ML20084N088

Analysis of PRA Testimony:Indian Point ASLB Hearings, Commission Question 1, Final Rept

ML20084N088
Person / Time
Site:	Indian Point
Issue date:	06/01/1983
From:	Amico P APPLIED RISK TECHNOLOGY CORP.
To:	NRC
Shared Package
ML20084N057	List: ML20084N077 ML20084N088
References
ARTECH-83-001, ARTECH-83-1, NUDOCS 8306020452
Download: ML20084N088 (67)

Text

.

ARTECH-83-001 ANALYSIS OF PROBABILISTIC RISK ASSESSMENT TESTIMONY:

INDIAN POINT ASLB HEARINGS COMMISSION QUESTION 1 JUNE 1, 1983 PREPARED BY:

PAUL J. AMICO APPLIED RISK TECHNOLOGY CORPORATION P.O. B0x 175 COLUMBIA, MD 21045 PREPARED FOR:

ATOMIC SAFETY AND LICENSING BOARD PANEL U.S. NUCLEAR REGULATORY COMMISSION WASHINGTON, DC 20555 O PDR

TABLE OF CONTENTS SECTION PAGE

1. INTRODUCTION 1-1

2. ACCIDENT SEQUENCE FREQUENCY 2-1 2.1 Failure Data 2-1 2.1.1 Use of Bayesian Techniques 2-1 2.1.2 Component Stress Factors and Aging 2-3 2.1.3 Human Error Rate Prediction 2-4 2.2 Omissions 2-6 2.2.1 Sabotage 2-7 2.2.2 Component Cooling Water Pipe Break 2-8 2.2.3 Steam Generator Tube Rupture With Stuck Open 2-9 Secondary Relief' Valve 2.2.4 Design and Fabri:ation Errors 2-9 2.2.5 Pressurized Thernal Shock 2-11 2.3 External Events 2-12 2.3.1 Siesmic Analysis 2-13 2.3.2 Fire Analysis 2-14 2.3.3 Wind Analysis 2-15 2.3.4 Other External Events 2-15 2.4 Modeling Errors 2-16 2.4.1 Fault Tree Errors 2-17 2.4.2 Arithmetic Errors 2-17 2.4.3 Event Tree Errors 2-17 2.5 Common Cause Analysis 2-18 2.5.1 Common Cause Omissions 2-19 2.5.2 Common Cause Data 2 2.6 Comparison With the Precursor Study 2-20 2.7 Conclusions on Accident Sequence Frequency 2-21

-wg

- ^ - - - - - - _.-.-__-,.2-y .,m ,, , , _ , , , ,___,_,.-._y ...,..m .. , _ - _

-g

3. IN-PLANT CONSEQUENCES 3-1 3.1 Containment Failure Analysis 3-1 3.1.1 Overpressure Failure 3-1 3.1.2 Vessel Steam Explosion 3-3 3.1.3 Hydrogen Burning 3-4 3.1.4 Basemat Penetration 3-5 3.2 Source Term Analysis 3-6 3.2.1 Chamical Form of Cs and I 3-6 3.2.2 Retention / Attenuation 3-7 3.2.3 Use of Experimental and Actual Data 3-9 3.2.4 Use of Discrete Probability Distribution 3-10 3.3 Conclusions on In-Plant Consequences 3-11

4. EX-PLANT CONSEQUENCES 4-1 4.1 Effluent Pathways 4-1 4.1.1 Meteorological Data 4-1 4.1.2 Atmospheric Dispersion Model 4-2 4.1.3 Liquid Pathways 4-2 4.1.3.1 Groundwater Dispersion 4-2 4.1.3.2 Airborne Releases to Water 4-3 4.1.4 Release Model 4-3

- 4.2 Emergency Response 4-4 4.2.1 Impact of Regional Disasters 4-4 4.2.2 Warning and Evacuation Times 1 4-5 4.2.3 Relocation Model 4-6 4.2.4 Sheltering Model 4-7 4.3 Health Effects 4-9 4.3.1 Dose Conversion Factors 4-9 4.3.1.1 Early Health Effects 4-9 4.3.1.2 Latent Cancers 4-10 4.3.2 Supportive Treatment Model 4-10 -

4.4 Economic Consequences 4-12 4.5 Conclusions on Ex-Plant Consequences 4-13

5. STATISTICAL UNCERTAINTY 5-1

- =c--- --

-n -

y - -- ,p-. - , - - - - - - -.g --m, , - -

6. CONCLUSIONS ON COMPLETENESS OF TESTIMONY 6-l'

7. CONCLUSIONS ON RISK 7-1 7.1 Licensee Risk Conclusions 7-1 7.2 NRC Staff Risk Conclusions 7-2

'7.3 Intervenor Risk Conclusions 7-3

Section 1 Introduction This report was prepared under the following charter, quoted from a letter written by James P. Gleason, Chairman of the presiding Atomic Safety and Licensing Board on Indian Point.

In connection with your employment as an independent consultant to the Board on probabilistic risk assessment, your task will be to review the completeness of the record on Questions 1 and 5. In accordance with your telephone conversation with Judge Shon, you will present a written report summarizing the issues presented to this Board and indicating whether additional evidence or testimony is needed for their resolution. You will not address the relative credibility or reliability of conflicting testimony, proffer any further testimony or evidence, or make recommenda-tions as to the resolution of issues before this Boa rd. This report will be submitted on the recora, and all parties will be given an opportunity to comment thereon.

~

The goal of summarizing the thousands of pages of testimony and I

transcripts on Question 1 was not simple. It was the decision of the author, in an attempt to keep the length of this report to a minimum, to limit the list of issues to those which, in his judgment, would be most useful to the board. Further, the discussion of each issue was kept to those key words and phrases which the author felt would be most meaningful.

There is one final limitation on the contents of this report. Any and all insinuations or accusations in the transcripts which questioned the inherent biases, motivations, moral or ethical standards, educational competence, or intelligence of any of the participants in these proceedings was totally ignored. This type of material does not belong in a reasonable discussion of a highly complex technical question.

L Section 2 Accident Sequence Frequency This section deals with areas which would tend to effect the point estimate value of accident sequence frequencies calculated in the IPPSS.

It is not really important in these discussions whether the point estimate value is referred to as a best estimate, mean, or median, since the discussion here is dealing with items which are basically indepen-dent of any probability distribution. The development of a point estimate gives a value around which a probability distribution can be

" centered" (in a statistical sense) if desired, and does not in and of-itself define a distribution.

2.1 Failure Data 2.1.1 Use of Baysian Techniques The failure data developed for the IPPSS was based on the application of Baye's theorem. This was done by developing a prior distribution based on two bodies of knowledge, El and E2 , which are general engineering knowledge of the design and manufacture of the equipment in question and the historical performance in other plants similar to the one in question, respectively. This was then combined using Bayes' theorem with E3 , the past experience in the specific plant being studied.

Although a distribution is implied by this process, we are only interested here in the point estimate values also derived, that

_2_

is, what effect does the particulcr application in the IPPSS have on the " center" of this implied distribution.

The Intervenor's concern is that the subjective engineering judgement that goes into selecting the prior distribution and applying it leads to a bias which can result in smaller failure rates than are actually justifiable. Also, the specific data used could be the result of incomplete searches of available data, or the data base itself could be incomplete by virtue of omissions in the filing of LERs or other failure reports.

The NRC staff re-analyzed the IPPSS data using the generic data base which has been used for other PRAs, notably the Interim Reliability Evaluation Program (IREP). This data was used as a best-estimate value only, with no implied distribution at all, as was done during IREP. The result of this exercise was that the staff concluded that the PPSS point-estimates as a result of their Bayes' theorem application was in general agreement with the staff estimates. The Intervenors pointed out that since the staff data was, at least theoretically, part of the body of knowledge used for developing the IPPSS priors, that one would expect a general agreement between the two. The staff pointed out, however, that the applications were entirely different, and that the genaral agreement showed that the application of Bayes' k

,n.-- . , _ , ,.,. ... - .- - - . - - . , . , - . . . --

theorem and the subjective judgement used in establishing the-priors did not alter the result. Thus, they concluded that the point-estimate values were basically independent of methodology.

2.1.2 Component Stress Factors and Aging The IPPSS work assumed that component failure rates can be represented by a constant (uniform) rate over the life of the plant, and that this failure rate applies under all con-ditions.1 The Board questioned whether it was reasonable to assume that wear-in, and particularly wear-out, can be assumed to occur outside the normal operating life of the plant. The Intervenors contend that this cannot be assured and thus there is a potential

. for large increases in accident frequency late in plant life.

Further, the Intervenors contend that a "k-factor" to represent unusual operating stresses on components under accident con-ditions should have been employed. They argue that the data for component failures is based on testing under benign conditions and that the failure rate should be higher under stress.

