ML20087K369

Evaluation of Potential Severe Accidents During LOW Power and Shutdown Operations at Grand Gulf,Unit 1.Summary of Results

ML20087K369
Person / Time
Site:	Grand Gulf
Issue date:	07/31/1995
From:	Whitehead D SANDIA NATIONAL LABORATORIES
To:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
CON-FIN-L-1923 FACA, NUREG-CR-6143, NUREG-CR-6143-V01, NUREG-CR-6143-V1, SAND93-2440, NUDOCS 9508230248
Download: ML20087K369 (56)

Text

NUREG/CR-6143 SAND 93-2440 Vol.1 Evaluation 0:? Potential Severe Accidents During Low Power and Shutdown C>perations at Grand Gu:f, Enit 1 Summary of Results

.$\hiitchead Sandia National Laboratories Operated by Sandia Corporation Prepared for U.S. Nuclear llegulatory Commission PDR DO 0500 416 P PDR

L AVAllABluTY NOTICE t

Ava!' ability of Reference Materials Cited in NRC Pubicatons Most documents cited in NRC publications win be available from one of the following sources: I

1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, Washington, DC 20555-0001 r

2. The Superintendent of Documents. U.S. Government Printing Office, P. O. Box 37082, Washington, DC 20402-9328 .

[

3. The National Technicalinformation Service, Springfleid, VA 22161-0002 l I

Although the Esting that foBows represents the majority of documents cited in NRG publications, it is not in- f tended to be exhaustive. I i

Referenced documents available for inspection and copying for a fee from the NRC Public Document Room  !

include NRC correspondence and internal NRC memoranda; NRC bulletins, cir cuiu, informst!on notices, in-spection and investigation no',1ces; Scensee event reports; vendor reports and correspondence; Commission papers; and appucant and &censee documents and correspondence, k

The following documents in the NUREG series are available for purchase from the Govemment Printing Office: l formal NRC staff and contractor reports, NRC-sponsored conference proceedings, international agreement l reports, grantee reports, and NRC booklets and brochures. Also available are regulatory guides. NRC regula- l tions in tne Code of Federal Regulations, and Nuclear Regulatory Commission Issuances. }

Documents available from the National Technicallnformation Service include NUREG-series reports and tech-nical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regu!atory Commission.

Documents available from pubuc and special technical Ebrarios include all open Uterature items, such as books, I journal articles, and transactions. Federal Register notices, Federal and State legislation, and congressional reports can usually be obtained from these bbraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference pro- I ceedings are ava!!able for purchase from the organization sponsoring the pubucation cited.

Single copies of NRC draft reports are available free, to the extent of suppty, upon written request to the Office of Administration, Distribution at:.1 MMI Services Section, U.S. Nuclear Regulatory Comn.ission, Washington, DC 20555-0001.

Copies of Industry codes and standards used in a substantive manner in the NRC regulatory process are main-tained at the NRC Library. Two White Finnt North,11545 Rockville Pike, Rockv51e, MD 20852-2738, for use by the pubBc. Codes and standards are usually copyrighted and may be purchased from the originating orgardza-tion or, if they are American National Standards, fro n the American National Standards Institute,1430 Broad-way, New York, NY 10018-3308.

DISCLAIMER NOTICE Where the papers in these proceedings have boon authored by contractors of the United States Government, neither the United States Govemment nor any agency therect. nor any of their employees, makes any warranty, expressed or implied, or assumes any legal liatility or respormibility for any third party's use, or the results of such use, of any infomation, apparatus, product, or process disclosed in those proceedings, or represents that its use by such third party would not infringe privately owned rights. The views expressed in these pro-  !

coedings are not riocessarily those of the U.S. Nuclear Regulatory Commission.

i

NUREG/CR-6143 SAND 93-2440 Vol.1 Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Grand Gulf, Unit 1 Summary of Results Manuscript Completed: April 1995 Ds:c Published: July 1995 Edited by D. W. Whitehead Contributing Authors D. W. Whitehead, J. L Darby,1 J. L Yakle,2 .J A. Forester,2 B. D. Staple, S. P. Miller, 2 S. L Daniel, T. D. Brown, B. Walsh,111. K. Kirk, D. B. Mitchell, V. J. Dandini, G. L Benavides, J. A. Lambright, S. Ross,1 J. Lynch,1 R. J. Budnitz,3P. R. Davis,4 M. K. Ravindra, 5 W.11. Tong, 5 L N. Kmetyk, L A. Miller, and J. D. Johnson6 Sandia National Laboratories d PRD Consulting Albuquerque, NM 87185 P.O. Box 2046 Sheridan, WY 82801 IScience & Engineering Associates,Inc.

6100 Uptown Blvd. N.E. SEQE International, Inc.

Albuquerque, NM 87110 18101 Von Karman Ave., Suite 400 Inine, CA 92715 2

Science Applications International Corporation 2109 Air Park Road S.E. 6 GRAM, Inc.

Albuquerque, NM 87106 Albuquerque, NM 87112 3 Future Resources Associates. Inc.

2039 Shattuck Ave., Suite 402 Berkeley, CA 94704 Prepared for Division of Systems Technology Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 NRC Job Code L1923

1 Abstract During 1989 the Nuclear Regulatory Commission (NRC) initiated an extensive program to examme the potential risks during low power and shutdown operations. Two plan *.s, Suny (pressunzed water reactsr) a.,d Grand Gulf (boiling weter reactor), were selected as the plants to be studied by Brookhaven National Laboratoiy (Suny) and fiandia National Laboratories (Grand Gulil The program objectives included assessing the risks of severe accidents initiated during plant operational states other than full power operation and comparing the estimated core damage frequencies, risks, important accident sequences, and other qualitative and quantitative results with those accidents initiated during full power operation as assessed in NUREG-1150. The scope of the program included a Level 3 probabilistic risk assessment (PRA) for traditional intemal events and a Level 1 PRA on fire, flooding, and seismically induced cort. damage sequences. This report documents the work perfonned during the analysis of the Grand Gulf plant.

A phased approach was used for the overall study. In Phase 1, the objectives were to identify potential vulnerable plant configurations, to characterize (on a high, medium, or low basis) the potential core damage accident scenario frequencies and  ;

risks, and to provide a foundation for a detailed Phase 2 analysis. It was in Phase 1 that the concept of plant operational states j (POSs) was developed to allow the analysts to better represent the plant as it transitions from power operation to nonpower operation than was possible with the traditional technical specification divisions ofmcxles ofoperation. This phase consisted of a  !

coarse screening analysis perfonned for all POSs, including seismic and intemal fire and flood for some POSs. 1 In Phase 2 POS 5 (approximately cold shutdown as defined by Grand Gulf Technical Specifications) during a refueling outage was selected as the plant configuration to be analyzed based on the results of the Phase I study. The scope of the Level I study includes plant damage state analysis and uncertainty analysis and is documented in a multi-volume NUREG/CR report (i.e.,

NUREG/CR-6143). The intemal events analysis is documented in Volume 2. Internal fire and internal flood analyses are I documented in Volumes 3 and 4, respectively. A separate study on seismic analysis, documented in Volume 5, was performed for I the NRC by Future Resources Associates, Inc. The level 2/3 study of the traditional intemal events is documented in Volume 6, and a summary of the results for all analyses is documented in Volume 1.

In the Phase 2 study, system models were developed for POS 5 on the way down to refueling and POS 5 on the way back up from refueling, and supporting thennal hydraulic analyses were performed. Initiating events that may mcur during POS 5 were identified and accident sequence event trees were developed and quantified using the IRRAS PRA code. Sur iving sequences were examined for recovery potential, appropriate human s ecovely actions were incorporated into the sequence cut sets, and the sequences were then requantified. Those sequences surviving this preliminary recovery analysis were then reexammed during a

" time window" analysis, which allows for a more realistic incorporation of the effects of the decrease in decay heat and a more I time-specific incorporation of equipment unavailabilities as the plant transitions from the beginning to the end of POS 5.

Core damage frequency estimates on a per calendar year basis for the Grand Gulf plant are as follows:

Mean 5th ocreentilt 95th percentils Intemal events (excluding fire and flood) 2.0E-06 4.lE-07 5.4E-06 Intemal fire events <1E-8 - -

Intemal flood events 2.3 E-8 8.2E-11 8.6E-6 ,

Seismic events l for the LLNL (1993) hazard curves 7.1E-8 2.1E-11 2.2E-7 l for the EPRIhazard curves 2.5E-9 2.5E-12 1.lE-8 l l

This is comparable with the total intemal event (excluding fire and flood) mean core damage frequency of 4.0E-06 per year estimated in the NUREG-1150 study of full per operations.

The risk associated with Grand Gulf as it operates in POS 5 during a refueling outage was shown to be comparable with the risk associated with full power operation. In NUREG-1150 the risk from full power operation of Grand Gulf was shown to be quite low. While the risk associated with POS 5 is low, there are very few features of the plant that are available to attenuate a release should one occur. The most likely accidents in POS 5 have an open containment, the suppression pool is bypassed, the containment sprays are not available, and the vessel fails, releasing the core debris into the containment. The low values for risk given the high conditional releases are, in part, due to the extremely low core damage frequency and the sparse population around the plant.

Vol.1 iii NUREG/CR-6143

Contents Abstract . . . . . . . . .. . . .. .. . . . . ... . . .. .. . . . . . . . . . iii Foreword . . . . .. . . . .. ... . . . . ... . . . . .... . . . . . . . . vii Acknowledgements .. .. . . .. .. .. ... .. . . .. .. . .. . .. ...... . .. ......... ix Acronyms . . .... ....... . .. . . . ... .. .. . .. . . . . . ... . ... . . .x

1. Background . . . .. . .... .. . . . . . ... . . .. . . ....... 1 3 Objectives . . . . . . . . . . . . . . .. .... . .. . . . .. . ....... . .. .... ..... 3 ,

3. Approach and Limitations . . . . . .... .. ....... . .. ... . ..... ... . .. .. 3 3.1 Level 1 . . .. . . . ....... . .... . . . .. . .. . .. .. ... 3 3.1.1 TraditionalInternal Events . . . . . . . . . .. . . .... . ..... . .. ... .3 3.1.2 Internal Fire Events . . . . . . .... .. . . . ... .. .. ... .4 3.1.3 Internal Flooding Events . . .. .... .. . .. . . .. . ... . . ..... 5 3.1.4 Seismic Events . .. .. . .. ..... . . .... . ... . . 5 3.2 level 2/3 .. .. . . . .. . . . . . . ... .. .. .. .. . .. 5

4. Results . .. . . .. . . .... .. . . ...6 4.1 Ixvel I Results. . ... . . . . . .. ... ... . .. 6 4.1.1 Qrantitative Results from Traditional Intemal Events Analyses . . . . . 6 4.1.1.1 Results from Sequence Quantification for Traditional Intemal Events Analyses . . . . 6 4.1.1.2 Total Plant Model Results for Traditional Internal Events Analyses . .... . .. 8 4.1.2 Quantitative Results from Intemal Fire Events Analyses . . .... . .. 10 4.1.4 Quantitative Results from Seismic Events Analyses . . . .. . . . . . 10 4.1.5 Qualitative Results . . . . . ... . .. .. 10 4.1.5.1 Plant Systems and Operations Insights from Traditional Intemal Events Analyses . .. 10 4.1.5.1.1 Systemsinsights. . .. . .. .. .. ... . . 10 ,

4.1.5.1.2 Operations Insights .. . . .. .. . 11 <

4.1.5.2 Insights from Intemal Fire Events Analyses . .. .. .. . . .. . ... I1 4.1.5.3 Insights f ; ' Internal Flooding Events Analyses .. .. . .. .. .. I1 4.1.5.4 Insights frw. Seismic Events Analyses . . ..... . .. ...... . 12 -

4.2 Level 2/3 Results . . .. . . . . . .. . ... 12 4.2.1 Core Damage Frequency .. . . . . 12 4.2.2 Accident Progression . . ... . ... .. . . . . . . . ... 12 4.2.3 Aggregate Risk . .. .... . .... ... .. 12 4.2.4 Qualitative Issues and Cautions . . . . .... ... .. 15

5. Comparison with Full Power .. . . .. .. . .. .. 16 5.1 Per Year Basis . . .. . . .. . . 16 5.2 Per flour Basis . . . . .. . .. 20

6. General Conclusions and Insights . .. . ..... . . . . .. .. ... 23 6.1 Level 1 Conclusions . . . . 23 6.2 Level 2/3 Conclusions . . . . . .. . .. . . .. 24 6.3 Insights from POS 5 . .. . . . . . . . . 24 6.3.1 Insights from LOCAs . .. . . .. . . . .... . .. 24 6.3.1.1 CDFInsights . . .. .. . . . 24 6.3.1.2 RiskInsights . . . 24 6.3.2 Insights from Station Blackouts .. . . . . . .. 25 6.3.2.1 CDFInsights .. . .. .... . 25 ,

6.3.2.2 Risk Insights . .. . .. .. . . ... 25 6.3.3 Insights from Other. ... .. . . . 26 6.3.3.1 CDF Insights . . . .. .. .. 26 6.3.3.2 Risk Insights . . . . .. . . 26 6.3.4 GeneralInsights . . . . . . . 27 6.3.4.1 CDF Insights . . . .. 27 6.3.4.2 Risk Insights . ... .... .... 27

7. References . . . . ... . . . .. . . . . . . 28 Vol. I v NUREG/CR-6143

FigurcS I POS vs Percent CDF .. ,. . . . . . .......... .2 3 Open Containment and Early Core Damage Sequences in POS 5 with a Potentially High Frequency . . . . . . . .2 3 Contribution to CDF by Initiating Event . .. .. . .. .. . . . ..... . 7 4 Percent ofCDF vs Time Window .. ... . . . . . .. ... .,.. 8 5 Fractional Contribution to CDF by IE Group vs Time Window . ... . . .. .. . .. .. .... . 9 6 Percent of CDF and Percent of Time in Time Window vs Time Window . .. ... . .... ... ... 9 7 Simplified Representation ofPOS 5 Accident Progressions . .. .. . . . ..... ... .... . ... 13 8 Percentage comparison of major accident sequence classes from full power and LPAS results . . . . . . . .. 17 9 Core damage frequency per year for time windows 1,2, and 3; total POS 5; and full power . . . ..... . 18 10 Early fatality risk per year for time windows 1,2, and 3; total POS 5; and full power . . .... .. . 18 11 Total latent cancer fatality risk per year for time windows 1,2, and 3; POS S in total; and full power . .. . .. 19 12 Core damage frequency per hour for time windows 1,2, and 3; total POS 5; and full power . .. . . ... 21 13 Early fatality risk per hour for time windows 1,2, and 3; total POS 5; and full power . ... . .. ... . 22 14 Total latent cancer fatality risk per hour for time windows 1,2, and 3; total POS 5; and full power . . ... 22 Tables 1 POS Descriptions . .. . . .... . . I 2 Core Damage Frequency for POS S and Fractional Contnbutions to the Core Damage Frequency for the LOCA, SBO. and Other Transients Plant Damage State Groups . . . 13 3 Distributions for Aggregated Risk for POS 5 . . .. 14 4 Fractional Contributions to A fgregate Risk for the LOCA, SBO, and Other Transients Plant Damage State Groups . 15 5 Distributions for Core damage frequency and aggregate risk for POS 5 and for full power . . . . 19 NUREG/CR-6143 vi Vol. I

Foreword (NUREG/CR-6143 and 6144)

Low Power and Shutdown Probabilistic Risk Assessment Program Traditionally, probabilistic risk assessments (PRA) of severe accidents in nuclear power plants have considered initiating events -

potentially occurring only during full power operation. Some previous screening analyses that were performed for other modes of operation suggested that risks during those modes were small relative to full power operation. However, more recent studies and operational experience have implied that accidents during low power and shutdown could be significant contributors to risk.

During 1989, the Nuclear Regulatory Commission (NRC) initiated an extensive program to carefully examine the potential risks during low power and shutdown operations. The program includes two parallel projects performed by Brookhaven National Laboratory (ENL) and Sandia National Laboratories (SNL), with the seismic analysis performed by Future Resources Associates.

Two plants, Suny (pressurized water reactor) and Grand Gulf (boiling water reactor), were selected as the plants to be studied.

The objectives of the program are to assess the risks of severe accidents due to intemal events, internal fires, intemal floods, and seismic events initiated during plant operational states other than full power operation and to compare the estimated core damage frequencies, important accident sequences and other qualitative and quantitative results with those accidents initiated during full power operation as assessed in NUREG-1150. The scope of the program includes that of a level-3 PRA.

