ML20100G279

Provides Specific Analysis That Applies Methodology Embodied in NRC RSS to Specific Design & Operating Experience of Oyster Creek Facility

ML20100G279
Person / Time
Site:	Oyster Creek
Issue date:	10/08/1976
From:	Paulson G NEW JERSEY, STATE OF
To:	Gossick L NRC COMMISSION (OCM)
Shared Package
ML20100F143	List: ML20100F160 ML20100F182 ML20100F185 ML20100F195 ML20100F197 ML20100F258 ML20100F262 ML20100F282 ML20100F287 ML20100F294 ML20100F348 ML20100F352 ML20100F359 ML20100F366 ML20100F374 ML20100F475 ML20100F526 ML20100G217 ML20100G279 ML20100G466 ML20100G473 ML20100G496 ML20100G505 ML20100G514 ML20100G519 ML20100G549 ML20100G558 ML20100G579 ML20100G591 ML20100G611 ML20100G620 ML20100G695 ML20105B001 ML20105B005 ML20105B301
References
FOIA-95-389 NUDOCS 9602230064
Download: ML20100G279 (35)

Text

n *, as .,

q <

~~ ~

Shde af Nem 3rrarg DEPARTMENT OF ENVIRONMENTAL PROTECTION TRIENToN 06625 omce or vue couims*' "*" October 8, 1976 Mr. L. V. Gossick Unites States Nuclear Regulatory Commission Washington, DC 20555

Dear Mr. Gossick:

As part of our effort to evaluate the need for land use restrictions around nuclear power plant sites in New Jersey (see the enclosed March 10th statement by Commissioner David J. Bardin),

we have commissioned a special analysis of the Oyster Creek nuclear power plant. This analysis, done by Peter R. Davis, basically applies the methodology embodied in the U.S. Nuclear Regulatory Commission's Reactor Safety Study to the specific design and operating experience of the Oyster Creek facility. The tentative interim conclusion in Mr. Davis' preliminary report is that the

- accident over the remaining antici-

[probabilityofacatasttophicpated lifetime of the Oyster Creek facility is approxii6Etiily~one in one hundren, TfX mTin determinant of this result, whT5hv recognize is a greater probability than one might expect, is the probability of the failure of the reactor to shut down after an anticipated transient.

We are circulating this preliminary draft for technical review to a small number of individuals and agencies, of which you are one. We would appreciate receiving any comments you may have by November 12th. To speed up this process, I would appreciate it if you would send a copy of your comments to Mr. Davis at 1935 Sabin Drive, Idaho Falls, Idaho 83401.

Sincerely, Glenn Paulson, Ph.D.

Assistant Commissioner GP/vp

Enclosure:

An Investigation of Hypothetical Catastrophic Accidents in the Oyster Creek Nuclear Power Plant - Preliminary Draft, September, 1976.

cc: Mr. Peter R. Davis Mr. Ben Rusche Mr. Saul Levine 9602230064 960129 I N' PDR FOIA DEKOK95-189 PDR .

I c1 s protect our c:rth '

2-NEW JERSEY DEPARTMENT OF y NVIRONMENTAL PROTECTION a N<9 , - #1 P.O. BOX 1390 TRENTON, N.J.08625 David J. BardincCommissioner

< Wes Denman, Public Information Officer (STATEWIDE)

No. 76/231 Imediate release:

BARDIN CALLS FOR LAND USE CONTROLS March 10, 1976 IN VICINITY OF NUCLEAR POWER PLANTS TOMS RIVER--Environmental Protection Comissioner David J. Bardin today told a New Jersey Senate comittee that "the time has come for state and local government to initiate practical land-use controls around nuclear power plants."

Testifying here before the Comittee on Energy and the Environment, chaired by Senator John F. Russo. Bardin said nuclear power plants will reduce New Jersey's reliance on fossil-fueled plants and help minimize the air pollution in the state from sulfur-containing oil and coal.

"This tradeoff is accompanied by other new risks related to radiatial associated with nuclear power." Bardin said. But he added that in contrast to rany other recent technological developments " nuclear power is probably the

.11ost carefully scrutinized regulated technology in the United States today."

According to Bardin, "the beehive offers a rough analogy: It's useful and pretty safe. But bees can sting. A stinging swarm can kill.

So the beekeeper takes precautions and the rest of us keep our distances.

We don't put the kids' sandbox or the swiming pool up against the hive.

That's common sense."

Bardin noted that the federal Nuclear Regulatory Comission (NRC) has a policy of limiting the human population near nuclear facilities, but said that while the policy has been in effect since the earliest days of the '

power program it has yet to be implemented effectively after a nuclear power plant has been licensed by the federal agency.

(more)

.. . ~ .

V ]

Nuclear power plants -

Add 1 ._

"We can and should minimize the human exposure to the risk of ham ,

~

from a major nuclear accident," Bardin said, "by enforcing population density goals and other measures." He called for compatible land use near present and future nuclear plants. Certain industrial operations, for instance, might prove compatible, Bardin noted.

The Department of Environmental Protection is conducting an in-depth study of potential hazards and land use requirements, Bardin said.

The study headed by Dr. Glenn Paulson, assistant commissioner for  ;

science, will enlist the help of municipal and county officials and lay the groundwork for a full review later by all interested parties, Bardin added.

Pending completion of this report, said Bardin, DEP will not approve the construction of residential development or other heavily occupied facilities in the proximity of either tne Oyster Creek nuclear i plant in Ocean County or those at Artificial Island in Salem County. The action is taken under the state's Coastal Area facilities Review Act (CAFRA).

Bardin said DEP also is studying the NRC's proposal on the clustering of nuclear plants as a means of reducing land use impacts. But he said DEP l

. I has advised the NRC that Ocean County seems a poor place for such clusters.

He said DEP would determine at a future data whether the concept has a place elsewhere in New Jersey. -

(Text of testimony attached.)

o e

65',

~- "

. 1

- ~.

4 i

Testimony'of i David J. Bardin, Commissioner,  !

New Jersey Department of Environmental Protection before the j Committee on Energy and Environment, j L. New Jersey Senate ,

j Toms River, New Jersey  !

l i

March 10, 1976 j Senator.Russo, members of the Committee: f l

. Nuclear power is no stranger to New Jersey. The Oyster Creek station,  !

located about 10 miles south of Toms River, has produced electricity since I

~

' December of 1969, with a potential maximum output of 620 megawatts. The first of two units of the Salem station, located on. Artificial-Island in Salem County, ,

' will be started up later this year. This unit can produce 1100 megawatts of l electricity. Its identical twin, scheduled to come on>1ine later this decade,  !

will have the came potential output. Other nuclear plants, both in New Jersey '

and in adjacent states, are at various stages in local, state and federal regu- '

latory proceedings. The New Jersey Department of Environmental Protection (DEP) follows the licensing and. regulatory processes for facilities in nearby states in addition to exercising our statutory responsibilities over nuclear power  ;

plants within the borders of the State of New Jersey.

The operation of both existing and future nuclear power plants will reduce New Jersey's reliance on fossil-fueled power plants and thereby help minimize the air pollution in the state from sulfur-containing oil and coal. This tradeoff is accompanied by other new risks related to the radiation associated with nuclear power. - In contrast to many other recent technological developments ranging from

• aerosol cans and pesticides to the supersonic transport, nuclear power was sub-jected to extensive safety and environmental evaluation before its commercial introduction, and is probably the most carefully scrutinized regulated technology in the United States today.

The beehive offers a rough analogy: It's useful, and pretty safe. But bees can sting. A stinging swarm can kill. So the beekeeper takes precautions, and the rest of us keep our distances. We don't put the kids' sandbox *or the swim-ming pool up against the hive. That's common sense. That's been our national objective regarding land uses near nuclear power plants, but this country has not fully implemented this common sense goal.

The State government must make the realistic and responsible protection of the public health and safety a keystone in all of its activities regarding nuclear power.

Review of Available Literature There are many sources for scientific, medical and engineering information on nuclear. power generally as well as on specific facilities. Some significant,

~ones are:

_. _ . . _ _ _ , _. ,. . ~ . , _ _ . - -

s, se .

- .The Reactor Safety Study (WASH-1400% published by the Nuclear ,

Regulatory Commission in October, 1975

- The Report of the Study Group on Light-Water Reactor Safety, published by the American Physical Society in August, 1975 An Assessment of Emergency Core Cooling System Effectiveness, prepared by the Environmental Quality Laboratory of the California Institute of Technology in 1975

- The Environmental and Safety Analysis Reports prepared by the Atomic Energy Commission (AEC) and its successor agency, the Nuclear Regulatory Commission (NRC), on each proposed facility This is only a partial list of key documents on nuclear reactors. Other materials from many governmental agencies, electric utilities and their consul-tants, and other organizations further expand the extensive base of information available on nuclear reactors.

Normal Day-to-Day Releases of Radioactive Materials Every commercial nuclear power plant now running will, under normal operating conditions, release small amounts of radioactivity into the air and water. While some have alleged that these planned releases pose serious risks to the health of human beings and other living th4.ngs, they have provided no definitive proof. The NRC requires that the overall releases from any facility meet the requirement of being "as low as practicable". In addition, the NRC i analysis of the normal rates of radiation released from the nuclear power plants I in New Jersey into the air and water are well below current allowable releases (10 CFR Part 20, Appendix B and 10 CFR Part 50, Appendix I). The resulting ex-posure levels are well below current exposure standards for members of the general public.

