thus, major contributors to risk are not likely to be omitted. Furthermore, the master logic diagram (Figure IV-1) and the event tree / fault tree methodology pro-vide a systematic framework for identi-fying the events and failures that could lead to plant damage. Scenarios which might have been overlooked in the analy-sis are likely to be rare, because the analysis considered all those events which have been identified in the com-bined years of nuclear plant operating experience, those which have been uncov-ered by safety experiments and analyt-ical studies conducted to date, and those which have been identified by critics of nuclear power and other re-view groups. The frequency of the cate-gory of " unidentified scenarios" de-creases with time, as the body of knowl-edge, techniques for identifying such scenarios, and operating experience grey. Previously unidentified scenarios may theoretically occur at any operating nuclear power plant. For an unidenti-fled' scenario to have a direct adverse impact on the population surrounding Indian Point, therefore, it must occur i at this site first. If such a scenario were to occur at another nuclear power plant, its relevance to Indian Point would be investigated and corrective measures would be taken as appropri-l ate. Because the Indian Point plants represent about a one percent sample of the total number of operating nuclear power plants in the Free World, the likelihood of an unidentified scenario occurring first at Indian Point is l correspondingly small. l Such unidentified scenarios must i develop rapidly or in a manner that overcomes the various in-service inspec-tion tests, It would otherwise be de-tected by plant operators. Even if such an unidentified accident were to occur, it must either bypass the containment or overcome containment integrity to affect the public; the IPPSS analysis demon-strated that very few accidents are capable of doing this. 2. A great deal about the potential conse-quences of these unidentified scenarios is known. The consequences of any unidentified scenario would likely be no more severe than those of scenarios already in the study. From the analysis of the consequences of these identified scenarios, it is known that it takes special (i.e., infrequent) weather con-ditions to obtain the maximum conse-quences. Therefore, the effects on the public from such an unidentified acci-dent scenario are likely to be no more and probably less severe than those already investigated. 3. Based on the above frequency and conse-quence characteristics of unidentified scenarios, the contribution of unidenti-fled scenarios to the overall risk is thought to be small. I i V. PLANT RESPONSE ANALYSIS A. INTRODUCTION A summary of the analysis of the plant response to the initiating events discussed in Section IV of this testimony is presented in the following subsections. First,-a basic plant response model was developed for the internal initi-ating events. This model delineates the system functions needed to avoid core damage and to protect the contain-ment. This model is used to calculate the probability that these functions are successfully provided. The plant response model used for internally initiated events is also used to analyze external initiating events. Because of the similarity of the plant response to internal and external initiating events, the plant response to external initiating events can be modeled as one or more internally initiated accident sequences. 8 B. PLANT RESPONSE TO INTERNAL INITIATING EVENTS Plant response to internal initiating events is discus-sed in terms of an overall event tree model supported by detailed systems analyses. Normal plant response is first examined and then the model is extended to ir.clude abnormal events. The structure of the plant response model begins with a " plant functional event tree" (Figure V-1) which

NUCLEAR CONTAINMENT INITIATING CORE CONTAINMENT REACTION RADIOACTIVITY SEQUENCE EVENT COOLING COOLING . SHUT DOWN SCRUBBING 1 2 3 4 5 6 8 7 EVENT TREE CONVENTION: 8 l lNITIATING l SYSTEM l SYSTEM l 'g l EVENT l l l 8 10 l I l l 1 i SYSTEM i @ SUCCEEDS 11YSTEM l i l YU1 FAILS l l 1 I l I Figure V-1. Plant Functional Event Tree P -

, describes the basic safety functions needed to protect the reactor core and the containment. By use of " plant response matrices" (Figure V-2), this general functional tree is then converted to several specific " plant event trees" (Figure V-3). " Plant response matrices" show the expected plant response to each initiating event and help define the specific parameters and systems of interest for the con-struction of the detailed, Indian Point specific plant event trees. These plant event trees define the scenarios to be analyzed in terms of specific functional criteria on plant systems and operations. These criteria are analyzed qual-itatively in the " systems analyses." Both the plant event trees and systems analyses account for various types of " common cause f ailures. " Finally, a state-of-knowledge " data base" is developed for use in the "quantification of the plant event trees." After sorting and totaling contri-butions of the accident scenarios to each plant damage state, the results, that is, the plant response to internal initiating events, are assembled. 1. Plant Functional Event Tree As an aid to analyzing the plant's response to an i initiating event, a plant functional event tree was devel-oped to describe the basic plant safety functions that are necessary to protect the plant and core and minimize release of radioactivity. These basic safety functions are reactor

AUTOh ATIC SAFEGUARDS SA F E T Y INJE CTION 7 SEOutNCE db JL JL JL StGh a t bU 58GN A L 4-k E 1 g RE ACTOR TRer t g'I l 0 F E E DmATE R 3 g g ISOtATION 4*3 I E UNtf TRIP AND 00 Teuf 8 Enno v eus aFR. I,,4 Ot ta v 2 WN. M gygggL ggy. L -&---- 2n I 4 START a SAptfy a 4-l eeufc1.oM SERvtCE I WATER a CONT AtN. e LDO. I 2 F AN COOtt RS I ASW 2 It tt CTRICI l CDNT AINME NT u g $PR AY ACTUATM)N F i 'g 7 j CONT AIN. 850t. PNAst a l 2 u sn 4 I I > 2 Mem Y NuON Jk ADOETtON I l t t coNTAeN. sot. 'P JL g g l PHASE A 7 AN l l l w. ODNTAtNMENT , II V( NT. fSOtA f TON I l r I i l I i "m Co.NTROOuT,0N v NT.. t R*= i ar I I I I m.Ot AT.ON A-oh. l l iSOt vAtva in 4-- I g l l l se At WATem a 26 I I I I I f CONNECT FUNCTIONS 83 2. = 1 7., i ", I ig' 1 5 ACTUATION $lGN AL Y. 3 ! !o ! ! E= i g' r E E38 EISI i$ $$5 $$.$YII i. II E$ idi !- I! E3 C.-

• E.-

IE E 5 "1g "1 h7 Ehg $hEU zgd $50 z! EEC 5 igo

3. 3 73 7

!?: 75 RESET SIGNAL 37@" z$3r 181 $h IST 8 "" zue

E 17 hT" g2 18

.,1 ash $s joe I.s i.31 .AND OR n 4 Figure V-2. Typical Plant Response Matrix - Safeguards Actuation System

t. g ff o Lg g T l Ev Ca fT NO S M M M M M m gN J tC S tEut E E G t S G ot C C C C C C C C C C C C C C LV ta C 9 C C C F C C C P C P P P C C C F F F C C C r C C C C C C p PE L G G G E t E t E G G G t e G G t e G E E E t t t SC U L U L U L U L U L U S A S A 9 A S A S A 9 A A A A A A A A A A A A A A A A A A A A A A A A A E C 7 1 3 e 5 8 N e 9 0 8 t 3 8 s M7 N o e 1 3 3 3 3 3 t t 2 3 e 9 e 7 S 9 o 9 3 3 a 9 8

• l 1

3 3 t 3 3 a s 3 3 t t 1 9 l 9 9 uo t S N T O N I t T ) uVA 1 NAt$ m AuA aPC e ts$RI e a o C r E C ,I g' ,3 T tI t smO n I e tT KA v w$u E Utl ' O S a ( c LE n Ri PC A E C R ,I ,I I ,I lI Il lI O L T N e E S g R WNtt r tAtf a aFOC T O L N C O C ,i ,I e er d T oN nO wuI t soTA OaOaN n CDD e S YA v H E t n a T N l E P WAv 5 Ia C c Ap i Ts ~ N f O i C c e p S tgno f W u y, I o 4 O*gr tgt e L ag P, l p ma x N E .NO VOIL TIT T E A C UO SAMT' 3 5 SNC IA V er u g i T 5 R F W T R E A G s. RC T C A E L L

. shutdown, core cooling, containment cooling, and radio-activity scrubbing. 2. Plant Response Matrices Instruments throughout the plant monitor its status. Examples are devices that measure containment pressure and radiation level, pressures and liquid levels within the primary and secondary portions of the plants, temperatures, flow rates, and pressure differences. Deviations from the normal operating ranges of the monitored variables are detected and signals are sent to take corrective actions. These corrective actions may be initiated both automatically and manually (i.e., by the plant operators). Depending on the severity of the initiating event that caused the plant to depart from the normal operating range, a number of safety systems are activated. For each of the 12 initiating event categories listed in Section IV, a plant response matrix was developed to dis-play the plant response logic from both automatic and manual actions. Figure V-2 is a typical plant response matrix where the monitored plant parameters are in the bottom row of blocks, e.g., high containment pressure, and the systems that are actuated are displayed in the right-hand column of blocks, such as reactor trip, in response to signals from specific plant parameters. These models of designed plant response were a source of information for detailed modeling of abnormal events described below. The models facilitated communication and helped bring the' operators into the plant modeling process. 3. Plant Event Trees Based on the information in the plant response matrices and plant functional event trees, a much more detailed logic d iag ram, the plant event tree, is developed (as an example, Figure V-3 presents the plant event tree for a large LOCA). A plant event tree was constructed for each of the 12 internal initiating event categories. The plant event trees are graphic displays of the system response logic and relate initiating events to core damage. In other words, given that an initiating event has occurred, they define which plant systems must respond to mitigate the effects of the initiating event and thus avoid core damage or, if core damage occurs, what type of in-plant condition will result. 4. Systems Analysis The systems that must operate to accomplish the safety functions identified in the plant event trees were analyzed in detail to determine their reliability. System dependen-cies, including dependencies on auxiliary, shared, or con-nected systems, were considered. Specifically, the analysis of each system included con-sideration of states of electric power, auxiliary system availability, interfacing system availability, and actuation signal availability. The Indian Point FSARs, system descriptions, schematics, piping and instrumentation dia-

i - grams, operating and emergency procedures, as well as exten-sive review by the designers and operators of the' plant, were used in the development of the system block diagrams l and system fault tree diagrams to ensure accurate system modeling. The system' fault trees were used to identify and display combinations of components whose failure could cause system failure. 5. Common Cause Failures 1 Multiple failures of safety equipment can result from a common cause.- Failures of common support equipment such as power supplies or cooling -systems have been explicitly modeled in the plant event trees or system fault trees. Human errors such as faulty maintenance, misinterpretation of plant conditions, and sequentially compounded errors.were-included in the systems analyses. Initiators such as earth-quakes or tornadoes that could disable multiple systems were explicitly modeled, as discussed later in this section. Other environmental factors with common cause potential, such as excessive humidity or dirt, were considered in each system analysis. l 6. Data Base Industry-wide data were collected and applied to pro-1 i vide initial probability distributions or generic distribu-tions, which were then supplemented with specific data from Indian Point for use in the study. The mathematical i technique used to combine the industry-wide and plant 3 e 1 specific data is Bayes' theorem, a technique which accom-modates all available data. Four types of data were used: component failure. data; maintenance and testing data; human error rates; and initi-ating event frequency data. The sources of these data are described below. a. Component Failure Data Indian Point Licensee Event Reports (LERs), control room equipment operating logs, component maintenance records, test records, and station internal event reporting documents from Indian Point were the source of data regard-ing Indian Point specific component failures. The industry-wide data were obtained from the NRC NUREG data summaries, IEEE STD-500, Nuclear Plant Reliability Data System, and the Reactor Safety Study. The Indian Point Unit 2 and 3 component failure and unavailability distributions, as well as the industry-wide data, were used to quantify the system logic models. b. Maintenance and Testing Data System availability is reduced when components are removed for maintenance or testing. Indian Point mainte-i nance and testing records were reviewed to identify the frequency and duration of maintenance and testing activi-ties. Industry-wide data for maintenance frequency and duration were developed based on the equipment specifica-tions, component normal service duty, the Reactor Safety Study, and experience with each component type. The Indian Point Unit 2 and 3 unavailability data, combined with the industry-wide data, were used to quantify the system logic models. c. Human Errors To the extent that human beings design, construct, operate, and maintain the plant, it is impossible to fully isolate the role of human interactions from any of the dependencies discussed previously in terms of hardware interactions. Hence, all of the common cause analysis methods described above pertain directly or indirectly to human interactions. Human interactions can directly cause initiating events. Such actions are imbedded in the IPPSS initiating event data. The procedure for analysis of intersystem and intercomponent dependencies caused by human interactions is to include human errors of omission and commission explic-itly in the event trees and system cause tables and to selectively use the human reliability saethods of Swain's human reliability handbook (Reference V-1) to implement quantification. A starting point for the identification of specific errors is the analysis of operation and maintenance procedures. This is especially important if operator action is required to effect actuation of a system or collection of systems. Additional insights into the enumeration of actions is gained upon the simulation of event sequences

- using computer models. Consideration is also given to possible incorrect judgments as to the plant state and subsequent implementation of the wrong procedures. Human errors were assessed for scenarios in the event tree and systems analyses. The general dependence relations of the human reliability handbook were used as a consistent basis for these assessments. Each analyst developed a dependent error model that was compatible with the specific testing, maintenance or operator action scenarios for his system. It is believed that tiie treatment of dependence does reflect the uncertainties in our state of knowledge and is neither optimistic nor pessimistic. d. Initiating Event Frequency Data The Indian Point plant operating reports, EPRI reports, and the NRC Operating Units Status reports were reviewed to obtain plant specific and industry-wide data on the fre-quency distribution for initiating events. Data from 30 nuclear plants were examined to provide the industry-wide data, which were then supplemented with Indian Point specific data. The resultant Indian Point frequency distri-butions were used in the quantification of the plant event tree sequences. 7. Quantification of the Plant Event Trees a. Systems Analysis The frequency of successful performance of each system was quantified using the component failure, maintenance,

_ testing, human error rate, and common cause probability distributions particular to each Indian Point unit, b. Plant Analysis Each path through each plant event tree was quantified using the Indian Point plant-specific and industry-wide internal initiating event frequency distributions and the event tree branch point frequency distributions from the systems analysis. Groups of sequences with similar effects on the plant were combined into a reduced number of " plant damage states" and their frequencies were determined. These physical conditions of the plant are then the entry states (initial conditions) to the containment response analysis. 8. Results - Plant Response to Internal Initiating Events Thousands of individual event sequences were quantified for each Indian Point unit. Only a very few of these have any impact on the calculated health effects. The leading internal initiating event contributors to the core melt frequency can be found in Tables V-1 and V-2. The most important internal initiating event at Indian Point 2 and 3 is the interfacing systems LOCA which involves the failure of two valves that isolate the reactor coolant system from the RHR system. Although this scenario is not a major contributor to core melt, it is important because it would bypass containment and would lead to early fatalities. The mean frequency of occurrence of this scenario is only 4.6 x 10-7 per reactor year at each plant. C. PLANT RESPONSE TO EXTERNAL INITIATING EVENTS The external initiating events discussed in Section IV of this testimony can potentially cause failure of plant equipment or cause failure of structures that house plant equipment. The plant response to such failures was evalu-ated with the same plant response model used for internal initiating events, which is summarized in Section V-B of this testimony. The leading external initiating event contributors to core melt and their mean frequencies can be found in Tables V-1 and V-2. A detailed discussion of the plant response to external events appears in Section 7 of the IPPSS. The methods used to analyze the major external events are summarized below. i 1. Seismic Analysis The response of plant structures, equipment, and com-1 ponents to seismic events can be represented by the peak ground acceleration at which failure occurs. Failure of structures housing vital equipment cn: components was defined as occurring when structural deformations interfere with the I operability of equipment attached to the structure. Such deformations do not necessarily lead to structural col-lapse. Failure of electrical and mechanical equipment was defined to occur when essential functions could no longer be performed. Failure of piping was defined as rupture of the 1 pressure boundary. The failure of each plant element that could affect the plant's safety was modeled using fault trees. The design basis earthquake for the Indian Point plants has an acceleration of 0.159 Indian Point safety related structures and equipment are designed to withstand such earthquakes without loss of function. Detailed studies of these safety related structures and equipment show that their actual capability to withstand seismic events consid-erably exceeds the design basis value (see Tables'7.2-3 and 7.2-7 of the IPPSS). The safety related equipment with the lowest median acceleration capabilities for both plants is in the 0.79 to 0.9g range. It is likely that even the least capuble of these Indian Point components would survive very large earthquakes. Other safety related equipment has even higher median acceleration capabilities and are available to limit the consequences of seismically induced failures. With regard to the containment structure itself, it is strong enough to withstand the largest earthquake that can be reasonably postulated for this area. The contribution of seismic events to core melt frequency is given in Tables V-1 and V-2. 2. Fires The evaluation of fires is composed of six major steps: o Identification of critical areas within the plant. o Calculation of the frequency of fires in these areas. o Calculation of the probability of fire propagation considering fire barriers and extinguishing equipment. o Assessment of potential fires that might initiate an accident, o Assessment of the effect of fires on mitigating systems. o Calculation of the frequencies of the various plant responses and release categories which could result. The risk from fire at both units is low b'ecause of the implementation of plant modifications in compliance with the requirements of Appendix R of 10 C.F.R. Part 50. These mod-ifications include the capability to supply power to various safety components by routing additional cables which are physically separated from normal cable routes. Because of this additional cable routing, fires in locations such as the cable spreading room, the switchgear room, the electri-cal tunnel and penetration area, and the motor control l center area are far less likely to have any risk implica-tions. Indian Point 3 is in the process of implementing Appendix R. The contribution of fires to core melt frequency is given in Tables V-1 and V-2. l 3. Extreme Wind The capacity of structures and exposed equipment to withstand the effects of wind loading and tornado missiles was evaluated. For Unit 2, the dominant sequences initiated by wind which can lead to latent fatalities are the loss of offsite and onsite power and failure of the control building. For Unit 3, and at a lower frequency, they are loss of offsite power, and f ailure of the auxiliary feed pump building and service water pumps. t Because of the capabilities of containment, potential wind-initiated accidents cannot by themselves lead to releases which could cause early fatalities. The contri-bution of wind to core melt frequency is given in Tables V-1 and V-2. 4. Other External Events Other external initiating events such as floods, turbine missiles, transportation accidents, and aircraft crashes are mince contributors to the risk and core melt frequency of both units. D, CORE MELT FREQUENCY Mean core melt frequencies from internal and external initiators are given in Tables V-1 and V-2 for Indian Point 2 and 3, respectively. Core melt frequency is a poor indicator of public risk. This can be shown in two ways. I I i

i First, 65 percent of the postulated core melt scenarios at Indian Point 2 and 90 percent of those at Indian Point 3 do not lead to significant releases of radioactive material to the environment. Second, 97 percent of the calculated early fatality risk at each plant is due to the interfacing systems LOCA which contributes about one-half of one percent to the core melt frequency. On the other hand, core melt frequency is a useful indicator of economic risk to the customers and owners of Indian Point 2 and 3, as it is a measure of the likelihood of losing the benefits of these plants. Table V-3 shows the comparison of the Indian Point 2 and 3 core melt median frequency with the Commission safety goal. Because the Zion PRA and the IPPSS are the only risk assessments of which we are aware that give comprehensive treatment to external events, Table V-3 also includes the core melt frequency coming from internal initiating events only. Considering internal initiating events only, both Indian Point plants meet the Commission safety goal. l E. REFERENCES V-1. Swain, A. D., and H. E. Gu t tman, " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power I Plant Applications," NUREG/CR-1278, October 1980. l TABLE V-1 CONTRIBUTORS TO CORE MELT FREQUENCY Indian Point 2 Internal Initiating Events Mean Core Melt Frequency (Per Reactor Year) 1. Turbine Trip Due to Loss of Offsite Power 2.9 x 10-5 2. Small LOCA 1.6 x 10-5 5 3. Large LOCA 1.6 x 10 5 4. Medium LOC 1 3 x 10-5. Other's 4.4 x 10-6 Subtotal (Internal) 7.8 x 10-5 External Initiating Events 5 1. Wind 4.3 x 10 5 l 2. Fire 2.7 x 10-3. Seismic 7.9 x 10-6 Subtotal (External) 7.8 x 10-5 TOTAL (Internal Plus External) 1.6 x 10-4 l l i = TABLE V-2 CONTRIBUTORS TO CORE MELT FREQUENCY Indian Pcint 3 Internal Initiating Events Mean Core Melt Frequency (Per Reactor Year) 1. Small LOCA 8.8 x 10-5 2. Large LOCA 6.5 x 10-6 3. Loss of Offsite Power 4.7 x 10-6 4. Medium LOCA 2.2 x 10-6 5. Others 1.6 x 10-5 Subtotal (Internal) 1.0 x 10-4 External Inititing Events 1. Fire 1.4 x 10-5 2. Seisic 3.1 x 10-6 3. Wind 1.3 x 10-6 Subtotal (External) 1.8 x 10-5 TOTAL (Internal Plus External) 1.2 x 10-4

r. TABLE V-3 CCNPARISON OF INDIMI POINT CORE MELT MEDIAN FREQUENCY WI'IU NRC SAETIY GOALS Indian Point 2 Indian Point 3 NRC Goal 1 x 10 4 Core Melt 1.4 x 10 4 or 5.0 x 10 5 or or Frequencies once in every once in every once in every (per reactor year) 7,000 years 20,000 years 10,000 years (internal and external) 3.0 x 10 5 Internal Initiatire 5.0 x 10 5 or or Events Only once in every once in every 20,000 years 33,000 years i t

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ VI. CONTAItiliE13T RESPONSE ANALYSIS A. INTRODUCTION The accident scenarios that could lead to core degra-dation, and the methods for analyzing them, are discussed in Sections IV and V of this testimony. The results of the plant response analysis are input to the containment response analysis. The containment response analysis investigates the phenomena that might occur during various types of degraded core accidents and assesses the response of the containment to these phenomena. Unless the degraded core is retained and cooled within the reactor vessel or containment boundaries, some form of uncontrolled release to the environment will occur. The major areas of investigation were: Evaluation of degraded ccre phenomenology; Evaluation of containment capability; Containment event tree description and quantification. As stated earlier, in Section V of this testimony, most of the accidents postulated do not lead to core melt. The containment response analysis shows that even should a core melt occur, less than one percent of all accidents would lead to a release of the type that might result in early ' fatalities. This conti;sion is attributed to the combin-ation of the reactor coolant system design and containment design for Indian Point 2 and 3, which would likely prevent a breach of containment if containment safeguards are oper-able. In general, these systems are designed to keep the ~ reactor core covered with water and sustain containment heat removal capabilities under accident conditions. Particular features of this design which provide for major accident accommodation are discussed in Sections 3 and 4 of the IPPSS. If containment safeguards are not operable, the containment capability would likely delay any breach, thus allowing time for reduction in fission product inventory and for evacuation. Additionally, recovery actions can be attempted by the operators during this time period to prevent containment failure. B. EVALUATION OF DEGRADED CORE PHENOMENOLOGY The evaluation of the phenomenology associated with 1 severely degraded reactor cores was an important part of the IPPSS. Following are short descriptions of some of the con-clusions drawn from this analysis: 1. Generation of Hydrogen Theoretical studies and experiments, as discussed in Section 3.1.3 of the IPPSS, indicate that the amounts and rates of hydrogen generated in nearly all postulated degraded core accidents at Indian Point would likely be limited such that the contaimment function would not be impaired. This is due to phenomena discussed in Section 3