The results of the program are documented in two repo ts, NUREG/CR-6143 and 6144. The reports are organized as follows:

For Grand Gulf:

NUREG/CR-6143 - Evaluation of Potential Severe Accidents During Low Power and Shutdown Operations at Grand Gulf, Unit i Volume 1: Summary of Results Volume 2: Analysis of Core Damage Frequency from Intemal Events for Plant Operational State 5 During a Refueling Outage Part 1: Main Repo t Part I A: Sections 1 - 9 Part IB: Section 10 Part IC: Sections 11 - 14 Part 2: Intemal Events Appendices A to H Part 3: Intemal Events Appendices I and J Part 4: Intemal Events Appendices K to M Volume 3: Analysis of Core Damage Frequency from Intemal Fire Events for Plant Operational State 5 During a Refueling Outage '

Volume 4: Analysis of Core Damage Frequency from Internal Flooding Events for Plant Operational State 5 During a Refueling Outage Volume 5: Analysis of Core Damage Frequency from Seismic Events for Plant Operational State 5 During a Refueling Outage Volume 6: Evaluation of Severe Accident Risks for Plant Operational State 5 During a Refueling Outage i

Part 1: Main Report Part 2: Supporting MELCOR Calculations Vol. I vii NUREG/CR-6143

1 For Sorry: -

NUREGER-6144 - - Evaluation of Potential Severe Accidents Dunng Low Power and Shutdown Operations at Suny'-

Unit-1 Volume 1: SummaryofResults Volume 2:- Analysis of Core Damage Frequency from Internal Events Dunng Mid-loop Operations s-Part 1: Main Report

.Part IA: Chapters 1 - 6 Part IB: Chapters 7 - 12 Part 2i InternalEvents Appendices A to D Part 3: IntemalEvents Appendix E

' Part 3A: Sections E.1 - E.8 Part 3B: Sections E.9 - E.16

' Part 4: IntemalEvents Appendices F to H Part 5: Intemal Events Appendix 1 '

Volume 3: Analysis of Core Damage Frequency from Intemal Fires During Mid-loop -

l?_ Operations

~

Part 1: Main Report Part 2: Appendices Volume 4: Analysis of Core Damage Frequency from Intemal Floods During Mid-loop .

Operations Volume 5: Analysis of Core Damage Frequency from Seismic Events During Mid-loop Operations Volume 6: Evaluation of Severe Accident Risks During Mid-loop Operations Part 1: Main Report Part 2: Appendices y:

L L_

i.

m_

NUREGER-6143 viii Vol. I

A i

Acknowledgements .

The authors wish to thank the following pcTsons for their contributions to this study: the various staff members at Entergy's Grand Gulf power station for their help in obtaining technica; information and for their assistance during the respective walkdowns (fire, ,

flood, and seismic,) all of which made this analysis possible; Richard C. Robinson, Jr. of the NRC for his help in obtauung timely support from the IRRAS computer code developers; Kenneth Russell ofIdaho Nuclear Engmeenng Laboratory for his help in i using IRRAS and for providing excellent code support during its use; Mike DiMascio of Solutions Engmecring, Inc., who performed the analysis of fire-fighting effectiveness; and members of the Senior Consulting Gr.>up and the BWROG PRA Review  ;

Committee for their review and suggested improvements to the project. Finally, we want to thank Ellen Walroth, Emily Preston, and Dena Wood for their secretarial support during the project. ]

1 1

1 l

1 4

)

i i

e l

l i

i Vol.1 ix NUREG/CR-6143 S

m . _ _

k

+

}

b Acronyms i

ADHR Alternate decay heat removal

• ADHRS Alternate decay heat removel system . i APET Accident progression event tree : l ATWS' Anticipated transient without scram BWR Boiling water reactor- .

i

- BWROO Boiling water reactor owners' group s CCI Core-concrete interaction CD' Core damage CDF' Core damage frequency  :

COMPDRN. Computer code for compartment fire propagation analysis DO- Diesel generator  ;

ECCS Emergency core cooling system

' EPRI Electric Power Research Institute

• IIPCS . High pressure core spray

' IPE - Individualplant examination IRRAS : Integrated reliability and risk analysis system (computer code)

LHS Latin hypercube sample .

. LLNL- - Lawrence Livermore National Laboratory LOCA - Loss-of coolant accident LOSP Loss of offsite power

- LPAS Iow power and shutdown ,

. MACCS MELCOR accident consequence code system (computer code) '  ;

MSIV _ Main steam isolation valve .

NRC Nuclear Regulatory Commission j

~

PDS Plant damage state POS. Plant operational state ,

PRA Probabilistic risk assessment

- RES Research(Office ofNRC) _;

RIIR Residual heat removal .

SBO Station blackout  !

SDC Shutdown cooling ,

SPMU Suppression pool make-up SRV Safety reliefvalve -

SSW Standby service water TW Time window  !

?

l NUREO/CR-6143 x Vol.1

. n. _ _. .

1. Background

Table 1 POS Descriptions Traditionally, probabilistic risk assessments (PRAs) of severe accidents in nuclear power plants have considered POS Description initiating events that could occur only during full power ,

operation. Some previous screenmg analyses that have been Vessel pressure from rated conditions to 500 performed for other than full-per modes of operation I psig and thermal power not greater than 15%;

suggested that risks during those modes of operation were core coolant at any temperature small relative to those occurring during full power operation.

Ilowever, recent studies and operational experiences indicate Ve8s I Pressure from rated conditions to 500 2

that the risks of accidents during low power and shutdown P828 (U%S) may be significant. Although the power of the Vessel pressure from 500 psig to above 100 reactor core is much less m off power conditions than at full 3 P8ig power, the technical specifications allow for more equipment to be inoperable in off power conditions. In cedain Vessel pressure less than 100 psig and the conditions the containment can be open. shutdown cooling system operating In response to the concems over risk during low power and Until vessel head is detensioned (all of cold shutdown conditions, the U.S. Nuclear Regulatory 5 shutdown and the initial part of Operating Conunission's Office of Nuclear Regulatory Research (NRC Condition 5-Refueling)

RES) has undertaken a two phase project to analyze the frequencies, consequences, and risk of accidents occurring Ilead off and coolant level raised to the steam 6

during modes of operation other than full power. lines Head oft, upper pool filled, and refueling Phase 1 of the project was completed in September of 1991 7 gg

[ Whitehead et al.,1991). This phase involved a coarse screening of potential accidents that could occur at a boiling water reactor (BWR) while the reactor was operating at other than full power. The coarse screening approach was adopted An examination of the results of the screemng study yielded as a means of obtaining, in a relatively short time, some Figures 1 and 2 [ Whitehead et al.,1994a]. As can be seen estimate of the potential for accidents during low power and from Figure 1, approximately 60 percent of the total core shutdown conditions and some ide a of the magnitude of the damage frequency occurs in POS S (consisting mainly of the i work necessary for a more detailsd analysis of these cold shutdown operating condition). Therefore, from a  !

operating states. The BWR examined was the Grand Gulf frequency point of view, POS S was the most logical choice Nuclear Power Station, a single-unit 1250 MWe (net) BWk for detailed analysis.

6 power plant with a Mark III containment, located near Port Gibson, Mississippi. Hawever, core damage frequency is not always the most impanant discrrminator for risk. In an attempt to identify the Results from the coarse screening analysis of seven plant more important sequences from a risk perspective, Figure 2 operational states (POSs) indicated that to accurately was constructed. This figure provided a Venn diagram of the evaluate accidents in low power or shutdown conditions, sequences classified as having a potentially high frequency dete.iled modeling would be required because the risk during with regard to an open containment and early core damage --

these conditions could not be shown to be insignificant by a important characteristics from the limited plant damage state screening analysis. (NOTE: Plant operational states are analysis performed during the screening study. From Figure artificial subdivisions of the time plants spend in LP&S 2 it can be seen that out of a total of 303 potentially high core conditions. This concept was developed during Phase 1 of damage sequences,186 had an open containment and core the LP&S Project to allow the analysts to better represent the damage was predicted to occur early in the accident. Of the plant as it transitions from power operation to nonpower 186 sequences that can potentially have high risk,178 are operation, See Table 1 for a brief description of each POS.) from POS 5. This information lent additional support to the Thus. NRC RES decided to have detailed follow-on analyses choice of POS 5 for detailed analysis.

performed.

in addition to the numerical results, engineering insights Since a very large effort would be required to accurately supp rted the selection of POS 5 for detailed study for the address each of the conditions identified in the Phase I study in detr.il, the NRC decided to perform a detailed analysis on

' " * "E' ** "  !

one of the off-power conditions.

Vol.1 I NUREG/CR-6143

F i~

1 l

e In POSs 6 and 7, the vessel head is off, thus <

alkviating concerns about the overpressunzation of e components of decay heat removal systems. Also, in POSs 6 and 7, the water level is rained, thereby '

so- providing more time for mitigation of accident.

p uutisting events than in POSs 4 or 5.

fn j e POS 4 and POS 5 both are shutdown states. He Pl ant is in the hot shutdown mode during POS 4,

's and it is in the cold shutdown mode during POS 5 8

(except for that part of POS 5 associated with

• removing the vessel head, for which the plant is in the refueling mode.) The vessel head is on in POS

r. . . M ,- 4, and it is assumed to be on in POS 5. The core is 5 8 8 * *

• 7 cooled with the shutdown cooling (SDC) system in Plant Operational State (POS) both POS 4 and POS 5 and with the altemate decay  ;

heat removal system in portions of POS 5. nese systems are not designed for high-pressure service.

Figure 1 POS vs Percent CDF If an unc ntrolled pres'ai,zation transient occurs, failure of the compone:As oflow pressure shutdown cooling systems is possible in these POSs, if the systems are not isolated. Such a scenario would lead to an interfacing systems loss of coolant accident (LOCA) outside containment which cannot m @ Gy,y",',g , be mitigated with emergency core cooling systems retai. 11s3 (ECCS), m the long term, since the suppression poolinventory will be lost through the break. In "o[8)

(

POS 4, shutdown cooling is carTied out by the residual heat removal (RHR) system, which has a p pressure rating of 220 psig. In POS 5, shutdown cooling can be provided with either RHR, or with '

the alternate decay heat removal (ADIIR) system PotentyI (ADIIRS) (aAer 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />), which has a pressure

• ' rating of 80 psig. The maximum expected decay i C) N G30) 178 in POS 5 heat in POSs 4 and 5 is almost identical: 1.0% of full power for POS 4 and 0.9% for POS 5.

j 1

When the POS was selected for detailed analysis in August 1991, it was understood that in POS 5 at Orand Gulf, auto-Figure 2 Open Containment and Early Core Damage isolation of SDC on high oressure (135 psig)is inactive, while m POS 4 it is active. This understanding was based on Sequences in POS 5 with a Potentially H,gh Frequency mformation that was received during a plant visit in January 1991.

e in POSs I,2, and 3, the state of the plant is Isolation of the components for low pressure shutdown essentially the same as for full power except that the cooling during pressurization transients is less likely if the power is lower and pressure / temperature can be auto-isolation function on high pressure is inactive since lower. Therefore, the imtiating events and operator recognition and intervention would be required to configuration of mitigating systems are essentially isolate the low pressure components. (Isolation on low level the same as for full power. Since the plant is in is active in POS 5, as well as in POS 4, thus providing the these POSs less onen than it is at full power, the ability to isolate an interfacing systems LOCA in the:

risk in these POSs is less than at full power, by a shutdown cooling system (s) aner the break occurs.) Because factor approximately equal to the fract.an of time in of the inoperability of auto-isolation on high pressure in POS '

these POSs divided by the fraction of t'.me at full 5, and because of the possible use of ADHR during POS 5, power. Based on this rationale, neither POSs I,2, POS 5 was chosen for detailed analysis.

nor 3 would be selected for detailed analysis.

NUREG/CR-6143 2 Vol. I

I This volume of the report summarizes information contained 3. Approach and Limitations in the docurcentation of the detailed analyses (see Volumes 2 through 6 of NUREG/CR 6143) performed for the Grand Gulf facility in POS 5 during a refueling outage. 3.I leVeI I BrooUnaven National Laboratory conducted a companion The approach used was a modification of a standard Level 1 ,

project for the Surry Pressurized Water Reactor during PRA approach. Event trees were constructed, top events were modeled using fault trees of various complexities, and midloop, documented in NUREG/CR-6144.

the top events were quantified using point estimates to produce the sequence frequencies, nese sequences were 2 Obj,ect,ves i then examined for recovery potential and validity. For those sequences where recovery was applicable, appropriate recovery actions were incorporated. The sequences that The primary objective of this study was to perform a detailed survived the recovery analysis were then accxamined with a analysis of potential accidents that could occur at Grand Gulf

'ttme wmdow" analysis approach. In this analysis, the while the plant is in POS 5 during a refueling outage. The ,

swing seq'aence cut sets were requantified based on their initiating events to be examined included: (1) intemal c ntribution to three distinct time regimes for POS 5 (i.e.,

initiators - including fire and flood, and (2) seismic initiatoni.

entry into POS 5 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />,24 hours to entry into POS 6, and POS S after core alterations).

Specific Level 1 objectives included:

The fault trees from the NUREG-1150 full power PRA for (1) Compare the results of this study with the results of Grand Gulf [Drouin et al.,1989] were utilized wherever tir.: full power analysis for Grand Gulf [USNRC, possible. The IRRAS computer code [ Russell et at,1992]

was used in the construction of the event trees, modification 1989] [Drouin et al.,1989].

of existing faularees and construction of new trees, and the quantification of the accident sequences. In addition, (2) Develop a metimdology for performing PRAs for inf nnation contained in 6e MEGM analysis of 6e miclear power plants in conditions other than at full Grand Gulf plant was used wherever applicabic power.

The IRRAS code was used to quantify frequencies for (3) Provide an analytical tool with which the NRC can accident sequences leading to core damage. Sequences evaluate the potential benefits ofproposed changes having point estimate frequencies below the Phase 2 in regulations affecting the required operability of truncation limit were considered to be noncontributors to the j equipment when a plant is in a condition other than verall e re damage frequency and were discarded. An i full power.

uncertainty analysis was performed for all sequences surviving the time window screenmg analysis.

Specific Level 2/3 objectives included:

3.1.1 Traditional Internal Events (1) Perfonn a characterization of the accident progressions following core damage resulting from In comparison with the full power PRA, the event trees for l traditional intemal events (excludes fire, flood, and POS S are more complex andlengthy:

seismically induced sequences), and estimate the consequences that result from these accidents. (1) Event trees for 34 initiating events were developed, (2) Quantitatively determine the risk and estimate the (2) More than 165 transfer event trees were developed, uncertainty for the risk-significant mode of operation in POS 5. (3) More than 110 operator action / decision points were included in the event trees, (3) Compare the risk associated with POS 5 during a refueling outage with the risk associated with full (4) Each transfer tree generally contained frora 16 -

power operation, 100 outcomes (i.e., transfer, core damage, or no core damage).

(4) Assess the potential for a radioactive release to cause onsite consequences. This event tree complexity is due to the relatively low decay heat in cold shutdown, resulting in a large number of ways by which cooling can be provided to the core if the coolant is Vol. I 3 NUREG/CR 6143

initially in a subcooled state. Also. the availability and maximize the possibility that all important locations are 2 configuration of plant systems in POS 5, compared with full analyzed, and this leads to the consideration of a potentially power, are more complex to specify owing to the less large number ofcandidate locations. The second objective is stringent requirements on operability impcned by the to minimize the effort spent quantifying event trees and fault technical specifications. trees for fire locations that turn out to be unimportant. A proper balance of these objectives is ont that results in an The methodology used in this study is the small event ideal alkeation of analytical resmarces and eflicient tree /large fault tree technique. In practical applications, this assessment.

technique assumes a fixed initial plant state prior to an accident-initiating event. Through the use of seven analysis The screening analysis consisted of the following steps:

' rules" (or acsumptions) we were able to consider numerous different conditions that can, and in fact do, exist at shutdown 1. Potentially important fire amas were identified.

before an accident-initiating event occurs. Areas which had either safety-related equipment or power and control cables for that equipment were Test and maintenance-induced loss of coolant accidents were identified as requiring further analysis.

not addressed in this study. Development of a detailed methodology for analyzing human actions during shutdown 2. Fire areas were screened for probable tire-induced conditions is under way, and analysis of such events is mittating events.

deferred until this improved methodology is available.

3. Fire areas were screened both on order and 3.1.2 Internal Fire Events fmquency f cut sets.

This assessment has made full use ofinsights gained during 4. Each remaining fire area was numerically evaluated and truncated on fregoency the past 15 years in assessing fire risk. The methodology utilized previously completed traditional intemal event fault and event tree models. Thus, the level of detail of the fire Step 3: FinalQuantification analysis is consistent with the level of detail of the traditional .

internal events analysis. A three-step oveniew of the AN#' b screening analysts had eh. .mmated all but the methodology used during this project is given below, probabih.stically significant fire areas, dominant cut sets were quantified as follows:

Step 1: Initial Plant Visit .

1. The temperature response m each fire area for each The general location of safety-related components of the p stulatedfirewasdetermined.

systems ofintenst was known from initial location analyses. 2. Fire fragilities were computed. The latest version of The plant visit allowed the analyst to verify the physical the COMPBRN fire growth code [V. Ilo et al.,

arrangements m each of these areas. The analyst completed a 1990 was used to calculate fire propagation and fire zone checklist which aided in the screening analysis and equipment damage.

m the quantification of risk.

3. The probabilities of barrier failure for all remaining The second purpose of the initial plant visit was to confirm combinations of adjacent fire areas were assesud with plant personnel that the documentation being used is in A barrier failure analysis was conducted for those fact the best available information, and to pt clarification combinations of two adjacent fire areas which, with about any questions that might have arim in a review of the or without additional random failures, remained documentation. after the screenmg analysis.

Also, fire-fighting procedures were thoroinghly reviewed to 4. An initial recovery analysis was perfou :1 In a detennine the probability of manual suppmssion in any given fashion similar to the traditional intemal events time for all critical plant areas. analysis, recovery of nonfire-related random failures was addressed. Appropriate modifications to Step 2: Screening recovery probabilities were made as necessary to account for fire conditions.

