ML20082C462

Draft Summary Review & Evaluation of Zion Probabilistic Safety Study

ML20082C462
Person / Time
Site:	05000000, Zion
Issue date:	08/29/1983
From:	BROOKHAVEN NATIONAL LABORATORY, SANDIA NATIONAL LABORATORIES
To:	Office of Nuclear Reactor Regulation
Shared Package
ML20080B566	List: ML20080B563 ML20082C462 ML20082C477
References
FOIA-83-408 NUREG-CR-3300, NUREG-CR-3300-DRFT, SAND83-1118, NUDOCS 8311220081
Download: ML20082C462 (42)

Text

r' Y

~

• \\

NUREG/CR-3300 SAND 83-1118 9E, GF

SUMMARY

Review and Evaluation of the Zion Probabilistic Safety Study Sandia National Laboratories and Brookhaven National Laboratory P30 - D9 96 Date Published:

Sandia National Laboratories Albuquerque, New Mexico 87185 operated by Sandia Corporation for the US Department of Energy Prepared for Reliability and Risk Assessment Branch Division of Safety Technology Office of Nuclear Reactor Regulation U.

S. Nuclear Regulatory Commission Washington, DC 20555 Under Memorandum of Understanding DOE 40-550-75 NRC Fin No. All25-0 8311220001 830829 PDR FOIA PDR SO83-408 C/4/X

+

i Table of Contents Section Page I.1 Introduction........................................

I-l I.l.1 Uncertainties in Results.....................

I-l I.2 Plant Analysis......................................

I-l I.2.1 Areas of Review..............................

I-2 I.2.2 Initiating Events............................

I-2 I.2.3 Event Trees..................................

I-4 I.2.4 Mitigating System Success Criteria...........

I-6 I.2.5 Review of the ZPSS Fault Trees...............

I-7 I.2.6 External Events..............................

I-9 I.2.7 Accident Sequence Analysis...................

I-10 I.2.8 Special Issues I-17 I.2.9 Summary and Conclusions I-18 II Summary to Volume 2 II-l II.1 Containment Event Trees.........................

II-2 II.l.1 Steam Explosion Induced Failures

.T I e II.l.2 Hydrogen Burn Induced Failures..................

II-4 II.l.3 Steam Overpressurization Failures II 4 II.l.4 Failures Induced by Basemat Penetration.........

II-5 II.l.5 Failure to Isolate Containment Building II-6 II.l.6 Interfacing System LOCA II 6 II.l.7 Impact of Containment Event Tree Review II 6 II.2 Site Model......................................

II-6 II.3 Release Fractions...............................

II-8 II.4 Reassessment of Risk............................

I I-10 II.5 Sensitivity Studies.............................

II-13 II.5.1 Plant Damage State Frequencies..................

II-13 II-13 II.5.2 Containment Event Trees II.5.3 Site Consequence Model..........................

II-14 II.6 New Plant Feature Considerations................

II-14 l

L iii

\\

J

o e

I.l.

Introduction This report summarizes the Sandia National Laboratories and Brookhaven National Laboratory review of the Zion Probabilistic Safety Study (ZPSS) for the Office of Nuclear Reactor Regu-lation of the Nuclear Regulatory Commission (NRC).

The Sandia National Laboratories review addressed the ZPSS systems analysis and external events analysis (i.e.,

plant analysis).

The Brookhaven National Laboratory review focussed on the ZPSS containment and consequence analysis.

Both efforts are detailed in a report entitled Review and Evaluation of the Zion Probabilistic Safety Study:

Volumes I

and II (hereafter referred to as the basic report).

The primary purpose of the review was to search for sig-nificant omissions and critical judgments in the ZPSS and to evaluate the impact of these on the results of the study.

The evaluation resulted in revised estimates for some plant damage state frequencies.

These were, in turn, evaluated for their impact on risk.

The inherently negative focus of the review is reflected in the basic report.

However, it should be noted that, in general, the ZPSS was considered to be a comprehensive and competent analysis.

Section I of this summary describes the plant analysis in terms of areas of review, accident sequence analysis, special issues and conclusions.

Section II describes the containment and consequence analyses.

I.l.1 Uncertainties in Results In the basic report, the uncertainties involved in both the ZPSS and in our review are reflected in uncertainty bounds placed on numerical estimates, in the discussion of assump-tions, conservatisms and unconservatisms in the analysis, and in the review of sensitivity issues.

Most of the uncertainty treatment is omitted in this

summary, in the interest of brevity.

However, the reader should be aware that such uncertainties

exist, and view the quantitative information provided accordingly.

The major sources of uncertainty in a probabilistic risk assessment are:

Limitations in the modeling und analysis methods Limitations in the data available on nuclear power plant component and system failure rates Lack of information regarding plant and operator responses to various accident conditions Assumptions made to facilitate the analysis, in light of these limitations 1

I I-l

I.2.

Plant Analysis I.2.1 Areas of Review The ZPSS, as any Probabilistic Risk Assessment (PRA), is composed of several interrelated tasks.

A review of a FRA is not complete unless the information and analysis which com-prises each task is examined.

The ZPSS PRA tasks are depicted in Figure I.2-1.

Also shown there are the Volume I report sections which summarize our review of a task.

Tasks reviewed in Volume II are so noted.

As can be seen, we did not review the first task, " initial information collection."

Our review assumes that the ZPSS has collected accurate Zion design and operations information; e.g.,

correct piping and instrumenta-tion layouts, etc.

The findings of our review are ultimately expressed quantitatively in terms of the effect they have on ZPSS damage state frequencies.

Damage states are, in essence, functional classifications of core melt accidents.

Llassificatiot of core melt accidents functionally is necessary to perform the con-tainment and consequence analysis presented in Volur e II.

The ZPSS defined 21 plant damage states.

These can be grouped as follows: 1) SEFC, SEC, SEF, AEFC, AEC, AEF, TEFC, TEC, TEF; 2)

SE, TE, AE; 3) SLFC, SLC, SLF, ALFC, ALC, ALF; 4) SL, AL; 5)V.

The nomenclature is:

S or A denotes small or large LOCA and T denotes transient, E or L denotes early or late core melt, F and C denote fans and sprays working respectively, and V denotes an interf acing systems LOCA. These five groups of plant damage states can be qualitatively described as follows:

1) early core melt with containnent cooling; 2) early core melt without containment cooling; 3) late core melt with containment cooling; 4) late core melt without containment cooling; and 5) containment bypass before core melt.

I.2.2 Initiating Events The initiating events covered in the ZPSS seem to be relatively complete compared to those addressed in previous PRAs.

The initiating event categories analyzed were identical for both Zion units.

ZPSS Table 1.5.1-31 summarizes the initiating events considered.

The treatment of these initiating events is discussed in other sections of this review.

Comparisons were made to other PRAs, an NRC list of con-cerns about potentially omitted initiating events, and EPRI NP 801.1 (It should be noted that the ZPSS used data contained in NP801 to quantify the ZPSS initiating event frequencies.)

In addition, several initiating events were identified by NRC as being of particular interest.

Review of this list of potential ZPSS initiating event has indicated that pressurized thermal shock, shutdown events, and loss of component cooling I-2 d

7 d1 g

- 1 e-g

~

g w._

g 9

i J'

l er 1j e

u d

'. -y e

I e.

c m

w =. """

o R

r L

e P

l v J'

t 4

n 1l e

m m

_w s

s c

a e

)ill!

4-o.

s l

c os n

sA l

r J'

5 k

s Ij 2 I i

a.

R

.ug 1

a n

2 l~

J I

m I

6 w

e 7

r I1 2

ld t

u g

- 3

=4 v

i s

..m F

2_

2f lt

~

T.

7,

_.d 2t 2

y l1

=

J

. = = ' '

1

..e' w "5 r

7

_l j

.a

e..

n_i i

a.

e

7 i

water due to a pipe break appear to be the only potentially significant initiating events omitted in the ZPSS.

Also the ZPSS treatment of a DC power bus initiating event appears to be inappropriate.

It should be noted that six external initiating events (seismic, fire, flood, wind, aircraft accidents, and turbine missiLos) were considered, which is more than most PRAs have attempted.

Initiating Event Quantification Estimated initiating event frequencies are expected to vary from plant to plant depending on the plant characteristics, design, and its specific data base.

The ZPSS initiating event data were compared to the data used in the Arkansas Nuclear One (ANO)

IREP2

'inalysis.

(ANO was chosen because it is a

recently completed NRC-sponsored PRA.)

The purpose of the comparison was to look for potential differences in judgment or calculation.

Based on our review of the ZPSS initiating event frequencies, we conclude that they are generally appropriate.

REFERENCES 1.

ATWS:

A Reappraisal--Part III, Frequency of Anticipated Transients, EPRI NP-801, Interim Report, July 1978.

2.

Interim Reliability Evaluation Program:

Analysis of the Unit 1

Nuclear Power

Plant, Arkansas Nuclear One NUREG/CR-2787, June 1982.

I.2.3 Event Trees The ZPSS constructed 14 event trees to model the plant system response to the initiating internal events.

We reviewed these trees for validity.

I.2.3.1 Event Tree Findings Core Melt / Safety System Interactions j

The interdependencies incorporated into the Zion event j

trees imply that the containment spray and fan cooler systems may be utilized during a core melt accident.