For example, the NRC has calculated the maximum individual radiation dose at the plant boundary due to liquid and gaseous radiation releases from one proposed f acility to be less than 5 millirem per year (mrem /yr). This is for a hypothetical person who lives at the fence around the facility 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day, 365 days per year. That increment is about 4 percent of the natural background dose of 130 mrem /yr caused by cosmic radiation and radioactive elements in the ground. DEP has calculated that persons living beyond the plant fence but within a fif ty-mile radius would receive, on the average, an cxposure of about 0.0008 (eight ten-thousandths) of a mrem /yr from plant operation.

These and similar analyses have led us to conclude that the normal, day-to-day releases from a nuclear power plant do not pose a significant in-cremental risk to the health of people living in the vicinity of such a facility.

DEP continues, however, to monitor the radiation levels at existing nuclear plants independently of any other agency.

Transportation of New and Used Radioactive Fuel DEP has also analyzed the slight additional radiation exposure that people would sustain due to the transportation of new and used fuel to and from a nuclear power plant. Typically this happens about once a year. For the pro-v posed, facility, the additional average exposure to the entire population within 50 miles is 0.003 (three one-thousandths) mrem /yr; this, too, should be com-pared to the 130 mrem /yr from background radiation. Virtually all of this comes

, from the used (" irradiated") fuel rods which are sent out of New Jersey for storage and eventual reclaiming of additional energy resources, isotopes for use in medical treatment and research, and for other purposes.

Ultimate Waste Disposal There are./no facilities now proposed for construction in New Jersey to either process used fuel rods or to store or dispose of the radioactive wastes after such processing. The closest potential sites known at this time are in upstate New York and in Barnwell, South Carolina. We agree with the Congres-sionel Office of Technology Assessment, which stated last October, " Satisfactory handling of nuclear fission wastes appears to be technologically feasible, '

though it has yet to be demonstrated". This area of work has not been funded adequately at the federal level. We support additional funds for research and especially demonstration projects in this area.

DEP does not believe that New Jersey residents will receive any additional exposure from this part of the fuel cycle, except for the transportation of the used fuel rods already discussed.

Major or Catastrophic Accidents During the operation of any nuclear power plant, new radioactive material is produced by fission and by neutron activation reactions from the metals and other elements in the reactor system. There is no question that the inventory l of radioactive fission products which would accumulate in the reactor's nuclear core during operation would, if released in significant quantity due to some catastrophic accident or deliberate act, pose grave risks to life and health for several miles downwind of the accident. For this reason, NRC scrutiny of any proposed reactor design places heavy emphasis on a review of safety-related features of the reactor core and associated hardware (including emergency cooling systems), the structural integrity of the building in which the reactor is to be housed, and factors external to the facility itself related to its proposed location (e.g., population density).

There are a series of types of accidents that can be envisioned, ranging widely.in degree of severity. The standard AEC/NRC ranking ranges over Classes 1-9. A Class 8 accident, the design basis for reactor safety analysis, is termed by the NRC the " maximum credible accident"; NRC apparently considers Class 9 accidents incredible. A Class 8 accident is one that does not involve a major catastrophic failure of both the reactor core and the building around )

it. Rather it involves a series of failures that increase the normal, day- 1 to-day releases substantially, but not necessarily to rapidly lethal levels.

DEP's continuous radiation surveillanc2 at nuclear plant sites provides an extra level of safety assurance to the public for Class 8 and less serious accidents.- This off-site surveillance system, while not able to detect in a j timely manner the onset of an extremely unlikely but rapidly occurring {

catastrophic Class 9 accident, nonetheless has the capability to detect the  !

development of malfunctions within the facility which, over the course of days l or weeks, might result in significant releases of radiation into the local environment. Such releases can be detected even at levels well below those

-currently allowed by NR standards as well as levels approaching these standards.

This State m'onitoring and reporting network is totally independent of any ch- .

going monitoring and reporting activity engaged in by any utility or by any federal agency.

A Class 9 accident means a rupture both of the reactor core and the building housing it. This could result in a rapid release of large amounts of radioactivity that would drift downwind. Current public controversy focuses on this risk. This controversy has been fueled, at least in large part, by the failure of the NRC's predecessor, the Atomic Energy Commission, to carry out in a timely man-ner long-planned safety studies; as the final report of the Energy Policy Project of the Ford Foundation (1974) noted, "an adequate experimental basis for nuclear safety systems is lacking". We condemn the federa'l budgetary and policy decisions that delayed this important safety research and testing work when the AEC was in charge of it. We look to the Energy Research and Development Administration to eliminate these areas of uncertainty.  ;

Probability of a Major Accident j The NRC Reactor Safety Study estimates (in the absence of experimental data) the probability or frequency of lethal accidents for nuclear reactors as well as for other technological failures and for natural disasters. Final ,

' professional reviews of these estimates and the uncertainties in them are not completed, and may lead to significant changes in the NRC Study. {

By way of perspective, the Study has a comparison between the frequency of an airplane crash killing up to several hundred people on the ground (for

~

example, a large airplane crashing into a residential area such as near Newark  ;

airport) and the probability of a nuclear reactor acaident killing the same  !

number of people. In general, the serious reactor accident, according to the  ;

NRC Study, is about one thousand times less likely than the airplane accident, '

which is in turn projected to occur at the rate of about one every few cen-turies. However, some professionals have chclienged that this underestimates the uncertainties that may lead to a major reactor accident. ]

The sciences of statistical risk analysis and radiation dose estimation have .volved gradually and relatively recently. In their present. formative stages, they do not deal adequately with the probability of a series of simultaneous failures or with the potential long-lasting effects of resulting ,

exposures. Apparently the series of events that led up to the fire at TVA's J Browns Ferry reactor, for example, was not included as a possible set of events in the NRC Study.

To try to reduce some of these uncertainties, New Jersey petitioned the NRC in 1974 to conduct analyses of the likelihood and consequences of a 1 Class 9 accident before licensing any new reactor configurations (NRC Docket PRM-50-10). Regrettably the NRC has yet to act on our petition.

Consequences of a Major Accident If there is disagreement as to the likelihood of such events, there is no disagreement that the consequences of a major release of radiation would be potentially catastrophic. The NRC Study as well as previous studies show that a major radiation release passing over any human population could kill people either from radiation sickness or cancer and could contaminate land and water to such a degree as to render them unsafe for a substantial period of time.

4

~

This led the AEC to long ago define the concepts of " exclusion zone",

- " low population zone", and " population center distance" (10 CFR Part 100 embodies these criteria and definitions). The " low population zone" is an area "which contains residents, the total number and density of which are such that there is a reasonable probability that appropriate protective mea-sures could be taken in their behalf in the event of a serious accident". The NRC's catalog of " protective measures" includes evacuation and fallout shelters.

The NRC has refused to actually define this zone either in terms of population density or total population, contending that "the situation may vary from case to case". In the case of Oyster Creek, the " exclusion zone" is land around the station owned by the utility; the " low population zone" in the State's view is a 3-mile radius around the plant; and the " population centec distance" is a radius 4 miles from the plant.

Emergency Plans These same concerns regarding the potential consequences of a major reactor accident have led to the development of emergency plan requirements and criteria by the NRC and other federal agencies. These plans involve preparation of de-tailed response procedures by the utility itself and by state and local officials.

These officials include, at the state level, the Governor's office, DEP, the State Police, the civil defense agency, the Health Department and ir. deed almost all other cabinet agencies. At the county and loca) level, local officials as well as similar agencies (police and fire departments, civil defense agencies, etc.) are also involved.

These plans, developed in view of the specific characteristics of each nuclear power plant, include:

1. methods to assess the severity of an accident

2. potential corrective actions (fire-fighting, damage control)

3. methods of sheltering people or evacuating them from the path of the radioactive cloud

4. techniques to keep people from entering the affected area during periods of risk

5. methods to prevent exposure (protective clothing or breathing equipment)

6. establishment of chains of communication and responsibility among the various public and private agencies involved.

7. procedures by which accurate information is made available to the public during such an emergency

8. criteria for when to allow re-entry into affected areas.

To be effective, these plans require close cooperation between the many other agencies of state, county and local government and DEP's Bureau of Radiation Protection. The basic components of these plans are publicly avail-able. The only confidential sections are those related to details of communi-cation links, state and local police mobilization procedures, and the like.

1

The plan is flexible, in that it allows the nature of the overall response to be tailore'd to the extent of the emergency and conditions at the time (e.g., .

extreme weather and its effect on available transportation). A Class 8 reactor accident requires a far more substantial response than a Class 4 accident. The plan is periodically reviewed by the relevant agencies, and is tested at least in part once per year. These tests to date have stopped short of the actual evacuation of people, but have included the mobilization and deployment of agency personnel at all levels.

The maintenance of this emergency response capability is important. I have directed DEP's Division of Environmental Quality to convene annually a meeting of all appropriate agencies in the vicinity of each New Jersey nuclear power plant. The purpose will be to review all specific plans and procedures, update them where necessary, to make certain each agency understands its responsibilities, and to ensure that means of implementation are in good order.