It was necessary to select those fire locations within the power plant that have the greatest potential for pmducing 5. A time window analysis and an uncertainty analysis risk-dominant accident sequences. The objectives oflocation were performed on any sequence sunising the selection are somewhat competing and should be balanced initial recovery analysis.

)

for a meaningful risk assessment. The first objective is to NUREG/CR-6143 4 v ol. I

. - . - -. . . -- --. - . . _=.

l I

3.1.3_ Internal Flooding Evenis - traditional internal events analysis were used, ao that the results of the two analyses wculd be as comparable as ne analysis was performed in three steps: Possible.

l

1. De purpose of this step was to identify potential 3.2 Level 2/3 flood zones, flood sources within each zone, and l equipment in each zone. Equipment whose fs.ilure The risk associated with POS 5 was determmed in the level could have safety implications for ;he platit, and the 2 and 3 portions of the PRA using a simplified fann of the  ;

susceptibility of this equipment to failure caused by NUREG-1150 methodology [USNRC,1990]. The level 2/3 i a flood in its location were also determined. The portion of the PRA is concemed with the progression of potential water inventory released from each source l'

postulated accidents following the onset of severe core was also quantified. damage and the estimation of the consequences that result from the release of any radioactive material. As such,it

2. The purpose of this step was to develop flood consists of the following constituent analyses: plan: bmage scenarios, determine which cf these might lead to state (PDS) analysis, accident progression analysis, source core damage, and characterize the frequency of term analysis, consequence analysis, and risk analysis. A flood-initiating events. The number of scenarios brief summary of the approach used in each of the constituent was then reduced to a size more amenable to analyses is prosided below.  ;

analysis by considering which scenarios would threaten safety-related equipment and, where Plant Damage State Analysis: PDSs were developed to ,

appropriate, combining some scenarios into one. define the inter race between the accident frequency analysis (Level 1) and the accident progression analysis (Level 2).  !

3. The purpose of this step was to develop and/or Core damage accidents that have similar plant and system i adapt appropriate fault and event tree models. configurations at the onset ofcore damage are grouped  :

quantify operator actions, and perform sequence together; each gmup is called a plant damage state. .l frequency qumtifications and uncertainty analyses.

Accident Progression Analysis: Based on the Quantification of accident sequences followed the same configuration of the plant dermed by the PDSs, event tree '

approach used in the traditional internal events analysis. techniques were used to delineate the accident progressions .I Several of the event trees from that work were applicable to following the onset of core damage. The accident the flooding analysis. In these cases, the frequencies of progressions define the status of the containment and other initiating event were modified to correspond to flood features of the plant that are used to mitigate the accident l frequencies; system and component failures based on flood during the various phases of the accident; they also identify .

volume and location were included, and operator actions phenomena that may impact the release ofradioactive I were modified as appmpriate. For cases in which no material. The accident progression event tree (APET) ,

analogous event trees fmm previous work wert. available, developed in this study is similar in concept to the APETs '

new trees were developed. developed in NUREG-1150; however, it is not as detailed.  :

Compared to the NUREG-ll50 APETs, the POS 5 APET 3.1,4 Seismic Events included fewer questions (i.e., top events), addressed issues in less detail, and did not use formal expert judgment The scismic analysis was limited to work analogous to a procedures to quantify the APET.

Level I seismic PRA, in which estimates have been l developed for core-damage frequency from seismic events SourceTerm Analysis: Source terms, which characterize  ;

during POS 5 for a refueling outage. The methodology is the type and amount of radioactive material releases from the almost identical to that used for full-power seismic PRAs, as plant, were estimated for accident progression groups using widely practiced in the nuclear industry. Ilowever, the parametric approach developed in NUREG-1150 [Jow et seismically-induced relay chatter w as beyond the scope of al.,1993] The parametric expression was quantified, to the  ;

this analysis. Seismic hazard curves from both the Electnc extent possible, using information from the NUREG-l l50 -

Power Research Institute (EPRI) [EPRI,1989] and the full power analysis of Grand Gulf [ Harper et al.,1992]. The o Lawrence Livermore National Laboratory (LLNL) [Sobel, source terms were then combined into a manageable number 1993] were used. of source term groups using a partitioning algorithm first developed in the NUREG-1150 study [Iman et al.,1990] and The modeling assumptions for the systems, the non-seismic then modified in the full power study of the LaSalle plant ,

failure rates for components, the human error rates, and the [ Brown et al.,1992].

same quantification techniques that were used in the r

Vol 1 5 NUREG/CR-6143 ,

- w e- r -.

I l

Consequence Analysis: Offsite consequences stre cut sets for the 28 sequences that survived the sequence j estimated for each source tenn group using the MACCS analysis through the time wmdow analysis. For POS S code. The emergency response assumption used in this study during a refueling outage at Grand Gulf, the sum of the mean are the same as those used in the NUREG-1150 Orand Gulf CDFs from the sursiving sequences is 2.1E-6 per calendar plant analysis [USNRC,1990; Brown et al.,1990]. In year for intemally initiated events (excluding internal fires addition to offsite consequences, this study also included a and floods).

acoping analysis of onsite consequences Two classes ofinitiating events donunate the results from this -

Risk Analysis: The n.s k results reported in this study are study. As ch db40CA/Did and bss of estimates of aggregrte nsk, which is the sum over all offsite power (LOSP)/ Blackout constitute approximately  ;

accident scenarios of the product of the accident frequency 95% of the total mean core damage frequency, with its consequence. The aggregate risk results calculated in this study account for the amount of time, on average, that i the plant is in POS 5 during a typical calendar year (i.e., the plant is in POS 5 for only a small fraction of the IE Class Mean  % Contribution year-approximately 3%). 'Ihc risk calculated in this study CDF To Mean CDF is not the risk attributable to one year of operation in POS 5.

LOCA/ Diversion 1.3E-06 62 i All risk results presented in this report are on a per calendar year basis. LOSP/ Blackout 7.0E-07 33 Other 9.9E-08 5 A limited uncertainty analysis (which included variables from Total 2.1E-06 100 the PDS, accident progression, and source term analyses) '

was also performed. In contrast to NUREG-1150, formal expert opinion techniques were not used in this study to quantify the accident progression and source tenn models.

Figure 3 shows the contributions of the various initiating Where appropriate, however, distributions developed in events to core damage frequency. Two types of accident NUREO-1150 were used in this study. For events that could sequences are among the dominant sequences in the  !

not be quantified using existing distnbutions, new imp riantinitiatingevents. Theyare:

distributions were developed by the project staff.

To analyze the potential accidents that can occur during POS e Blackout - Initiated by a LOSP, a subsequent loss er 5, it was necessary to divide POS 5 into thm! distinct time all onsite ac power either by loss of the diesel ,

regimes. "Ihese regimes [now called time windows (TWs)] generators (DGs) directly or inducetly- by the loss of  ;

are: (1) fmm entry into POS 5 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after shutdown, some DO support system, and the failure to restore (2) from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after shutdown to entry into POS 6 (POS 6 either offsite or onsite ac power before core damage begins approximately 94 hours0.00109 days <br />0.0261 hours <br />1.554233e-4 weeks <br />3.5767e-5 months <br /> after shutdown and roughly occum; and contsponds to the refueling mode of operation), and (3) POS 5 again after core aherations (this last time regime starts e Flooding Containment - Initiated by an event requiring approximately 40 days after shutdown and lasts for the injection of water into the vessel, out the safety approximately 10.4 days). For each time window the relief valves (SRVs) to the suppression pool, and approp:iate core power and radionuclide inventory was used finally out the open lower containment personnel lock to estimate the timing of the accident and its potential due to the failure of the operators to either close the consequences. bwer personnel lock or to control the injection of the water into the vessel. The resulting flood is assumed

4. ReSultS to fait equipment necessary for the prevention of core damage, 4.1 Level 1 ReSultS From a core damage frequency vs time wmdow aspect, time 4.1.1 Quantitative Results from Traditional window 2 is the most important. Figure 4 indicates that time Internal Events Analyses window 2 contributes 58 percent of the total core damage l frequency.

I 4.1.1.1 Resuhs from Sequence Quantification for l i

TraditionalInternalEvents Analyses Another way to present the core damage frequency information is to plot the fractional contribution of each The total core damage frequency (CDF) presented here initiator gmup by time window. This results in Figure 5.  !

i results fmm combining the mean CDFs fmm all 38 sequence From this figure it can be seen that for:

NUREG/CR-6143 6 Vol. I t

1 l

l 1

1 T5 ASH 1% AS 23 %

T1-5 33 %

khbfd h

Sj

/

@ - A5HY I u [ 10%

E2T E1TSH >

S1H-5 L___ i J2-5 H1-5H 2o4 2% 1 10% S1-5 6%

l' 12% i Figure 3 Contribution to CDF by Initiating Event l

AS - Large LOCA during nonhydro conditions A511Y - Large LOCA during hydro conditions ElT511 - Isolation of shutdown cooling common suction line E2T511 - loss of shutdown cooling common suction line 111-511 - Diversion to the suppression pool via the residual heat removal system J2-5 - LOCA in the residual heat removal system SI-5 - Intennediate LOCA during nonhydro conditions SIII-5 - Intermediate LOCA during hydro conditions TI-5 - Loss ofotTsite power TSA511 - Loss of standby service water system Vol. I 7 NUREG/CR-6143

g 1

7%

35% [$7 '

h~

2 58 %

Figure 4 Percent of CDF vs Time Window Time Window 1 Figure 6 also indicates that time window 3 contributes 35 percent of the total core damage frequency, yet 76 percent of The core damage frequency is split between the the time is spent in this window.

LOCA/ Diversion and the LOSP/ Blackout groups (42% and 58% respectively). Thus, from Figures 5 and 6 we see that time window 2 is the most important time regime for POS S during a refueling Time Window 2 outage.

The core damage frequency is split among the th ce 4.1.1.2 Total Plant Model Results for Traditional groups (41% . LOCA/ Diversion,50% . Internal Events Analyses -

LOSP/ Blackout, and 9% Other)

The CDF results from the uncertainty analysis of the Time Window 3 traditional intemal events total plant model (i.e., an uncertainty analysis of all of the sequence cut sets at the same All core damage frequency results from the time) using 1000 samples are as follows (per calendar year):

LOCA/ Diversion smup.

Mean Value 2.0E-6 One fmal way to present the core damage frequency 5th Percentile Value 4.lE-7 information is to plot the percent contribution to the total core Median Value 1.3E-6 damage frequency and the percent of time spent in each time 95th Percentile Value 5.4E-6 window vs the three time windows on the same graph. From Figure 6 it can be seen that even though the plant spends only Comparing the results of this study with those obtained in the al percent of the time in time window 2, this window Grand GulfIndividual Plant Examination (IPE), we fmd that I

contri6tes 56 p:rcent to the total core damage frequency. the mean CDF from the total plant model obtained in this study is almost an order of magnitude less that the IPE result l

l NUREG/CR-6143 8 vol, }

t i

7 F

s tF< LOCA/Diveens': LOSP/ BlackoutA/ Other

../ #J 0 00 l 'l

)

c ao / !E 0 70 / (

o so / I E k  ;

o so < d IN

.I

~ -

g .

o 20/ y  !'

0 50-' Sjft fikk b fjb E&a, ad_ !

o ao . 423 %1 TW1 TW-2 TW-3 Total A

Figure 5 Fractional Contribution io CDF by IE Group vs Time Window  !

Percent of CDF ?i! Percent of time in TW ,

80 / A&T2 60 / - -

<!!!]h 20 /

0 JN- ' 3 F " A '

b [A h Y b

(

^

l TW-1 TW-2 TW-3 r

Figure 6 Percent of CDF and Percent of Time in Time Window vs Time Window Vol. I 9 NUREG/CR-6143

of L7E 5 per reactor year. See Section 5 for a comparison 4.1.5 Qualitative Results

. with the NUREG/CR-4550 study.

4.1.5.1 Plant Systems and Operations Insights from In ad6 tion, the results from this study indicate that, unlike the TraditionalInternal Events Analyses NUREG/CR-4550 results, sequences other than those initiated by LOSP (e.g., LOCAs) contribute significantly to 4.1.5.1.1 Systems Insights the core damage frequency.

I Characteristics of the plant design are a major factor affecting 4.1.2 Quantitative Resuits from Internal Fire the likelihood of core damage while in cold shutdown. For Evenis Analyses Grand Gulf, the following plant characteristics are most important:

A detailed screening analysis was performed which showed most plant areas had a negligible contribution to the 1. Shutdown cooling system components are not rated frequency of fire-induced core damage. A detc.iled fire for full pressure, but automatic isolation occurs on propagation analysis was performed for four fire zones. either high pressure or on low !cvel; 1here were no plant areas which were found to have a ,

contribution to core damage frequency greater than the 2. Use of the residual heat removal system for truncation limit of 1E 8; thus, no fire sequences had a CDF shutdown cooling requires recirculation, either greater than 1E-8. forced or natural, to prevent pressurization transients; .;

4.1.3 Quantitative Results from Internal .

3. Due to density and pump head effects, recirculation Flooding Events Analyses is sensitive to actual level in the core region. The water level in the core region is related to but not A single sequence survivcd through the time window *

, equal to measured level in the downcomer, analysis. This sequence is uutiated by a break in a fire water  ;

system pipe. The resulting flood from this initiator disables '

4. At decay heat levels of concem, flooding induced Dmsions I,2, and 3 Class IE ac and de power. Given the dryout of the core (i.e., a steam flow suflicient to severity of tha postulated accident sequence, no operator prevent water from cooling the core) at atmospheric recovery was postulated. The mean core damage frequency pressure will not occur, and the core can be cooled  !

for tlus sequence is 2.3E-8 per calendar year. The 5th and '

by steaming with a maximum of 250 gpm makeup; 95th percentiles are 8.2E 11 and 8 6E-6 per calendar year, ,

respectively.

5. To steam at low pressure, opening ofone safety relief valve in relief mode is sufficient to maintain 4.1.4 Quantilative Results from Seismic pressure low enough that the low head pumps in the ,

Evenis Analyses emergency cooling system can proside suflicient makeup; i The CDF results of the seismic analyses for earthquake-initiated accidents during POS S for a refueling outage are as 6. Opening of one safety relief valve in relief requires follows (per calendar year): operator action, de power, and air, For the LLNL (1993)llazard Curves 7. In using the emergency core cooling system in a water solid mode, opening of two safety relief 5th percentile 2.1E 11 valves in the relief mode prevents overpressurumg Median 2.4E-9 the shutdown cooling system components, both in Mean 7.lE-8 the residual heat removal system and in the 95th percentile 2.2E-7 ADIIRS, regardless of the pump (s) u.wxt, For the EPRIIlazard Curves

8. In using the emergency core cooling system in a water solid mode, opening of one safety relief valve 5th percentile 2.5E-12 in the relief mode prevents overpressurizing the Median 2.0E 10 components in the residual heat removal system Mean 2.5E-9 used in shutdown cooling. but components in the 95th percentile I . lE-8 auxiliary decay heat removal system may overpresstirize; NUREG/CR-6143 10 Vol. I

e

9. Isolation of the shutdown cooling system allows the very few fire zones were found to be applicable because of core to be cooled at full pressure by steaming on physical separation criteria. Also, relative to other plants, one safety relief valve at its safety setpoint, and no Grand Gulf utilizes more automatic fire protection systems in operator action or support systems are required to critical safety-related areas, which in turn reduces the operate the valve in the safety mode; probability of damage from a fire. Therefore, after taking into account the physical separation of safety-related

10. Use of emergency core cooling systems in a water functions, automatic fire protection systems, lower solid mode does not require suppression pool frequencies of fire initiated events, and manual fire makeup, in the short term, to compensate for vessel suppression, most initiating events at shutdown and many fire fill; zones were eliminated from further enalysis.

I 1. Water can be injected into the vessel at low pressure A detailed fire propagation analysis was perfonned for the from both service water and diesel-driven firewater remaining initators and respective fire zones, . It was found pumps. that only in very limited areas could fire damage result in both the initiating event and other fire-related failures that 4.1.5.1.2 Operations Insights were necessary for core damage. Even in these situations, other random failures (nonfire-related) were also necessary in POS 5 (i c., cold shutdown), the requirements of the before core damage occurred. Therefore, when taking imo technical specifications for the operability of systems and account the reduction in fire frequency due to the limited area components are much less stringent than for power operation. ofinfluence and other random failures which were required The actual availability of systems depends on plant-specific before core damage, all remaining fire scenarios were found practices, and on the reason for transitioning the plant to cold to be less than the truncation limit (i.e., less than 1 E-8 per I

shutdown, in this case--a scrueling outage. calendar year).