This is an I

important assumption since the Zion analysis predicts that the operation of these systems can significantly reduce the risk associated with a core melt accident.

l l

I-4 L

r a

Sodium Hydroxide Addition All event trees model the additions of sodium hydroxide to the containment spray water.

Discussions with ZPSS personnel revealed that analysis performed late in the study indicated that sodium hydroxide addition had a negligible effect on the assessment of plant damage states and release categories.

All event trees could therefore be simplified by removal of the sodium hydroxide addition event.

Main Feedwater System The Zion study assumed that the main feedwater system was unavailable for purposes of removing post shutdown decay heat l

following all internal and external initiating events analyzed.

It appeared reasonable to credit main feedwater t

restoration for many sequences.

Core Melts Caused By Containment Overpressure Failure The Zion event trees do not model core melts caused by i

containment overpressure failure.

These sequences have been shown to be important in other PRAs (e.g.,

the SC sequence 2

i in WASH-1400).

However, an assessment of these potential sequences indicates that for Zion the impact is negligible.

i l

Transient Induced Pressurizer Safety Valve Demands The ZPSS event trees do not model the demand of the i

pressurizer safety valves in response to a transient.

Based on an estimate of the frequency of this event, however, it is not j

believed that any important accident sequences were missed.

Event Tree lic--Turbine Trip Due to a Loss of Service Water and Event Tree 13b--Reactor Trip Due to a Loss of Component Cooling Water The ZPSS used the turbine trip and reactor trip event trees to model the plant response to a loss of service water and loss of component cooling water initiating event respectively.

These event trees do not completely model the plant response to

-these initiating events for the following reasons:

a) the trees do not allow for a reactor coolant pump (RCP) seal LOCA to occur following a sustained loss of com-ponent cooling or service water, b) the systems which respond to a seal LOCA are not fully modeled, and 1

i i

1 l

I-5 i

7 s

c) station blackout initiated by a loss of service water followed by a loss of offsite power is not modeled (station blackout initiated by an LOP followed by a loss of service water is modeled on lib.)

If a loss of component cooling occurs, the RCP seals will lose cooling due to failure of the charging pumpsl and cool-ing to the thermal barrier heat exchanger.

The ZPSS predicts a 1200 gpm seal LOCA will occur approximately 30 minutes follow-ing a loss of seal cooling.

Since component cooling also cools the safety injection pumps they would be expected to subse-quently fail.

A core melt would ensue leading to an SEFC plant damage state.

The ZPSS omitted quantification of such a

sequence.

REFERENCE 1.

Summary of NRC Staff and Consultants Questions on the Zion Probabilistic Safety Study Commonwealth Edison Response, 1982.

I.2.4 Mitigating Systems Success Criteria In response to LOCA and transient initiating

events, various Zion core cooling and containment systems are called upon to bring the plant to a safe shutdown condition.

If core cooling is unsuccessful and a core melt ensues, the containment systems may be able to reduce the consequences of the accident by maintaining the containment boundary and thus isolating the core melt from the environment.

The combinations of plant systems required to cool the core and maintain the containment boundary constitute the Zion mitigating system success cri-teria.

A review of the success criteria employed in the ZPSS indicates that they are consistent with criteria employed in PRAs of similar plants.

In addition to the major core cooling and containment system success criteria discussed above, the ZPSS developed a variety of support system success criteria.

These support systems must succeed to allow successful operation of the core cooling and containment systems.

Support systems include pump cooling

systems, electric power

systems, and the plant operators.

We reviewed these criteria with the aid of the

FSAR, previous PRA analyses and discussions with the ZPSS analysts.

Some apparent problems were identified which are discussed in Section 2.5.

I-6

r I.2.5 Review of the ZPSS Fault Trees The system fault trees presented in ZPSS Section 1.5 were reviewed for accuracy and completeness.

The major findings of this review are presented below.

I.2.5.1 General The review of Zion fault trees included an examination of the fault trees, the supercomponent arrangement and definition, and the system calculations.

For the most part, these appear to be complete and correct.

Exceptions are noted below in comments on individual fault tree sections.

The ZPSS analyzed systems for the case where all electric power was available and for various degraded power states which represent loss of offsite power combined with failures of some or all of the emergency diesel generators.

In our review of the degraded power state cases, we found substantial differences existed between the system unavailabilities presented in the ZPSS and the unavailabilities resulting from our calculations.

These differences proved to be important in the loss of offsite power accident sequences.

Except for the treatment of Emergency Electric Power System loss of DC power as an initiating event, the analysis was found to be appropriate.

The ZPSS analysis of this system Reactor Protection System l

and the resulting failure probability were found to be l

appropriate.

Safeguards Actuation System - The analysis of this system was j

found to be appropriate.

However, in the system application to I

the small LOCA event tree, credit was given for actuation from j

high containment pressure, which does not appear to be a viable I

actuation mode for small LOCAs.

l High Pressure Iniection System - The ZPSS analysis appears to be correct except that common mode pump failure was considered negligible.

We believe Atwoodl common mode factors are appropriate in this case and applied them in a reanalysis.

Feed and Bleed - Subsequent to the ZPSS analysis, the PORV block valves at Zion were changed from normally closed to normally open.

A substantial portion of the failure probability for feed and bleed in the ZPSS was based on human error in failing to open the block valves.

Consequently, the feed and bleed failure estimate was reduced in our analysis.

Low Pressure Injection System - The ZPSS analysis was found to be appropriate.

A different common mode factor was used in our reevaluation, resulting in a minor change to the results.

I-7 l

3 2

Recirculation Systems - The analysis of the high pressure, low pressure and recirculation systems was found to be appropriate.

Containment Spray Injection System The ZPSS analysis of this system was found to be appropriate.

A common mode factor was applied to the pump trains in our reevaluation, resulting in a minor change to the results.

Containment Fan Cooling System The ZPSS analysis of this system was found to be appropriate except that a single manual valve in the return line of the fan cooling coils was not modeled.

Also, the analysis assumed that the system could function in a post-core-melt environment.

We agree with this assumption, but addressed it as a sensitivity issue.

Component Cooling Water System - The ZPSS analysis for this system assumed that three pumps were required for system success, except for reactor pump seal cooling (for which only one pump was assumed to be necessary).

We believe that two pumps would be required, and reevaluated accordingly.

Since component cooling water appears in many dominant accident sequences, this is an important assumption.

It was assummed in the ZPSS, that component cooling water is not required for charging and safety injection pump cooling.

We found from Reference 2 that these pumps do need cooling from the component cooling system.

This has a large impact on core melt fre-quency.

It is discussed in Section 2.7.

The ZPSS analysis of this section Service Water System assumed that three service water pumps would be required for system success.

Based on information in the Zion FSAR, we assume two pumps are sufficient, and reevaluated the system accordingly.

Auxiliary Feedwater System - The ZPSS analysis of this system was found to be poorly described, but generally correct.

The ZPSS analysis assumed that common mode pump failure was negligible.

We included common mode failure in our reanalysis.

Human Reliability Analysis - The human reliability analysis in the ZPSS was impressive in terms of its scope and level of effort.

Nevertheless, several situations were found in which the human error estimates were judged to. be too high or too low.

The net effect of these is believed to be overall optimism in human error treatment.

A complete evaluation was not possible because of insufficient documentation.

Suggested revisions to the ZPSS human error rate estimates are presented in the basic report.

The treatment of uncertainty associated Estimation Methods with estimates from existing data sources appears to be inconsistent.

Generally 5% and 95% bounds from WASH-1400 were used as 20% and 80% limits in ZPSS.

Notable exceptions to this I-8 l

r i

i were the treatment of interfacing system LOCAs, pressure vessel rupture, and pipe ruptures.

In all three cases, substantially higher estimates would have been obtained had their general rule been followed.

The results are highly sensitive to this assumption.

The Bayesian methodology used to estimate accident sequence rates was evaluated.

Where Zion data exist and are used to modify the ZPSS's prior probability distributions, the effect of the prior distributions is generally unimportant with respect to the estimate accident sequence rates.

Where Zion data are not available or

used, the estimates are quite sensitive to the assumed prior distribution.

REFERENCE 1.

" Common Cause Fault Rates for Pumps:

Estimates Based on Licensee Event Reports at U.

S.

Commercial Nuclear Power September 30, 1980."

Corwin Plants," January 1,

1972 Atwood, EGG-EA-5289, August 1982.

2.

Summary of NRC Staff and Consultants Questions on the Zion Commonwealth Edison Response, Probabilistic Safety Study 1982.

I.2.6 Fxternal Events The ZPSS treatment of external events is more comprehensive than most PRAs.

Events addressed include

seismic, floods,

tornados, fire, turbine

missiles, aircraft accidents, and explosions from transportation and hazardous materials.

The following comments arise from our review of the external events l

sections:

The seismic analysis was, in general, difficult to Seismic review due to lack of clear documentation.

Among the concerns noted were:

the choice of boundaries of seismcgenic zones and rate of seismic activity the imposition of an upper bound on effective peak acceleration the definition of damage effective ground acceleration the treatment of seismic events

only, as opposed to combinations of seismic and non-seismic events

However, the results were considered acceptable, within the limits of the uncertainties which apply to this type of analysis.

Fire - The ZPSS fire analysis was reviewed and several problems were noted.

Specifically, the fire analysis.

I-9

only analyzed the auxiliary equipment room and the cable t

spreading room.