4 of the IPPSS. These phenomena limit hydrogen production due to metal / water reaction durinig the time of core heatup, the time when the degraded core is moving to the lower reactor I vessel, and the time when the debris is at a reaction temperature. Hydrogen generation from concrete decom-position is also limited due to the particular geometry of the Indian Point containment floor, which permits available water to cover and cool core debris. Other potential sources of hydrogen generation, such as radiolytic decom-position of water and reactions with metals and other mater-ials in the containment, were examined and found to be insignificant. 2. Hydrogen Flammability and Burn Experimental data. (Ref. 4.1.2-9 of the IPPSS and F.F. Psai and N. Liparulo, " Flame Temperature Criteria," Second International Workshop on the Impact of Hydrogen on Water Reactor Safety,1982) have identified the conditions for which hydrogen would be flammable in a mixture of steam and air. Computations describing the steam and hydrogen release rates into the containment indicate that for most of the-analyzed. accidents, the hydrogen concentrations in the con-tainment are not anticipated to be in the flammable range, j Hence, the potential for pressurizing containment by hydrogen combustion is minimized. Even when a hydrogen burn is possible in the containment, other experimental and l analytical data indicate that such a burn would not produce w-e --y w-r. _p., ,.,7 a breach of containment for a wide range.of likely accident conditions. This is due to the amount of hydrogen available for burning, the manner in which it burns, and the capacity of the containment to sustain the calculated increases in pressure and temperature. 3. Steam Explosions In-Vessel and Ex-Vessel From Core Debris / Water Interactions An examination of steam explosion phenomena both within the primary system pressure boundaries and in the reactor cavity / containment areas indicates that such an explosion either will not occur or will be inconsequential with respect to loss of containment function. Section 3.1.5 of the IPPSS discusses the conditions necessary for large in-vessel steam explosions and concludes that the necessary mixing of coolant and debris is not realistically achiev-able, that the pressure in the primary system is usually not conducive to creating such reactions, and even if such interactions occurred, they do not produce loads sufficient l to cause vessel or containment failure. i Similarly, Section 3.2.1 of the IPPSS and Appendix C of NUREG-0850 conclude that ex-vessel steam explosions are not energetic enough to breach the containment structure. 4. Debris Bed Dispersion and Coolability The concrete basemat beneath the reactor vessel would be subject to ablation by hot molten core debris if it comes in contact with the concrete. For an event where there is i

l. an accumulation of debris in the reactor cavity in which there is no water present, ablation of the basemat would \\ occur. If water is present on a continual basis, a coolable debris bed would form and no substantial ablation is expected to occur. In general, coolability of core debris is influenced by how much the debris is spread or dispersed. The manner in which core material disperses at vessel failure depends on the pressure in the reactor vessel at the time of vessel breach, and on the reactor cavity geometry. Substantial portions of the core debris are expected to be expelled or dispersed from the reactor cavity following a breach of the vessel for the more probable high reactor system pressure core melt events. This dispersed debris would likely be coolable due to its large surfe.ce area and the availability of water in the area of dispersal. The debris not dispersed would collect in the reactor cavity. For the events during which the reactor coolant system pressure is relatively low at the time of reactor vessel melt-through, almost all of the debris would remain in the lower reactor cavity area. The reactor cavity must have sufficient surface area to result in this debris being coolable. At Indian Point, the basic plant geometry provides for the presence of water in the reactor cavity prior to a breach of the vessel, the continued availability of cooling water when containment safeguards are operational, and _ _ _ _ _ _ _ _ _ _ _ _ - - -. _ _ _ - - ----.-- J sufficient surface area for cooling. Therefore, in either the low or high pressure cases (i.e., whether the debris would be dispersed or not), the core debris would be coolable due to its large surface area, its particle size, and the availability of cooling water. These conclus. ions regarding debris coolability and dispersion are supported by analytical and experimental indications. (See Section 3 of the IPPSS.) C. EVALUATION OF CONTAINMENT CAPABILITY Containment pressure capability of the Indian Point containment buildings was thoroughly examined in connection with the preparation of IPPSS. Results of this evaluation indicate that the Indian Point containment buildings can withstand an internal pressure of about 140 psia without loss of structural integrity. Other, independent studies, such as NUREG-0850 and the direct testimony of James F. l Meyer concerning Contentions 2.l(a) and 2.l(d), support the conclusion that these large, dry containments have high pressure capabilities. This 141 psia pressure is 2.3 times the design basis accident pressure of 62 psia and represents a confident lower bound for containment functional capabil-ity. It is a " limit" pressure at which the hoop reinforcing steel in the weakest section of the reinforced concrete steel reaches a state of general yield. This does not represent actual failure o the containment structure. The ultimate strength of the containment structure could be well above this value. The factor of 2.3 corresponds to con-servatisms in the original containment structure design. Some of,the factors contributing to the conservatism are identified below: 1. Application of load factors; 2. Application of capacity reduction factors; 3. No credit for strength of steel liner plate; 4. Minimum strength of material considered in design basis accident evaluations rather than actual material properties; 5. Seismic rebar not considered to resist accident loads; and 6. Designer conservatism. A review was also made of the integrity of the piping penetrations, electrical penetrations, hatches, and major containment seals and ventilation valves. Pressure, tempe r-ature, and radiation effects on these containment components l l were considered for the containment transients analyzed in the IPPSS. None of these effects on the above components was found to be critical in the first 24 hours following l l accident initiation. The limiting part of the containment structure was found to be in a location just below where the hemispherical dome of the containment connects with the vertical wall of the lower cylindrical portion. This limiting area in the I

. vertical side wall is a location where there are fewer seis-mic reinforcing bars in the concrete. The containment cap-ability is not limited by the presence of penetrations or other discontinuities, but is determined by the expansion of the wall area on a broad scale due to internal pressure exerting a force on the wall. The discussion above concerns internal pressure and temperature loadings on containment. These containments are also capable of withstanding massive seismic events above any expected to occur at the site. D. CONTAINMENT EVENT TREE DESCRIPTION AND QUANTIFICATION In containment transient analysis, various accident sequences are analyzed in detail to determine containment response. The sequences of events leading to degraded core accidents depend on the initiating event and on the success or failure of plant systems. A common element for every sequence that proceeds to core melt is the loss of water f rom the primary system. l 1. Conditions Affecting Response In the containment response analysis, four conditions are used to group core melt sequences: (1) timing of emer-l gency coolant loss and fuel melting, (2) capability to vent hydrogen and steam from the reactor coolant system into the containment before vessel failure, (3) reactor coolant l l i

. system pressure at the time of vessel failure, and (4) oper-ability of containment sprays or fan coolers. For these four different sets of conditions, analyses are performed for representative accident sequences which characterize these conditions. 2. Containment Event Tree Description A containment event tree is a logic structure which provides an integrated and comprehensive analytical frame-work accounting for all important aspects of containment response for a number of related accident sequences. The containment event trees are quantified for each postulated accident sequence associated with that tree. Therefore, the same tree is quantified uniquely for each accident sequence. 3. Quantification Containment anal'yses are performed to provide the basis for quantifying the nodes on the containment event trees. The quantification uses computer models supplemented by independent analyses and experimental information. The containment analyses are performed for a wide and encompassing variety of conditions and phenomena such that each of the nodes in 'each containment event tree can be assigned a set of success or failure probabilities. E. RELEASE CATEGORY DEFINITION 1. Introduction The quantity and composition of fission products that might be released to the environment is an important part of modeling the potential consequences of postulated serious accidents. Source terms which were developed for the IPPSS generally followed the approach used in the Reactor Safety Study. The CORRAL computer code was developed as part of the Reactor Safety Study to calculate the fraction of the core inventory of fission products that could be released from the containment to the environment as a function of time. Four basic components of release from the core to the containment were considered: the gap-release component, the core melt release component, the vaporization release com-ponent, and the release component associated with steam explosion. The MARCH computer code was used to determine the times at which the four release components would occur; these times were input to the CORRAL code. The fractional l l release of the fission products from the core to the con-tainment for each of the four release components for each accident sequence of interest was obtained from the Reactor Safety Study and was also input to the CORRAL code. The CORRAL code was used to calculate the fission product source in the containment atmosphere as a function of time, as well as the time dependent release to the environment. l

. Release from the core to the containment and from the containment to the atmosphere was calculated in terms of fraction of core inventory. Processes such as plateout on the containment walls, washout by containment sprays, trapping by filter systems, and settling of aerosols will reduce the fission products in the containment atmosphere as a function of time. The CORRAL code uses these processes in calculating the time-dependent containment atmosphere source inventory and the cumulative release fractions to the environment. In the Reactor Safety Study, CORRAL calculations were performed for about 40 sequences. The results indicated that releases from containment could be grouped into a limited set of release categories. Seven categories with significant releases were considered for PWRs. All potentially significant sequences were assigned to the most appropriate release category, and consequence calculations were performed for this limited set of release categories. The IPPSS used a similar approach in that a limited number of release categories was considered. The Reactor l Safety Study release categories were used directly in some cases. There were, however, some additional release cate-gories developed for the IPPSS as a direct result of the. phenomenological and containment response investigation described in Sections 2 and 3 of the IPPSS.

. An important addition to the IPPSS is release category 2RW. The Reactor Safety Study did not include.this release category because it was assumed that. containment failure would occur relatively soon after core melt. This is the release category associated with late overpressure contain-ment failures which occur when containment sprays and fan coolers are not functional. Fission product release values were calculated for these late overpressurization scenarios and accounted for retention of certain radioactive material in the containment. Additionally, in some cases the long duration releases were divided into four time periods to permit more detailed consequence calculations. 2. Fission Product Release Fractions A summary description of fission product release cate-gories used in the IPPSS is presented in Table VI-1, and estimated values for the fraction of core inventory released from the containment for release categories of interest are t presented in Table VI-2. Values are tabulated for each release category for each of the seven groups of radioactive fission product species considered in the Reactor Safety Study. In addition, the halogen group has been divided into organic and inorganic fractions for use in consequence cal-culations. Parameters other than the fractional fission product release that are important to the consequence estimates include time of release, duration of release, energy associ-

. i n ated with the source release process, and elevation':of release. _ Values for these parameters are listed in Table i VI-3. t. s' i I a J I e i 1 1 i I l 1 1 t, ? l l-i l l i l 9 i ii ' ~~ TABLE VI-l

SUMMARY

OF RELEASE CATEGORY RATIONALE AND NOMENCLATURE Category _ Descript'_on 2 'This release category is primarily used for containment bypass failures associated with valve failures in interfacing systems. 2RW This release category applies to late overpressure failures without functional sprays or fans. Failures result from relatively slow pressure buildup due to loss of containment heat removal capability. The time of fission product to the contain-ment and the time of containment failure is accounted for. Be tween the time of core melt and contain-ment failure, natural processes reduce the source term available for release should the containment fail. Source estimates at the time of containment failure are based on CORRAL calculations. 8A and 8B These release categories apply to all damaged or core melt accidents in which the containment remains

intact, nadioactivity released from containment would be small, corres-ponding to that associated with design levels of containment leakage.

Source terms for these release categories were generated with the CORRAL code. Category 8A is for a core melt sequence without functional sprays and Category 8B is for a core melt sequence with functional sprays.

i TAB W VI-2 IPPSS RADIOACTIVITY REMASE FRACTIONS EDR SOUR TERM CATEGORIES (FRACTION OF CORE INVENIORY RELEASE FROM CONTAIM4ENP) FISSIm PRO [XJCT CLASS I ll Designation Organic For This Study Iodide Iodine Cs-Rb Te-Sb Ba-Sr Ru la Xe-KR 2 7x10-3 0.7-0.5 .3 0.06 0.02 4x10-3 0.9 2RW 7x10-3 0.1 0.3 0.4 0.03 0.03 5x10-3 0.9 1 8A 1.7x10-4 2.7x10-3 5.0x10 1.0x10 4 4 7x10-7 2x10-7 2x104 2.7x10-2 8B 1.9x10-4 1.6x10-5 8x10-7 1.5x10-7 1x10-7 3x10-8 3x10-9 2.7x10-2 i Note: See IPPPS for full listing of source term categories. t e I

d TABLE VI-3 ASSOCIATED SOURCE TERM RELEASE PAPRETERS USED IN THE IPPSS Time Release (Af ter Accident Duration Associated Release Initiation) Release Energy Release Conditions (Hrs.) (Hrs.) (BTU /H) 6 2 (V sequence)* 2.5 1 20 x 10 6 2W 12.0 Multi-phase *

• 6 x 10 8A 2.0 10.0 NA 8B 2.0 10.0 NA The daninant accident sequence in release mndition 2 is the interfacing system failure or V sequence for which release duration is relatively short. A one hour value for release duration was used.

A multi-phase release condition was used for category 25. i i i I r

~ F. RESULTS - CONTAINMENT RESPONSE DURING A DEGRADED CORE ACCIDENT The design basis accident pressure for the Indian Point containment buildings is 62 psia. An evaluation of contain-ment capability (Section VI-C) shows that because of con-servatisms in the original design analysis the containment structures can withstand an internal pressure of at least 140 psia, approximately 2.3 times the design basis accident pressure. NUREG-0850, Section 3.1.3 and the direct testi-mony of James F. Meyer concerning Contentions 2.l(a) and 2.l(d), provide a similar range of containment capabil-ities. The limiting part of the containment structure was found to be in a location just below where the hemispherical dome of the containment connects with the vertical wall of the lower cylindrical portion. The amount of hydrogen generated by the metal / water reaction is limited by many factors including steam starva-tion, the inability to finely fragment the metals, and the I temperature reduction due to rapid quench. The hydrogen and l noncondensible gases generated by concrete decomposition are l limited because of the material properties of the concrete and the geometry of the Indian Point containment floor which provide f avorable conditions for water entry into the cavity and for cooling of core debris. An analysis of the steam and hydrogen release rates to i l the containment and subsequent concentrations indicated that 1 l l l l

. for most accident progressions, hydrogen will not burn. Even when a hydrogen burn is possible, the pressure and temperature rises predicted are usually not sufficient to produce containment breach because of the large containment volume and the high failure pressure. Analyses indicate that steam pressure spikes in degraded core events are unlikely to cause a breach of either the primary system boundaries or the containment. The lower reactor cavity and containment designs tend to promote dispersion of core debris at the time of reactor vessel breach. If the primary system pressure is high at the time of reactor vessel failure, dispersal of debris occurs and serves to promote coolability. Even for debris configurations which are not dispersed, the plant geometry provides for easy entry of water, thus permitting cool-ability and minimizing basemat penetration. Containment failure is highly unlikely if containment fan coolers or sprays are operable. Ninety-nine percent of calculated containment failures are due to gradual late ove rpressuriza tion. This occurs when both containment fan coolers and sprays are inoperable. Only about one out of a hundred core melt accidents would lead to early containment breach and, thus, early fatalities. Sequences which would primarily lead to early radiological release would be the interfacing systems LOCA, the malfunction of the high pressure / low pressure isolation system which wculd result in

. _ - _ _ _ a path bypassing containment. If the containment were to fail due to late overpressurization, it would not be until at least 12 hours, and more likely about a day, after the initiating event. This delay would provide time for reduc-tion in the amount of fission products that could be released from the containment, as well as time for imple-mentation of protective actions, if required. I i i

3 j VII. CONSEQUENCE ANALYSIS A. INTRODUCTION The consequence analysis is the assessment of public i health and economic impacts from postulated releases of radioactive material. Each of the major postulated accident scenarios iden-tified in the IPPSS has a release of radioactive material from the core associated with its occurrence. Of these accident scenarios, those which could lead to releases from the containment to the atmosphere were studied in detail. Each atmospheric release scenario was assigned to one of several release categories based on the core and containment responses to the accident conditions. Accidents which have the potential for release into ground water were determined to be low in frequency and less severe in consequences than accidents which could result in atmospheric releases. The consequence analysis is based on Indian Point site-specific data, such as meteorology, demography, topography, and protective measures such as evacuation and sheltering. l The analysis estimates the probability of various health effects from exposure to the releases assigned to each release category, given the occurrence of -the release. These results were used, along with the release frequencies determined in the plant and containment response analyses, to construct final risk curves. These risk curves are I presented in Section III of this testimony. A detailed description of the consequences analysis methodology employed for Indian Point appears in Chapter 6 of the IPPSS. B. ANALYTICAL PROCEDURE The consequence analysis involves modeling radioactive dispersion in the environment. The effects that these radioactive materials may have on the health of individuals or population groups are related to their initial locations and their travel paths during evacuation and to the location and concentration of the released radioactive material, which may be either airborne (in the plume) or deposited on the ground. The degree of radiation exposure is dependent not only on time of exposure to airbcrne or deposited mater-ial but also on protective measures which may be taken, such as sheltering. To calculate radiation exposures and health effects probabilistically requires a detailed analysis that uses site meteorology, demography, topography, and pro-tective measures such as evacuation and sheltering. Computer programs were used in the IPPSS to construct the data bases and perform the analysis. In the corsequence analysis, it is assumed that an accident resulting in a release could occur at any random time. The consequences of a postulated accident can vary with the time when radioactivity is released from the plant and the duration of the release. The most important factors .affecting this variation are related to the weather condi-tions that exist at the time of release and during the dis-persion of released material. Wind speed, wind direction,- atmospheric mixing, and precipitation dictate..the area affected and the concentrations of radioactive material at any given location. After the distribution of. airborne and deposited radioactive material in the environment was cal- ~ culated as a function of time, the movement and shielding of people were taken into account, and the resulting doses and ~ number of health effects were calculated. For any single postulated release, as many as 300 weather condition scenarios were studied to determine the probability distri-bution for each health effect studied, given the release. Assumed accident start times (month, day, and hour) were randomly selected so that release start times were uniformly-distributed over all months and over day and night condi-tions. Meteorological data were selected from the data base for corresponding times. Additional analyses were performed using results of a search of the entire meteorological data l base to ensure that those low probability weather conditions which would result in the most severe consequences were 4 included in the study. 4 Af ter the completion of the consequence analysis, the o i probability distributions of selected health effects for i each release category were combined with the frequency of occurrence of the release category to express overall l l i

. potential impact on health as a curve showing total risk from all releases. The principal model used in the consequence analysis was an extensively modified version of the Calculation of Reactor Accident Consequences (CRAC) computer program developed by the Nuclear Regulatory Commission for the Reactor Safety Study. The CRAC program was the first code developed to enable a comprehensive probabilistic assessment of consequences from a severe reactor accident. It included treatment of the effects of plume rise, wet and dry deposition, and changes in meteorological conditions (except direction) during plume transport. It also simulated the impact of evacuation and other mitigative measures and it modeled doses and health effects from both early and chronic phases of exposure. The CRAC program, as it existed for the Reactor Safety Study, was intended for use in computing the overall risk from a number of nuclear plants in different regions throughout the United States. While the Reactor Safety i Study analyses were based on a composite site, the IPPSS analyzes consequences specific to the Indian Point site. Therefore, it was necessary to improve the CRAC program to fully reflect specific site conditions. The major improve-ments incorporate the use of variable wind direction and variable evacuation trajectories. Other improvements enable simulation of multiple plume trajectories due to changes in t meteorological conditions during the course of long duration releases. This improved version of CRAC is called Calculation of Reactor Accident Consequences Including Trajectories (CRACIT). The CRACIT program,has been used in a number of site-specific risk studies and was one of six codes exercised on the full range of test problems in a recent international benchmark study of reactor accident consequence analysis models sponsored by the Organization for Economic Cooperation and Development. The CRACIT code proved to be a state-of-the-art tool in this exercise. C. FEATURES OF THE ATMOSPHERIC DISPERSION ANALYSIS Phenomena modeled in the dispersion calculation include the following: 1. Atmospheric Dispersion of Released Material Material released into the atmosphere is transported from the release point by the wind. Initial dilution and travel speed are determined by the wind speed. The tra-jectory of the material is determined by the wind direction and local terrain. The atmospheric stability, that is, the turbulence (or mixing with air) in the atmosphere in which the material is dispersed, influences subsequent dilution and growth in plume physical dimensions as the material is carried downwind. Changes in meteorological parameters such as wind direction, wind speed, or stability during plume transport affect trajectory and dispersion. I

_ _ _ _ _ _ - _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ - _ _ - _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - 2. Hot and Dry Deposition Two deposition mechanisms, " wet" and " dry," act to remove some isotopes from the plume and deposit them on the ground. As the airborne material naturally gravitates toward the ground, some fraction of the particulate and reactive gaseous isotopes are absorbed. The wet deposition process occurs due to precipitation washout of airborne material. This process removes isotopes more rapidly than the dry process and thus was given considerable attention in the analysis. Because wet deposition is more rapid and results in higher ground concentrations, exposure from wet deposition to individuals is generally greater than exposure from dry deposition. If it rains through the plume in localized areas, ground concentrations in those areas may be higher than in other areas along the trajectory of the plume where no rain occurs. 3. Plume Rise Another important f actor in dispersion of the released material is the initial rise of the plume. Generally, the j higher the rise, the lower the ground concentration near the point of release. The importance of plume rise diminishes with distance from the point of release. The extent of plume rise is determined by the wind speed, the energy in the release, and atmospheric stability. Short duration releases with high energy content will rise higher than slow, low energy releases. Each release category has a

_ duration of release and release energy associated with it. The onsite structures also play an important role in sup-pressing plume rise because local wind patterns can trap the plume and prevent it from rising. 4. Inversion Layers During certain meteorological conditions, a layer of higher density air aloft can act as a lid and can restrict the vertical rise of the plume or restrict vertical disper-sion. As the plume rises, it may be sufficiently buoyant to penetrate the layer. 5. Terrain Modeling The variable elevation of terrain in the Hudson River Valley was modeled explicitly in this analysis. To model dispersion in the site vicinity, a three-dimensional wind flow and turbulent dispersion model was used. Four dif-ferent release heights and three atmospheric turbulence conditions were used to simulate wind flow patterns in the valley. The terrain treatment enables simulation of terrain effects on plume trajectory and on dose at points along the trajectory. 6. Long Duration Releases Release durations ranged from less than 1 hour to up to 10 hours. For the release associated with late overpressurization of the containment, category 2RW, the release was divided into several time periods. This divi-sion accounts for changes in wind speed, direction, and stability during release. Up to four time periods were used in the analysis. Each time period of the release was treated as a separate plume for purposes of analysis. D. DOSE ASSESSMENT METHODOLOGY The dose assessment methodology used in the Reactor Safety Study was used in this study with only minor modifi-cations. Details are included in Section 8 of Appendix VI l of the Reactor Safety Study,and Section 6 of the IPPSS. There are two basic elements in assessing the hazards of radioactive materials entering the environment from a hypothetical accident. First, the concentrations of the radioactive isotopes in the environment (air, soil, water, on and in vegetation, animals, etc.) must be estimated. Second, the exposure pathways to man for these isotopes must be identified and quantified. Exposure may be internal, the result of ingestion of food or inhalation of air containing t l radioactive isotopes. It may also be external, resulting l from isotopes that remain in the environment. Time is an important variable in several ways in the dose assessment. Biological effects depend not only upon the total radiation dose, but also upon the dose rate. Dose l rates, in turn, depend upon environmental concentrations of isotopes and their transport to humans, which also vary as a l function of time. To simplify the discussion, exposure is broken into early and chronic phases.

. 1. Early Phase Exposure The early phase includes all exposure to radioactive isotopes in the environment within a short time af ter release. The cutoff time for this period is the completion of the evacuation process, for those who evacuate, or 24 hours after the start of exposure for those assumed not to evacuate. The early phase of exposure is marked by con-centrations of isotopes in the environment that change rapidly as a function of time due both to environmental transport and the rapid decay of short-lived isotopes. This phase is also marked by highly variable human exposure path-way characteristics due to dose mitigation measures. Because an individual's exposure to the plume could begin a short time af ter release, dose mitigation measures for early phase exposure are more effective when promptly instituted. Two possible beneficial actions are evacuation and sheltering (i.e., having the public remain indoors). Sheltering reduces the dose incurred from inhalation, exter-nal plume exposure, and ground contamination. 2. Chronic Phase Expoy;ge There are several i;c q c' bronic exposure. The most important are direct radiation from contaminated ground and ingestion of contaminated milk or crops. Doses from inhalation of resuspended material are included in the com-putation, but are small relative to doses frc.a d'.her pathways. Chronic exposure would generally involve lower i

- 100 - dose rates than would early exposure. The time scales would be longer--several weeks for milk ingestion, one season for exposed crops, and 50 years or more for ground contamina-tion. There are two chronic phase dose mitigation actions: interdiction and decontamination of land. Interdiction prohibits the use of land or contaminated food for a period of time. This is done either by relocating people or by impounding milk, crops, or other contaminated food. Assump-tions used for the Reactor Safety Study were used in this analysis. In the IPPSS, the criterion for requiring land inter-diction or decontamination was the same as that used in the Reactor Safety Study which was adopted from the recommenda-tions of the United States Federal Radiation Council and the Medical Research Council of Great Britain. Four types of interdiction were included: Total interdiction for long periods (20 years or more) Partial land interdiction for several years Crop interdiction for a season Milk interdiction for several weeks. The area of interdicted land decreases with time because of radioactive decay and weathering, but decontam-ination could return the land to immediate use. The maximum I 1

- 101 - decontamination factor considered practical is 20. Inter-diction and decontamination are discussed in Section 11.2, Appendix VI of the Reactor Safety Study. A major distinction between the two exposure phases is that chronic exposure is entirely subject to administrative control. Measures such as interdiction of land would pre-vent doses that could lead to early f atalities or early ill-nesses caused by reoccupation of the more contaminated por-tion of the plume exposure pathway. In theory, all latent cancer cases from the chronic phase of exposure could.be precluded by interdiction of all contaminated land and food. However, it was assumed for this analysis that inter-d.iction would not be applied to land contaminated at rela-tively low levels, that is, levels which would lead to small increments in the risk of cancer fatality from other causes. The risk of cancer fatality for an average indi-vidual from all causes is presently about 15 percent. The risk from radiation exposure at the interdiction threshold of 25 rem in 30 years would result in an incremental risk of 0.25 percent, for a total of approximately 15.25 percent. Continued exposure in the period beyond 30 years could-increase the total risk slightly to about 15.37 percent. E. HEALTH EFFECTS AND OTHER IMPACTS The health effects model used in the Reactor Safety Study was used unchanged in the IPPSS. Detailed information-

- 102 - concerning the clinical and experimental data on which the calculations are based is included in Section 9 and Appen-dices F, G, H, and I of Appendix VI of the Reactor Safety Study. These appendices include data on the early and continuing somatic effects, late somatic effects, thyroid effects, and genetic effects. The health effects that could be associated with a reactor accident are divided into two categories. The first category includes early and continuing somatic effects, fatalities and illnesses that could occur after large doses of radiation received in a short period of time. They would be expected to occur within days to weeks after exposure, but the category also includes illnesses and fatalities that could become manifest within a year or so. These early and continuing somatic effects would not occur unless an indi-vidual receives a radiation dose in excess of some threshold dose. Even in the most severe releases, these threshold dose.s are usually exceeded only in areas near the plant. The second category of health effects occurs randomly with a probability which decreases with decreasing radiation dose. This category includes cancers, benign thyroid nodules, and genetic effects. Because there are no adequate ~ data for direct estimation of the risk of these effects at low radiation doses, risk estimates for low doses are based on extrapolation of the known relationships between high radiation doses and probability of effect. Risk estimates

I - 103 - used in this study are approximately equivalent to mid-range estimates developed by the National Academy of Sciences Committee on the Biological Effects of Ionizing Radiation in their most recent review of the subject, published in 1980. All but a small fraction of the cancer fatalities, thyroid cancer cases, and man-rems estimated in the IPPSS result from individual radiation doses in the low range, where risk estimates are based on extrapolation. The model used to determine economic impacts presented in this testimony is identical to the model used in the Reactor Safety Study, described in Section 12 of Appendix VI of the Reactor Safety Study. The economic impacts estimated include the cost of evacuation, relocation, interdiction, d econ tamina tion, and crop impoundment, but exclude costs associated with damage to the plant. The effects for which risk curves were prepared include early fatality, radiation illness, latent cancer fatality (excluding thyroid), thyroid cancer incidence, whole body man-rem, and economic damage. Risk curves were not prepared f or noncancerous thyroid effects or for genetic effects, but may be derived from the risk curves provided. For example, the thyroid cancer incidence curves may be used to estimate noncancerous thyroid effects by scaling thyroid cancer curves up by a f actor of 1.5, and whole body man-rem curves may be used to estimate genetic effects by using a conversion factor of approximately 0.0002 genetic effects

- 104 - (all types) per man-rem to be consistent with Reactor Safety Study estimates. F. PLANT / SITE DATA USED IN THE ANALYSIS The analyses incorporated data that were specific to the Indian Point site and environs. 1. Meteorological Data The primary source of weather data was the 400 foot tower located at the Indian Point site, which is instru-mented at three levels. Data from a representative one-year period, August 1978 through July 1979, were used for the analysis. Parameters necessary for the analysis included wind speed, wind direction, atmospheric stability, precipi-tation, and inversion layer height. Because data on precip-itation rates are import;nt, they were obtained for seven nearby locations. Inversion layer height was determined from atmospheric soundings in the New York City area. The variable trajectory plume model uses time - concurrent wind data from 13 stations in surrounding areas within 100 miles to determine plume direction as it travels away from the plant. Thus, any plume that is projected to leave the site area is assumed to be influenced according to weather data measured in an adjacent region.