For Grand Gulf, the following practices have an important in all areas, additional random failures of equipment (damage impact on the ability to cool the core in POS 5: not related to the fire itself) had to occur in order to obtain core damage. Adequate separation of equipment (and/or) l

1. At least two safety relief valves are maintained cabling between redundant functions and the presence of operable for both relief and safety operation; automatic fire suppression systems reduced core damage frequency for those areas. ,

2. Automatic isolation of the low-pressure shutdown ]

cooling system is not bypassed, but is maintained on 4.1.5.3 Insights from Internal Flooding Events Analyses j both high pressure and low level; The overall conclusion of this work is that intemal floods do

3. Some subsystems of the emergency core cooling not pose a significant core damage threat to the Grand Gulf system are available most of the time. Nuclear Station for POS 5 during a refueling outage. ,

l 4.1.5.2 Insights from Internal Fire Events Analyses The core damage frequency of 2.3 E-8 per calendar year due i to intemal flood events is approximately two orders of The fire-induced core damage frequency is lower than full- magnitude lower than the core damage frequency of 2.0E 5 i I

power fire risk assessments for a number of reasons First, for traditional internal events. Thus, internal flooding would the plant is in this POS only 3 percent of the time in any make only a minor contribution to the total core damage given year, so even if all other factors remained the same frequency at Grand Gulf during POS 5. This is principally with full power, one would expect the fire induced CDF for because of the low frequency of fluid boundary component POS 5 to be lower. Second, the shutdown fire frequencies breaks that could result in a flood and a separation of systems are somewhat lower than those at power. Third, even if that would be available to mitigate the efTects of such an active electromechanical safety-related equipment is accident.

demaged by fire, an initiating event may not necessarily occur. For instance, for the loss of'IT3CW (turbine building The two conservative assumptions a!Iecting flow rates and cooling water) initiator to result from fire-related damage, flood volumes included in these analyses (i.e., fully multiple operational pumps must fail These pumps and their guillotined catastrophic breaks and full hour undetected associated cabling have suflicient separation to make it breaks) did not significantly afTect the results of this study.

highly unhkely that a single fire could lead to failure of all For completeness, it should be noted that the assumed pumps. Thus, many initiating events at shutdown were undetected break time for the single surviving sequence was climinated because of the physical separation criteria of the 15 minutes. This time, while a departure from the 1-hour screening process. Even for the unscreened initiating events, assumption, was suflicient to cause a loss of all Class 1E ac Vol. I 11 NUREG/CR-6143

. . . .- - .=. . . - .

and de power, and probably represents a mcre reahstic will occur in a flooded cavity. For the former, the releases estimate of the @~W break time for POS 5 during a associated with CCl are prevented. In the latter case, the refueling outage. radioactive releases are scrubbed by the water in the flooded cavity, which helps reduce the source term to the 4.1.5.4 Insights froen Seismie Evente Analyses environment. If the containment is closed prior to core damage, it is predicted to either fail or to be vented after core lhe mean core damage frequency of 7.1 E-8 per calendar year damage because containment heat removal is not available in I (i.e., the maximum estimate obtained by using the LLNL these accidents. Venting the containment late in the accident l (1993) hazard curves) is also low relative to the 2.0E-6 is the most likely scenario. For the accidents identified in frequency for traditional internal initiators. Two reasons for POS 5, the containment sprays were never available after the j this are onset ofcore damage.

i

1. Grand Gulfs scismic capacity in responding to 4.2.3 Aggregate Risk earthquakes during shutdown is excellent, well above its design basis.

Table 3 presents the offsite risk results for the following six measures: early fatalities, total latent cancer fatalities, ,

2. The Grand Gulf site enjoys one of the least population dose within 50 miles of the site, population dose seismically active locations in the United States.

within 1000 miles of the site, average individual early fatality .

risk within 1 mile of the site, and average individual latent  !

4.2 Level 2/3 Results cancer risk within 10 miles of the site.

4.2.1 Core Damage Frequency Many factors can affect the magnitude and severity of the release and in turn affect risk. Factors associated with POS 5 For discussion purposes, the core damage scenarios a cidents that tend to increase risk include the following: ,

identified in the Level I analysis can be combined inte the e In many of the accidents the containment equipment following three PDS groups (12 PDSs were actually evaluated in the accident progression analysis): loss of hatch was open during the entire accident. An open coolant accidents, Station Blackouts (SBOs), and Other equipment hatch provides a path for radionuclides to Transients. The total core damage frequency and the escape from the containment to the auxiliary L fractional contnbutions to the core damage frequency T v building and then out into the environment.

these three groups are provided in Table 2. The LOCA PDS ,

group is the dominant contributor to the core damage o Two plant features that can be used to attenuate the l

frequency, followed by the SBO PDS group and the Other release fradioactive aerosols are the suppressmn  ;

Transients PDS group. pwl and the catainment sprays. In bodi die LOCA ,

and the SBO PDSs, the radioactive material released I from the damaged fuel bypassed the suppression i 4.2.2 Accident Progress. ion pool. The containment sprays were not available in [

any of the POS S accidents.  :

A simplified representation of the APET that addresses the  ;

major aspects of the accident is shown in Figure 7. (The e in many of the accidents, core cooling was not >

actual APET included 59 top events or questions). Figure 7 '

restored early in the accident, thus precluding any combines the results from all the accidents and is conditional possibility of arresting the core damage process ,

on the occurrence of core damage; the values displayed are before vessel failure. When the vessel fails, the core mean conditional probabilities. From the simplified tree i debris in the vessel is released into the reactor presented in Figure 7, it can be seen that in the most likely cavity, allowing for possible CCis. Significant i accidents in POS 5 the containment is open, the suppressim amounts ofradioactive material can be released pool is bypassed, and the vessel fails. For the cases where during diis ex-vessel phase of the accident.

the vessel fails, there is a significant probability that the cex debris will either be quenched in a flooded cavity cr the A number of factors associated with these POS 5 accidents interactions between the core debris and the concrete also tend to decrease risk. These factors are listed below; i structures beneath the vessel, the core-concrete interaction  !

(CCl), will occur in a flooded cavity. For the cases where the e Ahhough in many of the acc' dents the containment vessel fails, there is a significant probability that the core

• equipment hatch is open, the suppression pool is debris will either be quenched in a flooded cavity or the bypassed, and the containment sprays are interactions between the core debris and the concrete unavailable, the releases pass through the auxiliary structures beneath the vessel, the core-concrete interaction .

NUREG/CR-6143 12 vol. I i

i

T l

' Table 2 Core Damnage Frequency for POS 5 and Fractional Contributions to the Core Dassage Frequency for the lhCA, SBO, and Other Transients Plant Damnage State Groups Plant Dantage Descriptive Statistics' State Groups Pereestiles Mesa Standard c 5th 50th 95th Devistlom 1

Total Core Daninge Frequency (per esiendar year) j l Total 4.1E-07 1.4E-06 5.6E-06 2.1E-06 2.7E 06 Fractional Contribution to Core Damange Frequency f _. ..

LOCA 0.10 0.50 0.93 0.51 0.27 SBO 0.03 0.24 0.80 0.33 0.26 Other 0.01 0.09 0.52 0.17 0.18 '

• huwe based on a latan hyperashe samphng (llis) sampic size c(200 oteervataans.

1 Status of Status of Suppression Containme nt Containment Pool Vessel Status PDS Before CD During CD Bypass Failure ofCCI Dry CCI(039)

Yes (0.98) Flooded CCI(038)

Bypamed (0.85) None (0.23)

No(0.02)

Open (0.99) Open(1.0)

Dry CCI(0.0)

Yes (l.0) Flooded CCI(0.62)

None (0.15) None (038)

All No (0.0) l Early Failure (0.05) Bypam Yes Dry CCI I Late Venting (0.93) Bypass Yes Dry CCI Closed (0.01) Late Failure (0.02) Bypass Yes Dry CCI No Failure (0.00)

Figure 7 Maip24d Representation of POS 5 Accident Progressions l

Vol. I 13 NUREG/CR-6143

Table 3 Distributions for Aggregated Risk for POS 5 (all values are per calendar year, population doses are in person-rem) l Consequence Descriptive Statistles' )

Measures Percentiles Mean Standard I 1

5th 50th 95th Deviation  ;

Early Fatality Risk 3.7E-1 I 2.8E-09 3.9E-08 1.4E-08 5.4E-08  !

Total Latent Cancer Risk 4.3E-04 1.9E-03 1.2E-02 3.8E-03 7.7E-03 Population Dose within 50 miles of the plant 1.3E-01 5.3E-01 3.1E+00 9.9E-01 1.9E+00 Population Dose within 1000 miles of the plant 9.9E-01 4.4E+00 2.8E+01 8.7E+00 1.8E+01 Individual Early Fatality Risk- O to 1 mi!e 4.2E-13 2.7E-11 3.0E-10 9.6E-l 1 3.4E-10 Individual Latent Cancer Risk- O to 10 miles 2.5E-10 9.4E-10 4 9E-09 1.6E-09 2.4E-09 0 Staustics are based on a LilS sample of 200 observauons.

building before escaping into the environment. Table 4 provides the fractional contributions to the early Because ofits large volume and surface area, the fatality risk and the total latent cancer risk for the following auxiliary building provides a location for the three PDS groups: LOCAs, SBOs, and Other Transients.

radionuclides to be attenuated by deposition and The fractional contributions to the population dose risk thereby reduce the source term to the environment. measures (not shown in Table 4 for brevity) are similar to the fractional contributions to the total latent cancer risk e The accidents delineated for these shutdown measure. From Table 4 it can be seen that, on average, the conditions progress sufficiently slowly that there is SBO PDS group is the dominant contributor to the total early typically a considerable amount of time available for fatality risk.

the public to respond to the accident and evacuate before exposure to the release. This is primarily Because a large amount of overlap exists among the three important for the early health effects consequence distributions, as is evident from the descriptive statistics measures, which are more strongly affected by the provided in Table 4, on any given obseivation (an time available for evacuation- observation is one particular trial in the many trials made in a Monte Carlo type analysis) the contribution from the three e Radioactive decay has reduced the radioactive groups can vary. That is, for one observation the SBO group potential of these shutdown accidents relative to the may be dominant, whereas for another observation the LOCA inventory that is present immediately after the group may be the dominant group. On average, however, reactor is shut dowrt This factor is primarily the SBO is the dominant contributor. The SBO PDS group's important for early health efTects, w hich are more large contribution to early fatality risk can be attributed to its strongly afTected by the shorter lived radionuclides. relatively high contribution to the core damage frequency This effect is much less noticeable for latent heahh coupled with the fact that the containment equipment hatch is effects, which are more strongly affected by the open, the suppression pool is bypassed, and the auxiliary longer lived isotopes. building fails early in these accidents. Combined, these factors cause the SBOs to have relatively high risk values.

e The population around the Grand Gulf plant is relatively low. Although many factors influence the The LOCA PDS group, however, is not a dominant magnitude of the consequences, in general, for a contributor to early fatality risk even though it is a dominant given release, a smaller population correlates with a contributor to the core damage frequency. This situation smaller number of fatalities Of the four Mark 111 occurs primarily because the dominant contributors to the plants m the United States, Grand Gulf has the LOCA core damage frequency are LOCA accidents that are fewest number of people hving within 50 miles of nitiated while the plant is in time window 3 (i c., PDS3-1).

the plant, according to the 1990 census data. The Numerous factors can potentially reduce the number of early Mark 111 plant with the greatest number of people fatalities that occur when the accident is initiated in time l living within 50 miles of the site has a population window 3 relative to the other time windows. These factors that is more than an order of magnitude greater than include the following conditions: (1) Radioactive decay has the Grand Gulf 50 mile population. reduced the inventory of short-lived radionuclides that are NUREG/CR-6143 14 Vol. I

l.

Table 4 Fractional Contrebations to Aggregate Risk for the LOCA, SBO, and Other Transleets Plant Dassage State Groups l

Plant Damage Descriptive Statistles' State Groups Percentiles Mean Standard 5th 50th 95th Deviation i Fractional Centribution to Early Fatakty Risk : _

LOCA 0.001 0.04 0.72 0.16 0.24 l SBO 0.08 0.87 1.00 0.73 0.30  !

Other 0.001 0.04 0.61 0.12 0.18 l L Fractional Contribation to Total Latest Cancer Fatality Risk LOCA 0.04 0.38 0.90 0.42 0.27 ,

SBO 0.04 0.41 0.90 0.45 0.28 l Other 0 01 0 06 0 55 0 13 0.17

• stausua are based on a uts semple or200 ot=ervenas.

important to early health effects. (2) Because of the lower of the release are sembbed by either the suppression pool or decay heat the accidents progress more slowly, allowing the pool formed by flooding the contamment. The fractional l

more time for the population to evacuate. (3) The release is contribution from the SBO PDS group tends to be greater spread out over a longer time which, helps reduce the than the fractional contribution to the core damage frequency concentration ofradionuclides in the environment. For these because for these accidents the contamment is open at the -

reasons time window 3 is a r.egligible contributor to early start of the accident, the auxiliary building fails early in the fatality risk. accident, the vessel nearly always fails, CCI nearly always ,

occurs, and the releases are rarely sembbed by water.

For latent cancer health effects, the LOCA and SBO PDS Therefore the releases associated with the SBO tend to be groups are, on average, the dommant contributors to risk. large relative to the other accidents analyzed in this study. ,

Because the radionuclides that are important to the latent heahh effects tend to have long halflives, these risk measures See Section 5 for a comparison of the results of this study are not particularly sensitive to the time of accident with those fmm NUREO/CR-4551.

occurrence relative to shutdown . Latent cancers primarily depend on the total amount of radioactive material released, 4,2.4 Qualitative Issues and Cautions not on the time it was released (i.e., early in the accident versus late in the accident). Because latent cancers are not The results presented here for the Level 2/3 analysis are for a stmngly dependent on the timing characteristics of the single POS (namely POS 5) and, as such, only assess the risk accident (i.e., start of release or release duration), the latent associated with this POS. While the Phase 1 Screenmg cancer risk will depend on the likelihood of the accide it and Study ar,d other qualitative insights suggest that POS 5 is the on the total amount of radioactive material released. In all of risk-dominant mode of shutdown, no detailed study has been the core damage accidents delineated in this study, the performed on the other POSs to confirm this conclusion.

containment is either open at the start of the accident or fails during the accident, and in most of the accidents the core Only accidents initiated from traditional internal events were damage process is not arrested in the vessel. Thus, although analyzed in this study. Hence, the risk calculated for POS 5 the timing of the accident may vary, when the uncertamty in is not complete in the sense that it does not include accidents the source term is considered, all the accidents will result in initiated by internal fires and floods;it also does not include roughly similar releases of radioactive material to the accidents initiated by seismic events.

emironment. Thus, as can be seen in Tables 2 and 4, the mean fractional contribution to latent cancer risks tends to be It is important to realize that by changing the risk in one ,

roughly similar to the mean fractional contribution to the core POS, for example by changing when equipment is available damage frequency for each of the PDS groups. The and unavailable, can shift the risk to another POS. Since this fractional contributions from the LOCA and Other Transient study only addresses the risk associated with one POS, the i gmups tend to be less than their fractional contributions to effect of such a change on overall risk (i.e., risk across all the i the core damage frequency because for these PDSs portions POSs) cannot currently be quantitatively assessed.

Vol. I 15 NUREO/CR-6143 i l

Since only a single plant was analyzed, these results cannot degradation of multiple systems; however, now there are be considered generic and applicable to a population of additional accidents (e.g., LOCAs) that can cause loss or j plants. The plant and system models used in this study are degradation of multiple systems because of considerations l based on the Orand Oulf plant as it operates in a selected unique to POS S (e g., isolation of the automatic actuation of mode of operation. Thus, while some insights may be the suppression pool makeup system for safety reasons applicable to other plants, in general, the results from this thereby requiring manual operator actions for continued use ,

study should not be arbitrarily applied to other plants or of ECCS pumps during a LOCA). Nonetheless, there are conditions. The model used to develop the progression of the differences in the accident progression associated with the accidents after the onset of core damage is, in pan, based on SBOs. These are (1) almost all the LP&S SBO sequences the Orand Gulf Emergency Operating Procedures and other lead to an interfacing system LOCA and the full-power procedures and pra:tices at the plant. Changes in these sequences do not; (2) the containment is always open at the procedures and practices can certainly affect the progression start of the LP&S accidents whereas it is isolated at the start of the accident and the ultimate risk of the POS. Similarly, of full-power accidents; and (3) the probability of arresting since the offsite consequences are sensitive to the site the core damage process in the vessel is higher for full-power characteristics and surrounding region (e g., weather, accidents than for LP&S accidents.

population, land use), for a given release of radioactive material, the consequences can be expected to vary from one The makeup of the remaining accident classes provides a site to the next. major difference between the two analyses. In the full-power analysis, the anticipated transient without scram (ATWS)

5. Comparison with Full Power class is the second most important class while in the LP&S analysis the most important class is the LOCA. Given the This section presents a comparison of POS 5 results with plant conditions analyzed in each of the two studies, the first results from the NUREG-1150 (NUREG/CR-4550 and point that can be made is that ATWS sequences were simply NUREG/CR-4551) full-power analyses as documented in not possible in the LP&S analysis since the plant was already SAND 94-2949 [Whitchead et al.,1994b) In Section 5.1 suberitical, therefore, one should not be surprised by this results are presented on a calendar-year basis, taking into apparent difference. On the other hand, since LOCAs were account the fraction' of time on average the plant spends in possible in both analyses, why did this class show up in the c:ch state during any one year. In Section 5.2 the results are LP&S results but not in the full-power results? While no presented on a per hour basis, conditional on being either et detailed examination of this phenomenon was undertaken, the full power, in POS 5, or in a particular time window during most likely reason for the appearance of LOCAs in the LP&S POS5. results is the intentional disabling of the automatic actuation of the suppression pool makeup system. This actuation is 5.1 Per Year basis defeated for safety reasons. As a result, the continued use of injection systems during a LOCA requires operator By providing infonnation on a calendar-year basis, results intervention. The difference in reliability between automatic from all the ddrerent POSs can be added together to get a actuation and operator action generally accounts for the fact total CDF or risk measure for the plant as information that LOCAs survived in the LP&S analysis but not in the full-becomes availabic. p wer analysis.

