Text

Forwards Summary of ACRS Review Questions & Comments on Facility Probabilistic Safety Study as Result of 820325 & 26 Meetings.Listed Repts Encl
	ML20127E184
Person / Time
Site:	Zion File:ZionSolutions icon.png
Issue date:	04/13/1982
From:	Griesmeyer J; Advisory Committee on Reactor Safeguards
To:	Thadani A, Thandani A; NRC
Shared Package
ML20127E176	List: ML20127E173; ML20127E184; ML20127E252; ML20127E267;
References
	FOIA-85-44 ACRS-GENERAL, NUDOCS 8506240470
	Download: ML20127E184 (18)
	v • d • e

EHCLOSURE 1

(

!{p asc%g UNITED STATES NUCLEAR REGULATORY COMMISSION

~

o

.,E ADVISORY COMMITTEE ON REACTOR SAFEGUARDS

4 e

WASHINGTON, D. C. 20555

- - n*

.. :gg.-

- ~-

April 13,1982

.,n y

'(.

T N.:[

,. 9 3

_)

ME'M'RANDUM FOR:

A. Thadani n/

~~

O

[e_. M C FROM:

J. M. Griesmeyer

SUBJECT:

ACRS CONSULTANT'S REYIEW 0F THE ZION PSS-In accordance with the discussion between the ACRS Subcomittee on Reliability and Probabilistic Assessment and you and your staff on March 25 and 26,1982,

~

Vtw 1"have-developed a summary of the comments and questions generated by the

'.-33F;;1 ACRS, Consultants and those that arose.during the Subcomittee meeting on the A;

25;itnd 26 of March'. They are grouped topically and keyed to the pages or sectio ~ s of the particular repo'rts.in which they are-mentioned.. A copy:of the n

-m n M

report is.also. enclosed.

y

. m *4...

[N.(:~

YEe'Subcomittee has not had time to prioritize the coments and questions 7ty. _

or to screen them to any great extent. 'They are being set at this time so;

~

nt-that you might case them in your reviews of the Zion / Indian Point Safety Q' J3 2. Studies. 'In a week or so, Subcomittee members, D. Okrent and W. Kerr wil

~

u Tff have hid7a?ch'ance to 's'creen the' s0mma'ry and indicate the' comments and"q'ues ~.

.@. hk.1.1censee, pich it would be helpful. to' receive responses from NR tions for

,. f{.,.,, #

pugg:.

.%., w..

% w,;% _

.s.

49%!'4 G.u,Q, _

ii-c -

.g.,

.e n

,e

..g;",' '

1i.. Summary qf ACRS Review Questions '.

Englosures:

. m._

Ltf :.,

E':94-and Coments on the ZPSS

c...-

k

2. aReport by D. Aldrich,1/29/82 3.

Report by ANL, 2/17/82

4.. Re' port by P. R. Davis,1/19/82

',yg;;;

5

Report by J. W. Hickman, 2/15/82 pNffiDo

6. -Report by W. C. Lipinski, 3/24/82 Miy' '7.L

'7.~

Report by P. W. Pomeroy, 2/2/82-J

8. ' Report by D. A. Powers, 2/1/82 9.

Report by G. L. Schott,1/28/82

.u

10. Report by M. D. Trifunac, 2/23/82

.c..

11. --Report by Z. Zudans, 2/22/82 cc: ACRS Members W. L. Baldewicz S. Hanauer M. Ernst J. Meyer S. Newberry 1

8506240470 850304 PDR FOIA PEDROBS-44 PDR g

e

. 9f. s. ~,

I

Sumary of ACRS Review Questions and Comments on the Zion Probabilistic Safety Study (PSS) u.-.

Q.h..l.%f..**"

g

.yQp

.L I..

General Comments It wo~uld be useful for the licensee to indicate the strong point of his study and the weak points (i.e., those points that are least subject to a rigorous defense.)

II. Methodology and Execution of the Zion PSS 11.1. ' Comments on Propagation of Uncertainties n....

D :*

+

0

.(1). The implication in Section 0.13 that a systematic methodology for C

' gen'e' rating uncertainities was used throughout the study is somewhat G.1.,, ;. 3.agis14Ading.