- 105 - 2. Characterization of Terrain Surrounding Indian Point To acc-'rately represent the terrain -input to the three-dimensional dispersion model, a United States Geological Survey topographic map of the area was digitized and used as direct input to the numerical flow model calculations. 3. Releases from the Plant Releases of interest in the consequence analysis are characterized in Tables VI-2 and VI-3. Separate CRACIT runs were made for each of the release categories given in the two tables. The magnitudes of radioactive releases were input as fractions of the initial core radioactivity that might leak from the containment structure. In addition to release magnitude, the parameters that characterize the various hypothetical accident sequences are (1) time of release, (2) duration of release, (3) warning time for evacuation, (4) height of release, and (5) the energy content of the release. The CRACIT program contains a library of isotopes resident in the core of a 3,200 Mwt reactor. These inven-tory quantities were scaled down to 3,025 Mwt, which is the core power level of Indian Point 3. Because the maximum core power level of Indian Point Unit 2 is 2,758 Mwt, this results in a slight overstatement of the consequences for Unit 2.

- 106 - 4. Population and Evacuation Information Estimates of 1980 population were used for the analy-sis. For areas within 10 miles, five dif ferent scenarios were developed to account for time-of-day and seasonal vari-ations in evacuation and population. The five scenarios are: Night Weekday-school in session Weekday-school not in session Summer weekend or holiday Winter weekend or holiday The appropriate population and associated evacuation data base were selected based upon the start time for each acci-dent scenario. Evacuation trajectories and speeds, based on the actual road network in the vicinity of the site, were developed by Parsons, Brinckerhof f, Quade and Douglas, Inc. See Section VIII of this testimony for a discussion of sheltering and j other protective measures. G. UNCERTAINTY IN CONSEQUENCE CALCULATIONS The consequence analysis models used in this study i incorporate a large number of variables. Examples include meteorological conditions, factors affecting plume disper-sion, evacuation assumptions, shielding assumptions, dose conversion factors, and health effect factors. For most of e

- 107 - these parameters, a single best estimate value was a ss igned. Thus, the consequences computed for this study are based on single values for most parameters with recog-nition that some uncertainty exists. The effort made in this study to reduce uncertainties by improving the physical models that describe the transport and dispersion of released material in the atmosphere is important. The use of extensive meteorological data from the plant site and 13 other regions around the site and the ~ use of a multiple time period release model are examples of attempts to improve the ability to predict plume locations and to improve dose estimate accuracy. Associated with the improved modeling and data was the use of a team of atmospheric dispersion experts who were asked to evaluate and modify, if necessary, model results based on their years of experience with conditions in the Indian Point area. Another improvement lies in the evacu-ation model that simulated realistic evacuation times and paths for five evacuation scenarios. Screening runs using the entire one-year meteorological data base were made to ensure that low-frequency severe consequence scenarios were l included. Explicit consideration was given to limiting the uncertainties in various aspects of the dose calculations, j such as emergency response assumptions, precipitation (including rainfall washout), and release durations by

- 108 - improving the model. In Table VII-1 remaining uncertainties in these parameters and uncertainties in other aspects of the analysis are expressed as probabilities for each f requency versus health effect distribution for the sig-- nificant release categories used in assembling the final risk curves. Separate CRACIT runs were made to produce each of the four sets of conditional risk frequency distributions identified in Table VII-1. (See IPPSS Tables 8.5.2-4a-e and Table 8.5.2-4-6.)

- 109 - TABLE VII-l UNCERTAI?7 TIES ASSIGNED 10 ADOMC DISPERSION AND HEALDI EFEECTS GIVEN DIE RELFASE Probability Assigned (%) Doses Doses Doses Release Overestimated Overestimated Doses Underestimated IIcalth Effect Category by Factor of 10 by Factor of 2 are Correct by Factor of 2 Early Fatalities 2 10 25 50 15 and 2m* 10 20 60 10 Z11nesses 8A* O 40 50 10 8B* O 40 50 10 All Others 2 10 50 30 10 2W 10 50 30 10 8A* 10 50 30 10 8B* 10 50 30 10 i This release category is not a significant contritutor to this health effect. l 9 i l l l l

- 110 - VIII. EVALUATION OF MEASURES TO PROTECT THE PUBLIC DURING EMERGENCIES A. INTRODUCTION This section of the testimony employs.probabilistic risk assessment methods to evaluate various measures which would protect the public during emergencies. From such analyses it is possible to determine the relative effective-ness of different protective measures. The impact of source-term reduction on emergency planning is also discussed. B. GENERAL OBSERVATIONS Before describing the results of the alternate emer-gency response analyses a number of important. observations should be made regarding the expected frequency of evacua-tions from the Indian Point plume Emergency Planning Zone (EPZ), the minimum evacuation speed that would be sufficient to prevent early fatalities within the EPZ, and the size of the EPZ. 1. Frequency of Evacuation The IPPSS was used to gain insights into how frequently i evacuations might occur from the Indian Point EPZ. Evacu-ations f all into two categories: those that later prove to have been only precautionary and those that would, in fact, i-have reduced public risk. The latter category can be fur-ther broken down into those evacuations caused by a release l l l l

- 111 - category 2RW scenario, with a minimum of 12 hours between the time of accident initiation and the release of radio-active material, and those evacuations where the time is less than 12 hours, such as from the interfacing systems LOCA, release category 2. For those evacuations which would reduce public risk, the public in the vicinity of Indian Point might need to be evacuated once in 14,000 reactor years (the combined mean frequency of category 2RW scenarios for Indian Point 2 and 3), with a minimum of 12 hours available between the start of the accident and possible radioactivity release. It is more likely that about a day would be available. Evacua-tions under these conditions are not expected to lead to any early fatalities. Plant operator recovery actions directed towards maintaining containment integrity could further reduce the frequency of this type of evacuation. The fre-quency of evacuationc where there is less than 12 hours is very low, once in 1,000,000 reactor years (the combined mean frequency of category 2 scenarios for Indian Point 2 and 3). The above frequencies take into account the possibility of releases from both plants at the site. 2. Impact of Evacuation Speed on Early Fatality Risk sensitivity analyses indicate that early f atalities within the evacuation zone could be prevented if an accident were to occur if evacuees were to begin moving no later than i the start of the release and maintain a minimum speed of l

- 112 - about three mph. At a few miles from the plant, evacuations at this velocity could be initiated somewhat later without-an increase in the risk of an early fatality. 3. Size of the 10-Mile Emergency Planning Zone (EPZ) Figure VIII-l shows the distribution of early fatality risk from all core melt accidents as a function of distance, assuming that there were no protective measures, evacuation or shelter, taken by the public. As can been seen in this figure, essentially all of the early f atality risk, more than 95 percent, is confined to a four mile radius. This suggests that the 10 mile EPZ focuses efforts on the area where the early fatality risk is greatest. The bases for the Commission's selection of 10 miles as an appropriate radius for plume exposure pathway emergency planning are given in NUREG-0396. A number of considera-tions led to the selection of 10 miles to define the EPZ. Among them was the observation from generic studies that the likelihood that whole body doses of 200 rem or more from core melt accidents falls off markedly beyond 10 miles. Similar analyses for the Indian Point plants and site (with other assumptions identical to those in NUREG-0396) lead to the same conclusion. Results are shown in Figures VIII-2 and VIII-3 for Indian Poi.it 2 and 3, respectively. Based on the above, the 10 mile EPZ is more than adequately sized and, in fact, a smaller EPZ may warrant further review.

113 - Figura VIII-l Fraction of Early Fatalities Versus Distance IP-2 and IP-3

1. 0 '*

3 .. _ m. .__ w.. ._m._- .s _., r,. 6 6-

=iM+#c- "-#=l"=k.- = ; = 0==iN=F=-=41r=.W -i= 4

t =Fr=. i== = r.===i=== 2=t=Mnp , ~~~ 7 ~5E=MMElEE47ffZ.k-ME : -- =ht;if =tE:tMS si-Is# 3=E =34E p.__,__.g._ 4-u -- _ g g-9. t:====p=p g t +=- _ i =_==_M_ m m._

q==

h + i E==:-# % t25 sr = =_ M =

4= =:* =i =:a

--F + _r ,_.,_m r-p n=Y I I E O o 1 = i1 1. i i i c 0.1. ,___._'_e y t g g-._4 6_; .g - - r. ~; a

====F= P-n=% =t --kh ?-- g =- i==k= = M t =M -i4Hu - -2:.. ~=-n= =t= % 4 L== nn !

-

5EfnFi "liiG~~-IE= Il=i ZVi=E+f-ti-- -i;i# :li-- T_-L+tzli:Eli ~~ o c 1 + - m-- g;r-4.__.1-- =

a= :, - - -

o m 1:- t....-- -- s!=@=%= tn

=#+# :ti =ei1=i d6 itti" - !==

= =1-- g24t1

== A ~- l3-~ iEP - -"f5~iiM?--rs#fiflME fiEEshti EtLM i E tr E5fii=- a.UE t x=_ _, m i. , - g:;:rr-r - pt n-r--g :- =r-~~- e 4._- .s e.

; i.

\\_ u .a . 0. 0 1.., -.' - -. ~....- 'a'..'._._ _._.,_.=g._

• ~

~ ~~ c.4 e i ---r___r_-..6-,_%.p___._....v-p._,_.3.. u + .p.-+, O r r r

• • 5Y '

i I'd 1.===. 4 u:: kn.;L L:=-t=--r_= rr --t= tit = _i_. f-- -t- -+-i. -H-1 LiH= ?::=ti=+;r-t-----4"--i; -+ ;4 t-is ,_"__t=-..=_a. =_i.g_--=_ t-Eg._ge. -

a. ss!=i =-g=i.[.=y. gg. =.r-- r:--zgsi.===r.==tatsan.ti. ;

m '++ m ta m=n n== :==;=@=i= t = - =pr =.

c.== a = = =:st--: w W. -s =p== -: s=i 9.- -=

= c=-

u i ~ ' ]=..-i_- i. E-9= - u nt =._=E_ [3-9._1.._=_.;. p. __ -._=. ; c- _::=3. _:..E_9_3_ :J..g - p:c _.= = _ 5__3E. 3_ n-2: ~ o _). - j= ---+- .a.-. c ,_ +,\\ 4 0 4 m _.4 _ m ii= 1 g y> _4 . ! ! =, o 0.001, - - - - - " _ _. ~, ,.--.._p'_._4 u 6". "p ;__. g~ ~ - - _~_ p o r._ ~ r-. _ _ + gr _~_ p -

._., - p _ _

p

_r._g _. , v_.% 1 = = =d I --- m j ' i '=ME- -ANk:..ils-I 41;= -

IU

==9 -. E=

l =;d =I9#l=t9= E:=

E-M= in " !=-!=ikh dt" _"- =.tri =.iL=" di4 5 M i-iMh= fMi =. =%E

-1

--_ p_ j..;= j=-.., r - p=.2.i: 2=

={;-p. 3,~- :p:

e A_- j=._ j==_=__f_ - mg g,. _; -n p.ic - - --- n

p 7

-l3f3h -:-;Q . ;f:: ahj:

; j -

fi-jup M].j-i

.j.i

{js:i'.i M 5.n:p.;.i= ni. :Q:[:' 715:-i::.j;j _yiljf :- 1 p-'

n:.

' - g. ;gy p.=.-l :

p-- r =t ar;.1.. j-l':gl

_._ jig r g: 1-9_5_g;. = _ _ _.:.3 :mgg . t _; _ ._-.f---,... . _ _ _ 3.._ _ _ t $ t.r_L -g. =..:--__=-:...:._:.n 3_.-_. - --+_ ~.L. m d.. ~ - " - - '... ~, ",. ^ 0.0001, -I ~ 0.1 1.0 10.0 100. Distance (Miles) Normal Activities 24 Hours

- 114 - Figurs VIII-2 Probability of Exceeding Dose vs Distance IP-2 200 REM Whole Body

1. O ':_.

.. _... _. - _ ~ - ~ - ._.L rs -.+.__,__p i__: u -: r-a-- =

~- '-$... A----;in H.l=ps u

- q --t-+-m)!d:- 5.=@ bb i{ rp. =E.:.-.{3= : =:7..ni: :q.:-_p pf-- NNbN 58i !bN155-bi) NN?' Nkb kbh 5. =_i'.~ ~NdiN b' ktd 5 ~~' _s W G;gIgg j-- ~F==T9EEiitiE .,. ~ ~ 7: h.'MEb i iN.i kh , IfE[.h# '# _-3 -fb 7# __y _ g___ ...,f:=._ _.,.,_ _ _._n = _ '. " ._g._. g._ _a. _ _ __x =:t:- 4.__.,;i-.-,. f_..,._. ,_=== .c x n-.n, m-yyt-a._;g "l; 4J i 1 1 i I. .i i-- 1. i i 1 .i g 0. 1,. r i. i 4 ii m i> wx g-- __ _.,_,-.._~__ p-s. [ [ g V l *-; -- - * - -. - - + - m o t-5=-M2!5: =9 = t*4M= 4h

= l ="r i =#=aN

=h kil-m " . %s=Linia utb u - ~--q = g-== =MMMMtih E-At==== ES.-N!iihL~ ~ " ",MMfE- =Mi=2"i.3: c ,- p e t- ---+y.4 m > -. - ----. g-- ; -,- r -...m._.. :. _1 =- -Mi-tas=iW=h=d.=1I- - '*=t-m==+#= h L =F i 1- = r '. -d+-!= hi!.r .,-t 2 = *E-. ERIE:ffiM 'it!MMM-5=f5=LIEiMis %!.h iMiii = :- W ;=.-iiMWiEM M o r -.._,... 7 ._.p g n y__._ y \\._ -:-\\_. g .,p7__. _._: r o t-~'

:"_.NUREG 0 3 9 6 r~::

a +, r 0. 01,., 1. , e, i +-- m...._..._.'_. m v_ l - 4 _ v._..,. r. .. _6 g... - g ~ y _. IP-2 -.-+-u -t-5--- -r-t +--H t: 0 +- 0 =Ei== 5@iMMEtW =E, +y.. _ _.. _].. _. _ _ f __.E_n...1.=i4.W. _ie b=._i=_ f.=_t_* M_. d ZiE= EEi:M s LZ__h,1- =ImsliMi~! ele.WIM i t =9M==h=J-tM=+ t==L=# =-it P_l ti - F. c.---- @ =is:En =u-a 1 ...t E o D.l 7--e-_ tu i. F-- w=pr, i--". --t & ;--L 1 q' ~ ~* :- +- g

=n!== ='t.s= = i re =k

- s

=r== 5=i= 4== :

-=-= tl. i==sI== w 5 M =t=mtr O

1. .Mii.@=iE Mi "_.=_Eti=-_.JEd E!I M4 aii si biM4E==.5==3E= MlMHi i

3 _=q 3 _,_ v --w ..}._.\\c._ 4 s._ --+.- _. i o, o 01, .a _r. 4- .c e ., _ _ _. _. _... _. _ m+- . _..,..., _ _ _ _... _., _,..m ,Q _...6__4_.,_... _r o . _,_,_s,_ .r. _p

, + r_s_

H _+_.__

== =--1 i Y l =1 ! ' =-li:- -l=== I7-' EF- ~ -k F-7 M r= iL=;h EIFI='i L=- +=:+.= f-~. f5= = t=4# Prf- = ? E"

== u ra M itri2==ItE-F--Wi!=! i=-!E. 4 +$ EE M---5EfEEE5I ' ~ Efd5-35!5Et36-5@ EE!5 *ISEAE p. ; -- p W: g--ah nn 1 p 3g ; pM- - 4:L:- p 5 '- g.. _97 m .q

i-j un -c g=

4dij=4==

• W t bb

~] a.. E =ii=? '= ! =51 W ~==3 =: a .=,..I- ._ I.- _._ . __.-_i. 5__.. {:;.. _.-.~.'_ M d =.~~.. '_ d.'-~. I. I:~_L. b' f.. u-..: r - t_. _~.E-l: O.0001, r._.. ... =4. __._ =L: r _:. =t:

_ r

.t:. 4, L.. ---+ s. + +- ..-_l-.-- F 0.1 1.0 10. 100. Distance (Miles) Normal Activities 24 Hours

- 115 - Figurn VIII-3 Probability of Exceeding Dose vn DictEncs IP-3 200 REM Whole Body 1.0 ",

• - g -- *- >- e, i -;

,__--._ _._. _ = , _ _ - - - + _. _.. ry e--w 8 I ' ?? 5h' k ?-f ~

5

'5 Y '~~ -f = '* =tN=: **~t~~~-h ~~b5l1[-h'b ' }-W -n -.7, E -a__INU_ 55bbi-i I b 5.~f'EEfNIi=NNbh- ?b'I-Yr5 '.'NINbb@. i$ =:ta-t-g i ,=r----

- p

. _ = _ =.:=. -.riE EKd= -:= M! iEE E#i=T..::.n "fTi m a ihi-i=_=L=-2._sr=Es: =E L=EE=_E -a -+=t-RE:R-h-s - 74 a-_ 1==r-- ---t- _.T___ _~ ... _ ~ 3 _.w 5 i !. I~ 4 2 0.1 i 1 z o X-N t-t-++ - i 1 y = ti "- ts#h=i== -Wri-- =H d=st=tri-N = N===4: Ms=-- ' =- t==a _.wnt=idMi ! o - ~ ~ ~~ ~~ G Z'TsE--h~ ~_WhMFMM mMB m=w

p_ -

n=;=r=. & .:=; = u me-t =t+==, s:===814, q=i5.W==A= sW=kt=-

==h=m t===5i=r=ttM ...__2=E ZiEMl"t M-i;5in Z~ ZMsi EMES \\ = fEEMN=5:U ="IMEbi~~; 24Mi#1ii = r p p_g.__gy-rr*n i _. i ._t o t = a l l !.l i NUREG 0396 - I

0. O l '.

2 __. ..___.._.____r'~

• - _, _ _ -._s

_6_ g _, j. _ " 5 IP-3 + ,o 1 o s:+ m ;; hrau m.gwit=== u s + i_i _ U -; _ i_m-b l co - -- m =9= = m ggg_ - - L.gg.L;;g q_-. i.g-g:gggp;g:t==_4=.2=n._; n p_ t -.= -s- .a - x r-

_.t_

ra = p! g - - 2 =iE5ihl=t-3=~M= t . )H 3==J =~= - ""h M-l _. . { tid-_r = {== Hj

= =s i

=u x o ~~~L=___pE!= a-=

===-

= a _ =___ ._.=. _=. =_

_t-g:'_

_a_E p.. t_ a_=__= = _ _:p._%=. _ _ =t= =sEEE_ .u- >l .e4 >p 1 - +-- a i 2, -4 l 1 4 0.001. ~ .a _ ~ _.. _.... _. e .4_,.g.,.. 4_, g i -.,. j. +__.p_._,._ 4 w,._p j_, = _-,p - o i -- - r -- -+-t---+----i + - + - y

= 12 r+ H--i = +==? N :i-i=i ir:R==== es

-l i

=b _4=:4==w= f9=.M= = b-

=:

- =

= = W=_@2=-5E!E-M =_l=RJ_O== E.E= Elt f5 MEl MilM M 55ti ME i ih = i :

---

.---+--:;-:- _g. ;

. ;- ; -.____:: r=:t-T t-- !.._; . 3.. -

f.;_;p;- -.,.;; _;

f-;_;y_- L _t-r-- t;---:. :a k;}-.

• .--.b *T-.~ -" 7 *. ". l *-j -'- *_y.,-{_.

} 'y

• :1d_ LI ;) ;.. --*;

fLd.6-

}J,j".L l' f.- J: --TM R=i ;i~isF-Es= E 4==eM-#-J=E!=!=== ti =E:3= = = : -L= FEE = =fEh 7.3.. -=_- t g =p.... _. g.g:.- up.._ p.y_ f=..;.g...__ c _. _.. r _ . _ M~[_Y' ip, _ ' ~.. "CZ E121 l ~ ~ _~. 0.0001, +- i'".-..~.. g l' - -+ 10'd. Distance (Miles) Normal Activities 24 Hours

- 116 - C. PROTECTIVE MEASURES ANALYSIS This section reviews various analyses that were per- ) formed for alternate emergency-response measures for release category 2, the interfacing systems LOCA. There are two reasons for selecting this accident for further study. It is the major contributor to the early fatality risk and because this accident has the potential for releasing radioactivity into the environment relatively quickly, it represents the greatest challenge, in terms of emergency response. Because of the extensive time that would exist for evacuation in accidents that could lead to late overp. essurization of the containment, alternate emergency response measures were not investigated for these release categcry 2RW cases. A key parameter that affects the early fatality risk.is the time between warning from the plant and the start of evacuation. In the IPPSS a.id in this testimony, this para-l l meter is called the " delay time." Delays in evacuation can occur from adverse weather, difficulties in communications, I insufficient mass transportation, and other factors. The study of alternate emergency response scenarios described below gives some insight into the effect of delay time and other emergency response parameters on early fatal-l ity risk. Figures VIII-4 and VIII-5 present risk curves for Indian Point 2 and 3, respectively, for the -various protec-e tive measures that were analyzed. I l i.

- 117 - 1. Bounding Scenarios In Figures VIII-4 and VIII-5, Curve A, " normal activi-ties" assumes that no protective measures are taken for 24 hours aft 2r the start of exposure, The normal activities group was assumed to spend a fraction of their time out-doors, but most of their time in the living area of a structure equivalent in shielding to a one-story frame or brick house. For this normal activities group, the plume and ground shielding factors were 0.75 and 0.33, respec-tively. No inhalation dose reduction was assumed. The normal activities is equivalent to an emergency response delay time of 24 hours during which even the simple precau-tion of sheltering in basements is not taken. Curve e repreeents cheltering of everyone from 0 to 50 miles, with " normal activities" beyond 50 miles. For the sheltered group, it was assumed that the people spent a 24 hour exposure period in a structure equivalent to the base-ment of a one-story frame or brick house and that the house was closed so that infiltration of airborne radioactive material would be limited. The plume and ground shielding factors were 0.50 and 0.08, respectively. Based on limited infiltration, a factor of 2 reduction in inhalation dose was assumed. The only difference between these two analyses is the shielding effectiveness of structures, as described earlier. The scenarios in Curves A and B are considered

Figure VIII-4 Sensitivity of Early Fatality Risk to Emergency Response IP-2 e lOM b: ~ lormal Actis ities (24 IIours) / e-4 ~ ~ 'N \\ i ~ i i / N IIR '4 IIR ~ IPPbS Evacuation ~ Assumptions 'q j ,o ~ y D j { Shelter & M m Relocate N B A o co

s

? u ILe Io c ~ _ as x C O e4 lh __ s s i Lt11! t_9 i B8888 8 10 10' 10'-- 8 3 ' ! !!!! ~ 10' 10 10 10 g 5 6 Early Fatalities Release Category 2 IPPSS Tables 6.2-16, 17 Mean Frequency 5.4 x 10~7 yr ~1

Figure VIII-5 Sensitivity of Early Fatality Risk to Emergency Response Indian Point 3 e Io - --I 1 7 Normal Activlt les (24 Ilours) ( 4 IIR 0 IPPSS Evacuation Assumptions ~ 8 ( x 'a X G o M : s D I o Shelt ar and I Relo cate C

3 tr A

en~ c 7 8 o_ x B O o a s _u...i t i ! I. _ s s sists e i t t i. i f. ! I s I 83'31 ' -3 +9't~ --l LU ' ' ' ' 10 10' 10' 10' 10' 10' 10' Early Fatal,ities 'lelease Category 2 iPPSS Tables 6,2 - 16, l MeanFrequency4.8x10}yr_1

120 - conservative bounding analyses for consequence assessment. Even in the case cf no emergency-response for 24 hours for release category 2, the interfacing systems LOCA, the Commission's adopted early and cancer fatalilty safety goals are met for Indian Point 2 and 3, as shown in Table VIII-1. 2. Evacuation Curve C uses the same delay time, evacuation, and st.eltering assumptions as those used in the IPPSS. The consequence analysis in the IPPSS assumes that evacuation of the 10 mile EPZ would take place in accordance with the evacuation plan developed by Parsons, Brinckerhof f, Quade and Douglas, Inc. and allowed for delays in the start of evacuation. Estimates of 1980 poput.ation were used for the analy-sis. For areas within 10 miles, five dif ferent scenarios were developed to account for time-of-day and seasonal ( variations in evacuation and population. The five scenarios are: o Night o Weekday-school in session o Weekday-school not in session-o Summer weekend or holiday o Winter weekend or holiday The appropriate population and associated evacuation data bases were selected based upon the start time for each accident scenario. T w

