ML20101G263

Summary of Chernobyl Followup Research Activities

ML20101G263
Person / Time
Issue date:	06/30/1992
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
NUREG-1422, NUDOCS 9206250386
Download: ML20101G263 (74)

Text

{{#Wiki_filter:~.s .g p,7 - 3,

{-

a - i NUREG-1422 l iV. ~ * ' e..._...e s Summary of Chernobyl Followup Research Activities r-1 r ^ .1 n '. M. [ UISkNuclear Regulatory Commission Omce of Nuclear. Regulatory-Research {: ^ t E f 4 9206250386 920630 PDR NUREO M22 R PDR

h v: [' AVAILABILITY NOTICE Availability of Reference Materials C:ted in NRC Publications Most documents cited in NRC pub" cations will be available from one of the following sources: a 1. The NRC Public Document' Room, 2120 L Street, NW., Lower Level Washington, DC N 20555' 2. The Superintendent of Documents, U.S Government Printing Office, P.O. Box 37082, . Washington.. DC 20013-7082 g , 3, The National Technical Information Service, Springfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publica. ~ W 'tions, it is not intended to be exhaustive, g . Referenced documents aval!able for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC bulletins, circulars [information notices, inspection and investigation notices; licensee event reports;

vendor reports and correspondence; Commission papers

• snd applicant and licensee docu-ments and correspondence.

Tlie following documents in the NUREG series are avaliable for purchase from the GPO Sales. .. Program: Jormal NRC staff'and contractor reports NRC sponsored conference proceed-ings, international agreement reports, grant publications, and NRC booklets and brochures. ' Also available are regulatory guides, NRC regulations in the Code o/ Federal Regulations, and Nuclear Regulatory Commission Issuances,

Documents available from the National Technical information Service include NUREG series

), reports and technical reports prepared by other Federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission. . Documents available~ from public and speclat technical libraries include all open literature itemsi such as books, journal articles, and transactk,1s. Federal Reglster notices Federal and State legislatbn," and congressional ~ reports can usually be obtained-from these libraries.. Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference proceedings are available for purensse from the organization, sponsoring the p-publicatk 1 citede s Single copies of NRC draft reports are available free, to the extent of supply, upon written request to the Office of Administratloa, Distribution and Mail Services Section, U.S. Nuclear , p . Regulatory Commission, Washington, DC 20555. e ' Copies of industry codes and standards used in a substantive manner in the NRC regulatory prccess are maintNned at the NRC Library,-7920 Norfolk Avenue, Bethesda, Maryland, for P use bkthe public. Codes and standards are usually copyrighted and may be purchased !from the origineting organization or, if they are American National Standards, from the . American National Standards Institute,1430 Broadway, New York, NY 10018. i ,....N .$__~.

N U R EG-1422-l _ - - - _ ~ -. -... -.... _ - - - - _... --m.- ...- ~ ~ _7 - -. ~.. Summary o::, taerno 3yl q Folowup Research Ac":ivi:ies - MEs" -. w *Wm -, m EM e-ee m*e - ame.em4am ew-w 6mm wam. d U.S. Nuclear Regulatory Commission i Office of Nuclear Regulatory Research l $pn **%q'o, 4 V 9206250386 920630 PDR NUREC 1422 R PDR

a AVAILABILITY NOTICE Availabihty of Reference Materials Cited in NRC Pubhcations Most documents cited in NRC pubhcotions wdl be available from one of the following sourCos; 1. The NRC Public Document Room, 2120 L Street, NW., Lower Level, Washington, DC 20555 2. The Superintendent of Documents, UA Government Printing Offico, P.O. Box 37082, Washington, DC 20013 7082 3. The National Technical information Servico. Springfield, VA 2/161 Although the listing that follows represents the majority of documents cited in NRC pubhca-tions, it is not intended to be exhaustive. Referenced documents availab!o for inspection and copying for a for from the NRC Pubbc Document Room include NRC correspondenco and internal NRC memoranda; NRC bulletins, circulars, information noticos, inspection and invest gation notices; bcenseo event reports; vendor reports and correspondence; Commission papers: and applicant and hcensee docu-menti and ccrrespondence, 1n0 foSowng documents in the NUREG sones are availabio fo" purchane from the GnD Sales Progrea: formal NRC staff and contractor reports, NRC-sponscred conference proceed-ings, anternational agreement reports, grant pubhcations, and NRC booMets and brochures, AIC., available are regulatory guides, NRC tegulations in tho Codo of Federal Aegulahons, and Nuclear Rogulatory Commission Issuances, Documents available from the National Technical information Service include NUREG ser;es reports and technical reports prepared by other Federal agencios and reports prepared by the Atomic Energy Commission, forerunner agency to the Nucient RegJatory Commission. Documents available from pubhc and special technical I,braries include all open hteraturo items, such as books, journal articles, and transactions Feceral Register notices, Federal and State legislation, and congressional reports can usually be obtained from these libraries, Docurnents such as thosrs, dissertations, foreign reports and trarstations, and non NRC confurer.co proceedings are available for purchase from the organization sponsoring the pubhcation cited, Singto copies of NRC draf t reports are avadable free, to the extent of supply, upon written request to the Office of Administration, Distribution and Mail Services Section, U.S. Nuclear Rogutatory Commission, Washington, DC 20555. Copies of industry codes and standards used in a substantivo manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfo:k Avenue, Bethesda, Maryland, for uso by the pubhc. Codes and standards are usva!!y copyrighted and may be purchased from the originating organizatinn or, if they are American National Standards, from the American National Stanc:ards Institute,1430 Broadway, New York, NY 10018.

~-. _ _ _.. _ _ _ _ _ _ NUREG-1422 Summary of Caernobyl Followua R.esearc1 Activities Manuscript Cornpleted: May 1992 Date Published: June 1992 Division of Safety issue Resolution Ofuce of Nuclea. Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555

p....u l

l l l e-t mr'- -6 m-m --a s -a ap is-a .u-

ABSTRACT In NUREG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," April 1989, the NRC staff concluded that no immediate changes in NRC's regulations r<garding design - or operation of U.S. commercial reactors were needed; however, it recommended i that certain issues be considered further. NRC's Chernobyl followup research program consisted of the research tasks undertaken in response to the recommen-dations in NUREG-1251. It included 23 tasks that addressed potential lessons to be learned from the Chernobyl accident. This report presents summaries of NRC's Chernobyl followup research tasks. For each task, the Chernobyl-related issues are indicated, the work is described, and the staff's findings and conclusions are nresented. More detailed reports concerning the work are referenced where applicable. This report closes out NRC's Chernobyl followup research program as such, but additional research will be conducted on some issues as needed. The report inciudes remarks concerning significant further activity with respect to tha issues addressed. I L 1 - NUREG-1422 iii

. _. ~ - l l 1 CONTENTS P_agg ABSTRACT............................... iii INTRODUCTION............................. 1 Chapter 1 ADMINISTRATIVE CONTROLS AND OPERATIONAL PRACTICES........ 1-1 Task 1.1A, " Symptom-Based Emergency Operating Procedures".... 1-1 Task 1.1B, " Procedure Violations"................ 1-2 Task 1.2A, " Test, Change, and Experiment Review Guidelines"... 1-7 Task 1.2B, "NRC Testing Requirements".............. 1-9 Task 1.3A, " Bypassing Safety Systems".............. 1-14 Task 1.4A, " Engineered Safety Feature Availability"..,.... 1-16 Task 1.40, " Technical Specification Bases" 1-17 Task 1.40, " Analysis of Risk at Low-Power and Shutdown Conditions"..................... 1-19 Task 1.6A " Assessment of NRC Requirements on Management".... 1-27 Task 1.7A, " Accident Management" 1-29 '2 DESIGN 2-1 Task 2.1A,_" Reactivity Accidents"................ 2-1 Task 2.3A, " Control Room Habitability" 2-7 Task 2.3B, " Contamination Outside Control Room"......... 2-9 Task 2.30, " Smoke Control" 2-10 Task 2.3D, " Shared Shutdown Systems" Task 2.4A, "Firefighting With Radiation Present" 2-12 2-14 3 . CONTAINMENT.-...............-......,,... 3-1 l Task 3.1A, " Containment Performance" 3-1 Task 3.2A, " Filtered Venting", 3-4 4 EMERGENCY PLANNING 4-1 Tasks 4.3A, " Ingestion-Pathway Protective Measures"; 4.4A, " Decontamination"; and 4.4B,MRelocation"..................... 4-1 5 SEVERE-ACCIDENT PHENOMENA.,.......... 5-1 Task 5.1A, " Mechanical Dispersal in Fission-Product Release"... 5-1 Task 5.2A, " Stripping in Fission-Product fselease"........ 5-5 .NGREG-1422 v - 1 .i

l INTRODUCTION In April 1989, the U.S. Nuclear Regulatory Commission (NRC) staff issued NUREG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Com-mercial Nuclear Power Plants in the United States," Final Report. As reported in NUREG-1251, Volume 1, the NRC staff concluded that no immediate etinges in NRC's regulations regarding design or operation of U.S. commercial reactors were needed; however, it recommended that certain issues be considered further. The staff found that most of these issues were already under consideration as a part of ongoing NRC work, but adjustments of ongoing programs were made to take the Chernobyl lessons into account. In a few cases, the staff initiated new research tasks as a direct result of_the recommendations stemming from its assessment of the implications of the Chernobyl accident. NRC's Chernobyl followup research program consisted of the research tasks undertaken in response to the recommendations in NUREG-1251. It included 23 tasks that addressed potential Chernobyl lessons. Nine of these tasks involved issues pertaining to operational practices and administrative controls, six involved design-related issues, two were related to the containment, three to emergency planning, and two to severe-accident phenomena. To the extent that reactor type had a bearing, these 23 tasks addressed primarily light-water reactors. Two additional tasks recommended in NUREG-1251 were related to high-temperature gas-cooled reactors (HTGRs). These tasks were not pursued, because Fort St. Vrain, which was the country's only operating HTGR, ceased operation in 1989. The staff initiated three of the Chernobyl followup research tasks in direc*. response to the Chernobyl implications assessment. These were Task 1.18, " Procedure Violations"; Task 1.40, " Analysis of Risk at Low-Power and Shut-down Conditions"; and Task 2.1A, "Roactivity Accidents." A fourth task, 1.2B, "NRC Testing Requirements,t' was initiated partly in response to the Chernobyl implications assessment and was influenced by Chernobyl, but would have been undertaken even in the absence of the Chernobyl assessment. The remaining 19 -tasks represent limited adjustments of-ongoing NRC (or NRC-sponsored) projects. This report presente summaries of NRC's Chernobyl followup research tasks. For each task, the Chernobyl-related issues are indicated, the work is described, l and the staff's findings and conclusions are presented. More detailed reports concerning the work are referenced where applicable. This report closes out NRC's Chernobyl followup research program as such. It should be noted, however, that some of the tasks involve issues on which work will continue beyond the-nominal closeout of the Chernobyl followup program (e.g., Task 1.40, " Analysis of-Risk at Low-Power and Shutdown Conditions," and . Task 4.4A, " Decontamination"). Such work, even when its content is clearly

influenced by the lessons learned from the Chernobyl accident, will be pursued in the normal course of NRC business.

The Chernobyl followup program is not being extended as a discrete program to encompass such further activities. The individual task summary reports presented include, where applicable, remarks concerning significant further activity with respect to the issues addressed. NUREG-1422 1

The task summary reports are presented in the order in which the issues are addressed in NUREG-1251. The numeric part of each task number corresponds to the number of the section in NUREG-1251 in vhich the issue is discussed and the task's work is reconnended, k s + HUREG-1422 2

k CHAPTER 1 ADMINISTRATIVE CONTROLS AND OPERATIONAL PRACTICES TASK 1.1A, " SYMPTOM-BASED EMERGENCY OPEMTING PROCEDURES" Task Leader: Susan F. Shankman, Hume. W ' ac Assessment Branch, Division of License Performance and [ vli+ Evalui u, Office of Nuclear Reactor Regulation Issue: At Chernobyl serious operational errors aggravated the emergency situation that occurred and were crucially implicated in the disan rous consequences that ensued. Although design and operational-control protection at U.S. reactors provide assurance against the chain of events that occurred at Chernobyl, the Chernobyl experience suggests close attention should be paid to effective emer-gency operating procedures (E0Ps) and the ability to use_them. Symptom-based E0Ps and their full implementation are a key part of the necessary preparedness for effective management of emergencies. Recent audits by the NRC contir.ue to identify deficiencies in the implementation of new symptom-based E0Ps. In addi-tion,-NRC examinations have identified the need for additional training on the use of these-EOPs.

Purpose:

-To take into consideration the Chernobyl experience through increased emphasis on symptom-based E0Ps. Scope: The staff undertook an accelerated inspection program pert. ing to the E0Ps, -which was-aimed at evaluating whether they were technically correct, whether= they could be physically carried out, and whether they could be correctly car-ried out_.,All-U.S. reactors have been inspected. Possible regulatory action to further upgrade programs or further study of any inconclusive results will be considered as part of the staff's ongoing evaluation of the results of this inspection program. This Chernobyl followup task consists of the integration of Chernobyl lessons'into this E0P effort. Work

Description:

During-1988, the NRC staff inspected.EOPs at 30 plant sites. The inspections included an audit of the technical adequacy of the E0Ps, control room and plant walkdowns, simulator exercises, and a review of licensees' programs for ongoing evaluation and revision of E0Ps. In. late 1988 and early 1989, the NRC staff met with each of the vendor owners groups to_ discuss the inspection findings. At those meetings the staff reiter-ated the importance of_ developing and maintaining high quality E0Ps, of providing operators with appropriate training, and of requiring compliance with the E0Ps. NURE M A22 1-1

In June 1989, the Nuclear Management and Resources Council (NUMARC) sponsored E0P workshops in-Washington, D.C., and Denver, Colorado. The NRC staff parti-cipated in both the planning and implementation of these workshops, and repre-sentatives from most nuclear utilities attended the workshops. Open discussions were held on a variety of topics including those relevant to Cf..rnobyl issues such as training and procedural compliance. The workshops provided an excel-lent forum for' reemphasizing NRC expectations in the area of symptom-based E0Ps. Findings: The great majority of E0P problems identified during inspections conducted from ~ March to October 1988 resulted from incomplete implementation of E0P programs. The most significant programmatic problems were lack of a multidisciplinary team approach in the development of E0Ps, lack of independent review of the E0Ps, and lack of a systematic process for ensuring that the quality of E0Ps does not deteriorate over time. These findings were discussed with NUMARC ano the owners groups and were published in NUREG-1358 (Ref. 1; see also Ref. 2). The E0P inspection program has been completed, and all operating plants have been inspected. Results of the inspections conducted in fiscal years 1989 through 1991 indicated some improvement in the implementation of E0P programs; however, problems previously identified in NUREG-1358 continue to exist. Sig-nificant findings from the recent E0P inspections will be addressed in a sup-plement to NUREG-1358 thct is being developed.

== Conclusions:== At present, there appears to be no need for the NRC staff to develop additional i regulatory actions or initiate new research pertaining to E0Ps. In general, a system of E0Ps is in place in plants that results in emergency actions needed to bring the plant to a safe shutdown condition. The NRC staff has identified needed improvements-in both the E0Ps and their supporting programs, and licensees are committed to making these improvements. The staff continues to monitor plant performance in this area, and E0P followup inspections will continue to be conducted as necessary.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1358, " Lessons Learned From the Special Inspection Program for Emergency Operating Procedures," April 1989. 2. G. Lapinski, S. Shankman, and W. Regan, "An Interim Report on the NRC Special Inspection Program for Emergency Operating Procedures," paper presented at the winter meeting of the American Nuclear Society in San-Francisco, California, November 1989. TASK 1.1B, "PROCFDURE VIOLATIONS" Task Leader: Jerry Wachtel, Human Factors Branch, Division of Systems Research, Office of Nuclear Regulatory Research Issue: Among the root causes of the Chernobyl accident was a series of procedure violations committed before and during the event. For example, the test NUREG-1422 1-2

procedure was never submitted to the RBMK design group for a safety evaluation -before the test was performed, in violation of Soviet administrative review requirements. In addition, while conducting the test. the Chernobyl operators violated the test procedure and, more importantly, violated their standard oper-ating requirements by disabling the emergency core cooling system in order to complete the test. Because of design differences between the RBMK reactor and the reactort in use in the U.S. commercial nuclear power industry (notably the avoidance of positive void reactivity coefficients and the use of containment structures), an accident identical to Chernobyl could not happen here. However, the NRC's concerns about the possibility of procedure violations causing a significant event in the L United States led to the initiation of a research project on this issue. As I the NRC's Chernobyl Task Force noted in NUREG-1251 (Ref. 1): Although the. staff recognizes that errors and violations will occur, the measures taken by the NRC and the industry should keep violations l to a minimum. Since Technical Specifications containing the opera-bility requirements for safety equipmeni. are so prominent in opera-tors' and management'c minds, the staff believes that operators, because of their concern for safety, will not willing~.y violate these L requirements and put the reactor in jeopardy. It should be recog-L nized, however, that since violations of procedures do nevertheless-occur, a study that would characterize the nature, severity, and fre-quency of violations could be of value. It might provide a firmer ( basis for a reassuring conclusion or lead to a consideration of addi-tional means of reducing inadvertent violations and deterring willful ones. (p. 1-6)

Purpose:

To (1) distinguish intentional procedure violations from errors and (2) assess the extent, nature, and consequences of procedure violations in U.S. commercial nuclear power plants. Scope: The scope of inquiry was a search for and analysis of published reports of procedure violations in U.S. commercial nuclear power plants that occurred during the period extending from January 1984 to July 1988. Although the NRC had previously sponsored research assessing industry practices and problems associated with plant emergency, normal, abnormal, and maintenance procedures in response to Item I.C.9 of the Three Mile Island Task Action Plan (Ref. 2), prior studies have not focused on the particular issue of procedural adherence. Consequently, this project was a new task arising out of the Chernobyl Task -Force's Concerns. Work

Description:

Personnel-at Battelle's Human Affairs Research Centers and at the Pacific Northwest Laboratory screened more than 1,200 incident reports and identified 707 occurrences in which a failure to follow procedures played a role. These occurrences were then further characterized as described below. NUREG-1422 1-3