1 Except for common cause failures due to component dependencies and external events.

1 l

The Licensee feels that it is reasonable to assume that aging has little effect on co.nponent failure rates. Even if the wear-out process begins during plant life for some components, which they feel is doubtful due to the quality of the components and the care they receive, they contend that a component entering wear-out will be detected as a " trouble-maker" by test and maintenance procedures and would be replaced in a timely fashion.

Further, they contend that to a certain extent these types of failures are analyzed, since . failures during the component wear-in period are included in the data base, thus yielding a higher value for the component failure rate. On the subject of a stress factor, the Licensee feels that the accident conditions which would occur are within the design envelope of the plant components, and that therefore the base failure rate would be expected to apply.

l The NRC Staff did not comment on the validity of constant l failure rates or the use of stress factors.

2.1.3 Human Error Rate Prediction The IPPSS got its human reliability data and technique from l

NUREG/CR-1278, the NRC's human reliability analysis guide. Some

_ statistical manipulation was applied to the data in the guide, but the resultant point estimate numbers were still almost

! , ,_ _ . _ _ _ _ - ~ _ . __ _ __ _ __ __ -. __ _ _ _ _ - . _ .

. l l

1 identical to those in the guide. The Licensee feels thac the guide was applied properly and that the operator action credit given in the IPPSS was reasonable for the time available and the action required.

The Intervenors contend that certain things were not treated in the human reliability analysis, or were treated improperly.

They specifically pointed out that the willful violation of NRC rules, such as having two trains of a safety system out of service at the same time but not shutting down as required, is not treated. They feel that the pressure on operators to keep a plant producing power leads to " overlooking" some requirements, and that this should be accounted for.- Also, they feel that an insufficient description was given of operator dilemma analysis, the situation where the operator must decide between two alterna-tive causes of action. .

The NRC Staff review concluded that, in some key cases, hbman error was handled in a non-conservative manner. Of note is the fact that the Staff review in this area was conducted by Dr. Alan Swain, the principal author of the NUREG document that the IPPSS team used, and the developer of the techniques espoused by that document. Dr. Swain's basic judgement was that in those cases the IPPSS team misapplied his techniques in a non-conservative way. In particular, the IPPSS assigned very

optimistic failure rates to activities for which no or insuffi-cient proceoures existed. Sandia re-evaluated the human error numbers for these events. They also re-evaluated four important activities and one of them in particular was found to be very non-conservative. The revised numbers were included in the overall Staff sequence frequency re-evaluation which is discussed in Section 2.7. .

2.2 Omissions In general, the Licensee believes that there are no major omissions in the IPPSS. That is, none-that would be significant to risk. The NRC Staff, also in general, is in agreement with this. Specifically, the Licensee and Staff believes that while errors of omission led to the understatement of risk, most of the omissions would be expected to have a small effect on risk. They base this on the belief that the things which may have been i

omitted from both the IPPSS and the Staff review must have a small probability because otherwise there would be information available in the general body of knowledge which would have led to these things being included, which'is a somewhat rhetorical s

argument.

The Intervenors contend that a PPA, by its very nature as an extremely complex study, cannot possibly be complete. They further state that there is no way to assure that there are not

unknown scenarios which may be significant risk contributors, and just are not fully understood. They believe that the amount of review performed by the Staff is insufficient in terms of level of effort to be able to declare that all significant omissions were recognized. They also contend that since the staff review started with the IPPSS as a base line and was therefore not iruly independent of the IPPSS, that an inherent bias would exist.

What they mean by this is that it is not possible to accurately review a complex PRA by using just the final report, especially in the area of omissions.

The above point notwithstanding, the Staff review did find significant areas of disagreement, di: cussed throughout this report, and did recognize omissions. It might be added that the Intervenors noted certain omissions also. The notable omissions are discussed in the following sections.

2.2.1 Sabotage The Licensee did not include sabotage in the IPPSS because they felt that the delicate, security intensive nature of the sabotage issue was not conducive to disclosure in a public document. They do state that they have no way of knowing what the risk due to sabotage might be.

4

- , m - - . - -.v. - - - , - , , - . , - - - - - ,- -- r,-

The Intervenors contend that there is no basis for saying that the risk from sabotage is low, and therefore that it may be very high. Both the licensee and the NRC Staff agree that the only way to know for sure is to do the analysis, that PRA is an appropriate tool for performing the analysis, and that including sabotage analysis in a PRA would give a better estimate of total risk and provide useful insights.

None of the hearing participants directly addressed the sabotage issue through expert testimony, despite the fact that nuclear facility sabotage studies have been performed, by Sandia far example. While the studies themselves are likely to be classified, the testimony of the people who performed the studies l

about their subjective judgement on- the risk significance of i sabotage would have been useful.

2.2.2 Component Cooling Water Pipe Break The IPPSS did not consider a component cooling water pipe break as an initiating event. The NRC Staff reviewers felt that this initiator should be included in the analysis.

They quan-tified the frequency of core melt from this initiator and found it to be a significant contributor to total core melt frequency (3.8E-5 at IP2 and 1.4E-4 at IP3).

9-2.2.3 Steam Generator Tube Rupture w/ Stuck Ooen Secondary Relief Valve l

Although the IPPSS did consider steam generator tube rupture as an initiating event, they did not include a containment bypass j sequence caused by a stuck open secondary relief or safety valve.

This event is very similar phenomenologically to the inter-facing systems LOCA. That is, they are both containment bypass prior to core melt. The Sandia review evaluated this event to be of the same order of magnitude as the interfacing LOCA. If the Sandia evaluation were used, there would be no significant difference between the IPPSS and NRC frequencies for the total of containment bypass sequences. However, the Staff did a separate evalintion, which included multiple tube ruptures whereas the Sandia evaluation considered only single tube ruptures. This resulted in the NRC frequency for all containment bypass sequences being a factor of five higher than the IPPSS estimate.

2.2.4 Design and Fabrication Errors The IPPSS analysis does not specifically deal with the issue of errors in the design and fabrication of the power plant. The Intervenors feel that this could lead to substantial error.

Specifically, they point out that the IPPSS assumes that the design of the components and systems at Indian Point is suffi-

cient for them to perform their function under all conditions.

However, since extensive testing is not performed under all

10 -

possible conditions, they feel that assuming the systems and components capable is not reasonable. Further, they claim that the study does not take into account the possibility that the plant as it was actually built might differ from reference drawings due to errors during construction or that the actually installed materials may not meet the design specifications.

The NRC Staff testified that the methodology employed would be fairly reliable at identifying some kinds of design errors, but would indeed not be able to identify design errors which were not portrayed in design docunentation or revealed by surveillance tests or operating experience. In general, however, the Staff believes that this would not be a significant risk contributor for the reasons outlined in Section 2.2.

As far as can be ascertained, the opinion of the Licensee is that sufficient conservatisms are used in the design of systems and components to virtually assure that they are capable of performing under any plant conditions, and that the quality assurance at Indian Point renders the likelihood of errors during construction or inferior materials being installed quite low.

.m + ..r-- ., n , , - - . - - - . ----- .,m.

2.2.5 Pressurized Thermal Shock (Board Question 1.4)

The IPPSS did not consider the effect of pressurized thermal shock (PTS) on core melt risk. The Licensee used the value of 3E-7 per reactor year for vessel rupture frequency, taken from WASH-1400. They state that this number bounds the PTS evaluation done by the NRC and the Westinghouse owners group. Numbers in this range are supported by various other evrluations. This frequency is too small to affect risk.

The Intervenors point out thac at least one of the eval-uations referenced contains fossil boiler data which is not applicable because no neutron bombardment takes place. They contend simply that not enough is known about PTS to do a reason-able evaluation and then further to conclude that PTS is not significant.

The NRC Staff testified that both IP units are several years away from exceeding the NRC criteria for total fluence which 11dicates sensitivity to PTS. They feel that the criterion is sufficiently conservative that risk is negligible below this value. Specifically, they feel that the frequency of PTS for a

" sensitive" plant is on the order of 10-5-10-6 per reactor year, and that at present the IP units are 1-2 orders of magni-tude below this value.- Further, if flux at the vessel is reduced over the remaining plant lifetime, neither of the units need ever

. _ - . .  :- , - . - . - - . . .N . -

become " sensitive." Therefore, the Staff concluded that PTS is not a significant risk contributor now and need not be for the, remaining plant lifetime.

No one addressed directly the issue of PTS leading to core melt and containment failure. The above numbers are for occur-rence of PTS only. Thus, they cannot be put in context as to what they might contribute to the plant damage states evaluated in the IPPSS or by the NRC Staff.

2.3 Extermal Events -

A number of general statements can be made about the treat-ment of external events in the IPPSS. Both the Licensee and the

NRC Staff agree that the evaluation of external events was the i

most comprehensive ever performed in any PRA and that the method-ology was reasonable. They further agree that it is possible to do an evaluation of external events and get results which are useful for determining, to a certain extent, the risk contribu-tion and dominant scenarios of these events. The Intervenors, however, feel that the evaluation of external events cannot possibly be reasonable or complete since the evaluation is not based on any "real" information. Thus, the remainder of this section, which deals mostly with the comparison between the IPPSS evaluation and the NRC Staff evaluation, must be read while l

l l _ . - - - - - - .- . - - - - - - - - -

keeping in mind the Intervenor contention that neither evaluation is useful.