Location of Nuclear Power Plants: State and Local Regulation of Surrounding Land Uses The potential major-accident threat to the public health and safety prompted the NRC objectives of limiting the population density near nuclear facilities and controlling land uses so that "there is a reasonable probability that protective measures could be taken...in the event of a serious accident" (10 CFR Part 100). The NRC has not implemented its objectives, apparently hoping to pass this responsibility on to state and local governments.

Local decisions could play a key land-use role. Moreover, both of the New Jersey nuclear power plant sites are in the coastal area as defined in the Coastal Area Facility Review Act (CAFRA), although the Oyster Creek plant is )

only 1 1/4 miles from the Garden State Parkway, the present western boundary of the CAFRA coastal area in this region. A particularly demanding responsi-bility rests on DEP to evaluate land uses within the coastal area near nuclear power plants, including approval or disapproval of a,11 residential developments of 25 units or more.

]

I The time has come for state and local government to initiate practical land-use controls around nuclear power plants. Existing state law provides some of the regulatory tools for realistic and responsible implementation of a major national policy: the AEC/NRC policy of limiting the human population within reasonable distances of nuclear facilities. This policy has been in l effect since the earliest days of the national civilian nuclear power program, but it has yet to be implemented effectively after a nuclear power plant has l been licensed by the AEC or NRC. We can and should minimize the human expo-sure to the risk of harm f rom a major nuclear accident by actually enforcing low population density goals and other reasures.

The appropriate land use controls need not necessarily foreclose develop-ment. For example, we recognize the distinct possibility that certain indus-trial activities could be most compatible with nuclear power plants. Non-labor intensive industry is one possibility. Industries using by-product heat are another.

As a first step to this end, I have directed the Assistant Commissioner for Science, Dr. Glenn Paulson, to analyze the following issues as they re-late to the existing Oyster Creek plant and the nearly-finished Salem plant:

0, ..*.

population density

- meteorological characteristics

- engineering characteristics of the facilities

- the probability of and the potential radiation releases from various types of accidents the potential human consequences of.various types of accidents under characteristic weather conditions

- the status of the emergency plans for these facilities applicable federal, state and local laws and regulations

- compatible land uses Dr. Paulson will be aided by other appropriate DEP agencies, including the Division of Marine Services, directed by Donald T. Graham, the Bureau of Radiation Protection, headed by John J. Russo, and the Office of Coastal Zone Management, headed by David N. Kinsey. They will seek the help of municipal and county officials. Dr. Paulson's report will provide the basis for a full review by all interested parties of these issues and proposed land-use requirements.

Pending the submission of Dr. Paulson's report and appropriate followup procedures, DEP's Division of Marine Services, directed by Donald T. Graham, will not approve the construction of residential developments or other heavily occupied facilities in the State coastal area i'n the proximity of either the Oyster Craek nuclear facility or those at Artificial Island.

Nuclear Energy Centers and Mini-clusters The clustering of nuclear power plants has been proposed, among other reasons, as a way to reduce the overall land use impact of nuclear power plants.

For example, clustering would reduce the square miles of low population zones as compared with disperced single nuclear power plants. Small clusters, per-haps half a dozen or so plants, appear more practical to consider than large aggregates.

In any event, Ocean County seems a poor place for either a mini-cluster or.a large aggregate, and DEP so advised the NRC. The Pine Barrens wilderness, the highly developed barrier beach, the intermediate back bays and the adjacent wetlands do not provide the proper setting for a nuclear cluster. We are evaluating the NRC study of the clustering concept, which was required by the Energy Reorganization Act of 1974, to determine whether the concept has a place elsewhere in New Jersey.

.e.

/

• Preliminary Draft AN INVESTIGATION OF THE PROBABILITY OF llYPOTilETICAL CATASTROPilIC' ACCIDENTS IN THE OYSTER CREEK NUCLEAR POWER PLANT Prepared for the I

New Jersey Department of Environmental Protection i

l l

By 1 P. R. Davis October, 1976

• e 5

, em,

so , .=.

Preliminary Draft

. TABLE OF CONTENTS-P_ age I., -INTRODUCTION 1

II.- ~ POWER REACTORS AND SAFETY 1 III. RESULTS- 4-IV. ANALYSIS 4-A .- Determination of the type of accidents with the potential for catastrophic off-site consequences 4-B. Determination of the significant accident sequences in WASH-1400 leading to core melt and loss of above-ground

containment integrity 5 C .- Determination of site and plant factors specific for Oyster Creek with the' potential-for changing

, the BWR core melt accident probability as assessed Lin WASH-1400 6 D. Calculation of core melt probability for Oyster Creek 11 V. REFERENCES 18 I

APPENDIX A: An Evaluation of the Relative Significance of BWR Core Melt Sequences as Addressed in WASH-1400 20 l

APPENDIX B: Sensitivity Studies 23

.l 4

APPENDIX C: Assessment _of Oyster Creek Scram Failure Probability 25-I l

i l

I

l1

• i r < -. .

Preliminary Draft i ,

LIST OF TABLES i

i .  !

Page Table No.- l t

i I-' Frequenc'y of: Anticipated Transient-Induced- l t

. Scrams for Oyster Creek 6:

J

'II; Differences between Peach-Bottom II and Oyster. Creek 10  ;

i Assessment'of Probabilities Associated with

.III Anticipated Transient without Core Power ,

Shutdown 13 ,

IV ' Assessed Failure. Probability for Oyster  :

Creek Systems 15 V- ' Core Melt Probability for:.the 0yster Creek l 16  !

Reactor- i Core Melt Sensitivity Study 16 VI e

)

VII' Survey of Core Power Shutdown Failure Probability 17 . i A-1 Dominant Hypothetical Core Melt Accident Sequences for Each Assumed Initiating Event 21 1 l

Definitions of Accident S.equence Symbols 22 A-2 Summation of Accident Probabilities 22 A-3 l

l i

I 1

)

.- - ~ . . . . . . . - . .. .-

t i

't . ** . t Preliminary Draft l

. LIST OF FIGURES i,

~ Figure No.

i Computation of-Probability of Core Melt in the Oyster

~

1- l Creek ?lant from an Anticipated Transient with Failure {

to Reduce Core Power  :

'2 . Computation of Probability of Failure to Remove Decay l Heat within 1 3/4 Hours i

.3 Computation of Probability of Failure to Remove Decay l

Heat after 1 3/4 Hours-  ;

i B-1 Influence of Anticipated Transient Frequency'  !

i

.5-2. Influence of Scram Failure Probability

--B-3 Influence of Recirculation Pump Trip Failure Probability l

B-4. Influence of Manual Poison Injection Failure Probability C-l' Simplified Fault Tree of Scram Failure Probability for Oyster Creek i

1 l

l l

,,; G , ',

. '" f reliminary Draft-l

~

An Investigation of the Probability of Hypothetical l

' Catastrophic Accidents in the Oyster Creek. I Nuclear Power Plant.

By .,

-i P.' R. Davis ] !

September, 1976 I .' INTRODUCTION This-reportdescribestheresultsofanefforttodeterminetheprobabilityofi) an hypothetical catastrophic accident st the Oyster Creek nuclear power plant . l This study was undertaken for, and under the sponsorship of, the New Jersey  ;

l Department of Environmental Protection and;was directed by Dr. Glenn Paulson, Assistant-Commissioner for Science. This effort is part of a larger effort to determine the necessity for, and extent of, appropriate land use requirements in

~

i the proximity of nuclear power plants located in the State of New Jersey. j The. approach taken in the effort was as follows. First, a determination was made of the type of accidents which could occur in the Oyster Creek facility that had the potential for catastrophic consequences. (" Catastrophic" in this context.means those accidents which might be expected to produce human fatal-ities from-radiation damage beyond the boundary of the Oyster Creek plant within 30-60 days.from such an accident.) Second, a determination was made of the-specific applicability of the Reactor Safety Study (hereinafter referred to a WASH-1400)recentlycompletedbytheU.S.NuclearRegulatoryCommission(NRC)[2);

WASH-1400 assessed the overall probability of catastrophic accidents for the two general types of nuclear power reactors currently operating in the U.S. Third, using appropriate adjustments to WASH-1400, a numerical probability, with the range of uncertainties defined as well as possible, was established for the catastrophic accident potential in the Oyster Creek reactor.

II.. NUCLEAR POWER REACTORS AND SAFETY For' background and perspective, this section represents a very brief descrip -

tion of nuclear power reactors and their safety features. A nuclear power plant consists of a nuclear reactor and those associated components (such as generators, turbines, and electrical generators) necessary for the production of electricity.

A nuclear power plant is similar to a conventional power plant in most respects except for the means employed to produce _ heat. In a conventional power plant, a fossil' fuel:(such as oil or coal) is burned to produce _ heat for steam production; this steam is then used to rotate turbinegenerator units which produce electricity.

In a nuclear power plant, a nuclear reactor is used for the heat generation; the rest of the plant lis, in essence, identical to a fossil fueled plant.

r l

._._ -_ . . u.. __ _ _. . _ _ ,_ _ _ _- _ -. _ . _ _ a

.* , n.