~ The term " procedure violation" can refer to'any failure to follow the procedural and administrative requirements that guide humar actions in the work processes of nuclear power plants. However, NRC Enforcement Policy (10 CFR Part 2, Appendix C (Ref. 3)) specifically distinguishes between violations that are " willful" and those that are " inadvertent." This distinction depends on evi-dence regarding the intentions and knowledge of the worker committing the vio-lation.. Thus, in cooperation with the NRC's Of fice of Enforcement, three ca;e-gories of procedure violations were operationally defined for this project to conform with the language in 10 CFR Part 2, Appendix C, as regards.the concept of willfulness: Level A Violation - A procedure violation which, in the judgment of the NRC, has been determined by a preponderance of the evidence to have been " willful" as defined in 10 CFR Part 2, Appendix C. Note that thcse procedure violations defined in this study as Level A were subject to NRC enforcement actions. Level B Violation - A procedure violation which may or may not have been " willful," as defined in 10 CFR Part 2, Appendix C, but for which either: (a) insufficient information was available to the NRC, after review, to make a determination of willfulness based upon a preponder-ance of the evidence; or (b) due to NRC resource limitations and an apparent lack of safety significance, the procedure violation was not subjected to the scrutiny of such a review. Level C Violation - An inadvertent procedure violation which clearly -was not " willful." These violations may be due to error, misjudgment, ignorance, or confusior, Procedure violations that occurred during the study period and that were described in either licensee event reports (LERs) or NRC inspection reports (irs)-reported in NUREG-0940 (Ref. 4) comprised the two data sets used in the subsequent analyses. Each violation was coded according to the plant and region involved, the level of the violation committed (i.e., Level A, B, or C), the type of procedure or administrative requirement involved, the job category of the person committing the violation, the probable cause(s) of the violation, i and the consequences of the incident. Insufficient detail in many of the reports reviewed made it impossible to derive complete information from the data avail-able. Level B and C violations data were statistically analyzed to address the central questions of th'e study; however, the small number of Level A violations precluded their inclusion in the statistical analyses. i Findings: The data on the extent of procedure violations indicated -that all-three levels -of violations occurred in U.S. nuclear power plants during the study period. However, only 1.4 percent of '.he reported violations were coded as Level A vio-lations (10 out of 707). A' larger number of "iolations were categorized as Level Bs (118 out of 707, 16.7 percent). The very large majority of the vio-1ations were characterized as Level Cs (579 out of 707, 81.9 percent). Although not based on a random sample of plants, statistical examination of the distribution of the IR data set across plants showed that some plants had higher numbers of procedure violations than would be expected if violations NUREG-1422 1-4

were randomly distributed. These findings may indicate that some plants had weak procedu.'e programs and procedure adherence policies; however, a number of other interpretations are plausible, such as differences in the perspectives on procedure adherence of NRC and licensee personnel (i.e. the authors of irs and LERs, respectively) or variations in NRC inspection practices at different sites. It was not possible to assess whether the extent of the violations found was " excessive." This is because data do not exist regarding the number of oppor-tunities to violate procedures against which the actual frequency of violations identified in this study could be evaluated. It is likely, however, that the number of violations found in this study underestimates the extent to which each type of procedure violation occurred during the study period. This is due to several factors. First, the LERs reviewed comprised only a small sample of the entire population of LERs submitted during the study period. It is likely that a complete review of all LERs from that period would reveal more procedure vio-lations. Second, the violations reviewed represented only those that had been detected and reported in LERs or irs. It is possible that other violations were committed that were neither detected nor reported, or that were reported in other documents. Findings regarding the nature of the violations indicated that all types of plant personnel, including licensed operators and senior reactor operators, and all types of procedural requirements, including technical specifications, were involved. Although the relative numbers of violations of each type of plant procedure dif fered in the two data sets, the distributions of violations appeared to be consistently related to the frequency with which procedures of each type are performed in plants. For example, although only small numbers of violations of abnormal and emergency operating procedures were observed in the data sets, these procedures also are the most infrequently performed. The assessment of the relative involvement of different types of plant personnel mas constr6ined by the fact that the job roles of the workers committing the violations were not reported, nor could they be inferred, in nearly 50 percent of the irs and in about 60 percent of the LERs reviewed. Additional findings of interest pertained to reactor type and plant age at the time the violation was committed. Although rates of violations (defined as the number per reactor year) at boiling-water reactors (BWRs) and pressurized-water reactors (PWRs) were not significantly different in the LER data set, the rate of level C violations in the IR data set was higher at PWRs than would be expected if violations were randomly distributed among reactor tvp

Further, in both data sets the rates of Level C violations per reactor year appeared to decrease as the plants gained operating experience.

Both violation rates and the distributions of Level B and C violations differed among the NRC regions. For example, in the IR data set, fewer Level B and C violations were reported for Region III than wculd be expected if violations were randomly distributed among reaions, while Region V reported a dispropor-tionately large number of Level B violations. Reasons for these findings could not be identified directly from these data. However, the relative frequency of the violations in each region was quite similar in the IR and LER data sets, thus suggesting that plant-related characteristics rather than reporting characteristics were responsible for these findings. 1 NUREG-1422 1-5

Although detailed information about the factors that contributed to the procedure violations was not provided in the reports, soce conclusions about the causes of the violations wer_e possible. In both the LER and the IR data sets, Level B violations appeared to involve personnel misuse of the procedures, such as the omission of a procedure step or the performance of actions that differed from those prescribed by the procedures; whereas the causes cited for the Level C violations primarily pertained to deficiencies in the procedures, such as an inadequate level of. detail, ambiguities, or inaccuracies in the pro-cedures. Interestingly, the cause of procedure violations most frequently cited in the irs was the failure to use a procedure; whereas, in the LERs, the cause most frequently cited was an inadequate level of detail. The analyses of consequences associated with the procedure violations in the data set confirmed that procedure violations in the United States have not been directly linked to.significant events that resulted in harm to public health and safety. The most frequently coded consequence category in both data sets was "no immediate safety consequences." In descending order, for the LERs, the next most frequently cited categories were automatic scrams and engineered safety feature actuations. In the irs, the next most frequently cited category of consequences was "other" (unrelated to operational safety), followed by personnel exposures to radiation within regulatory limits and personnel exposures that t needed regulatory limits. Ana?yses of the relationship between the frequency of procedure violations and plant safety performance indicators showed that rates of procedure violations at plants were moderately correlated with these broad measures of performance. Level B violations were more often correlated with the safety performance indi-cators than Level C violations. Higher numbers of violations of health physics and maintenance procedures were associated with higher values of the total person rem exposure performance indicator. Safety system actuations were posi-tively correlated with increased numbers of violations of maintenance procedures-and technical specifications; safety system failures were positively correlated with violations of normal operating procedures, technical specifice; ions, and health physics procedures. Although these correlations do not indicate that procedure violations cause poor plant performance, they indicate that procedure violations were linked with operational problems at U.S. plants during the period of this study. -Conclusions: Because of the manner in which U.S. nuclear power plants are designed, operated, and regulated, the probability of a single procedure violation resulting in a ^ major event is extremely small - no single procedure violation reviewed for this study resulted in a major event. Multiple violations were associated with sig-nificant operational events, but did not affect public safety in the data j analyzed. Since the NRC continues to receive reports of procedure violations ) being committed at U.S. plants, it must be assumed that the potential exists for i such violations to act as precursors to serious events or to compound the seriousness of events as they occur. Thus, while the results of this study do i not indicate that strong and immediate action is warranted, additional efforts j to reduce the incidence of procedure violations may further ensure safe opera-tions in U.S. nuclear power plants. j i l l NUREG-1422 1-6 i

Remarks: A complete description of this project will be published as a NUREG/CR report. The findings of this project indicate that substantial reductions in the incidence of procedure violations and errors are likely to result from . improvements in the quality of industry procedures and from programs for procedure development, change, and adherence. A project to develop guidance for NRC _ review of procedure upgrade programs was initiated in fiscal year 1992 as part of the resolution of Generic Issue HF 4.4, " Guidelines for Upgrading Other Procedures." The scope of this project was broadened as a result of the findings from the procedure violations study.

References:

1.- U.S. Nuclear Regulatory Commission, NUREG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," Final Report, Vol. 1, April 1989. 2. --, NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 Accident," Vol. 1, May 1980. 3. Code of Federal Regulations, Title 10, " Energy," U.S. Government Printing Of fice, Washington, D.C., revised periodically. 4. U.S. Nuclear Regulatory Commission, NUREG-0940, " Enforcement Actions: Significant Actions Resolved," Quarterly Progress Reports, April 1984 through September 1988. TASK 1.2A, " TEST, CHANGE, AND EXPERIMENT REVIEW GUIDELINES" Task Leader: C. Craig Harbuck, Technical Specifications Branch, Division of Operational Events Assessment, Office of Nuclear Reactor Regulation i -Issue: NRC regulation 10 CFR 50.59 (Ref.1) requires that licensees review beforehand planned. tests and experiments not described in their safety analysis reports -as well as changes to the facility and procedures described in those reports to ensure-they can be carried out without cottpromising plant safety and that the NRC be afforded the opportunity to review them if an unreviewed safety question is involved. Licensees perform thousands of these reviews each year.

However, in some instances, these reviews were not adequate.

As a result, the NRC was L not always afforded the opportunity to review those tests, experiments, and L changes that involved an unreviewed safety question before the tests or experi- -ments were conducted _or before the changes were made. Without appropriate reviews by licensees and the NRC, tests could be performed without adequate safety provisions or some safety features could be unacceptably altered, and the unsafe condition could remain undetected for lengthy periods. The Chernobyl accident occurred during a test. The lack of adequate planning review, prepara-tion, and implementation of the Chernobyl test emphasizes the need for attention to this issue. NUREG-1422 1-7

Purpose:

To: improve guidance and criteria for performing reviews of proposed tests, changes, and experiments. Scope: The scope of tests or experiments that can be performed and of changes that can be made without prior NRC approval is governed by 10 CFR 50.59. Accordingly, the scope of this task is limited to the development of guidelines to be used by licensees in determining whether proposed tests, experiments, or changes can be implemented within the limits. imposed by 10 CFR 50.59 or whether they must be reviewed by the NRC before they are implemented. This-is not a new task stemming from the Chernobyl experience; it was originally -conceived as a part of the Technical Specification Improvement Program to pro-vide greater confidence that proposed changes to requirements relocated from the technical specifications would receive adequate technical reviews before imple-mentation. However, the Chernobyl experience confirmed the importance of pro-viding the guidance necessary to ensure the quality of the reviews. Work

Description:

In response to the NRC requirement that the 10 CFR 50.59 review process be up-graded as a part of the Technical Specification Improvement Program, a Nuclear Management and Resources Council / Nuclear Safety Analysis Center (NUMARC/NSAC) Working Group was formed in March 1986 to develop an industry standard in this area, NSAC-125 (Ref. 2). This working group produced several drafts of the proposed standard, which were provided to the industry at large and the NRC for -comment. A final draft, which included consideration of the comments received up to that time, was issued for trial use in June 1989. Findings: The work done in developing the guidance on 10 CFR 50.59 now in trial use confirmed that weaknesses existed in the test,' change, and experiment review process and needed to be corrected. These weaknesses involved both the review process itself and the criteria for defining such items as "the margin of safety" that need to be considered in determining when an unreviewed safety question exists in connection _with a proposed action. The findings and proposed correc-tive actions are discussed in detail in Reference 3.

== Conclusions:== The need for additicaal guidance in'this area has been confirmed, and this Cuidance (revised NSAC-125) has been issued by a NUMARC/NSAC Working Group in consultation with the NRC staff. The NRC plans to continue monitoring the trial use of this guidance as an element of the Technical Specification Improvement Program..This issue is considered closed as a Chernobyl followup task. Final action on the NRC endorstment of guidance on the 10 CFR 50.59 review process will be accomplished as part of the Technical Specification Improvement Program. NUREG-1422 1-8

References:

Code of Federal Regulations, Title 10, " Energy," U.S. Government Printing 1. Office, Washington, D.C., revised periodically. Nuclear Safety Analysis Center, NSAC-125, " Guidelines for 10 CFR 50.59 2. Safety Evaluations," Palo Alto, California, June 1989. U. S. Nuclear Regulatory Commission, letter from Charles E. Rossi, NRC, 3. to Thomas E. Tipton, NUMARC, "NRC Comments on Draft NUMARC/NSAC Guidance Document on 10 CFR 50.59," May 10,1989. TASK 1.2B, "NRC TESTING REQUIREMENTS" Carl Johnson, Human Factors Branch, Division of Systems Research, Task Leader: Office of Nuclear Regulatory Research (RES). This report is based on work per-formed by R. M. Lobel and T. R. Tjader of the Technical Specifications Branch, Office of Nuclear Reactor Regulation (NRR), and A. W. Serkiz of the Reactor and Plant Safety Issues Branch (RES), and on Brookhaven National Laboratory and Science Applications International Corp. research on procedures for evaluating technical specifications. Issue: NUREG-1251 (Ref. 1) states, "The fact that the Chernobyl accident was initiated by a test intended to assess equipment capabilities raises a concern aoout the balance between the benefit of testing and the risks introduced by tests." The NRC requires periodic surveillance testing to assess and ensere the oper-ability of safety systems. However, these periodic equipment surveillance tests during reactor power operation involve risks as well as benefits. In general, the risks arise from potential equipment failures and/or human errors during the These circumstances might initiate a plant transient or reduce the test. Tradeoffs between the risks associated with availability of safety systems. such testing and the risks of not testing, or of testing less frequently, should be reassessed in light of today's knowledge.

Purpose:

To determine whether the NRC requires operating plants to perform equipment tests whose conduct presents a sufficient potential impact on plant safety risk to suggest either modification of the tests, a reduced test frequency, or elim-ination of the tests. Scope: The scope of this task is (1) to review NRC requirements for testing equipment at operating plants, that is, after initial startup tests have been completed; (2) to evaluate the potentiai risks for each such test; and (3) to recommend revised test requirements for tests involving excessive risk. These requirements for testing are contained in the technical specifications The NRC Technical Specifi-that form a part of each plant's operating license. cation Improvement Program to improve these surveillance test requirements was 1-9 NUREG-1422

already under way when the Chernobyl accident occurred. Chernobyl followup Task 1.2B was incorporated into this ongoing program. Work

Description:

After the Cnernobyl accident, the NRC staff undertook a line-by-line review of all testing requirements in the technical specifications for a boiling-water reactor (BWR) and a pressurized-water reactor (PWR) to identify potential can-didates for change (Ref. 2). The NRC staff will publish NUREG-1366 on this review, which was performed under the Technical Specification Improvement Program. In conducting this review to screen existing surveillance test requirements, the staff used four criteria: (1) The surveillance could lead to a plant transient. (2) The surveillance results in unnecessary wear on equipment. (3) The surveillance results in radiation exposure to plant personnel that is not justified by the safety significance of the surveillance. (4) The surveillance places an unnecessary burden on plant personnel because the-time required is not justified by the safety significance of the surveillance. The staff used these screening criteria to identify technical specification requirements for tests that could adversely affect plant risk. The staff then considered each of these test requirements in terms of balancing the risk bene-fits of testing against different test strategies. The risk importance of the equipment and the frequency at which it should be tested to ensure safety system availability was balanced against the risk of human error in testing causing a reactor-trip or leaving the equipment in a degraded or failed state. Engineering judgment and a qualitative assessment of the risk impact of the test were used to determine this balance. A quantitative example (Ref. 3) was used as part of the -background information for making these judgments. Using this qualitative approach, the staff reviewed the risk benefits and . penalties of each of the surveillance requirements in the Westinghouse Standard Technical Specifications (for PWRs) and the Technical Specifications for Hatch Unit 2 (a BWR). In addition, the staff visited five reactor sites in 1988 to discuss surveil-lance requirements with the persons who plan, manage, and perform these surveil-lances (Ref. 2). The staff also reviewed the dockets of several reactors whose licensees were seekirg plant specific technical specification changes related to surveillance requirements that have generic applicability. The staff relied on operational data from licensee event report searches, nuclear plant reliability data system searches, and other sources to assess the effect of technical specification surveillance requirements on plant operation. NUREG-1422 1-10 -- n

m In addition, the_ Nuclear Plant Aging Research Program provided background infor-mation on component reliability and types of degradation. -Diesel generator testing is being addressed separately as Generic Safety Issue B-56. Findings: Using_the screening criteria listed under " Work Descriotion," the NRR staff identified 46 surveillance requirements for PWRs and 31 surveillance require-ments for BWRs for specific evaluation. As a result of the specific evaluation, the staff recommended reducing 33 surveillance requirements for PWRs and 20 for BWRs. Equipment failures and personnel errors during sev_eral types of surveillance-testing have caused reactor trips. In particular, reactor protaction system testing, turbine valve testing, main steam isolation valve testing, nuclear instrumentation testing, engineered safety features logic testing, and reactor ~ trip breaker testing were all significant contributors to reactor trips. In: addition to causing reactor trips, testing has resulted in spurious isolation of the control room, fuel handling building, auxiliary building, and containment -. ventilation. Inadvertent emergency diesel generator starts are relatively com-mon results of surveillance testing; actuation and isolation of standby safety equipment occasionally occur. Wear on equipment is also a significant concern; some instrument parts (such as connector pins and plugs) experience wear because of the amount of plugging and -unplugging required for testing. Auxiliary feedwater pumps were found to be subjected-to_ wear because of the small recirculation lines used during testing. Emergency diesel generators have been subjected to an excessive amount of testing, especially_those diesel generators in plants with_ older technical specifications. For example, a problem with one diesel generator can-result L in testing the other(s)-every 8 hours. Furthermore, the requirement for fast starting and loading a diesel---generator comes from assumptions in the analysis regarding a-large-break-loss-of-coolant-accident (LOCA). Current LOCA analyses that are based on more realistic assumptions.and experimental data indicate that = the current fast-start-and-load requirement of 10 seconds could be extended to 30 seconds or more (Refs. 4 and 5). Such an extension would further reduce the adverse-effects of-wear on the diesel generator. l . Radiation exposure of personnel as a result of surveillance testing ranges up-to approximately 20 percent of the total integrated dose incurred at e site. Although the biggest contributor to incurred dose is maintenance, not testing,_ some surveillance tests do: result in a significant incurred radiation dose. Tests that= require containment entry while the reactor is in operation (e.g., l containment purge and exhaust isolation valve leak testing) cause significant doses. Walkdowns of ' systems to check valve alignments and snubber operability also were fot.d to be significant contributors to radiation dose. Examples of recommended changes to NRC requirements for surveillance testing are listed'in Table 1.28-1 (Ref. 2). NUREG-1422 1-11

Table 1.28-1 Examples of recommended changes to surveillance test requirements Surveillance test requirement Recommended change REACTIVITY CONTROL SYSTEMS Perform control rod' movement testing Change to quarterly. monthly (PWR). Perform standby liquid control system Change to quarterly, pump test monthly (BWR). Perform reactor trip test to verify Delete requirement. Require an operability of scram discharge vol-evaluation of scram discharge volume ume vent and drain valves; required system response after each scram to once every 18 months (BWR). verify that no abnormalities exist. TURBINE OVERSPEED PROTECTION Perform turbine valve cycling once Change all turbine valve testing to every-7 days; direct observation of quarterly if turbine vendor agrees. turbine valve cycling required monthly (PWR, BWR). REACTOR COOLANT SYSTEM-Check capacity of pressurizer Change frequency to refueling inter-heaters quarterly (PWR). vals on a plant-specific basis. Demonstrate emergency power supply Retain for those plants where power is to pressurizer heaters is operable not from vital bus. Otherwise delete. every 18 months (PWR). EMERGENCY CORE COOLING SYSTEM Perform analog channel operational Change to quarterly. -test on accumulator level and pres-sure instrumentation monthly (PWR). CONTAINMENT Test hydrogen recombiner semiannually Change frequency to refueling (PWR, BWR). intervals.

== Conclusions:== Although some testing of standby safety systems during power operation is essential, safety can be improved by reducing the amount of testing at power. Licensees appear to have taken the steps within their power to limit the dose from testing.

The number of tests is large.