The NRC staff conclusions on external events can be sum-marized by saying that, in general, they feel that the differ-ences between the staff numbers, which were used in the final Staff risk calculations, and the IPPSS numbers are small. That is, the point estimato values used by IPPSS and NRC for the most part do not significantly differ. The one exception to this is the evaluation of high winds at Unit 2, where the NRC evaluation is a factor of five higher than the IPPSS.

2.3.1 Seismic Analysis The NRC staff review of the seismic analysis actually consisted of two reviews, one by Sandia in conjunction with JRBAI as part of the overall Sandia review of the sequence analysis and one by Robert Budnitz specifically dealing with external events.

In as much as the Budnitz review was commissione'd specifically for external events and also encompassed a review of the Sandia/JRBAI work, it will be considered to be the final Staff review and the official staff position. The staff concluded that the seismic methodology and data are not well enough known to provide absolute quantitative risk numbers. In general, however, the Staff agrees with the insights (i.e.,

dominant contributors) which are found in this type of a.ialysis.

A number of specific differences were identified, but for the most part it is not necessary to identify all of them. The most notable of them is the omission from the IPPSS of consideration of the collapse of the control room ceiling. The IPPSS team agreed that this was a non-conserystive omission which should be treated. What is important is that the end result of the eval-uation shows that the difference between the Staff and IPPSS seismic evaluations is virtually nonexistent.

2.3.2 Fire Analysis The NRC Staff perforned a re-analysis of fire at Indian Point. Again, there were a number of differences with the IPPSS analysis. Most notable of these was the omission of control room fi res. Other issues included the omission of cable failure due to insulation degradation without actual cable combustion, the lack of treatment of the spread of fires from non-critical areas to critical areas, and the use of non-conservative human error rates for safe shutdown using local auxiliary feedwater pump control. The first three of the above mentioned issues were also pointed out during Intervenor testimony as being non-conservatisms in the fire analysis. Despite these differences, the NRC Staff concurs with the IPPSS findings regarding the major fire risk contributors and the contribution of fire to overall risk. The

l actual staff numbers for total core melt frequency due to fire do not differ significantly from the IPPSS numbers, even though there is a significant difference (an order of magnitude) in one of the less important IPPSS plant damage states.

2.3.3 Wind Analysis The wind analysis was done in two parts like the seismic analysis. Again, the Budnitz analysis will be considered to be the final Staff review and the official Staff position. The Staff concluded that the wind methodology and data are not well .

enough known to provide absolute quantitative risk numbers. The most important conclusion of the Staff analysis is that the hurricane analysis is extremely subjective. Although the Staff does come up with a number, it is a result of not being able to decide between the IPPSS analysis and the Sandia analysis. Thus, the Staff decision was to " split the difference" between the two.

Using this value the Staff estimate of core melt frequency due to high winds is almost a factor of five higher than the IPPSS for Indian Point 2 only.

2.3.4 Other External Events The IPPSS considered various other external events, such as flooding, aircraft impacts, barge accidents, and gas transmission line accidents. For all cases except barge accidents, the Staff concurs that these other external events are insignificant

contributors to risk and that the IPPSS Enalysis is generally reasonable. In the case of barge accidents, the Staff believes that there is a serious methodological error in the IPPSS using Boston Harbor data for computing accident likelihood near Indian Point. The Staff was also not capable of developing a reasonable methodology of its own and thus has no best estimate for core melt frequency due to barge accidents. The Staff believes, quite subjectively, it is highly likely that the overall risk from barge accidents is quite small and thus their omission from full-scale risk analysis is acceptable.

2.4 Modeling Errors Part of the Intervenor contention is that a PRA is not a reliable evaluation because the scope'of the analysis is so large and complex tnat it is impossible to avoid significant error even ff " correct" information is available. Also, in the particular case of the IPPSS, they feel that the NRC's use of the IPPSS as a starting point for their review and a lack of detailed background information created a bias whereby it would be impossible for the NRC to detect these errors. Both the Licensee and the Staff disagree with the above points, and tfe Staff did indeed look for and found some errors in the IPPSS. The Staff's conclusions on analytical errors in the IPPSS are contained in the remainder of l this section.

I

2.4.1 Fault Tree Errors The NRC Staff review identified errors in some of the system fault trees. The Licensee agreed with the errors and incorporated corrections in the IPPSS. Thus, these errors would not be expected to result in any differences between the Staff eval-uation and the IPPSS.

2.4.2 Arithmetic Errors The NRC Staff testified that, in principal, arithmetic errors could grossly distort the results. It is their belief, however, that a significant distortion of the risk due to arith-metic errors would have been conspicuous in the comparison of the two studies and against the background of other PRAs and risk research. Thus they conclude that no large arithmetic errors exist.

2.4.3 Event Tree Errors The Staff review of the IPPSS event trees found five noteworthy errors. Two of them are omissions which have been discussed previously (Sections 2.2.2 and 2.2.3). The other three l

are (1) the ATWS tree took credit for some ATWS fixes which the utility had decided to defer, (2) the loss of service water /

j component cooling water initiators did not take into account subsequent loss of RCP seal integrity or offsite power, and (3) 1

\_ , .__ ._. ,_ _

no credit was taken for the availability of main feedwater after an initiator (this last one is an error on the side of conserva-tism). The Staff re-evaluated the event trees with these three errors corrected, and concluded that the effects were not signif-icant overall.

2.5 Common Cause Analysis The IPPSS attempted to quantify the effects of various common cause failures. Failures of comon support equipment was modeled explicitly in the fault / event trees. The external event analysis modeled multiple failures caused by those events. Other common cause potential due to similar operating environment was modeled using beta-factors. The human error analysis included common cause (dependent) operator faults. The Licensee believes that common cause can be treated adequately in these ways. The NRC Staff agrees that it is possible to adequately model common cause also, but had some problems with some of the IPPSS analysis.

These problems are discussed below. The Intervenors, on the other hand, believe it to be impossible to adequately treat l common cause type failures. They contend that nuclear plants are l too complex and interactive to be dealt with in the PRA context.

1 They point out that this complexity might lead to events occurring which are not likely to be expected by the designers or operators.

~ _ , . . _ ,_ _. - - _ _ - ____.

2.5.1 Common Cause Omissions The Staff feels that it is possible that some types of common cause events were probably omitted from IPPSS. However, they are of the opinion that no important ones were omitted.

Their reasoning for this is not that these potential omissions are of negligibly low frequency in an absolute sense, but rather that other common causes which have been quantified for IPPSS are substantially higher. They point out that it would be highly unlikely that an omitted common cause event could exist which would have the high frequency and devastating scope of the earthquake, fire, and high wind external events which are modeled in IPPSS.

The Intervenors argue, as alluded to in the previous section, that due to the complexity of nuclear plants that making the above assumption is a serious error, and that no one could even anticipate some of the events which could occur.

2.5.2 Common Cause Data The NRC Staff concluded in their review that the common cause data used in the IPPSS was largely non-conservative. They I

state that the IPPSS team did not have available to it some very recent sources of data on common cause failures. Using this data, the Staff re-evaluated the beta-factors used in the IPPSS, l

I coming up with higher common cause failure rates. These updated beta-factors were used in the Staff's re-evaluation of IPPSS

- sequence frequencies, and were found not to have a significant effect on the results.

2.6 Comparison with the Precursor Study (Board. Question 1.2)

The accident precursor study evaluated all the abnormal occurrences which have happened at U.S. nuclear plants and determined that the frequency of severe core damage was substan-tially higher than that evaluated in the IPPSS. The Board was concerned about what effect this has for the IPPSS results.

The Licensee believes that the study does not affect the IPPSS. They state that the study deals with a simple accounting of events over a previous period of time which is not applicable to the present. Further, the study deals with severe core damage, not specifically with core melt. In general, they feel that the methodological deficiencies and assumptions render the study useless as a prediction of future core melt frequency.

The NRC Staff believes that the study does not affect the IPPSS. They feel that the study is consistent with the possibil-ity that the IPPSS is correct. They base this on their conclu-sion that a study of accidents in the 70s is unduly pessimistic g,-ww- ,---wwgww---w--r- -

as a predictor.of similar accidents at IP today. In particular, the methodology cannot take into account major differences in plant designs (it is not plant specific) and also cannot quantify the effect of plant and procedure changes which have been imple-mented at the plant and throughout the industry.

The Intervenors believe that the study having a different ,

answer from other PRAs demonstrates the large effects of method-ology selection on the final result. They conclude that the study helps to discredit PRAs in general as accurate predictors of risk.