Preliminary Draft For fuel, the reactor uses a compound of uranium which contains a small percentage of a special uranium atom (or isotope) known as uranium-235 or U-235. The U-235

, atoms are " fissionable"; that is, they can be split apart when struck by a small atomic particle, the neutron. When a U-235 atom splits apart, or fissions, after being hit by a neutron, energy, in the form of heat, is released. The process of fissioning also produces " fission products", which are other radioactive elements and additional neutrons. The neutrons produced by the fissioning of one U-235 atom can be made to cause further fissioning of additional U-235 atoms and, if the U-235 atoms are properly spaced in a matrix of appropriate materials, a controlled, continuous " chain reaction" occurs which is accompanied by the release of large amounts of heat.

The part of the reactor which contains the uranium fuel is called the reactor .

core. The core is. located inside a large vessel (the reactor vessel) which is connected by large pipes to either a steam generator or a turbine. Under normal conditions, pumps continuously circulate water through the reactor vessel when a chain reaction is occuring; this water removes the heat produced in the core by the -

fission process.

There are two types of power reactors in general use in the United States today.

The most common is the pressurized water reactor (PWR). In this type, the water in the reactor vessel is kept under high pressure and is circulated to a steam generator. The steam generator is a large vessel designed to both remove heat from the water which circulates through the core and to transfer this heat to a lower pressure water reservoir which then boils to produce steam. The steam leaves the  ;

steam generator via pipes and is directed into a turbine-electrical generator unit which turns to produce electricity.

The second type of power reactor is the boiling water reactor (BWR). In this type, water circulating through the core is held at a lower pressure than in a PWR (though still higher than atmospheric) and allowed to boil. The steam produced from the boiling is piped directly to the turbine-generator units, causing them to rotate and produce electricity. The Oyster Creek reactor, the subject of this study, is of the BWR type.

I The fission products produced in the fissioning process are highly radioactive

{ atoms of various chemical elements. Their intrinsic radioactivity causes additional heat to be generated in the core above and beyond the heat asso-l ciated with the actual fission of the uranium atoms; this additional heat is called " decay heat". Thus, even after the fissioning of uranium atoms in the core has stopped (e.g., by causing the neutrons to become unavailable for further fissioning), a substantial amount of heat continues to be generated from the decay heat process. There is no way to stop this decay heat from being generated. Even though it represents only a fraction of the full-power heat (perhaps 6-10% of the heat generated by the fissioning or chain reaction process when the core is pro-ducing maximum power), continuous cooling must be supplied to the core af ter the fissioning process is stopped to prevent overheating which could lead to a catastrophic accident. This is because, if the decay heat is not removed from the core, overheating from the decay heat can lead to fuel melting. If the fuel melts, the radioactive fission products are likely to be released from the core and could l

,, c=.

Preliminary Draft find their way into the outside world. Because they are highly radioactive, the fission products represent a serious hazard' to human health if the level of radio-activity is high enough. Needless to say, these materials can threaten other living things as well as man.

In order to minimize the chances that 1adioactivity could be released from a melted.

core, several systems are designed for and built into reactors to maintain core cooling even in the event of unlikely accidents which could interrupt normal cooling water flows; these systems are generally termed " emergency core cooling systems". Also, a large, airtight containment building is always erected around a reactor core so that even in the unlikely even of a radioactive release from the core and primary reactor system, the noterial might be confined inside the containment building rather than escaping to the outside world.

There are two general types of accidents which have the remote potential for causing a release of radioactivity from the core of a reactor. These two types are: (a) an accident initiated by a loss of (normal) coolant, and (b) accidents initiated as a result of brief (or " transient") conditions in the reactor.

In a loss of coolant accident (LOCA), a cooling water pipe that connects with the reactor vessel is postulated to rupture. Because the water contained within the pipe is under pressure (even in a EUR), it is expelled rapidly from the pipe, and eventually, if nothing else happened, the reactor vessel would become empty; this would stop the chain reaction. However, if emergency core cooling systems were not provided to refill-the reactor vessel with water, the core would eventually melt just frem the decay heat, releasing radioactivity through the pipe rupture into the containment. If the containment's integrity (leak tightness) were, for some  !

reason, also lost during the accident, the radioactivity could be released to l the atmosphere. Depending on weather conditions existing at the time of the l accident, the locstion of people near the site, and the ability of them to either  !

, leave the area or take shelter, the radioactivity could be carried by the wind to ,

persons living the site in quantities sufficient to cause thei,r death. Under very unlikel) j conditions, many persons could be killed from such an accident (WASH -1400, Main Report, ref. 2). ,

I The second type of accident is initiated by a so-called " anticipated transient", I an event which briefly but drastically disrupts the orderly transfer of heat i energy.from the reactor core. This can occur, for example, due to an abrupt increase in the amount of heat produced in the core, or by an abrupt decrease in the ability of the circulating water to remove the heat produced in the core.

If the normal heat transfer balance is not restored quickly by the various systems designed to do so, or if the reactor is not quickly shut down, the core could overheat and possibly melt. The overheating process could cause certain pressure relief valves to be opened (" scrammed"), and, if a melting of the core had occurred, radioactivity could exit through these valves from the core into the containment building. Under some conditions, the containment building could fail to retain the radioactivity, and a release to the outside atmosphere would occur. This type of accident has been found to be more likley for a BWR than is a LOCA and is discussed in more detail below.

Preliminary Draft It should be emphasized that, to date.sycither of the above accident sequences has yet occurred in a nuclent power reactor in the United States. (At present, some 58 power reactors are operating in the,U.S.; the period during which they have been in service totals some 250 reactor-years of operation) . In order for a radioactive release to the atmosphere to occur, several events must occur in sequence. These include (1) an initiating event, (2) the failure of more than one of the redundant systems designed to cope with the accident-initiating event, and (3) a failure of the containment building. If any one of the three events does not occu[2)there will be no significant radioactivity release. Calculations in WASH-1400 indicate that, for both general reactor types, the probability of a significant radioactive release is exceedingly remote; while useful, this con-clusion does not provide guidance on spgyific facilities. The probability of such a release from the Oyster Creek reactor specifically is the subject of this report.

III. RESULTS Based on the preliminary scoping effort described in this report, the proba-bilityofacoremeltaccompanjedbycontainmentfailureinOysterCreekis assessed to be about 3.5 x 10 (or about 3 1/2 chances out of 10,000) per year. This would mean that, over the remaining 30-year designed lifetime of the Oyster Creek reactor, the chance of a core melt with containment failure is about 1 x 10-2 (1 chance in 100), although relatively minor modifications to the plant appear available which could significantly reduce this value. This result is based on serveral simplifying assumptions which are stated below; further, the relatively limited resources available for this effort did not allow an analysis fully comparable to that in WASH-1400 (which cost about $5 million). The result should thus be considered no more than a preliminary estimate, subject to revision on the basis of comments and review.

Also, the result is strongly dependent on the probability assumed for failure of " scram" to occur in a transient-induced accident. There does not appear to be a sound basis readily available at this time for selecting a " scram" failure probability. The value used in this study is based on a simplified analysis which relies on assumptions from other sources which review may show are not appropriate to use. The failure probability value thus calculated is at the high end of a rather wide spectrum of values derived by other investigators. Substantial additional effort, probably more properly a federal rather than a state respon-sibility, appears needed in this area in order to establish in the future a value which could be used with greater confidence. But, given the basic goal of the larger state ef fort to protect human life in the event of an acccident, this value provides useful guidance.

IV. ANALYSIS This section describes the analytical evaluations which were undertaken in pursuit of the overall effort. These evaluations proceeded in four discrete parts, as follows: -

A. Determination of the type of accidents with the potential for catastrophic off-site consequences (one or more short-term radiation deaths to the human population around the Oyster Creek site).

In order for radiation death to occur to any individual outside the reactor site boundary (" exclusion area") of a reactor site, radioactive material from Preliminary Draft the reactor must be carried to the vic4n.ity of the individual in sufficient  !

quantities.such that the resulting radiktion-induced cell damage is extensive enough to cause mortality. The only source of radioactivity within the plant i that has any substantial potential for relsasing such quantities of radio-active material is the reactor core. The spent fuel storage pool could conceivably

] contain, within the stored fuel, a quantity of radioactive material approaching 4

that contained in the core. However, as assessed in WASH-1400, the probability of a significant release from the spent fuel stored at the plant is negligible, on the

. order of one in one million or less per reactor per year;.I concur with this 4 assessment. It is also generally accepted that the only conceivable way for the

radioactive material in the core to be transported off-site would be for a meltdown

[ of the core to occur in conjunction with an above-ground failure of the integrity J of the containment structure which houses the reactor system. The rationale for this conclusion is given in WASH-1400. It was thus assumed, for the purposes of this effort, that only accidents in Oyster Creek which are postulated to result in

loss of above-ground cont'ainment integrity along with core meltdown will have the i potential for causing immediate human fatalities outside the site exclusion area.

B.' Determination of the significant accident sequences in WASH-1400 leading l to core melt and loss of above-ground containment integrity.