In an 18-month cycle, between 15,000 and 20,000 surveillance tests typically are required (without counting simple channel checks). A comment heard during plant visits conducted as part of this effort was that equipment was tested that never failed (except, perhaps, because of the testing). Because of the large amount of testing and the fact that it may be NUREG-1422 1-12

more than necessary for some systems, the application of reliability methods to technical specification surveillance testing could result in a better allocation of utility resources to those systems and components that experience the most problems. The potential improvements in NRC's requirements for testing equipment during power operation that were identified under this task are being documented and implemented in NRC's planned regulatory program. Remarks: In January 1989, the staff briefed the Commission on its efforts to reduce testing at power and ircluded a presentation of the findings and recommendations summarized above an. in Reference 2. A draft report " Improvements to Technical Specification Surveillance Testing Requirements" has been circulated for comment within the NRC. A final report will be issued as NUREG-1366. The staff plans to forward this report to the reactor owners groups to include these recommendations in the revised technical specifications being proposed as part of the ongoing Technical Specification Improvement Program. In addition, the staff plans to prepare generic lettet advising licensees tnat they may propose further changes to their technical 'pecifications on the basis of the recommendations in this report. Items selec ed for inclusion in the generic letters will be those whose safety significar e appears to warrant expedited action. All of the recommendations will be f ctored into the preparation of the new Standard Technical Specifications. In the resolution of Generic Safety Issue B-56, " Diesel Generator Reliability," the staff (in response to Commission direction (Ref. 6)) is revising the Station Blackout Rule (10 CFR 50.63 (Ref. 7)) and Regulatory Guide 1.9 (Ref. 8) to monitor emergency diesel generator reliability against performance-based criteria that have been proposed by the Nuclear Management and Resources Coun-cil. The proposed rule amendment and the revised regulatory guide will be issued for comment in April 1992, and the safety issue will be brought back before the Commission following review of comments received and followup dis-cussions with the Advisory Committee on Reactor Safeguards. The revised guide will result in some reduction in the required testing of emergency diesel gen-erators without significantly reducing their reliability levels for coping with station blackout, design-basis accidents, and other plant tiansients.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," Final Report, Vol. 1, April 1989. 2. --, SECY-88-304, "Staf f Actions To Reduce Testing at Power," memorandum from V. Stello, Jr., to the Commissioners (staff contact: E. J. Butcher), October 26, 1988. 3. --, NUREG/CR-5200, " Evaluation of Risks Associated With A0T and STI Requirements at the ANO-1 Nuclear Power Plant," Brookhaven National Laboratory, August 1988. NUREG-1422 1-13

. - ~. _ - -. - . ~. - - - - - - - - - - 4. Nuclear Safety Analysis Center,_NSAC-96, "Effect of Diesel Start Time on BWR/6 Peak Cladding Temperature," Palo Alto, California, January 1986. S. --, NSAC-130, "Effect of Diesel Start Time Delay on Westinghouse PWRs," -September 1988. 6. U.S. Nuclear Regulatory Commission, staff requirements memorandum from S. J. Chilk, Secretary, to J. M. Taylor, Executive Director for Operations, " Resolution of Generic Issue B-56," March 6, 1992. 7. Code of Federal Regulations, Title 10 " Energy," U.S. Government Printing Office, Washington, D.C., revised periodically. 8. U.S. Nuclear Regulatory Commission, Regulatory Guide 1.9, " Selection, Design, Qualification, Testing, and Reliability of Diesel Generator Units Used as.0nsite Electric Power Systems at Nuclear Power Plants." TASK 1.3A, " BYPASSING SAFETY SYSTEMS" Task Leader: J. Persensky, Human Factors Branch, Division of Systems Research, Office of Nuclear Regulatory Research Issue: The bypass or override of a safety or protection system is typically any acti u taken by the operator that inhibits or prevents the system or some portion of the system from performing its safety-related protective functions. Multiple safety systems that could have prevented or mitigated the consequences of the accident at Chernobyl were intentionally bypassed by the plant. operators as part of a test procedure that ultimately led to the accident. Additionally, the operators deviated from the test procedure and bypassed additional safety systems in order to complete the test. It is apparent that administrative controls governing the availability of safety systems did not exist or were violated by the operators. Some safety system bypasses are necessary to prevent' inadvertent actuations of _ plant safety systems that might otherwise disrupt plant operation or result in unnecessary challenges to safety systems in specific operating modes. If used correctly, safety system bypasses actually contribute to the overall safety of the plant. The use of bypasses at U.S. commercial reactors is controlled by plant-specific technical specifications. The technical specifications require the operability of safety systems consistent with the transient and accident final safety analysis.

Purpose:

To assess whether the existing _ regulations and guidance applicable to the issue of bypassing safety systems contain clear and comprehensive information for licensees. Scope: The scope of this task is limited to the administrative controls and hardware design features used to ensure the availability of sufficient safety systems NUREG-1422 1-14

.m m__ to respond to transient and accident conditions; that is, controls concerning conditions under which deliberate bypass is recuired or permitted. Work

Description:

The staff made an assessment of whether regulations and guidance concerning administrative controls and hardware design features contain the information needed to adequately inform licensees and applicants of requirements an) guide-i lines concerning the bypass of safety systems. Criteria and guidance considered include 10 CFR 50.55a(h) (Ref. 1) and Institute of Electrical and Electronics Engineers (IEEE) Standard 279-1971 (Ref. 2) and IEEE Standard 338-1975 (Ref. 3) as supplemented by Regulatory Guide 1.118 (Ref. 4), Regulatory Guide 1.22 (Ref. 5), and Regulatory Guide 1.47 (Ref. 6). Findings: i An assessment of relevant regulations and guidance indicates that the information provided is sufficiently clear and comprehensive to guide licensees in order to reduce the likelihood of loss of safety system function due to system bypass.

== Conclusions:== Though the existing guidance provides information for licensees to reduce the likelihood sf inappropriately bypassing a safety system, ongoing NRC activities will improve the informatien available regarding safety system bypass. Remarks: Three specific, ongoing NRC activities will provide guidance on further reducing the probability of inappropriate safety system bypass. The effort under way at the NRC to revise Regulatory Guide 1.47 should continue, especially with regard to the inclusion of human factors considerations as recommended in NUREG/CR-J621 (Ref. 7). In its ongoing reviews of maintenance and surveillance activities, the NRC continues to assess administrative controls used to ensure the avail-ability of redund:nt safety systems. Pursuant to the resolution of Generic Issue 102 on wrong-unit / wrong-train events, the NRC is continuing to evaluate the effectiveness of industry efforts to reduce the incidence of such events.

References:

1. Code of Federal Regulations, Title 10, " Energy," U S. Government Printing Office, Washington, D.C., revised periodically. c 2. Institute of Electrical and Electronics Engineers, IEEE 5tandard 279-1971, " Criteria for Protection Systems for Nuclear Power Generating Stations." 3. --, IEEE Standard 338-1975, "IEEE Standard Criteria for the Periodic Testing of Nuclear Power Generating Station Safety Systems." 4. U. S. Nuclear Regulatory Commission, Regulatory Guide 1.118, " Periodic Testing of Electric Power and Protection Systems," 1978. 5. --, Regulatory Guide 1.22, " Periodic Testing of Protection System Actuation Functions," 1972. NUREG-1422 1-15 a-.

=- 6. --, Regulatory Guide-1.47, " Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems," 1973, 7. --, NUREG/CR-3621, " Safety System Status Monitoring," Pacific Northwest i Laboratory, 1984. l TASK 1.4A, " ENGINEERED SAFETY FEATURE AVAILABILITY" Task Leader:- F. Mark Reinhart, Technical Specifications Branch, Division of Operational Events Assessment, Office of Nuclear Reactor Regulation Issue: P Operability requirements for engineered safety feature (ESF) equipment needed to mitigate the design-basis accidents (DBAs) and transients are included in technical specification = to ensure the equipment is available for all modes of operation. In some instances all of this equipment has not been @ udied in light of the need for its availability for plant shutdown modes. -Purpose: To_ evaluate and specify operability (availability) requirements for those ESF systemc and support systems needed to mitigate DBAs and transients. Reactor-vendor owners groups _will implement this task for Standard Technical Specifica-tions (STS). The results will be made available to individual licensees for plant-unique technical specifications as part of a voluntary industry-wide program to improve technical specifications. Scope: This task is being accomplished under the Technical Specification Improvement Program (TSIP), which-is an ongoing joint NRC and industry pro _ gram. It is.part of the overall program to ensure that the owners groups and individual licensees specify the appropriate plant-status modes for-ESF equipment. In some of the older technical specifications, mode requirements-for operability may not be specified for other than the power operating mode. In the rewriting of the bases section of the technical' specifications, the reasons for the limiting conditions for operation are being included. If the mode is absent or is inappropriately specified, the bases sections are being clarified to. identify ESF equipment required-for each operational condition. However, required ESF availability is only being addressed under the TSIP with respect to the design-basis accidents, transients, and initial conditions (i.e., modes) currently analyzed in the final safety analysis reports. The required ESF availability during shutdown and low-power conditions is being evaluated separately as part of the shutdown and low-powe: risk study (Task-1.4C). That study specifically' includes tasks to define appropriate technical specifications for shutdown and low power conditions, in accordance with the Commission's policy statement on technical specification improvements (Refs. 1 and 2). This is not a new task stemming from the Chernobyl experience; it was originally conceived as a part of the TSIP to provide greater confidence that appropriate specifications for all modes of operation are included in technical specifica-tions. However, the Chernobyl experience reinforced the importance of ensuring that the technical specifications govern the availability of the ESF equipment during all modes of operation. NUREG-1422 1-16

Work

Description:

Reactor-vendor owners groups are being permitted to relocate from the STS to licensee-controlled documents those specifications that do not meet the Commis-sion's criteria for what should be included in technical specifications. The remaining specifications are being rewritten and improved. Each rewritten and improved technical specification must have a bases section that not only explains why the technical specification is needed, but also the plant conditions for which it is needed. This need is being evaluated for all the operating modes of the plants. Licensees will be e... "*aaed to convert to the new STS and conduct similar upgrades for plant unique specifications that meet the NRC criteria for techni-cal specifications. These plant upgrades will be done on a vnluntary basis during the conversions to the new STS. The participating licensees shall spe-cify appropriate ESF operability requirements for plant conditions during which equipment could be needed for accident-mitigation purposes. Upgraded plant-unique technical specifications are also being evaluated under the TSIP. If significant disparities in ESF availability are disclosed during the TSIP, they will be recommended for backfit in the technical specifications of licensees not participating in the program, as the need arises. The shutdown and low power risk study (Task 1.4C) is leading to the development of a comprehensive set of recommendations to ensure plant safety during shutdown and low power operation, until more definitive design bases can be established for those conditions. Those recommendations will include backfitting analyses for changes to plant designs, technical specifications, and procedures to reduce risk during shutdown and low power operations. Findings and

Conclusions:

This task is currently being accomplished as part of the development of the new Standard Technical Specifications and implementation of the recommendations from the shutdown and low power risk study. This issue is considered closed as a 1 Chernobyl followup task.

References:

1. Federal Register, Volume 52, Number 25, " Proposed Policy Statement on Technical Specification Improvements for Nuclear Power Reactors," pp. 3788-3792, February 6, 1987. 2. U.S. Nuclear Regulatory Commission, SECY-91-283, ' Evaluation of Shutdown and Low Power Risk Issues," September 9, 1991. l ASK 1.48. " TECHNICAL SPECIFICATIONS BASES" Task Leader: Richard Emch, Technical Specifications Branch, Divisit of Operational Events Assessment, Office of Nuclear Reactor Regulation Issue: Current technical specificati-aes sections do not always contain a clear and comprehensive discussion of we link between specific requirements and the NUREG-1422 1-17

safety analysis assumptions froni which they are derived. This lack can result in operators not being as aware as possible of the safety significance of cer-tain types of technical specification violations - an issue that may have had a counterpart at Chernobyl. It can also result in proposed changes to technical specifications without adequate consideration of all the relevant safety issues.

Purpose:

To develop an upgraded set of bases sections for the Standard Technical Specifications (STS) that provides a clear, concise link between requirements and safety analysis. The up9raded standard set of bases sections will be made available to individual licensees so they can adapt it to their plants as part of a voluntary industry-wide program to improve technical specifications. Scope. The upgraded standard bases sections are being developed as part of the ongoing joint NRC and industry Technical Specification Improvement Program (TSIP). Under this program, the reactor-vendor owners groups are rewriting the STS (including the bases sections) and improving both format and content. Because of this program, which was initiated before the Chernobyl event, no additional work will be necessary to accomplish this task. Once the new STS are completed, it is expected that most utilities will voluntarily elect to adopt them for their plants. Any decision to require an individual licensee to convert to the new STS will be made in accordance with the Backf1t Rule (10 CFR 50.109 (Ref. 1)). This task is limited to the introduction of lessons lea"ned from the Chernocyl accident into ongoing work. Work

Description:

No work beyond that already started under the TSIP is planned in response to the Chernobyl event. The rewriting of the bases sections under the TSIP will be comprehensive. A clear one-to-one relationship between technical specifica-tion requirements and the safety analysis will be documented in a carefully formatted bases section for each technical specification. Separate bases sub-sections are being written to address separate parts (i.a., limiting conditions for operation, action statements, and surveillance reouirements) of individua technical specifications. Findings and

Conclusions:

This task is currently being accomplished as part of the review of the new Standard Technical Specifications. This issue is considered closed as a Cher-nobyl followup task.

Reference:

1. Code of Federal Regulations, Title 10, " Energy," U.S. Government Printing Office, Washington, D.C., revised periodically. NUREG-1422 1-18

-TASK 1,40, " ANALYSIS OF RISK AT LOW-POWER AND SHUTDOWN CONDITIONS" Task Leader: Richard Robinson, Probabilistic Risk Analysis Branch, Division of Systems Research,' Office of Nuclear Regulatory Research Issue: Traditionally, probabilistic risk assessments (PRAs) of-severe accidents in nuclear power _ plants (including those discussed in NUREG-1150 (Ref. 1)) have considered the set of initiating events that could occur during full-power oper-ation. Some screening analyses of accident initiators during low power, shut-down, and other modes of plant operation other than full power have been per-formed..These analyses suggested that risks during these modes were small rela-tive to those during full power operation. However, other studies (discussed later) and the Chernobyl accident, which occurred during low ower testing exer-cises, suggested that accident risks during low power and shutdown conditions could be significant. The 1990 loss-of power event at Vogtle Unit 1 (Ref. 2), while the plant was at cold shutdown, further emphasizes the need to systemat-ically and comprehensively evaluate plant safety when operating at other than full power. - As a result, the analysis of the frequencies, consequences, and risks of-these accidents was identified as one task (Task 1.4C) in tha NRC-staff's study of the implications of the Cherno'oyl accident for U.S. commercial nuclear power plants (Ref. 3).

Purpose:

-To-(1) assess the frequencies of severe accidents initiated during plant oper-ational modes, other than full power operation, for a commercial pressurized-ater reactor (PWR) and a boiling-water reactor (BWR); (2) combine accident fre-w quencies with accident progression, source term, and offsite consequence anal-yses-to yield estimates of severe-accident risks from these plant operational modes in the PWR and BWR studied; and (3) compare the estimated core damage fre-quencies, important accident sequences, and other qualitative and quantitative results of this study with those of accidents initiated during full power oper-ation (as assessed in NUREG-1150 (Ref. 1)). l -- Scope: As discussed above, the work performed under this task involves the investigation of two operating commercial reactors, a PWR and a BWR, at plant operational modes other than full power operation. The current plan consists of a two phased approach in order to provide.an early analysis overview and to highlight any potential problem areas. Phase 1 (now completed) was dedicated to producing preliminary PRA results, including internal fire and flooding analyses, for other related studies under way in the NRC. Phase 2 is to produce a final PRA, guided by the Phase 1 results, to proportionately allocate the effort among the various operating modes, the dominant sequences, and' pertinent data items accord-ing to their importance to core damage frequency and risk. The scope of Phase 2 was broadened to include a seismic analysis and to develop a more detailed human reliability analysis (HRA). The general tasking for Phase 2 includes the following topics: NUREG-1422 1-19

(1) Identification o' Plant Operational States (POSs) and Parameters Several POSs other than full power operation are characterized by parameters such as reactor criticality, reactor coolant system (RCS) pressure, RCS temperature, and percent thermal power. These POSs are a restructuring of the technical specification modes of operation: low power, startup, hot standby, hnt shutdown, cold shutdown, and refueling. Thus, the scope of this task includes the definition of the POSs of interest as a founda-tion for performing risk analysis. (2) D_etermination of the Applicable Initiating Events for Each POS The scope of this task includes the determination of a set of initiating events for each POS that potentially result in core damage, including those initiating events associated with and resultinc from maintenance activities and plant modifications, as well as those associated with internal fires and floods. (3) Establishment of the Applicable Systems and Success Criteria for Each POS s and Initiating Event 1 The initial conditions of the plant, i ecially RCS pressure and tempera-ture, and the availability of steam w1.I affect the operability of engi-neered safety systems (and Some systems not defined as "sa+ety" but for which safety credit may be given). The scope of this task includes the ide,itification of the applicable systems for each POS and initiating event witl, the corresponding success criteria so that system models can be constructed. (4) Development of a Data Base for POSs Other Than Full-Power Operation Plant testing and maintenance practices, procedures, and logs will be examined under this task to characterize equipment and systems unavailabil-ities for-the various P0$s. Mean time duration (per year) will also be established for each of the POSs. Operating procedures will be reviewed to determine if and what systems may be bypassed during a given P05. Tech-nical specifications will be reviewed to determine what relaxations will be in effect during the given P0S. (5) -Analysis of Accident Frequencies For each POS, using the initiating events identified for that POS, an accident frequency-analysis will be performed that encompasses data anal-ysis, systems analysis, event tree analysis, internal fire and flooding analysis, seismic analysis, dependent failure analysis, human re iability analysis (both conventional and detailed), accident sequence quaritifica-tion, plant damage state analysis, and uncertainty analysis. (6) Accident Progression and Containment Analysis The scope of-this task includes the examination of applicable technical specifications for each POS to identify containment status and systems availability and develop accident progression and containment event trees, and to carry out quantification and develop accident progression bins for each plan + damage state. NUREG-1422 1-20

(7) Source Term Analysis The next step in the risk calculation is the source term analysis. The results of the source term analysis are release fractions for groups of chemically similar radionuclides with associated energy content, time, and duration of release for each accident progression _ bin. Source terms for shutdown and lower power events will be corrected for reduced fission -product and decay heat levels from the full power source terms. (8) Consequence Analysis The f; al step in the risk quantification will be the offsite consequence analysis for source terms defined in the previous step. The specific con-sequence measures may include early fatalities, latent cancer fatalities, -and population dose. After risk quantification has been completed for the two plants, generic insights and specific recommendations, if necessary, will be developed to reduce estimates of frequencies and consequences for accidents that may occur during the low power or shutdown modes of operation. Work

Description:

' Under this -task, a-study of a BWR plant is in progress at the Sandia National Laboratory.(SNL) and a study of a PWR plant is in progress at the Brookhaven National Laboratory (BNL). For the selected BWR plant, some of the ongoing work includes review of the Final Safety Analysis Report (FSAR) and technical spect-fications to develop ~a matrix that describes each operating mode in terms of the selected parameters such as temperature and pressure. fabulated information on technical specification requirements versus. operating modes is also being devel-oped. Various documents, including safety analyses contained in the plant's FSAR and licensee _ event reports, have been reviewed to define initiating events relevant _to low-power and shutdown modes. The preliminary (Phase 1) accident _ frequency quantification for both plants was completed in late 1991 in final _ draft form and is available from the NRC Public Document Room. Because of the enormity of the potential effort, Phase 2 will start with a specific POS for each reactor type: mid-loop for the PWR and cold _ shutdown for the BWR. A Level 1 analysis is expected to be completed in final draft form by the end of January 1993 and a Level 2 and 3 analysis toward the-end of 1993. Some of the other completed studies relevant to this task are discussed in References 4-13. Also, in response to the March 20, 1990, event at the Vogtle nuclear plant, the NRC has established a broad-based evaluation (exteading beyond the PRA approach) of low power and shutdown operations. This is described in Reference 14. Findings: In most of th'e PRAs, it has been assumed that the level of risk associated with -accidents initiated during full power operation, although small, is substantially greater than that associated with accidents during low power or shutdown. This assumption is supported by the fact that because of the lower decay heat levels and smaller radionuclide inventory during low power and shutdown modes, generally more time is available to recover from adverse situations during thcse moas of cperatian. Howrver, other factors might exacerbate the situation during acci-dents at low power and shutdown. Some of these factors are (1) the fact that NUREG-1422 1-21

many

• the automatic safety systems may have been disabled during these modes, thus requiring greater operator intervention; (2) high equipment unavailability as a result of planned maintenance; (3) potential maintenance configurations requiring minimum RCS coolant inventory; (4) open containment penetrations and hatches; and (5) inadequacy of full power emergency procedures to address emergencies during low power and shutdown modes.