2.7 Conclusions on Accident Sequence Frequency There are, in general, two classes of issues discussed above. The first is those issues whose effect has been evaluated in the NRC Staff review of the IPPSS. A comparison of the final  ;

IPPSS and NRC numbers is shown on Table 2.1 for the after fix case.2 This table shows that the only significant differences are in the " containment bypass prior to core melt" and "early core melt with containment cooling (Unit 3 only)" categories.

The f.frst difference is due entirely to the reanalysis of steam 2

The absolute before fix numbers are different, however the -

NRC/IPPSS ratios are generally the same.

generator tube rupture, and the second is due almost entirely to the addition by the Staff of the loss of component cooling water due to pipe break initiation. Thus, based on the Staff's results, it can be said that of all the issues which were evaluated quantitatively by the Staff, only the two mentioned above have a statistically significant effect on total frequency of any plant damage states.

The second class of issues were those which were not quanti-tatively re-evaluated, and thus whose effect is not truly known.

Of those issues, there are three for which additional testimony would be useful in helping to evaluate their effect. These are component stress factors and aging (Section 2.1.2), sabotage (Section 2.2.2), and pressurized thermal shock (Section 2.2.5).

The type of and reason for additional testimony are explained in the cited sections. In general, the Licensee and NRC believe that all the issues in this class have no effect on overall damage state frequency.

The Intervenors' case can be sunnarized as one of "you missed more than you found, and what you found was wrong." They conclude that the entire sequence frequency analysis is filled with errors, omissions, and inherent biases which render it useless. Some of these problems are inherent in the methods

employed, while others are due to the application of these l methods to a very complex nuclear plant.

l l

l

l Table 2.1 Comparison of IPPSS and NRC Numbers for Various Plant Damage States (After Fixes)

Unit 1 Unit 2 IPP55 NRC IPP55 NRC Early Care Melt w/ Containment Cooling 7.4(-5) 1.6(-4) 1.8(-5) 2.0(-4)

Late Core Melt w/ Containment Cooling 3.4(-5) 1(-4) 1.1(-4) 1(-4)

Early Core Melt w/o Containment Cooling 5.8(-5) 8.3(-5) 1.2(-5) 3.9(-5)

Containment Bypass Prior to Melt 4.6(-7) 2.4(-6) 4.6(-7) 2.4(-6)

Direct Contain-ment Failure 7(-7) 7(-7) 3.5(-8) 3.5(-8) em -

Section 3 In-Plant Consequences This section deals with the issue of plant response following core melt. It includes those areas dealing with the analysis of containment response and subsequent failure and analysis of the radionuclides available for release from containment, known as the source term.

3.1 Containment Failure Analysis 3.1.1 Overpressure Failure The IPPSS analysis of containment overpressure assumed that the containment can withstand pressures up to 140 psia, at which point it would definitely fail. This was based on a detailed strength of containment analysis. In order to account for the fact that there is a finite probability that failure could occur at a lower pressure, a distribution curve was used, with a probability of failure of 1 at 140 psia and a probability of .01 at 136 psia. The MARCH code (version unknown) was used to model the core melt accident progression and containment building loading. The IPPSS concludes that containment overpressure is likely to occur only by gradual late overpressure, and then only if both containment sprays and fan coolers are inoperable.

The NRC Staff analysis assumed that containment failure would occur at 126 psig. This is essentially equivalent to the 140 psia used in the IPPSS. They used a distribution which was slightly wider than the IPPSS distribution, running from 106 psig with a failure probability of .02 to i

l l

126 psig with a failure probability of .98. The staff used MARCH 1.1 to model the core melt accident progression and containment building loading. The staff believes that this code is conservative in showing a faster core heatup than would be expected. The improved version of the code, MARCH 2.0, appears to show a slower heatup. Since this is the case, the staff should have performed the analysis using MARCH 2.0, or at least provided a discussion of the differences in the codes and a justification for using MARCH 1.1. In general, the staff conclusion regarding overpressure is not significantly different than the IPPSS conclusion. In one area, however, the staff does believe that the IPPSS

.is overly conservative. For damage state E, IPPSS assumes late overpressure will occur. However, the staff believes, due to the type of concrete used for the Indian Point basemats, that there is a 50-50 chance that the less severe basemat melt-through failure mode will occur instead of overpressure.

The intervenors believe that- the containment overpressure analysis is extremely non-conservative. They state that the rupture pressure is too high and that the failure probability distribution used is too i narrow to account for the uncertainties. Since the containment is never 1

- ' tested above 60 psia, they wonder how 140 psia can be justified by only the use of a hand analysis and unspecified computer codes of unvalidated accuracy. Further, the assumption of overpressure leading only to cracks in containment as opposed to a penetration blowout or similar severe failure is non-conservative. They also point out that the l

l l

, - - . . , _ _ _ _ . _ , _ , _ ~

analysis does not account for the possibility that inferior materials or construction are present. Finally, they point out that the final version of the Sandia review was not sure whether the containment sprays or fan coolers could continue operating after a core melt, and thus whether any credit should be given for the continued operation of these systems. The intervenors believe that the assumption that these devices are available.is extremely non-conservative and that no credit should be given unless substantial, realistic testing is done.

3.1.2 Vessel Steam Explosion The IPPSS analysis concluded that containment failure by vessel steam explosion was not possible. This is based on an analysis which showed that the necessary mixing of coolant and debris for a large in-vessel steam explosion is not achievable and that the primary pressure is usually not conducive to creating such reactions. They took the analysis one step further, however, and assumed that such a reaction did occur and analyzed its effects. They concluded that insufficient loads would be produced to cause vessel or containment failure.

In the staff analysis, they used a value of 1 x 10-4 for vessel steam explosion, a factor of 100 less than WASH-1400. This was based on detailed analysis perfomed in NUREG-0850, and similarly concluded in a Sandia report (NUREG/CR-2214) done independently. In general, the reasons for tne value being so low are the same as those used by the IPPSS to eliminate this failure mode. The staff concluded, however,

that while this failure mode is unlikely, it is not impossible.

The intervenors feel that the elimination of this failure mode by the IPPSS may not be justified. They believe a sensitivity study on the effect of this assumption on risk should be performed and then perhaps a review of the physical modeling which lead to the exclusion. They do not directly dispute the NRC staff number used in the staff analysis.

4 3.1.3 Hydrogen Burning The IPPSS concluded that hydrogen burn resulting in containment failure is not a viable failure mode at Indian Point. Their analysis found that hydrogen generation is not significant based on the effect of the Indian Point geometry on hydrogen generation by concrete decomposition. The geometry permits available water to cover and cool i the core. Other phenomena limit hydrogen generation during the other phases of core melt. Experimental data indicate that the hydrogen concentration and containment conditions are not in the flammable range for most of the analyzed accidents. Further, even when a hydrogen burn is possible, experimental data indicate that insufficient loads would be produced to cause containment failure.

Th'e NRC staff analysis concluded that while hydrogen burn is not possible for damage state E, it is the primary threat to the containment for damage states EC, EF, EFC, and LF. The major reason for its not I

being possible for damage state E is the high partial pressures of steam and noncombustible gases due to the failure of all containment cooling i

1

I systems. This renders the containment atmosphere inert. For the other damage states, the condensing of steam allows a combustible mix of hydrogen in the containment atmosphere. The analysis of these combustions is based on MARCH runs and NUREG-0850. The staff believes that the IPPSS was very non-conservative in their analysis of hydrogen generation during invessel core slump and core debris / water / concrete interactions. The staff concluded that thousands of pounds of hydrogen would be produced, as opposed to the hundreds calculated in the IPPSS.

l With this amount of hydrogen, combustion and containment failure become significant.

3.1.4 Basemat Penetration The IPPSS concluded that basemat penetration would occur only for 3those sequences where no water was available in the reactor cavity.

The presence of water would result in a coclable debris bed which would not penetrate the basemat. Their analysis shows that dispersion of the core debris would result in a large surface area for cooling, and that the continued presence of water would cool the debris. They claim that this conclusion is supported by analytical and experimental indications.

They state that the plant geometry virtually assures the presence of water in the reactor cavity prior to a breach of the vessel and a continuous supply of water when containment safeguards are available.

Thus, for almost all sequences basemat penetration will not occur.

The NRC staff analysis is similar to the IPPSS analysis but there

are two specific differences. For the case of the flooded reactor cavity, a coolable debris bed is not assured, thus they have assigned probabilities of from 10-20% that penetration will occur. This is based entirely on analysis in NUREG-0850, and is more conservative than the IPPSS. For the dry cavity case, the IPPSS assumed overpressure would always precede penetration whereas the staff felt it could go either way, as explained in Section 3.1.3. The staff also assignad a 10%

probability that no containment failure would occur. In this case, the IPPSS was too conservative.

3.2 Sourca Term Analysis The testimony on source term analysis is unusual in that the IPPSS does not constitute the final licensee position on an issue. In this case, the licensee presented additional testimony which essentially disputed the IPPSS analysis, thus four testimonies will be dealt with in the summary of this issue.