Figure 8 presents a comparison of mean CDF percentages for Figures 9,10, and 11 present a comparison on a calendar.

the major classes of accidents from both the NUREG-1150 year basis of the CDF, early fatahty nsk, and total latent full-power [ Brown et al.,1990) and the LP&S analyses cancer fatality risk for the three time windows' in POS 5,

[ Brown et al.,1995). From this figure one can see that there POS 5 in total, and in full power. Distribution information ere points of both similarities and difTerences. The major f r POS 5 in total and for full power is displayed in Table 5.

From Figure 9 one can see that while the POS 5 total mean similarity observed from the figure is that in both analyses the SBO class is important. SBOs showed up as dominant in full e re damage frequency is about a factor of two lower than the power because nothing else could cause loss or degradation fu p wer vahme, there u omlap between 6e two of multiple systems and be above the truncation limit. In POS 5, SBOs also show up because they still cause loss or

'A time wimlow is a sutxtivision of the time spent in any one POS. Each subdivision allows a more realistic estimate of the decay heat 8

ne fraction of tine the plant is in POS 5 is 0 031 and the load, equipment unavailabilities, and radicnuclide inventories to tw used fraction of tinw the plant is at full power was taken as 1.0, since this has during subsequent analyses. For POS 5, tlw three tinw windows used were been traditionalty used and thus can be cornpared with past results. In time window 1-starting I4 hours aAer shutdown and having a duration of rethty, the fraaion asaaeinted with full-power operation would be something 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />; tinw window 2--etarting 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> aAer shutdown and having a close to 0 8. His small difrerence is not expected to significantly alred any duration of 70 hours8.101852e-4 days <br />0.0194 hours <br />1.157407e-4 weeks <br />2.6635e-5 months <br />; and time window 3-starting 40 days aAer shutdown i compansons made in this sectwn amt is therefore ignored. and having a duration of 10 4 days.

)

l NUREG/CR-6143 16 Vol. I

i l

l l

l

! Full Power ATWS Other

,4 . .. . ,

. ,' in

.S f 9 4, -

G.. Q,f, ,, <

• ~

> ;p: bj- .%. ,  ;;

'_'.a;, lil!! . - . ., , ::R 'p -

t

'\ M a  ?$:' + .a ,

l 1

SBO 90 %

LP&S Other 17 % SBO 33 %

LOCA 50%

Figurr 8 Percentage comparison of major accident sequence classes from full power and LP&S results.

Vol. I 17 NUREG/CR4143 i

y w -

re w ,

i e -

e .1 10i - 3 g 1 C' ': ..,

.k  :

n g j,-$ -

E - I

_ _ t 4 ~~

l in. - 10  :

h g

I i

a

~

-7 =

.yl 10 3

]

10 TW-1 TW-2 TW-3 TOTAL POS 5 Full Power ,

?

Figure 9 Core damage frequency per year for time windows 1,2, and 3; total POS 5; and full power.

i i

i

-7 '> '

10  :

E 95 % _ _ _j

-- mean -

l

~~ '

C 10 ' =

1. 8" ~~ ~~

~~

I C  ! -

5%

w -9 ,

10 = ,

.a*

• -- [

.T

'3i -

- -10 C 10  ; y r

1:  : -

~

+

-11 10 1 _

-12 10 TW-1 TW-2 TW-3 TOTAL POS 5 Full Power '

Figure 10 Early fatality risk per year for time windows 1,2, and 3; total POS 5; and full power.  !

l i

i s

NUREG/CR-6143 18 Vol.1 i

(

, . - - ._ _ . . _ _ r

l c .30 j l 95 % .;

f

-- mean  ;

~

-2 _ median --

10 _

5%

I --

j __

~~

10' -

10

-~

il  :

~

10' TW-1 TW-2 TW-3 TOTAL POS 5 Full Power ,

Figure 11 Totallatent cancer fatality risk per year for time windows 1,2, and 3; POS 5 in total; and full power.

Table 5 Distributions for Core damage frequency and aggregate risk for POS 5 and for full power

• l (All values are per calendar year)

Descriptive Statistics i Analysis p,,c,,, ,,,,

Sth 50th 95th Mean i Core Damage Frequency:

POS5 4.IE-07 1.4E-06 5.6E-06 2.1E-06 FullPower 1.8E-07 1.1E-06 1.4E-05 4.1E-06 Early Fatality Risk POS5 3.7E-11 2.8E-09 3.9E-08 1.4E-08 FullPower 2.5E-12 6.1E.10 2.6E-08 8.2E-09

. Total Latent Cancer; Fatality Risk .l  ;

POS5 4.3E-04 1.9E-03 1.2E-02 3.8E-03 ,

FullPower 1.4E-05 2.4E-04 2.312-03' 9.5E-04

• Full-power results were extracted from Volume 6 of NUREG/CR-4551 [ Brown et. al,1990] -  !

Vol. I 19 NUREG/CR-6143 i

rietributions. Within POS 5, the least important time 1. The decay heat load would votinue to decrease e, indow appears to be time window 1. The other two during the year, resulting in add 3ional time for the windows have approximately the same importance, with operators to respond to any undesired event.

window 2 being slightly more important from a mean CDF viewpoint The primary reason window 1 is the least 2. He unavailability associated with the systems imputan;is the small fraction of time the plant spends in would change as the year progressed, generally window I compared with windows 2 and 3 -0.03 in window getting smaller, and thus reducing the likelihood of I and 0.212 and 0.758 in wirJows 2 and 3, respectively, an ac::ident progressing to core damage as a result of Fran Figure 10 one can see that the mean early fatality risk equipment unavailability.

of POS S is only a factor of 1.7 greater than the full-power . I

3. Decay would reduce die radiological inventory that risk even though the containment is open during most of the ]

accidents in POS 5. Within POS 5, the least important time is avat a e to cam heale dects.

l window is window 3. 'the main reason for this is that time window 3 starts about 40 days after shutdown; thus, the Figure 12 presents a comparison of the CDF on a per hour radioactive material released during an accident in window 3 basis for each of the three POS 5 tune windows, for POS 5 m, will have undergone decay, reducing the inventory of short- t tal, anHw fuH power. Fmn &c figum me can see mat l

lived radionuclides that are important to early health effects. POS 5, generally speaking, is more important than full power 1 The decay associated with windows I and 2 is less; thus one " # .is considered on a per hour basis. While would expect the risk associated with these windows to be N"ially imt thir might seem counterintuitive given thl higher. From Figure il one can see that the mean total latent decay heat associated with operation in POS 5 and the cancer fatality risk of POS S is about a factor of 4 greater subsequent increase in response time for the operators, the than the corresponding full-power risk. One reason for this is nas ns fw & s e clear anu exanunad n. hile se that in POS 5 the containment is always open and in full I wer decay heat does provide the operators with more time power the containment is always isolated at the start of an to deal with events given an initiating event, accident. Some of the difference results from the different s me f these operator actions are more myolved and/or models used in the MACCS calculations for the two studies. canPH eated &an em aduH powa in ahon, se MACCS version 1.5.11.1 [Chanin et al.,1993] was used to perators must usually deal with the events that occur m, POS estimate offsite consequences in the POS 5 probabilistic risk 5 with a reduced set ofequipment that results from the assessment; an earlier version was used in the NUREG-1150 *l.uired test and maintenance activities associated with the plant studies. Cancer risk coefficients implemented in van us systems during the POS.

MACCS version 1.5.11.1 are two to three times greater than .

those utilized in earlier versions of the MACCS code. The Within POS 5, the least important time window appears to be total latent cancer fatality risk measure is directly affected by window 3. This wmdow, generally speaking,is less these risk coeflicients. Within POS 5, the total latent cancer imp rtant than the other two windows, even though the plant fatality risk associated with each time window tracks with the spends more time in this substate than it does m the other two CDF associated with each time window since this risk combined. Time wmdows 1 and 2 have relatively the same measure is affected less by the decay of radionuclides than is imp riance, with time window 2 being slightly more the early fatality risk measure. imp riant from a mean CDF viewpoint. Ilowever, as can be seen, the distributions for these two time windows have considerable overlap, and thus, for any given Latin hypercube 5.2 Per Hour Basis sample (uIs) observation, either could be the most important. Possible explanations for these observations are as follows:

By providing information on a per hour basis, results from different POSs can be compared, allowing the identification

1. The decay heat load associated with time window 3 of the mc,st important POS from a conditional CDF or risk i is the smallest of all three time windows. Since the viewpoint. Ilowever, before pmviding the CDF and risk water level in time window 3 is at least as high as it infonnation on a per hour basis, the following caution is is in the other two windows, the operators will have made. Per hour results fmm the POS S analysis are not more time to deal with events if they happen in time directly scalable to results based on being in POS 5 for I i window 3. In addition, many accidents were l year. In other words, one cannot simply mu!riply the per '

eliminated fmm the analysis because the time to core hour results by the number of houri in a year and have the damage was greater than the 24-hour mission time correct estimation ofeither CDF or risk for a POS 5 year-used in the analysis. These two in combination i Such a pmcess would overestimate the CDF and risk for offset the larger fraction of time spent in this POS 5 for the following three reasons:

window. '

NUREG/CR 6143 20 Vol.1 l

i i

10  ; -

sm A '. ~ ~

=d=-- .;

I, _3

. j ' 10#

~ l

~

ta, 10 '

1. 30 --

'{

- g 10 g u  : '

I l, 10 TW-1 TW-2 TW-3 TOTAL POS 5 Full Power Figure 12 Core damage freque ey per hour for time windows I,2, and 3; total POS 5; and full power.

'I

2. The relatively equal importance of time windows I radionuclides has decreased, the containment is generally - l and 2 can be explained as follows: always open and there are fewer means of removing _  !

radioactive materials from the atmosphere than is the case ~ :i

• The higher decay heat load in time window I during an accident at full power. Also, on a per hour basis, implies that the operators will have less time to the CDF is high for POS 5 relative to full power.

deal with events in window I than in window 2. . .

i Within POS 5, the least important time window appears to be a Generally speaking, the availability of equipment window 3,just as with the CDF. While window 2 is slightly -

10 respond to an initiating event is greater in more important than window I from a mean viewpoint, the -

window I than in window 2. overlap between the two distributions clearly indicates that for given IJIS observations either window may be the more

• In combination, these two factors tend to balance important. One reason window 3 is generally less important each other, resulting in relative equality for both than the other two is that time window 3 starts 40 days aAer -

tirac windows. shutdown-which is enough time for many of the short-lived radionuclides important in early fatality risk to have decayed.

This, in combination with the beneficial effect of the -

Figure 13 presents a comparison of the early fatality risk on a overlying pool of water (i.e., quenching the core debris and per hour basis for each of the three POS S time windows, for scrubbing releases for situations where the core debris is not POS 5 in total, and for full power. From this figure one can cooled) associated with the accidents in this time window, see that, generally speaking, the risk due to early fatalities is tends to reduce the importance of early fatalities.

more important for the total POS 5 than for full power.

llowever, as can be seen, there is overlap between the Figure 14 presents a comparison of the totallatent cancer -

distributions such that for some Ills observations either fatality risk on a per hour basis for each of the three POS 5

might be the most important. One explanation for the time windows, for POS 5 in total, and for full power. From

. generally higher importance of POS 5 is that, even though the this figure one can clearly see that the risk due to total latent plant has been shut down and the inventory of shon-lived cancer fatality is more important for the total POS 5 than for full power. The most likely reasons for this are the open Vol:1 21 NUREG/CR-6143 vg--p- -g- --