'I J

After extensive investigation over a period of four years, the authors of WASH-1400 concluded that only about 60 accident sequences were of any substantial signifi-cance in assessing the general probability of a core meltdown in a BWR such as Oyster Creek. These sequences are shown in Appendix V, pg. V-27 of WASH-1400.

As part of this effort, a further analysis was made of the relative signifi-cance of these 60 accident sequences. The result of this analysis is that two accident sequences dominate the probability of BUR core meltdown to the extent that all the others (some 58) would increase' the- core melt' probability by only 4% over that contributed by the two- dominant sequences'.-

For this reason, the analysis below focuses only on the two dominant sequences.

These two sequences consit of accidents initiated by a severe anticipated transient (mentioned above in Sec. Iil), which would momentarily but drastically disturb the

lyeat production and transfer process in the reactor. Following the occurrence of certain kinds of anticipated' transients, certaih safety systems (including ones

that would totally shut down the reactor) must successf~ully operate in order to

, prevent a core meltdowm, a release of radioactivity into the containment building and an eventual loss of containment integrity. The failure of the reactor shutdown systems following an anticipated transient constitutes one of the two major accident sequences leading to core melt. The second sequence involves the failure of the decay heat removal systems to prevent core melt after the transient occurs.

Appendix A to this report contains a detailed numerical assessment of all of the dominant accident sequences considered in WASH-1400 and illustrates the dominant

! role of the two sequences discussed above. Thus, if there are no factors. specific ,

i for the Oyster Creek plant which would drastically increase the significance of the j other 58 accident sequences or decrease the significance of the two dominant sequences, then the probabilty of a core melt in Oyster Creek will also be dominated by the probability of these two accident sequences. The next subsection 4

considers this area in more detail.

.~

.v - _. ~ .,- --- -. -

s* ; =*.

Preliminary Draft ,

C. Determination of site and plant factors specific for Oyster Creek with

. the potential for changing the BWR core melt accident probability as assessed in WASH-1400. -

The Oyster Creek plant's design and characteristics were investigated to deter-mine: (a) if the 58 insignificant BWR core melt accident sequences in WASH-1400 could become significant for Cyster Creek, and (b) whether, and to what extent, the probabilities of individual occurrences in the two dominant core melt sequences in WASH-1400 might need to be altered for specific application to Oyster Creek.

. TheWASH-1400assessmentofByg)coremeltaccidentprobabilityisbasedonthe design of the Peach Bottom II reactor. Although the General Electric Company designed and supplied both the Peach Bottom II and Oyster Creek reactors, several design and site-related differences were found which have the potential of making the direct application of the WASH-1400 results to Oyster Creek inappropriate.

These differences and an assessment of their significance are:

1. Frequency of Anticipated Transients. According to WASH-1400, the  !

average frequency of anticipated transients in a BWR is about 10 per year per reactor. This value was based on reactor operating experience for 1972 (UASH-1400, pg. V-36). Table I shows the actual number of anticipated transients that have occurred at Oyster Creek; it is based on semi-annual operating reports for Oyster Creek (References 4 through 16). The first column gives the time period covered, and the second column gives the number of reactor shutdowns (" scrams") which were Since no scram failures occurred during the period precipitatedbythetrgygents. then the number of scrams which were initiated by from 1970 through 1975 ,

anticipated transients is also the number of anticipated transients. (All anti-cipated transients, by definition, result in a reactor condition requiring scram.)

TABLE I Frequency of Anticipated Transient-Induced Scrams for the Oyster Creek Power Plant ,

Time Period Anticipated Transient-Induced Scrams 7/1/75 to 12/31/75 3 1/1/75 to 6/30/75 1 7/1/74 to 12/31/74 1 1/1/74 to 6/30/74 1 7/1/73 to 12/31/73 1 1/1/73 to 6/30/73 6 7/1/72 to 12/31/72 4 .

1/1/72 to 6/30/72 4 7/1/72 to 12/31/71 1 1/1/71 to 6/30/71 0 7/1/70 to 12/31/70 6 1/1/70 to 6/30/70 _8 Total for the Period 1/1/70 to 12/31/75 36 9

creliminary Draft As can b'e seen from Table I, 36 scrams occurred as a result of anticipated tran-sients over the 6 year operating history covered in the table. This results in an

, average of 6 anticipated transients per year, as compared with the 10 assumed in WASH-1400. However, for the first year covered in the table (1970), an inordi-nately h utility'{ppnumberofanticipatedtransientsoccurredWhich,accordingtothe

, were the result of problems associated with the fact that the plant was just starting to operate. If 1970 is ignored, the table shows an average of 4.4 anticipated transients per year. Experience since the last half of 1973 indicates that, with the notable exception of the last half of 1975, an even lower rate might be expected in the future. For the purposes of this study, an average frequency of 4 anticipated transients per year was selected as representative of the Oyster Creek plant. (The effect of assuming different anticipated transient frequencies. for Oyster Creek, to cover the full range of experience, is given in Appendix B, along with other sensitivity studies. These results are discussed in a later section of this report.)

2. Differences in Emergency Core Cooling Systems ECCS). The Oyster Creek plant does not have a so-called high pressure coolant injection system (HPCIS) as part of its ECCS. Peach Bottom II, the reactor used as the model for BWRs in WASH-1400, has such a system. The system is provided (along with other redundant systems) to protect the reactor core from overheating in the event that a small pipe rupture occurs in the primary cooling system. This dif-ference would indicate that the probability of core melt in Oyster Creek would be greater from small breaks than that assessed for Peach Bottom II in WASH-1400. However, as an upper limit, it can be shown that if the HPCIS is assumed to  ;

always fail in Peach Bottom (this is equivalent to not having the system), the  !

overall core melt probability would not significantly change; this can be verified j by the information contained in Table A in Appendix A. The HPCIS failure proba-bility is included in the small pipe break accident sequences (details are included in Appendix A). Since the failure probability of the HPCIS was assessed to be about one in ten in WASH-1400 (Appendix II, pg.11-394 et seq.), increasing the total contribution of these specific core melt accident probabilities by a factor of 10 would be equivalent to assuming the HPCIS always failed (or did not exist).

As can be seen from Table A-1 in Appendix A, this increase would not result in an accident involving a failure of the HPCIS dominating the accidents initiated by anticipated transients. In addition, the Oyster Creek reactor has a system not included on Peach Bottom II (called the isolation condenser s designedtoprovidereliablecoreprotectionforsmallbreaks{ggymorICS)whichis This system will be described in detail later.

A second difference in emergency core cooling systems between Peach Bottom II and Oyster Creek exists relative to the low pressure coolant injection systems.

The Peach Bottom II reactor has systems which will both spray and flood the core, each of which is designed to provide emergency coolant to the reactor core in the event of a loss of coolant accident. The core spray system sprays water down on the core from above, and the core flooding system delivers coolant to the reactor vessel from the bottom to reflood the core. In the Oyster Creek reactor, there is no core flooding system. Instead, two redundant core spray systems are provided.

(The reason for these differences is explained in Item 5 following.) As shown in

.l .. .

Preliminary Draft WASH-1400 (Appendix II), either the core spray system or the core flooding system '

is assumed to provide adequate core cooling for Peach Bottom II in the event of a loss-of-coolant accident. In addition, depending on the type of accident as well as assumptions made regarding the operation of the safety systems, various combi-nations of partial operation of the two systems can provide adequate core heat removal._ An equivalent analysis for the Oysster Creek plant has apparently not been done either by the utility or by the U.S. Nuclear Regulatory Commission or its predecessor, the U.S. Atomic Energy Commission; it is also beyond the scope of this '

effort. Such an analysis is required in order to more accurately estimate the differences in core melt probability as a result of the detailed differences in these emergency core cooling systems for Peach Bottom as compared to Oyster Creek. However, in view of the fact that the systems on both reactors appear to be generally similar in terms of components, emergency activating signals, general arrangement, etc., there is no obvious reason to expect that the failure probabilities are substantially different. Also, the contribution to core melt from accidents which these systems are designed to mitigate is very small (as illustrated in Appendix A).

However, it should be noted that the Oyster Creek dual core spray system could be more susceptible to so-called " common mode failures" than the Peach Bottom II systems, since the two Oyster Creek systems are essentially identical. (An example of a common mode failure for the Oyster Creek system would be the plugging of all core spray nozzles in both systems by some mechanism.) The complete assess-  ;

ment of possible common mode contributions is beyond the scope of this effort; l however, due to testing and maintenance procedures prescribed for the Oyster Creek l plant, significant common mode contributions would not be expected.

A further consideration relative to the differences between Peach Bottom II and Oyster Creek is the effectivenes[2ff Sprays as opposed to flooding in cooling a core. It has been recently asserted , based on the results of foreign core spray tests, that the ef fectiveness of core spray cooling may be less than pre-viously assumed. Since Oyster Creek depends exclusively on spray cooling from its two low pressure injection systems in the event of a loss of coolant accident, this i could mean that the probability of core melt could be greater if these systems are l less ef fective in fact than they have been assumed to be. However, recent tests by I the General Electric Company at their San Jose, California facility have shown that f

core spray matory cooling tests, is roughly according to GPUgg79,fective as has are planned bybeen Exxonassumed; additional Nuclear at their confir- I Richland, Washington test facility. It was, therefore, assumed that no increase in core melt probability for Oyster Creek would occur due to the possible reduced cooling effectiveness of core sprays. The validity of this assumption should be reviewed when the Exxon Nuclear test results become available.