3.2.1 Chemical Form of Cs and I Both the IPPSS and the NRC staff made the assumption that Cs and I are present as atomic cesium and 2I , respectively. This is based entirely on the WASH-1400 analysis of these elements following core melt. The licensee believes that this assumption is overly conservative. They state that NUREG-0772 predicts that the dominant form of iodine is CsI, and that other studies'show that the remainder of

s the Cs will show up as C's0H. This is significant in that these forms of Cs and I will not transport as well through the reactor coolant system and containment as will the forms assumed in WASH.1400. This will result in a much smaller release of these radioisotopes to the atmosphere.

The NRC staff does not dispute that chemical forms CsI and Cs0H would be dominant. They do state, however, that the solubility of Csl may have only a small overall effect on release since WASH-1400 did assume a high solubility for I ,2 although CsI would still have a much higher solubility.

3.2.2 Retention / Attenuation Both the IPPSS and the NRC staff used the WASH-1400 models for calculating the releases from containment. The IPPSS used an unspecified version of the CORRAL code and the staff used CCRRAL 2. The licensee believes that this model does not properly handle the transport and release from containment of radionuclides produced during core melt.

They state that the CORRAL model does not account for the retention or attenuation of fission products in the reactor coolant system or the containment. Specifically, they claim that although much of the fission products released are volatile initially, available information indicates that they do not remain volatile as they encounter lower temperatures, cooler surfaces, water and water vapor, and particulates in the air as they make their way through the reactor coolant system and

~

4 containment. A more realistic model was developed by Battelle for NUREG-1990 which included the TRAP code for calculating the fraction of fission products retained in the primary. Assuming Cs and I in the form of Cs0H and 2I , respectively, this model predicts that 20-65% of the iodine and 99% of the cesium would be retained. If the dominant form of

. iodine were CsI, as stated in Section 3.2.1, then 99% of both-iodine and cesium would be retained.

The staff agrees that the WASH-1400 methodology is conservative in overestimating the quantities of fission products released. They state that CORRAL does not adequately model the source term because it does not consider aerosol agglomeration or retention in the primary system.

The performance of aerosols in containment over the long time frames associated with delayed containment failure is more accurately modeled by the NAUA 4 code, which shows a reduction in the source term. The staff should provide a justification for not re-analyzing the source term using this code. The staffidoes not believe that these deficiencies in the WASH-1400 methodology can be converted into quantitative reduction factors, as the licensee proposes, at this time.

With the great amount of effort by both the industry and the NRC on the

~

ongoing source team work which is expected to be completed by the end of i

this year, quantitative reduction factors are premature until that time.

Thus, it is best at present to use the current models as a reasonable i

representation of the source term.

The significance of the source team work, however, calls into

~

i i

, , - - - - - .- e- - - - , - - - - - _ , , ,.,y, . - - - . - ..-.--.__.-.,--x, ~ . _ - - - -

question whether a valid decision can be mad 2 on a reasonable source term until that work is completed and additional testimony can be developed from it.

The intervenors question whether the assumption of there always being retention is valid. They point out that NUREG-0772 states retention is low or non-existent for a full core melt and that the licensee does not address the issue of what happens when there is no-water available.

3.2.3 Use of Experimentsl and Actual Data The licensee's source term testimony is based in large part on various experimental studies and comparisons to actual occurrences at nuclear plants. A number of experimental studies, both old and recent, have definitely indicated that the WASH-1400 source terms were conservative. The most significant of these are the Containment Systems Experiments (CSE), which suggest large dose reduction factors, and the l German risk studies. Actual comparisons of releases from plant accidents, such as SL-1, TMI-2, Windscale, and Fermi, with releases predicted using the WASH-1400 methodology shows that the predictions i were extremely high.

l The NRC staff disagrees with the licensee's interpretation of the l available data. They believe that the use of non-core melt data to support reduction factors is not appropriate. Preliminary results of i core melt calculations show that reduction factors are highly dependent

on accident sequence and reactor design. TMI-2 experience is not really applicable because gross containment failure did not occur. Further, the extent of fuel melting is unknown and the analysis of core fission product inventory is not complete. Comparison with Fermi, SL-1, and Windscale is not valid due to the great differences in the design of these facilities and the accident scenarios. Finally, CORRAL uses an empirical fit to CSE data as its model for containment spray effectivencss, yet the licensee claims that this same data proves a greater effectiveness for the sprays.

The intervenors in general concur with the points brought out by the NRC staff.

3.2.4 Use of Discrete Probability Distribution The IPPSS apparently used discrete probability distributions assigned to the various source terms in an attempt to quantify the impact of some of the deficiencies in the CORRAL code. Specifically, this was supposed to compensate for CORRAL's insufficient treatment of aerosol agglomeration in the containment atmosphere and its lack of consideration of the retention of aerosols in the primary.

The NRC staff finds little basis for doing this. They feel this is subjective and simply demonstrates the substantial uncertainties associated with the source term estimates. The source terms used by the i staff are appropriate at the present.

The intervenors also believe the IPPSS approach to be unjustified.

The approach is questionable because it (1) appears to ignore uncertainties in core phenomenology, containment response, and dose response, and (2) reduces the source terms for the important release categories by 22-35% below the WASH-1400 model, without justification.

3.3 Conclusions on In-Plant Consequences The licensee concluded that any containment failure is highly unlikely if containment fan coolers or sprays are operable. Ninety-nine percent of calculated containment failures are due to gradual late overpressurization, which occurs only when both sprays and fans are inoperable. Thus, only one percent of core melts lead to ear'ty containment failure. Generally, hydrogen burn, basemat penetration, and vessel steam explosion are not of concern for containment failure. The licensee also concludes that the IPPSS source term is too conservative.

They believe improved models and actual data justify a source term reduction of atleast a factor of 10 to 20, which greatly reduces risk at ,

the high end of most of the risk curves. Early fatalities are reduced along the entire risk curve and are actually totally eliminated at a reduction factor of 15. The licensee's final conclusion is that a realistic source term would result in (1) a reduction in property damage by a factor of ten, (2) no early fatalities would occur as a result of any accident scenarios at Indian Point and latent fatalities would be of an extremely small magnitude, and (3) the consequences of the " worst case" scenario would be similar to those of other large-scale industrial

accidents.

The NRC staff concluded that the essential elimination of vessel steam explosion, hydrogen burning, and basemat penetration by the IPPSS was improper and based on non-conservative and unjustified assumptions.

The staff re-calculated the probability of the containment failure modes. The most significant difference between the staff and IPPSS analysis is the increased probability of early containment failure from hydrogen burning. The staff agrees that the WASH-1400 source term methodology used for both the IPPSS and the staff analysis is probably conservative, however, they do not agree with the licensee conclusions on quantitative reduction factors for the scurce term. The reduction factors presented are extremely subjective in nature, being based on engineering judgment improperly applied to the available information on source terms. The staff does not state that the reduction factors are wrong, simply that, until the completion of ongoing source term work, there is no data or analysis available at this time to detennine whether the licensee testimony is right or wrong in the quantitative sense.

Thus, they conclude that the WASH-1400 methodology is the best to use for the present. The staff did have some disagreements with the way the IPPSS appl-ieo this methodology, however none of these was meaningful.

The final conclusion was that there was no significant difference I between the releases calculated in the IPPSS and those calculated by the NRC staff. The staff did some additional analysis to evaluate the effect of including various mitigating features at the plant, and i

concluded that, overall, these did not have a significant impact on risk reduction.

, The intervenors ' generally supported the staff positions 'en in-plant !

consequences, with one notable and potentially significant exception.

In the analysis of overpressure protection, the containment is calculated to be able to withstand 140 psia, which is substantially greater than the design pressure. This is unjustified since the containment is never tested above 60 psia. Further, the assumption that containment fans and sprays will be available to control pressure during i a core melt is improper since these systems have never been tested under these extremely adverse conditions. Changing these in the analysis would result in a greater number of sequences would end in containment failure and many failures would occur earlier in time. The overall impact on risk is unknown.

i M

l-

Section 4 Ex-Plant Consequences 4.1 Effluent Pathways 4.1.1 Meteorological Data The IPPSS used data from the one year period from August 1978 through July 1979. The primary data source was the tower on the Indian Point site. Additional data was gathered from 13 stations within 100 miles of the plant for the variable trajectory plume model.

Precipitation data was obtained for seven nearby locatien3. The IPPSS used a random sample of 288 start hours over the year.

The NRC Staff used 91 selected samples over the same sample year.

These were coupled to 16 direction sector-samples resulting in a total of 1,456 scenarios for the consequences of a release category, as opposed to the 288 for the IPPSS. The Staff feels that the sampling scheme used is not a significant source of error, although it is possible.

The Intervenors feel that the use of a single year of me,tecrological data could lead to large errors in the consequence analysis. They point out that sensitivity studies of the CRAC sampling scheme resulted in differences of up to an order of magnitude using

~

l different sets of data from the same year. They further note that the Sandia siting study used an improved sampling scheme which used an entire' year of data, but that the study concluded that the use of more than one year averaged together was recommended. The Intervenors also felt the data was inaccurate because no data was taken from directly

-4

. ~

N .