TAf1tE Vill-1 ME Aviawz Ram tut VARids IWW101 tMTts i<elease Catepry 2 Itergericy tienqmmse - Matuul Activities 24 Ikmars miease catoywy 214d iterjency Nguuse - Evacuatim (Iriss) Risk frun Irullan tuint 2* tac Safety Goal tiealth Effect l'rutubility [er Yamar twAubility per Year rly n tality 0-1 ad le 5.9 x 10-8 or once in 17,0u0,000 yasrs 5 x 10-7 Ihmliatim Illness 0-1 mile 9.0 x 10~0 or once in 11,000,000 yturs 1hyroid Casaxr Csse 0-1 mile I.5 x 10-8 or Onue in 67,000,000 yeurs 0-50 miles 1.2 x 10~0 or Once in 83.000,000 yatra latent Cancer htality 0-1 mile 6.2 x 10-8 or Once in 16,000,000 yesrs 2 x 104 (includes thyroid cancer) 0-50 miles 1.4 x 10-8 or Onw in 71,000,000 years 2 x 10-6 I TE AVtRME RISK IOR VARIOUS tit %I.TI EMWIS H Risk faun Irmlian Ibint 3* tac Safety Goal itealth Effeet PratubtIitv ier Year Erc4abi1itv ner Year (D 4 Early h tality 41 mile 5.3 x 10 or Once in 19,000,000 yeurs 5 x 10-7 8 4 b liation Illnuss 0-1 mile 3.6 x 10 or aim in 28,000,000 yemars 1hyroid Carcer Case O-I mile 6.9 x 10-9 or h in l@,000,000 ymru 0-50 miles 3.1 x 10-9 or once in 320,000,000 years 4 latent curer Fatality 0-1 mile 1.d x 10 or Once in 62,000,000 yessrs 2 x 10~0 (iru:ludes thyroid 4 4 cancer) 0-50 miles 3.4 x 10 or once in 290,000,000 yuirs 2 x 10 I i Ikasal on 0-1 mile gqualation of 2400 gerstas, 0-50 gqaalatican of 15,000,000 perscns, nuan selease frapiencies. I a

- 121 - Evacuation trajectories and speeds, based on the actual road network in the vicinity of the site, were developed by Parsons, Brinckerhoff, Quade and Douglas, Inc. Delay time, the time between warning from the plant and the start of evacuation, was treated probabilistically. This treatment reflects the possibility that the entire evacuee population may be delayed longer than expected, for example, due to severe weather conditions, unavailability-of transportation or difficulties in communication. It also allows for the possibility that some segments of the population would respond less rapidly to the evacuation notification than would others. The values selected for delay times reflect the emergency response requirements developed following the Threc !!ile Island accident. The most likely delay time for most population groups in most scenarios was assumed to be one hour. Iloweve r, it was assumed that at least 30 percent ~ of the population was delayed more than one hour in all scenarios. Long delay times (5.5 to 13 hours) for popu-lations in certain areas within about three miles of the plant were asssumed for the weekday-school in session scenario. Assumptions for the population beyond 10 miles are described in Section 6.2 of the IPPSS. Shielding effects associated with different types of protective actions were taken into account. The shielding factors for " normal activities" and sheltering are as described above. For the evacuees, no reduction in inhal-1

- 122 - ation and plume dose rates was assumed. A shielding factor of 0.50 was assigned to evacuees to account for shielding provided by vehicles. These shielding and reduction factors were based on calculations and measurements for similar structures. Results of this evacuation analysis are presented in Figures VIII-4 and VIII-5 for Indian Point 2 and 3, respec-tively. In this figure, Curve C represents the early fatality risk using the same evacuation model as did the IPPSS. 3. Sheltering Followed By Relocation The following is an analysis of an alternative approach to evacuation using the same analytical techniques as be-fore. Rather than implementing evacuation as soon as possi-ble, an alternative approach to public protection following an interfacing systems LOCA would be to have the public take si.elter, preferably in basements, until notified that the plume had passed. Those people who were in the plume pathway, as identified by radiological and meteorological measurements, would be notified where the plume boundaries are and where and when to relocate. The travel distance necessary to leave the affected area would depend on the width of the plume and the location within the plume of the population group of interest. The width of the plume increases with distance downwind and with increasing atmo-spheric turbulence, and concentration thus decreases.

l - 123 - Distances from the centerline to the edge of the plume are presented in Table VIII-2 below for high, moderate, and low turbulence (Stabilities, B, D, and F, respectively) at-several downwind distances. As can be seen from Table VIII-2, the distance from the centerline of the plume to its edge is small. Exposure drops of f as one moves away from the plume centerline, and once outside of this plume, exposure to the released radio-active material decreases markedly. Although the plume widens with distance from the point of release, the con-tamination levels generally decrease. Therefore, the addi-tional time needed to relocate outside of a wider plume is largely offset by the lower contamination levels at these distances, resulting in about the same exposure during relocation.

- 124 - TABLE VIII-2 MAXIMJM DISTANCE FROM PLUME CENTERLINE 'IO EDGE - OF PLUME EOR VARIOUS DOWWIND DISTANCES AND ATPOSPHERIC 'IURBUIENCE Center To Edge Distance Downwind High Moderate Low Distance (Miles) Turbulence Turbulence Turbulence 2 0.40 0.20 0.09 5 0.89 0.42 0.21 10 1.40 0.70 0.34 Curve D in Figures VIII-4 and VIII-5 is the results of calculations in which this approach to public protection was analyzed. In both cases, it was assumed that people took shelter in basements, then traveled out of the deposition area when notified. Even though the distance to the edge of the contaminated area is not great (f rom 0.09 to 1.40 miles), it was assumed that it took one-half hour to travel this distance. Curve D assumes that people remained in their basements for six hours prior to evacuation. The shielding factors during sheltering and evacuation are as described above. It can be seen that the " shelter first -- relocation later" response, although not as effective as the evacuation

- 125 - model used in the IPPSS, is more effective than the shelter for 24 hour (Curve B) case. Also, because the need for mass transportation such as buses should be significantly less than in the evacuation response, implementation of the shelter followed by relocation response should be simpler in some ways. 4. Source Term Reduction Smaller releases of radionuclides than those used in the IPPSS would have a significcnt impact on risk and on emergency protection responses. Testimony justifying the use of smaller sources will be presented elsewhere in this-hearing for the scenarios that dominate risk. It is useful, however, to present here a somewhat simplified approach to source term reduction analyses and to relate this to emergency protection responses. As before, the interfacing systems LOCA (release category 2), the dominant contributor to early fatalities, is used to evaluate emergency protection measures but with smaller release fractions. With the exception of the noble gas release fractions which were not changed, analyses were performed where the release fractions were uniformly de-creased by constant factors of 10 and 20. Using such smaller sources and IPPSS evacuation assumptions, the early fatality risk was recalculated.. Very few early f atalities remain at a factor of 10 reduction and none were calculated at a factor of 20 (See Figure VIII-6). Inspection of peak

Figure VIII-6 Sensitivity of Early Fatality Risk to Source Term Indian Point 2 and Indian Point 3 .a oH -: w 'a 54 H : x - IPPSS Relea se Category 2 M 3 Y _ with Iodine 3 and IPPSS Rele ise Category 2 c Particulate i t 10 Tables 6.2 - 16, 17 e 8 k. X r4 o s_ w m 2 W I o N { No ear ly fatalities ~ calcu] ated for IPl >SS e Releas e Category ? O with ] odines and C+ Partic ulates t 20 a at! ez M io ~ 10 10* 10' 10' 10' 10* 10' Early Fatalities _7 _y Mean Frequency 5.4 x 10 yr IPPSS Emergency Response Assumptions

- 127 - doses calculated shows that about a factor of 15 reduction in the IPPSS source term coupled with evacuation would be sufficient to effectively eliminate the early fatality risk. Although the " shelter followed by relocation" approach was not analyzed with smaller source terms, the early fatality risk in that case would also be significantly reduced with a f actor of 15 reduction in the source term. Additionally, Figures VIII-7 and VIII-8 show a significant reduction in the latent f atality risk with source term reductions of factors of 10 and 20. Another effect of reduced source terms is to move the point at which 95 percent of the early f atality risk is obtained closer to the plants. As shown previously on Figure VIII-1, using the IPPSS source term and assuming " normal activities," about 95 percent of the early f atality risk is within about four miles of the plants. With a smaller source term, a f actor of 10 reduction, the 95 per-cent early fatality risk point would occur even closer to the plant. Both the IPPSS source term, and particularly the reduced source term, indicate that on the basis of early fatality risk an EPZ smaller than 10 miles may be justified.

Figure VIII-7 Sensitivity of Cancer Fatality Risk to Source Term IP-2 lo b IPPSS Releat.e ,y Category 21:W Tables 6.:.-16, 17 1 / u o N M IPPSS 2RW -a with 3 Iodines a nd Particulates 8 So . 20 ew I u o o E \\ x\\ o c IPPSS 2RW with l Iodines and Particu: ates u N b 10 e .-i id S x io* ...un. 10' 10' 10' 10' 10' 10' 10' Latent Cancer Fatalities -5 -1 (Other than Thyroid Cancer) Mean Frequency 5.7 x 10 yr IPPSS Consequence Analysis Assumptions

Figure VIII-8 Sensitivi.ty of Cancer Fatality Risk to Source term Indian Point 3 a Io -t. -4 s 8o_ tn e-1 : c y IPPSS Reler se o Cetegory 2LW 0 IPPSS 2RW vith Tables 6. 2-16, 17 N Iodines and Particulates 20 8 u 0 L e h b c o h I I

5 tro 54 N

~ c I e o o e-s - E I IPPSS 2RW uith Iodines and Particulatos

• 10 i

.S ..um 10' 10' 10' 10' 10' 10' 10' Latent Cancer Fatalities (Other than Thyroid Cancer) -5 -1 Mean Frequency 1.1 x 10 yr IPPSS Consequence Analysis Assumptions

l l l - 130 - D. CONCLUSIONS l Based on the conclusions below a smaller emergency planning tone may be justifiable and a review of emergency response actions may be warranted. 1. Evacuation o The evacuation analysis in the IPPSS is based on the Emergency Plan at Indian Point and includes reasonable assump-tions of delays in initiating evacuation and slowdowns during transit. Transit velocities are based on specific analyses of road networks within the Indian Point EPZ. o The frequency of evacuations needed to reduce public risk is low, about once in 14,000 reactor years. The time avail-able to implement such evacuations is ample, at least 12 hours af ter accident initiation and more likely about a day. o Accidents in which there would be less than 12 hours between accident initia-tion and the release of radioactive material to the environment are very unlikely, aoout once in a million reactor years, o If evacuation is initiated prior to the release of radioactive material to the environme nt, early fatalities can be avoided if an evacuation speed of only three miles per hour is maintained, o Over 95 percent of the early f atality risk is within four miles of the plant, assuming IPPSS source terms and normal activities for 24 hours. This fact, combined with reductions in the source term may, on the basis of early f atality risk, justify an EPZ smaller than 10 miles. J

- 131 - 2. Sheltering Followed by Relocation o An alternative to evacuation is shelter-ing for a few hours followed by reloca-tion out of the plume deposition area. For the once-in-a-million-reactor-year type accident (interf acing systems LOCA), where the time between accident initiation and releases to the environ-ment is short, this alternative is more beneficial than the shelter for 24 hours i option. o The shelter followed by relocation option would require far less use of mass transportation than would evacu-ation and would be simpler to implement in some ways. 3. Source Term Sensitivity Study o A reduction of a factor of 15 in the IPPSS source term would effectively eliminate the early fatality risk from the Indian Point plants, assuming evacuation as modeled in the IPPSS. o The latent fatality risk from Indian Point 2 and 3 is reduced by an order of magnitude when the IPPSS source term was reduced by a factor of 20. I I I

6 NAME CENN*S C. ELEY ECUCATION Ph.D., Nucl ear Reac:cr Engineering, Massachuse :s Instituta of Tecnnolo gy, 1379. C:urses in nuclear engineering and c:mcutar science, Cornell University, 1372-197A. U.S. Navy Nuclear P:wer School,1968. University of Cincinnati, 3.5.I.E.,1967. i Courr.es in Ma:nematics and Physics, Centre Ccliege of Kantucky, 1961-1955. l PRCFESS:0NAL EXPERIENCE General Sen=ary A censul an: at ?ickard, Lowe & Garrick, Inc., IS79-present. Tecnnical analysis of power plan; availaoility and risk. C:s:-benefit analysis of pcwer 31 ant system changes. Preparation of :acnnical recorts, excert tastimony, and proposals. Supervision of -he tecnnical quality of PL3 reports and direction of some PLG projects.

ns rue :r at availacility, risk, anc decision analysis c:urses offered by PLG. Oystar Creek Probabilistic Risk Assessmen: (CPSA).

Assisted in the : mole:f on and review of this c moleta risk assessment of an c erating 3WR serf:rmed for Jersey Central Power & Lign:. Work Order Scheculing System (WOSS). Assisted in develo:ing the San Onofre 2 and 3 plant model for a c:mputar cased work order priori:1:ing, scheduling, and record keecing system for Scutnern California Edision Company. Steam Tursine Ofagnostics Cost-Benefi: Analy si s. Developed and applied a procedure for evaluating ciagnostic altarnatives for I?RI. Reliability Analysis Of Dia:lo Canyon Auxiliary Feecwater System for Pacific Gas & Electric. Midland Plan: Auxiliary Feecwatar System Rel f aoflity Analysis for Censumers ? ewer. Technical Review of the " Office of Emergency Services Rec:mmended Emergency Planning Ione Considerations..." for Sou:nern California Edison. Prioritization of NRC Action Plan for NSAC. Devele: ment of a l metnodology and participation in an AIF workshop to apply-it' for I?RI/NSAC. If en and Indian Point Probabilistic Safety Studies. Me: nods cevelopment, systems analysis, and plan modeling. Other ? ras--LaSail e, 3rewns Ferry, Midland, Pilgrim 1, and Ocenee. On USS Enterprise, Reactor Training Assistant, i months,1971. Responsible for technical training of approximately a00 nuclear trained officers and men prior to annual safeguards examination. Propul sion Pl an Station Officer, 9 months, 1970-1971. Responsible for maintenance and operation of one propulsion plant (:wo reactors, eight steam genera ces, and ass:ciated ecuipment) during gewer range testing of new react:rs and during declaymen. Approximately 50 enlistad cera:nnel were assigned Oc the pl ant. Shif t Propul sion Pl an: Wa tch Officer,15 m:nths, 1969-1970. Su:ervisac a crew Of abou: 20 navy enlisted opera: Ors anc many shioyard workers on 5-hour shift rotation conducting maintenance 1 e i s. 7

ELEY - I anc testing in one proculsion plant during refueling-overhaul. Shipbcarc cuali fica:1cn s: Pr:;ulsion Ou y Officer, respcnsible for all propulsion ecui: ment during aosence of Reac ce Officer and Engineer Officer. Eng'neering Officer of :ne Waten, c:erational wa en in Central Centrol, res:ensible for all precuision and engineering equipment and watch stancers. Propulsion Plan: Waten Officer, ocerational wa ch in ene pre:ui sion plant, directed and respcnsicle f:r all ocers-ions in :ne 3 I ar. ~. A: Cincinnati 3 ell, Plant staff assistant, 4 men:hs,1967. Werked in central effica and transmissien gr:up suoplying technical assistance to the line or;dni:atien. Cocperative trainee, 3 years,196*-1967, wort-stucy program with alternate three men:5 periocs at :ne University of Cincinnati. Chronciogical Su= mary 1979-?resen Censul tant, Pickard, Lowe and Garrick, Inc. 1971-1979 Massachusetts Institute of 7ecnnelegy. Research assistant for Department cf Energy LWR Assessmen Projec;. 7eacning assis:1n: in engineering of nuclear reactors. Su=mer 1976 Northeas: Utilities. Engineer: economy studies, plant startup, ar.alyris o f physics tests. 1967-1974 U.S. Naval Reserve. active duty. Instruct:r of nava science, Cornell University, 1971-1974; Reac cr Department of USS Enterprise, de;loyment and re fuel ing-overnaul, 1969-1971; Nuclear ?cwer training program and Officer Candidate School, 1967-1969. 1964-1967 ' Cincinnati Bell. Pl ant staff assistant and wort-stucy program trainee. MEMSERSHIPS. LICENSIS. AND HCHORS The Society for Risk Assessment. Institute of Electrical and Electronics Engineers. American Nuclear Scciety. A erican Association for the Advancemen cf Science. The New Yor< Academy of Sciences. U.S. "aval Reserve, Cc =ander. Registered Nuclear Engineer, State cf California.

SLEY - 3 Sigma Xi (national science henors socie y), 1975. Sherman R. Xna:o Feil wsnip Ulor-heas: Utilities), 1975-1975. 51 oan Resear:h Traineesnip, 197 -1975. Eta Xacca Nu (national electrical engineering honors socie y),1957. RE?CRTS ANO 3'J3LICATIONS "SeacrooK ?recacilistic Safety Assessment," Puclic Service C: meany of New Han=snire, o se puolisned in 1983. Pi:kard, L0we and Garrick, Inc., " Midland ?rcoabilistic Risk Assessment,* C:nsumers ?cwer Com:any, to se puolished in 1982. Oconee Probabilistic Risk Assessment," a join eff:r: of ne Nuclear 4 Safety Analysis Center, Duke ?cwer, and other participa:ing utilities, to be puoiished in 1982. Tennessee Valley Authority and Pickard, L:we and Gar ick, Inc., "Br:wns Ferry Precacilistic Risk Assessment," : ce puolfsned in 1932. A cstolakis, G., M. Ka:arians, and D. C. 31ey, "A Methodelogy for Assessing the Risk fr:m Caole Fires," ac:epted for puolication in Nuclear Sa fe ty, 1932. Kaolan, S., H. F. ?erla, and D. C. Slay, "A Methodclogy for Seismic Safety Analysis of Nuclear ?:wer ?lants," ;rocosed presenta:fon at tne International Meeting on Thermal Nuclear Reactor Safety, Chi age, Illinois, August 29-Septemoer 2,1982. Bl ey, D. C., S. Kaplan, and 3. J. Garrick, "Assecoling and Dec mposing ?RA Resul s: A Matrix Formarism," proposed presentation at the International Meeting on Thermal Nuclear Reactor Safety, Chicage, Illinois, August 29-Septemcer 2,1982. Garrick, 3. J., S. Kaplan, and D. C. Sl ey, "Recent Advances in ?r:babilistic Risk Assessment," precared for :Me MIL Nuclear P wer Reac ce Safety Course, Camoridge, Massachusetts, July 19, 1982. Fleming, X t . Kaplan, and 3. J. Garrick, "Seabrook ?r:babilistic Safety Assessment Management 31an,"?LG-0239, June 1982. Garrick, 3. J., " Lessens Learned From First Generation Nuclear ?lan: ?rcoacilistic Risk Assessments," to be presented at the '4crkshco en Low-?rcoacility/High-Consequence Risk Analysis, Arling::n, Virginia, June 13-17,1952.

ELEY - 4 3arrick, 3. J., S. Xaol an, D. C. Iden, E. 3. Cl eveland, H. F. ?erla,

3. C. 31 ey, D. W. Stillwell, H. V. Scnneider, and G. Acostslakis, "?:wer Plan: Availacility Engineering: Me: nods of Analysis, ?r: gram Planning, and Acplications,* E?RI NP-2158, PLG-0155, May 1932.

Sley, O. C., and R. J. Mulvihill, "Cemments en Evaluation of Avafiacili y Imorovemen: Oc icns for Moss Landing Units 5 and 7," PLG-0225, Mar:n 1982. Stillwell, O. W., G. Acostolakis, D. C. Bl ey, P. H. Raabe, R. J. Mulvihill, S. Ka:lan, and 3. J. Garrick, "EEI Availacility Hancbeck," ?LG-0213, January 1982. Sley, O. C., L. G. H. Sarmanian, and O. W. Stillwell, "Rel f acility Analysis of Safety Injecticn System Modification, San Onofre Nuclear Generating Station - Unit 1,".PLG-0206, Oct:ber 1981. "Zicn Precaoflistic Safety Study," Cc=manwealth Edison C:mpany, Septemcer 1931. Su :emer, O. R., " Analysis of Postulated Accidents During L:w Power Testing at the San Cnofre Nuclear Generating Station--Uni: 2," PLG-0199, Septeaser 1981. Bl ey, D. C., O. W. 5:filwell, and R. R. Fray, "Relf acili:y Analysis cf Diable Canyon Auxiliary Feedwater System," presented at the Tenth 3iennial Tecical Conference on Reacter Operating Experience, Cleveland, Chic, Augus; 17-19, 1981. Garrick, 3. J., and O. C. Siey, " Lessons Learned fr:m Current PRAs," cresentec to :ne ACRS Subc:mmittee en Reliacility and Prebabilistic Risk - Assessnent, Los Angeles, California, July 23, 1981. Kapl an, S., G. Apost:lakis, 3. J. Garrick, D. C. Bley, and K. Woodard, " Methodology for Procaoflistic Risk Assessnent of Nuclear Power Plants," draf t version of a book in preparation, ?LG-0209, June 1981. ?erl a, H. F., "Proj ect Pl an: Precabilistic Risk Assessnent, Midland i Nuclear Pcwer Plant," PL9-0150, May 1981. l Bl ey, D. C., C. L. Cate, D. W. Stillwell, and 3. J. Garrick, "Midl and Plant Auxiliary Feecwater System Reliability Analysis Synopsis," ?LG-0156, March 1981. Pickard, Lowe an: Garrick, *nc., "A Methedclogy to Quantify Uncertain y cf Cos: Of Electricity for A1:arnate Cesigns of (C:=bustien) Turcine Comsined Cycie Pl ants," PLG-0152, March 1981. - m ,4 . ~

3 LEY - 5 Garricx, B.. J., S. Ahmed, and D. C. 31ey, "A Methodolcgy f:r Evaluating ne Cos s and Senefits of Pcwer Plan: Otagnostic Tecnniques," su:mittad for cresentation a :ne Ninth Turecmacninery Sy=posium, Houst:n, Texas, Decemoer 9-11, 1980. Pickard, Lowe and Gc.rricx, Inc., " Seminar: Prcoacilistic Risk Assessmen of Nuclear Peder Plants," PLG-0134, Novecoer 1980. Pickard, Lowe and 3arrick, Inc., " Project Pl an: Pecoacilistic Risk Asses sment, 3r:wns Ferry Nuclear Plant Uni-1," PLG-0119, Oct:cer 1980. Garrick, E. J., S. Kapir.n, D. C. Iden, E. 3. Cl eveland, H. F. Perla, O. C. Bley, and O. W. Stillwell, "Pcwer ?lan: Availability Engineering, Methods of Analysis - Program Planning - Appi f ca:f ons," 2 Vols., PLG-0148. Oct:ber 1980. I 31 ey, D. C., C. L. C a :a, D. V.' Stillwell, and 3. J. Garrick, " Midland Plan: Auxiliary Feeduater Systea Reliability Analysis," PLG-0117,- Oct:cer 1980. Sl ay, D. C., D. M. Wheeler, C. L. Cate, D. W. Stillwell, and

3. J. Garrick, " Reliability Analysis of Of aolo Canyon Auxiliary Feecwater Sy stem," PLG-0140, Septemoer 1980.

Garrick, 3. J., et al, "Pr: Ject Plan: Oc: nee ?r:basilistic Risk As sessnent,' PLG-0128, August 1980. Garrick, 3. J., O. M. Wheel er, E. 3. Cl evel and, D. C. Bl ey, L. H. Reichers, and C. 3. Morrison, "Ocerating Excerience of Large U.S. Steam Turoine-Genera::rs; Volume 1 - Data, Volc=e 2 - Utility Di rectory," PLG-0134, June 1980. Garrick, 3. J., S. Xapl an, and O. C. Bley, " Seminar: Pcwer Plan Procabilistic Risk Assessment and Reliability," TLG-012/, May 1980. Garrick, 3. J., and S. Xaplan, "0yster Creek Prceabilistic Safety Anal-ysis (CPSA)," presented at the ANS-ENS Topical Meeting on Thermal React:r Sa fety, Knoxville, Tennessee, April 8-11, 1980. Garrick, 3. J., S. Xaolan, G. E. Apostolakis, D. C. 31ey, and i T. E. Pctter, " Seminar: Preeabilistic Risk Assess =en as Applied to Nuclear ?cwer ?lants," PLG-0121, March 1980. Garrick, 3. J., S. Ahmed, and D. C. Bley, "A Methodology for Evaluating

ne Cos:s and Beneft:s of Pcwer Plan: Of agnostic Tecnniques," PL3-0115, January 1980.

l

ELEY - 5

<a:lan, S., 3. J. Garrick, and O'. C. El ey, "No as on Ri sx, ?r:oacili y' and ecisien, FLG-0112, Novemoc 1979.

31 ey, D. C., C. L. Cate, D. C.

en, 3. J. Garri:%, and J. M. Mucscn' Seismic Safe.y Margins Resear:n Program (?hase I), Projec-VII. sy ;3ms an aly si s, PL -0110, sep accer 1979.