Other important areas such as the Auxiliary Building Zone 11.3-0 and the component cooling water pump room were either assessed qualitatively or not addressed at all.

did not address seal LOCA events caused by loss of component cooling water.

did not consider the loss of service water or component cooling water components by fire in conjunction with loss 4

of redundant components due to maintenance.

The resolution of these problems was deemed to be beyond the scope of the review.

A reanalysis of this subject is 4

recommended.

3 Other External Events - The ZPSS did not identify any specific external events other than seismic and fire which had a sig-nificant effect on risk.

We found no reason to disagree with this position.

I.2.7 Accident Sequence Analysis In this section, sequences we identified as dominant' are discussed.

These include the sequences which, by our estimates dominate core melt frequency or plant damage state frequency.

We identified fourteen such sequences (Table I.2.7-1).

Of these sequences five are on the list of dominant accident sequences (ZPSS Table 8.10-1) presented in the ZPSS.

The remaining nine are sequences which did not appear on the ZPSS list either because they were not interpreted as leading to core melt or because the frequency calculated in the ZPSS was not high enough to consider them dominant.

The plant damage state used in the tables is:

S or A denote small or large LOCA and T denotes transient, E or L denote early or late core melt, F an C denote fans and sprays working respectively.

In the following subsections we analyze the dominant accident sequences.

For each of those sequences not addressed in the ZPSS, we describe the sequence and the frequency calcu-lations.

For sequences which appeared in the ZPSS, we review the analysis.

I-10

7 S

TABLE I.2.7-1 REVISED ZION DOMINANT ACCIDENT SEQUENCES Rank Sequence Plant Annual with State Frequency Respect to Core Melt 1

CCW Failure (causing failure of all charging SEFC ~ 2 (-4) and SI pumps, seal LOCA) i 2

Failure of DC Bus 111 (causing Failure of 1 TEFC 6.4 (-5)

PORV and loss of AC Bus 148), Failure of Auxiliary Feedwater 3

Loss of offsite power: Failure of component SEFC 4.6 (-5) cooling water: Failure to Recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 4

Loss of offsite power: Failure of component SEFC

4. 0 (-5) cooling water: Failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 5

Loss of offsite power, Failure of component SEC 1.8(-5) cooling water, Failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, Failure of containment fans 6*

Small LOCA, Failure of recirculation cooling SLF 1.6(-5) 7 Loss of offsite power, Failure of component SEFC 7.9 (-6) cooling water, Failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> I-ll

i i

e TABLE I.2.7-1 (continued)

REVISED ZION DOMINANT ACCIDENT SEQUENCE Rank Sequence Plant Annual with Damage Frequency Respect State to Core Melt 8*

Seismic: Loss of all AC Power SE 5.6 (-6) 9*

Large LOCA: Failure of Recirculation Cooling ALF

4. 9 (-6 )

10*

Medium LOCA: Failure of Recirculation Cooling ALF 4.9 (-6) 11 Loss of offsite power, Failure of component SE

4. 7 (-6 )

cooling water, Failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, failure of containment sprays and fan coolers 12*

Large LOCA: Failure of Low Pressure Injection AEFC 1.4(-6) 13 Loss of Offsite Power: Failure of Auxiliary TEFC 1.1(-6)

Feedwater: Failure of Feed and Bleed: Failure to Restore Offsite Power in four hours 14 Loss of Offsite Power: Failure of Auxiliary TEFC 1.0(-6)

Feedwater: Failure of Feod and Bleed: Failure to Restore Power in one hour V

1.1(-7)

Interfacing System LOCA**

• Sequences identified by the ZPSS to be dominant.

• • Included here because of its potential impact on consequence analysis, not one of the dominant core melt sequences.

I-12

r I.2.7.1 Failure of Component Cooling Water (CCW), SEFC The complete loss of component cooling water frequency is given in the ZPSS as 9.4 (-4 ) per reactor year (see initiating event 13b in Table 1. 5.1-50).

This frequency was derived by a two stage Bayesian analysis.

To date, no such events have occurred at Zion or any other plants considered in the ZPSS data base.

No further information is provided by the ZPSS.

The ZPSS analysts assumed, based on information available, that failure of component cooling water did not lead directly to core melt, without additional system failures.

Specifi-cally, it was believed that loss of component cooling water did not cause failure of the safety injection pumps and charging pumps during the injection phase.

Consequently, it was con-cluded that loss of component cooling water as an initiating event would result in core melt only if it were combined with independent failure of these pumps (or associated hardware).

Subsequent information from Commonwealth Edison (Reference

1) is that both charging pumps and safety injection pumps will fail "in a short period of time", given loss of component cool-ing water.

On this basis the following sequence is applicable.

1.

Component cooling water is lost with consequent loss of cooling to the reactor coolant pump seal thermal barriers.

2.

The two centrifugal charging pumps fail.

We estimate that each pump would fail in about five minutes based on information received from Consolidated Edison for similar pumps during our Indian Point Safety Study Review.

Since the pumps would be operated in succession, seal cooling would be lost approximately 10 minutes after CCW failure.

3.

All four reactor coolant pump seals fail in about 30 minutes after loss of seal cooling with maximum loss of coolant through each seal of 300 gallons per minute (total 1200 gallons per minute).

4.

Both safety injection pumps are actuated by low reactor coolant pressure, and fail due to loss of cooling in about 5 minutes.

5.

With loss of makeup capability through either the charging or safety injection pumps, core un covery will ensue.

A core melt accident will be assured unless cooling to the safety injection pumps is restored in about 45 minutes.

An important assumption in the analysis of this sequence is the number of CCW pumps required for system success.

The ZPSS I-13

1 indicated that only one pump would be required.

However, based on a review of the CCW system loads in this situation, we believe that two 9s would be required.

The frequency of r

this sequence ticulated to be N2(-4).

The sequence calculations are

. led in Section 3.2.1 of the basic report.

I.2.7.2 Failure of DC Bus 111, Failure o Auxiliary Feedwater, TEFC Failure of DC Bus 111 would cause loss of main feedwater i

and reactor trip.

It would also remove DC power from one of the two PORV's.

Since Bus 111 provides control power for AC Bus

148, the auxiliary feedwater system would lose the availability of one motor-driven pump.

The sequence of interest in this case is failure of DC Bus 111, loss of main feedwater, reactor trip, loss of auxiliary feedwater, and failure of feed and bleed capability due to loss of one PORV.

The sequence leads to core melt.

The frequency of occurren-e of the events in this sequence is calculated as 6.4(-5).

Calculations are detailed in Section 3.2.2 of the basic report.

I.2.7.3 Loss of Offsite Power: Loss of Component Cooling Water:

Failure to Restore Power in Four Hours, SEFC In this sequence the initiating event, loss of offsite

power, is followed by loss of component cooling water with failure to restore power in four hours.

Given loss of com-ponent cooling water, a series of events leading to a seal LOCA with loss of makeup capability and thus to core melt will occur, as described in Section I.2.7-1.

The frequency of the events in this sequence is 4.6 (-5).

(See basic report,Section I.3.2.3.)

I.2.7.4 Loss of Offsite Power: Loss of Component Cooling Water:

Failure to Restore Power in One Hour SEFC In this sequence the initiating event, loss of offsite power, is followed by loss of component cooling water, with failure to restore power in four hours.

Given loss of com-ponent cooling water, a series of events leading to a seal LOCA with loss of makeup capability, and, thus, to core melt will occur, as described in Section I.2.7.1.

The calculation of this sequence frequency is the same as that described in Section I.2.7.3, except for the probability of failure to restore offsite power.

The calculated frequency is 4.0 (-5).

(See basic report,Section I.3.2.4.)

I.2.7.5 Loss of Offsite Power: Failure of Component Cooling Failure to Recover Offsite Power in Eight Water:

Hours, Failure of Containment Fans, SEC I-14 t

f 1

This sequence is the same as that described in Section I.2.7.7 except that it also includes containment fan system failure.

Since the success criterion for the containment fan system is three of five fan coolers operating, the dominant cause of fan system failure in this sequence is loss of power from two of the three unit 1 AC buses.

The frequency of this sequence is calculated as 1.8(-5).

(See basic report, Section 3.2.5.i I.2.7.6 Small LOCA: Failure of Recirculation Cooling, SLF By Zion's estimates (see page 8.10-7) this accident is the most probable cause of core melt.

Zion's dominant 1.3-128) occurs when AC power is available at all three buses sequence (p.

and recirculation cooling fails (R-2).

Zion's mean value for the probability of R-2 is given as 4.55(-4).

Multiplying by the mean Small LOCA rate (3.54(-2) per year) and by the probability of power at all AC buses (.1) yields 1.6(-5) per year as the estimated core melt rate by this sequence.

As discussed elsewhere, the initiating event estimates (given as posterior means and variances) are reasonably consistent with the data presented and we agree with their estimate.

I.2.7.7 Loss Offsite Power: Loss of Component Cooling Water:

Failure to Restore Power in Eight Hours, SEFC In this sequence, the initiating event, loss of offsite power, is followed by loss of component cooling <ater, with failure to restore power in eight hours.

Given loss of com-ponent cooling water, a series of events leading to a seal LOCA with loss of makeup capability, and, thus, to core melt will

occur, as described in Section I.2.7.1.

The calculated frequency of this sequence is 7.9(-6).

(See basic report, Section 3.2.7.)

I.2.7.8 Seismic:

Loss of All AC Power, SE In this sequence, a seismic event large enough to fail offsite power and the service water pumps occurs.