10 ,

-10 95 %

10 y ,,

- mean g . : __ __

median --

'( .j C 10'11 l- 5%

f

~~~ l

-12 10 , -

,a -13 , _

u E 34

- d 10 ,

i 10

-15 f 5

-16 10 TW-1 TW-2 TW-3 TOTAL POS 5 Full Power  !

i t

i Figure 13 Early fatality risk per hour for time windows 1,2, and 3; total POS 5; and full power.

i 10'  ; ,

C 5 - 1 e -

" 95 %

0 ~# -

10 ~

- mean

.g  ;  ;

-- - median --

E __

- 5%

g gg-5 --

j 5 - --

w  : __

~-

I. 10 - ; ,

U -

- -7 ,

F_- ,

5 iG -

0 -

~~

'il 10 ,

l h 5  !

10' TW-1 TW-2 TW-3 TOTAL POS 5 Full Power Figure 14 Total latent cancer fatality risk per hour for time windows I,2, and 3; total POS 5; and full power.

NUREG/CR-6143 22 Vo! I I

1

e r

contamment associated with many of the accidents in POS 5; basis is nel rs =

• since plant conditions (e g., system v

!. there are fewer features of the plant to mitigate the release; unavailabilities and decay heat loads) would change L and radioactive decay does not have a significant impact on dramatically during a year, A more appropriate measure of

- the long-lived isotopes that are important in latent health conditional CDF would be one based on a per hour basis as effects. Also, on a per hour basis, the CDF is high for POS 5 described in Section 5.2 of this report. As was shown.in  ;

relative to full power, Section 5.2, the conditional CDF is higher in POS 5 than at

i. full power.

Within POS 5, the least important time window appears to be window 3. Given the overlap in the distributions associated Plant Specific with windows I and 2, either could be the most important for f

any given LIIS observation. Ilowever, from a mean risk There are three major aspects of the specific Grand Gulf

'. viewpoint, window 2 is slightly more important. 'Ihe most plant model used in this analysis that significantly affected the j l likely reason window 3 is the least important is the beneficial results. These are l i

effect of the overlying pool of water associated with the  ;

accidents in this time window. (1) Grand Gulfs requirement for automatic isolation oflow presnre components in the shutdown 6, General Conclusions and Insights c= ling system, given an inaease in pressure i t

and/or a decrease in water level in POS 5.

6.1 Level 1 Conclusions (2) Grand Gulfs requirement that at least two safety gl relief valves be available in POS 5 allows the  :

The conclusions drawn from the Level I study can be operators to use portions of their inadequate decay l grouped into three categories. They are heat removal procedure, which would otherwise l be inaccessible. ,

(1) methodological, '

(3) Grand Gulfs additional system for removing decay (2) plant specific, and heat (ir., the attemate decay heat removal system) affects the estimated core damage frequency (3) generic. during two of the three POS 5 time windows. l i

Methodolomical Generic  !

l This study was successful in developing a methodology to The results from this study appear to indicate that the core 'i estimate the risk (i.e., the core damage frequency) associated !amage frequency associated with operating in POS S during with the operation of a BWR during low power and shutdown a refueling outage is less than that from operating at full ,

' conditions. The methodology developed and the lessons power. While this should be true for Grand Gulf, learned from its application provide the NRC with new tools generalizations to other BWRs should be perfonned with thit could be used in subsequent analyses. cere.

The event tree models developed for the analysis of POS 5 Two factors that should be considered during any 1 were more complicated than the full-power models because. generalization are given the lower decay heat load, there are many options for removing heat and keeping the core covered. In addition, (1) Does the other BWR have a motor-driven high-I more initiating events must be considered because of the pressure pump? The availability of such a pump systems that are nonnally operating to keep the plant within provides a mechanism for injecting water at high desired temperature and pressure parameters. pressure, if necessary, and also prosides an alternative means ofinjecting water at low The mean CDF for each of the intemal and external analyses pressure should the low-pressure pumps fail.

presented in this report includes the fraction of time the plant

'is in POS 5 during a refueling outage. If one wanted to (2) Does the other BWR have procedures in place to present the results as a conditional CDF (i.e., conditicmal on deal with the loss of the normal decay heat the plant being in POS 5), then the results should be divided removal system? If the procedures do exist, does by the value assigned to the POS 5 event. Thus, for example, the utility require that the systems and components for the Total Plant Model for the traditional intemal events necessary fc the procedure be available?

analysis, the conditional CDF is (2E-6)/0.031 = 6.5E-5 per 1

year in POS 5. Ilowever the conditional CDF on a per year i Vol I ' 23 NUREG/CR-6143 i

these insigits were developed and/or identified can be found 6.2 Level 2/3 Conclusions in SAND 94-2949.

The following conclusions can be drawn from this study:

6.3.1 Insights from LOCAs e With many plant features unavailable to mitigate a 6.3.L1 CDFInsights release, the potential exists for a large release of radioactive material should core damage occur. The LOCAs that were analyzed in the LP&S project can be For the most likely accidents, the containment is grouped into two categories. These are LOCAs during open, the suppression pool is byppui, and the nonhydro conditions (i.e., at atmospheric pressure) and containment sprays are not available. during hydro conditions (i.e., at approximately 1000 psi).

The accident sequences in the LOCA class are driven by e In the event that the containment is closed prior to events that result in the loss of multiple systems:

the onset of core damage, it is always predicted to fail since containment heat removal was not 1. Failure of the operators to dump the suppression available in the accidents analyzed. pool makeup (SPMU), resulting in loss of all ECCS, and e The risks from POS 5 are not insignificant compared with the risks from full power 2. Flooding in the auxiliary building as a result of the operation. llence the full-power risk distributions perators failing to close the lower personnel lock.

by themselves do not completely characterize the From a CDF viewpoint, concerns about the value used for the nsks associated with the operation of tlus plant, initiating event frequency of the nonhydro LOCAs in POS 5 To accurately characterize the plant's results from would be immaterial if the automatic actuation of the SPMU this study suFgests that it may be necessary t system were functional. Automatic actuation of the SPMU include other modes of operation in addition to the would most likely eliminate all LOCAs. Ilowever, given that full-power mode. This can have important this system is deactivated in POS 5 for the physical safety of implications for assessments that rely on the total the workers, elimination of the low-pressure LOCAs reduces nsk from a plant, such as when comparisons are the fractional contribution of the LOCAs to the total CDF by made with the safety goals.

about a factor of 2. More important, elimination of the low-pressure LOCAs reduces the early fatality risk attributed to e Although only a simplified scoping study of the LOCAs by about a factor of 80. This is expected because onsite consequences was performed, the possible low-pressure LOCAs occur in time windows I and 2, and, onsite consequences of an accident during generally speaking, these affect early fatality risk more than shutdown could be significant, panicularly since time window 3 sequences.

m many of the accidents the containment remains open allowing for an early release of radioactive Changes in procedures that would allow more credit to be material. given to the operators during the human reliability analysis for controlling injection systems, specifically the high 6.3 Insights from POS 5 pressure core spray OIPCS) system, would provide some reduction in the importance of the LOCA class from a CDF This section presents insights for POS 5 as documented in and total latent cancer risk point of siew, however, since this SAND 94-2949 [Whitchead et al ,1994b]. All insights change affected only accidents in time window 3 (sequences presented here are derived from observations made on the in time windows I and 2 were unaffected because the llPCS specific results in the traditional intemal events, the specific system is unavailable in the cut sets that survived the phase 2 models and assumptions used in the LP&S analyses, selected analysis), no significant change would be expected in the sensitivity studies that made modifications to the models and early fatality risk measure.

cssumptions, selected results from the full-power analysis, 03,1,2 msk In: Wits and the experience of the analysts who perfonned the original LP&S study. These insights will be discussed from both a When considered as a group, LOCA accidents are not on vertical (i c., withm a specific observation) and horizontal average the most imponant contributor to early fatality risk.

(i c., across many observations) viewpoint-They are, however, an important contributor to the total latent The reader should be aware that these insights are for POS 5 at Grand Oulf. As such, this infonnation should not be

• The LOCA group is not on average the most generalized to other nuclear power plants without first important contributor to early fatality risk because considering all relevant factors. Complete details on how the most probable LOCA accidents occur while the NUREG/CR-6143 24 Vol.1

s- _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ._ _ _ _ . __ - _

plant is in time window 3 (approximately 40 days 6.3.2 Insights from Station Blackouts after shutdown), by which time radioactive decay has significantly reduced the inventory of short-lived 6.3.2.1 CDFInsights radionuclides that are important in early health effects.  !

The SBO sequences are driven by events that result in the J

• The LOCA group is an important contributor to total I ss of multiple systems. For example, the loss of onsite ac  !

latent cancer fatality risk hecause it is an important Power prevents the use of all systems except the diesel.

contnbutor to the core dariage frequency and driven firewater pumps. The use of firewater was because accidents from tha group release a unsu cessful in these accidents which were grouped into the f U wing thme classes:

considerable amount of radioactive material into the  ;

environment (primarily long-lived radionuclides that i are important in latent health effects). 1. Insuflicient time for the operators to align and use the pumps before battery d:pletion. .

The releases associated with the LOCA have the potential to .

be relatively large because all of the accidents progress to full 2. Suflicient time for operators to use the pumps, but core damage and vessel failure, and many of the plant they fail.

features that can be used to mitigate the release are  !

unavailable or bypassed. 3. Operators successfully align and begin use of the ,

pumps, but the batteries deplete, the SRVs close, The containment is ineffective as a barrier to the and injection is lost as the reactor vessel pressure release of radioactive material during accidents maeasa '

initiated by a LOCA because the equipment hatch and personnel airlock remain open. This occurs

• In this third class, a distinction was made l when the operators fail to recognize the need to close between those sequences where the pumps the lower personnel airlock before core damage ran long enough to allow either the #8 or starts. #9 is lation valves to be closed. If either of the valves was closed, then no interfacing ,

The radioactive material released from the damaged system LOCA occurred. If the isolation fuel in the vessel bypasses the suppression pool and, valves were not closed, the decay heat hence, is not attenuated by the scrubbing properties removal systan faded on overpressum, of the pool. The containment spray system fails and [esulting in an interfacing systems LOCA cannot be recovered during the accident. m the auxiliary building.

Two features of the accident that can mitigate the release to Results from the sensitivity calculation where it was assumed the environment are the flooded containment and the passage that the SRVs could be either opened or kept open given a t of the release through the auxiliary building. loss of de power show that the ability to open or keep open i

the SRVs is relatively important-the mean fractional o While the vessel is always predicted to fail and release contnbution of the SBO sequences changes from 0.33 to core debiis into the pedestal cavity, there is a significant 0.10, indicating that approximately 23% of the total CDF -

probability that the core debris will be quenched in the comes from SBO sequences involving dependence on the casity. For those accidents in which the core debris is SRVs and thus de power. In addition, the sensitisity not quenched, the releases that accompany the calculation gives an indication of the importance of the interactions between the core debris and the concrete operator action associated with use of the diesel-driven ,

structures will be scrubbed by an overlying pool of firewater pumps. Failure to successfully align and use the water. Hence, the flooded containment can attenuate the firewater system contributes about 10% to the total mean late release of radioactive material by either preventing CDF.

core-concrete interactions or by scrubbing the releases that accompany CCI in the event that the core debris is 6.3.2.2 Risk Insights not quenched.

Station blackout accidents, when considered as a group, are o

The passage of the release through the auxiliary buildm8 an important contributor to both early fatality risk and to total will also attenuate the release; owing to its size, the latent cancer fatality risk. The SBO group is an important auxiliary buildmg can act as a large holdup volume. contributor to these risks because: i allowing time for natural processes to remove airbome material from the building atmosphere.

Vol. I 25 NUREG/CR-6143 l

i J

• The group is a major contnbutor to the core damage One of the few plant features available to attenuate the frequency. release of radioactive material in these accidents is the auxiliary building. Since the containment is open and the

- ne probability that core cooling is restored and the break in the decay heat removal system is located in the core damage process arrested is fairly small. The auxiliary building, all of the release passes through the factor that is primarily responsible for this low building before escaping to the environment.

probability is the relatively low probability of recovering offsite ac power before significant core 6,3.3 Insights from Other damage has occurred. 11ence, the most likely situation is that the accident progresses to full core 6.3.3.1 CDFInsights damage and vessel failure.

• Since the containment is not flooded, the core debris Accident sequences in the Other class were grouped into released from the vessel will almost always interact three classes:

with the concrete stmeture below the vessel and continue to release radioactive material. In these 1. Flooded containment, SBO accidents, these interactions rarely occur under 2. Open main steam isolation valves (MSIVs), and  ;

a pool of water and, therefore, the releases that 3. L ss of all standby service water (SSW). l accompany these interactions will typically not te scrubbed by an overlying pool. Within each of these classes, some event (or assamption) causes failure of several of the systems that might be used to

• There are very few plant features available to respond to the accident.

attenuate the release of radioactive material from the damaged fuel and core debris.

• For the first two, the water coming out of the flooded containment or the open MSIV is assumed to fail the

. The containment remains open during the remaining core cooling systems.

entire accident. Closing the containment requires offsite ac power, and ac power

• For the third, the loss of all SSW fails all emergency was not available before core damage core cooling systems.

started.

All of the sequences in the first class involved an empty

. Owing to the configuration of the plant and suppression pool-based on an assumption made in the the nature of the accident, radioactive LP&S analysis. If the sequences in this class are climinated material bypasses the suppression pool- from the Other class, then the mean CDF for the Other class The unisolated break in the decay heat decreases by about a factor of 10. Ilowever, the total POS 5 removal system and the open reactor vessel mean CDF decreases by only a factor of 1.2 since the mean head vent both a!!ow material released from contributian of this class to the total CDF is only 17%. This the damaged fuel in the vessel to bypass the implies that while water in the suppression pool is important suppression pool. The open drywell to the Other class, it is not important to a change in the total equipment hatch and personnel airkick mean CDF for POS 5.

allow airborne radioactive material in the drywell to bypass the suppression pool.

6.3.3.2 Risk In Ights

. Owing to system failures and the fact that containment pressure control is not an issue When considered as a group, the Other accidents are not on when the containment is open, the average the most important contributor to either early fatality containment sprays were not used during risk or to the total latent cancer fatality risk. This stems the accident and, hence, airbome primarily from the fact that the Other group is not on average radioactive material was not scrubbed by the most important contributor to the core damage frequency the sprays. and the consequences from these accidents are not large enough to compensate for the relatively low core damage