In addition to the above factors, certain experiences and events at operating reactors provide further impetus to study risk during low power and shutdown modes of operation (e.g., see References 7-9, 15, and 16). One type of event ~is'the Chernobyl type of event, that is, rapid insertion of reactivity causing accidents. Other types of events represent loss of decay heat removal functions, -loss of coolant inventory, and inadvertent pressurization. To systematically examine these concerns, two of the NUREG-1150 (Ref. 1) plants are being analyzed further under low power and shutdown modes of operation. Reference 11, which is a report of work performed in support of Task 2.1A, provides the results of a study of accidents that result from large reactivity insertions at a PWR plant and a BWR plant. The potential reactivity accidents i were categorized in that study as follows: PWR Events addition of diluted water from the accumulator during refueling addition of diluted water from the refueling water storage tank during shutdown loss-of-coolant accident (LOCA) with diluted emergency core cooling system water LOCA with sump water diluted steam generator tube rupture with secondary coolant-diluting primary coolant inadvertent boron dilution at shutdown startup of reactor coolant pump after improper boron dilution -i beyond-design-basis rod ejection accidents l 1 thermal-hydraulic transients with positive modera'or temperature coefficient j l other beyond-design-basis events y BWR Events beyond-design-basis rod drop accident rod ejection accident beyond-design-basis overpressurization events flushing of boron during an anticipated transient without scram operation in reaion of instability refueling accidents other beyond-design-basis events NUREG-1422 1-22

Few of the above-listed events were identified as requiring further analysis on the basis of the estimated frequency of worst accident sequences. During the current task, these events are being examined for their applicability to operational modes of interest and further analysis. Recently, a Level 3 PRA for the Seabrook Station was completed to evaluate the likelihood of severe core damage with various paths for offsite release when the plant is in Mode 4 (hot shutdown), Mode 5 (cold shutdown), or Mode 6 (refueling) (Ref. 4). Radiological source terms and resultant public health consequences also were evaluated. The findings and conclusions from this study are as fol-lows (Ref. 4): (1) With the benefit of relatively low-cost modifications and administrative controls, the frequency of core damage during shutdown is small, but not negligible, in comparison to that at power operation. The improvements include instrumentation and alarms to improve operator action and to foretell incipient loss of the residual heat removal (RHR) system during the time when the RCS is drained to the hot-leg midplane procedures and training to cover the possible abnormal plant condi-tions and alternative cooling schemes administrative controls to minimize the time ir the drained-down configuration, to ensure that alternative cooling methods are available, and to ensure control of containment integrity (2) Some q_antitative conclusions of the study are the follcwing: The mean core damage frequency during shutdcwn is less than that during full power operation by about a factor of 6. The early fatality risk from shutdown is about an order of magnitude less than that from full power operation. Results of two studies sponsored by the Electric Power Research Institute (EPRI) to evaluate experiences with the RHR systems for both the PWR and BWR plants are summarized in References 9 and 10, respectively. In Reference 9, about 251 shut-down events from 1977 through 1981 for PWR plants are evaluated. About 100 of these events involved an actual loss or significant degradation of the RHR system while it was operating in a decay heat removal mode. The major safety implications of these events fall into three categories: (1) loss of reactor coolant inventory via the RHR system (2) inadvertent cold overpressurization of the RCS (3) loss of long-term decay heat removal capability via the RHR system Similarly, Reference 10 provides a survey of 480 BWR events involving the RHR system; of those events 90 involved an actual loss or significant degradation of the RHR system. The safety implications are the same as those for PWRs. As a follow-on stady to Reference 9, EPRI sponsored a residual heat removal probabilistic study of the Zion plant (a PWR) (Ref. 6). This study (Ref. 6) NUREG-1422 1-23

l: h 1: concluded, by comparis_o_n with the results of the Zion probabilistic safety -study, that the annual frequency cf fuel damage from events initiated during . shutdown is_ less, by a factor of 5 to 20, than the frequer:cy of core damage from transients initiated at power. However, the shutdown risk is highly dependent on operator error, and wider uncertainty exists for the shutdown raodel results than for the full power results. A similar probabilistic study was also performed for Brunswick Unit 1 (a BWR) (Ref. 5), where the core damage frequency of a loss u RHR during cold shutdown was estimated to be __7E-5 per reactor year. In support of the resolution of Generic Issue 99, which deals with loss of-residual-heat removal events in PWRs, BNL reanalyzed the Zion study (Ref 7) by applying some modifications in the definition of outage phases and their_ dura-tion and the modeling of human cognitive errors. The estimated core damage frequency represented a nontrivial-(SE-5) contribution to overall core damage frequency (at full power and shutdown). Reference 2 describes the investigation by an NRC inspection team of a recent incident at Vogtle. The plant was operating in a mid-loop condition (reduced inventory) when a loss of offsite power occurred as a result of an accident in the switchyard. One of the onsite diesel generators was down for maintenance, and the other diesel generator failed to operate. Cooling for decay heat removal was lost for 36 minutes. Reference 12 describes research by Electricite de France (EDF) in which PRA methodology was used.to analyze the effect of t chnical specifications on the core melt frequency of a French 900-megawatt-electric (MWe) PWR during cold shutdown. By implementing changes-in shutdown technical specifications in the area of scheduled unavailabilities of certain systems (mainly affecting the RHR system). the core melt frequency was said to be reduced by about a factor of 4. Reference 13 summarizes the results of two PRAs: one done by EOF for a 900-MWe PWR, and the other done by Institut de Protection et de Surete Nucleaire (IPSN) for a 1300-MWe PWR. Both PRAs_ investigated the importance of r L k when the reactor is not at operating power (i.e., shut down with the RHR system operat-ing, or during refueling). These states accounted for more than half (55 per-cent) of the total core melt frequency (about 1E-5 per year) in the 1300-MWe plant and almost one-third of the total (about SE-5_ per year) in the 900-MWe plant. Findings of_ the ctudies discussed above will be reviewed under this task, and insights gained will-be used to develop models and perform analyses.

Conclusions:

= Work under this task is still in progress. However, as discussed previously, some work has already been done to evaluate risk during modes other than full-power operation. -Phase 1 of the program (a preliminary Level 1 PRA of two pl_ ants) revealed no new alarming accident sequences, but the findings did emphasize some plant configurations and sequences that are being studied in more detail during Phase 2. For the PWR, the plant appeared more vulnerable during mid-loop. configuration and during a station blackout when at shutdown. As was also found in a Vogtle sequence, the use of temporary seals at the seal table as a temporary pressure boundary during shutdown operation can result in NUREG-1422 1-24 1

an immediate primary system leakage nn loss of core cooling capability and on an RCS pressure increase. Further pressurization can quickly lead to core uncovery. For the BWR, the study indicated the importance of anticipated operator recovery actions, primarily as a result of several hours available to the no* itors during many of.he potentially high cot e damage sequences. The dom cia..' configurations were from cold shutdown to refueling with the water level raised to the steamlines, and Egain during refueling with water raised to the steamlines. Two important in tiating events were the loss of instrument air as a unique initiating event and loss of the RHR system. A more deta. led summary of the Phase 1 results can be found in Reference 14 Jollowing the resolution of Generic :ssue 99 and events the occurred at oper-ating plants, the NRC issued several notices to licensees (e.g., Refs. 17 and Adm nbtrative and procedural changes have been evaluated and implemented. 18). i Sevcral harwe changes have also been made. Remarks: At the completion of this task, the NRC will publish two NUREG/CR reports addressing risks at a PWR plant and at a BWR plant during the low power and shutdown modes. These studies may lead to recommendations regarding possible hardware, procecural, training, and staffing changes. Following the establishment of NRC's research program in this area, a shutdown event (mentioned previously), involving loss of all vital ac power, occurred at the Vogtle plant. In response to this incident and growing concern in this area, the NRC Executive Director for Operations issued an August 8, 1990, memorandum (Ref. 19) regarding followup actions to the NRC inspection team's report on Vogtle (Ref. 2). Subsequently, a task plan was formulated to evaluate plant safety during shutdown operations to ensure that risk during all modes of opera-tion is acceptably low. These evaluations are to form the basis for (1) any proposed changes to current technical specifications that govern shutdown opera-tions, (2) changes in direction regarding the new Standard Technical Specifica-tions that are being developed by the staff, (3) recommendations to industry regarding emergency response procedures and outage management and control, and (4) modifications to the NRC inspection program. The NRC staff also has dovel-oped a working agreement with industry representatives to ensure cooperative efforts in addressing shutdown risk. Topics that will clearly involve signifi-cant interaction with industry groups include technical specifications, emer-gency operating procedures, and risk management applied to shutdown activities. The results based on this plan are presented in a draft report issued for comment in February 1992 (Ref 14). The objective was to assess risk broadly during shutdown, refueling, and startup with all of the tools at hand, address-ing not only issues raised by the Vogtle event, but also a number of other shutdown-relate issues that had been identified by foreign regulatory organi-zations as well as the NRC, and any new issues uncovered in the process. The fundamental conclusion of the evaluation of reactor shutdown issues is that public health and safety has been adequately protected while plants were in shutdown conditions, but that numerous and significant events have occurred that indicate that substant al safety improvements are possible and appear NUREG-1422 1-25

warranted. The staff has also concluded, or perhaps reconfirmed, that reactor safety is the product of the prudent, thoughtful, and vigilant efforts of the reactor licensees and the NRC and not the result of " inherently sa#' designs or " inherently safe" conditions. The areas of weakness identified in this report stem primarily from the false premise that " shutdown" means " safe." The primary staff action resulting from this study must therefore be a recogni-tion of this fact and a resolution not to allow complacency to substitute for appropriate safety programs to deal with shutdown conditions. The NRC staff identified some important safety issues that warrant serious consideration as potential new generic issues, and for which regulatory action may be justified. This conclusion is based on the results of observations and inspections at a number of plants, deterministic safety analysis, and insights from probabilistic risk assessments. The potential actions identified include improvements in the following: outage planning and control; fire protection, operations, training, procedures, and other contingency plans; technical speci-fications; instrumentation; and emergency planning. The major technical aspects are expected to be completed in mid-1992.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1150, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants," second draft, June 1989. i 2. --, NUREG-1410, "Los; of Vital AC Power and the Residual Heat Removal System During Mid-Loop Operations at Vogtle Unit 1 on March 20, 1990," June 1990. 3. --, NUREG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," Final Report, Vol. 1, April 1989. 4. J. H. Moody, Jr., et al., "Seabrook Station Probabilistic Safety Study - Shutdown Modes 4, 5 & 6," Proceedings of Conference on Probabilistic Safety Assessment, Pittsburgh, Pennsylvania, 1989. 5. J. H. Holderness et al., " Brunswick Decay Heat Removal Probabilistic Safety Study," Electric Power Research Institute / Nuclear Safety Analysis Center (EPRI/NSAC) Report NSAC-83, prepared by Impell Corp., Palo Alto, California, October 1985. 6. D. C. Bley et al., " Zion Nuclear Plant Residual Heat Removal PRA," EPRI/NSAC Report NSAC-84, prepared by Pickard, Lowe, and Garrick, Inc., Palo Alto, California, July 1985. 7. U.S. Nuclear Regulatory Commission, NUREG/CR-5015, " Improved Reliability of Residual Heat Removal Capability in PWRs as Related to Resolution of Generic Issue 99," Brookhaven National Laboratory, April 1988. 8. --, NUREG-1340, " Regulatory Analysis for the Resolution of Generic Issue 99: Loss of RHR Capability in PWRs," February 1989. 9. G. Vine et al., " Residual Heat Removal Experience Review and Safety Analysis - Pressurized Water Reactors," EPRI/NSAC Report NSAC-52, Palo Alto, California, January 1983. NUREG-1422 1-26

10. --, " Residual Heat Removal Experience Review and Safety Analysis - Boiling Water Reactors," EPRI/NSAC Report NSAC-88, March 1986. 11. U.S. Nuclear Regulatory Commission, NUREG/CR-5368, " Reactivity Accidents - A Reassessment of the Design-Basis Events," Brookhaven National Laboratory, January 1990. 12. J. M. Mattei and G. Bars, "Probabilistic Analysis of 900 MWe PWR Shutdown Technical Specifications," Probabilistic Safety Assessment and Risk Management /PSA '87, Vol. III, European Nuclear Society and Swiss Nuclear Society Internal Topical Conference, August 30-September 4, 1987, Zurich, Verlag.TUV Rheinland GmbH, Koln, 1987, pp. 801-806. 13. Electricite de France and Institut de Protection et de Surete Nucleaire, "Probabilistic Safety Studies in France: What is the Core Melt Probability for the PWRs?" French Nuclear Society seminar, Paris, May 16, 1990. 14 U.S. Nuclear Regulatory Commission, NUREG-1449, " Shutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States," draft report for comment, February 1992. 15. --, AE00 C-503, " Decay Heat Removal Problems at U.S. Pressurized Water Reactors," AE0D Case Study Report, December 1985. 16. --, NUREG-1269, " Loss of Decay Heat Removal System, Diablo Canyon Unit 2, April 10, 1987," June 1987, 17. --, Information Notice 88-36, "Possible Sudden Loss of RCS Inventory During Low Coolant Level Operation," June 8, 1988. -18. --, Generic Letter 87-12, " Loss of Residual Heat Removal While the Reactor Coolant Syst u Is Partially Filled," June 9, 1987. 19. --, memorandum from James Taylor, Executive Director for Operations, to the Commissioners, " Staff Actions Resulting From the Vogtle Unit 1 Incident Investigation," August 8, 1990. TASK 1.6A, " ASSESSMENT OF NRC REQUIREMENTS ON MANAGEMENT" Task Leader: Joel Kramer, Human Factors Branch, Division of Systems Research, Office of Nuclear Regulatory Research Issue: Failure of management to recognize and respond appropriately to hazardous conditions during the conduct of a test was a major factor in the Chernobyl accident. One reason for this failure may have been an excessive burden of non-critical requirements. NRC requirements on nuclear power plant management for oversight of tests, maintenance, and operations must not contravene safety. The issue is whether compliance with NRC requirements has the potential to divert management's attention from safe operations. It is important that NRC requirements on management be reasonable and not impose burdens that could divert the implementation of critical responsibilities. -NUREG-1422 1 "~

Purpog: To ensure that NRC's imposition of requirements on plant and utility company management includes consideration of potential diversions from priority safety issues by paying particular attention to matters important to safety and by avoiding requirements that could divert management's attention. Scope: The scope of this task involved (1) a review of requirements imposed by the NRC on plant management and (2) development of a new NRC senior management survey to assess the current effect of NRC activities on the safe operation of nuclear power plants. In 19*1 the NRC conducted a survey of utilities to obi.ain their views on the effect of NRC regulatory programs and initiati!es on utility operations and Therefore, this task was not cone' t red a new task stemming from resources. the Chernobyl accident. Work

Description:

The NRC staff reviewed 10 CFR Parts JO and 55 (Ref. 1) and other NRC requirements (e.g., Ref. 2) to determine if NRC requirements on management are reasenable and do not impose burdens that could divert management's attention from important safety actions. On August 4, 1989, the Actin 0 Executive Director for Operations informed the Commission (Ref. 3) of a proposed NRC senior management survey of the current effect of NRC activities on the safe operation of nuclear power plants. As stated ir. Reference 4, the Secretary of the Commi3sion informed the Acting E n cutive Director for Operations on September 22, 1989, that the Commission approved the recommer.dation to conduct this survey. On June 7, 1991, the Executive Director for Operations informed the Comission (Ref. 5) of the staff's final actions resulting from the conduct of this wurvey. On December 20, 1991, the Secretary of the Commission informed the Executive Director for Operations (Ref. 6) of additional staf f actions required based on the Commission's re.iew of SECY-91-172 (Ref. 5). Findings: In its review of 10 CFR Parts 50 and 55 and other NRC requirements, the NRC staff identif ed one significant requirement related to this issue. 10 CFR 50.3P requires that test, calibration, or inspection activities be conducted so that facility operation will be within the safety limits and that the limiting conditions for operation will be met. The closecut report for another Chernobyl followup task, Task 1.2B, "NRC Testing Requirements," is related to the 10 CFR 50.36 requirement. Af ter the t'hernobyl accident, the NRC staff undertook a line-by-line review of all testing require-ments in the technical specifications to identify candidates for change. As a restit of the review, the staf f recommended that the requirements for a majority of the surveillance tests be reduced because of the potential adverse effects on l safety. I ( f >'7G-1422 1-28 i

The NRC was concerned about the possible adverse effects of its regulations, requirements, and potentially burdening or competing activities on safety bef ore and after Chernobyl. In 1981 it conducted a survey of utilities to obtain their views on the ef fect of NRC regulatory programs and initiatives on utility oper-atior,s and resources. As a result of that survey, the NRC made a number of char;es in its Organization and practices. As a result of the Regulatory Impact Survey completed in 1990 (Ref. 7), the NRC made ar!ditional significant changes to reduce burden and iF rove safety.

== Conclusions:== On the basis of the above findings, the staff concludes that, before and after Chernobyl, the NRC gave serious consideration to not imposing requirements on plant and utility company management that could divert its attention from matters important to safety. The staff will continue on an annual basis to review exist-ing requirements and activities to ensure that excessive burdens are not being imposed on plant and utility company management.