Failure of the service water pumps causes subsequent failure of the diesel generators, due to lack of cooling.

A loss of all AC power results followed by failure of RCP seal cooling and a RCP LOCA.

Since safety injection and containment systems require AC power, a core melt ensues that results in damage state SE.

The ZPSS frequency estimate for this sequence is 5.6 x 10-6 per year.

We conclude that this estimate is reasonable.

(See bacic report, Section 3.2.8.)

I.2.7.9 Large LOCA:

Failure of Recirculation Cooling, ALF For internally initiated accidents, this sequence is the second leading contributor to core melt.

Zion's posterior distribution for the Large LOCA rate has a mean of 9.4 (-4) per I-l5

1 I

which seem consistent with the year and a variance of 5.74 (-6),

Recirculation failure (R-1) pertains to low recirculation and, as in the case of Small LOCA:

available data.

Recirculation Failure, the assumption made in calculating the pressure split fraction is that fan coolers are not available.

As a point estimate, Zion's mean QH1 of 4.03(-3) seers reasonable and so we concur with their estimated rate for this sequence.

Section 3.2.9.)

(See basic report, Failure of Recirculation Cooling, ALF I.2.7.10 Medium LOCA:

The ZPSS analysis and results for this sequence are identical to their treatment of the Large LOCA:

Failure of Our comments are the same.

Recirculation Sequence.

Failure of Component Cooling Loss of Offsite Power: Failure to Recover Offsite Power in Eight I.2.7.11 Water:

Failure of Containment Sprays and Fan Hours:

Coolers, SE This sequence is similar to that described in Section I.2.7.5 except that it also includes containment sprays and containment fan system failure. The dominant cause o f '.f ailure of both fans and sprays in this sequence is loss of power from AC buses in unit 1.

The frequency of this sequence is Section 3.2.11.)

calculated as 4.7 (-6).

(See basic report, Failure of Low Pressure Injection, AEFC I.2.7.12 Large LOCA:

The large LOCA initiating event estimates have been pre-discussed.

Failure of the low pressure injection 1.39(-3).

The ZPSS analysis of viously system is given a mean value of this sequence appears to be appropriate.

The frequency is calculated as 1.4(-6).

(See basic report, Section 3.2.12.)

Failure of Auxiliary 7.2.7.13 Loss of Offsite Power:

Failure to Failure of Feed and Bleed:

Feedwater:

Restore Offsite Power in Four Hours, TEFC Ir this sequence, the initiating event, loss of offsite

power, is followed by loss of auxiliary feedwater and loss of feed and bleed capability, with failure to restore power in four hours.

The loss of auxiliary feedwater eliminates the capability for secondary cooling, since without offsite power the main feedwater pumps have tripped and cannot be restored.

The loss of feed and bleed capability removes the remaining option for core cooling.

The frequency of this sequence is Section 3.2.13.)

calculated as 1.l(-6).

(See basic report, I-16

e I.2.7.14 Loss of'Offsite Power:

Failure of Auxiliary Feedwater:

Failure of Feed and Bleed:

Failure to Restore Offsite Power in One Hour, TEFC This sequence is similar to I.2.7.13, above.

The frequency is calculated as 1.0 (-6).

(See basic report, Section 3.7.14.)

1.2.7.15 Event V:

The Interfacing LOCA Event V leads to release category 2 which, by Zion's risk estimates, is one of the dominating releases.

The dominant V sequence is the joint failure of two motor-operated valves in the RHR suction path.

The calculated frequency is 1.0(-7).

(See basic report, Section 3.2.15.)

l I.2.7.16 Other ZPSS Dominant Sequences A number of accident sequences which appeared in the ZPSS dominant accident sequence list (ZPSS Table 8.10-1) have been omitted from the foregoing discussion because their importance to the plant damage state frequencies has diminished.

This is primarily due to the fact that they have been supplanted by sequences which in our analysis, have higher frequencies of occurrence.

Included in this group are the sequences numbered 7,

8, 10, 11, 12, 13 14, and 15.

I.2.8 Special Issues A number of special issues were addressed in the review.

Generally, these represented assumptions made in our reanalysis of the ZPSS.

To illustrate the impact of these assumptions, i

plant damage state frequencies based on the assumption were compared with the frequencies which would have resulted if the assumption had not been made.

The special issues included:

The assumption that core spray and fan cooler systems would not fail due to post-core-melt environment.

The assumption that feed and bleed is a viable option at Zion.

The assumption that reactor coolant pump seal leakage would create a

small

LOCA, given failure of seal cooling.

The assumption that monthly testing of room cooling systems will be instituted at Zion.

The application of gross bounding estimates for fire as an initiating event.

I-17

3 In addition to the above, an analysis was made of the prob-ability of concurrent sequences at Unit 1 and Unit 2 due to loss of component cooling water.

The analysis included estimates of the frequency of damage states SEFC, SEF, SEC, and SE at Zion Unit 2,

given these damage states at Unit 1.

The results of this analysis are shown in Table 2.8-1.

I.2.9 Summary and Conclusions I.2.9.1 General l

In general, we found the tystems analysis portion of the i

study to be consistent in scope and detail with ongoing prob-I abilistic risk assessments.

The scope of the external events analysis represents an advancement over what has been done in the past.

We commend the ZPSS analysis team for their utilization of plant-specific data in their analysis.

Section I.2.9.2 presents our recommended estimate of plant damage state frequencies for use in the containment and consequence analysis.

This estimate reflects, to the degree possible given the limited scope of our

review, our best

" ction I.2.9.2.1 summarizes judgment of these frequencies.

our findings for the internal

ents, and Section I.2.9.2.2 summarizes our findings for tne external events.

Section I.2.9.3 combines the findings for internal and external events.

I.2.9.2 Estimated Plant Damage St' ate / Release Category Frequencies and Sensitivity Issues I.2.9.2.1 Internal Events Table I.2.9.1 summarizes the effect that the findings dis-cussed in the previous sections have on the Zion internal event plant damage states and release category frequencies.

The first column is a listing of 21 plant danage states defined in the ZPSS.

The nomenclature is:

S or A denotes small or large LOCA, T denotes transient, V denotes interfacing systems LOCA, E or L denotes early or late core melt, F and C denote fans and sprays working, respectively.

Also appearing in column one are the mean frequencies of those damage states as calculated in the ZPSS.

The second column represents the revised estimates of the ZPSS plant damage states.

It can be noted that a dash appears instead of a frequency estimate in several places.

A dash denotes that we did not attempt to recalculate a frequency because these damage states were found to have a small impact on risk as calculated in the ZPSS.

I-18

TABLE I.2.8-1 Zion Unit 1/ Unit 2 Shared System Sequence Frequency Total Damage Corresponding Damage States at State at Unit 1 Unit 2 From Shared System 1.

SEFC = 3.0(-4)*

1.

SEFC = 2.8-4*

1. 8 (-4 )

SEF

=C SEC

= 7.2-6 4.6(-6) 6.8-7

4. 4 (-7)

SE

=

2.

SEF

= 5. 5 (-9) 2.

SEFC = 1.1-10 7.0(-11)

SEF

= E SEC 3.9-9

2. 5 (-9 )

=

SE

= 3.2-10 2.0(-10) 3.

SEC

= 1. 9 (- 5 )

3.

SEFC = 1.3-5 8.3(-6)

SEF

= C 3.8 (-9) 3.4-6 2.2 (-6)

SEC

=

1.3-6 8.3 (-7)

SE

=

4.

SE = 1.0(-5)t 4.

SEFC = 2.0-6

1. 3 (-6) 6.8-10

4. 4 (-10)

SEF

=

2.3-6 1.5(-6)

SEC

=

5.7-6t SE 3.6 (-6)

=

• predominantly CCW loss as initiating event

t. 5.6-6 is seismic event

• • Values adjusted to reflect the probability of.64 that both units will be in operation at the time of an initiating event.

{

I-19

The third column represents the revised "NRC defined" plant damage states.

The "NRC defined" states consist of the sum of ZPSS damage states listed to the left.

Also listed in columns 2 and 3 are the upper and lower 95%

confidence limits for the damage states.

These were obtained by estimating the sum of the accident sequence rates for those dominant sequences that make up each damage state, using the Maximus methodology.

I.2.9.2.2 External Events Table I.2.9-2 summarizes the effect that the findings dis-cussed in the previous sections have on the Zion external event plant damage states.

(The ZPSS did not report the external event plant damage state frequencies.

They were deduced by comparing ZPSS, Tables 8-2 and 8.10-1 and Figure 8.10-1 pre-sented in ZPSS, Section 8 for external events.)

I.2.9.3 Combined Internal and External Events Table I.2.9-3 lists the revised dominant core melt internal and external accident sequences.

Table I.2.9-4 summarizes the effect that the internal and external event findings have on the "NRC defined" plant damage state frequencies.

The frequencies listed in Table I.2.9-4 were obtained by summing

~

the frequencies listed in Table I.2.9-1 and I.2.9-2.

As can be seen, the revised damage state frequency esti-mates are within a factor of two of the ZPSS estimate except for "Early Core Melt With Containment Cooling."

In the field of PRA, f actors of two are usually not considered a significant disagreement.

The difference in the "Early Core Melt With Containment Cooling" category is due primarily to the inclusion of sequences involving loss of component cooling and a DC power initiated sequence in our revised frequency estimate.