• All of the SBO accidents occur while the plant is in frequency. This is not to say that the relee+cs are negligible.

time windows 1 and 2 when there is still a significant While many different types of progressions can be found in inventory of radionuclides that sre important in early this group, some common characteristics of these accidents health effects. include:

NUREG/CR-6143 26 Vol. I

t

• Core cooling is never restored and, hence, all of the an interfacing system LOCA except when power is lost to the accidents progreis to full core damage and vessel isolation valves, as is the case during the SBO sequences.  ;

failure.

Operator actions play a significant role both in the

• The containment is either open during the entire progression of the accident sequences and in the estunate of ,

accident or ifit is closed before the core is damaged, the CDF associated with the sequences. Generally speaking, l

it is either vented or fails during the accident. The operator actions in POS 5 tend to be more involved and/or  !

, principal reason the containment becomes complex from a diagnosis viewpoint.

l pressurized is that containment heat is not removed; ,

hydrogen combustion and loads that accompany Only sequences that resulted in a loss of vessel inventory failure of the reactor vessel at high pressure also survived in time window 3. The major reason is that the contribute to containment failure. decay heat load in time window 3 is small enough that only with a loss of water fmm a break or diversion will core

• All the accidents occur while the plant is in time damage occur within the 24-hour mission time used in the

' windows 1 and 2 and, thus there are enough short- LP&S project.  :

lived radionuclides to cause early fatalities. l 6.3.4 GeneralInsights in these accidents, the containment is not effective as a 6.3.4.1 CDFInsights barrier against the release of radianctive material. While it is a common characteristic of all of these accidents that the The sequences that survive generally contain some event or c ntainment is an ineffective barrier, the reasons that lead to events that result in the failure of multiple systems.

this characteristic vary across the accidents.

Examples of this are

• For LOCAs - The failure of the operators to

• For accidents where the containment is flooded (LOCAs and some of the Other accidents), it is the dump the suppression pool makeup system results in the loss failure of the operators to close the lower personnel I ek that leads to the containment being open during of all ECCS injection systems.

the entire accident.

Flooding of the auxiliary building, as a result offailure to

• For SBO accidents, it is the fact that offsite ac close the personnellock,is power is not available prior to core damage that assumed to result in loss of all causes the containment to remain open for the remaining core cooling systems. duration of the accident. .

• For SBOs - The failure ofonsite ac power

• For the few accidents where the contamment is climinates allinjection sources isolated before the onset of core damage, it is the except for the diesel-driven lack of containment heat removal that is the firewater system. principal cause for containment venting or failure; hydrogen combustion events and loads that .

Requiring the availability of SRVs during POS 5 allows for accompany failure of the reactor vessel at high i additional cooling options and thus requires that something pressure also contribute to containment failure. I cuts across multiple system boundaries to result in core damage. This is in part what contributes to the relatively Isolation of the containment is not sufficient to prevent a i small CDF estimate obtained by the LP&S project. release to the environment. Owing to the relatively low design strength of the containment and the venting ,

'Ihe presence of a motor-driven high-pressure system also procedures used at the plant, containment heat removal and  !

contributes to the relatively small CDF estimate. This is true hydrogen control must also be prosided to nummize the i even afler taking into account this system's sometimes likelihood of a release to the environment. Even with these significant unavailability, primarily because the motor-driven systems available, energetic loads accompanying the failure pump, when available, can be used in many situations where of the vessel at high pressure and energetic fuel-coolant a turbine-driven pump could not be used. interactions can threaten the contamment. Nevertheless, without heat removal and hydrogen control, containment Automatic isolation of the low-pressure piping on high failure is only delayed; it is not prevented.

pressure during POS S effectively eliminates the problem of Vol.1 27 NUREG/CR-6143

t:

As illustrated by SBO accidents, in addition to the difliculty 7. References of closing the containment equipment hatch, it may be difficult to isolate all penetrations when oc power is not available because valves that were open before the initiating [ Brown et al.,1990] T. D. Brown et al.," Evaluation of event may " fail" in the open position. This concern is not as Severe Accident Risks: Grand Gulf Unit 1,* NUREG/CR-acute during full-power operation since all of the low.

pressure components are already isolated from the primary 4551, SAND 86-1309, Vol. 6,

. system. Furthermore, the remaining valves that must be Rev. I, Sandia National Laboratories, December 1990.

isolated dunng power operation will typically ' fail closed" on complete loss of power.

[ Brown et al.,1992] T. D. Brown et al. " Integrated Risk Assessment for the LaSalle By the time the core is damaged, enough failures have Unit 2 Nuclear Power Plant,"

occurred (both hardware and operator) that the probability of NUREG/CR-5305, SAND 90-recovering core cooling and arresting the damage process in ,

2765, Vols.12, Sandia National '

the vessel is relatively low. The most likely situation is that Laboratories, August 1992.

core cooling is not restored and the accident progresses to full core damage and vessel failure.

[Chanin et al,1993] D. Chanin et al.,"MACCS i Version 1.5.11.1: A Maintenance Many of the plant features that can mitigate the release of Release of the Code,"

radioactive material that accompanies a severe accident are NUREG/CR-6059, SAND 92-cather bypassed or unavailable. In all these accidents, the 2146, Sandia National containment is ineffective as a barrier to the release of Laboratories, Albuquerque,NM, radioactive matenal; the containment sprays are either October 1993' unavailable or are not used, and in most of the accidents the radioactive matenal released from both the damaged fuel in .

[Dr uin et al.,1989] M. T. Drou.m et al., " Analysis of the vessel and the core debris released from the vessel bypass Core Damage Frequency: Grand the suppression pool. Both the containment sprays and the Gulf, Unit 1 Internal Events,"

water pools have in the past been demonstrated to be NUREG/CR-4550, SAND 86-effective devices for scrubbing radionuclides from the 2084, Vol. 6. Rev.1, Part 1 containment atmosphere.

September 1989.

The auxiliary building can play an important role in [EPRI,1989] Electric Power Research attenuating the release and reducing the risk to the offsite Institute,"Probabilistic Seismic population. Since in most of these accidents the containment Hazard Evaluations at Nuclear is either open or bypassed, and many of the plant features Power Plant Sites in the Central used to mitigate a release are bypassed, the auxiliary building and Eastern United States:

is one of the few plant features available to reduce the Resolution of the Charleston release Earthquake Issue," Prepared by Risk Engineering Inc., Yankee Compared with accidents that occur while the plant is in time Atomic Power Company and windows I and 2, accidents in time window 3 result in Woodward Clyde Consultants, relatively few early fatalities since by this time radioactive EPRI Report NP-6395-D, April decay has significantly reduced the inventory of short-lived 1989.

radionuclides that are important in early health effects.

[ Harper et al.,1992] F. T. Harper et al.,' Evaluation of Owing to the sparse population around the plant, relatively Severe Accident Risks:

rapid evacuation, and the slow progression of the accident, Quantification ofMajorInput nearly all of the early fatalities will occur in the fraction of the Parameters: Experts' j population that does not leave the evacuation zone. This Determination of Source Term  ;

parameter--the fraction of the population that does not Issues," NUREG/CR-4551, Vol. l evacuate-can have a significant impact on the number of 2, Rev.1 Part 4, Sandia National early fatalities; it has a relatively minor effect on the number Laboratories, June 1992.

oflateni cancer fatalities.

NUREG/CR-6143 28 Vol. I i

1

[Iman et al.,1990] R. L. Iman et al.,' PARTITION: [ Whitehead et al.,1991] D. W. Whitehead, J. L Darby, B.

' A Progrvn for Defining the D. Staple, B. Walsh T. M. Hake, Source Term / Consequence and T. D. Brown, 'BWR Iow Intedace in the NUREG-1150 Power and Shutdown Accident Probabilistic Risk Assessments," Frequencies Project, Phase 1 -

NUREG/CR-5262, SAND 88- Coane Screening Analysis," Vol.

2940, Sandia National 1, Draft Letter Repod, Sandia Laboratories, May 1990. National Laboratories and Science and Engineering Associates,Inc., November 23,

[Jow et al.,1993] II. N. Jow et al., "XSOR Code 1991 update, Copy available at

, User's Manual," NUREG/CR. the NRC Public Document

! 5360, SAND 89-0943, Sandia Room.

National Laboratories, November 1993. [ Whitehead et al.,1994a] D. W. Whitehead et al.,

" Evaluation of Potential Severe

[ Russell et al.,1992] K. D. Russell et al., " Integrated Accidents During low Power i Reliability and Risk Analysis and Shutdown Operations at System (IRRAS) Version 4.0." Grand Gulf, Unit 1 Main Report NUREG/CR-5813. EGG-2664, (Sections 1-9)," NUREG/CR-January 1992. 6143, SAND 93-2440. Vol. 2, Part I A, Sandia National

[USNRC,1989] USNRC,' Severe Accident Laboratories, June 1994.

Risks: An Assessment forFive j

U.S. Nuclear Power Plants," [ Whitehead et al.,1994b] D. W. Whitehead. T. D. Brown,  ;

NUREG-1150, June 1989. and J. A. Forester," Observations I andinsights fromlowPower and

[Sobel,1993} P. Sobel," Revised Livennore Shutdown Studies: Grand Gulf Seismic IInzard Estimates for 69 Nuclear Power Plant During l Nuclear Power Plant Sites East POS 5 of a Refueling Outage," I

^

of the Rocky Mountains," SAND 94-2949, Sandia National NUREG-1488 (drafi), October Laboratories,1994.

I993.

[USNRC,1990] U. S. Nuclear Regulatory Commission," Severe Accident l

Risks: An Assessment for Five U. S. Nuclear Power Plants,'

NUREG-1 I50, Vols.1-3, December 1990, January 1991.

I t [V. Ilo et al.,1991] V.11o et al., 'COMPBRN I!!c.  ;

An Interactive Computer Code l

forFireRisk Analysis,'EPRI l NP-7282 May 1991. l l

Vol. I 29 NUREG/CR 6143 i

f;3$

j J Kiyoharu Abe _ Ephraim Asculai j,

. Dept.cof Reactor-Safety Research Division'of Nuclear Safety L Nuclear Safety Research Center Wagramestrasse, 5-Tokai Research Establishment P.O. Box 100 JAERI. A-1400 Wien Tokai-mura, Naga-gun AUSTRIA Ibaraki-ken, iJAPAN Vladimar Asmolov r

_ Head, Nuclear Safety Department' f Sarbes Acharya- I. V. Kurchatov Institute' K Department of Energy .

of Atomic Enegry-NS-1/FORS .

Moscow,. 123181 Washington, DC 20585 RUSSIA Dr. Ulvi Adalioglu J. de Assuncao Cekmece Nukleer Arastraima ve Cabinete de Proteccao e Egitim Herekezi . Seguranca Nuclear P.K. 1 Ministerio da Indusstria Havaalani/ ISTANBUL Ave. de Republica 45-6' TURKEY 1000 Lisbon PORTUGAL Dr. Eng. Kiyoto Aizawa Senior Engineer H.P. Balfanz,. Head Reactor Eng. Dev. Department Institute of Probabilistic PNC. .

Safety Analysis 9-13, Chome. Akasaka TUV Nord Minato-K, Tokyo Grosse Bahnstrasse 31 JAPAN D-22525 Hamburg 54 GERMANY Harry Alter Manager Applied Tech Pat Baranowsky Nuclear Systems Tech USNRC-AEOD/TPAB NE-46 MS: T-4A9 US DOE Washington, DC 20585 l Robert A. Bari, Deputy Chairman i .

Dept of. Nuclear Energy R.M. Andrews Bldg 197C Nuclear Installations Insp. Brookhaven National Laboratory St. Peters House Upton, NY 11973 Balliol Raod, Bootle Merseyside L20 31Z UNITED KINGDOM Librarian l Technical Information Section-L Battelle Pacific Northwest Lab George Apostolakis P. O. Box 999 UCIA Richland, WA 99352 Boelter Hall, Room 5532

=Los Angeles, CA 90024-1597 Dr. John Baum Dept of Nuclear Energy Director of Reactor Engineering Radiological Sciences Div Argonne National Laboratory Bldg 703 M-9700 S Cass Ave Brookhaven National Laboratory Bldg 208 Upton, NY 11973 Argonne, IL 60439' Dist-1

Eric Beckjord Dennis Bley USNRC-RES/DO Buttonwood Consulting MS: T-10F12 17291 Buttonwood St.

Fountain Valley, CA 92708 Robert Bernero USNRC-NMSS/DO Roger Blond MS: T-BA23 Booz-Allen & Hand 1 ton 4330 East West Highway Bethesda, MD 20814 Andrea Besi Institute for Systems Engineering and Informatics M. P. Bohn CEC Joint Research Centre Division 6449 CP N 1 Sandia National Laboratories 1-21020 Ispra (Varese) Albuquerque, NM 87185 ITALY Dr. Mario Bonaca John Bickel Manager, Reactor Engineering Idaho National Engineering Lab. Northeast Utilities EGGG MS: 3850 P.O. Box 270 P.O. Box 1625 Hartford, Conn. 06141 Idaho Falls, ID 83415 Robert B. Borsum  !

Vicki Bier Nuclear Power Division Dept. of Industrial Engineering B & W Nuclear Tech University of Wisconsin-Madison 1700 Rockville Pike 1513 University Avenue, Room 389 Suite 525 Wisconsin, WI 53706 Rockville, MD 20852 Scott Bigelow Stephen Boult S-CUBED Electrowatt Engineering Services 2501 Yale SE, Suite 300 (UK) Ltd.

Albuquerque, NM 87106 Grandford House 16 Carfax, Horsham West. Sussex RH12 IUP Prof. Dr. Dr.-Ing. E. H. Adolf ENGLAND Birkhofer Gesellschaft for Anlagen und Reaktorsicherheit (GRS) mbH Gary Boyd

• Forschungsgelande Safety & Reliability Optimization D-8046 Garching Services Federal Republic of Germany 9724 Kingston Pike, Suite 102 '

Knoxville, TN 37922 David Black American Electric Power Brookhaven National Laboratory (2) 1 Riverside Plaza Attn: Lev Neymotin Columbus, OH 43215 Arthur Tingle Building 130 Upton, NY 11973 Harold Blackman Idaho National Engineering Lab.

EG&G MS: 3850 David M. Brown ,

P.O. Box 1625 Paul C. Rizzo Associates, Inc.  !

Idaho Falls, ID 83415-3850 300 Oxford Drive Honroeville, PA 15146-2347 Dist.2 l

a Tom D. Browr. A. L. Camp Sandia National Laboratories Division 6412 Dept, 6413 MS: 0748 P.O. Box 5800 Sandia National Laboratories Albuquerque, NM 87185 Albuquerque, NM 87185-0748 Robert J. Budnitz John Forbes Campbel Future Resources Associates, Inc. HM Superintending Inspector 2039 Shattuck Avenue, Suite 402 Health & Safety Executive Berkeley, CA 94704 St. Peter's House Balliol Road Bootle L20 31Z Gary Burdick UNITED KINGDOM USNRC-RES/SAIB MS: T-10F13 Leonel Canelas New University of Lisbon Arthur Buslik Quinta de Torre USNRC-RES/PRAB 2825 Monte de caparica MS: T-9F31 PORTUGAL Edward Butcher Harold Careway USNRC-NRR/SPSB General Electric Co., M/C 754 MS: 0-10E4 175 Curtner Ave.

San Jose, CA 95129 Te.hnical Library B&W Nuclear Service Co D. D. Carlson P. O. Box 10935 Division 6411 Lynchburg, VA 24506 Sandia National Laboratories Albuquerque, NM 87185 Stefaan Caeymaex Safety & Systems Section Jose E. De Carlos Nuclear Generation Dept. CSN International Coordinator TRACTEBEL Consejo de Seguridad Nuclear Avenue Ariane 7 Calle Justo Dorado 11 B-1200 Bruxelles 28040 Madrid BELGIUM SPAIN Leonard Callan, Administrator Annick Carnino U.S. Nuclear Regulatory Commission International Atomic Energy Agency Harris Tower and Pavilion Wagramerstrasse 5, P.O. Box 100 611 Ryan Plaza Drive, Suite 400 A-1400 Vienna Arlington, TX 76011-8064 AUSTRIA J. Calvo S. Chakraborty Division of PSA & Human Factors Swiss Federal Nuclear Safety Consejo de Seguridad Nuclear Inspectorate Calle Justo Dorado, 11 Hauptabteilung for die Sicherheit 20040 Madrid der Kernanlagen SPAIN CH-5232 Villigen-HSK SWITZERLAND Erulappa Chelliah USNRC-RES/PRAB MS: T-9F31 Dist-3

y r

Mike Check S. Daggupaty j NUS .

Environment Canada

' 910 Clopper Road 4905 Dufferin Street Gaithersburg, MD 20878 Downsview Ontario, M3H ST4 CANADA Nilesh Chokshi USNRC-RES/SSEB MS: T-10L1 Louise Dahlerup Inspectorate of Nuclear Inst.

Danish Civil Defense & '

T. L. Cha Emergency Planning Agency Brookhaven National Laboratory 16, Datavej Department of Nuclear Fnergy DK-3460 Birkerod l Bldg. 130 DENMARK l Upton, NY 11973 l

l John Darby I

( Peter Cooper SEA, Inc.

l-j SRD/AEA Technology 6100 Uptown Blvd. NE Wigshaw Lane Albuquerque, NM 87110 Culcheth Cheshire WA3 4NE I England Gerald Davidson Fauske and Associates, Inc.

16 W 070 West 83rd Street

'I

)

Susan E. Cooper Burr Ridge, IL 60521 Science Applications Int'l. Corp.

11251 Roger Bacon Drive Reston, VA 22090 Peter Davis PRD Consulting P.O. Box 2046 Michael Corradini Sheridan, WY 82801 University of Wisconsin 1500 Johnson Drive Madison, WI 53706 P. De Gelder Secretary, BELGIAN NUCLEAR SOCIETY (BNS)

E.R. Corran A V Nuclear ANSTO Reasearch Establishment Avenue du Roi 157 Lucas Heights Reserch Labs. B-1060 Brussels Private Mail Bag 1 BELGIUM Manai, NSW 2234 AUSTRALIA Lennart Devell Studsvik Nuclear Massimo Cozzone Studsvik Energiteknik AB A.N.P.A. S-611 82 Nykoping Via V. Brancati, 48 SWEDEN I-00144 Rome

- ITALY J. Devooght Service de la Metrologie Nucl George Crane University Libre de Bruxelles 1570 E. Hobble Creek Dr. Faculte des Sciees Appliqu.

Springville, Utah 84663 50 Avenue F-D Roosevelt Bruxelles 5 BELGIUM Mark Cunningham USNRC-RES/PRAB MS: T-9F31 Dist-4

\

+,

')

G. Diederick John Flack

~ Commonwealth Edison Co. USNRC-RES/SAIB 1

-LaSalle County Station MS: T-10F13 RR1, Box 220 2601 North 21st Rd.

, 'Marsielles,-IL 61341 Karl Fleming Pickard, Lowe & Garrick

'2260. University Drive-

' Chuck Dobbe . Newport Beach, CA 92660.

Idaho National Engineering. Lab.

'EGEG MS: 3840