It suggests a possible. disconnect.between the methodology Mc

. authors of Section 0 and the ' engineers who actually arrived at the E^

probability distributions assignsd to the various branch points of

^

i; heiaccident sequence..This seems.especially true..in the case of the 4'

~

.A My

g. con'tainment matrix & (ANL, Sec. 2.1).; ?_

h" '...

. ~.

.:.pn.

m.~:= ?:.:

ci.2: W '

. ??Mp -

a

. -...~.... -, ~...

.., n :[n.......,

..n.-.,..,

,7 (2)"Usingthe~ point' estimate' of' risk'y / A'ar-4. *1,-hh

lease ~c.ategories'for."""'

.W. '... !.

.?

.,... g Ap,

, d J.,. 5",. g E.,.p - ?

7 %-; Y '.

. g%

.j to rank'th.e;n T

' " +

h..w.

. wttich un~ certainty calculations '.would'actually be"perfomed suggests-5T*M 'tVo~(vest

'['N7;.ff."e/g'.7uncertaintyinrisk,.' lead.tothesameranking..? it%same' for all risk mea With 'this.latter E.T';!1 measure, the release category tharcontributed most to the uncertainty' BrM, yy Xi.sk would be. ranked number one',agd so.forth. - Although,"the answers

" ~

s 4%, _.to.th~es~e questions may well suppod ~.and vindicate the calculations actually perfomed in the study; we did not find any-indication that these questions were addressed.

(ANL,2.1) a 2.~.-i..

~

M3.)[Reviewofthephenomenology'a'AsociatEd'withthicontainmentmatrix

' g'vl":gy: erit; trees has led to some question.as to whether 'the probabilities '

a'ssigned to the branch points were in some cases optimistic with respect

~-

/w to both value and uncertainty range.

If probabilities and attendant

^

uncertainties atsigned to these branch points have been optimistic, short hy.

' cuts used in.assassing the uncertainty bands may be invalid.

In many cases

9-with respect to the containment matrix, it appears that the treatment was such that no uncertainty value was assigned. Specifically, uncertainties in branch points having 1-E or E, probabilities were ignored -.obviously this is only justified if the confidence that is implied by assigning these probabilities is justified.

(ANL,2.1)

G m:

9' d

',a

, s.-

...QL.

-[

. 4/6/82

~

Review Questions and Comments

.v.

11. 2 Comments on Data Analysis k~

(1) To widen the published. uncertainty bands associated with equipment failure

~

rates, the lognormal distribution is fitted to " data" by matching the 20th and Ref'rence 0-17 of 80th percentiles.to the ends of'the published data range.

e D / -

the Zion PSS is quoted as stating that 20-50% of "true values" fall outside judgementally obtained 98% confidence bounds.

If we simply a'ssume the wrong, then the 25th and 75th, mate, that 50% of opinions on failure rates

..?'

pessimistic side of this esti percentiles should be used., In any case, more justification for matching djstributip.ns should be provided.

(ANL, C 2.2)

(2) The WASH 1400 bounds are not consistently used as the 20th and 80th percentiles. Easterling has written a few words on the treatment of the V

. seguence, a dominant sequence.in.the Zion and many other studies, and has g>,:, y/. shown that the sequence mean changes about four orders of magnitu m

54'_

ing on whether the. WASH-1400 parameter bounds are used as 5th and 95th per-7C centiles, or as 20th and 80th percentiles, a. choice that seems to be highly

~

,Ci?

'subjei:tive if not somewhat arbitrary.' If th'Is choice is arbitrary and 'if se the Easterling calculations do reflect what was done in the Zion study (it

~

NT.

R not always easy to tell),,then 'one must conclude that the methodology L,.Tal '

allows one to get any answers one wishes within the four orders of magnitude.

..%,.,.. ^. 7=.{.f55., '

-..f4,. =.

'(JH, p.6) '

i@y hiD5b&D'lN-m.:.. w& %E. c.

l%.s^..~.C Z. & Lb5; & Q idi 4 :6.lc;&;

c,.

n.