The ZPSS did not identify such sequences.

(See Section I.2.7.)

I-20 l

L_

Table 1.2.9-1.

Zion Internal Event Results 2PSS Plant Revised Plant Revised NRC Defined Damage States Damage States Plant Damage States Mean Point Estimate L95 095 Point Estimate L95 U95 SEFC 7.4(-6)

SEFC 3.0(-4) 4(-6) 1(-3)

AEFC 1.7(-6 AEFC 1.9(-6) 0 3(-6)

SEC 1.8(-8)

SEC 1.9(-5) 8(-7) 7(-5)

Early Core 3.9 (-4 )

2 (-5) 2(-3)

AEC 8.2(-9)

AEC Melt With TEFC 8.3(-7)

TEFC 6.7(-5) 8 (-7 )

2(-3)

Containment Cooling TEC 9.3(-7)

TEC SEF 1.3(-9)

SEF AEF 1.9(-10)

AEF TEF 1.6(-9)

TEF D!

SE 6.5(-10)

SE 4.7(-6) 1(-7) 1(-5)

Early Core Melt Without TE 2.3(-7)

TE 7.7(-7) 1(-7) 2(-6)

Containment 5.5(-6) 1(-8) 3 (-5)

Cooling AE 1.l(-11)

AE SLFC 1.9(-5)

SLFC 0

Late Core ALFC 9.8 (-6)

ALFC 0

Melt With SLC 1.9(-6)

SLC 0

Containment 2.6(-5) 3(-8) 3(-5)

ALC 4.0(-10)

ALC 0

Cooling SLP 4.7(-9)

SLF 1.7 (-5) 3(-8) 7(-5)

ALF 7.3(-10)

ALF 9.8(-6) 0 3(-5)

SL 1.3(-8)

SL 1.0(-7)

Late Core Melt Without AL 2.5(-13)

AL Containment 1.0(-7)

Cooling V

1.1(-7)

V 1(-7) 0 1(-7)

Bypass 1(-7) 0 1(-7)

• --Denotes frequency was not recalculated because of.small impact on risk.

Table I.2.9-2. Zion External Event Results (Excluding Fire)

ZPSS Plant Revised Plant Revised NRC Defined Damage States Damage States

• Plant Damage States *

(Mean)

(Point Estimate)

(Point Estimate)

AEFC

< 1(-7)

AEFC AEF

< 1(-7)

AEF Early Core AEC

< l(-7)

AEC SEFC

< l(-7)

SEFC Melt With

< 1(-7)

Containment SEC

< 1 (-7)

SEC Cooling TEFC TEFC TEF TEF TEC TEC Early Core AE

< 1(-7)

AE Melt Without SE 5.6 (-6)

SE 5.6 (-6)

Containment 5.6(-6)

Cooling TE TE Late Core SLF

< 1(-7)

SLF

< l (-7)

Melt Without Containment Cooling

• Reflect seismic contribution only.

See Section I.2.9.1 for discussion of fire analysis.

I-22

i

)

o TABLE I.2.9-3 REVISED ZION DOMINANT ACCIDENT SEQUENCES Rank Sequence Plant Annual with State Frequency Respect to Core Melt 1

CCW Failure (causing failure of all charging SEFC

~2(-4) and SI pumps, seal LOCA) 2 Failure of DC Bus 111 (causing Failure of 1 TEFC 6.4 (-5)

PORV and loss of AC Bus 148), Failure of Auxiliary Feedwater 3

Loss of offsite power: Failure of component SEFC 4.6 (-5) cooling water: Failure to Recover offsite power in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> 4

Loss of offsite power: Failure of component SEFC 4.0(-5) cooling water: Failure to recover offsite power in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 5

Loss of offsite power, Failure of component SEC 1.8(-5) cooling water, Failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, Failure of containment fans 6*

Small LOCA, Failure of recirculation cooling SLF

1. 6 (-5) 7 Loss of offsite power, Failure of component SEFC 7.9 (-6) cooling water, Failure to recc/er offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> I-23

l l

l TABLE 2.9-3 (continued)

REVISED ZION DOMINANT ACCIDENT SEQUENCE Rank Sequence Plant Annual with Damage Frequency Respect State to Core Melt 8*

Seismic Loss of all AC Power SE 5.6(-6) 9*

Large LOCA: Failure of Recirculation Ceoling ALF 4.9(-6) 10*

Medium LOCA: Failure of Recirculation Cooling ALF 4.9(-6) 11 Loss of offsite power, Failure of component SE 4.7(-6) cooling water, Failure to recover offsite power in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, failure of containment sprays and fan coolers 12*

Large LOCA: Failure of Low Pressure Injection AEFC 1.4(-6) 13 Loss of Offsite Power: Failure of Auxiliary TEFC 1.l(-6)

Feedwater: Failure of Feed and Bleed: Failure to Restore Offsite Power in four hours 14 Loss of Offsite Power: Failure cf Auxiliary TEFC 1.0(-6)

Feedwater: Failure of Feed and Bleed: Failure to Restore Power in one hour V

1.1(-7)

Interfacing System LOCA**

• Sequences identified by the ZPSS to be dominant.

• • Included here because of its potential impact on consequence analysis, not one of the dominant core melt sequences.

j I-24

?

Table I.2.9-4 Zion Combined Internal and External Event Results ZPSS Revised NRC Defined Frequency Frequency Damage State (Mean)

(Point Estimate)

Early Core Melt With 1.5(-5) 3.9(-4)

Containment Cooling Early Core Melt Without 5.8(-6) 1.0(-5)

Containment Cooling Late Core Melt With 3.1(-5) 2.7(-5)

Containment Cooling Containment Bypass Prior 1.l(-7) 1.l(-7) to Core Melt i

I-25

~

II.

SUMMARY

TO VOLUME 2 In Volume 2 of this report the core meltdown phenomenology, containment response, containment event trees, rele categories and consequence modeling in the Zion Probabilistic Safety Study (ZPSS) are reviewed.

Sixteen in-ternal initiating events were identified in the ZPSS.

The plant event trees resulted in twenty-one plant damage states with associated frequencies.

This aspect of the ZPSS was reviewed in Volume 1 of this report by SNL staff.

The SNL review reassessed the frequencies of the plant damage states.

The combi-nation of the twenty-one damage states and their associated frequencies was te'rmed a " plant state vector" in the ZPSS.

Containment event trees are a convenient way to determine the conditional probabilities of various potential containment building failure modes.

The containment failure mode analysis (refer to Section 2 of Reference 1) in the ZPSS is summarized in the containment matrix.

This matrix specifies the con-ditional probabilities of achieving eleven release categories for each of 21 plant damage states.

The quantification of the conditional probabilities re-lies heavily on core meltdown phenomena (refer to Section 3 of Reference 1) and containment response analysis (refer to Section 4 of Reference 1) in the ZPSS.

Because of the close interrelationship between these three sections of the ZPSS, they are reviewed together.

The review of this aspect of the ZPSS is summarized in Section II.1.

The site consequence analysis is described in Section 6 of the ZPSS.

Out-put from the consequence model in the ZPSS was in the form of the conditional likelihood that a given damage level or greater will result given that one of the eleven releases has occurred.

" Damage" was measured in the ZPSS by the following five damage indices; 1.

Early Fatalities 2.

Injuries 3.

Thyroid Cancers 4.

Thyroid Cancers (not including fatalities from thyroid cancers) 5.

Total Man Rem

~

The five damage indices for the eleven release categories were summarized in the ZPSS in the " Site Matrix." This aspect of the ZPSS was reviewed by NRC staff in the Accident Evaluation Branch DSI/NRC.

Their review is included in Appendix C to Volump of this report.

In addition, an input deck for the CRAC computer code,L2 which is used to calculate off-site consequences, was supplied to BNL by P. Easley (AEB/DSI/ NRC) on May 13, 1983.

This site model was used by BNL staff to generate the damage indices reported in Volume 2 of this report. Also, the effects of sensitivity studies suggested by P. Easley related to the evacuation model are summarized in Section II.S.

The determination of release categories in the ZPSS (refer to Section 5 of Refergnqe 1) follows closely the approach taken in the Reactor Sa fety StudyL3J (RSS).

The point estimate or level 1 risk curves used in the ZPSS are based largely on RSS release categories.

However, it is noted in the ZPSS that the RSS may have been overly conservative regarding the potential for re-lease of fission products.

The level 2 risk curves in the ZPSS attempt to in-l dicate how removal of these conservatisms might influence risk. There has 11-1

been significant research activity in this area since the publication of the RSS it ;975.

A basis for estimating fission product behavior was pub-lishedL3 in 1981 by RES/NRC.

In addition, updated fission product source term methods are currently being developed by RES/NRC contractors and their work is under extensive peer review.

At this stage, we are unable to confirm the validity of the proposed level 2 risk curves in the ZPSS.

Consequently, our review of the release categories, which is summarized in Section II-3, deals only with the level 1 risk curves.

The independent evaluations performed by the authors of both volumes of the draft report were combined to provide a best estimate of the reassessment of risk at the Zion facility. The reassembly of all of the elements that con-tribute to the final risk indices is described, in detail, in Volume 2 of this report and follows the methodology described in Section 8 of the ZPSS.

The impact of each of the reviewers is clearly identified in terms of changes to the total risk indices and as a function of plant damage state frequencies, containment event tree conditional probabilities, release categories and site consequence model.