Cats, C. L., and 3. J. Garricx, "*4-501 C mous:f on Tur:ine Starting Rei f acility Analy sis," PLC-0103, June 1979. ?f ckard, L:we and 'ar-ick, Inc., "Pl an: Availacility Program Soecifica- ,icn, san Onorre Nuclear Generating Sta-ion," Maren 1979. Pickard, Lewe.and Garrick, Inc., "'Jork Order Scheduline Systam' Design Specifica icn," March 1979. ~ I I O i t {

i NAME B. JOHN GARRICK EDUCATION Ph.D., Engineerirg, University of California, Los Angeles,1968. M.S., Engineering, University of California, Los Angeles,1962. B.S., Physics, Brigham Young University,1952. U.S. Atomic Energy Comission Grant-in-Aid, Oak Ridge School of Reactor Technol ogy, 1954-1955. PROFESSIONAL EXPERIENCE General Summary A principal of Pickard, Lowe and Garrick, Inc. Consultant in reliability and availability, risk analysis, licensing and safety, management systems, and engineering. Pioneered early use of re'iability and risk analysis technology in nuclear and fossil power plants. Served on several design review and safety committees and other task forces related to power plant design and operations. Study director of numerous major risk studies of nuclear power plants including Oyster Creek, Zion, Indian Point, LaSalle, Pilgrim 1, Midland, and Browns Ferry. Extensive experience with hearings and the general nuclear licensing process. Coordinator and principal lecturer for the annual UCLA short course on pcwer plant reliability. Presented numerous seminars on risk and safety analysis at such institutions as MIT, the University of California, and the United Kingdom's National Centre of Systems Reliability. Served on several accreditation teams evaluating engineering curriculum at different universities. Organized and conducted numerous workshops and training programs on maintenance, reliability, and availabilty for EPRI, DOE, and many utilities. Adjunct Professor, University of California, Los Angeles; member of several institutional committees including the UCLA Radiation Committee, the Select Review Comittee for the Clinch River Breeder Reactor, Design Review Board for the Midland Nuclear Power Plant, Direction and Control System Advisory Comittee of the Governor's Emergency Task Force on Earthquake Preparedness, and Boston Edison's Audit and Nuclear Review Comi ttee. Chronological Summtry 1975-Present Principal, Pickard, Lowe and Garrick, Inc. 1957-1975 Holmes & Narver, Inc. Key Positions: Member of Board of Directors; President, Nuclear & Systems Sciences Group; Sr. Vice President; Vice President, Science & Technology, The Resource Sciences Corporation, Tulsa, Oklahcma (parent company).

GARRICK - 2 1955-1957 Physicist, Hazards Evaluation Branch, U.S. Atomic Energy Commission, Washington, D.C. 1952-1954 Physicist, Phillips Petroleum Company, National Reactor Testing Station, Idaho. MEMBERSHIPS, LICENSES, AND HONORS American Nuclear Society. Fellow, Institute for the Advancement of Engineering. New York Academy of Sciences. Registered Professinal Engineer, State of California. Leaders in American Science (Eighth Edition). REPORTS AND PUBLICATIONS "Seabrook Probabilistic Safety Assessnent," Public Service Company of New Hampshire, to be published in 1983. Pickard, Lowe and Garrick, Inc., " Midland Probabilistic Risk Assessment," Consumers Power Company, to be published in 1982. Oconee Probabilistic Risk Assessment," a joint effor.t of the Nuclear Safety Analysis Center, Duke Power, and other participating utilities, to be published in 1982. Tennessee Valley Authority and Pickard, Lowe and Garrick, Inc., " Browns Ferry Probabilistic Risk Assessment," to be published in 1982. Garrick, B. J., and H. F. Per:la, " Quantitative Risk Management - A New Tool for the Engineering of Facilities," to be presented at the ASCE National Convention, New Orleans, Louisiana, October 25, 1982. Garrick, G. J., " Experiences and Practices in the Applications of Risk Analysis," to be presented at the ORSA/TIMS,1982, Joint National Meeting, San Diego, California, October 25-27, 1982. Heising, C. D., A. W. Barsell, K. N. Fleming, S. Kaplan, and B. J. Garrick, "A comparison of Recent Nuclear Plant Risk Assessments," proposed presentation at the Congres Annuel 1982, SFRP, La Comparaison des Risques Associes aux Grandes Activites Humaines, Avignon, France, October 18-22, 1982. Garrick, B. J., "Probabilistic Risk Assessments and Quality Assurance," to be presented at the Ninth Annual Natior.al Energy Division Conference, ASQC, Orlando, Florida, October 12-15, 1932.

GARRICK - 3 Bley, D. C., S. Kaplan, and B. J. Garrick, " Assembling and Decomposing PRA Results: A Matrix Formalism," proposed presentation at the International Meeting on Thermal Nuclear Reactor Safety, Chicago, Illinois, August 29-September 2,198?. Kaplan, S., "On a 'Two-Stage' Bayesian Procedure for Determining Failure Rates from Experiential Data," PLG-0191, preprint of a paper to appear in the IEEE Transactions on Power Accaratus and Systems, August 1982. Garrick, B. J., "Probabilistic Risk Assessment as an Aid to Risk Management," presented to the 17th Intersociety Energy Conversion Engineering Conference, Los Angeles, California, August 8-13, 1982. Garrick, B. J., S. Kaplan, and D. C. Bley, "Recent Advances in Probabilistic Risk Assessment," prepared for the MIT Nuclear Power Reactor Safety Course, Cambridge, Massachusetts, July 19, 1982. Fleming, K. N., S. Kaplan, and B. J. Garrick, "Seabrook Probabilistic I Safety Assessment Management Plan,",PLG-0239, June 1982. Garrick, B. J., " Lessons Learned From First Generation Nuclear Plant Probabilistic Risk Assessments," to be presented at the Workshop on Low-Probability /High-Consequence Risk Analysis, Arlington, Virginia, June 15-17, 1982. Garrick, B. J., S. Kaplan, D. C. Iden, E. B. Cleveland, H. F. Perla, D. C. Bley, D. W. Stillwell, H. V. Schneider, and G. Apostolakis, " Power Plant Avail ability Engineering: Methods of Analysis, Program Planning, and Applications," EPRI NP-2168, PLG-0165, May 1982. Garrick, B. J., and H. F. Perla, " Management of PRA Projects," presented at the ANS Executive Conference, Arlington, Virginia, April 4-7, 1982. Garrick, B. J., "Results From Recently Performeo PRA Studies (Zion / Indian Point) and the Proposed Use of such Studies for Safety Decision-Making," presented at the ANS Northeastern Section and M.I.T. Department of Nuclear Engineering Meeting, Cambridge, Massachusetts, March 16,1982. " Indian Point 2 and 3 Probabilistic Safety Study," Power Authority of the State of New York and Consolidated Edison Company of New York, Inc., March 1982. .w

GARRICK - 4 Stillwell, D. W., G. Apostolakis, D. C. Bley, P. H. Raabe, R. J. Mulvihill, S. Kaplan, and B. J. Garrick, "EEI Availability Handbook," PLG-0218, January 1982. " Zion Probabilistic Safety Study," Commonwealth Edison Company, September 1981. Garrick, B. J., and D. C. Iden, " Project Plan, Probabilistic Risk Assessment, LaSalle County 1 and 2," PLG-0208, September 1981. Siu, N. O., and B. J. Garrick, " Analysis of Severe Transportation Accident Environment Frequencies," PLG-0207, September 1981. Mulvihill, R. J., B. J. Garrick, Y. G. Mody, and D. A. Reny, " Comparative Evaluation of Air Quality Control Equipment Availability for Intermountain Power Project,",PLG-0200, September 1981. Iden, D. C., B. J. Garrick, and Loren Reichers, "0yster Creek Feed and Condensate System Reliability Study," presented at the Tenth Biennial Topical Conference on Reactor Operating Experience, Cleveland, Ohio, August 17-19, 1931. Stillwell, D. W., B. J. Garrick, D. R. Buttemer, G. Apostolakis, J. C. Lin, and S. Kaplan, " Analysis of the Pilgrim Nuclear Power Station Reactor Protecuan System," PLG-0195, July 1981. 2 Garrick, 3. J., and D. C. Bley, " Lessons Learned frem Current PRAs," l preser.ted to the ACRS Subcommittee on Reliability and Probabilistic Risk Assessment, Los Angeles, California, July 28, 1981. Kaplan, S., G. Apostolakis,.B'. J. Garrick, D. C. Bley, and K. Woodard, " Methodology for Probabilistic Risk Assessment of Nuclear Power Plants,". draft version of a book in preparation, PLG-0209, June 1981. Mulvibill, R. J., B. J. Garrick, and Y. G. Mody, " Reliability, Availability, and Maintainability (RAM) Program Plan," PLG-0182, June 1981. Mulvihill, R. J., and B. J. Garrick, R. S. Hanson, S. Kaplan, Y. G. Mody, D. A. Reny, L. H. Riechers, and H. Y. Schneider, " Comparative Evaluation of Boiler Availability for Intennountain Power Project," PLG-0169, April 1981. I Mulvibill, R. J., and B. J. Garrick, " Tutorial: Reliability Analysis of Plant Systems and Components; A Boiler Procurement Case History," i PLG-0171, presented to the Eighth Annual Reliability Engineering Conference for the Electric Power Industry, Portland, Oregon, April 1981. w -s -s . m y

GARRICX - 5

Kaplan, S., and B. J. Garrick, "On the Quantitative Definition of Risk,"

PLG-0196, Risk Analysis, Vol.1, No.1, March 1981. Bley, D. C., C. L. Cate, D. W. Stillwell, and B. J. Garrick, " Midland Plant Auxiliary Feedwater System Reliability Analysis Synopsis," PLG-0166, March 1981. Garrick, B. J., S. Xaplan, and N. O. Siu, " Definition of Bounding Physical Tests Representative of Transport Accidents - Rail and Truck," PLG-0164, March 1981. Kaplan, S., B. J. Garrick, and G. Apostolakis, " Advances in Quantitative Risk Assessment - The Maturing of a Discipline," IEEE Transactions on Nuclear Science, NS-28, No.1, February 1981. Garrick, B. J., and D. C. Idea, " Project Plan: Probabilistic Risk Assessment, LaSalle County 1 and 2," PLG-0158, January 1981. Apostolakis, G., S. Kaplan, B. J. Garrick, and R. J. Duphily, " Data Speciali:ation for Plant Specific Risk Studies," Nuclear Engineering and Design 56, 1980. Kaplan, S., L. H. Reichers, and B. J. Garrick, " Histogram Convolution Program (HICOP)," PLG-0157, Decemb'er 1980. Garrick, B.. J., S. Ahmed, and D. C. Bley, "A Methodology for Evaluating the Costs and Benefits of Power Plant Diagnostic Techniques," submitted for presentation at the Ninth Turbomachinery Symposium, Houston, Texas, December 9-11, 1980. Hanson. R. S., J. C. Lin, D. M. Wheeler, S. Kapl an, B. J. Garrick, D. C., Iden, W. B. Holder, and L. G. H. Sarmanian, "An Assessment of the Reliability of Turbine-Generat rs," PLG-0155, November 1980. Garrick, B. J., S. Kaplan, D. C. Iden, E. B. Cleveland, H. F. Perl a, D. C. Bley, and D. W. Stillwell, " Power Plant Availantlity Engineering, Methods of Analysis - Program Planning - Applications," 2 Vols., PLG-0148. October 1980. Bley, D. C., C. L. Cate, D. W. Stillwell, and B. J. Garrick, " Midland Plant Auxiliary Feedwater System Reliability Analysis," PLG-0147, October 1980. Bley, D. C., D. M. Wheeler, C. L. Cate, D. W. Stillwell, and B. J. Garrick, " Reliability Analysis of Diablo Canyon Auxiliary Feedwater System," PLG-0140, September 1980.

GARRICK - 6 Garrick, B. J., et al, " Project Plan: Oconee Probabilistic Risk Assessment," PLG-0138, August 1980. Garrick, B. J., D. M. Wheeler, E. B. Cleveland, D. C. Bley, L. H. Reichers, and C. B. Morrison, " Operating Experience of Large t U.S. Steam Turbine-Generators; Yolume 1 - Data, Volume 2 - Utility Directory " PLG-0134, June 1980. Garrick, B. J., and D. C. Iden, " Study Plan: Probabilistic Risk Assessment, LaSalle County 1 and 2," PLG-0128, June 1980. Kaplan, S., R. S. Hanson, B. J. Garrick, and J. W. Stetkar, "A Strategic Plan for a National Data System for Electric Power Plants," PLG-0144, July 1980. Garrick, B. J., S. Kaplin. C. 'Apostolakis, D. C. Iden, K. Woodard, and T. E. Potter, " Seminar: Probabi'iistic Risk Assessment of Nuclear Power P1 ants," PLG-0141, July 1980. Garrick, B. J., S. Kaplan, and D. C. Bley, " Seminar: Power Plant Probabilistic Risk Assessment and Reliability," PLG-0127, May 1980. Garrick, B. J., " Power Plant Availability Decision-Making Under Uncer-tainty'," presented at the 34th Annual Technical Conference, American Society for Quality Control, Atlanta, Georgia, May 20-22, 1980. Garrick, B. J., end S. Kaplan, "A Conceptual Plan for a National Data System for Electric Power Plants," PLG-0131, April 1980. Garrick, B. J., and S. Kaplan~, "0yster Creek Probabilistic Safety Anal-ysis (OPSA)," presented at the ANS-ENS Topical Meeting on Themal Reactor Safety, Knoxville, Tennessee, April 8-11, 1980. Kaplan, S., and B. J. Garrick, "A Strategic Plan for a National Reliability Data System," PLG-0125, March 1980. Garrick, B. J., S. Kapl an, G. E. Apostolakis, D. C. Bley, and T. E. Potter, " Seminar: Probabilistic Risk Assessment as Applied to Nuclear Power Pl ants," PLG-0124, March 1980. Kaplan, S., and B. J. Garrick, "Try Probabilistic Thinking to Improve Power Plant Reliability," Power, March 1980. Garrick, B. J., " Progress Report: Availability Engineering Guide, Electric Power Plants," presented to the EEI Availability Engineering Task Force, Atlanta, Georgia, March 26, 1980.

GARRICK - 7' Garrick, B. J., "Probabilitistic Risk Assessment and Regulation," presented at the AIF Workshop on Licensing and Technical Issues, - Post TMI, Washington, D.C., March 9-12, 1980. Garrick, B. J., S. Ahmed, and D. C. Bley, "A Methodology for Evaluating the Costs and Benefits of Power Plant Diagnostic Techniques," PLG-0118, January 1980. Garrick, B. J., " Power Plant Reliabilty: Practices and Trends," presented to the IEEE Power Engineering Society, San Francisco Section, January 15, 1980. Apostolakis, G., S. Kaplan, B. J. Garrick, and W. Dickter, " Assessment of the Frequency of Failure To Scram in Light Water Reactors," Nuclear Safety, Vol. 20, No. 6, November-December 1979. Garrick, B. J., and H. F. Perla, " Maintenance Management in the Electric Util i t,v Industry," presented to the International Conference on Energy Use Management, Los Angeles, Calfornia, October 22-26, 1979. Bl ey, D. C., C. L. Cate, O. C. Iden, B. J. Garrick, and J. M. Hudson, " Seismic Safety Margins Research Program (Phase I),- Project VII - Systems Analysis," PLG-0110, September 1979. Garrick, B. J., S. Kaplan, and S. Ahmed, "A Reliability Prediction Technique for Selected Themomechanical Components of Gas Turbine l Combined Cycle Plants," PLG-0109, September 1979. Iden, D. C., S. Ahmed, and B. J. Garrick, " Impact of 18-Month Refueling Cycle on BWR Plant Availability," PLG-0107, September 1979. Garrick, B. J., S. Kaplan, P. P. Bieniarz, K. Woodard, D. C. 'Iden, H. F. Peria, W. Dicter, C. L. Cate, T.- E. Potter, R.1. Duphily, T. R. Robbins, D. C. Bley, and S. Ahmed, "0PSA, Oyster Creek Probabilistic Safety Analysis," (Executive Summary, Main Report, Appendixes), PLG-0100 DRAFT, August 1979. Garrick, B. J., and S. Ahmed, " Technical Note: Prediction of Reliability Growth for Alternate Designs of Combustion Turoines," PLG-0105, July 1979. Kaplan, S., and B. J. Garrick, "On the Use of a Bayesian Reasoning in Safety and Reliability Decisions--Three. Exampies," Nuclear Technology,. Vol. 4, July 1979.

Kaplan, S., and B. J. Garrick, " Notes on Prediction of Reliability,"

PLG-0117, June 1979. s --&!-d -e----- 1w--umw-.+e

• e<-

, e =-m T- +e-r- - P-mn -f

d GARRICK - 8 Garrick, B. J., and R. W. Pack, " Workshop Proceedings: Outage Planning and Maintenance Management," 2 Vols., June 1979. Kaplan, S., and B. J. Garrick, " Notes for a Workshop on Risk, Reliability, and Decision Under Uncerr.ainty," presented at Battelle Northwest Laboratory, June 1979. Cate, C. L., and B. J. Garrick, "W-501 Combustion Turbine Starting Reliability Analysis," PLC--0103, June 1979. Garrick, B. J., P. P. Bientarz, and S. Kaplan, " Risk Analysis of Transporting Oconee Spent Nuclear Fuel to the McGuire Nuclear Station," PLG-0102, June 1979. Iden, D. C., S. Ahmed, B. H. Garrick, and J. K. Pickard, " Full Core Removal Study," PLG-0101, May.1979. Garrick, B. J., and S. Kaplan, " Training Engineers to be Reliability Practitioners," presented to the Sixth Annual Reliability Engineering Conference for the Electric Power Industry," Miami Beach, Florida, April, 19-20, 1979. Dickter, W., B. J. Garrick, and S. Ahmed, " Selecting Corrective Actions," March 1979. Apostolakis, G., S. Kaplan, B. J. Garrick, and W. Dick'ter, "An Assessment of the Frequency of Failure to Scram," Vol. 20, No. 6, Nuclear Safety, November-December 1979. Garrick, B. J., " Establishing Availability Goals in Procurement," presented to the ANS Topical Meeting on Reliable Nuclear Power Today, Charlotte, North Carolina, April 9-13, 1978. Garrick, B. J., "0yster Creek Probabilistic Safety Analysis, Phase 1 Report," February 1978. Garrick, B. J., " Energy and Property Values," presented to the 1978 Southern Region Conference, California Assessors' Association, Anaheim, February 8-10, 1978. Garrick, B. J., S. Kaplan, and P. P. Bieniarz, " Input Material for Reliability Section of Westinghouse Turbine-Generator Proposal to Middle South Utilities," December 1977. Garrick, B. J., and W. Dickter, "How Do We Improve the Productivity of Large Power Plants?" presented at the Pacific Coast Electrical Association Engineering' and Operating Conference, Los Angeles, California, March 1977.

GARRICK - 9 Garrick, B. J., " Reliability Engineering Guide, Sundesert Nuclear Plant," October 1976. Garrick, B. J., "Where Do We Go from Here in Inproving Reliability? The Role of the Consultant," presented to the ANS Executive Conference, Hot Springs, Virginia, September 27-29, 1976. Garrick, B. J., and S. Kaplan, " Reliability Technology and Nuclear Power," IEEE Transactions on Reliability, Vol. R-25, No. 3, August 1976. Garrick, B. J., " Technical Note: Cost-Benefit Estimate of Transporting Spent Nuclear Fuel by Special Trains," August 1976. Garrick, B. J., " Broadening the Application of Risk and Reliability Technology (Summary)," presented to the ANS Annual Meeting, Toronto, Canada, June 13-18, 1976. Garrick, B. J., and W. C. Gekler, "The Impact of Reliability on Power Plant Economics," prerented to the Pacific Coast Electrical Association Engineering and Operating Conference, San Francisco, California, March '.8-19, 1976. Garrick, B. J., " Nuclear Power - Issues with Answers,." Engineering Forum, California State IJniversity, Long Beach, February 27, 1976. Garrick, B. J., and S. Xaplan, " Reliability Technology' and Nuclear Power," 197 5. Garrick, B. J., "Nuclee~ Power Plant Availability, Its Costs and Benefits (Outline Only)," presented to the. Atomic Industrial Forum, Workshop on Reactor Licensing & Safety, San Diego, California, December 10-13, 1974. Garrick, B. J., A. A. Jarrett, E. B. Cleveland, and W. C. Gekler, " Availability Analysis: Initial Allocation of the Clinch River Breeder Reactor Plant," NSS-8212, Project Management Corporation, Chicago, Illinois, November 1974. Garrick, B. J., W. C. Gekler, E. B. Cleveland, and L. T. Allard, " Reliability Assurance Program Plan for the Clinch River Breeder Reactor P1 an'c," NSS-8212, November 1974. Gt rrick, B. J., C. V. Hodge, and A. A. Jarrett, " Transportation Accident T'.sks in the Nuclear Power Industry 1975-2020," NSS 8191, November 1974.

GARRICK - 10 Garrick, B. J., " Problems and Methodology in Power Plant Siting Based on the California Experience," presented to the Power Systems Engineering Program, The University of Arizona, Tucson, March 1974. Garrick, B. J., " Site Evaluation Decision Methodology," 1973. Garrick, B. J., " California Power Plant Siting," Nuclear Safety,1973. Garrick, B. J., " Risk and Systems. Analysis Projects," Holmes & Narver, Inc., Decembar 18, 1972. Garrick, B. J., and R. J. Mulvihill, " Maintainability in Automated Postal Systems," presented to the Los Angeles Maintainability Association, SYMPO-72, May 20, 1972. Garrick, B. J., S. Xaplan, "A Method for Evaluating Nuclear Plant Siting Concepts," presenteed before tne Joint Committee on Atomic Development and Space, California Legislature, Sacramento, May 19, 1972. Garrick, B. J., S. Kaplan, and O. C. Baldonado, "On a Decison Theory Fomalism for Nuclear Power Plant Siting," presented to the Conference on Unique Siting Concepts for Nuclear Power Plants, Joint Committee on Atomic Development and Space, Sacramento, California, May 9,1972. Garrick, B. J., " Reliability Analysis of Bulk Mail Handling Facilities, Holmes & Narver, Inc., Los Angeles, California,1971. Garrick, B. J., R. J. Mulvihill, et al, " Failure Modes Analysis for the New York Bulk Mail Center," HN-8101.20, August 1971. Garrick, B. J., R. J. Mulvihill, et al, "RMA Studies and Recommendations for Chicago Bulk Mail Center," HN-8114.1 (Rev.), AJgust 1971. Garrick, B. J., R. J. Mulvibill, et al, " Failure Modes Analysis for the NBMS Modul ar BMC," HN-8106.6, n.d. i. Garrick, B. J., " Reliability Analysis of Bulk Mafi Handling Facilities," Tenth Annual Reliability and Maintainability Conference, Anaheim,- California, June 28-30, 1971. Garrick, B. J., O. C. Baldonado, and W. C. Gekler, " Estimating the Risk Involved in Transport of Hazardous. Materials," presented at CREST, Specialist Meeting on Applicability of Quantitative Riiability Analysis of Complex Systems and Nuclear Plants in Its Relation to Safety,-Munich, Gemany, May 1971.

GARRICK - 11 Garrick, B. J., O. C. Baldonado, and W. C. Gekler, " Estimating the Risk Involved in Transport of Hazardous Materials," presented to the Armed Services Explosives Safety Board Seminar, August 25-27, 1970. 4 Garrick, B. J., R. J. Mulvibill, et al, " Reliability Analysis of Substation Unit Configurations," HN-216, January 1970. Gekler, W. C., et al, and B. J. Garrick, "A Risk Model for the Transport of Hazardous Matef als," HN-204, August 31, 1969. Ge<ler, W. C., O. C. Baldonado, H. K. Elder, J. E. Shapley, and B. J. Garrick, "A Risk Model for the Transport of Hazardous Materials," HN-204, August 1969. Garrick, B. J., C. V. Chelapati, R. A. Williamson, D. V. Dominic, and O. C. Baldonado, "Probabilistic Analysis of Nuclear Reactor Containment Structures," Part I - Seismic Analysis of Reactor Building, Volume I, HN-203, June 1969. Chelapati, C V., R. A. Williamson, C. V. Dominic, O. C. Baldonado, B. J. Garrick, "Probabilistic Analysis of Nuclear Reactor Containment Structures," Part I - Seismic Analysis of Reactor Building and Part 2 - Finite Element Analysis of Drywell Oue to Loss-of-Coolant Accident, HN-203, June 1969. Garrick, B. J., B. Shimizu, W. C. Gekler, and J. H. Wilson, " Collection of Reliability Data at Nuclear Power Plants," HN-199, December 1968. Garrick, B. J., " Unified Systems, Safety Analysis for Nuclear Power Plants," Ph.D. Thesis, University.of California, Los Angeles, California, 1968. Garrick, B. J., B. Shimizu, M. T. Campora, R. C. Erdmann, W. C. Gekl er, and J. E. Shapley, " Reliability Monitoring Pilot Test Program - Connecticut Yankee Project, Part I - Program Initiation," (preliminary draf t), HN-198, September 1968. Jackson, M. W., B. J. Garrick, R. A. Williamson, R. P. Kennedy. D. L. Platus, V. A. Smoots, " Report of Study of Hanford Waste Tank Structure," HN-197, May 1968. Garrick, B. J., W. C. Gekl er, O. C. Bal donado, E. H. Behrens, and B. Shimizu, " Classification and Processing of Reliability Data from Nuclear Power P1 ants," HN-193, February 1968. l Garrick, B. J., and S. Kaplan, " Notes on Fault Trees and Reliability Calculations," (unpublished work), HN 342.32.08, September 1967. i

c GARRICK - 12' Garrick, B. J., R. C. Erdmann, and S. Kaplan, "Another Approach to Reliability Calculations," (unpublished work), HN 342.32.07, August 1967. Garrick, B. J., B. Shimizu, E. H. Behrens, W. C. Gekler, L. Goldfisher, and J. H. Wilson, " Reliability Analysis of Carolinas Virginia Tube Reactor Engineered Safety Systems," (preliminary draft), HN-191, August 1967. Garrick, B. J., and W. C. Gekler, " Reliability Analysis of Engineered Safeguards," Nuclear Safety, Vol. 8, No. 5, November 1967. Garrick, B. J., W. C. Gekler, L. Goldfisher, R. H. Karcher, B. Shimizu, and J. H. Wilson, " Reliability Analysis of Nuclear Power Plant Protective Systems," HN-190, Phillfps Petroleum Company, May 1967. Garrick, B. J., "An Approach to Systems Safety Analysis for Nuclear Power Plants," paper presented at the meeting of the Comittee on Reactor Safety Technology, Brussels, Belgium, April 11-12, 1967. Garrick, B. J., W. C. Gek1er, H. P. Pomrehn, "Are P1 ant Engineered Safeguards Reliable?" Nucleonics, January 1967. Garrick, B. J., W. C. Gekler, H. P. Pomrehn, "An Analysis of Nuclear Power Plant Operating and Safety Experience," HN-185, December 1966. Garrick, B. J., J. H. Wilson, R. H. Karcher, "Shieldin'g Effectiveness of Soils Against Initial Radiation," HN-186, August 1966. Garrick, B. J., " Engineering Aspects of Nuclear Plant Safety," American Society of Civil Engineers, January 1966. Garrick, B. J., " Siting Aspects of a Nuclear Power Reactor in the Republic of Korea," performed for the International Atomic Energy Agency under the auspices of the U. S. Atomic Energy Comission, June 1966. Garrick, B. J., R. H. Karcher, J. H. Wil son, " Structural and Shielding Considerations in the Design of Hardened Facilities," HN-183, June 1966. Garrick, B. J., W. C. Gekler, H. P. Pomrehn, " Preliminary Site Analysis and Nuclear Design Evaluation of a Proposed Large Central Station Nuclear Power Plant," May 1965. Garrick, B. J., W. C., Gekler, H. P. Pomrehn, " Preliminary Site Analysis and Nuclear Design Evaluation of a Proposed Large Central Station Nuclear Power P1 ant," May 1965.