References:

1. Code of Federal Regulations, Title 10. " Energy," U.S. Government Printing Office, Washington, 0.i revised periodically. 2. U.S. Nuclear Regulatory Commission, Generic Letter 82-33, Supplement 1 to NUREG-0737, " Requirement for Emergency Response Capability," December 1982. 3. --, SECY-89-238, "NRC Senior Management Survey of the Impact of NRC Activities on the Safe Operation of Nuclear Power Pl ?nts," August 4, 1989. 4. --, COMKR-89-3, "NRC Seniar Management Survey of the Impact of NRC Activ-ities on the Safe Operation of Nuclear Power Plants," memorandum from Commissioner K. Rogers to Chairman K. Carr et al., August 16, 1989. 5. --, SECY-91-172, " Regulatory Impact Survey Report - Final," June 7,1991. C. --, memorandum f rom S. J. Chilk, Secretary, to J. M. Taylor, Executive Director for Operations, "SECY-91-172 - Regulatory Impact Survey Report - 2 Final," December 20, 1991. 7. --, NUREG-1395, " Industry Perceptions of the Impact of the U.S. Nuclear Regulatory Commission on Nuclear Power Plant Activities," draft, March 19, 1990. TASK 1.7A, " ACCIDENT MANAGEMENT" Task Leauer: Joel Kramer, Human Factors Branch, Division of Systems Research, DTfice of Ruclear Regulatory Research (RES) Issue: As a result of the Chernobyl accident, a concern exists that the current svmptom-baset emergency operating procedures (EOPs) now in place at nuclear power giants do not deal uniformly with the states of core damage and beyond. Reference 1 contains several elements that address this issue. One objective of the NUREG-1422 1- ?9

Individual Plant Examination element is the aduction of the overall probability of core damage and fission product releases, if necessary, by appropriate modi-fications of procedures and hardware that would help prevent or mitigate severe accidents. The Containment Performance Improvements element focuses on n solving hardware and procedural issues related to generic containment challenges. The Improved Plant Operations element includes the expansion of E0Ps to include guidance on severe-accident-management strategies. Finally, the Accident Man-agement Program element includes certain measures to be taken before an event (e.g., improved training for severe accidents and hardware or procedural modi-fications) to facilitate implementation of accident management s',tegies. It b anticipated that each plant's accident management plan will resolve this issue. Purpnse: To ensure that accident management programs consider the adequacy of current symptom-based E0Ps. Scope: This task involved reviewing and coordinating several ongning NRC and industry research activities and programs dealing with accident management to ensure incorporation of this procedural issue and providing further guidance as neces-sary. The ongoing programs include (1) the development of a generic letter on accident management to be issued in fiscal year 1993 as one element of NRC's program for resolving severe-accident issues at nuclear power plants; (2) work performed by Brookhaven National Laboratory (BNL) (Ref. 2) to evaluate the func-tional, control, and communication behavior involved in severe-accident response situations; (3) related work under way and planned as part of RES's Human Fac-tors Regulatory Research Program Plan, Revision I (Ref. 3) (e.g., procedures); (4) development of accident management guidelines for utilities by the Nuclear Management 9d Resources Council (NUMARC) and the Electric Power Research Insti-tute (Ref. 4); and (5) the Containment Performance Improvements Program. There-fore, this task was not considered to be a new task stemming from the Chernobyl accident. Work

Description:

The staff reviewed the ongoing NRC and industry re earch activities and programs listed under " Scope" to ensure that this issue is being addressed. Findings: Results of the staf f's review of the ongoing NRC and industry research activities and programs listed under " Scope" indicate that although the adequacy of current E0Ps is being addressed as an issue, tie issue is far from being resolved. Conclusions-The caff concludes that more work is necessary before thi issue is finally resolved. A generic letter on accident management is planned fu issuance in fiscal year 1993. NUREG-1420 1-30 I

References:

1. U.S. Nuclear Reguietary Commission, SECY-88-147, " Integration Plan for Closure of Severe Accident Issues," May 25, 1988. 2. D. S. Metlay, S. B. Haber, and W. J. Luckas, " Responding to Emergencies: How Organizational Factors Make a Difference," Brookhaven tional Laboratory, Upton, New York, September 1989. 3. U.S. Nuclear Regulatory Commission, SECY-89-183, "NRC's Human Factors Programs and Initiatives," June 16, 1989. 4. S. R. Lewis and G. J..Boyd, " Guidelines for Evaluating Accident Management Capabilities" (draft for review), Saros, Inc., Knoxville, Tennessee, August 1989. (Prepared for the Electric Power Research Institute, Palo Alto, California, in support of Nuclear Management and Resources Council, Washington, D.C.) t F NUREG-1422 1-31 l (

_ _ _._.m.__ ___ _ _ _ _ - ~ _ _ __.. _ _ _ i l CHAPTER 2 DESIGN TASK 2.1A, " REACTIVITY ACCIDENTS" Task Leader: Fuat-(Frank) Odar, Reactor t 1 Plant Systems Branch, Division of i Systems Research, Office of Nuclear Regulatory Research Issue: Reactivity insertion mechanisms are considered in standard safety analysis. In - addition to the events that are analyzed, low probability events that could conceivably have more severe consequences can be hypothesized. In the past, these unanalyzed events either were precluded by specific design features or required combinations of causative events that were judged too improbable to be of-concern. Hence, these sequences have been considered to be insignificant contributors to overall risk and were not studied in detail. After the accident at the Chernobyl plant, the NRC published NUREG-1251 (Ref. 1). - In that report, the NRC staff explained how the positive void reactivity coeffi-cient and slow response of the shutdown system contributed to the accident. It also pointed out that light-water reactors (LWRs) do not have the same charac-teristics as the reactor at Chernobyl. However, one of the recommendations in the report was to verify that previous judgments regarding reactivity accidents . are still valid. The' issue is whether these earlier judgments can be reconfirmed using the more sophisticated analytical tools now available and taking into account the Chernobyl experience.

Purpose:

To analyze reactivity events that m1ght be postulated for the different LWR designs that are currently Itcensed. This would reconfirm, or bring into ques-tion, previous judgments N the potential reactivity accident sequences hitherto selected for analysis er a basis for design approvals. - Scope: The study included both probabilistic analysis to determine the frequency of an event and deterministic analysis to assess the potential consequences. The events of interest were those during which there is a relatively large reac-tivity insertion and/or the response of the shutdown system is inadequate. The Chernobyl-experience suggested that attention be focused on sequences that might involve a positive void coefficient or moderator temperature coefficient NUREG-1422' 2-1 =--w=& 9 e ee-3" re.4.-- i tem e 3- -ira.s e "e-we7e'mm-e +r %eme -e s w 4 eww--d-wwm wer-w we e-a wo-- p n- --eeM-qve eip-g wey e <wD-17 M. 4-'tr-gi-e v.yr W = t e e-?p-

i that arise in connection with the deliberate bypassing or disabling of any safety feature vhose causes include human error (commission, omission, or misjudgment) Wor L Joscription: The work, which was done by Brookhaven National Laboratory, is described below. (1) Establishment of Criteria Criteria were established to judge whether a particular sequence needed further examination by the NRC. These figures-of-merit consisted of frequency ranges and limiting valaes for physical parameters. (2) Selection of Events A list of sequences of events was developed for major reactor designs in opera-tion. This list consisted of extensions of reactivity events currently ana-lyzed, for example, multiple rod drops in a boiling-water reactor (BWR), events that had been brought to the attention of the NRC (e.g., intrusion of unborated water as a result of a steam generator tube rupture and boron dilution after a loss-of-coolant accident during the long-term cooling mode when all rods are out and the moderator temperature coef ficient is slightly positive), and other events that could be identified (e.g., a reactivity event when more than one control rod is unavailable). The events for the most part are delineated in Reference 1. The new events were identified by a disciplined and systematic approach to event sequence definition using event trees. Various modes of reactor operation were considered (e.g., low power), as well as the potential unavailability of engineered safety features that would otherwise mitigate an event in question. Conditions for positive moderator coefficients were considered. The following list is a simple description of what some of the event sequences included: BWR Events control rod ejection overpressurization with limited relief boron dilution during an anticipated transient without scram (ATWS) ATWS without recirculstion pump trip 3 multiple rod drop multiple rod bank withdrawal reactivity events with more than one rod stuck out Pressurized-Water Reactor (PWR) Events injection of cold, unborated emergency cooling water injection of cold, unborated water as a result of a steam generator tube rupture multiple rod ejection f NUREG-1422 2-2

j multiple rod bank withdrawal - 1 unlimited boron dilution coolant temperature increase with positive moderator temperature coefficient ATWS with less negative moderator temperature coefficient reactivity events with more than one rod stuck out Both PWRs and BWRs were considered by selecting one PWR plant (Westinghouse four-loop plant) and one BWR plant (BWR-4 type) and by performing analyses of these plants and noting the extent to which the results obtained apply to various reactor designs within each of the broad LWR subclasses. (3) Probabilistic Quantification of Events The accident sequences that emerged from Item (2), " Selection of Events," were cuantified to establish those that meet the appropriate selection criteria. The S antification process involved a detailed search of various data bases and other s6urces to oDtain failure rates and event probabilities. (4) Physical Assessment of Events A deterministic analysis was done for each sequence of events for which the frequency of occurrence is either unknown or expected to be significant. Key parameters were determined, and their limiting values were quantified. For example, the maximum rate of reactivity insertion was a key parameter for an event initiated by a multiple rod bank withdrawal in a PWR. The quantification was done primarily by using the results of analysis already in the literature for other purposes. A limited number of independent calculations were also dpne using. existing codes and reactor models when it appeared that the potential safety significance of the postulated event warranted this additional' effort. (5) Report The NRC published a report (Ref. 2) that integrated the results (probabilistic and deterministic elements) of the above tasks. The report discusses the criteria used to judge the significance of different events the. events considered and how they were determined a .the methods and results of the probabilistic analysis to determine the -expected frequency of different sequences the methods and-results of the determinist % analysis to determine the physical consequences of events recommendations and conclusions NUREG-1422 2-3 '-9Y'ie-w** *m- ---eye-- w w+ su m4w--- .wMa w m ur - W um4-=cewaim+mi uP-w ww-swws-u---We-ww+y--'-e-m4 -ww-ai -ww' r-ww--w-em-

Findings: The primary results from the study are the following: Many sequences in 17 broad categories were studied. All but two of the sequences that have the potential to cause rapid fuel damage have fre-quencies too low to warrant further consideration at this time. Of the two sequences with estimated frequencies in the range of interest for severe accidents, the most important is a refueling accident in a BWR. This accident is caused by the loading of fuel surrounding two or more positions where control blades have been removed and are inoperative. The consequences of a refueling accident can be severe because the vessel head is open and the containment is not sealed. The other sequence with an estimated frequency that is significant is the rasult of the flushing of boron during an ATWS at a BWR because of an uncontrolled depressurization and injection of unborated water from low-pressure cooling-systems. Calculations show that the reactivity insertion in this transient will not cause rapid fuel disintegration. The results are reported in Reference 3. Several sequences under shutdown conditions were found not to lead to rapid fuel damage but to lead to core melt. These sequences have low estimated frequencies of occurrence. Table 2.1A-1 summarizes the results.

== Conclusions:== Only one seqJence studi9d is important. It is the refueling accident in a BWR. Since the probabilities of occurrence of the other sequences are very low, their further consideration is not warranted, The probability of the refueling acci-dent based on crude preliminary calculations was indicated to be potentially sufficier.tly high - and its consequences are sufficiently severe - that changes in operating reactor technical specifications may be nece;sary to prevent it or to substantially reduce its probability. At present, General Electric (GE) and the Electric Power Research Institute are conducting a joitit effort to quantify more exactly the probability and consequences of the event.- NRC research planned for fiscal year 1993 under Task 1.4C will address the probability and consequences of this t.ansient. The results of this research and GE findings may lead to the identification of some changes in procedures.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1251, " Implications of the Acci-dent at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," Final Report, Vol. 1, April 1989. 2. --, NUREG/CR-5368, " Reactivity Accidents - A Reassessment of the Design Basis Events," Brookhaven National Laboratory, January 1990. 3. --, NUREG/CR-5573, " Boron Flushing During a BWR Anticipated Transient Without Scram," Brookhaven National Laboratory, June 1990. NUREG-1422 2-4

4 4. J. P. Berger, "Probabilistic Safety Assessments at EDF," paper presented at 4 I Committee on tne Safety of Nuclear Installation workshop on applications and limitations on probabilistic safety assessments in Santa Fe, New Mexico, September 4-6, 1990. i 5. U.S. Nuclear Regulatory Commission, NUREG-1449, "Snutdown and Low-Power Operation at Commercial Nuclear Power Plants in the United States," draft i report for comment, February 1992. 6. C. A. Cameron, General Electric, letter to U.S. Nuclear Regulatorv Com-mission, "Telecon - Condition Germane to Safety," June 25, 198? Table 2.1A-1 Summary of reactivity accidents Expected consequences for Estimated Event worst sequence frequency PWR Events Addition of diluted water from the Core melt or rapid < IE-8/ reactor-accumulator during shutdown as a fuel damage, but cal-year (RY), result of slow leakage or blow-culations are needed insignificant down through a single valve to verify possibility of latter Addition of diluted v aer from the Same as above < IE-7/RY, refueling water storage tank (RWST) insignificant during shutdown as a result of inadvertent safety injection, leakage because of improper valve opening or closing, or filling of cavity Loss-of-coolant accident (LOCA) Same as above < 1E-7/RY, with diluted emergency core cooling insignificant system water from more than one accumulator or RWST LOCA with sump water diluted Core melt Insignificant Steam generator tube rupture with Core melt Analysis by NRC secondary coolant diluting primary to be published coolant Uncontrolled boron dilution from Core melt < 1E-6/RY, chemical and volume control system insignificant -during shutdown Startup of reactor coolant pump Cor* damage is No analysis after improper boron dilution expected, but rapid fuel damage is not expected * -See footnotes at end of tabic. NUREG-1422 2-5

lable 2.1A-1 (continued) Expected consequences for Estimated Event worst sequence frequency PWR Events (continued) Rod ejection accident Rapid fuel damage Insignificant, requires (un-known) mechanism for multiple ejections Transients with positive moderator Acceptable Not relevant temperature coefficient Other beyond-design-basis events No rapid fuel damage No analysis BWR Events Rod drop accident Rapid fuel damage < 1E-8/RY, insignificant Rod ejection accident Acceptable Insignificant Overpressurization events Rapid fuel damage not Insignificant expected (only short-term behavior con-sidered) Flushing of boron during an ATWS Rapid fuel damage ** > 1E-6/RY, significant Reactivity event initiated while Acceptable (with Significant reactor is in unstable operation respect to reactivity event) Refueling accidents Rapid fuel damage *** > IE-6/RY, significant (appears to be < 1E-8/RY with procedural change) Other beyond-design-basis events Core melt In:s]nificant

• French studies show that this transient may be a significant contributor to the risk (Ref. 4).

Recent studies at Brookhaven National Laboratory (BNL), discussed in an NRC report (Ref. 5) and in more detail in a BNL report that is to be published as NUREG/CR-5819, indicate that core damage may occur for extreme event parameters, but events may be prevented with appropriate procedures.

• • A follow-on study at BNL shows that rapid fuel damage is not predicted (Ref. 3).
    • General Electric calculations show that fuel enthalpy increases to more than 280 cal /g, which may lead to rapid localized disintegration of fuel (Ref. 6).

NUREG-1422 2-6

I TASK 2.3A, " CONTROL R00H HABITABILITY' Task Leader: Charles Ferrell, Severe Accident Issues Branch, Division of Safety Issue Resolution, Office of Nuclear Regulatory Research ' Issue: The radioactive ges and smoke released during the accident at Chernobyl Unit 4 spread to the other three operating units at the site. The airborne radioactive material was transported to the other units through a shared ventilation system-as well as by way of general atmospheric dispersion paths. This raises the question of how accidents at one unit of a multiple-unit site affect control room habitability at the remaining units.

Purpose:

To describe staff efforts under way that address this issue. Scope: In Section 2.3.4 of NUREG-1251 (Ref. 1), the staff concluded, "In the event of a severe accident in one unit of a multiple-unit site, the control room opera-tors are adequately protected by design features that will ensure a habitable environment." It also concluded that additional control room habitability studies under way, as part of ongoing Generic Issue 83, " Control Room Habitabil-ity," were expected to confirm this conclusion. The scope of this task, there-fore, is to discuss efforts under way pertaining to Generic Issue 83. Work

Description:

As noted in NUREG-1251, the NRC staff initiated a review of the existing design and maintenance of control room ventilation systems. One result of this effort, designated as Generic Issue 83, has been a survey of the as-built control room ventilation systems of 12 operating nuclear power plants. The report on this survoy was published-in October 1988 as NUREG/CR-4960 (Ref. 2). This survey indicated that many as-built control room ventilation systems were performing differently (in terms of air flow, infiltration rate, etc.) than they were designed. During another study performed as part of this issue, the improved estimation of atmospheric dispersion for assessment of control room habitability associated with building wakes was investigated. The diffusion models in this report are based on tracer studies at reactor sites. Tne report on this study, which was published in May 1988 as NUREG/CR-5055 (Ref. 3), suggests that pre-vious staff assessments made using Standard Review Plan (SRP) Section 6.4 -(Ref. 4) may have been unduly conservative. Also as prt of Generic Issue 83, the staff is studying improved computer models for estluating concentrations of toxic substanas at control room air intake structures and for tracking fission-product movement within typical plant flow paths. The staff is also examining improved dose assessment models. In addition, the nuclear industry is preparing a proposed standard on control room habitability systems. This work is being done under the auspices of the American Nuclear Society (ANS) (Working Group ANS 59,7). NUREG-1422 2-7 ,c

1 The NRC staff has completed the technical analysis for resolving Generic Issue 83. This issue is in the final stages of the regulatory resolution process. It is expected to be resolved by the issuance of a generic letter to licensees and a revision to SRP Section 6.4, " Control Room Habitability System." This resolution will provide for the use of improved meteorological models and computer codes to calculate the exposure of control room operators to radiological or toxic gas releases. The reports published to assist in the resolution of Generic Issue 83 include NUREG/CR-5656 (Ref. 5), NUREG/CR-565B (Ref. 6), NUREG/CR-5659 (Ref. 7), and NUREG/CR-5669 (Ref. 8). Findings: The findings of the work done under Generic Issue 83 indicate that (1) some ~ control room ventilation systems may not be performing as well as had been des-cribed in licensee submittals, and (2) staff assessments with regard to atmos-pheric dispersion may have been unduly conservative. Other aspects of the staff's assessment model are still being investigated.

== Conclusions:== On the basis of the work performed so far on Generic Issue 83, there is no reason to believe that the conclusion expressed in NUREG-1251 and stated under " Scope" has changed.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," Final Report, Vol.1, April 1989. 2. --, NUREG/CR-4960, " Control Room Habitability Survey of Licensed Commer-cial Nuclear Power Generating Stations," Argonne National Laboratory, October 1988. 3. --, NUREG/CR-5055, " Atmospheric Diffusion for Control Room Habitability Assessments," Battelle Memorial Institute, Pacific Northwest Laboratory, May 1988. 4. --, NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," July 1981. 5. --, NUREG/CR-5656, "EXTRAN: A Computer Code for Estimating Concentrations of Toxic Sabstances at Control Room Air Intakes," Battelle Memorial Insti-tute, Pacific Northwest Laboratory, March 1991. 6. --, NUREG/CR-5658, "FPFP-2: A Code for Following Airborne Fission Products in Generic Nuclear Plant flow Paths," Battelle Memorial Institute, Pacific Northwest Laboratory, March 1991. 7. --, NUREG/CR-5659, " Control Room Habitability System Rev ew Models," i Science Applications International Corp., December 1990. NUREG-1422 2-8 l

8. --, NUREG/CR-5669, " Evaluation of Exposure Limits to Toxic Gases for Nuclear Reactor Control Room Operators," Battelle Pemorial Institute, Pacific Northwest Laboratory, July 1991. TASK 2.3B, " CONTAMINATION OUTSIDE CONTROL ROOM" Task Leader: Charles Ferrell, Severe Accident Issues Branch, Division of Safety Issue Resolution, Office of Nuclear Regulatory Research issue: The radiractive gas and smoke released during the accident at Chernobyl Unit 4 spread to the other three operating units at the site. The airborne radioactive material was transported to the other units through a shared ventilation system as well as by way of general atmospheric dispersion paths. This raiscs the question of how accidents at one unit of a multiple-unit site affect the re-maining units, with regard to contamination outside the control room.