%, <, 3

- s T ,

", g

- s m ,

2;.

above the river, as opposed o* on the 3hore'.

s 1 ,

4.1.2 Atmosoneric'Discersion Model , ' ,

s

.s.. ,.4

,The

,-s \IPPSS . team believes that tney significantly improved the atmospheIdc[ 'dispersion model frcin CRAC. They claim that the use of tl' ' s extensFie meteorological <hata,and a team of atmospheric dispersion

'\ ,x is ,

experts who, evaluated and modified the model results gives a much better K

answer"th'anCRAC.2TheNRCStaffbelieves'thatanyatmospheric

, i

's .

dispers' ion model would be expected to have differences between the model m

and (th'e actual'tfansport, diffusion and deposition that would occur. It

, \ is tiieir opinion that these factors can result in substan' Mal s

~ ovIrastimatesorunderestimatesinallconsequenceareas. .

v N  :

N

.4l,O3 Liquid Pathways - -

t .

J.'1.3.1 Groundwater . Dispersion .

l ' C' ' -

? . xs

The IPPSS analyzed the effect of groundwater dispersion of

, s radiofsotopes ,following .in accident, and concluded them t'c;be j ,

b insignific' anti to risk. The NRC Staff had some disagreement with the IPPSS model, believing it to be non-conservative in.three' areas: (1);1t

' s ,

overestimated retardation in the ground of CS-137 and SR-9d, (2)'It 'did ,

nottreatcontaminationofHudsonRiversediments,and(3)therewadx insufficient groundwater' data to confirm dose estimates. 'Alth6 ugh the

, ;y Staff did not reanalyze this scenario in a quantitatGe sense, they' v

concludedthatdespitekthesemodelingproblems,groundwaterdispersion T would still be a relatbely small contributor to ovirall consequences.

5 4 4  %

\

~ s. ,

C. . , ,_,

_*D - .

_ _ , _ -. _ \ _ - 1 _ _

. ~

4.1.3.2 Airborne Releases to Water The NRC Staff felt that the effect of airborne radionuclides being deposited in the Hudson and in fresh water reservoirs was not analyzed in the IPPSS. The Staff perfonned calculations to quantify the risk associated with the contamination of the New York City upstate water supply system, and extrapolate those calculations to include other systems as well. The analysis concluded that although the expected consequences would be higher than those for groundwater dispersion they would still have only a minimal effect on total risk. The Staff concluded that the doses would be well below the early fatality and radiation illness thresholds and would be a small fraction of the doses and risks which would result frcm traditional airborne pathways.

4.1.4 Release Model The CRACIT code used for the IPPSS has an updated release model which allows for long duration releases toi be modeled as a series of

" puffs." The Licensee believes that this is a better model than the CRAC model used by the NRC Staff, which simplifies all releases to a single release at containment failure. They point out that since the 2RW release category is a long duration release and that it is very significant to risk, that this modeling difference is significant. The NRC Staff agrees that for long duration releases such as 2RW, CRACIT is

more realistic than CRAC. However, the Staff believes that differences 4

between the assumed release duration and other release parameters and that which would actually occur is one of the less significant sources N . . - - . _..

of error in the consequence mcdel.

4.2 Emergency Response 4.2.1 Impact of Regional Disasters The IPPSS analysis of emergency response following an accident used the same emergency response model for all accident scenarios. This does not consider the effects of regional disasters such as hurricanes, earthquakes, blackcuts, etc., an the ability to initiate evacuation.

The Licensee believes that this approach is reasonable, since the time from accident initiator to the release of radioactive effluents is a minimum of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and that it is reasonable to assume the regional disaster has passed by that time and that evacuation would be possible.

The Intervenors believe that this simplified model is not reasonable in light of the potential lasting effects of these regional disasters. They point out that all three of the events (hurricanes, earthquakes, and blackouts) can involve area-wide loss of electrical power, which would seriously impede the ability of the authorities to notify the affected populace. This would affect the delay time until evacuation which, according to the PRA Procedures Guide (NUREG/CR-2300) could have significant impact on consequence estimates. For hurricanes and earthquakes, the Intervenors point out that the severity level of the event is extremely important for subsequent evacuation. Very severe events could damage or scatter debris upon roadways and other evacuation paths, making evacuation infeasible. Damage to structures may reduce the availability of sheltering. None of the above effects are

specifically modeled in the IPPSS. The Intervenors state that both the PRA Procedures Guide and the Sandia siting study (NUREG/CR-2239) mention that a site specific analysis of emergency response should include these types of effects.

The NRC Staff in general comes to the same conclusion as the Intervenors with regard to the lack of treatment of these regional disasters in the IPPSS. The Staff designed a response scenario which they called " late relocation" to represent these events. This scenario assumes a long time before relocation (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) and minimum shielding availability. This scenario was included in the Staff's re-quantification of consequences and was found to contribute to a significant change in the 2RW consequence curve.

4.2.2 Warning and Evacuation Times The IPPSS considered a warning time of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> for the 2RW release category, based on the assumption of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> from initiator to release.

They feel this is a conservative bound since they believe the release would not actually occur for almost 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The evacuation delay times were treated probabilistically starting with the assumption that at least 30 percent of- the population was delayed more than one hour for all scenarios. Delay times of 5.5 to 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> were used for certain areas within three miles of the plant for the wat': day-school-in-session scenario.

The Intervenors believe that both the delay times and warning times used are overly optimistic. They point out that the evacuation times

used in the 1P055, although said by the Licensee to be from the Parsons Brinkerhoff report, do not appear to agree with the report. The report apparently shows evacuation times of 5-15 hours whereas the IPPSS apparently used 2-8 hours. In the area of warning time, the assumption of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> warning is felt to be overly optimistic when you consider that the core doesn't even become uncovered until 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> into the incident. In order to have 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> warning, the decision to evacuate would have to occur only one hour into the incident, which does not seem reasonable to the Intervenors.

The NRC Staff used much shorter warning times for their analysis.

For most release categories the warning time was one hour. For release category RC-C (equivalent to the IPPSS 2RW release category), 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> was used. In addition, a delay time of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> was added. The Staff states that these values are based on Parsons Brinkerhoff and CONSAD Research Corporation studies, and they feel that they are a reasonable basis for the evaluation of risk. These values were used in the Staff's re-quantification for RC-C (2RW) for those events not involving regional disasters. The Licensee pointed out that the use of the NRC values versus the IPPSS values found no difference in the .'alculated early fatalities. The Staff stated-that it believes that warning and evacuation time is one of the less significant sources of error in the consequence model.

4. 2. 3- Relocation Model Both the Licensee and the NRC Staff assumed that relocation would

1 take place following a serious accident at Indian Point, although different assumptions regarding the exact timing of the relocation were used (this is discussed in Section 4.2.1). Despite these differences, both the Licensee and the Staff believe that relocation is a viable means of reducing accident exposures, and the models used are apparently quite similar. The Intervenors, however, feel that insufficient consideration has been given to whether a large scale relocation is actually possible. They cite the large number of people located around Indian Point whose orderly relocation is assumed by both the Licensee and staff analysis, and feel that the relocation assumptions do not consider the effect on relocation.

4.2.4 Sheltering Model The IPPSS assumes that of those people instructed to seek shelter, 90 percent of them will effectively do so and will be in shelter equivalent to a standard house basement for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following an accident for all accident scenarios. The licensee points out that many things qualify as " equivalent basements," such as interior areas of large apartment buildings. The licensee believes this assumption to be reasonable in that there should be sufficient " basement equivalents."

The Intervenors believe that this is very optimistic. They feel, in general, that people will not follow the sheltering instructions in large numbers, especially when they or their children are not at home.

The IPPSS assumes that people will seek shelter wherever they are, but l

the Intervenors feel that people will try to reunite their families l _ _ _ _

rather than ininediately seeking shelter. Further, the Intervenors believe that there is no hard justification for assuming that large numbers of people will believe it necessary to seek shelter when instructed to. They point out that WASH-1400 did not take credit for large numbers of people being indoors during passage of the plume. The reasons for this were (a) since a reactor accident would be a "once-in-a-lifetime experience", it would be unreasonable to expect the public to be prepared to take " sophisticated" protective measures; (b) in many regions and for several months of the year, residents live and sleep with windows open and no reduction is possible without " positive action", and (c) it would be difficult to persuade the public to close their windows and even more difficult to persuade them to reopen them at the right time. The IPPSS took credit for this sheltering " ventilation model" without addressing these concerns from WASH-1400, and thus'the intervenors conclude that the use of this model is inappropriate. i The NRC Staff also feels that 90 percent sheltering is optimistic.

They feel it is more reasonable that the actual sheltering model should assume normal activities, where some people are indoors and some are outdoors, for most accident scenarios. Further, for accidents caused by external events such as earthquake or hurricane, the Staff felt that less sheltering should be assumed due to severe damage to buildings.