GARRICK - 13 Garrick, B. J., W. C. Gekler, H. P. Pomrehn, "Some Aspects of Protective Systems in Nuclear Pcwer Plants," 1965 IEEE International Convention, March 1965. Garrick, B. J., W. C. Gekler, " Monitoring the Reliability of Engineered Safeguards," American Nuclear Society National Topical Meeting, February 1966. Garrick, B. J., "A Numerical Formalism for Reactor Site Selections," UCLA Research Project,1964. Garrick, B. J., W. C. Gekler, J. M. Duncan, R. H. Karcher, B. Shimilu, "A Study of Research Reactor Operating and Safety Experience," HN-180, June 1964. Garrick, B. J., R. H. Karcher, " Design Information for Protection Against Initial Radiation (Secret-Restricted)," HN-179, May 1964. Garrick, B. J., "The Meaning of Test Reactor Operating and Safety Experience to Power Reactor Operations," presented to the 1963 Annual Confarence of the Atomic Industrial Forum, New York, New York, November 18-21, 1963. Garrick, B, H., P. W. van der Pas, "Least Squares Analysis of Parameters of U-233, U-235, and Pu-239," UCLA Research Project, June 1963. Garrick, B. J., W. C. Gekler, " Nuclear Parameter Study of a Pu-239 Gaseous Core Reactor," UCLA Research Project, June 1963. Garrick, B. J., W. J. Costley, W..C. Gekler, "A Study of Test Reactor Operating and Safety Experience," HH-172 (Volumes I and II), May 1963. Garrick, B. J., W. C. Gekler, " Temperature Coefficient Measurement by Cold Water Injection," UCLA Research Project,1962. Garrick, B. J., " Probability Theory as a Couple Between Aton.cspheric Diffusion and Population," UCLA Research Project,1962. Garrick, B. J., et al, "By-Product and Special Nuclear Material Safety Report," September 1960. Garrick, B. J., W. C. Gekler, " Safety and Engineering Site Study for a Nuclear Fuel Reprocessing Plant," June 1960. Garrick, B. J., " Nuclear Fuel Reprocessing Plant Accident Analysis," published by the Florida Development Cc= mission,1960.

GARRICX - 14 Garrick, B. J., "Some Hydrologic and Geologic Considerations of Reactor Site Selection," Second Annual Meeting of California Association of Engineering Geologists, University of Southern California, October 1959. Garrick, B. J., "Research and Development in Reactor Safety," February 1959. Garrick, B. J., " Radiation Barriers in a Reactor Plant," Civil Engineerirg, September 1958. Garrick, B. J., et al, " Thermal and Mechanical Design of the Westinghouse Testing Reactor Core Support Structure," September 1958. Garrick, B. J., "Multigroup-Multiregion Theory for the Consistent P i Approximation to the Boltzmann Equation," ORNL 55-8-189, 1955. e 4 5 4 e 4 m

~ BICGRAPHICAL INFORMATION ~ David K. Goeser Manager - Marketing Nuclear Technology Division Name is David K. Goeser. My business address is Westinghouse Electric Corporation, P.O. Box 355, Pittsburgh, Pennsylvania, 15230. I am employed as the Manager of Marketing in.the Nuclear Technology Division i for Westinghouse Electric Corporation. I was graduated from the Illinois. Institute of Technology of Chicago, Illinois in 1966 with a Bachelor's degree in Electrical Engineering and from the University of Pittsburgh of Pittsburgh, Pennsylvania, in 1967 a with a Master's degree in Electrical Engineering. From 1967 through 1973, I worke'd o'n the FFTF Project, During this period, I was responsible for: the design, analysis and rel.iability evaluations of the FFTF primary and secondary reactor shutdown systems; the design and analysis of. the FFTF. control system; the design and analysis of the FFTF containment isclation system; the specification of perfomance, safety and standard ccmpliance requirements for the safety-related instrumentation and electrical systems; and the specification and review of system requirements for the hardware specifications for the FFTF plant protection system equip-ment. In addition, I wa's a lead participant in the specification of the design themal transients for the FFTF plant, a member of the cemittee ~ which drafted the RDT Standard for Plant Protection Systems (C16-IT), a member of design review comittees for LWR PPS equipment, and a participant in preparing appropriate sections of the FFTF PSAR and design safety assessments. In 1973, I became the Manager, LMFBR Protection and Control Systems for the 1 CRSRP., In this position, I was responsible for the design and analysis of all equipment for the Plant Protection and Plant Control Systems for the Nuclear Steam Supply System for_the CRBRP. Specific responsibilities included the specification of the protective functions and instrumentation to implement these functions, specification and evaluation of analyses of PPS performance, specification and implementation of applicable codes and standards, specifica-tion and implementation of applicable USNRC regulatory guides, design, of the PPS hardware, specification and des.ign of the reactor control rocm, specifica-tion and design of the control system, analysis of control system hardware, reliability evaluation of the shutdown system, and preparation of appropriate sections of the PSAR. In addition, I was a lead participant in defining the duty cycle and design, thermal transients for.the CRBRP,.a lead participant in the development of the CRBRP reliability program, the chaiman of the Inter-national A:cmic Energy Agency Specialist's Meeting of the design for and handling of'themal transients in LMF3R's in 1974, and a participant in various plant design trade studies.

From l'975'to 1978, I was Manager, LRM Nuclear Safety and Licensing. In this position, I was responsible for the safety, licensing and reliability activities assigned to the lead reactor manufacturer. This includes the responsibility for technical and programatic direction of the licensing,' safety analysis and reliability activities being performed at the LRM.and the reactor manufacturers. Frem 1978 to 1980, I was the Manager, Systems Integration for the lead reactor manufacturer. In,this position, I was responsible for the systems engineering, architect-engineer liaison, construction liaison, operating procedure outline generation and review, design control and the activities of my forner position as Manager, Safety Licensing and Reliability. Frem 1980 to 198.1, I was at the Westinghouse Water Reactor Divisions as Manager, Risk Assessment Technol.ogy. I had the responsibility for the program management and for integration of all Westinghouse activities addressing tne reduction of risk resulting frem severe accidents. These activities include the high priority efforts which are currently ongoing in support of Ccmonwealth Edison, PASNY, Consolidated Edison, Duke and TVA. Also included are the responsibility for developing and implementing probabilistic risk assessment and cost benefit evaluation methods, developing models and analytical capabilities required-to evaluate and understand the various phencmena resulting from postulated degraded core scenarios, and developing strategy for and participat,ing in public rulemaking hearings dealing with establishment of a risk-oriented safety goal and consideration s of degraded cores in NRC safety reviews. Responsibility included providing support in areas dealing with risk assessment, analysis of degraded core ~ conditions, evaluation of* design features to prevent and/or mitigate degraded' ~ core conditions, systems reliability evaluations, evaluation of emergency and abnomal operating procedures. From October'1981 to August 1982 I was the Manager, Westinghouse LMFBR Licensing Coordinating Office for the CRPRP. Frem August 1982 to the present, I have been the Manager, Marketing, Nuclear Technology Division. =o h __ l l

s-Robert E. Nnry - Consultant - Phenomenological Task Univ'ersit;y of Notre Dame 1967 Ph.D. Mechanical Engineering Rcbert E. Henry is the Vice President and co-founder of Fauske & Associates, Inc. He spent thriteen years at the Argonne National Laboratory achieving the position of Associate Director of the Reactor Analysis and Safety Division. In this position ne was responsible for all out-of-mactor experimental work pertaining to 11guid-catal, light-water, and gas-ccoled reactor safety. He served on the program cxraittees for the Marviken III Large Scale Criticial Flow Tests (Chaiman) and the Marviken IV Jet Impingement Tests. In addftion he was a member of the team fomed by the telear Safety Analysis Center to investigate the accident at Three Mile Island. At Fauske & Associates, Dr. Henry is now a consultant to electric power uttiities and nuclear reactor equipment nanufacturers in the United He has made major contributions to the Zion States as well as overseas. and Indian Point Hear Site Studies, the Limerick Probabilistic Study, and the Swedish FILTRA Project. Fomerly the Chaircan of the Mechanical Engineering Depament and Dean of the Graduate School at the Midwest College of Engineering and author or more than 75 publications and reports on boiling and two-phase flow, Dr. Henry has given numerous lecture: at universities and has He also has acted as participated in seminars throughout the world. advisor to several graduate studients in mechanical and chemical enginering, and is a member of the American Nucles. xiety. l i t w * **w* l

? Fobert E. Henry, Vice president Dr. Henry received his B.S. (1962), M.S. (1964), and Ph.D. (1967) in Machanical Engineering from the University of Notre Dame where his thesis f work, which was carried out at Argonne National Laboratory, involved an experl= ectal and analytical study of one-co ponent, two-phase critical flow. Following cocpletion of his thesis, he spent two years in the field artillery, leaving the service with the rank of captain. During this time he was attached to the Levis Research Center of the National Aeronautics and Space Administration where he was responsible for ir.iciating experi-cental f acilities for the study of two-component, two-phase critical flew x and one-co=ponent critical flows near the ther:odynamic critical point. Upon coc.pletion of his military obligation, Dr. Henry returned - to Argonne National Laboratory to work in liquid metal'f ast breeder reactor safety research. In particular he was responsible for out-of-reactor experiments on liquid metal superheat and sodium voiding as they relate to hypothetical accidcat conditions. These ' experimental studies played a l c.sj or role in resolving the uncertainties in these phenomena. In addi-tion, he was also responsible for the vapor explosion studies, both analytical and experimental, carried out at Argonne. It was these experi- =ents which gave the first clear deconstration of the physical threshold for such events as " spontaneous nucleation upon contact". ~ In 1974, Dr. Henry was prou ted to Manager of the Expericental l Modeling Section in the Reactor Analysis and Safety Division. At thit l tice, the areas of respor. ibility for the section vere broadened to - include both L173R and LW safety research as well as some limited involve aut with the CCFR. As part of the LVR responsibilities he was

~ 4 cade Chair =an of the Progr9: Co=r.ittee for the Marviken 111 Large Scale Critical Flow Tests. This co=sittee established the original test matrix for these experiments ~ as well as the basic test configuration and I instrumentation requirements. As another part of the LW safety studies, t s=ill scale simulant fluid experiments at ANL revealed that the "early 2, CMF" observed in large LOCA simulation in the Se:1 scale facility could be i governed by spontaneous nucleation. This resulted in two special tests i for the Semiscale program, S-29-2 and S-29-3, for which pretest predictions were presented to the Advisory Co=nittee on Reactor s l Safeguards. The test results were in excellent agreement vich the pretest E predictions, thereby resolving the issue. [ Small scale experiments on vapor explosions, under Dr. Henry's ). direction, revealed the strong effect of system pressure on the ability to f initiate such events. This lead to the large scale, molten salt-vater ij expeti=4 cts at Ispra, which were funded by the German BMFT and the USNRC. l Dr. Henry was responsible for planning and supervising these experfeents I as well as providing the pretest predictions for the pressure level at which steam explosions vould be terminated. Tne results were in excellent t agreement with the pretest predictions and this had a profound positive ef fect en ISP. safety analyses. Dr. Henry was promoted to Associate Division Director of the Ecactor Analysis and Safety Division in March, 1979. Shortly thereafter the Nuclear Saf ety Analysis Center (SSAC) fort.ed a team to study the TMI-2

accident, i.e.

cause, extent of damage, and "what-if" scenarios. In particular, Dr. Henry was responsible for the evaluations in in-vessel steac explosion peteccial (negligible), in-vessel cooling of the degraded b

core, and the potential for ex-vessel cooling if core =starial had been released from the pricary system. la March 1980, Dr. Henry lef t Argonne National Laboratory to for= the firm of Fauske and Associates, Inc. with Drs. Fauske and Crolmes. In this capacity, he was incicately involv4d in the Zion / Indian Point Near Site Study and the Limerick Probabilistic Risk Assessment. He has also been involved in the planning and interpretation of the Marviken IV Jet Ispingements Tests which are currently underway. in addition, his academic background includes: Chairman of Mechani-cal Engineering Department (6-years) 2nd Dean of the traduete School (2-years) at Midwest College of Engineering, as sell as the supervision of several Masters and Ph.D. thesis and numerous lectures at cajor universi-ties. A complete listing of all publications is given below. 1. "A Study of One-and Two-Compocent, Two-Phase Critical T1cus at Lov Qualities," AFL-7430,1968. 2. "Fropagation Velocity of Pressure Waves in Gas-Liquid Mixtures " s Coeurrent Gas-Liquid 71ov, Plecu= Press, 1969. 3. ""%o-Phase Critical Plov at Lev Qualities, Part 1: Expericiantal," Nucl. Sci. Eng., 41,79-91,1970. l 4. "Ivo-Phase Critical Flow at Lov Qualities, Part 2: Analysis," Nucl. I Sci. Eng., M, 92-98, 1970. l 5. "?ressure Wave Propagation in Two-Phase Mixtures," Chen. Eng. Symp, Series, 66, 1-10, 1970. 6. "The Two-Phase critical Discharge of Initially Saturated or Subcooled Liquid," Nucl. Sci. Ing., 3,336-342,1970. 7. "The Two-Phase Critical Flov of One-Component Mixtures in Nozzles. 0:ifices, and Short Tubes," Trans. of ASME, J. F. eat Transfer, 179-187 May 1971. l l S. "P. ole of Surf ace in the Measurec,ent of the Leidenfrast Te:perature," ASME Sy=pesisc: Series en Augeentation of Convective Heat and Mass Transfer, 1970. l 9. " Pressure Wave Propagation to Annular Mist Flows," AIChE Sytp. Series, 113, 67, 3S-47, 1971. 1

10. "Fressure-Pulse Propagation in Two-Phase One-nd Two-Co=ponent Mixtutes," ANL-7792, 1971.

11. "Two-Phase Critical Discharge of High Pressure Liquid Nitrogen "

Proc. Third Incl. Congress of Refrigeration, k*ashington, D.C., 1971. j 12. "Mementum Flux in Two-Fhase, Two-Component Lov Quality Flov," AIChE Sy=p. Series, 131_, 69, 46-54, 1972. 13. "A Correla ton for the Minicu= Film Boiling Te=perature," AIchE Gy=p. Series, 138, 79, 81-90, 1974.

14. "Large Scale vapor Explosionsi" Proc. Fast ?.aaetor Safety Mtg.,

CCNF-710401, 1974. 15. "Sodiu.m Expulsion Test for the 7-Fin Ceometry," Proc. Fast Reactor [ Safety Meg., CONF-740401, 1974. 16. " Transient Sodium Boiling Experiments for Fast Reactor Safety," Sy=p. 3 on Fast Breeder Reactor Development. 77th Nat. AIChE Mtg., Fitts-t burgh, FA, 1974. [ 17. " Pressure Dror and Coc) pre ssible Flov of Cryogenic Liquid-Vapor Mixtures," Chpt. 11, Heat Transfer at Lov Temperatures, Plenu:n Press, 1975. 18. " Experimental Study of the Minimum Film Boiling Foint for Liquid-Liquid Systems," Proc. Fifth Intl. Heat Transfer Conf., Tokyo, Japan, Septenber 1974. 19. " Incipient Superheat in Convective Sodiu: Systa=," Proc. Fifth Intl. Reat Iransfar Conf., Tokyo, Japan, Septecher 1974. 20. "CPERA Single-Pin Pump-Coastdown Expulsion and Reentry Test," Ahl - 17, 1975. 21. "Energe tics of Vapor Explosiens," ASME Paper 75-ET-66, presented at [ Nat. Heat Transfer Conf., San Francisco, CA, 1975. 22. " Vapor Explosions of Subcooled Freon," Proc. Third Specialists Meg. ( on Sodium / Fuel Interactions in Fast Reactors, Tokyo, Japan, March 1976. 23. "Sueleation Characteristics in Physical Explosions," Froc. Third 4 Specialists Mtg. on Sodiuz/ Fuel Interactions in Fast Reactors, Tokyo, Japan, March 1976. 24. "SIK?LE-2: Co:puter Code for Calculation of Steady-State The r:a1 Eehavior of pod Bundles vich Fuel Sveeping," ASME Paper 76-HT-8, presented at Nat. Heat Transfer Conf., St. L:uis, MO, 1976. 25. " Fuel Dispersa.1 Experiments with siculant Fluids," Proc. Mtg. Fast Rea: tor Safety and Kelated Physics, Chicago, IL, October 1976.

i e i 26. " Cladding Relocation D:periments," Proc. Mcg. Fast Reactor Safety and Related Physics, Chicago, IL, October 1976. 27. "Ye.por Dispersal Experiments with Siculant Fluids." Proc. Mtg. Fast 7 Reactor Safety and Related Physics, Chicago, II., October 1976. 28. " Analytical and Experimental Studies of Transient Tuel Freeting," i Proc. Mtg. Fast Reactor Safety and F. elated Physics, Chicago, IL, 1976. 20. " Experiments on Pressure-Driven Fuel Compaction with Reactor Materi-als," Proc. Mtg. Fast Reactor Safety and Related Physics, Chicago, IL, October 1976. 30. " Hydrodynamic Instability Induced Liquid-Solid Contacts in Fil: Boiling," ASME Paper 76-WA-25, presented at Winter Annual ASME Mtg., l New York, NY, 1976. \\ 31. " Transient Freezing of a Floving Ceramic Fuel in a Steel Channel," t Nucl. Sci. Eng., H, 310-323, 1976. 32. "Non-Equilibriu: Critical Discharge of Saturated Subcooled Liquid Freon-ll," Nucl. Sci. Ing., g, 365, 1977. 33. "A Mechaniss for Transient Critical Heat Flux," Proc. Meg. Ther:21 Reactor Safety, Sun Valley, 1D, 1977. 34. " Vapor Explculon Potentials Under LWR Eypothetical Accident Cendi-tions," Proc. Mtg. Ther:a1 F.eactor Sa.fety, Sun Valley, ID,1977. 35. "An Evaluatica of the Fotential for Energetic Fuel-Coolant Interac-tions in Hypothetical L"F3R Accidents " Ther=al and Hydrau.lic Aspects of Nuclear Reactor Oafety, 2_, Liould Metal Fast Ereeder Reactors, American Soc.*ety of "echanical Engineers, New Yo rk., h7, ed. O. C. Jones and S. G. Sankorf, p. 223, 1977. 36. " Experiments of Quenching Under Pressures," presented at the 1978 . Intl. Heat Transfer Conf., Toronto. 37. "An Investigation of the Minimum Film 3 oiling Tecperature on Hori-zental Surfaces," Trans. ASME, J. Herst Transfer, 1_00, May 1978, p. q 260-267. 38. "Vaper Explosion D: peri =ents with Subcooled Freen," ANL-77-43,1967. l 39. " Occurrence of Critical Heat Flux During Blowdown with Flow Rever-i sal," accepted for publicatica in Nucl. Eng. Design. 40. "Sucleation Processes in Large-Scale Vapor Explosions," accepted for publication in Trans. ASMI, J. Heat Transfer. 41. "Ef feces of Systec Pressure on the Bubble Growth frc: Highly Super-heated Water Droplets," ASME Sy=p. Volume on Topics in Two-Phase Eeat Transfer and Flow, Dece ber 1975, p. 1-10. l i

42. "Iher=al and Hydrodynae.ic Interactions in a Shock Tube Configura-tion," ASME Sy=p. *!olume on Topics in Two-Phase Be t Transfer and Flow, Dececher 1978, p. 37-49. "Ef f ects of Dissolved Cas and Downstream Geonetry During Blovdwn of [ 43. a Subcooled Liquid," ASMI Sy=p. Volume on Fluid Transients and Acoustics in the Power Industry, December 1978, p. 95-104,

44. "Generi: Considerations of 120T>R Hypothetical Accident Energetics',"

presented at the ENS /ANS Intl. Topical Meg. on Nuclear Reactor Safety, October 1978, Brussels, Belgium. 45. "IRFER Saf ety and Sodius Boiling," presented at the ENS /ANS Intl. Topical Meg, on Nuclear Reactor Safety, October 1978, Brussels, Selgius. 46. " Fuel-Coolant Interactions in a Shock-Tube Geo stry," presented at the ENS /ANS Intl. Topier'. Mtg. on Nuclear Reactor Safety, October 1978, Brussels, Belgium. f

47. " Fuel-Sodiun Ther=al Interactions in the CAME TOP Sefety Tests,"

accepted for publication at the Tourth CSNI Specialist Meg. on ruel-Coolent Interactions, April 1979. 3 "A Comparison of the Sodiun-UO, Results with the Spontaneous Nuclea-48. tien Theor'j," accepted for publication at the Fourth CSNI Specialist Mtg. on Tuel-Coolant Interactions, April 1979. 3 49. "The Ef fect of Pressure on NACL-H.O Explosions," accepted for publi-cation at the Tourth CSNI Specillist Mtg. on Fuel-Coolant Interac-tions, April 1979. Liquid," sube.itted for 50. " Bubble Crowth During Decocpression of a prese.tation and publication at the Nat. Heat Transfer Conf., San l Diego, CA, August 1979. "Depressurization of internally Heated Boiling Pools," subcitted for t l 51. presentation and publication at the Nat. Heat Transfer Conf., San Diego, CA, August 1979. Li=ited Distribu: ion Paports_ _NA_SA TMI Reports "The Ivo-?hase Critical Discharge of Initially Saturated or Subcooled 1. l Liquid," NASA TMX-52726, 2. "The Cocpressible Flow of Tve-Cc:ponent, Tve-Phase Mixtures in No::les and Crifices," NASA TMX-52729, 3. " Role of the Surface in the Measure =ent of the Leidenfrost Terpera-i ture," KASA TMX-52866. l L

4. " Pressure Wave Propagation Through Annular and Hist Flows," NASA X7.-5 28 S 2. 5. "Two-Phase critical Discharge of High Pressure Liquid Nitrogen,** NASA TM1-57863. 6. "Momentu: Flux in Two-Phase, Two-Component, Low Quality T1ow," NASA 'D0'-6 803 8. ANL/ RAS Reports "CPERA Sin 6 e-Pin Pung Coastdevn P.xpulsion and Reentry Test," ANL/ RAS 7. 1 73-23. 8. "An Assessment of Voiding Dynanics in Sodien-Cooled Tast Reactors," ANL/ RAS 74-20. 9. " Energetics of Vapor Explosions," M L/ RAS 75-22. 10. " Transient Freezing of a Floving Ceramic Fuel in a Steel Channel," ANL/ RAS 76-3. 11. " Upper Plenum Inj ection Tests No. 1 and No. 2," ANL/ RAS 76-4 12. " Vapor Er:plosion Experiments with Subcooled Freon," ASL/MS 77-3. t, 13. An Investigation of the Minimum Film Boiling Tenperature on Horizon-cal Surf aces," ANL/F).S 77-14. 14 "CREL TOP /7uel Sweepout Single-Pin Test C2." ANL/ RAS 77-22. 15. " Transient Critical Heat Flux in a 0.91 e Leng Unifer:17 Eeated Test Section During Blowdot.: of High ?ressure Freen," ANL/KAS/LVR 77-1. 16. " Wood's Metal Cladding Relocation Experiments," ANL/ RAS 77-37. l 17. "Eperimental Siculation of Eoiled-Up Fuel Fools," ANL/MS 78-24. l { 18. " Test Flan Large Scale Holten Salt-Water Vapor Explosion Studies to l l be Conducted at Ispra, Italy." ANL/ RAS /LVR 78-1. 19. "High Pressure Freon Blovdovn Studies in a 2.75 m Long Non-Unifortly { Ueated Round Tube," ANL/F.AS/LVR 75-3. 20. "High Pressure Freen Blowdows Studies in a 2.75 m f.ong Uniformly 2 Heated Round Tube," ANL/ RAS /LVR 76-4 Scientific Sound Movi s Produced l l 1. "Large Scale Vapor Explosions." l 2. "VapCT Explosions in a Well-Yetted System." l l 1

3. "28-Pic Clad Relocacica Expericent." 4. "The Consequences c 'INI-2 if Core Melting occurred." i i 9 6 4 8 k 6 e i f a h 9 w N O i l t h L

NAME STANLEY KAPLAN EDUCATION Senior Post-Doctoral Fellcwship, University of Southern California, 1967-1969. Ph.D., Mechanical Engineering and Applied Mathematics, University of Pittsburgh, 1960. Post-doctoral courses in mathematics at the University of Pittsburgh and Carnegie Institute of Technology, 1960-1965. M.S., Mechanical Engineering, University of Pittsburgh,1958. Graduate of the Oak Ridge School of Reactor Technology,1955. B.S., Civil Engineering, City College of New York,1954. PROFESSIONAL EXPERIENCE General Summary Mathematician and engineer well know for contributions to risk analysis and reliability theory, reactor physics, kinetics, and computational technique. Specializes in probabilistic methodology; decision theory; risk analysis; and, particularly, applications of Bayes' theorem. In this connection has worked specifically and recently on developing probabilistic and decision theoretic treatments of various phases of the energy business. Included here are PRA anlayses of several existing nuclear plants, hazardous material transportation and storage, spent fuel pools, aircraft impact, offshore oil drilling (environmental risk), underground oil storage, pipelines, and tarsands projects (business and construction risk). Developer of the DPD method for probabilistic calculations, the two-stage Bayesian technique for data analysis, the " set of triplets," " probability of frequency," "cause table," and " environmental table" concepts in risk analysis. Originator of the Matrix Theory of Event Treet and DPD approach to seismic risk analysis. Chronalogical Summary 1977-Present President, Kaplan & Associates, Inc., a consulting firm specializing in risk analysis and applied decision theory. Concurrently Adjunct Professor, Department of Chemical, Nuclear and Thennal Engineering, University of California, Los Angeles, and Associate Consultant, Pickard, Lowe and Garrick, Inc. 1975-1977 Private consultant specializing in risk analysis and decision theory. 1972-1975 Holmes & Narver, Inc., Anaheim, California. Director, Advanced Technology Division; Director, Systems Sciences Division; Technical Director, Nuclear & Systems Sciences Group.