3. Reactor Protectings(Shutdown) System. The Oyster Creek reactor core contains 137 control rods, all of which are designed to be inserted quickly into ghe core when scram (rapid reactor shutdown) is called for; as noted above, scramming is always required following an anticipated transient. The Peach Bottom II core contains 185 control rods, primarily due to the fact that the Peach Bottom core is larger due to its higher design power output. (See Item 6 below) .

.*l' ' .

A Preliminary Draft The effect of this difference in number of control rods relative to scram failure was not directly evaluated. Instead a preliminary, simplified, independent analysis was performed of scram failure probabilities, since the analysis provided in WASH h gg)been found to be of questionable validity based on published

{g0gg reviews 7 . This analysis is presented in Appendix C; the results indicate that the scram failure probability for Oyster Creek is 1.4 x 10"4 (about 14 failures,ger hundred thousand) per demand, compared to the WASH-1400 assessment of 1.3 x 10 (about 13 failures per million) per demand for Peach Bottom. A sensitivity study which relates the effect of scram failure probability to core i melt probability is given in Appendix B and is discussed further in a later section.

4. Recirculation Pump Shutdown. In the Peach Bottom II reactor, according l' to WASH-1400, the reactor recirculation pumps are automatically shut off (" tripped")

when scram is called for following an anticipated transient. This pump trip (in conjunction with the manual injection of a 1 squid reactor poison into the primary reactor coding system) is considered in WASirl400 to be an effective backup in the event of scram failure {pppendix V, pg. V-4A) . Dyster Creek has no automatic recirculation pump trip  ; thus, manual activation of this system would have to be relied on in the event of scram failure. Based on information provided in Appendix III of WASH-1400, a probability of 0.5 (one out of two) was assumed for manual recirculation pump trip f ailure in the event of scram failure. This failure probability value is based on human reliability, and includes the f act that the pumps must be tripped immediately (e.g., within a few seconds for the most serious transieat and within a few minuts for less serious ones) af ter the scram failure in l order to be effective. The ef fect of changes in this failure probability are discussed in a later section; details are provided in Appendix B. l

5. Location of Primary System Recirculation Loop Piping. In Peach Bottom II, all recirculation loop pipes are located at an elevation above the core. In  !

Oyster Creek, the pump discharge portion of the recirculation piping is located below the level of the core. This could mean that, if a pipe rupture ocurred in that portion of a recirculation loop (five such loops exist in Oyster Creek) below l the core level, it would be difficult, perhaps impossible, to maintain enough water l in the reactor vessel to reflood the core. For this reason, Oyster Creek depends J on spray cooling (see Item 3 above) . This analysis assumes that this dif ference is l not significant overall, since core cooling f rom reflooding the reactor vessel is i not relied upon in Oyster Creek as it is in Peach Bottom II.  ;

I

6. Plant Size. As noted earlier, at maximum operation the Peach Bottom j II reactor produces 1065 megawatts of cicctrical power, while Oyster Creek produces 620 megawatts. Because of this size difference, there are other plant design differences, including: (a) fewer main steam lines in Oyster Creek (2 vs. 4 for i Peach Bottom II), (b) fewer recirculation loops, (c) reduced pumping requirements l for emergency cooling, and (d) smaller sizes of the core, reactor vessel, contain-ment vessel, etc in Oyster Creek. None of these size-related differences signi-ficantly af fect the accident probabilities.

Table II summarizes all of the differences described above and indicates their relative significance.

'.o l % e 's ,

j

'+ i Preliminary Draf t_. s .

TABLE II -,

Differences Between Peach Bottom II  !

i and. Oyster Creek Nuclear Reactors Significance in Terms of Change in Core Melt Probability Difference

~

.11 : Frequency of Anticipated '4 per year assumed for Oyster.

Transients Creek,.10 per year assumed in~- t WASH-1400  !

. 2 . .. Emergency Core Cooling ~  :

Systems  :

Not significant l a.- No High Pressure Injection System in Oyster Creek

'b. Oyster Creek Plant .Significant in providing residual j contains an Isolation heat removal capability following  !

' Condenser System an anticipated scram (see Section i D following) j

c. Oyster Creek plant contains Not significant two core spray systems j rather than one spray and one injection system

. Failure probgbility assessed to l

3. Reactor Protection System ~

be 1.4 x 10 per dgmand for Oyster

~

i Creek vs. 1.3 x 10 in WASH-1400 l i

4. Recirculation Pump Trip RPT failure assessed at 0.5 for i (RPT) not automatic with Oyster Creek; it is considered .

scram in Oyster Creek negligible in WASH-1400 f

5. Some recirculation loop piping Not significant located below core in Oyster j Creek

6. Oyster Creek smaller than Not signficant -f WASH-1400 reactor  :

)

i

+

1

Preliminary Draft D. Calculation of Core Melt Probability for Oyster Creek.  :

. This section presents the method and results of the calculation of core melt l probability for the Oyster Creek ractor. Due to the limited scope of this effort, the results need to be extensively qualified; future more detailed analysis might I change them. The limitations of the results are described below:

1. Qualifications and Limitations of the Results. A fully comprehensive evaluation of the Oyster Creek core melt probability would entail substantially more effort than described herein. Extensive " event trees" would have to be constructed; as-built drawings of all the reactor sub-systems would be required; all active components (pumps, valves, etc.) would have to be identified and available reliability data for each of these components would need to be gathered  :

and compiled; extensive fault trees for these systems would have to be prepared; and substantial effort would be required in evaluating any common mode failures, i design adequacy, human errors, test and maintenance factors, etc, specifically  !

pertinent to Oyster Creek. In short, an effort similar in magnitude to that ,

expended in WASH-1400 to establish the core melt probability for Peach Bottom II ,

would be required if one wished to ensure that the results approached the thoroughness of WASH-1400. The expense for such an effort would probably approach

$1 million (WASH-1400 cost $4 million), orders of magnitude above the resources available for the ef fort described herein. In order to accomplish this analysis within the available time and resources available, it was necessary to make several simplifying assumptions. The validity of these assumptions should be reviewed and evaluated by appropriate individuals and organizations before the results can be generally accepted. The major simplifying assumptions are:

a. Except as noted elsewhere in this report, the failure probabilities for reactor systems involved in the core melt accident sequences are assumed to be identical for Oyster Creek to those determined in WASH-1400. This assumption is based on a necessarily brief review of the full Oyster Creep pysign and on discussions with personnel from Jersey Central Power and Light , the owner of Oyster Creek, as well as with appropriate officials of the State of New Jersey.

b. There are no features or activities related to the Oyster Creek site (such as major nearby airports, LNG f acilities, etc.), which would, over the remaining lifetime of the plant, be significant in initiating an off-site accident  ;

(e.g., direct plane crash) leading to core melt. This assumption is based on a l review of the site characteristic and environs as well as discussions with New Jersey state officials.

2. Description of Dominant Core Melt Accident Sequences. As discussed earlier in Section IIB, and as numerically assessed in Appendix A, which in turn is based on WASH-1400, there are two accident sequences which dominate i the core melt probability in a BWR as analyzed in WASH-1400. These two sequences are also assumed likely to dominate the core melt probability for Oyster Creek ,

(Section IIC). The two accident sequences are: (a) the occurrence of an anti- l cipated transient followed by the f ailure of systems designed to rapidly reduce j core power, and (b) the occurrence of an anticipated transient followed by an  !

l a s;d .,

- Preliminary Draft l

eventual failure to remove core decay heat WASH-1400 assumes that both of these i .

accidents are followed by a rupture in the containment structure and thus lead to a i release of radioactivity to the atmosphere. In order to understand the assessment '

of the likelihood of these two accident sequences in the Oyster Creek reactor, it is first necessary to understand the basic features of these hypothetical sequences.

i a. Anticipated transient followed by failure to reduce core power. As noted above, an aniticipated transient is an event which leads to an imbalance in the

, core power production and core heat removal processes so that the core temperature begins to rise. Unless core power production is reduced, such an occurrence could lead to core melt and a catastrophic accident. A discussion of which events can constitute an anticipated transient is discussed in Appendix V (Section 4.3, page V-36) of WASH-1400. As shown in Section III-C.l. of this report, the average frequency of anticipated transients'at the Oyster Creek plant since 1970 is about 4 per year.

Following the occurrence of an anticipated transient, the required core power reduction can be accomplished in one of two ways. The first way (cnd the one which has always successfully occurred in the Oyster Creek plant and all other BWRs) is for the automatic reactor protection system (the " scram" system) to rapidly insert control rods into the core. i

! If the automatic scram system fails, immediate power reduction can be accom-plished by the manual tripping (shutdown) of the reactor recirculation loop p umps . This step must then be followed within about ten minutes by the injection of a neutron-absorbing material (a reactor " poison"); this injection, which can only be accomplished as a result of manual activity by the operator, further reduces the probability of a core melt.