This, in combination with the late relocation discussed in Section 4.2.1 results in the assumption that the population has essentially no -

, sheltering (is standing outside) for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following these accidents.

l l These assumptions were included in the Staff's re-quantification of i

I

1

-g-ex-plant consequences.

4.3 Health Effects 4.3.1 Dose Conversion Factors 4.3.1.1 Early Fatalities Both the IPPSS and the NRC Staff re-evaluation use dose response curves for early fatality from WASH-1400. This gives an LD 50 fr early fatality of 340 RADS bone marrow dose for minimal medical treatment and a bone marrow dose of 510 RADS for supportive medical treatment. This is in general agreement with the Risk Assessment Review Group's estimate of 400 to 600 RADS for supportive medical treatment.

The Intervenors point out that other, more recent studies, have used dose response models which give lower dose response curves. A study performed for the California Energy Resources and Conservation Commission cited discrepancies between the data used in WASH-1400 and the references cited in WASH-1400, and instead came up with an LD 50 #

286 RADS for minimal treatment and 429 RADS for supportive treatment.

Also, the Accident Evaluation Code used for the CRBR risk assessment used an LD f 350 RADS whole body dose for minimal treatment (the 50 previous numbers are all bone marrow dose). Thus, the Intervenors feel that the dose response curves used by the IPPSS and Staff may understate the actual number of early fatalities which would result from an accident.

The Staff feels that this issue is one of the lesser contributors to error in the analysis.

4.3.1.2 Latent Cancers The model used in WASH-1400, and in the codes used for the IPPSS and NRC Staff analyses (CRACIT and CRAC, respectively), assume a latency period where cancer risk is zero, followed by a " plateau period" of 10-30 years where exposed individuals are assumed to be at constant risk. This implies that all cancers would occur within this 10-30 year time frame.

The Intervenors believe that this is a non-conservative assumption.

They point out that the BEIR III report recommended a lifetime risk model, where the plateau period is extended to the end of an exposed individual's life. This model is used in CRAC 2, the improved version of CRAC, and the Intervenors reference the PRA Procedures Guide (NUREG/CR-2300) to show that using this newer model results in approximately a 20 percent greater occurrence of latent cancers.

The NRC Staff feels that the latent cancer model is in general a l

lesser contributor to error and is much more likely to overestimate consequences than to underestinate them, and they further point out that the possibility that low level radiation could produce zero consequences has not been ruled out by proof of evidence.

4.3.2 Suoportive Treatment Although, in general, reference calculations are performed using both minimal treatment and supportive treatment dose response curves,

~

for the final assessment of risk both the IPPSS and the NRC Staff analyses assume that supportive treatment is available. The Licensee

feels that that this is reasonable because supportive treatment only need be started within 20 days and does not usually require special facilities, according to WASH-1400.

The Intervenors completely disagree with this. They point out that the Risk Assessment Review Group stated that the ability to supply supportive treatment is not documented. They state that many things have not been considered in the assumption of supportive treatment being available. No consideration is given to the fact that in an Indian Point accident over 10,000 people would be in need of supportive treatment. This exceeds estimates of the ability to provide this treatment contained both in WASH-1400 and the PRA Procedures Guide.

Further, the Intervenors point out that even in cases where the number of people requiring treatment is theoretically within the capabilities of the medical community, that .it may still be virtually impossible to get them treated. There are practical problems involved, first, in identifying the actual population at risk (i.e., exactly where did the plume pass), and second, which people in that risk population actually

. got substantial dose. It is likely that many people will come for treatment out of fear and would thus overload treatment facilities even though they may not need treatment. The Intervenors feel that diagnosis would be made impractical since symptoms may not be reliable in times of stress. People believing they have received lethal doses may begin to manifest the expected symptoms. Finally, it is overly optimistic to assume that the medical and emergency personnel will all continue working. For these reasons, the Intervenors feel that supportive v- w. - - --

Y treatment should not be assumed. They estimate that, based on the NRC Staff analysis and NUREG-0340, the difference in early fatality estimates would be between a factor of 2.4 and 4.

The NRC Staff states that the potential error induced by using supportive medical treatment is less than a factor of 5 (for the "after fix" case) and is one of the lesser contributors to error.

4.4 Economic Consequences The IPPSS calculated financial consequences based on the model used in WASH-1400. They state that this includes the cost of

_ evacuation, relocation, interdiction, decontamination, and crop impoundment, but not the costs associated with damage to the plant.

The NRC Staff also evaluated these consequences, and apparently included those measures of economic consequences which are modeled in-CRAC. These are: cost of evacuation, value of contaminated crops, value of contaminated milk, loss of real estate property value, loss of income from temporary unemployment, cost of decontamination of property, and cost of relocation. This appears to be very similar, but not identical, to the IPPSS model.

The Intervenors believe that other cost features should be included in the cost evaluation. They note that a proposal from Pacific l

Northwest Laboratories to revise the CRAC financial consequences model noted the following omissions or deficiencies in the model: loss of

~~

real property value other than real estate, cost of monitoring and f decontaminating the evacuated population, incomplete treatment of loss l

of income compensation, indirect costs such as compensation for health damages, replacement power costs, indirect effects associated with possible reductions in productive capability of industries outside the area of direct accident effects, and aggregation of state level economic data. This last point was particularly mentioned since the concept of decontamination costs was handled as an average cost per resident, which may underestimate the cost in New York City. A draft Sandia report (NUREG/CR-2723) evaluated the financial consequences for various severities at 91 reactor sites and found that the estimated consequences for Indian Point were the highest of any site. It must be added that, interestingly, the intervenors testified that they believe economic consequences was not modeled in the IPPSS at all. In summary, the Intervenors contend that the Staff's estimates are little better than the IPPSS total omission of financial consequences. In both cases, the financial consequences are seriously underestimated and could be a significant contributor to societal risk.

The NRC Staff believes that the possible error in tht; evaluation of economic consequences could be substantial, but that it is still one of the lesser contributors to overall error.

l 4.5 Conclusions on Ex-Plant Consequences For those issues which the NRC Staff had differences with the IPPSS analysis, these differences were included in the NRC evaluation. A comparison of the results yields the following conclusions. First, i

j there was no significant difference in the evaluation of latent health l

effects between the IPPSS and staff analyses. Second, the early health effects in the Staff evaluation were consistently higher than for the IPPSS and the difference was significant for certain categories, most notably the 2RW category where the difference was greater than an order of magnitude. Some of the difference could be traced to modeling differences such as CRAC using a single puff release and CRACIT using multiple puffs to model long term releases. However, it is apparent from the testimony presented that the real significant contributor to the difference in the result is the use by the Staff of the late relocation without sheltering emergency response model for scenarios involving regional disasters. Thus, based on the Staff's results, it can be stated that this issue is the only significant issue in the j ex-plant consequence analysis.

The Staff did not evaluate some of the Intervenors concerns, notably the problems with the supportive treatment model and the economic consequences model. The Intervenors also believe that neither the Staff nor the IPPSS used the best models for dose conversion factors and meteorological issues. These issues could contribute significantly I

to errors in the consequence estimates.

It would have been useful if the Staff had used the improved CRAC 2 code for its evaluation. The reasons given by the Staff for using CRAC (it's simple to use, data reouirements are not large, the analyst was familiar with it, CRAC 2 is not fully benchmarked) do not seem to justify ignoring a code which was specifically designed to correct some of the deficiencies in CRAC. It would be useful if testimony were i

l

15 -

included which (1) dealt thoroughly and systematically with the differences between CRAC and CRAC 2 and (2) provided the results of the consequence analysis using CRAC 2, since CRAC 2 has been used extensively to evaluate consequences for all U.S. nuclear power plants in the Sandia Siting Study.

i i

k i

4,w' I

-, ---, ., ,, .-e y--y>-c-.p*, y mm-yw,.,v- em - --w, . p.

g ww-v -ww-y----w,--,

Section 5 Statistical Uncertainties The licensee believes that the presentation of risk must contain a presentation of the uncertainties involved. Uncertainties in occurrence and failure rates used in the IPPSS calculations of accident sequence frequencies were quantified based on "all relevant evidence, experience, and information available." Also included were uncertainties in the in-plant and ex-plant consequence analyses. The " discrete probability distributions" method was used to combine and propagate the uncertainties. The analysis was not limited to straight statistical propagation of uncertainties, however. Although this will give a reasonable distribution around the point estimates, which the IPPSS refers to as level 1 risk estimates, the licensee feels that this does not take into account conservatisms in the analysis. Thus, they conclude that the level 1 estimates were not necessarily the "best estimate" results. In order to account for this, the IPPSS expanded the use of " expert judgment" to assist in determining the "true distribution". This application, similar to the use of expert judgment in the construction of Bayesian priors for the filure data used in the sequence-frequency calculations, resulted in a median risk curve which appears to be substantially lower than the level 1 estimates available for comparison. The median (50% confidence) value is what was then assumed to be the "best estimate" from which the IPPSS point estimates were developed. Curves for 10% and 90% confidence were also developed for each risk measure, and the whole family of curves was presented in the IPPSS and referred to as level 2 risk estimates.