KAPLAN - 2 1971-1972 Director of Software Development, COMARC Design Systems, Inc., San Francisco, California. 1969-1971 Product Manager and Senior Staff Member, Computer Sciences Corporation, Los Angeles, California. 1967-1969 Special Research Fellow, U.S. Public Health Service at University of Southern California, Los Angeles. 1955-1967 Westinghouse Bettis Atomic Power Laboratory, West Mifflin, Pennsylvania. Experimentalist, Experimentalist in Charge, Scientist, Senior Scientist, Fellow Scientist, Advisory Scientist. 1954 Lecturer, Department of Civil Engineering, City College of New York.. 1962-1967 Concurrently Adjunct Professor of Mechanical Engineering, University of Pittsburgh; Lecturer, Oepartment of Mathenatic?, Carnegie Institute of Technology. MEMBERSHIPS Anerican Society of Civil Engineers. American Nuclear Society. Society of Industrial and Applied Mathematics. New York Academy of Sciences. REPORTS AND PUBLICATIONS "Seabrook Probabilistic Safe y Assessment," Public Service Company of New Hampshire, to be published in 1983. Kaplan, S., "A Matrix Theory Formalism fc-Event Tree Analysis--Application to Nuclear Risk Analy3is," Risk Analysis, Vol. 2, No. 1, 1982. Kaplan, S., "On Safety Goals and Related Questions," KAI-19, Reliability Engineering, Vol. 3, 1982 Kaplan, S., " Methodology for the Zion and Indian Point Probabilistic' Risk Assessments," proposed presentation at the Congres Annuel 1982, SFRP La Comparison des Risques Associes aux Grandes Activites Humanines, Avignon, France, October 18-22, 1982. l

KAPLAN - 3 Heising, C. D., A. W. Barse11, K. N. Fleming, S. Kaplan, and B. J. Garrick, "A comparison of Recent Nuclear Plant Risk Assessments," proposed presentation at the Congres Annuel 1982, SFRP, La Comoaraison des Risques Associes aux Grandes Activites Humaines, Avignon, France, October 18-22, 1982.

Kaplan, S., H. F. Perla, and D. C. Bley, "A Methodology for Seismic Safety Analysis of Nuclear Power Plants," proposed presentation at the International Meeting on Ther nal Nuclear Reactor Safety, Chicago, Illinois, August 29-September 2,1982.

Bley, D. C., S. Kaplan, and B. J. Garrick, " Assembling and Decomposing PRA Results: A Matrix Formalism," proposed presentation at the International Meeting on Themal Nuclear Reactor Safety, Chicago, Illinois, August 29-September 2,1982. Kaplan, S., "On a 'Two-Stage' Bayesian Procedure for Detemining Failure Rates from Experiential Data," PLG-0191, preprint of a paper to appear in the IEEE Transactions on Power Aoparatus and Systems, August 1982. Garrick, B. J., S. Kaplan, and D. C. Bley, "Recent Advances in Probabilistic Risk Ass &ssment," prepared for the MIT Nuclear Power Reactor Safety Course, Cambridge, Massachusetts, July 19, 1982. Fleming, K. N., S. Kaplan, and B. J. Garrick, "Seabrook Probabilistic Safety Assessment Management Plan,"PLG-0239, June 1982. Garrick, B. J., S. Kapl an, D. C. Iden, E. B. Cl evel and, H. F. Perl a, D. C. Bley, D. W. Stillwell, H. V. Schneider, and G. Apostolakis, " Power Plant Availability Engineering: Methods of Analysis, Program Planning, and Applications," EPRI NP-2168, PLG-0165, May 1982. " Indian Point 2 and 3 Probabilistic Safety Study," Power Authority of the State of New York and Consolidated Edison Conpany of New York, Inc., March 1982. i Lin, J. C., and S. Kaplan, "SEIS3: A Computer Program for Seis.aic and Wind Risk Assessment," PLG-0222, March 1982. Kaplan, S., "On the Method of Discrete Probability Distributions in Risk and Reliability Calculations--Application to Seismic Risk Assessment, Ri sk Analysis, Vol.1, No. 3,1981. l Kaplan, S., B. J. Garrick, and P. P. Bieniar::, "On the Use of Bayes' Theorem in Assessing the Frequency of Anticipated Transients." Nuclear Engineering and Design 64, 1981. I

KAPLAN - 4 Kaplan, S., "On The Method of Discrete Probability Distributions in Risk and Reliability Calculations--Application to Seismic Risk Assessment," Risk Analysis, Vol.1, No. 3,1981. " Zion Probabilistic Safety Study," Commonwealth Edison Company, September 1981. Risk Analysis," PLG-0207 prepared as input to the NRC/ANS Probabilistic Risk Assessment Procedures Guide, September 1981. Kaplan, S., "A Matrix Theory Formalism for Event Tree Analysis--Application to Nuclear Risk Analysis," preprint of a paper to appear in Risk Analysis, Vol. ~ 2, No.1,1983; PLG-0198, August 1981. Stillwell, D. W., B. J. Garrick, D. R. Buttemer, G. Apostolakis, J. C. Lin, and S. Kaplan, " Analysis of the Pilgrim Nuclear Power Station Reactor Protection System," PLG-0195, July 1981. Kaplan, S., " Matrix Format for PRA and Its Possible Usefulness in Licensing," presented to the ACRS Subecmmittee on Reliability and Prooabilistic Risk Assessment, Los Angeles, California, July 28, 1981. Kaplan, S., " Scarce Data Analysis Techniques," presented at the ANS 1981 Annual Meeting, Miami Beach, Florida, Juna 7-12, 1981. Kaplan, S., G. Apostolakis, B. J. Garric, D. C. Bley, and K. Woodard, " Methodology for Probabilistic Risk Assessment of Nuclear Power Plants," draf t version of a book in preparation, PLG-0209, June 1981. Mulvihill, R. J., and B. J. Garrick, P.. S. Hanson, S. Kaplan, Y. G. Mody, D. A. Reny, L. H. Riechers, and H. Y. Schneider, " Comparative Evaluation of Boiler Availability for Intermountain Power Project," PLG-0169, l April 1981. Apostolakis, G., and S. Kaplan, " Pitfalls in Risk Calculations," Reliability Engineering, Vol. 2, No. 2, April 1981. Kaplan, S., and B. J. Garrick, "On the Quantitative Definition of Risk," PLG-0196, Risk Analysis, Vol.1, No.1, March 1981. Garrick, B. J., S. Kaplan, and N. O. Siu, " Definition of Bounding Physical Tests Representative of Transport Accidents - Rail and Truck," PLG-0164, March 1981. 9

KAPLAN - 5 Kaplan, S., B. J. Garrick, and G. Apostolakis, " Advances in Quantitative Risk Assessment - The Maturing of a Discipline," IEEE Transactions on Nuclear Science, NS-28, No.1, February 1981. Apostolakis, G., S. Kaplan, B. J. Garrick, and R. J. Duphily, " Data Specialization for Plant Specific Risk Studies," Nuclear Engineering and Design 56, 1980. Kaplan, S., L. H. Reichers, and B. J. Garrick, " Histogram Convolution Program (HICOP)," PLG-0157, December 1980. Hanson. R. S., J. C. Lin, D. M. Wheeler, S. Kaplan, B. J. Garrick, D. C., Iden, W. B. Holder, and L. G. H. Sarmanian, "An Assessment of the Reliability of Turbine-Generators," PLG-0155, November 1980. Garrick, B. J., S. Kaplan, D.-C. Iden, E. B. Cleveland, H. F. Perl a, D. C. Bley, and D. W. Stillwell, " Power Plant Availability Engineering, Methods of Analysis - Program Planning - Applications," 2 Yols., PLC-0148. October 1980. Kennedy, R. P., A. C. Cor,nell, R. D. Campbell, S. Kaplan, and H. F. Perla, "Probabilistic Seismic Safety Study of an Existing Nuclear Power Plant," Nuclear Engineering and Design, Vol. 59, No. 2,

. 1980.

Kaplan, S., R. S. Hanson, B. J. Garrick, and J. W. Stetkar, "A Strategic Plan for a National Data System for Electric Pcwer Plants," PLG-0144, July 1980. Garrick, 3. J., S. Kaplan, G.- Apostol akis, D. C. Iden, K. Woodard, and T. E. Potter, " Seminar: Probabilistic Risk Assessment of Nuclear Pcwer t P1 ants," PLG-0141, July 1980. Garrick, B. J., S. Kaplan, and D. C. Bl ey, " Seminar: Power Plant Probabilistic Risk Assessment and Reliatility," PLG-0127, May 1980. Garrick, B. J., and S. Kaplan, "A Conceptual Plan for a National Data System for Electric Power Plants," PLG-0131, April 1980. l Garrick, B. J., and S. Kaplan, "0yster Creek Probabilistic Safety Anal-ysis (0PSA)," presented at the ANS-ENS Topical Meeting on Thermal Reactor Safety, Knoxville, Tennessee, April 8-11, 1980. Kaplan, S., and B. J. Garrick, "A Strategic Plan for a National Reliability Data System," PLG-0125, March 1990. l

KAPLAN - 6 Garrick, B. J., S. Kaplan, G. E. Apostol akis, D. C. Bley, and T. E. Potter, " Seminar: Probabilistic Risk Assessment as Applied to Nuci ear Power P1 ants," PLG-0124, March 1980. Kaplan, S., and B. J. Garrick, "Try Probabilistic Thinking to Improve Pcwer Plant Reliability," Power, March 1980. Apostolakis, G., S. Kaplan, B. J. Garrick, and W. Dickter, " Assessment of the Frequency of Failure To Scram in Light Water Reactors," Nuclear Safety, Vol. 20, No. 6, November-December 1979. Kaplan, S., B. J. Garrick, and D. C. Bley, " Notes on Risk, Probability, and Decision," PLG-0113, November 1979. Garrick, B. J., S. Kaplan, and S. Ahmed, "A Reliability Prediction Technique for Selected Thermomechanical Components of Gas Turoine Combined Cycle P1 ants," PLG-0109, September 1979. Garrick, B. J., S. Kaplan, P. P. Bieniarz, K. Woodard, D. C. Iden, H. F. Perla, W. Dicter, C. L. Cate, T. E. Potter, R. J. Duphily, T. R. Robbins, D. C. Bley, and S. Ahmed, "0PSA, Oyster Creek Probabilistic Safety Analysis," (Executive Summary, Main Report, Appendixes), PLG-0100 DRAFT, August 1979. Kaplan, S., "A Numerical Method for Obtaining Probability versus Frequency Distributions from EDAC's Data for Failure of a Structural Comoonent Under Specified Accelerations," presented to the International Conference on Structural Mechanics in Reactor Technology, Berlin (West), t Gemany, August 20-21, 1979. Kaplan, S., and B. J. Garrick, "On the Use of a Bayesian Reasoning in Safety and Reliability Decisions--Three Examples," Nuclear Technolocy, l Vol. 44, July 1979. Kaplan, S., and B. J. Garrick, " Notes on Prediction of Reliability," PLG-Oll7, June 1979.

Kaplan, S., and B. J. Garrick, " Notes for a Workshop on Risk, Reliability, and Decision Under Uncertainty," presented at Battelle Northwest Laboratory, June 1979.

Garrick, B. J., P. P. Bienf ar:, and S. Kaplan, " Risk Analysis of Transoorting Oconee Spent Nuclear Fuel to the McGuire Nuclear Station," PLG-0102, June 1979. Garrick, B. J., and S. Kaplan, " Training Engineers to be Reliability Practitioners," presented to tne Sixth Annual Reliaoility Engineering Conference for the Electric Power Industry,' Miami Beach, Florida, Apri l, 19-20, 197 9.

KAPLAN - 7 Xaplan, S., J. M. Vallance, and C. L. Cate, " Prediction of Frequency of Aircraft Crashes at the Three Mile Island Site," Nuclear Safety, Oc Aber 1978. Garrick, S. J., S. Kaplan, and P. P. Bieniar:, " Input Material for Reliability Section of Westinghouse Turbine-Genera *ar Proposal to Middle South Utilities," December 1977. Kaplan, S., " Description of OPTSWU-1, a Program for Computing the Optimum Amounts of Separative Work to be Contracted for," November 1976. Kaplan, S., " Notes on Pooling, Meaning of, Types of, and Advantages of Also Notes on a Bookkeeping Concept for Equitable and Visible Management of a Nuclear Pool," September 1976.

Kaplan, S., " Notes on the Concept of Inventory as it Relates to Uranium Procurement Planning," September 1976.

Garrick, 3. J., and S. Kaplan, " Reliability Technology and Nuclear Power," IEEE Transactions on Reliability, Vol. R-25, No. 3, August 1976. Kaplan, S., "UPLAN, A Decision Theoretic Tool for Uranium Procurement Planning," May 1975. Kaplan, S., "On a Probabilistic Approach to Project Co,st Estimating," Consulting Engineer, February 1976. Kaplan, S., "On a Bayesian Type Methodology for Making Accept / Reject Decisions on Offshore Lease Bids," Journal of Petroleum Technology, March 1976. Kaplan, S., and D. Trujillo, " Numerical Studies of the Partial Differential Equations Governing Nerve Impulse Conduction-I, the Significance of Lieberstein's Inductance Term," Journal of Mathematical Biosciences, Vol. 7, pp. 379-404, 1970. Kaplan, S., and J. M. Vallance, " Notes on a Model for Evaluation and Optimi:ation of Uranium Procurement Strategies for the CAPCO Companies," January 1976. Garrick, B. J., and S. Kaplan, " Reliability Technology and Nuclear Power," 1975. Garrick, 3. J., S. Kaplan, "A Method for Evaluating Nuclear Plant Siting Concepts," presenteed before the Joint Committee on Atomic Develecment and Space, California Legislature, Sacramento, May 19, 1972.

F KAPLAN - 8 Garrick, B. J., S. Kaplan, and O. C. Baldonado, "On a Decison Theory Formalism for Nuclear Pcwer Plant Siting," presented to the Conference on Unique Siting Concepts for Nuclear Power Plants, Joint Comittee on Atomic Development and Space, Sacramento, California, May 9,1972. Kaplan, S., " Variational Methods in Nuclear Engineering," Advances in Nuclear Science and Technology, Vol. V, P. R. Greebler, editor, Acaoemic Press, no:t.

Kaplan, S., "A New Derivation of Discrete Ordinate Approximations,"

Nuclear Science and Engineering, Vol. 34, No.1,1968. Kaplan, S., A. J. McNabb, and M. B. Wol f, " Input-Output Relations for a Counter Current Dialyzer by the Method of Invariant Imbedding," Journal of Mathematical Biosciences, Vol. 3, No. 3,1968. Kaplan, S., A. J. McNabb, J. K. Siemsen, and D. Trujillo, "The Inverse Problem of Radiosotype Diagnosis - A Comoutational Model for Determining the Size and 1.ocation of Tumors," Journal of Mathematical Biosciences, Vol. 5, pp. 29-35, 1969. Yasinsky, J. B., and S. Kaplan, " Anomalies Arising from the Use of Adjoint Weighting in a Collapsed Group Space Synthesi's Model," Nuclear Science and Engineering, Vol. 31, No. 2,1968. Kaplan, S., " Canonical and Involutary Transformations 'of Variational Problems Involving Higher Derivatives," Journal of Mathematical Analysis and Acolications, Vol. 22, No. 1, 1958. Yasinsky, J. B., and S. Kaplan, "On the Use of Dual Variational Principles for the Es imation of Error in Approximate Solutions of Diffusion of Problems,' Nuclear Science and Engineering, Vol. 31, pp. 80-90, 1968. Xapian, S., " Properties of the Re1axation Lengths in Pl-Double-P1 and Angle-Space Synthesis Type Approximations," Nuclear Science and Engineering, Vol. 28, pp. 450-463,1967. Kapian, S., J. A. Davis, and M. Natel son, " Space-Angle Synthesi s - An Approach to Transport Approximations," Nuclear Science and Engineering, Vol. 28, pp. 364-375, 1967. Kaplan, S., and J. A. Davis, " Canonical and Involutory Transformations of the Variational Principles of Transport Theory," Nuclear Science and Engineering, Vol. 23, No. 2, 1967.

KAPLAN - 9 Yasinsky, J. B., and S. Kaplan, " Synthesis of Three-Dimensional Flux Shapes Using Discontinuous Sets of Trail Functions," Nuclear Science and Engineering, Vol. 28, pp. 426-437,1967. Gelbard, E. M., and S. Kaplan, " Reality of Relaxation Lengths in Various Approximate For ns of the Slab Transport Equation," Nuclear Science and Engireering, Vol. 26, No. 4, 1966. Kaplan, S., and J. B. Yasinsky, " Natural Medes of the Xenon Problem with Flow Feedback - An Example," Nuclear Science and Engineering, Vol. -25, pp. 430-438, 1966. Kaplan, S., "An Analogy Between the Variational Principles of Reactor Theory and Those of Classical Mechanics," Nuclear Science and Engineering, Vol. 23, No. 3,1965. Henry, A. F., and S. Kaplan, Some Applications of a Multimode Generalization of the Inhour Formula," Nuclear Science and Engineering, Vol. 22, No. 4, 1965. Kaplan, S., " Synthesis Methods in Reactor Theory," Advances in Nuclear Science, Vol.111, Academic Pre 5s, June 1966. Kaplan, S., E. M. Gelbard, " Invariant Imbedding and the Integration Technioues of Reactor Theory," Journal of Mathematical Analysis and Accl ications, Vol.11, No.1-3,19eo. Kapian, S., A. F. Henry, S. G. Margolis, and J. J. Taylor, " Space-Time Reactor Dynamics," Proceedings, Third United Nations International Conference on the Peaceful 'Uses of Atomic Energy, Geneva, Switzerland, 1904. Kaplan, S., Editor and Contributor, Section 5.5, " Space-Time Kinetics," Naval Reactors Handbook, Vol. 1. Kaplan, S., "The Use of the Rayleight-Rit: Method in Non-Self Adjoint Problems," IEEE Transactions, Vol. MIT-12, No. 2,1964. i l Kaplan. S., O. J. Maricwe, and J. A. Bewick, " Application of Synthesis s Techniques to Problems Involving Time Depencence," Nuclear Science and i Engineering, Vol.18, pp.163-176,1964. Kaplan, S., "Some New Methods of Flux Synthesis," Nuclear Science and Engineering, Vol.13, No.1,1962. Kaplan, S., and G. Sonnemann, "The Methods of Finite Integral Transfor as in Heat Transfer Droblems," Proceedings of the International Heat Transfer Conference, Boulder, Coloraco,19cl.

KAPLAN - 10 Kaplan, S., "The Procerty of Finality and the Analysis of Problems in Reactor Space-Time Kinetics by Various Model Expansions," Nuclear Science and Engineering, Vol. 9, No. 3, 1961. Kaplan, S., and S. G. Margolis, " Delayed Neutron Effects During Flux Til t Transients," Nuclear Science and EngineeriAg, Vol. 7, No. 3,1960. Kaplan, S., and G. Sonnemann, "A Generalization of the Finite Integral Transform Technique and Tables of Special Cases," Proceedings of Mid-Western Conference on Solid and Fluid Mechanics, Austin, Texas,1959. Goldsmith, M., T. T. Jones, T. M. Ryan, S. Kaplan, and A. D. Vorhis, " Theoretical Analysis of Highly Enriched Lignt Water Moderated Critical Assemblies," Proceedings, Second United Nations International Conference on the Peacefui uses of Atomic Energy, Pager P/2370, 1956. l l I l l l l l

Core, Cos.'ainment and Consequence Nicholas J. Liparulo Analysis Group Manager University of Pit'tsburgh, B.S. Chemical Engineering 1971 University of Pittsburgh, M.S. Chemical Engineering 1974 Registered Professional Engineer Mr. Liparulo is Manager of the Core, Containment and Consequence Analysis Group. He came to this position from the Safeguards Engineering Group in the Nuclear Safety Department of Westinghouse's Water Reactor Division where he was responsible for many safety related analyses. Sirae joining Westinghouse PWR System Division in 1972, Mr. Liparulo has held positions of incree. sing responsibility. In his present assignment he is responsible for managing all aspects of the analysis of degraded core accidents including the development of analytical models,. specification and direction of test programs associated with developing information on degraded core progression, application of models and experimental results to meet customer needs, programmatic and technical direction of degraded core analyses performed by Westinghouse, and interf acing with regulatory and customer personnel. His previous assignments have included the development and application of models for the Zion Probablistic Safety Studies, the Indian Point Probablistic Safety Studies, and other probablistic safety studies, as well as Ice Condenser Hydrogen Studies. Prior to his present position, Mr. Liparulo was involved in the development and application of analytical techniques for the study of postulated accidents in nuclear power plants. Assignments included the performance of analyses related to high energy line ruptures, preparation of plant safety reports, modeling of and performing analyses for safety related tests (e.g., LOFT, semi-scale), development of analytical models, core meltdown reactor coolant and containment thermal-hydraulic analysis, and equipment qualification modelling. He became heavily involved in degraded core accidents during the TMI incident during which he provided technical support.. Since then, he has participated in and lead studies into the effect of non-condensible gases (hydrogen and nitrogen) on condensation in the primary system, hydrogen burn flammability limits and testing, debris bed cooling limits and testing, and general code development for degraded core events. Mr. Liparulo has also been the responsible individual for many safety related thermohydraulic computer codes. Mr. Liparulo is the author or co-author of many nuclear safety related reports, and has many times presented results to the NRC, ACRS and other organizations. J

M NAME HAROLD F. PERLA EDUCATION B.S., Engineering, University of California, Los Angeles,1951. Advanced course in Management and Systems Approach, University of California, Los Angeles. PROFESSIONAL EXPERIENCE General Summary Consul ting: Conducted surveys and developed programs for electric utility workshops in maintenance and outage planning. Performed cost studies and productivity improvement studies and developed engineering-construction job controls, cost controls, and management information systems. Site Planning and Engineering; Expert witness on power plant siting alternatives with considerable experience in plant siting and project pl anning. Managed probabilistic risk assessment projects. Performed probabilistic seismic analysis of nuclear power plants, integrating scisnicity and structure and equipment capacities with plant event sequences. Principal investigator for State of California study of aboveground, underground, and offshore siting concepts for nuclear power plants to be located in California. Directed seismic and geologic investigations in site selection studies for nuclear power plant in Florida to serve Jacksonville Electric Authority. Directed master plan for 10,000-acre citrus processing plant in Arizona and for industrial park in New York. Was activation manager for startup of the U.S. Postal Service's bulk mail center in Chicago. Was responsible for the planning and design of research and development and support facilities, utility systems, and site developments related to sereral U.S. Atomic Energy Commission programs. Directed the design and structurally engineered ncnerous industrial and commercial facilities including aircraft assembly plant, shopping centers, bridges, telephone exchanges, and offices. Systems Analysis: Was principal investigator for unique systems studies including deployment and construction of an exploratory lunar base in NASA's Apollo program, an interoceanic canal using nuclear explosives and hydraulic excavation, and a major fallout shelter and parking garage under Manhattan. Also developed company job control and management information system. Administration: As Vice President, Technical Services, managed business development support and long range planning activities. Directed business development in one broad segment of the firm's activities. Directed continuing profit improvement program and was key in the development of project and overhead cost control and reporting systems. As Vice President, Nuclear & System Sciences Group, controlled nuclear l l

PERLA - 2 facilities design and study activities, and systems analysis projects from proposal to project completion. As Engineering Manager, directed engineering and construction project managers and multidisciplined design departments including architects and civil, electrical, mechanical, and structural engineers. Managed engineering projects and structural engineer.ing department. Chronological Summary 1976-Present Associate Consul tant, Pickard, Lowe and Garrick, Inc. 1951-1976 Holmes & Narver, Inc. Positions of increasing responsibilities from structural engineer to Vice President. LICENSES Registered Civil and Structural Engineer, States of California and Hawaii. REPORTS AND PUBLICATIONS "Seabrook Probabilistic Safety Assessment," Public Serv ce Company of New Hampshire, to be published in 1983. Peria, H. F., " Role of External Events in PRA Studies," to be presented at the Proposed Technical Session, ASCE, Philadelphia, Pennsylvania, May 1983. Oconee Probabilistic Risk Assessment," a joint effort of the Nuclear Safety Analysis Center, Duke, Power, and other participating utilities, to be published in 1982. Tennessee Valley Authority and Pickard, Lowe and Garrick, Inc., " Browns Ferry Probabilistic Risk Assessment," to be published in 1982. Garrick, B. J., and H. F. Perla, " Quantitative Risk Management - A New Tool for the Engineering of Facilities," to be presented at the ASCE National Convention, New Orleans, Louisiana, October 26, 1982.

Kaplan, S., H. F. Perla, and D. C. Eley, "A Methodology for Seismic Safety Analysis of Nuclear Power Plants," proposed presentation at the International Meeting on Thermal Nuclear Reactor Safety, Chicago, Illinois, August 29-September 2,1982.