However, the description of the reassembly process is rather detailed and consequently only those aspects of the review that have the largest influence on the damage indices are summarized in Section II.4.

The changes in the total risk curves appears in Appendices B through F of Vol-ume 2 of this report.

However, in order to display the contribution of the various changes to the damage indices, an alternative approach to the risk diagrams used in the ZPSS was adopted.

The area under the risk diagrams can be integrated to calculate a "mean" for the various damage indices. By inte-grating under the conditional curves generated by the site consequence model, the means for all eleven release categories and for the five damage indices can be calculated.

The alternative approach uses these means together with the frequencies of the eleven release categories to calculate total means, which are equivalent to the area under the total risk curves. For simplicity, this alternative approach using "means" is utilized in this summary section.

In Section II-5, sensitivity studies are summarized that resulted from the review of the ZPSS.

Initially, sensitivity studies related to the determina-tion of the plant damage state frequencies are considered.

Then uncertainty regarding core meltdown phenomenology and how this uncertainty impacts con-tainment event tree conditional probabilities is assessed.

Finally, sensitiv-ity studies regarding the evacuation modeling in the site consequence analysis are also discussed.

Finally in Section II-6, we summarize a critique of the assessment (refer to Section 9 of Reference 1) of new plant features in the ZPSS.

This review was performed by UCLA under contract to RSB/D51/NRC and is included in Appen-dix D to Volume 2 of this report.

II.1 Containment Event Trees The objectives of the sections in the ZPSS on containment response analy-sis, degraded core phenomena and transient analysis were to determine poten-tial containment building failure modes appropriate to the twgny-one plant damage states that were identified.

The Reactor Safety StudyL3J identified several containment failure modes, which should be thought of in two distinct categories; II-2

L

1) those for which the containment building function is initially effective

2) those for which the containment building function is either by-passed or significantly compromised The first category is made up of the following failure modes (using the notation of Reference 3).

Steam explosion induced failures.

Steam explosions can poten-a tially generate missiles which could then penetrate the contain-ment building.

Y Hydrogen burn induced failures.

Burning hydrogen gas can generate sufficient pressures inside the containment building to cause an overpressurization failure.

(Hydrogen burns can also cause the containment building to fail indirectly by causing the failure of engineered safety features needed to protect the building contain-ment function).

6 Failures induced by overpressurization of the containment building produced from generation of steam and noncondensible gases.

The release of primary system energy in the form of steam, combined with the decay heat energy which produces more steam and noncon-densible gases, can overpressurize the containment building, thus leading to failure.

c Failures induced by basemat penetration.

Core materials interac-ting with the reactor cavity basemat can penetrate the containment building floor (basemat), thus releasing core materials and water into the environment.

The second category is made up of the following failure modes (again using the notation of Reference 3).

8 Failure to isolate containment building.

The core melt accident occurs with containment building penetrations left open, thus con-siderably reducing the effectiveness of the containment building function.

V The accident progression bypasses the containment building func-F tion completely.

An example of this failure mode is the inter-facing systems loss-of-coolant accident (LOCA).

It is due to the failure of barriers, such as check valves, that separate high pressure from low pressure systems.

Direct access to the environ-ment is obtained through the residual heat removal system piping.

~

In the RSS, all core melt accidents were assumed to fail the containment building by one or more of the above failure modes.

However, the extensive analysis reported in the ZPSS regarding core meltdown phenomena and contain-ment response resulted in a very significant departure from the RSS in this

' area.

In the ZPSS, the majority of core melt accident sequences were II-3

n 4

predicted to have a very low probability of resulting in one of the above con-tainment building failure modes.

Consequently, for most core melt accidents, as calculated in the ZPSS, the only release of fission products to the envir-onment would be via gradual leakage.

This aspect of the ZPSS represents a significant advance beyond tha methods and assumptions used in the RSS.

Each of the containment building failure modes noted above were reviewed in detail to determine if the conditional probabilities allocated in the ZPSS are appropriate.

Note that this aspect of the ZPSS review had the benefit of assessments [4,5J]yses of core meltdown accidents at the Zion facility.

independent ana These were very useful in helping to identify areas of agreement and disagreement and they focused this aspect of the review of the ZPSS.

In the following paragraphs, we briefly summarize our review of each of the po-tential failure modes.

11.1.1 Steam Explosion Induced Failures It is now appropriate to use significantly lower conditional probabilities for containment failure via steam explosions than assumed in the RSS.

In Ref-erence 5, a conditional probability of 10-4 for a steam explosion [fgilure was sugge which is consistent with the work of Theofanous 6J Corradini.d, 10g an In the ZPSS, the conditional probabilities range from to 10-8 However, sensitigity studies have ind.icated that conditional probabilities lower than 10-will not significantly further reduce ri s k. With a conditional probability of 10-4, steam explosion failure modes do not contribute significantly to risk at the Zion facility. 1I.1.2 Hydrogen Burn Induced Failures Our review of the potential for hydrogen burns to fail the Zion contain-ment building has highlighted two areas of concern:

1) We consider that there is the potential for significantly more H2 production during core meltdown than assumed in the ZPSS.

2) We are also concerned about the impact of two areas related to combus-tion phenomena that do not yet appear to be fully resolved, namely, flame acceleration and the potential for nonuniform H2 compositions.

The above concerns are developed in greater detail in Volume 2 and lead us to suggest higher conditional probabiliti' s for H2 burn failure modes than e assumed in the ZPSS. These high probabilities only affect those damage states that have some form of containment heat removal systems (CHRS) operating. Ac-cident sequences without CHRS operating are allocated to the 6 overpressuriza-tion failure mode, which is discussed below. 11.1.3 Steam Overoressurization Induced Failures In the ZPSS, plant damage states witnaut CHRS operating were assumed to eventually fail the containment building with a conditional probability of close to unity. However, an important difference between the ZPSS and the RSS II-4

r is that containment failure was predicted to occur much later in the accident (approximately 10 hours after scram) in the ZPSS analysis. In the RSS, con-tainment failure was predicted to occur close to the time that the core debris is released from the reactor pressure vessel. This difference in timing (from reactor pressure vessel failure to containment failure) between the ZPSS and the RSS has important implications in terms of the quantity of fission pro-ducts that might be eventually released to the environment (refer to Section II.3). This aspect of the ZPSS containment analysis has been confirmed by independent analysis. It has been determined [8] (by more detailed structural analysis than was performed for the RSS) that the ultimate capacity of Zion containment build-l ings is higher than previously thought. In addition, we have performed very limiting calculations of potential pressure pulses that might occur as the l core debris is released from the vessel. By comparing the limiting calcula-tions with the higher failure pressure, we have confirmed the basic assumption in the ZPSS, namely, that the probability of containment building failure i. close to vessel failure by steam overpressurization is relatively low. We I calculate eventual failure of the containment building on a similar time frame to the ZPSS due to gradual build-up of the partial pressures of steam and noncondensible gases in the containment atmosphere. 11.1.4 Failures Induced by Basemat Penetration l In the ZPSS it is concluded that the core materials will be quenched and fragmented as they enter the flooded reactor cavity. These fragmented core particles will then form a packed debris bed, which if flooded and contin-uously supplied with water will form a "coolable debris bed." The term cool-l able implies that the decay heat in the core materials can be continuously l removed by boiling water. This will maintain the core debris at a relatively low temperature. If this state can be established, interaction of the core materials and the concrete rcactor cavity will be minimal and basemat penetra-tion will be prevented. Even if water is not supplied to the reactor cavity, l it is concluded in the ZPSS that failure of containment will occur via over-pressurization long before the core debris penetrates the concrete basemat. Indeed, this is considered a conservative assumption in the ZPSS because fis-sion product release via overpressurization failure would be more severe than release via basemat penetration. Extensive independent assessments on the potential for the formation of a coolable debris bed and on containment pressurization vs basemat penetration were reported in Reference 5. The NRC staff position, taken in Reference 5, l 1s that even with a flooded reactor cavity supplied continuously with water, l debris bed coolability is not guaranteed. However, for the Zion facility, it was concluded, in Reference 5, that failure would occur via overpressurization prior to basemat failure for those sequences in which water supply to the cavity was limited. II-5