.' In order to assess the probability of a core melt accident from an anticipated

transient without core power shutdown in Oyster Creek, it is necessary to know the probabilities associated with all of the events described in the preceding discussion. Table III describes each event, summarizes the assessed probabili-

! ties both for Oyster Creek and the BWR analyzed in WASH-1400, and indicates where the assessed probability is found in this report and in WASH-1400 respec-tively.

4- With the information contained in Table II, it is possible to compute a probability for a core melt accident in Oyster Creek caused by an anticipated transient followed by failure to reduce core power. One way to perform such a computation is l

to construct an " event tree" as was done in WASH-1400. The event tree describes the inter-relationships between the various events in Table III and, if enough probability information is known, leads directly to the computation of the proba-bility of the event of interest (in this case, core melt from an anticipated transient followed by failure to reduce core power) . Figure 1 shows such a com-putation associated with the event tree. As shown in Figure 1, the computed probability of a core melt accident from an anticipated transient event followed by failure to rgduce core power based on the assumptions and analyses presented herein is 3.4 x 10 per year, about 3.4 times per hundred thousand. Over the remain-ing 30-year lifetime of the plant, this means that the likelihood of this accident is about one chance in 100.

7

Probs.bility of -

core melt from 3.4x10-4 per year -

, anticipated tran- [(4) (8.4x10-5))

sient and failure reduce core power and ,

8.4x10

-5 Failure to Anticipated

, Transients [(1.4x10-4) (0.6)] reduce core n m. ,-

4 per year and

1. • il"** I Failure of 0.6 per demand reserve

" scram" (0.5+0.1) shutdown -

system .

. . '-4 1.4x10 per demand

~

or

/%

Manual re-

'0.5 per demand. cire. pump Liquid poi-trip fail. 0.1 per demand son injec-tion failure Computation of Probability of Core Melt in the Oyster FIG. 1

• • l' **.

reliminary Draft

, TABLE III Assessment of Probabilities Associated with

. Anticipated Transients without Core Power Shutdown Probability Event WASH-1400 Oyster Creek

1. Anticipated Transients: 10 (Appendix V, 4 (Section II-Frequency per year Sec. 4.3) C.l.)

~

2. " Scram" system failure 1.3x10" (Appen- 1.4x10 (Ap-probability, per demand dix II, Sec. 6.2) pendix A of this report)

3. Recirculating loop pump Negligible 0.5 (Sec. III-C.4.)

failure probability, per demand

4. Failure to manually 0.1 (Appendix V, 0.1 (Same as WASH-introduce liquid poison Sec. 4.3) 1400 value)

b. Anticipated transient followed by failure to remove decay heat. The second accident sequence which was determined in WASH-1400 to contribute signi-ficantly (see Appendix A) to the BWR core melt accident probability was a transient-initiated accident followed by failure to remove core decay heat (described on page V-52 of WASH-1400) . Af ter reviewing the accident sequence described in WASH-1400 for Peach Bottom II and investigating decay heat removal systems in Oyster Creek, it was determined that the WASH-1400 analysis does not apply to Oyster Creek. Several reasons exist for this, but the main one is the l existence of the isolation condensor system (ICS) in Oyster Creek. There is no comparable system in Peach Bottom II. In order to determine the core melt j probability in Oyster Creek from a transient accident followed by failure to remove l decay heat, an independent assessment was performed. This is described next.

1 Following an anticipated transient with successful core power reduction (scram), i the ICS would be used in Oyster Creek to remove decay heat. This system consists of a closed loop heat removal system which is connected to the primary cooling system. The ICS is normally isolated ',the primary system by two valves in parallel. When the ICS is needed (such as for removal of decay heat), the valves are opened and the primary system cooling fluid from the core (mostly steam) flows through the ICS to a heat exchanger, is condensed, and the resulting water flows back into the bottom of the reactor vessel via the main recirculation lines. The ICS is arranged so that the cooling cycle occurs by natural convection; special pumping power is not required. In addition, the ICS valves are operated by DC power available from within the plant so that the loss of all AC power (e.g., from off-site) does not disable the system. The valves are automatically activated following an anticipated transient. Heat is removed from the ICS heat exchanger by steam production; the steam is released to the outside atmosphere. The water supply for this heat removal is provided by a supply tank which can supply water for 13/4 hours following initial operation of the ICS. If the ICS fails (by failure of the valves to receive an opening signal when required, by tailure of the DC power supply, or by mechanical failure of the valves), two other mechanisms are available

,,g.. .  !

I Preliminary Draft ,

to' remove heat. One is removal via the power conversion system (PCS); this requires that the main steam isolation valves (MSIV) be manually opened, the .

turbine bypass valves opened, and the feedwater pumps started. The MSIVs ,

automatically close for most anticipated transients, and the feedwater pumps trip  !

off, that is, close. If both the ICS and the PCS fail, an automatic depressu-rization system (ADS), designed to automatically activate, should come into play, reducing primary system pressure. When the pressure drops to a pre-set level, the core spray injection systems activate automatically to maintain water in the '

reactor vessel for core cooling. The steam produced from the core is vented through the ADS relief valves to the water in the " torus", a water-holding chamber  ;

beneath the reactor. Heat is removed form this water by the torus heat removal

' l

! systems (two redundant systems) . Heat is transferred by these systems into a heat exchanger fed by water from the emergency service water system.

Since the ICS self-contained water supply lasts only 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 45 minutes, it  ;

is necessary, after this time has elapsed, to add additional water to the ICS. j This can be accomplished by either pumping water from a storage tank or from the fire water system. The storage tank capacity is sufficient to supply adequate water to the ICS heat exchanger for at least one day. The fire water supply is j essentially unlimited, coming from sources external to the plant.

Given that the ICS self-contained voter supply is adequate for 1 3/4 hours, it is convenient to consider the decay heat systems for two time periods during the accident, those decay heat removal systems available at times less than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 45 minutes and those systems available after 1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 45 minutes. Fault trees j were constructed for both time periods and are shown in Figures 2 and 3; the 4

failure probabilities for each system are also shown. These probabilities were derived by various means as shown.in Table IV. It should be recognized that the 3

failure probability of some of the systems, notably the ICS, have not been deter-mined with the full rigor used in WASH-1400 since such quantification is beyond the

scope of this effort. Instead, in these cases, failure probabilities were assessed based on values for similar systems in WASH-1400. The explanation for each system failure probability is given 1n the right hand column of Table IV.

Figure 2 shows the probability of failure to remove core decay heat within 13/4 hoursfollowingananticipatedtransiengintheOysterCreekreactor. As can be a seen, this failure probability, 1 x 10- (or about one in one hundred million)

is negligible. Figure 3 shows the probability of failure to remove decay after 1 l 3/4 hours (whentheself-containedwatersupplyfortheICSisexhausted).

The result is 1.4 x 10' (about 1.4 times in one million) . Obviously, this

second time period dominates the decay heat removal failure following anticipated transient.

Assuming, as discussed previously, that the frequency of anticipated transi-ents is 4 per year, the probability of a core melt in the Oyster Creek reactor fromananticipatedtransientfoglowedbyfailugetoremovedecayheatisassessed to be 4 multiplied by (1.4 x 10 ) or 5.6 x 10 per year (about 5.6 chances in a million) . Thus, over the remaining 30-year life of the reactor, the likelihood of ag ore melt by this mchanism is thirty times larger this value per year or, 1.68 4

x 10 (about one chance in 6,000).

Failure to re-move decay heat ~1

' 10 -

within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 45 minutes and -

~

PCS fail-Failure of 10 ure Failure'of -2 isolation low pressure 1.3x10 condenser sy s. -3 heat remova) 7x10 cr or f~% .

f7% .

i l

1. "il"** f Failure of -3 -4

• Torus heat DC power to 10 valves to 10 ADS failure removal valves oPen failure

~3 -2 5x10 1.3x10

, and 4

Failure of Failure of

. . first second

! valve valve -

~3 ~1 I. +

, . 10 10 FIG. 2 - Computation of Probability of Failure to Remove Decay Heat ..

. -~. ...

Failure to R:-

move Decay Heat -0

, 1.4x10

, after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, ,

45 minutes and 1 I .

Isolation PCS failure 7x10

-3 Failure to Condenser 10 remove de- 2x10" Failure

{agheatat ,

1. '- or or r% p-~s ,

p.-

Failure of Failure to Torus heat y,1y,,

10

-2 MS fauun deliver va- removal water to fail heat exchanr .

ter to core failure 4.8x10-4 -2

, ' 5x10-3 1.3x10 (negligible)

! and -

and

's ,

Failure of Failure to CSIS fail- Fire water

$$kdena!$ Se f om fire "

ssem{ CSIS fail- injection storage s ter systen ure (2nd ,

infinra

~

0.1 0.1 4.8x10 system) i o,1 a

. 0.1

i FIG.'3 - Computation of Probability of Failure to Remova Decay Heat after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 45 minutes

e :'** o ,

i .

eliminary Analysis I

. 3.

• Numerical Result of Oyster Creek Core Melt Probability. Based l

• on the analyses presented in previous sections of this report, the Oyster Creek core melt accident probability is dominated by an anticipated transient i followed by failure to shut down core power generation. The total core f melt probability per year from the twg dominant accidents considered, as illustrated in Table V, is 3.46 x 10 , about 3 1/2 chances in ten thousand per year.