Garrick, B. J., S. Kaplan, D. C. Iden, E. B. Cleveland, H. F. Perla, D. C. Bley, D. W. Stillwell, H. Y. Schneider, and G. Apostolakis, " Power Plant Availability Engineering: Methods of Analysis, Program Planning, and Applications," EPRI NP-2168, PLG-0165, May 1982. p ~ T ~ L T ~ ~~- ~^

a PERLA - 3 Garrick, 3. J., and H. F. Perla, " Management of PRA Projects," presented at the ANS Executive Conference, Arlington, Virginia, April 4-7, 1982. " Indian Point 2 and 3 Probabilistic Safety Study," Power Authority of the

tate of New York and Consolidated Edison Company o# New York, Inc.,

March 1982. Perla, H. F., W. T. Hussey, D. H. Lougeay, and Y. G. Mody, " Cost and Controls Study of San Onofre Units 2 and 3," PLG-0227, December 1981. " Zion Probabilistic Safety Study," Commonwealth Edison Company, September 1981. Perla, H. F., "A Perspective of the Seismic-Initiated Hazard from the Indian Point Nuclear Generating Station," PLG-0201, September 1981. Perla, H. F., " Outage Planning Systems--Status Overview," presented at the Tenth Siennial Topical Conference on Reactor Operating Experience, Cleveland, Ohio, August 17-19, 1981. Perl a, H. F., " Project Plan: Probabilistic Risk Assessment, Midland Nuclear Power Plant," PLG-0150, May 1981. Pickard, Lowe and Garrick, Inc., " Project Plan: Probabilistic Risk Assessaent, Browns Ferry Nuclear Plant Unit 1," PLG-0149, October 1980. Garrick, B. J., S. Kaplan, D. C. Iden, E. B. Cleveland, H. F. Perla, D. C. Bley, and D. W. Stillwell, " Power Plant Availability Engineering, Methods of Analysis - Program Planning - Applications," 2 Vols., PLG-0148. October 1980. t Kennedy, R. P., A. C. Cornell, R. D. Campbell, S. Kaplan, and H. F. Perla, "Probabilistic Seismic Safety Stuidy of an Existing Nuclea.- Power Plant," Nuclear Engineering and Design, Vol. 59, No. 2, August 1980. Chavez, G., and H. F. Perla, " Managing and Controlling Maintenance," Power, June 1980. Garrick, B. J., and H. F. Perla, " Maintenance Managemant in the Electric Utility Industry," presented to the International Conference on Energy Use Management, Los Angeles, Calfornia, October 22-26, 1979. l ^

NAME THOMAS E. POTTER EDUCATION M.S., Environmental Science, University of Michigan,1972. B.S., Chemistry, University of Pittsburgh,1963. PRCFESSIONAL EXPERIENCE General Summar/ Consultant on health and safety aspects of nuclear power. Perfoming environmental dose assessments for nuclear power plant safety analysis, environmental reports and operating reports. Assisting clients in design and implementation of radiological or environmental monitoring programs and interpretation of results. Providing independent review of in-plant radiological protection programs and effluent analysis programs. Consultant in radiological health aspects of nuclear power. Prepared radiological health section of safety analysis reports and environmental monitoring programs and evaluated data from those programs. Developed a mathematical model to predict radiation doses from nuclear power plant effluents. License administrator, plutonium fuel facility health and safety supervi sor. Provided radiological safety review of major facility modifications. Used these analyses and nuclear criticality analyses perfomed by others to prepare AEC special nuclear materials and byproduct license applications. Served as corporate contact with AEC in matters related to licensing. Organized and supervised a radiological protection program for a plutonium fuels fabrication facility and hot cell facility. Instituted personnel monitoring programs using themoluminescent dosimetry and breathing-zone areosol sampling in 1967. Served as secretary of a plant safety comittee which inspected all operations and reviewed detailed written procedures for operators. Served as member of a corporate safety committee which determined corporate policy regarding health and safety matters. Chronological Summary 1973-Presenti Consultant, Pickard, Lowe and Garrick, Inc. 1972-1973 Consultant to Dr. G. Hoyt Whipple, University of Michigan. 1963-1970 Nuclear Materials and Equipment Corporation (NUMEC). License administrator, plutonium fuel facility health and safety supervisor.

POTTER - 2 MEMBERSHIPS American Chemical Society. American Nuclear Society. Health Physics Society. Certified by American Board of Health Physics. REPORTS AND PUBLICATIONS Woodard, K., and T. E. Potter, " Consideration of Source Tenn.in Relation to Emergency Planning Requirements," presented to the Workshop of Technical Factors Relating Impacts from Reactor Releases to Emergency Planning, Bethesda, Maryland, January 12-13, 1982. Garrick, B. J., S. Kaplan, G. Apostolakis, D. C. Iden, K. Woodard, and T. E. Potter, " Seminar: Probabilistic Risk Assessment of Nuclear Power P1 ants," PLG-0141, July 1980. Garrick, B. J., S. Kaplan, G. E. Apostolakis, D. C. Bley, and T. E. Potter, " Seminar: Probabilistic Risk Assessment as Applied to Nuclear Power P1 ants," PLG-0124, March 1980. Woodard, K., and T. E. Potter, " Modification of the Reactor Safety Study Consequences Computer Program (CRAC) to Include Plume Trajectories," presented to the 1979 ANS 25th Winter Meeting, San Francisco, California, November, 11-15, 1979. Woodard, K., and T. E. Potter, " Assessment of Noble Gas Releases from the Three Mile, Island Unit 2 Accident," presented to the 1979 ANS 25th Winter Meeting, San Franc !sco, Calf fornia, November, 11-15, 1979. Garrick, B. J., S. Kaplan, P. P. Bientarz, K. Woodard, D. C. Iden, H. F. Perla, W. Dicter, C. L. Cate, T. E. Potter, R. J. Duphily, T. R. Robbins, D. C. Bley, and S. Ahmed, "0PSA, Oyster Creek Probabilistic Safety Analysis," (Executive Sumnary, Main Report, Appendixes), PLG-0100 DRAFT, August 1979. Woodard, K.,'and T. E. Potter, "Probabilistic Prediction of X/Q for Routine Intermittant Gaseous Releases," Transactions of the Anerican Nuclear Society, Vol. 26, June 1977. " ~

• Dennis C. Richardson - Rf sa Assassmen: Technoicqy Manager Penn Sta:a Universt:y, 5.5. laroscace Enginesring 1963 M.S. Con:rci Engineering 1965 San Of ago State University, M.S. Mathematics 1970 Universf ty of Pittsburgh, MBA 1980 Hr. Richardson has many years of professional and canagement experience in the nuclear field. He joined the Pressart::ad Water ?anctsr Division of Westinghouse in 1972 wnere he canaced the Reactor Protection Analysis Group for perfoming nuclear plant sarety analysis and, cost recently, has =araged the Rtsk Assess::en: Techno1cgy Organization.

Frf or to this, Mr. Richardson was with Gulf General Atomic wnere he weried en design of contr:1 and safety systacs for the gas-cooled nuclear plant. At Westinghouse, he has participated in and directed a n'moer of risk assessment and safety analysis stucfes f r a wide variety of appitestions. He was a.prf neipal inyestigator in both the Zion Sta-tien and Indian Point Station Reacter Fsfety Studies.- He directed tne PRA studies for the Wes:ingneuse Owners Group that addressed the Post-TMI NUREG requirecents on ecer;ency procecures and operator display nout noents. Mr. Rtcnardson was technical and prograa canager for the Brittsa (NNC) Reference ' dater Reector Safety Stuay. He has also Ted the deveicpment of econocic and financial risk o tsass.ent tachntques for the use in new reacter ocdel destgn concepts. l Mr. Atchardson is a mecber of the IEEE and ANS anc has se-ved on the wrking groups for M standards corzittees. He is reviewing the sec-tions for the PRA manuai dfrected by MRC te be finished in 1981. He fs i author or co-at:ther of core than 15 reports and papers deaf f ng with rf sk assess =en: and varicus aspects of nuclear planc design l i l l v w w e** l l

November 1982 RESUME OF Richard H. Toland 1355 Mark Drive West Chester, Pennsylvania 19380 Education 1969 University of Delaware, Newark, Delaware Ph.D. in Applied Science. 1967 University of Delaware, Newark, Delaware M.C.E. - Empht. sis in Structural Mechanics. 1964 University of Delaware, Newark, Delaware B.C.E. - Civil Engineering, Structures Option. Professional Experience 7/78 - Present United Engineers & Constructors, Inc., Philadelphia, Pennsylvania.

Title:

Consulting Engineer - 7/78-7/80. Ma' nager, Structural Analysis Group - 7 /8 0-Presen t. Functions: As Manager of the Structural Analysis Group, responsible for directing.a group of 25 engineers who perform sophisticated structural analyses in support of nuclear and fossil power l plants. Static, dynamic, linear and non-linear analyses are performed. These analyses include seismic, impulse and impact, containment, hydrodynamic load evaluation, forced response analysis and other analyses required for design l and verification of power structures and l components. 9/78 - Present Drexel University, Department of Mechanical Engineering and Mechanics, Philadelphia, Pennsylvania.

Title:

Teach Graduate Mechanics Courses. 8/76 - 7/78 University of California, Lawrence Livermore Laboratory. l l

Title:

Mechanical Engineer 8/76 - 8/77 Section Leader, Materials Test and Evaluation Section 8/77 - 7/78. Functions: Member of Fiber Composites & Mechanics Project; Manager for NASA Program on lightweight composite pressure vessels; research on life of composite pressure vessels under a sustained load environment; research on composite flywheel rotors. Section leader of 24 man group chartered to accomplish standard and advanced technology materials testing and research. National defense related work. Security Clearances: Department of Energy - Q; Department of Defense - Secret. 9/72 - 8/76 Drexel University, Department of Mechanical Engineering and Mechanics.

Title:

Assistant Professor of Mechanics. Functions: Teacher in Civil Engineering and Mechanics curriculums, Undergraduate and Graduate levels. Recipient of the College of Engineering Undergraduate Teaching Award - Outstanding Teacher, 1975, Nominee, 1976. Funded research from: Commerical industry - analytical / experimental study of materials and structural shape in containers. Department of Defense - experimental study of penetration mechanics phenomena. Member of Drexel Polymers Group. 7/69 - 9/72 Hercules Incorporated, Indastrial Systems Division, Allegheny Ballistics Laboratory - 7/69-2/71 Bacchus Works - 2/71-9/72

Title:

Senior Development Engineer - 7/69-11/71. Staff Scientist - 11/71-9/72. Functions: Stress Analysis of solid propellant rocket motor components; design of many structural components made with advanced composite materials; design and analysis of the reflector support truss of NASA's ATS-F Satellite; research on nature of impact resistance of composite materials. 2/65 - 6/69 University of Delaware, Department of Civil Engineering Research Fellow, NSF Trainee, Instructor.

Summer 1966 National Bureau of Standards, Building Research Division, Gaithersburg, Maryland. Research Engineer. 7/64 - 2/65 Delaware State Highway Department, Dover, Delaware Highway and Bridge Engineer. j' 3/60 - 9/61 NVF Company, Reinforced Plastics Section, Yorklyn, Delaware, Laboratory Technician. i l Professional Affiliations i Registered Professional Engineer - Utah and j Pennsylvania. American Society of Mechanical Engineers ( ASME) Member. American Society for Testing and Materials ( ASTM) l - Member. l American Concrete Institute ( ACI) - Member. Member of ACI Committee 349-- Code Requirement for. Nuclear Safety Related Concrete Structurea, Working Group 5 - Special Provisions for l Impulsive and Impactive Effects. 1 Member of ASTM Working Group within Committee C15 Developing Criteria for Brick and Mortar Chimney Liners. Sigma Xi, Scientific Society of North America, l Chi Epsilon, Civil Engineering Honor Fraternity, Pi Tau Sigma, Mechanical Engineering Honor i l Fraternity. Dissertations "A Random Walk Approach to First Passage and Other Random Vibration Problems," thesis presented to the University of Delaware, Newark, Delaware, in partial fulfillment of the requirements for the degree of Doctor of Philosophy, June 1969. l "The Behavior of Reinforced Concrete Columns Subjected to Biaxial Bending," Master's thesis, Department of Civil Engineering, University of Delaware,1967. l l e

_4_ Invited Presentations " Instrumented Impact Testing of Composite Materials," Session for American Society of Metals Workshop in Instrumented Impact Testing, Los Angeles, California, February 1975. "Some Practical Aspects of the Probabilistic Design and Reliability of Structures,' University of Delaware, February 1975. " Interior Impact of Duplex Rounds," Naval Surface Weapons Center, Dahlgren, Virginia, May 1975. " Matrix Transfer Analysis of Composite Flywheels with Reliability Applications," Composite Flywheel Symposium, Berkeley, California, November 1975. "Long-Time Loading of Advanced Fiber Composites," Engineering Mechanics Div., ASCE National Convention, Dallas, Texas, April 1977. " Stress-Rupture Life of Kevlar/ Epoxy Pressure Vessels," NASA / Johnson Space Center, Houston, Texas, December 1977. " Composite Flywheel Design," The 4 th Annual SAMPE Northern California Advanced Composites Workshop, Palo Alto, California, February 1978. " Materials Needs for Energy Storage Flywheels," ASM Meeting, Materials for Advance Fuergy Systems, Philadelphia, November 1978. " Indian Point 2 & 3 Containment Structure Ultimate Capacility," Advisory Committee for Reactor Safeguards, Los Angeles, California, July 1980. " Dynamic Analysis of Machine Foundations," Philadelphia Chapter of ASCE, October 1981. i Publications / Presentations Toland, " Indian Point Containment Ultimate Capability," Proceedings of IDCOR Workshop on Containment Capability, February 1982. Bjorkman, Toland and Chessom, " Attracting and Developing Candidates for Teaching," ASEE Meeting in New Orleans, Loui siana, June 1979. Toland and Schwartz, " Composite Materials in Automotive Energy Storage Systems," presented in 1978 ASME Winter Annual Meeting, San Francisco, California, December 1980, Composite Materials in the Automotive Industry. 3 - Toland, " Composite Flywheels - Current Status," SAMPE, Anaheim, California, May 1978. Toland, " Rotor Design Implications for Composite Material Properties," Second Flywheel Technology Symposium, San Francisco, California, October 1977. Chou and Toland, " Experimental Study of Multiple Interior 3 Impacts," Experimental Mechanics, June 1977. Toland and Alper, " Transfer Matrix for Analysis of Composite Flywheels," Journal of Composite Materials, Vol. 10, July 1976. Chou and Toland, " Experimental Study of Multiple Interior Impacts, presented at the 2nd International Symposium on Ballistics sponsored by the American Defense Preparedness Association, March 1976. Toland and Koczak, " Aluminum Matrix Composites Applied to Fusion Reactor System," presented at Second-Metal Matrix Workshop sponsored by the Institute for Defense Analysis, Washington, D.C., October 1975. Maxwell, Toland, and Johnson, "Probabilistic Design of Composite Structures," presented at the Composite Reliability Conference (ASTM), Las Vegas, Nevada, April 1974. ASTM Publication OTP 580. Toland, " Instrumented Impact Testing of Carbon Fiber Composite Materials," presented at the ASTM Symposinm on Instrumented Impact Testing, Philadelphia, Pennsylvania, June 1973. ASTM Publication STP 563. Burns and Tola,nd, " Design and Analysis of the ATS Graphite Epoxy Satellite Truss," Conference on Fibrous Composites in Flight Vehicle Design, Dayton, Ohio, September 26, 1972. Toland and Vicario, " Failure Criteria and Failure Analysis of Composite S tructures," a chapter in Structural Design and Analysis, Vol. 7 edited by C.C. Chamis for the Composite Materials treatise edited by Krock and Broutman, Academic Press. Toland, " Failure Modes in Impact Loaded Composite Materials," presented at the AIME Failure Modes in Composites Symposium in Boston, Massachusetts, May 8-11, 1972. Toland, Yang and Hsu, "Nonstationary Randcm Vibration of Nonlinear Structures," International Journal of Nonlinear Mechanics, Vol. 7, No. 9, August 1972.

r Toland and Yang, "A Random Walk Model for First-Passage Probability," Journal of Engineering Mechanics Division, ASCE, Vol. 97, June 1971, pp. 791-807. Toland and Yang, "A Random Walk Model for Randam Vibration Problems," presented at the Applied Mechanics Div., ASCE National Convention, Louisville, Kentucky, April 1969. Pfrang and Toland, " Capacity of Wide-Flange Sections Subjected to Axial Load and Biaxial Bending," Department of Civil Engineering, University of Delaware, Newark, Delaware, 1966. (Publ. citation unknown.) Selected Technical Reports " Stress-Rupture Life of Kevlar/ Epoxy Spherical Pressure Vessels," LLL UCID 17755 Parts 1, 2, and 3,.1978-1979. An. Experimental and Statistical Study with the Objective to Develop Life Prediction Methods for Pressure Vessels in a Constant Stress Environment with Richard Barlow of the University of California. " Prototype Development of an Optimal, Tapered-Thickness, Graphite / Epoxy Flywheel," LLL UCRL 52623, November 1978. " Prototype Development of an Optimal, Tapered-Thickness, Graphite / Epoxy Composite Flywheel," LLL UCRL 52623, November 1978. Other Instructor, University of California / Berkeley, Engineering Extension, Finite Element Method of Analysis, Spring 1977, 1978. Instructor, Composite Mattrials Computation Workshop, Berkeley, March 1977. Patent Pending: Composite Flywheel Rotor Design.

' O. H. Walker - Chief Nuclear Engineering - Vestinghouse WR0 Offshort Power Systecs (OFS) University of Utah. 1953 B.S. Checical Engineering Oak Ridge School of Reactor Technolgy, M.S. Nuclear Engineering 1954 University of Pittsburgh, PhD. Checical Eng1neertng 1963 Dr. Walker is currently Chief Nuclear Engineer for OPS. His responsi-bilities have included plant licensing activities, coonfination of the Floating Nuclear Flant Design Report, plant safety evaluation, defini-tion of radiation scurces throughout the plant, design of plant shield-ing, definition of cffsite radiation doses, and mon recently direction of Probabilistic Risk Assessment work including the Zion / Indian Point Probabili stic Safety studies. He has also directed the OPS evaluation of the consequences to man and environment of radioactivity released to liquid pathways es a result of postulated core melt accidents. Prior to. joining OPS, Dr. Walker participated in the LOFT Progra: (on the staff of Phillips Petroleum Co.), where his nesponsibilities l included experimental and analytical development work concerning the release and subsequent behavior of fission products follcwing a loss-of-coolant accident. He was involved in program canagement and planning for the Water Reactor Safety Program with Aerojet Nuclear Cccpary, planning of the early environmental report on the LOFT Prograc, and planning of involvecent of Aerojet Nuclear Cc=pany participat on in the Reactor Safety Study, WASH-1400. Other experience includes work in reactor systems coolant control, mata- [ rial corrosion, radiation levels resulting from activated corrosion I products, participaticn in the startup testing of Nautilus and other early naval nuclear subr.arines and perfon..ance of t%se plants, while working at Bettis Atootc Power Laboraton for Westinghcuse. Dr. Walker is a menber of the American Institute of Chemical Engineers and it's Nuclear Division. He has served as President of the Peninsular Florida Section of the American Institute of Chemical Engineers. He was a mecber of the ANS Cocs:tittee preparing ANSI Standard H-635 and has-served as a = ember of ANS Program Cc=mittees and the FRA Guide Review Ceccittee.

o UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION ATOMIC SAFETY AND LICENSING BOARD Before Administrative Judges: James P. Gleason, Chairman Frederick J. Shon Dr. Oscar H. Paris ) In the Matter of ) ) CONSOLIDATED EDISON COMPANY OF ) Docket Nos. NEW YORK, INC. ) 50-247 SP (Indian Point, Unit No. 2) ) 50-286 SP \\ POWER AUTilORITY OF THE STATE OF ) Jan. 24, 1983 NEW YORK ) (Indian Point, Unit No. 3) ) ) CERTIFICATE OF SERVICE I hereby certify that on the 24th day of January, 1983, I caused a copy of Licensees' Testimony on Commission Question One and Board Question 1.1 to be served by first class mail, postage prepaid on the following: J e

James P. Gleason, Chairman Charles M. Pratt, Esq. Administrative Judge Stephen L. Baum, Esq. Atomic Safety and Licensing Board Power Authority of the 513 Gilmoure Drive State of New York Silver Spring, Maryland 20901 10 Columbus Circle New York, New York 10019 Mr. Frederick J. Shon Administrative Judge Janice Moore, Esq. Atomic Safety and Licensing Board Counsel for NRC Staff U.S. Nuclear Regulatory Office of the Executive Commission Legal Director Washington, D.C. 20555 U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Dr. Oscar H. Paris Administrative Judge Brent L. Brandenburg, Esq. Atomic Safety and Licensing Board Assistant General Counsel U.S. Nuclear Regulatory Consolidated Edison Company Commission of New York, Inc. Washington, D.C. 20555 4 Irving Place New York, New York 10003 Mr. Ernest E. Hill Administrative Judge Ellyn R. Weiss, Esq. Lawrence Livermore National William S. Jordan, III, Esq. Laboratory Harmon and Weiss University of California 1725 I Street, N.W., Suite 506 P. O. Box 808, L-123 Washington, D.C. 20006 Livermore, CA 94550 Charles A. Scheiner, Co-Chairperson Docketing and Service Branch Westchester People's Action Of fice of the Secretary Coalition, Inc. U.S. Nuclear Regulatory Commission P.O. Box 488 Washington, D. C. 20555 White Plains, New York 10602 Joan Holt, Project Director Alan Latman, Esq. Indian Point Project 44 Sunset Drive New York Public Interest Research Croton-On-Hudson, New York 10520 Group 9 Murray Street Ezra I. Bialik, Esq. New York, New York 10007 Steve Leipzig, Esq. Environmental Protection Bureau Jeffrey M. Blum, Esq. New York State Attorney New York University Law School General's Office 4 23 Vanderbilt Hall Two World Trade Center 40 Washington Square South New York, New York 10047 New York, New York 10012 Alfred B. Del Bello Charles J. Maikish, Esq. Westchester County Executive Litigation Division Westchester County The Port Authority of New York 148 Martine Avenue and New Jersey White Plains, New York 10601 One World Trade Center New York, New York 10048 Andrew S. Roffe, Esq. New York State Assembly Albany, New York 12248 o

v Marc L. Parris, Esq. Atomic Safety and Licensing Eric Thorsen, Esq. Board Panel County Attorney U.S. Nuclear Regulatory Commission County of Rockland Washington, D.C. 20555 11 New Hempstead Road New City, New York 10956 Atomic: Safety and Licensing Appeal Board Panel Phyllis Rodriguez, Spokesperson U.S. Nuclear Regulatory Commission Parents Concerned About Indian Washington, D.C. 20555 Point P.O. Box 125 Honorable Richard L. Brodsky-Croton-on-Hudson, New York 10520 Member of the County Legislature Westchester County Renee Schwartz, Esq. County Office Building Paul Chessin, Esq. White Plains, New York 10601 Laurens R. Schwartz, Esq. Margaret Oppel, Esq. Zipporah S. Fleisher Botein, Hays,.Sklar and Hertzberg West Branch Conservation 200 Park Avenue Association New York, New York 10166 443 Buena Vista Rcad New City, New York 10956 Honorable Ruth W. Messinger Member of the Council of the Mayor George V. Begeny City of New York Village of Buchanan District #4 236 Tate Avenue City Hall Buchanan, New York 10511-New York, New York 10007 Judith Kessler, Coordinator Greater New York Council Rockland Citizens for Safe Energy on Energy 300 New Hemstead Road c/o Dean R. Corren, Director New City, New York 10956 New York University 26 Stuyvesant Street David H. Pikus, Esq. New York, New York 10003 Richard F. Czaja, Esq. Shea & Gould Joan Miles 330 Madison Avenue Indian Point Coordinator New York, New York 10017 New York City Audubon Society 71 West 23rd Street, Suite 1828 Amanda Potterfield, Esq. 1:ew York, New York 10010 Johnson & George 528 Iowa Avenue Richard M. Hartzman, Esq. Iowa City, Iowa 52240 Lorna Salzmam Mid-Atlantic Representative Ruthanne G. Miller, Esq. Friends of the Earth, Inc. Atomic Safety and 208 West 13th Street Licensing Board Panel .ew York, New York 10011 U.S. Nuclear Regulatory Commission Stanley B. Klimberg, Esq. Washington, D.C. 20555 General Counsel New York State Energy Office 2 Rockefeller State Plaza. Albany, New York 12223

Mr. Donald Davidoff Director, Radiological Emergency Preparedness Group Empire State Plaza Tower Building, Rm.1750 Albany, New York 12237 Craig Kaplan, Esq. National Emergency Civil Liberties Committee 175 Fifth Avenue, Suite 712 New York, New York 10010 Michael D. Diederich, Jr., Esq. Fitgerald, Lynch & Diederich 24 Central Drive Stony Point, New York 10980 Steven C. Sholly Union of Concerned Scientists 1346 Connecticut Avenue, N.W. Suite 1101 Washington, D.C. 20036 Spence W. Perry Of fice of General Counsel Federal Emergency Management Agency 500 C Street, S.W. Washington, D.C. 20472 Stewart M. Glass Regional Counsel Room 1349 Federal Emergency Management Agency 26 Federal Plaza New York, New York 10278 Melvin Goldberg Staff Attorney New York Public Interest Research Group 9 Murray Street New York, New York 10007 Jonathan L. Levine, Esq. P. O. Box 280 fx f / I New City, New York 10958 ,/ ) g /~) }

j g

l / { \\.rfL.l,s. W,Z;/ / -- /; '/ N'/ \\ \\ , Paul F. Colarulli v (/ ( i

• }}