Purpose:

To describe staf f ef forts unct way that address this issue. Scope: In Section 2.3.4 of NUREG-1251 (Ref. 1), the staff concluded that "for areas outside the control room, shutdown system design and control rm capab;11ty preclude the need for immediate access to remote areas, and measures are avail-able to gain access to take the few longer term actions necessary for accom-plishing cold shutdown and performing maintenance." However, the staff also recommended that "when ventilation and post-accident shutdown systems are being designed for new plants, contamination outside the control room should be con-sidered." The scope of this task is to discuss efforts under way in this area. Work

Description:

At present, the NRC staff does not plan to study contamination outside the con-trol room at licensed plants because adequate measures exist to gain access for accomplishing cold shutdown and performing maintenance.

== Conclusions:== In SECY 90-016 (Hef. 2), the staff recommended, in regard to fire protection for evolutionary advanced light water reactor plants, that the designers ensure that smoke, hot gases, or the fire suppressant will not migrate into other fire areas to the extent that they could adversely affect safe shutdown capabilities, including operator actions. The Commission has endorsed this staff position. The staff concludes that, with this position, radioactive contamination af plant areas outside the control room, in addition to smoke and hot gases, will be considered for new plants.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," Final Report, Vol. 1, April 1989. NUREG-1422 2-9

2. --, SECY-90-016, " Evolutionary Light-Water Reactor (LWR) Certification Issues and Their Relationship to Current Regulatory Requirements," January 12, 1990. TASK 2.3C, "$M0KE CONTROL" Task Leader: John H. flack, Severe Accident Issues Branch, Division of Safety Issue Resolution, Of fice of Nuclear Regulatory Research Issue: The smoke released during the fires started by the accident at Chernobyl Unit 4 spread to the other three operating units at the site. This issue called for the staff to assess the risk significance of smoke propagation from one u'11t to an adjacent unit ard to address the question of whether additional protection [ or requirements should be developed.

Purpose:

To independently evaluate the risk, from a probabilistic perspective, of smoke that could or ginate from a fire at one unit and potentially affect an adjacent i unit. Scope: Licensees must comply with General Design Criterion (GDC) 5 of Appendix A to 10 CFR Part 53 (Ref. 1); this GDC addresses the sharing of structures, systems, and components teetween units. If the intent of GDC 5 is met, then from a regulatory perspective fire and smoke originating at one unit should not affect the safe shutdown of an adjacent unit. However, the purpva M this task was to independently evaluate the risk from a probabilistic perspectivo. The NRC staff, therefore, atterpted to extrapolate the insights gained from a study by Sandia National Laboratories (Ref. 2), which had evaluated smoke control in single units only, to multiple-unit sites, and to thus address the Chernobyl smoke control issue. Work

Description:

According to the Sandia study, Virtually no quantitative data exists on the response of equipment to other than purely thermal environments. Further, virtually no analy-tical tools are available which are capable of predicting the char-acteristics of these secondary environmental fattors, let alone how equipment will interact with such factors. This lack of understand-ing of equipment response, coupled to a lack of analytical tools, prevents quantification of secondary [ smoke) damage impacts on plant risk in any meaningful way. The study attempted to provide some guidance on the potential effect of smoke on core damage by the analysis of operating experience. The experience base for nuclear power plants was investigated for relevant smoke-induced phenomena NUREG-1422 2-10

and the significance of such phenomena with regard to plant safety. An effort was made to identify certain vulnerabilities. The probability that any given plant might display these smoke-irduced vulnerabilities was then evaluated. Findings: The primary fuel sources for the most risk-Signific ant fire areas at nuclear power plants are lubricating oils and cable inculation. Both of these sources represent the most prolific smoke generating fuels. In its study, Sandia reports that smoke from burning such fuels in a typical r uclear power plant enclosure would obscure the entire enclosure in about 10 m nutes. In actual experience, i firefighters often have had difficulty in seeing the fire source. This could lead to misdirected suppression efforts and othet medes of failure. In general, smoke can affect plant risk in dif ferent ways: (3) Smoke can reduce the effectiveness of manual firefighting, cause mis-directed suppression efforts, and consequently damage equipment not directly involved in the fire. (2) Smoke can damage ar degrade electronic equipment, resulting in functional loss or specious response. (Very little experimental data on equipment response in smoke-filled environments are available. In addition, computer codes needed to model smoke propagation at nuclear power plants have not been fully developed and have not been fully validated.) (3) Smoke can hamper operators' ability to safely shut down the plant by causing evacuation of control centers and subsequent reliance nn backup shutdown capability. (4) Smoke can initiate automatic suppression systems in areas away from the fire, potentially damaging safety systems and components. (Generic Issue 57, " Effects of Fire Protection System Actuation on Safety-Related Equipment," addresses this problem.) The ef fect 01 smoke on firefighting teams and plant equipment could not be qutntified explicitly as part of the Sandia study primarily because (1) there are to date virtually no quantitative data on the vulnerability of plant equip-ment to smoke, (2) the historical experience base does not provide sufficient detail to identify the mechanisms of fire damage, and (3) current fire-modeling techniques do not model environmental effects on plant equipment of factors other than direct thermal heating and ignition.

== Conclusions:== The effect of smoke on operators, firefighting teams, and plant equipment could not be quantified within the framework of the Sandia study. Very little experi-mental data on equipment response in smoke-filled environments are available, and methodology for including smoke in fire probabilistic risk assessments has not been adequately developed. The extrapolation of smoke damage from a single-unit to a multiple-unit site would therefore exacerbate the large uncertainties already present in understanding the effect of smoke on plant safety. NUREG-1422 2-11

Nevertheless, the qualitative evidence provided by the Sandia study justifies concern about the potential risk impact of smoke. An aspect of this concern relates to mult'ple-unit sites, where some designs might allow the propagation of smoke f rom eae unit to the adjacent unit (e.g., the control rooms). The smoke control issue should be (and recently has been) raised as a potential generic issue and will be resolved within the generic issue program. Remarks: On the basis of the insights gained from the Sandia study, smoke control and manual firefighting effectivene:s has been raised as c potential generic issue. The need for additional work in the smoke control area will therefore be deter-mined within the generic issue program. It should be noted that two additional potential generic issues, which are somewhat related to the propagation of smoke at multiple-unit sites, have been identified by the Sandia study: (1) control room-alternate shutdown panel interactions and (2) adequacy of fire barriers. The disposition of these two issues may also have a bearing on the need for further protection against smoke propagation at multiple-unit sites.

References:

1. Code of Federal Regulatioas, Title 10 " Energy," U.S. Government Printing Dffice, Washington, D.C., revised periodically. 2. U.S. Nuclear Regulatory Commission, NUREG/CR-5088, " Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, including Pre-viously Unaddressed Issues," Sandia National Laboratories, January 1989. To / 2.30, " SHARED SHUIDOWN SYSTEMS" N Leader: Brad Hardin, Advanced Reactors and Generic Issues Branch, Division V legulatory Applications, Office of Nuclear Regulatory Research Issue: Should shar;og of systems required for safe shutdown among units at a multiple-unit site be prohibited? If not, what restrictions should be placed on such sharing? Even though General Design Criterion (GDC) 5 of Appendix A to 10 CFR Part 50 (Ref.1) appears to provice appiopriate guidance on the sharing of sys-tems important to safety, and the sharing of important support systems is addressed throughout the Standard Review Plan (Ref 2), problems still have occurred in operating plants. For example, at Byron Units 1 and 2, it was dis-covered that safety equipment needed for Unit 1 operation was to be shared with Unit 2 but was not provided until Unit 2 was constructed. Unit 2 was not scheduled for completion until a significant time after Unit I was scheduled for operation.

Purpose:

To determine requirements for shared shutdown systems in future light-water reactors (LWRs) and to identify any appropriate restrictions on the sharing of such systems. NUREG-1422 2-12

Scope: The conclusions resulting from this task apply to future LWRs only. This task is one part of a series of tasks addressing reactor system designs stemming from the concerns raised by the Chernobyl accident. It is related to Generic Issue 83, " Control Room Habitability." Work

Description:

The NRC staff reviewed existing re0ulations including general design criteria and the Standard Review Plan to determine what requirements and guidance al-ready exist concerning shared shutdown systems. It examined staff review of shared shutdown systems under the Standard Review Plan in conjunction with information about experience at operating plants. The information obtained from this review was factored into the evaluation of the need for strengthening existing requirements on the sharing of shutdown systems for the General Elec-tric advanced boiling water reactor and other evolutionary LWRs. Because of Brookhaven National Laboratory's (BNL's) ongoing work with the staff on the implementation of the Severe Accident Policy for the evolutionary LWR designs, the staf f also entacted BHL to obtain its comments. The specific areas that were discussed a o considered were emergency power systems (diesel generators), service water syss ms, ultimate heat sinks, and control rooms. Findings: GDC 5 states: Structures, systems and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in ona unit, an orderly shutdown and cooldown of the remaining units. The requirements embodied in GDC 5 appear to be adequate provided they are rigurously adhered to in the as-built plant. The problems experienced in U.S. plants have mainly been due to inappropriate interpretation of the requirements of GDC 5 rather than to inadequacies in the regulations. Again, an example is that of Byron Units 1 and 2. Some other examples of these problems are cited in the control room habitabili+.y survey of licensed commercial power plants conducted by Argonne National Laboratory for the NRC and documented in NUREG/ CR-4960 (Ref. 3). The problems discussed in the Argonne report are mainly asso-ciated with shared ventilation systems; however, discussions with NRC staff members and consultants have shown that other general concerns have existed in the past regarding the sharing of support systems for ventilation, water and electrical power supplies, and the ultimate heat sink. Concysions: The regulations concerning the sharing of sys+. ems needed fcr safe shutdown at multiple-unit sites as stated in GDC 5 are sufficient for future LWR applica-tions if the requirements embodied in GDC 5 ore strictly adhered to. On the basis of its review, the staff concludes that, although future LWR plants should generally be inctependent of one another in terms of their apability to NUREG-1422 2-13

achieve safe shutdown, multiple-unit sites may provide, through mutuel support, substantial improvement in system reliability. Although total independence between units is an easy way to demonstrate absolute assurance that problems in one unit do not affect another, there are circumstances in which the increase in system reliability may justify the existence of cross-connects and other means of mutual support bstween units. In these cases, benefits of such mutual support may be suf ficient to justify a minimal and carefully analyzed inter-connection vulnerability. However, the NRC recognizes that the capability for sharing systems (through the use of preplanning and the provision ci equipment needed for cross-ties, etc.) among plants can improve the availability of selected safety systems and sub-stantially reduce risk. This flexibility is appropriate for beyond-design-basis events (severe accidents). Such sharing can contribute toward reducing overall plant risk provided it is implemented in strict compliance with the conditions of GDC 5. More 'pecifically, the condition should be satisfied that such shar-ing shall not impair the capability of those systems to satisfy the needs of all of the plants at a multiple-unit site if one of the plants experiences an accident. This would include the incorporation of appropriately designed isolation features to minimize common mode failures. The staf f does not believe it is necessary to modify or add to the present formal regulations addressing the sharing of shutdown systems. However, in its review of advanced reactors, the staff will ensure that GDC 5 has been applied as discussed above. In its review of the advanced plant probabilistic risk assessments, the staff will ensure that the gains in reliability from supplying cross-connects are nfficiently great to justify any additional vulnerability.

References:

1. Code of Federal Regulations, Tit e 10. " Energy," U.S. bovernment Printing ~ Office, Washington, D.C., revised periodically. 2. U.S. Nuclear Regulatory Commission, NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," July 1981. 3. --, NUREG/CR-4960, " Control Room Habitability Survey of Licensed Commercial Nuclear-Power Generating Stations," Argonne National Laboratory, October 1988. TASK 2.4A, "FIREFIGHTING WITH RADIATION PRESENT" Task Leader: John H. Flack, Severe Accident Issues Branch, Division of Safety Issue Resolution, Office of Nuclear Regulatory Research Issue: Hot fuel and reactor material ejected as a result of the energetic release during the Chernobyl accident started approximately 30 fires in and around the surrounding building structure. Firefighters arriving 90 minutes later con-centrated their efforts on fires in the turbine building. The turbine building fires were brought under control in about 40 minutes, and all fires outside the core region were extinguished approximately 90 minutes later. During this time a number of firefighters were overexposed to radiation and subsequently died as a consequence. This event, therefore, raised a concern regarding the effect of radi tion on manual firefighting teams and plant safety in general. NUREG-1422 2-14

Because of differences in reactor design, firefighting teams at U.S. nuclear power plants are not expected to be exposed to the high radiation levels that occurred during the Chernobyl accident. Nevertheless, firefighting in radio-active environments may still affect the time required to suppress a fire and needs to be considered in overall firefighting plans. To have confidence in the adequacy of current fire programs implemented in compliance with NRC rules, the NRC staff recommended in huREG-1251 (Ref. 1) that firefighting when radia-tion is present be reviewed further from a risk perspective.

Purpose:

To factor into ongoing studies of risks associated with firefighting the Chernobyl lessons with regard to firefighting when radiation is present. Scope: Fighting fires when radiation is present can lead to (1) firefighting teams being overexposed to radiation and suffering from the related consequences and (2) an increase in fire suppression time as firefighting teams must (in addition to their normal preparation) prepare and plan for radiation environments. The first aspect is related to health physics and is addressed during the licensee's development of procedures that define strategies for fighting fires at nuclear power plants. Section 9.5.1.2.0 of the NRC Standard Review Plan (Ref. 2) states that these procedures should designate potential radiological and toxic hazards in fire zones. The second aspect of fighting fire when radiation is present is directly related to fire risk. The longer a fire is allowed to burn for whatever reason, the greater the conditional probability of core damage. The staff investigated the risk stemming from this issue as part of this task. Given a fire, the extent cf fire damage depends on fire detection time, fire-fighters' response time, and fire suppression time. The longer the time, the more likely the fire damage. The evaluation of a specific utility's firefight-ing team's ability to suppress fires and hence the explicit determination of the response and fire sbppression times are normally outside the scope of fire probabilistic risk assessments (PRAs). PRA sensitivity studies of the effectiveness of manual firefighting teams were performed as part of Sandia National Laboratories' Fire Risk Scoping Study (Ref. 3). The LaSalle PRA was used in the scoping study to bound the effects of variability in fire brigade response time. The fh dings were then applied to risk-significant areas identified in four fire PRA. (those for Indian Point 2, Oconee, Seabrook, and Limerick 1). Using insights gained from and working within the scope of this study, the NRC staff investigated the potential effect of radiation on firefighting teams' ability to respond to and suppress fires. Work

Description:

The first two tasks of the Fire Risk Scoping Study included requantification and assessment of uncertainties in the four fire PRAs. The third and fourth tasks were the identification and assessment of the risk significance of potential fire risk issues. The fourth task (in part) included an evaluation of the effect of firefighting activities on core damage frequency, using the requanti-fied PRAs developed by the first two tasks. NUREG-1422 2-15

Each of the four fire PRAs used in the scoping study contain a fire hazard analysis. The primary purpose of the fire hazard analysis is to identify risk-significant equipment or areas where safety-related equipment or its support systems are located. By identifying these areas, unimportant locations can be screened out. This greatly reduces the amount of work needed to perform the risk assessment. The four PRAs used in the scoping study identified 13 risk significant areas. These areas were placed into five groups according to size, equipment in the area, type of suppression equipment available, and type of fire detection. The five groups were the following: (1) cable shaft (0conee); electrical tunnel, cable spreading room (Indian Point 2); cable spreading room (Seabrook) (2) control room (Seabrook) (3) turbine building (Seabrook) (4) 13-kV switchgear room (Limerick), electrical equipment room (0conee), switchgear room (Indian Point 2) (5) primary component cooling pump area (Seabrook); safeguards access area, control rod drive hydraulic equipment area, general equipment area (Limerick) Using the above groups, Sandia then investigated the effect of firefighting activities on core damage frequency by estimating a range of oetection time, firefighters' response time, and suppression time. Response time was furcher separated into the following five categories: (3) responst. to fire,tvipment cage (2) suit-up (3) response to scene (4) setup at scene (5) scene search By adding the various times estimated above, the total fire burn time can be calculated. The longer the response and suppression time, the longer the burn time and the greater the fire damage. The greater the fire damage, the greater the risk of core damage. Should radiation be present during a fire, firefighters would have to take addi-tional protective action. This action would tend to increase the time associ-ated with the firefighters' response time and the time needed to suppress the fire. Depending on the location of the fire, the prolonged time would have an effect on core damage frequency. The NRC staff investigated the significance of this potential effect in its review of the scoping study. Findings: In the scoping study, Sandia determined that manual firefighting activitics can have a significant effect on core damage frequency. Sandia noted, "The typical variation observed due to assumed variability in fire brigade response time is NUREG-1422 2-16

l l l at least one order of magnitude. This indicates the importance from a risk per-spective of levels of staffing, equipping, and training of fire brigades at U.S. nuclear power plants." However, the staff's review of the study indicated that radiation was not a fac-tor that affected firef V ters' ability to suppress fires at the plants under study because the identified risk-significant fire areas were not located in radiation areas. Had radiation been a factor, the response and suppression times would have increased as there would have been a need to take radiation protection measures. Because radiation was not a factor in these areas and would not af fect manual fire suppression, no increase in core damage frequency would result. Conclus_i m : In the Fire Risk Scoping Study, Sandia concluded that manual firefighting effec-tiveness can have a significant effect on the frequency of fire-initiated core damage. In response to that conclusion, manual firefighting effectiveness was raised as a potential generic issue, " Smoke Control and Manual Firefighting Effectiveness." Upon further review and using insights gained from the Fire Risk Scoping Study, the staff concluded that radi uion does not noticeably affect the risks associa-ted with manual firefighting effectiveness. This conclusion stems from the fact that fires identified by past PRAs and the Fire Risk Scoping Study as risk significant do not occur in areas where radiation is a factor that may reduce or in any way affect firefighting effectiveness. This finding indicates that no additional action is warranted. Remarks: Although the effect of radiation on manual firefighting effectiveness appears to have minimal generic risk significance, licensees are expected to conduct a search for plant-specific fire vulnerabilities under the Individual Plant Exami-nation for External Events Program. Fire vulnerabilities identified under this program (which could include firefighting with radiation present) will need to be evaluated on a plant-specific basis.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1251, " Implications of the Acci-dent at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the Unitid States," Final Report, Vol. 1, April 1989. 2. --, NUREG-0800, " Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants," July 1981. 3. --, NUREG/CR-5088, " Fire Risk Scoping Study: Investigation of Nuclear Power Plant Fire Risk, Including Previously Unaddressed Issues," Sandia National Laboratories, January 1989. NUREG-1422 2-17

CHAPTER 3 CONTAINMENT TASK 3.1A, " CONT AINMENT PERFORMANCE" Task Leader: Len Soffer, Severe Accident issues Branch, Division of Safety Issue Resolution, Of fice of Nuclear Regulatery Research Issue: The Chernobyl accident, with its absence of effective containment, focused attention on tha strengths and performance limits of the substantial contain-ments for U.S. light-water reactors. It led to added recognition of the sig-nificance of angoing work on the issue of whether U.S. containments that were built using criteria based on design-basis accidents have adequate margins during severe accidents.