l

The NRC staff also believes that uncertainties are important in understanding plant risk, although they did not attempt a rigorous treatment of them. The expected uncertainties are quite large, which makes for the inability to pinpoint absolute risk. Thus, too much emphasis should not be placed on the point estimate numbers. Even though the staff did not quantify the uncertainties, they do have some ,

judgments about them. In general, assumptions which go into the analysis tend to be conservative. For example, partial failure is considered to be total failure and core damage is assumed to be core melt. Accident processes terd to be modeled predominantly pessimistically, such as the source term analysis. All of these items will tend to exaggerate the risk, thus it is expected that.the uncertainty bands would be much wider on the low side than on the high side. However, the calculated point estimate should still serve as the "best estimate" rather than the median of the defined distribution as used in the IPPSS. Also, some uncertainties used in the IPPSS may actually be broader. In particular, things such as external events, human error, and accident processes cannot be accurately evaluated probabilistically based on the state of the art. Thus, the uncertainties associated with these parameters are expected to be quite large. Although the IPPSS treatment of uncertainties is comprehensive, it is plausible that the actual risk might be outside the range presented in the IPPSS. Using the staff "best estimate" as a starting point and applying engineering judgment, the staff nas estimated what they subjectively believe to be the expected range of uncertainty in i their risk estimates. They state that they "would be mildly surprised, l

but not very surprised" if their risk estimates were low by a factor of 40 or high by a factor of 400.

The intervenors believe that the uncertainties are much larger than either the licensee or NRC staff estimates. The use of subjective

" engineering judgment" as part of the uncertainty estimates is not accompanied by a detailed technical justification. The fact that no purely statistically basis appears to exist for the determination of the uncertainties used simply proves that there is a scarcity of data. This implies extremely large uncertainty bands actually exist. Further, -

there are uncertainties due to methodology decisions made in the IPPSS.

Three examples of these are:

certain key components were left with 95%/5%

confidence limits while all other components used 80%/20% limits; discrete approximations to continuous functions were used; and the lognormal distribution was assumed.

Thus, the intervenors conclude that it is highly likely that the uncertainties are seriously understated.

- - v

Section 6 Conclusions on Completeness of Testimony There are a number of areas where the record does not appear complete enough to allow a reasonable decision to be made. For these areas, additional testimony would be desirable. The additional testimony recommended can be divided into two groups. The first group deals with the generic question of using the most up-to-date analytical methods for the risk assessment. In some cases, this appears to have not been done. Some reasons given for this are that a new code hadn't been fully benchmarked, the old code was easier to use or familiar to the analyst, or the improved information was not yet available. There may be some merit to some of these arguments, but it is questionable whether a reasonable decision can be made regarding the continued operation of these plants without additional information on at least the potential significance of the improved models and information or even a re-analysis using the improvements. Without this, it becomes possible l

to make a decision now which could be proven obsolete in six months. In l order to avoid that possibility, it is recommended that the following testimony be added to the record.

- The NRC staff should provide a detailed technical summary of the difference between the CRAC code used for their assessment and the improved version CRAC 2. They should evaluate the potential effects on their final analysis of using CRAC 2 and should provide a reasonable justification of why they should not re-do their analysis using CRAC 2, since it is supposedly a more accurate code than CRAC, or else should provide the results of a re-analyzis using CRAC 2.

- Similar testimony to that described above should be provided regarding the staff's use of MARCH 1.1 as opposed to MARCH 2.0 and the use of the CORRAL 2

aerosol model as opposed to NAUA 4.

- It may be desirable to delay the final decision in order that testimony may be heard at a later date regarding the results of the-NRC and industry source term work which is presently ongoing. It is obvious from the testimony given that the results of this work is going to have a significant impact on the evaluation of source terms in the future, regardless of whether or not it shows a reduction as expected.

The second group of recommended additional testimony deals with issues which were not dealt with in either the IPPSS or NRC analysis where additional information could prove useful. The specific testimony recommended is discussed below:

- Staff witnesses should directly address the issue of the use of stress and aging factors versus constant failure rate. The licensee feels they are not needed and the intervenors believe they must be used. The staff did not comment on this issue.

- Expert testimony on the significance of sabotage should be heard. None of the hearing participants i directly addressed the sabotage issue through

( expert testimony, despite the fact that nuclear facility sabotage studies have been performed, by Sandia for example. While the studies them-selves are likely to be classified, the testimony of the people who performed the studies regarding their expert judgment on the risk significance of sabotage would be useful.

- The licensee should present the level 1 (point estimate) risk curves for external initiators and total risk rather than just the level 2 (confidence level) curves for these items. This would more readily allow a direct comparison between the IPPSS and the "best estimate" curves of the staff re-analysis to see how significant the differences are between the two analyses before confidence l

levels are applied. This testimony should include a comparison of the risk derived from these level I curves with the NRC's proposed safety goals.

- The NRC staff should provide testimony which directly compares their results with the NRC's proposed safety goals.

- In the responses to Board Question 1.4 about the effect of pressurized thermal shock (PTS) on core melt risk, no one directly addressed the risk issue. Rather the only quantitative testimony offered dealt with the frequency of the PTS event itself. Testimony is required on the conditional probability of core melt and release given PTS in order that the effect of PTS can be put in context as to what it would contribute to the given plant damage states analyzed.

l r

i l

l l

I _ - . _ _ __ _ _ _ _ ,

Section 7 Conclusions on Risk (Includes Contention 1.1)

This section summarizes the overall conclusions on the risk of continued operation of the Indian Point plants for each of the three parties to the hearings (licensee, NRC staff, and intervenors).

~

7.1 Licensee Risk Conclusions The licensee conclusion, based on the results from the IPPSS, is that the Indian Point plants meet the NRC's proposed safety goals (with the exception of core raelt frequency at IP-2) and thus the risk from the operation of the plants is not unduly high. The values upon which this is based are calculated from the median (50% confidence level) curves in the level 2 risk curves shown in the IPPSS. Since level 1 (point estimate) curves are not provided for external i

initiators and total risk, the median value is the only way to present a "best estimate" risk value for the Indian Point plants. Other confidence levels are presented to account-for uncertainties in the analysis, and as far as can be _

ascertained from the IPPSS results, the licensee also concludes that even the upper bound (90% confidence level) risk curve will meet the safety goals for individual and societal risk. The licensee further concludes that they believe the source term analysis used in the IPPSS was quite conservative, and that it is likely that the risk would be j even lower if a more realistic source term is used.

7.2 NRC Staff Risk Conclusions The NRC staff conclusion, based on their re-analysis of the IPPSS work, is that Indian Point plants do pose some risk, but that this risk is not "high" in relation to other risks.

The values upon which this is based are calculated from "best estimate" risk curves shown in NRC testimony. They take into account a number of issues which the staff believed to be improperly evaluated in the IPPSS. The staff re-analysis of the IPPSS replaced the licensee evaluation of thes,e issues with their own, and carried the analysis through to a re-calculation of the risks from Indian Point. It is not really possible to perform a direct comparison of the results since the staff results were in the form of level 1,(point

, estimate) curves for total risk as opposed to the level 2 (confidence level) curves presented in the IPPSS. The limited comparison performed seems to indicate that the staff point estimate curves for the after fix case, which would be the most representative for future plant operations, are generally at a risk level at or above the 90% confidence curves shown in the IPPSS. The significant difference appears to be in early health effects. Latent effects and other measures such as man-rem and cost appear to be of similar magnitude in both the IPPSS and staff analyses. The staff does not specifically address if their evaluation of Indian Point risk meets the proposed safety goals. The staff did not rigorously treat the uncertainties involved, but it is their belief based on their evaluation that, due to preceived conservatisms in the w -

i analysis, it is much more likely that their results overstate the risks rather than understate them.

7.3 Intervenor Risk Conclusions The intervenors' conclusion is that both the IPPSS analysis and the NRC staff re-analysis are not reasonable estimators of risk at Indian Point. This is based as much on their belief that no risk assessment could possibly be a reasonable risk estimator as it is on particular faults they find in these risk studies. They believe that things such as sabotage, the availability of supportive medical treatment, and the effectiveness of emergency preparedness measures are not treated properly. They place more emphasis, however, on what they believe are the inherent deficiencies of the probabilistic risk assessment approach. Particularly, they argue that much of the data used in the analysis is based on information which is insufficient or not directly applicable, that it is not possible to create a model which can identify all the subtle interfaces and common mode effects s

which exist in a system as complex as a nuclear power plant, and that the actual uncertainties associated with the results are much larger than either analysis states, so large in fact, that they render any decision based on a PRA totally meaningless. For these reasons, the intervenors conclude that any decision regarding continued operation of the Indian Point plants should not be based on the PRA's presented.

. . .