TABLE IV l

Assessed Failure Probability for Oyster Creek Systems l Failure Probability Rationale for System or Component Failure Probability

~

DC power failure 10 pg. II-88*

First valve failure 10

~

Appendix III*

~

Second valve failure 10 Appendix III*

(common mode considerations)

PCS failure 7 x 10 -3 Pg. V-41*  ;

-3 pg. 11-404* l ADS failure 5 x 10 l

~

Torus heat removal failure 1.3 x 10 pg.11-177 l (similar to PWR LPRS)*

Valve fails closed Negligible After being opened, valve failing closed is very unlikely, especially compared to failure of water to ICS heat exchanger

~

CSIS 1 '!ure (first system) 4.8 x 10 pg. II-387*

~

CSIS failure (second system) 10 Appendix II*

(common mode consideration)

• from WASH-1400

d ,**' o ;

' ~ - -

. t Preliminary Draft  !

TABLE V 1

Core Melt Probability for l l the Oyster Creek Reactor  !

i Core Melt  ;

Accident Probability (per year)  !

[

5 i -4

! Anticipated transient withput scram 3.4 x 10 j Anticipated transient with failure to 5.6 x 10"  !

remove core decay heat after 1 3/4 hours . i TOTAL 3.4 x 10' t

Taking into account both of these dominant sequences, this probability means l that, over the remaining 30-year design lifetime of the Oyster Creek reactor, l theoverall.probabilgyofacoremeltaccidentis30timeslargerthanthe l annual value, 1 x 10 , or about 1 chance in 100. l It would be of considerable value to establish the uncertainty limits for the  !

Oyster Creek core melt probability as assessed here. However, any computation of uncertainty limits vould involve sulstantial further effort requiring detailed I

- knowledge of the failure uncertainty associated with each component of each system, 'i the test and maintenance schedules, possible common mode contributions and their  ;

related uncertainties, etc. This information would have to be combined in a .i compicx~ statistical manner in order to catablish uncertainty limits and confidence l intervals. This full quantification of these uncertainties is beyond the scope of j the present effort. As an alternative, a sensitivity study was undertaken to determine the relative significance of factors involved in the computation of the Oyster Creek core melt probability. The details of this study are presented in Appendix B. Table VI is a composite tabic showing the results of the study. The first column identifies the contributor used in the core melt probability compu-tation, and the second column gives the decrease factor in the core melt proba-bility for a factor of two decrease in the value used above for the contributor listed in the first column. Only those factors associated with the anticipated I

transient witbout scram accident are considered since no other sequences are significant by comparison. ,

TABLE VI Core Melt Sensitivity Study Factor of Change in Core Melt Probability Core Melt Probability for-Factor of 2 Changesin the Core-Contributor Melt Probability Contributor

1. Anticipated Transient Frequency 2 2.- Scram Failure Probabilities 2

3. Recirculation Pump Trip Failure 1.7 '

4. Manual Poison Injection Failure 1.1 Probability l

e

ca . o , Preliminary Draft

' A3"dhown in the t blo, the are melt probability is most sensitive to the frequency of anticipated transients and the scram failure probability. In both cases,,a

-reduction

,bility.

of a factor of 2 would result in a similar reduction in core melt proba-The results in Appendix B shows that if the probability of recirculation pumptripsweretobemadenegligible(aswasassumedinWASil-lg0forPeachBottom 11), the core melt probability would be reduced to about 2 x 10 or 1 chance in 500, rather than 1 chance in 100, over the remaining design operating life of the Oyster Creek reactor.

The largest uncertainty, by far, is in the foregong analysis of scram failure probability.

The simplified analysis given in Appendix A for scram failure at Oyster Creek is undoubtedly inadequate in view of the importance of this factor.

llowever, it is not clear that techniques readily exist at this time which would ,

ellow the derivation of a value that could be applied with greater confidence. In view of these uncertainties, a survey was undertaken to determine what scram failure probabilities have been derived by various investigators. The results of this sugvey are summagized in Table VII. The tabic shows that values ranging from 4 x 10 to 1.5 x 10 value used in this study (1.4 x 10have been qug)ted for scram , failure probability. The is at the high end of this range ; and therefore -

tends V11 Table to produce a high value for the core melt probability.

also includes a core power shutdown failure probability  ;

wh ' c.h includes the reliability of the combination of recirculation  !

pump trip and manual poison injection as a backup to scram failure (evaluated only for WASH-1400 and this study). l l

VII also includes a core power shutdown failure probability which includes the l

reliability of the combination of recirculation pump trip and nanual poison  !

injection study).

as a backup to scran failure (evaluated only for UASil-1400 and this k

It should be noted that, as a result investigation of anticipated transients without scramof the U.S. Atom g nergy Commission's

. General Electric Co. has proposed to incorporate automatic matic poison injection as a backup to scram failure recircula g pump trip and auto-

. It is not known what the current NRC requirements are for the incorporation or retrofitting of euch a system in BWRs.

If such a syqcm vere employed on Oyster Creek, and assuming a failure probability of 10 (which should be easily attainable),

the core melt probability, based on the results of this study, could be reduced to one chance in over 3000 for the remaining life of the Oyster Creek reactor.

TABLE VII Survey of Core Power Shutdown Failure Probability Source Reference Scram Failure Probability Core Power Shutdown Failure Probability AEC 22 1x10 and 4x10 -

WASH-1400 2 -5 1.3x10 1.3x10 Fullwood 23 1.9x10 , 8. -6 1.5x10gx1g2),and -

This Study 1.4x10 -0 8.4x10 -5 (1) These values are based on data from a variety of reactors.

(2)

Based on different statistical treatments of data from light water reactors. .

im

J ,<*l w

~ ~

celiminery Droft a

V.. REFERENCES t

1. Oyster Creek Unit No. 1 Facility Description and Safety Analysis Report, Jersey Central Power and Light Co.

2. Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, WASH-1400 (NUREG-75/014).

3. Final Safety Analysis keport, Peach Bottom Atomic Power Station Units No. 2 & 3 Philadelphin Electric Co. (October 1970).

4. Semi-Annual Report No. 2, Provisional Operating License No. DPR-16, Oyster Creek Nuclear Generating Station Unit $1, Plant Operations (1/1/70 to 6/31/70).

5. Semi-Annual Report No. 3, Provisional Operating License No. DPR-16, Report of Operations (7/11/70 to 12/31/70), Jersey Central Power and Light Co. , Oyster Creek, Nuclear Generating Station.

6. Ibid, Report No. 4, 1/1/71 to 6/30/71.

7. Ibid, Report No. 5, 7/1/71 to 12/31/71.

8. Ibid Report No. 6, 1/1/72 to 6/30/72.

9. Ibid, Report No. 7, 7/1/72 to 12/31/72,

10. Ibid, Report No. 8, 1/1/73 to 6/30/73.

11. Ibid, Report No. 9, 7/1/73 to 12/31/73.

12. Ibid, Report No. 10, 1/1/74 to 6/30/74.

13. Ibid, Report No. 11, 7/1/74 to 12/31/74.

14. Ibid, Report No. 12, 1/1/75 to 6/30/75.

15. Ibid, Report No. 13, 7/1/75 to 12/31/75.

16. Operating History of Oyster Creek (through) 1974. Dept. of Environmental Protection (New Jersey), Bureau of Radiation Protection.

17. Meeting at Morristown, N.J., June 7, 1976.

Attendees: Dr. Glenn Paulson, State of New Jersey, DEP Dr. Peter Preuss, State of Ne Jersey, DEP Donald A. Ross, Jersey Central Power and Light Thomas M. Crimmins, Jr., GPU Service Corp.

Nick G. Trikouras, CPU Service Corp.

P.R. Davis, Consultant, State of New Jersey w.

e rE a t

~

~

Ireliminary Draft'  !

t F 18. Reactor Safety Study (WASH-1400): A Review of the Draft Report,

.; EPA-520/3-75-012 ( August 1975) . j A heview of the Final Report, U.S.  !

19. Reactor Safety Study (WASH-1400):

Environmental Protection Agency (June 1976). .

20. Oyster Creek Nuclear Generating Station, Docket 50-219, Single Failure ,

Analysis - ECCS System (June 24, 1975) (including Attachment II, ECCS ,

Modifica tion) .

21. Testimony of Birdenbaugh, Hubbard, and Minor, Joint Committee on  :

Atomic Energy (May 13, 1976).

22. Technical Report on Anticipated Transients Without Scram for Water-  !

I Cooled Power Reactors, WASH-1270 (Sept. 1973).

23. Estimation of Scram Failure Probability in a Bayesian Framework, R.R. Fu11 wood,1976 Annual Meeting of the American Nuclear Society, Toronto, Canada (June 1976) (TANSA023 1-637).

}

24. Studies of BWR Designs for Mitigation of Anticipated Transients Without Scrams, Z. W. Baysinger, et al General Electric Co., NEDO-20626 (Oc t. 1964) (also Amendment 2, July 1975).

25. The Nuclear Regulatory Commission's Reactor Safety Study, J. Yellin, Bell Journal of Economics 7, 317f f ,1976.

I l

l