-P.O. Box 1625 Terry Foppe

. Idaho Falls, ID 83415 Safety Analysis Engineering Rocky Flats Pla c Energy. Systems Group Mary Drouin. Rockwell International' Corp USNRC-RES\SAIB P.O. Box 464 MS:'T-10F13 Golden, CO 80401 Duke Power Co. (2) R H. Gauger Attn: Duncan Brewer' Manager-Reliability Engr Steve Deskevich A/E Div 422 South Church Street . Holmes & Narver Inc.

Charlotte, NC 28242 R Roanne Circle Irvine, CA 92714 Bill Eakin Northeast Utilities Robert Gobel Box 270 Clark University Hartford, CT 06141 Center for Technology, Environment and Development.

950 Main St.

Stewart D. Ebneter Worcester,'MA 01610-1477 USNRC 101 Marietta St., Suite 2900 Atlanta, GA 30323-0199 Faul Govaerts Studiecentrum voor Kernenergie (SCK/CEN)

Adel A. El-Bassioni Boeretang, 200 USNRC-NRR/PRAB B-2400 Mol-MS: 0-10E4 BELGIUM ENEA/ DISP'(2) Mr. Gubler Attn: Alvaro Valeri International Atomic Energy Agency

(~ Alfredo Bottino NENS/ SAD B0842 Via Vitaliano Brancati, 48 Wagramerstrasse 5, P.O.~ Box.100-

.00144 Roma EUR A-1140 Vienna ITALY AUSTRIA

-2 LWalter P. Engel Paul M. Haas, President

.PRAG MGR Analysis & Reg Matter Concord Associates, Inc.

'NE-60 725 Pellissippi Parkway CRYCITY- Suite 101, Box 6 6-'

US DOE Knoxville, TN 37933 Washington, DC 20585 I

Dist 5

F._T. Harper Steven Hodge Division 6413 Cak Ridge National Laboratories MS: 0748 P. O. Box Y Sandia National Laboratories Oak Ridge, TN 37831 Albuquerque, NM 87185-0748 Gary Holahan Dr. U. Hauptmanns USNRC-AEOD/OSP Gesellschaft for Anlagen und MS: T-4A9 Reaktorsicherheit (GRS) mgH Schwertnergasse 1 D-5000 Koln 1 N.J. Holloway GERMANY A72.1 Atomic Weapons Establishment Ademaston Sharif Heger Reading RG7 4PR UNM Chemical and Nuclear UNITED KINGDOM Engineering Department Farris Engineering, Room 209 Albuquerque, NM 87131 Griff Holmes Westinghouse Electric Co.

Energy Center East' )

Jon C. Helton Bldg. 371 Dept. of Mathematics P.O. Box 355 Arizona State University Pittsburgh, PA 15230 Tempa, AZ 85287 William Hopkins Dr. P. M. Herttrich Bechtel Power Corporation Gesellschaft fur Anlagen und 15740 Shady Grove Road Reaktorsicherheit (GRS) mbH Gaithersburg, MD 20877

'Schwertnergasse 1 5000'K61n 1 GERMANY Dean Houston USNRC-ACRS MS: P-315 Dr. D.J. Higson ,

Radiological Safety Bureau Australian Nuclear Science & Der-Yu Hsia ,

Technology Organisation Institute of Nuclear Energy Research P.O. Box 153 Lung-Tan 325 ,

Roseberry, NSW 2018 TAIWAN AUSTRALIA Alejandro Huerta-Bahena ,

Dr. Mitsumasa Hirano National Commission on Nuclear Deputy General Manager Safety and Safeguards (CNSNS) '

Institute of Nuclear Safety Insurgentes Sur'N. 1776 NUPEC C. P. 04230 Mexico, D. F.

3-6-2, Toranomon, Minato-ku MEXICO

• Tokyo 108 f JAPAN l Peter Humphreys US Atomic Energy Authority Dr. S Hirschberg Wigshaw Lane, Culcheth Paul Scherrer Institute Warrington, Cheshire ]

Vurenlingen and Villigen UNITED KINGDOM, WA3 4NE i CH-5232 Villigen PSI

]

SWITZERLAND Dist-6 I

9

t

, W. Huntington Dr.-H. Kalfsbeek-

, Commonwealth Edison Co. DG/XII/D/1 LaSalle County Station-  : Commission of the European RR1, Box 220 Communities.

.2601 North 21st Rd. Rue de la Loi, 200 *

> < Marsielles, IL ,61341 B-1049 Brussels BELGIUM-J.S.-Hyslop-USNRC-RES/FRAB 'Yoshio Kano NS : ..T-9F31 ' ' General Mngr. & Sr. Engineer Systems Analysis'Section

_. O-arai Engineer.-Centr, PNC'

' Idaho National ~ Engineering Lab. (2)

Higashi-Ibaraki-gun.

- Attn: Doug Brownson Ibaraki-Ken, 133-13 Darrel Knudson JAPAN EG&G N3: 3840 O Box 1625

-P.'.

Idaho Falls, ID B3415 William Kastenberg UCLA-Boelter Hall, Room.5532-Idaho National Engineering Lab. (2i Los Angeles, CA 90024 L

Attn: Art Rood Mike Abbott EG&G MS: 2110 Barry Kaufer

.P.O. Box 1625 OECD/NEA l Idaho Falls, ID 83415 "Le Seine St. Germain" 12.

Boulevard des lies 92130 Issy-les-Moulineaux Hanspeter Isaak FRANCE Abteilung Strahlenschutz Hauptabteilung fur die Sicherheit der Kernanlagen (HSK)- Paul Kayser CH-5303 wurenlingen Division de la Radioprotection SWITZERLAND Avenue des.Archiducs, 1 L-1135 Luxembourg-Belair LUXEMBOURG Brian Ives UNC Nuclear Industries P. O. Box 490 Ken Keith' Richland, WA 99352 TVA W 20 D 201 400 West Surmnit Hill Kamiar Jamili Knoxville, TN 37092 DP-62/FTN Department of Energy Washington, D.C. 20585 G. Neale Kelly commission of the European Communities Robert Jones . Joint Research Centre

- USNRC-NRR/DSSA Rue de la Loi 200 MS: 0-8E1 B-1049 Brussels BELGIUM

' Edward Jordan USNRC-AEOD/DO HS: T-4D18 Knolls Atomic Power 'saboratory (2)

Attn: Ken McDonough Dominic Sciauaone Box 1072 Schenectady, NY 12301 Dist-7

Jose A. Lantaron Dr. K. Koberlein Consejo de Seguridad Nuclear Gesellschaft fur Sub. Analisis y Evaluaciones Reaktorsicherheit mbH Calle Justo Dorado, 11 Forschungsgelande 20040 Madrid D-8046 Garching SPAIN GERMANY Josette Larchier-Boulanger Alan Kolaczkowski Electricte de France

, Science Applications International Direction des Etudes Et Recherches Corporatien .

30, Rue de Conde 2109 Air Park Rd. S. E. 75006 Paris Albuquerque, NM 87106 FRANCE Jim Kolanowski H. Larsen Commonwealth Edison Co. Head of Department 35 1st National West Riso National Laboratory j chicago, IL 60690 P.O. Box 49 DK-4000 Roskilde DENMARK John G. Kollas Institute of Nuclear Technology and Radiation Protection Lawrence Livermore Nat'l Lab. (4)

N.R.C.P.S. "Demokritos" -Attn: George Greenly P.O. Box 60228 Marvin Dickerson GR-153 10 Aghia Paraskevi Rolf Lange Attiki Sandra Brereton GREECE Live rmo re, CA 94550 S. Kondo Shengdar Lee Department of Nuclear Engineering Yankee Atomic Electric Company Facility of Engineering 580 Main St.

University of Tokyo Boston, MA 17407 3-1, Hongo 7, Bunkyo-ku Tokyo JAPAN B.T.F. Liwaang Dept. of Plant Safety Assessment Swedish Nuclear Power Inspec.

D. Lamy P.O. Box 27106 CEN/SCK S-10252 Stockholm Dept. Scientific Irradiation SWEDEN Experiment & Study BR2 Boeretang, 200 B-2400 Hol Peter Lohnberg BELGIUM Expresswork International, Inc.

1740 Technology Drive San Jose, CA 95110 Dr. J.M. Lanore CEA/IPSN/DAS Steven M. Long Centre d' Etudes Nucleaires de USNRC-NRR/SPSB Fontenay-aux-Roses MS: 0-10E4 B.P. n' 6 92265 Fontenay-aux-Roses CEDEX FRANCE D. Eugenio Gil Lopez Consejo de Seguridad Nuclear calle Justo Dorado, 11 28040 Madrid SPAIN Dist-8

c: -:- --

l* i Los Alamos National Laboratory (2)

. Attn: Kent Sasser-. Andrew S. McClymont N-6, K-557 .

IT-Delian Corporation Los-Alamos,:NM 87545 1340 Saratoga-Sunnyvale Rd.-

Suite 206 San Jose, CA 95129 l Christiana H. Lui.

'USNRC-RES/PRAB.

MS: T-9F31 1 Michael McKay Los Alamos Natienal. Laboratory.

A-1, MS F600 Services ~

, John Luke P.O. Box 1663

- Florida Power & Light Los Alamos,'NM87545 P.O. Box 14000 Juno Beach, FL 33408 Zen Mendoza SAIC Daniel Manesse 5150 El Camino Real ISPN Suite'C3 1 Boite Postale n' 6 Los Altos, CA 94022 92265 Fontenay-aux-Roses CEDEX FRANCE Dr. J. Mertens Division of Risk Analysis &

Fred Mann Reactor Technology Westinghouse Hanford Co. Institute of Safety Research WIA-53 Research Centre Julich (KFA)

P.O.' Box 1970 D-52425 Julich Richland, WA 99352 GERMANY' Nadia'Soldo Falcao Martins Jim Meyer Comissao Nacional de Energia Nuclear Scientech

.R General Severianao 90 S/408-1 11821 Parklawn Dr.

Rio de Janeiro Suite 100 BRAZIL Rockville, PE) 20852 Harry F. Martz .

Joe Minarick Analysis and Assessment Division Science Applications Int'l Corp.

Los Alamos National Laboratory 301 Laboratory Road Los Alamos, NM 87545 P.O. Box 2501 Oak Ridge, TN'37830 Herbert Massin comnionwealth Edison Co. Jose I. Calvo Molins, Head 35 lat National West Division of P.S.A.'and Human Factors Chicago, IL 60690 Consejo de seguridad Nuclear Calle Justo Dorado, 11 28040 Madrid Hideo Matsuzuru SPAIN Tokai Research Establishment Tokai-mur Maka-gun Ken Muramatst)

Ibaraki-ken, 319-11 Risk Analysf. 2%oratt 'y JAPAN Japan Atomic Energy Research Institute-Tokai-mura,'Naka-gun Jim Mayberry Ibaraki-ken,~319-11, Tokyo Ebasco Services JAPAN 60.Chubb Ave.

Lyndhurst, NJ 07071 Dist-9

l Joseph A. Murphy N. R. Ortiz, Director Division of Safety Issue Resolution Nuclear Energy Technology U.S. Nuclear Regulatory Commission Division 6400 MS: T-10E50 Sandia National Laboratories Washington, DC 20555 Albuquerque, NM 87185 Kenneth G. Murphy, Jr. Robert Ostmeyer US Department of Energy U.S. Department of Energy 19901 Germantown Rd. Rocky Flats Area Office Germantown, MD 20545- P. O. Box 928 Golden, CO 80402 Shankaran Nair l Central Electricity Robert Palla I

Generating Board USNRC-NRR/SPSB Berkeley Nuclear Laboratories MS: 0-10E4 Berkeley b Gloucestrshire CLl3 9PB UNITED KINGDOM Gareth Parry NUS Corporation 910 Clopper Rd.

Ray Ng Gaithersburg, MD 20878 NEI 1776 Eye St. N Suite 300 Vern Peterson Washington, DC 20006-2496 Building T886B EG&G Rocky Flats P.O. Box 464 G. Niederauer Golden, CO 80402 Los Alamos National Laboratory P. O. Box 1663 MSK 575 G. Petrangeli Los Alamos, NM 87545 ENEA Nuclear Energy ALT Disp Via V. Brancati, 48 00144 Rome Oak Ridge National Laboratory (2) ITALY Attn: Steve Fisher i Sherrel Greene NS-8057 Ing. Jose Antonio Becerra Perez P.O. Box 2009 Comision Nacional De Seguridad

[ Oak Ridge, TN 37831 Nuclear Y Salvaguardias Insurgentes sur 1806 01030 Mexico, D. F.

Ken O'Brien MEXICO University of Wisconsin Nuclear Engineering Dept.

153 Engineering Research Blvd. William T. Pratt Madison, WI 53706 Brookhaven National Laboratory Building 130 Upton, NY 11973 Theresa Oh INEL Tech Library EG&G MS: 2300 Urho Pulkkinen P. O. Box 1625 Technical Research Centre of Idaho Falls, ID 83415-2300 Finland Laboratory of Electrical &

Automation Engineeering Otakaari 7B, 02150 Espoo 15 FINLAND Dist.10

~Blake Putney Marc Rothschild Science Applications Halliburton NUS

-International Corporation 1303 S. Central Ave.

5150 El Camino Real, Suite C31 Suite 202 Los Altoa, Ca 94022 Kent, WA 98032 Dr. V. M. Raina Christopher Ryder Project Manager-Risk Assessment USNRC-RES/PRAB Ontario Hydro H11 G1 MS: T-9F31 700 University Ave.

Toronto, Ontario MSG 1X6 CANADA Takashi Sato, Deputy Manager Nuclear Safety Engineering Section Reactor Design Engineering Dept.

William Raisin Nuclear Energy Group, Toshiba Corp.

NEI Isogo Engineering Center 1726 H. St. NW 8, Shinsugita-cho, Isogo-ku, Suite 904 Yokohama 235, JAPAN washington, DC 20036 Martin Sattison Ann Ramey-Smith Idaho National Engineering Lab.

USNRC-RES/PRAB P. O. Box 1625 MS: T-9F31 Idaho Falls, ID 83415 Dale Rasmuson Dr. U. Schmocker USNRC-AEOD/TPAB Hauptabteilung for die MS: T-4A9 Sicherheit der Kernanlagen CH-5232 villigen HSK SWITZERLAND John Ridgely USNRC-RES/SAIB MS: T-10F13 A.J. Seebregts ECN Nuclear Energy Westerduinweg, 3  ;

Richard Robinson (2) Postbus 1 USNRC-RES/PRAB NL-1755 Petten ZG MS: T-9F31 THE NETHERLANDS M. Roch Dr. S. Serra Manager of Design, Nuclear Ente Naxionale per I'Energia Department Electtrica (ENEL)

TRACTEBEL via G.B. Martini 3 Avenue Ariane 7 I-00198 Rome B-1200 Bruxelles ITALY BELGIUM A.E. Rogers H. Shapiro General Electric Co Licensing & Risk Branch 175 Curtner Ave Atomic Energy of Canada Ltd.

MC-489 Sheridan Park Research Comm.

San Jose, CA 95125 Mississauga, Ontario L5K 1B2 CANADA Judy Rollstin GRAM Inc 8500 Menual Blvd. NE 7

Albuquerque, NM 87112 l l Dist-11

i Nathan O. Siu Technadyne Engineer. Consultants (3)

Center for Reliability and Risk Attn: David Chanin Assessment Jeffery Foster Idaho National Engineering Lab. Walt Murfin EGEG MS: 3850 Suite A225 P.O. Box 1625 8500 Menual Blvd. N Idaho ralls, ID 83415-3855 Albuquerque, NM 87112 l

I E. Soederman Ashok Thadani ES-Konst t AB USNRC-NRR/ADT Energy ahd Safety MS: 0-12G18 P.O. Box 3096 S-16103 Bromma SWEDEN T. G. Theofanous University of California, S. B.

Department of Chemical and Nuclear Desmond Stack Engineering Los Alamos National Laboratory Santa Barbara, CA 93106 Group Q-6, Mail Stop K556 Los Alamos, NM 87545 Catherine Thompson USNRC-RES/SAIB Jao Van de Steen MS: T-10r13 KEMA Laboratories Utrechtseweg, 310 Postbus 9035 Soren Thykier-Nielsen NL 800 ET Arnhem Riso National Laboratory, THE NETHERLANDS Postbox 49 DK4000 Roskile DENMARK Eli Stern Israel AEC Licensing Div.

P.O. Box 7061 R. Toossi Tel-Aviv 61070 Physical Research, Inc.

ISRAEL 25500 Hawthorn Blvd.

Torrance, CA 90505 Dr. Egil Stokke Advisory Group Ennio Traine OECD Halden Reactor Project ENEL P C. Box 173 Via Vialiano, 48 N 4751 Halden 00144 Rome NORWAY ITALY Stone & Webster Engineering Corp Ulf Tveten Technical Information Center Environmental Physics Section A. Hosford Institutt for Energiteknikk 245 Summer Street Postboks 40 245/01 N-2007 Kjeller Boston, MA 02210 NORWAY Dennis Strenge US Department of Energy Pacific Northwest Laboratory Energy Library RTO/ 125 Room G 034/GTN P.O. Box 999 AD-622.1 Richland, WA 99352 Washington, DC 20585 Dist-12

i US Department of Energy Edward Warman NS-50 (GTN) Stone & Webster Engineering Corp.

NS-10.1 P.O. Box 2325 S-161 Boston, MA 02107 Washington, DC 20585 J.E. Werner U.S. Environmental Reactor Research & Techn Division Protection Agency (2) US DOE Idaho Operations Attn: Allen Richardson MS: 1219 Joe Logsdon 850 Energy Drive Office of Radiation Programs Idaho Falls, ID 83401-1563 Environmental Analysis Division Washington, DC 20460 Dr. Wolfgang Werner Safety Assessment Consulting GmbH Harold VanderMolen Veilchenweg 8 USNRC-RES/PRAB D 83254 Breitbrunn MS: T-9F31 GERMANY Dr. A. Valeri Westinghouse Electric Corp A.N.P.A. Technical Library Via Vitaliano Brancati, 48 P. O. Box 355 I-00144 Rome East 209 ITALY Pittsburgh, PA 15230 Magiel F. Versteeg Westinghouse Electric Corp Ministry of Social Affairs NTD and Employment Central File Nuclear Safety P.O. Box 90804 P. O. Box 355 2509 LV Den Haag 408 1-A THE NETHERLANDS Pittsburgh, PA 15230 Martin Virgilio Westinghouse Electric Company (3)

USNRC-NRR/DSSA Attn: John Lacovin MS: 0-8E2 Burt Morris Griff Holmes Energy Center East, Eldg. 371 R. Virolainen, (Chairman PWG5) P.O. Box 355 Systems Integ. Off. (STUK) Pittsburgh, PA 15230 P.O. Box 268 Kumpulanite 7 SF-60101 Helsinki Westinghouse Savannah River Co. (2)

FINLAND Attn: Kevin O'Kula Jackie East Safety Technology Section Seppo Vuori 1991 S. Centennial Ave., Bldg. 1 Technical Research Centre of Finland Aiken, SC 29803 Nuclear Engineering Laboratory Lonnrotinkatu 37 P.O. Box 169 Donnie Whitehead Sf-00181 Helsinki 18 Department 6412, MS: 0747 FINLAND Sandia National Laboratories t

P.O. Box 5800 I

Albuquerque, NM 87185-0747 Dr. Ian B. Wall 81 Irving Avenue Atherton, CA 94027 Dist.13

s 4

'KeithLWoodard. INTERNALDISTRIBUTION '

PLG, Inc.

7315 wisconsin Ave. MS0737.. M.P. Bohn,6449 suite-620 East MS0736 N.R.Ortiz,6400 Bethesda, MD 20814-3209 MS0747 A.L. Camp,6412

MS0747 V.J. Dandini,6412 John'Wreathall' MS0747 - S.L. Daniel,6412

. -John Wreathall &'Co. MS0747 - S.E. Dingman,6412 4157 MacDuff Way MS0747-- J.A. Forester,6412 Dubin, OH. 43017 MS0747 D.B. Mitchell,6412 MS0747 ILK. Schnner,6412 ~

MS0747 B.D. Staple,6412

,H. K. Yeung.

University of Hong. Kong-MS0747 ~- D.W. WhwaA 6412 (28)

MS0747 G.D. Wyss,6412'

' Mechanical Engineering Dept.

Polfulam MS0748 F.T. Harper,6413 HONG KONG MS0748 T.D. Brown,6413 MS0980 - L.N. Kmetyk,9225 MSI175 L.A. Miller,6513 -

Bob _Youngblood . . -

MS9018 Central Technical Files,8523-2

'Brookhaven National Laboratory MS0899 Technical Library,13414 (5) <

Department of Nuclear Energy MS0619 . Print Media,12615 Bldg. 130 i

,

-Upton, NY 11973.  !

i

Carlo Zaffiro A.N.P.A.

Directorate for Nuclear ,

Via Vitaliano Brancate, 48 r I-00144 Rome .!

ITALY. -i Dr..X. Zikidis i Greek Atomic Energy Comm.

i N.R.C.P.S. "Demokritos"

, GR-153:10 Agia Paraskevi or Attiki  ;

GREECE

-t t

4' b

'I 9

'i i

Dist-14

R p @ u 336 U.S. NUCLEAR REGULATORY COMMISSION 1. R TN E

,,,c.1 m -.e Aaa.a.,m N-*-,. w .w.

mi.22c2 ' BIBLIOGRAPHIC DATA SHEET is ;mr,ucre. ,n,,. r,,1 NUREG/CR-6143 SAND 93-2440 2.mtE ANo SUsuTLE Vol . 1 Evaluation of Potential Severe Accidents During Low Power 3. DATE REPOiqT PUBLISHED and Shutdown Operations at Grand Gulf, Unit 1 ~~m " ^a l

July 1995

4. FIN OR GRANT NUMBE R Summary of Results L1923

5. AUTHOR (S) 6. TYPE OF REPORT Edited by D. W. Whitehead Technical

7. PE R 100 COV E R E D tinctume pares)

8. PE RFORMING ORGANIZ AT SON - N AME AND ADDR ESS tar NRc.provum otenton. orrice er Re,non, v.s Nucmar Reevoorary commisuon, emt menons eddren tr eontractor.orovier none smf moutng edeens)

Sandia National laboratories Albuquerque, NM 87185

9. SPONSORING ORGANIZATSON - NAME AND ADORESS (t!NRC, tree '5ane as abo **'*;itcontraenor, provMr NRC okinson. O!!ke or Region. V.K Nacke Reenktory Commonnion.

cmr monke ed*ena,I Division of Systems Technology Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

10. SUPPLEMENTARY NOTES

11. ABSTR ACT (Jo0 =orm or mest This document contains a summarization of the results and insights from the Level 1 accident sequence analyses of internally initiated events, internally initiated fire and flood events, seismically initiated events, and the Level 2/3 risk analysis of internally initiated events (excluding fire and flood) for Grand Gulf, Unit 1 as it operates in the Low Power and Shutdown Plant Operational State 5 during a refueling outage. The report summarizes the Level 1 information contained in Volumes 2 - 5 and the Level 2/3 information contained in Volume 6 of NUREG/CR-6143.

12. KE Y WORDS/DESCRIPTOR S (Let more orphrases ther w#1mskt researrhws M Jocerme the report./ 13. AV AILA8ipi y SI ATEMENT Loe Power and Shutdown, Probabilistic Risk Assessment, PRA, Unlimited BBR, Plant Operational State, POS 5, Insights, Cold Shutdown, "ma' " c '^ =^ =

Grand Gulf, Internal Events, Fire, Flood, Seismic, Risk nYEiassified 4the Report)

Unclassified

15. NUMBER OF PAGES

16. PRICE NRC FORW 335 (2 89)

1 Printed on recycled Paper Federal Recycling Program

~'

RGREGERdbu43, Vol 1 ' " ' -- E t AND SHUTDOWN OPERATIONS AT GRAND GULF, UNIT 1:

SUMMARY

OF RESULTS 12C555139531 1 1AN UNITED STATES NUCLEAR REGULATORY COMMISSION hy [f PUBLICATIONS SVCS FIRST CLASS MAIL POSTAGE AND FEES PAID WASHINGTON D.C. 20555-0001 TOS-PDD-NUREG USNRc 2 'J F N - 6 E 7 WASHINGTON DC 20555 PERMIT NO. G 67 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE, $300

\

l

\,

I l

,