Purpose:

To reflect the Chernobyl experience in containment reviews conducted to implement the Commission't Severe Accident Policy. Scope: The scope of this task is to consider the Chernobyl containment failure as part of the evaluations of containment types. An existing set of tasks related to this issue was being implemented in the United States before the Chernobyl acci-dent. These tasks (which developed into implementation of the Containment Per-rg formance Improvement (CPI) Program, individual plant examination (IPEs), the development of accident management strategies, and the publication of the Reac-tor Risk Reference Document (Ref. 1)) are related to implementing the Commis-sion's Severe Accident Policy and effecting closure of ser re-accident issues. The Chernobyl accident adds to the information base only iridirectly because of differences in U.S. reactor and containment designs. Work

Description:

The NRC staff has issued its " Integration Plan for Closure of Severe Accident Issues" (Ref. 2). This plan described the following main elements that, in total, will help provide a definitive basis for reaching closure on the safety implications of severe-accident issues: CPI Program The staff has examined all containment types for possible containment improvements in response to generic containment challenges. The recommen-dations developed under this program are consistent with the Safety Goal Policy and the Backfit Rule. Recommendations for the Mark I containment NUREG-1422 3-1

were made. Evaluation of the remaining types of containments (i.e., ice condenser, Mark II and III, and large dry) is complete and is being incor-porated into the IPE Program by means of a generic letter (Ref. 3). Brook-haven National Laboratory (BNL), Idaho National Engineering Laboratory (INEL), Oak Ridge National Laboratory (ORNL), and Sandla National Labora-tories (SNL) provided contractor technical reports. This effort was com-pleted in November 1991. IPE Program The staff has issued guidance (Ref. 4) for nuclear utilities on the preparation of their IPE submittals. A workshop was conducted in Fort Worth, Texas, in February 1989 to acquaint the nuclear industry with the program. The staff has received and is reviewing IPE submittals. This effort is expected to be completed in 1995. Accident Management Strategies The staff has developed, with the assistance of Brookhaven National Labora-tory and Pacific Northwest Laboratories, a compilation and description of candidate accident management strategies (Ref. 5). These generic strategies fall under three broad categories: (1) conserving and replenishing limited resources, (2) use of systems and components in innovative applications, and (3) defeating interlocks and component protective trips in emergencies. NUREG-1150 This report was published in final form in December 1990 (Ref. 1). SNL and BNL provided significant contractor assistance. This document represents the most thorough probabilistic risk assessment performed to date for a group of reactors typifying U.S. containments. Findings: CPI Program The Commission approved several actions (Ref. 6) to enhance the safety of boiling-water reactor (BWR) Mark I containments. It directed the staff to approve the installation of a hardened vent by any Mark I licensee who voluntarily chooses to do so. All BWf< Mark I plants have or will install hardened vents. The Commission decided to incorporate other staff recom-mendations for the Mark I plants into the IPE program (Ref. 7). The NRC has requested that licensees incorporate the recommendations for all other containment types into their IPE programs (Ref. 3). IPE Program The NRC staff has issued a generic letter (Ref. 8) concerning the per-formance of IPEs for severe-accident vulnerabilities. This directive requires information from each utility that is based on a reexamination of its operating plant for plant-specific vulnerabilities. The staff also has issued guidance (Ref. 4) utilities may follow in performing their reviews. NUREG-1422 3-2

Accident fianagement Strategies The staff has established a long-term program to evaluate accident manage-ment strategies affecting containment performance. 3NL has developed a report on candidate strategies (R?f. 5), which include the assessment of in-vessel and ex-vessel severe-accident challenges. The report is intended to provide licensets with sample accident management strategies and guid-ance on their implementation. NUREG-1150 This report indicates that the five commercial nuclear power plants examined meet the Commission's Safety Goal Policy regarding individual early fatality risk and individual latent cancer fatality risk; no additional changes, other than those that may stem from the actions described above, are required. References 9-11 contain additional information concerning this task.

== Conclusions:== These ongoing staff actions did not stem from the Chernobyl accident. They are being pursued in a coordinated effort to implement the Commission's Severe Acci-dent Policy and to reach closure on severe-accident issues, including containment performance. With the exception of the Commission's directive regarding hardened vents for the BWR Mark I containments, they do not point to the need for signifi-cant modifications to present U.S. containments, though IPEs may disclose plant-specific containment vulnerabilities. Work will continue on improving the under-standing of potential changes to operating procedures under accident conditions, but no specific changes have been recommended.

References:

1. U.S. Nuclear Regulatory Commission, NUREG-1150, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Plants," seconc: draft for peer review, June 1989; Final Report, December 1990. 2. --, SECY-88-147, " Integration Plan for Closure of Severe Accident Issues," May 25, 1988. 3. --, Generic Letter 88-20, Supplement 3, " Completion of Containment Per-formance Improvemcnt Program and forwarding of Insights for Usn in tne Individual Plant Examination for Severe Accident Vulnerabilities," July 1990. 4. --, NUREG-1335, " Individual plant Examination: Submittal Guidance," Final Report, August 1989. 5. --, NUREG/CR-5474, " Assessment of Candidate Accident Management Strate-gies," Brookhaven National Laboratory, March 1990. 6. --, memorandum f rom S. J. Chilk, Secretary, to V. Stello, Executive Director for Operations, "SECY-89-017, Mark I Containment Performance Improvement Program," June 30, 1989. NUREG-1422 3-3

7. --, Generic Letter 88-20, Supplement 1, " Initiation of the Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.44(f)," August 1989. 8. --, Generic Letter 88-20, " Initiation of IPE for Severe Accident Vulnerabilities - 10 CFR 50.44(f)," November 1988. 9. --. NUREG/CR-5225, "An Overview of BWR Mark 1 Containment Venting Risk Implications," Addendum 1, Idaho National Engineering Laboratory, June 1989. 10. --, NUREG/CR-5528, "An Assessment of BWR Mark 11 Containment Challenges, Failure Modes, and Potential Improvements in Performance," Idaho National Engineering Laboratory, July 1990. 11. --, NUREG/CR-5589, " Assessment of Ice-Condenser Containment Performance Issues," Brookhaven National Laboratory, July 1990. e TASK 3.2A, "i ILTERED VENTING" Task Leader: Len ' offer, Severe Accident Issues Branch, Division of Safety Issue Resolution, Office of Nuclear Regulatory Research Issue: Siould U.S. containments be backfitted with filtered vents to mitigate the con-sequences of severe accidents as is being proposed and implemented in several European countries? The Chernobyl accident has heightened interest in this issue.

Purpose:

To develop information to be used in assessing filtered vents proposed for U.S. ~ reactors and to advise the Commission on whether such systems should be required for specific categories of U.S. reactors. m Scope: The scope of this task is to assess t.ke filtered venting technology emerging i from European rese.rch ano its applicati n to U.S. reactors. This work is part of the development. of acc. dent manageme<,i 5 ategies and containment performance assessment. Work

Description:

No separate projects or assessments stemming from the Chernobyl accident are envisaged. Idaho National Engineering Laboratory has studied enhanced venting for boiling-water reactor (BWR) Mark I containments (Ref. 1). In addition, the staff has written a eport on this subject (Ref. 2). Enhanced venting for BWR Mark II and 111 plants was also studied as part of the Containment Performance Inprovement (CPI) Program. Filtered venting for large dry pressurized water reactors and ice condensers was also examined. NUREG-1422 3-4

Findings: The Commission directed the staff to approve the installation of a hardened vent by any Mark I licensee who voluntarily chooses to do so (Ref. 3). All BWR Mark I plants have or will install hardened vents. 1 The BWR emergency procedure guidelines currently endcrse venting through the suppression pool as a means to reduce the possibility of initiating core damage. These venting arrangements provide for partial filtering by the suppression pool. l The Commission's directive was based on staff recommendations on the CPI Program, one of the main elements of the staff's coordinated effort to understand and resolve uncertainties in containment response to severe accidents (Ref. 4). No generic recommendations for enhanced venting for_other containments arose from the CPI Program. All plant-specific findings are being pursued as part of the Individual Plant Examination Program.

== Conclusions:== The_ Commission has addressed the issue of enhanced venting for containments, as discussed above. It approved a hcrdened filtered vent, via the suppression pool, for the BWR Mark I containments because of the expected reduction in core melt accident frequency. The benefit of hardened venting was shown to be less for the remaining containment types. External filters do not appear to be cost effective.

References:

1. U.S. Nuclear Regulatory Commission, NUREG/CR-4696, " Containment Venting Analysis for Peach Bottom Atomic Power Station," Idaho National Engi-neering Laboratory, December 1986. 2. --, memorandum from R. W. Houston, Division of Reactor Accident Analysis, Office'of Nuclear Regulatory Research, to Guy Arlotto et al., Division of Engineering, Office of Nuclear Regulatory Research, " Filtered Vent ' White Paper,'" December 8,1987. 3. --, memorandum from S. J. Chilk, Se.etary, to V. Stello, Executive Director for Operations, "SECY-89-017, Mark I Containment Performance Improvement Program," June 30, 1989. 4. --, SECY-88-147, " Integration Plan for Closure of Severe Accident Issues," May.25, 1988. NUREG-1422 3-5

CHAPTER 4 EMERGENCY PLANNING TASKS 4.3A, " INGESTION PATHWAY PROTECTIVE MEASURES"; 4.4A, " DECONTAMINATION"; and 4.48, " RELOCATION" t Task Leader: George Sege, Reactor and Plant Safety Issues Branch, Division of Safety Issue Resolution, Office of Nuclear Regulatory Research Issue: The phenomena of radioactive contamination pathways and the nature and effec-tiveness of protective measures after the Chernobyl accident constitute the common underlying issue of this group of tasks. The tasks are directed at deriving possible lessons for emergency planning to be used for U.S. reactors. In addition,:information to be gained on accident consequences may improve the information base for cost-risk tradeoffs where these are involved in regulatory analyses of potential safety requirements and for backfits in cases where the results may be significantly influenced by the economic consequences of acci-dents. The more specific issue areas for the three tasks involved are as follows: 4.3A, " Ingestion Pathway Protective Measures" After the Chernobyl accident, human and animal food chains in the Soviet Union ~ and other European countries were contaminated in varying degrees. The Soviet and other affected governmental authorities took measures - both short term and longer term - to protect the public from receiving unacceptably high levels of radiation through consumption of contaminated food. The findings on contamina-tion levels-and the experience with the Soviet and other European control _ mea-sures could provide important extensions of the data base with regard to the planning of-protective measures in the United States. 4.4A, " Decontamination" The practicality and effectiveness of measures to decontaminate structures, land, etc.,-after a major accident can be a significant factor in_the evaluation of accident consequences as_well as in the formulation of plans and approaches for post-accident decontamination. Evacuation and reoccupation of structures and areas as well as other social and economic consequences could be substantially affected. The extensive experience in the Soviet Union with decontamination after the Chernobyl accident could provide important extensions of the data base. NUREG-1422 4-1

l 1 4.4B, " Relocation" + Notwithstanding cultural and socioeconomic differences, the Soviet experi-ence with the post-accident evacuation and relocation of the population of contaminated towns and villages near the Chernobyl reactor may well offer 1 valuable lessons for U.S. emergency planning.

Purpose:

To participate, with the Federal Emergency Management Agency (FEMA) and other Federal and appropriate international agencies, in the planning and eventual execution of efforts to obtain available information on the Soviet (ard, where applicable, other European) experience with post-Chernobyl contamination control measures, includino the ingestion pathway (Task 4.3A), decontamination (Task 4.4A), and relocation of people (Task 4.4B). Scope: The scope of the initial efforts to date has been to establish plans, contacts, and arrangements for the exchange of information and to begin execution of the plans. The work is expected to be coordinated primarily under FEMA and will also involve other Federal agencies, such as the Food and Drug Administration and the U.S. Environmental Protection Agency, and international agencies, such as the International-Atomic Energy Agency (IAEA). NRC's initial and continuing participation in this work is intended to ensure that NRC's area of interest (i.e., regulation) is adequately. represented in the effort and to obtain infor-mation for NRC's regulatory purposes. The work is expected to continue for a number of years and will encompass lessons learned from the long-term as well as the nearer-term experience. Work

Description:

The principal continuing international arrangement for implementation of these tasks has been the U.S.-USSR (non U.S.-CIS) Joint Coordinating Committee on Civilian Nuclear Reactor Safety (JCCCNRS), in which the NRC has been the prin-cipal U.S. participant. An initial 2 year set of activities for the JCCCNRS has - through its Working Group 7 - included those pertaining to the environ-mental and health effects of the accident at Chernobyl. Two noteworthy meetings under tha auspices of. Working Group 7 were the meeting of Subgroup 7.1, "Envi-ronmental Transport of Radiation," in Moscow in September 1989, and that of Subgroup 7.2, " Health Effects," in Kiev in October 1989. (Ref. 1) The envi-ronmental transport work associated with several subsequent working group meet-ings, most recently in Germantown, Maryland, on March 5, 1992, included contri-butions on atmospheric dispersion modeling, wind-driven resuspension of toxic aerosols, transfer of radionuclides through tnrc strial food chains and the resulting dose to man, ~ 1ong-term dose from comamination of aquatic food chains, and modeling the behavior of-radionuclides in a soil-aquatic system including rivers and reservoirs (Ref. 2). 'The work specifically included study of the January-March 1991 Pripyat River flood event. An NRC staff member attended the First International Workshop on Severe Acci-dents and Their Consequences, organized jointly by the American Nuclear Society and the Soviet Nuclear Society, which was held in Sochi, USSR, on October 30-November 3, 1989, and which was devoted entirely to Chernobyl. (Refs. 3 and 4) NUREG-1422 4-2 _ _-- _ ___ _ _.. _ _ _. _. _ _ _.. _. _ _ _ _. - _. ~., _. _ _, _, _ _. _ _ _

Informal contacts included those with FEMA, the U.S. Department of Energy, the U.S. Departmert of Defense, and IAEA. rinoings: work to date has focused on the establishment of lans and arrangements. available information (see, especially, Reference.1, 3, and 4) at this p

a is fragmentary.

It suggests that contamination control actions after a 4 .or accident are sabject te difficulties that may not be clearly anticipated nd that the actions may need to be massive, may be farflu, lographically, md may extend over a number of years. Specific illustrath.., of this liminary general observation include the following: In late 1989, more than 3 years af ter the accident at Chernobyl, the Soviet authorities found it necessary to make the decision to evacuate substantial additional areas in the Ukraine and Byelorussia and a small area in Russia. This newly planned - and partly carried out - evacuation is expected to involve the relocation of a greater number of people than the 135,000 originally relocated f rom around Chernobyl. Shortly after the accident at Chernobyl, a pine forest near the plant was uprooted and protectively buried in the evacuated zone, along with the top meter of soil. These majos protective measures are expected to provide eff

• ve c ntrol for a number of years, but are not considered by the Sov M r..arities to constitute a permanent disposai solution.

Plans for further oction are being cc-ridered. Envi.eental transport of radioactive materials can recontaminate cleaned-f up surfaces, sq1gesting tnat waiting for contamination to stabilize can enhance the effectiveness of decontamination efforts The decision in late 1988 tc abandon plans for re-occupancy of the town of Pripyat (the closest town to the Chernrbyl Nuclear Power Station) was made aftet the results of massive decontam u tion efforts th*ough 1987 were less than hoped for.

== Conclusions:== The information available to date on contamination control after the Chernobyl accident suggests t1at rystematic analysis of the information at hand together with (possibly extmisive) further information expected to develop and become available in the F ited States over the years should provide highly valuable input to the bases.or emergency planning in ti'c United States as well as to the basis for estimating the socioeconomic consequences of accidents for risk analysis and cost-risk tradeoff purposes. s. The internet ianal arrangements in place provide ef fective and promising mechanisms for the information exchange sought. Remarks: The NRC staff olans to continue work in cooperation wi' FEMA and other agencies, extending over s number of years, to obtain and organize emerging information on the post-Chernobyl ingestion pathway, decontamination, and relocation experience, f NUREG-1422 4-3 l

-and to evaluate that information for its isearing on emergency preparedness and on risk analysis and cost-risk tradeoffs in connection with U.S. reactors. t Already available infora tion concerning Chernobyl ace.ident costs is being used, within bounds of a limited analysis, in an NRC-sponsored study by the Brookhaven National 1.aboratory addressing cost-benefit censiderations in backfit analysis. The NRC staff is evaluating the Polish and Soviet experience with potassium iodide as a thyroid blocking agent for ingested or inhaled radiciodine. In mid-1991 an international advisory committee sponsored by IAEA complete $ The Irternational Chernobyl Project: Assessment of Radiological Consequences and Evaluation of Protective Measures. The project results add valuable background % formation related to the issues addressed here. keferences: 1. U.S. Nuclear Regulatory Commission, SECY-89-351, " Update on U.S.-USSR Civilian Nuclear Reactor Safety Cooperation," memorandum from J. Taylor to the Commissioners, November 24, 1989. 2. Working Group 7.1 on Environmental Transport, U.S.-USSR (non U.S.-C.IS) Joint Coordinating Committee on Civilian Nuclear Reactor _ Safety, " Progress Report,"-January 15, 1992. (U.S. Department of Energy and U.S.. Nuclear Regulatory Commission) 3. "First International Workshop - Severe Accidents and Their Consequences," (Preliminary (unotficial) Proceedings of the First International Workshop on Severe Accidents and Their Consequences, Sochi, USSR, October 30-November 3, 1989, produced through the U.S. Department of-Energy, 1990) 4. U.S. Nuclear Regulatory Commission, " Trip Report - ANS-SNS International Workshop on Chernobyl and its Consequences," memorandum from G. Sege to J. Taylor et al., November 22, 1989. NUREG-1422 4-4 l

CHAPTER 5 SEVERE.1CCIDENT PHEN 0r"A TASK 5.1A, " MECHANICAL DISPERSAL IN FISSION-PRODUCT RELEASE Task Leader: C. G. Tinkler, Accident Evaluation Branen, Division of Systems Research, Office of Nuclear Regulatory Research Issue: The initial release of fission products that occurred at Chernobyl was the result of mechanical dispersion. Such a mechanism is possible in a light-water-reactor (LWR) containment during energetic events such as high pressure melt ejection, steam explosions, and hydrogen combustion, Although such events are being studied with regard to their likelihood of occurrence and their con-sequences, associated mechanical releases of fission products have not been quantified in current source term models, and the study of such releases has only just begun to receive attention. Because some of these phenomena appear to have played a dominant role in the releases at Chernobyl, it is important to understand them more completely.