II.1. 5 Failure to Isolate Containment Building This is potentially a very important release category. In the ZPSS, this failure mode was allocated a low probability and consequently had minor in-fluence on risk. A detailed review of this failure mode was outside the scope of the BNL review. However, this failure mode is the subject of extensive current NRC staff activity and its omission from this draft review report should not be interpreted as an acceptance of the ZPSS analysis. 11.1.6 Interfacing System LOCA This plant damage state was not allocated to a containment event tree in the ZPSS. An appropriate fission product release category was selected from the RSS and all of the plant state frequency was simply allocated to this category. The frequency associated with this plant state was not changed as a result of the SNL review (refer to Volume 1 of this report). The only change to this plant state in Volume 2 relates to the appropriateness of the release category. This is discussed further in Section II.3. 11.1.7 Impact of Containment Event Tree Review From the discussions in Sections II.1.1 through II.1.6 above, it is clear that only the H2 burning and basemat penetration failure modes in th ZPSS remain as potential areas of concern. In addition, the NRC positionL only differs on the establishment of a coolable debris bed (hence preventing base-mat failure) for sequences that involved a flooded cavity. If we consider only the impact of the above changes to the containment event trees in the ZPSS, the impact on risk is not significant. This is simply because, in the ZPSS, plant damage states that have no CHRS operating have relatively high frequencies (particularly if external events are considered). As these plant states result in containment failure via overpressurization with a conditional probability close to unity, and this is a relatively severe release category, they dominate risk. The above suggested changes to the containment event trees apply only to accident sequences with CHRS operating so their impact on l risk (using the ZPSS plant state frequencies) is negligible. i However, the above is not the case when the SNL plant damage state fre-i quencies are used. The SNL review allocates significantly higher frequencies to plant states with CHRS operating than in the ZPSS so that the higher proba-i bilities for H 2 failure modes suggested above in Section 11.1.2 becomes po-l tentially more important (refer to Section II.4). The release categories associated with basemat failure result in this failure mode having a negligible impact on risk even with the revised frequencies. SNL { t II.2 Site Model s The site consequence analysis in the ZPSS was reviewed by NRC staff (AEB/DSI/NRR) and their critique is included in Appendix C of Volume 2 of this Detailed comparisons between the site model used in the ZPSS and the report. j model suggested by NRC staff are included in Section 5 of Volume 2 to this report. In the ZPSS, most of the core melt frequency was allocated to four release categories; } II-6

~ 2 - Overpressure failures without sprays, including interfacing sys-tem LOCA 2R - Delayed overpressure failures without sprays 8A - Containment intact without sprays 8B - Containment intact with sprays In the ZPSS, only the 2 and 2R release categories were calculated to in-fluence risk. These categories, as defined in the ZPSS, were input directly to the NRC site consequence model at BNL. The results are compared with the ZPSS predicted values in Table II.1 below: Table II.1 Comparison of ZPSS and NRC site consequence model (conditional means) Release Acute Early Thyroid Latent Man Category Fatalities Injuries Cancers Fatalities Rem 2 39 1300 10000 3000 4.3x107 (ZPSS Model) 2 220 3500 1140 2700 4.5x107 (NRC Model) 2R 29 600 6400 2800 4.3x107 (ZPSSModel) 2R 0 833 895 2430 4.4x107 (NRCModel Internal Events) 2R 1190 3430 1040 2970 5.0x107 (NRC Model External Events) It can be seen from this comparison that the latent fatalities and man rem values are quite similar. This is to be expected, since these are long-term How-effects and are larcely independent of the details of the site model. A ever, similar dose conversion data must be used in the two calculations. comparison of the thyroid cancers shows that they vary by approximately a fac-tor 8, with the NRC model being lower. Since these are total thyroid cancers fatalities values agree (early plus chronic exposure) and since the latent reasonably well, one would expect the same to be true for total thyroid II-7

s cancers. The discrepancy is due to differences in dose conversion factors which differ by an order of magnitude. The dose conversion factor used in the BNL calculations is consistent with the review in Appendix C. Acute fatalities and acute injuries are a strong function of the thresh-olds used in the dose effectiveness model and the parameters used in the evac-uation model. These effects are evident by comparing results in Table 11.1. The NRC and ZPSS site consequence models used for internal events in general predict similar trends for early injuries. Acute fatalities show more sensi-tivity to evacuation modeling and hence exhibit more variation. However, the NRC site model used for external events initiated by seismic phenomena shows much higher early damage indices because of the more conservative evacuation model assumed (refer to Appendix C). II.3 Release Fractions The determination of release categories in the ZPSS follows the approach taken in the RSS. Thc:e release categories were used for the level 1 risk curves in the ZPSS. For reasons noted early in this section, we reviewed only the level 1 risk curves. Our review concentrated on the release categories that have the most significant impact on risk, namely, 2 and 2R (refer to Sec-tion II.2 for a definition of these releases). The majority of the release category 2 frequency comprises the interfacing system LOCA. The release category 2 in the ZPSS was taken from the RSS and corresponds to an overpressurization failure of containment in which the re-lease energy was calculated to be relatively high. The suggested BNL release (B1) has similar release fractions but uses a lower energy of release more ap-propriate to the interfacing system LOCA. The 2R release category comprises all sequences that result in gradual overpressurization failure of containment (all plant damage states without CHRS operating). In the ZPSS, the release fractions corresponding to RSS

ategory 2 were used for this failure mode with the timing of release adjusted appropriately.

However, the RSS release category 2 was calculated for con-tainment failure close to vessel failure and the release fractions reflect this assumption. It was noted above (Section II.1) that containment failure for these sequences at Zion would occur many hours after vessel failure. This would allow for aerosol deposition and significant reduction in the release fractions. This was not considered in the level I calculations in the ZPSS. However, the equivalent release category B2 calculated at BNL did include the impact of aerosol deposition and consequently the release fractions were lower than in the ZPSS category 2. Note that one of the reasons for reducing the l source terms in the ZPSS and generating the lower level 2 risk curves related to the impact of aerosol deposition for the late containment failure sequen-ces. Consequently, the BNL release category B2 does reflect this aspect of the ZPSS arguments for the level 2 risk curves. However, this is the only aspect of the ZPSS arguments considered in the B2 category and the methods used to calculate the aerosol deposition are consistent with those used in the l RSS. A comparison of the consequences resulting from the ZPSS and BNL release categories is shown on Table II.2. From the table it is seen that all the II-8 l l l

Table II.2 Comparison of ZPSS and BNL release categories using NRC site consequence model (conditional means) Release Acute Early Thyroid Latent Man Category Fatalities Injuries Cancers Fatalities Rem 2 220 3500 1140 2700 4.5x107 (ZPSS Release) B1 622 1850 724 1660 2.8x107 (BNLRelease) 2R* 0 833 895 2430 4.4x107 (ZPSSRelease) B21* 0 583 321 1440 2.4x107 (BNLRelease) 2R** 1190 3430 1040 2970 5.0x107 (ZPSSRelease) 82E** 120 1280 393 1690 2.7x107 (BNL Release)

• Based on evacuation model, used for plant states initiated by only internal events.
  • Based on evacuation model influenced by regional disaster, used only for plant states indicated by seismic events.

consequences, except one, determined using the ZPSS release categories are higher than those determined using the BNL release categories. The one excep-i tion is the number of acute fatalities determined for the interfacing LOCA re-lease. Although the release fractions are essentially the same for the two release categories, the energy of release is much lower in the BNL case. The effect of this lower plume energy is to deposit the plume content close to the plant, and consequently those individuals who do get irradiated receive a rel-atively large dose. The net result of this is an increase in acute fatalities for this particular site. This effect is clearly site dependent, if the popu-lation close to the plant were very sparse an increased number of acute fatal-ities may not be determined. II-9

II.4 Reassessment of Risk The independent evaluation performed by the authors of both volumes of this draft report were combined to provide a best estimate of the reu5sessment of risk at the Zion facility. This reassembly process was in four stages:

1) Fi rstly, SNL suggested new frequencies associated with some of the twenty-one plant damage states.

2) Then BNL revised the containment matrix, which gives the conditional probabilities of achieving eleven release categories for each of the twenty-one plant states.

3) In addition, BNL suggested three revised release categories.

4) The revised release categories were input to the NRC site consequence model.

Output from the consequence model was obtained for all eleven release categories and for five damage indices. The output was in two forms, normalized means and complementary cumulative distribution functions (CCDF). The CCDF or risk diagrams give the frequency that a given damage index occurs or is exceeded. The CCDFs appear in Appen-dix B through F of Volume 2 to this report. The means or average num-bers are used in this section. The total mean or average number for any given damage index can be calcu-lated by multiplying the plant damage state frequencies by the conditional probabilities in the containment matrix to determine the frequency of occur-rence of a given release category. This frequency is then multiplied by the conditional mean for the release category corresponding to the damage index of interest. All of the means for each of the release categories would then be summed to give the total average number appropriate to the damage index. In Table II.3 the means (obtained by the above process) for the five dam-age indices, are included for internal events only. Internal plus external events are included in Table II.4. Both tables compare the reassessed risk i indices with the original ZPSS estimates. Note that acute fatalities and early injuries in Tables II.3 and II.4 are short-term effects but that the thyroid cancers, latent fatalities and man rem were integrated over 30 years. From an inspection of Table II.3, mean acute fatalities increase by a fac-tor of approximately six. This difference is largely due to two competing l effects:

1) The interfacing system LOCA contributes significantly more to acute fatalities in the revised estimate than in the ZPSS.

The frequency of this damage state was not changed in the SNL best estimate frequencies so that all of the increase comes from the changes made to the release category at BNL and the NRC site consequence model (refer to Sections II.2 and II.3).

2) The BNL release category and the NRC site model result in the predic-tion of no acute fatalities for the gradual overpressurization failure mode.