Purpose:

To introduce the b ssons learned from the Chernobyl accident into ongoing work and to improve the understanding of mechanical dispersal phenomena associated with direct containment heating and hydrogen combustion. Scope: The ongoing work is described below. The scope of this task is coordinated to ensure that what can be learned from Chernobyl is reflected where partinent. Current research on mechanical dispersion includes work in the areas of direct containment heating (or high pressure melt ejection) and hydrogen combustion. For direct containment heating, the scope of current research (Refs. 1 and 2) is to develop a capability to analyze the likelihood and consequences of this phenor.enon. This can be accomplished by generating an experimental data base resu'. ting from appropriate scaling considerations that can then be used to support the development of phenomenological models for containment analyses. -Stoping studies (intermediate-scale experiments) (Ref. 3) were conducted to investigate the resuspension of aer,sols - radioactive or otherwise - that had been deposited on containment surfaces by mechanical or tN'rmal processes during hydrogen combustion, and the volatilization and expulsion of airborne aerosols in the containment by similar pre asses. Work

Description:

Tne NRC has established a direct containcent heating (DCH) rcsearch program to develop an experimental data base and supporting phenomenological models for NUREG-1422 5-1

assessing the effects of high pressure melt ejection on containment loading and on aerosel generation. This program has both experime".al and analytical aspects. The program provides quantitative result. of ["H that include the effects of reactor coolant system pressure, melt temperature, reactor cavity geometry, structures, and water. When appropriate, analytical models of phenom-ena that have the potential to impact DCH loading are developed and assessed. Consideration is given to the development of correlations and scaling laws that will enable extrapolation of DCH test results to reactor scale and accident con-ditions. This is a multilaboratory effort, and work is being perforr.ed at Sandia National Laboratories (SNL), Argonne National Laboratory (ANL), and Purdue University. The experimental tasks are performed at several laboratories but represent an integrated approach to solving the OCH 1ssue by providing prototypical results through the use of plant-specific features and accident conditions performed at two physical scales. The objectives of the experimental tasks are (1) identifi-cation of mechanisms of debris dispersal that need to be modeled to predict DCH, (2) assessment o.' the effects of physical scale on debris dispersal, and (3) mea-surement of the pressure increase in the 1:10 linear scale Surtsey (Sandia National Laboratories) and the 1:40 linear scale corium-water thermal interac-tion (CWTI) melt-dispersal experiments (Argonne National Laboratory). Measure-ments will be taken in each test for both the 1:10 and 1:40 linear scales. This experimental approach should provide an adequate technical basis for the assessment of (1) the hydrogen generation model, (2) the mitigative effect of lower compartment structures, and (3) the effect of water in the containment atmospi ere. Sort estimates (Refs. 4 and 5) of containment loading following high preasure melt ejection suggest that these pressures could be significant. The expert opinion solicitation results for NUREG-1150 (Ref. 6) indicated that best-estimate pressure calculations for DCH would not fail the containment, but that there was a large range of uncertainty. The system pressure at which DCH would no longer pose a threat to the containment has been termed " low pressure cutoff." Experi-ments (Refs. 7 and 8) have been conducted and analyzed at both SNL (1:10 Zion and Surry cavities) and BNL (1:42 Surry, Zion, and Watts Bar) to determine if a low pressure cutoff exists. The data will be used to identify (1) the mechanisms of debris dispersal, (2) the effect of cavity geometry, (3) the effect of physi-cal sca'e, (4) the effect of the vessel failure mode, and (5) the effect of incavity structures. Correlations and models will be developed and assessed. In the area of hydrogen combustion, experiments and modeling effort have been devoted to developing an improved data base for the like'ihood and consequences of diffusion flames, deflagrations, acceleration flames, and deflagration-to-detonation transition and detonation combustion modes. Experiments have been performed in small, intermediate, and large-scale facilities under nearly prototypical conditions (i.e., mixture composition, obstacle geometries) to address the late phase of an accident (premixed conditions). Fir. dings and

Conclusions:

Four large-scale DCH experiments have been cont'icted in the Surtsey 1:10 linear scale facility to study the energy exchange processes and the generation of aero-sols. These experiments show that these processes are greatly affected by the trapping of the debris on the surface of the test chamber. These experiments NUREG-1422 5-2

were not performed under prototypical conditions (i.e., initial and boundary conditions) and cannot be used directly to assess the potential for DCH at reac-tor scale and accident conditions. Comparison of these-four tests showed that the atmosphere heating does not scale directly with the mass of the debris being expelled into the atmosphere. !ow pressure experiments suggest that a low-pressure cutoff exists that prevents complete dispersal and that the value of this threshold pressure is above the accumulator set point. However, the ability-to achieve a low pressure cutoff pressure 'or which DCH loading is nonthreatening has not yet been demonstrated. Hydrogen combustion experiments to investigate resuspension and volatilization suggest~that all combustion modes enhance these processes. These studies were i l perfcrmed for the NRC in support of the LACE International Program (Large-Scale Aerosol Containment Experiment managed by the Electric Power Research Institute) (Ref. 3). Experiments to investigate the behavior of hydrogen-air and hydrogen-air-steam mixtures for temperatures up to 100 C are now complete, and the MECTR (lumped parameter) code has been developed, assessed, and applied to LWR containment analyses (Refs. 9-12). Remarks: The NRC-sponsored Technical Program Group has completed the development of a general severe-accident scaling methodology (SASM). A high pressure melt ejec-tion.(HPME) accident scenario was used as the first application of this method-ology. The SASM framework has been applied to develop the inta.1ral effects test scaling analysis tc assist in the development of integral experimental testing at-the SNL 1:10 linear scale Surtsey facility and counterpart testing at the 1:40 linear scale facility at ANL. The integral effects tests include both the Surry and Zion cavity models, The goal is to be able to use the results_of scaled integral experiments-to validate a system-level computer code such as -the CONTAIN code. The validated CONTAIN code in turn could be used to predict-containment load due to DCH in a nuclear power plant. L The integral experimental tests currently planned for SNL and ANL are consid-erably different from the tests proposed before the SASM was developed. Speci-fically, these tests are' improved for these reasons: (1) the initial and bound-ary conditions for the tests are scaled fcr specific accident scenarios for specific plants; (2) important scaling groups have been matched, or the distor-tions have been minimized for those tests in which matches cannot be achieved; (3) technology has been &veloped and scoping tet.:s have been conducted, and instrumentation and procedures required to carry out HPME/DCH experiments are reliable and reproducible; and (4) test conditions include more prototypic con-ditions (i.e., steam-driven melts, more realistic co. tainment compartmentaliza- -tion, sources of water, potential for hydrogen combus '. ion, etc.). These inte-Oral effects tests are needed to' evaluate the effect3 of water, chemical reac-tion, debris / gas heat transfer, and their related synergetic effects on DCH. A program to conduct high-temperature high-steam hydrogen combustion experiments to address flama acceleration and deflagration-to-detonation transition and detonatior.s has oeen initiated at Brookhaven National Laboratory. KUREG-1422 5-3

References:

1. W. W. Tarbell, J. E. Brockman, K. E. Washington, and M. Pilch, " Direct Containment Heating and Aerosol Generation During High Pressure Melt Ejec-tion - Experiments," American Nuclear Society (ANS) Therralhydraulics Division Proceedings of the ANS/ European Nuclear Society (ENS) Interna-tional Meeting, Uctober 31-November 4, 1988, Washington, D.C. 2. K. D. Marx, "A Computer Model for the Transport and Chemical Reaction of Debris in Direct Containment Heating Experiments," ANS Thermalhydraulics Division Proceedings of the ANS/ ENS International Meeting, October 31-November 4, 1988, Washington, D.C. 3. L. S. Nelson, "The Effects of Hydrogen Combustion on Cesium Iodide Aerosols," LWR Aerosol Containment Experiments, LACE-TR-055-1990, Electric Power Research Institute, Palo Alto, California. 4. D. C. Williams and D. L. Y. Louie, "CONTAIN Analyses of Direct Containment Heating Events in the Surry Plant," ANS Therma 1 hydraulics Division Proceed-ings of the ANS/ ENS International Meeting, October 31-November 4, 1988, Washington, D.C. 5. K. K. Murata and D. L. Y. Louie, " Parametric CONTAIN Calculations of the Containment Response of the Grand Gulf Plant to Reactor Pressure Vessel Failure at High Pressure," Proceedings of the Fourth Workshop on Contain-ment Integrity, June 14-17, 1988, Washington, D.C. 6. U.S. Nuclear Regulatory Commission, NUREG-1150, " Severe Accident Risks: An Assessment for Five U.S. Nuclear Plants," second draft for peer review, June 1989; Final Report, December 1990. 7. R. T. Nichols and W. W. Tarbell, " Low-Pressure Debris Dispersal From Scaled Reactor Cavities," ANS Thermalhydraulics Division Proceedings of the ANS/ ENS International Meeting, October 31-November 4,1988, Washington, D.C. 8. N. K. Tutu and T. Ginsberg, " Low-Pressure Debris Dispersal Experiments," Proceedings of the ANS/ ENS International Meeting, October 31-November 4, 1988, Washington, D.C. 9. U.S. Nuclear Regulatory Commission, NUREG/CR-4507, "HECTR Version 1.5 User's Manual," Sandia National Laboratories, April 1986. 10. --, NUREG/CR-4803, "The Possibility of Local Detonations During Degraded-Co.*e Accidents in the Bellefonte Nuclear Power Plant," Sandia National Laboratories, January 1987. 11. --, NUREG/CR-3912, " MARCH-HECTR Analysis of Selected Acsidents in an Ice-Condenser Containment," Sandia National Laboratories, December 1984. 12. --, NUREG/CR-2530, " Review of the Grand Gulf Hydrogen Igniter System," Sandia National Laboratories, March 1983. I NUREG-1422 5-4

. TASK 5.2A, STRIPPING IN FISSION-PRODUCT RELEASE" Task Leaders: T. J. Walker and R. Lee, Accident Evaluation Branch, Division of Systems Research,-Office of Nuclear Regulatory Research Issue: The late enhanced release of fission products during the Chernobyl accident may be attributable to the chemical and/or thermal stripping of urania (U0 ) 2 fuel. Such mechanisms have been observed in in pile and out-of-oile experiments fuel rods were exposed to steam or high temperatures (and other severe when U02 degraded core conditions). During the process of thermal stripping, for example, 2 vaporized. fission products were released in proportion to the amount of UO The rate of fission-product release is thus controlled by UO2 vaporization. Fission product release by chemical and thermal stripping mechanisms is not modeled 0; current severe-accident source term codes. The Chernobyl accident hac demonstrated that such mechanisms can be important in fission product release under-some conditions.

Purpose:

To introduce Chernobyl lessons into the continuing research on chemical and . thermal stripping and to ensure that sufficient data for model development and assessment are developed. Scope: stripping is to complete ongoing experiments The scope of present research on U02 investigating thermal stripping mechanisms, to collect and review experimental data on chemical stripping mechanisms, and to apply both the thermal stripping and chemical stripping data to improve _present fission product-release codes. Work-Description: The two competitive mechanisms for the release of the semivolatile fission products and actinides are solid-state diffusion to the surface with subsequent

volatilization and, at higher temperatures, stripping of the surface by volatil-ization of the urania-matrix or substrate.

Most fission product-release data have been determined by af ter-the-f act analysis of in pile tests or from studies with simulants. In this NRC-sponsored work at Battelle (Columbus, Ohio), high-pressure, high-temperature mass spectrometry was used to obtain releases of pre-cise species under conditions of temperature, pressure, gas composition, and flow rates commensurate with_ nuclear accidents. The equipment description and tables of fission product species are provided in Reference L In brief, a modulated molecular beam was coupled with a mass spectrometer that was designed to-operate to a temperature of 2400K and to a pressure of 30 bar. Fuel pellets that had' operated to 40,000 megawatt-days / ton were included in the test program. Findings: Analytical reviews of related literature by Battelle and recent NRC-sponsored experimental research have shuwn conclusively that solid-state transport and subsequent vaporization of fission products from urania (U0 ) surfaces are_less 2 NUREG-1422 5-5

important in fission product and actinide transport than urania substrate vola-tilization. Although solid-state transport (diffusion) of some fission products is important at lower temperatures, the crossover to urania substrate volatiliza-tion as the important mechanism occurs in the range of 1800K to 2000K in steam. Temperatures of 2000K to 2300K were used in a recent experimental program. These temperatures and higner would be reached in severe accidcnh involving core degradation. Thus, release models that are based on urania solatilization are appropriate for future incorporation into severe-accident codes. Report of this work by C. A. Alexander and J. 5. Ogden of Battelle is available as a peer-reviewed report in a scientific journal (Ref. 2). The U.S. needs for high-temperature thermal stripping in severe-accident analyses are in-vessel and without air; thus the program has not been expanded into the air oxidation regime as suggested previously as a possibility. There is a small probability that certain large-break loss-of-coolant accidents could result in air being present in the core region during heatup and thermal strip-ping. However, for the present, this potential minor change in the source term is not being investigated. The effect of air is to lower the temperature for a vaporization rate compared to that in steam; the rate of vaporization in steam at 2500K is approxi.7.ated in air at about 1.800K. The probable effect on the vaporization rate with a numerical estimate for a Chernobyl-type accident is discussed in Reference 3.

== Conclusions:== Research has shown that direct vaporization of fission products and actinides from the irradiated fuel substrate is more important than solid-state transport and subsequent vaporization of the fission products from the surface at temper-atures above the range of 1800K to 2000K in a steam atmosphere. The experi-mental program will provide data needed for severe-accident codes to model the release of these semivolatile materials. The rare accident sequences that result in potential air oxidation would cause substrate vaporization at lower temperatures and could be evaluated on an equivalent lower temperature basis. The Chernnbyl accident has highlighted the importance of the ongoing work on 00 substrate v6porization, or stripping, and the resulting fission product 2 release. The atmosphere associated with the Chernobyl release was believed to be low in oxygen in the vicinity of pellet stripping and would be expected to result in release-temperature pressure relations close to those of the experi-mental results. Remarks: The fission product-release program satisfies current NRC needs for most severe-accident cases. However, the inclusion of air is being considered for shutdown accident studies. An algorithm, which allows fuel to volatilize based on a relation for volatili-zation (Ref. 2), has been added (1991) to the VICTORIA code. Previously, VIC-TORIA did not calculate movement of fuel. In addition, a relation for surface oxidation and subsequer.t vaporization as UO3 gas when vaporized in air and to UO (OH) gas when air and steam are both present nas been added. 2 NUREG-1422 5-6

3 and rug -have also been added to the Oxidized species typified by gaseous Ru0 4 chemistry base so that the matrix stripping phenomena can be adequately modeled in-VICTORIA for any chosen atmospheric condition and volumetric flow rate.

References:

1. C. A. Alexander and J. S. Ogden, "Real Time Mass Spectrometric Evaluation of Fission Product Transport at Temperature and Pressure," Proceedings of the Meeting of the American Chemical Society, Nuclear Chemistry Division, i Anaheim, California, September 1986. at High Temperatures and High Pressures. A 2. --, " Vaporization of UO2 Generic Relation for ',olatilization," High Temperatures - High Pressures, Vol. 22, pp. 149-156, 1990. 3. C. A. Alexander et al., " Matrix Stripping of Fission Products Released at High Temperature," Severe Accidents in Nuclear Power Plants, Vol. 2, IAEA SM 296/99, pp. 179-184 (Sorrento Proceedings, Vienna, 1988). NUREG-1422 5-7

t iPO** f NVW54 M #4as sa*a er FIDC ede vsw A'8. d eat 1 8sRC 8O*M 335 u s,suCLE A4 R50VL ATOR v Couv'stiON (2 941 %"' 2% BIBLIOGRAPHIC DATA SHEET l NUREG-1422 SLI INETRUCTIONS ON T ML Rivt h$t J Le a v q gL ANa, 2 Tif Lt AN0 5veisitt Summary of Chernobyl Followup Research Activities ) ,aAa caNf-May 1992 e Avmoni5i 6 D A T E R EPOSE T iS5UE D WONTM ] vtAR June I 1992 5 PROJL C T JT A5A Yv0Hs. UN,7 Nvus t M 7 PtRIORMING QNSANIZ AllOh N AME AND WAILING ALDHL$5 Hnt welp /d fessel Division of Safety 1ssue Resolution s m Oa c.a*N r Nuvat a Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, D.C. 20555 ?O SPONWRING ORGANil AT10N N Avt AND M*4 SNG ADDME55 Harsi de to Cassee Sie T vet or titron f Technical . et moo cov ia e o o=~.. d. 1 13 SmPPLt MtNT ARV NQf t$ 13 AS ST R ACT 1J00 needs ea 4 m In NUP.EG-1251, " Implications of the Accident at Chernobyl for Safety Regulation of Commercial Nuclear Power Plants in the United States," April 1989, the staff of the U.S. Nuclear Regulatory Commission (NRC) concluded that no immediate changes in NRC's regulations regarding design or operation of U.S. commercial reactors were needed; however, it recommended that certain issues be considered further. NRC's Chernobyl followup research program consisted of the research tasks undertaken in response to the recommendations in NUREG-1251. It included 23 tasks that addressed potential lessons to be learned from the Chernoby) accident. This report presents summaries of NRC's Chernobyl followup research tasks. For each task, the Chernobyl-related issues are indicated, the work is described, and the staff's findings and conclusions are presented. More detailed reports concerning the work are referenced where applicable. This report closes out NRC's Chernobyl followup research program as such, but additional research will be conducted on some issues as needed. The report includes remerks concerning significant further activity with respect to the issues addressed.

i. oocuu NT AN Ac vs.3... A e swSC;uesca:,f oes a AvAsA.cf.

Chernobyl accident, severe accident, Chernobyl implications, Chernobyl followup, operational controls, procedure violations, testing requirements, Unlimited low-power risks, shutdown risks, reactivity accidents, contamination con- ' ' c '"'" C ' ^ $" 'c ^ ' 'o* trol, fission product release <r.> Unclassified . ietNei,,easco tN eNuo naus e rm. -u Unclassified i f NUM8tR OS P AGES til 980Cf

Das a _..:s THIS DOCUMENT WAS PRINTED USING RECYCLED PAPER l'

s. NUREG-1422

SUMMARY

OF CHERF7BYL FOLLOWUP RESEARCH ACTIVITIES JUNE 1992 e UNITED STATES spec.At rovars-etass nArt rosrAct Ano rtes FAo NUCLEAR REGULATORY COMMISSION usunc WASHINGTON, D.C. 20555-0001 PERMIT NO G-67 OFFICIAL. BUSINESS PENALTY FOR PiilVATE ttSE,- $300 , ; r:1 c O 15 A l" I l , e n 5 c,513 0 5 51 r N";$j#3,ru9L1CSIIC 2 m rn_ m -su -g ) U' p.711 y &[4146Y O. l

l41I ll y b x. G e. = 1 s' 9 T 9 AD 1 n A sF 7 E s s 4 N r uG b-arc J O moRnNN nA S T u U ot S ? r a R a' E t t P ais ce c, r s c ..S. - .E.

H.

.T .v . u ~. 5 I . c: 5 p A 9 s

H M

s-1 .C~ A .R Y A. 1 .E. C S ev .S N D ..E. t G R I .P. ns T . U ;. a i W ;:. C I . O... L g L.

L.

B ~ O.- u6 ,F eE c ,' M 3,"U 3 , L :- N ~Y 5 B. O ~_ G. 9 f

• J T

3 G >N: 1-n

R..

5C vE. SR p1i 1H H. SN I,2S . Cw n7h p. P. n . W . F. 19 .O . Y c. . R :.

A;

,M.. .Mu U. . S. N .O I 1 .S0 .S0 0 I 0 0 w$ .M, 3 5 .M 5 E SO5 S S . EC0 . S U E . T 2 , A Y INE T R S A ~. TS O C. . U V BI TD R . DA P L TU _A ELN I R CI O O FF I .N G T - FO Y . 2 ~. . UE G T l R N L 2,. RI AN 4; A H. . E 1 E S. P .G LA. .E. CW, R. U _.Uw N" .N.: wf3'r ltl - - jbl\\!! l !l(ltIiIi {! =}}