In the ZPSS analysis, this category was calculated to result in 11-10 i e

Table II.3 Change in risk associated with revised point estimate (internal events only) Total Latents Acute Early Thyroid (Excluding Man Fatalities Injurias Cancers Thyroid) Rem Revised Point 6.5(-5) 3.5(-3) 3.26(-3) 1.26(-2) 220 Estimate ZPSS Point 1.1(-5) 2.8(-4) 2.62(-3) 9.96(-4) 15.05 Estimate Table II.4 Char.ge in risk associated with revised point estimate (internal plus external events) Total Latents Acute Early Thyroid (Excluding Man Fatalities Injuries Cancers Thyroid) Rem Revised Point 6.96(-4) 1.02(-2) 5.36(-3) 2.2(-2) 363 Estimate ZPSS Point 1.73(-4) 3.64(-3) 3.84(-2) 1.57(-2) 256 Estimate 11-11

h some acute fatalities. The damage state frequencies that have the l largest contribution to this failure mode were significantly increased ji as part of the SNL review. Consequently, the increase in acute fatal-ities in Table II.3 is considerably less than would have been calcula-ted if the ZPSS release category and site model had been used. t Further examination of Table II-3 indicates that mean early injuries are higher by a factor of over twelve in the revised estimate relative to the ZPSS. This increase is dua almost entirely to the higher frequencies allo-cated by SNL to damage states without containment heat removal systems op-j - erating. It was noted above that these frequencies were significantly in-creased at SNL but that the appropriate BNL release category and NRC site model predicted no acute fatalities, hence the increased damage state fre-quencies had no impact on this damage index. However, the BNL release cate-3- gory and NRC site model do predict similar early injuries to the ZPSS model so that the increased SNL damage state frequencies have a major impact on this damage index. Total Latent Cancers (excluding thyroid) and man rem follow similar trends. The revised estimate is higher than the ZPSS by a factor of approxi-mately 14 for both damage indices. The increase is due largely to the in-creased frequencies resulting from the SNL review of plant states without CHRS operating. However, the increases are not so pronounced because the BNL re-lease category and NRC site model actually reduced the normalized mean latent fatalities by a factor of 2 (refer to Sections II-2 and II-3). The increased frequency of some plant states with CHRS operating are also important to risk l because BNL allocated a fraction (CP=0.02) of these damage states to contain-i ment failure via H2 burning. Even with this rather modest potential for H2 failure, the failure mode contributes to approximately 257. of the mean latent fatalities. There is considerable uncertainty regarding the potential failure of containment via H2 burning for plant states with containment heat removal systems (in particular, sprays) operating. In view of the uncertainty regarding this failure mode, a - sensitivity study is included in Volume 2 to illustrate its potential impact on risk and the results are summarized in Sec-tion II.S. i Finally in Table II-4, the risk associated with the revised estimate is compared with the original ZPS5 estimate for internal and external events. Acute Fatalities are higher by a factor of four. The revised estimate of acute fatalities is largely composed of sequences involving small break LOCA with loss of ECC and CHRS, but only with that fraction of the sequence fre-quency associated with seismically initiated events. Note that the NRC site model used an evacuation scheme that reflects regional disasters (such as se cm c events) so that when this scheme is used with the BNL release cate-i i gory, the calculation results in early fatalities (refer to Section II-3). The increase in risk of the revised estimate of acute fatalities is due to the high frequency allocated to plant states without CHRS operating by SNL and the revised evacuation scheme for seismically initiated events. The rather modest change in'the thyroid cancers, latent fatalities and man rem of less than a factor of 2 (refer to Table II-4) is again largely due to the increased frequency of the damage states without CHRS operating resulting from the SNL review. The impact is not as pronounced for latents and man rem II-12

as it was for acute fatalities. This is because the evacuation scheme does not have as large an impact on longer term damage indices (such as latent fa-talities) as it does on acute fatalities. II.5 Sensitivity Studies The independent evaluations performed by the reviewers of the ZPSS re-sulted in best estimates of the reassessed risk at Zion as described in Sec-tion II.4. However, the review process highlighted concerns that suggested a number of sensitivity studies. The impact on the best estimate revised risk curves of these sensitivity studies is calculated in Section 5 of Volume 2 to this report. The major results of these sensitivity studies are discussed in the following paragraphs. II.5.1 Plant Damage State Frequencies The SNL review of plant state frequencies suggested six separate areas to be examined through sensitivity studies. The following is a list of these six areas:

1) Seal LOCA does not result from loss of CCW

2) Room cooling function is not verified 3)

Independent turbine trip circuits unavailable

4) Fan cooler failure due to core melt environment

5) Feed and bleed not viable

6) Review of ZPSS fire analysis The rational behind the above sensitivity studies is given in Volume 1 of this report and summarized in Section I.

The impact on risk of these studies is described in Section 5 of Volume 2 and summarized in this section. All of the above suggested sensitivity studies have minimum influence on acute fatalities or early injuries. The largest impact on the longer term damage indices (namely, thyroid cancers, latent fatalities and man rem) re-sults from the assumption that the room cooling function is not veri fied. However, as SNL assumes that monthly verification of the room cooling function will be instituted at Zion, the sensitivity study only serves to indicate why such verification is important. The results of the review of fire analysis in the ZPSS and the assumption that fan coolers may fail in a post core meltdown environment also signifi-cantly impact the longer term damage indices. These are, however, not in-cluded in the best estimate frequencies used in Section II.4. 11.5.2 Containment Event Trees Uncertainty in the containment matrix 'C' is quantified in Section 8.14 of the ZPSS and it was concluded that the total uncertainty is very small. Two reasons were given for this lack of uncertainty:

1) Many of the nodes which showed uncertainty had little impact on the later nodes.

11-13 L

4

2) Risk is dominated by plant damage states with no CHRS operating and they result in overpressurization failure with a CP close to unity with very little uncertainty.

We would generally support the ZPSS conclusions with regard to the lack of uncertainty associated with sequences without CHRS, but we cannot support the lack of uncertainty in the ZPSS for plant states with CHRS operating. For ex-ample, we noted above in Section II.1 that BNL suggests higher conditional probabilities for H2 burn failure modes for plant states with CHRS operating than assumed in the ZPSS. The potential for H2 burn failure of the Zion containment buildings is uncertain. In Section 5 of Volume 2, a sensitivity study is presented to indicate the impact of this uncertainty on risk. A factor of 10 change in the conditional probability of the failure mode can have a significant impact on the longer term risk indices. Acute fatalities and early injuries are not significantly influenced by this failure mode. We consider the sensitivity study in Section 5 of this report to more appro-priately represent uncertainty in the containment matrix than reflected in Section 8.14 of the ZPSS. I I. 5. 3 Site Consequence Model Uncertainty in the ZPSS regarding release categories and site model was - reflected in the level 2 risk curves. We noted above that a review of the level 2 curves is outside the scope of our review. However, sensitivity stud-ies regarding the site evacuation model were performed in Section 5. In the event of a natural disaster, such as an earthquake, it is assumed that the transportation system will be disrupted. The degree of disruption will vary, depending on the severity of the disaster. It was thus decided to consider two earthquake evacuation models. First, a model was used in which a 24 hr delay is assumed and second, a model was used which assumes an 8 hr de-lay time. These two evacuation models were applied to the release categories appropriate to gradual overpressurization failure, which is the assumed re-lease for seismic events. The most significant impact applies to acute fatal-ities. Zero acute fatalities are calculated for the evacuation scheme with the 8 hr delay and for the evacuation scheme used for internal events. If a delay of 24 hrs is assumed, then acute fatalities are predicted. II.6 New Plant Feature Considerations In Appendix D to Volume 2 of this report, the section on new plant fea-tures in the ZPSS is reviewed. In addition, an extensive eval tjonofpoten-tial mitigation features at Zion has recently been published. J The poten-tial for risk reduction at the Zion plant depends on a number of assumptions regarding the treatment of the interface system LOCA (V sequence), the treat-ment of seismic events and the importance of a hydrogen burn as a containment failure mode. As a result of the discussion and analyses presented in Appen-dix 0 to Volume 2 the following can be stated: a) If only internal initiators are considered the V sequence, because of its dominance, will tend to mask potential risk reduction based on acute fataliti's. II-14 a

b) When both internal and external initiators are considered, the treat-ment of the V sequence becomes less important. c) When external initiators are considered, the mitigation feature must be capable of withstanding the external event to ensure significant risk reduction. d) The role of hydrogen burning is important in determining risk reduc-tion when internal and internal plus external initiators are con-sidered. However, this failure mode only influences the longer term damage indices (thyroid cancers, latent fatalities and man rem). The potential risk reduction is discussed in detail in Appendix D to Vol-ume 2. II.7 Reference to Section II 1) " Zion Probabilistic Safety Study," Commonwealth Edison Company, September 1981.

2) For a description of the CRAC code, refer to Appendix VI of Reference 3.

3) Reactor Safety Study, "An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400, NUREG/75-014, October 1975.

4) W. T. Pratt and R. A. Bari, " Containment Response During Degraded Core Ac-cidents Initiated by Transients and Small Break LOCA in Zion / Indian Point Reactor Plants," NUREG/CR-2228, July 1981. 5) " Preliminary Assessment of Core Melt Accidents at the Zion and Indian Point Nuclear Power Plants and Strategies for Mitigating Their Effects," NUREG-0850, Volume 1, November 1981. 6) T. G. Theofanous and M. Saito, " LWR and HTGR Coolant Dynamics: The Con-tainment of Severe Accidents," NUREG/CR-2318, October 1981. 7) M. L. Corradini and D. V. Swenson, " Probability of Containment Failure Due to Steam Explosions Following a Postulated Core Meltdown in an LWR," NUREG/CR-2214, June 1981.

8) Letter from F. Schauer, Chief Structural Engineering Branch, DE, NRR to G. Mazetis, Acting Chief, Reactor Systems Branch, DSI, NRR dated Janauary 22, 1982.

i l 9) A. Ahmad, et al., "PWR Severe Accident Delineation on Assessment," NUREG/ CR-2666, January 1983. 11-15}}