~ ~ " '

1ONEW IL3.1 Consents on Human ErroF27e, EW v

.- i ~ -

~

.. :. s., 2 Q@WN %. M-%..=.7 f1)Mhere appears to be a somewhat arbitrary decision to

..z.+

t

-e e-M.1 percentiles in matching the lognormal distribution to human error rates.

h The' 20/80 percentiles were chosen to represent equipment failure rates.

Fi[Ei,".

0ur ignorance of human error rates exceeds our ignorance of equipment 7

EscM failure rates) Therefore, assuming the 20/80 choice to be correct for

$EF9 equipment failure, the choice of the 10/90 percentile band for human error rates appears to be optimistic and counter to our present state of under-standing. The matched ~ distribution should be broader than the analogous equipment distribution, i.e., it should be matched using, say, a 30/70

~G >

choicei Obviously, whaterever choice is made should be defended with j

.:/_.;

s[tronger; arguments than are now provided.

(ANL,C;2.3)'

k'".

(2) The treatment of dependence appeared to be optimistic in predicting a

collaborative operator fa.ilure rates. We recommend human error experts be consulted.

(ANL,2.3) mv m '.

(3) High stress situations are stated as being haridled on a case-by-case l

basis.

Several obvious questions should be answered: (1) What is the general basis for handling individual cases?

(2) What is the impact of l

high stress situations on the results of this study?

(3) Where and for what events is high stress behavior most critical?

(4) How do high stress l

operator failure rates used in this study compare to low stress failure i

rates?

(ANL, C 2.3)

,f ?

i A mc

--,-_.._m

Review Questions and' Comments

- 3.-

4/6/82 l

_. F.1.nally, the report states on p.1.3.3 "While errors of commission to (4) correct indicatibn's-(as at'TMI-2) are, f

k' misunderstanding of correct or mostly'at the above app'riach' on huisan error

~ not explicitly modeled, it is felt. th accounts for such events." Upon what'is this feeling based? (WCL, p.5)

-n t.

- II.4 Comments on System Modeling and Simplification Procedures' (1) As with other studies, the Zion stu@ team turned to event trees and fault trees for cataloguing ac,cident se,quences.

However, their use of event trees is somewhat different. They have chosen to carry several support system faults' (e.g., AC bus failures) in the event tree.

Such an V

approach limits the number of support system failure states that can be explicitly modeled.'p.and which ones are modeled is decided by the analyst l

~4[7 ba.ied usually on a_ robabilistic irgument.

Su'h simplifications result c

- 1in models that have limited utility for future studies. (JH, p.5) c. qjy&

.;p

-.c.;.p -

! " W (2) The fault trees'also were. treated in an abbreviated manner by drawing H ri'^?; front line systems in block diagram' form and deriving simplified trees to

-J J.af.? identify important out sets..Such tre' tments' require many subjective a

4

!/ PET 3udgements by the analysts and arithus difficult to review and difficult -

@ '.~.:JGto draw insights from (JH, p.5)..There was concern that these simplificai

" Etioni may invalidate"the.stu @.,(WCL,' p.6)

A... m

~

F.'y$

~.

NSES. %.wiMN?hLk.e.5:1?ikk%.mu.ON$5lndb5Mbiit& k <. MM

& g !f* m *'

~

'.Duk

J.

Li M:;q#.wI'55 FSy'sYe. ?.RK%:..

~ d tassen-Cause ms Interactions an e;...e

.. _ f.M-

.e.p+~ n:

,,. w m

.w..x.r n.

-.. m+~ e

+-

p.s.:wpr;m.,.L 3 JMjjRelated to the'above concerns is the problem' of not-so obvi.ouFsystem inter-i tM.h actions such as water..in air. linest that were alssed because the analysis was f

b.%..;.$not carried outlin en6 ugh detail.s (WCL, p.3)-[Inte d

J W?are not connectled but which can influence each other upon failure we're not systema-n 'i M ticalli treated,"nor Ts 'there con'sideratiion of the potential for and ' adverse

~

~ " influence of cascading effects.

(PD.,p.5) What assurance is there that i

the above concerns will not have a significant impact on the results of the

.. stu@ when they are addressed?

h;j?; OfInstrument Air Systems.were not modeled.- Is instrument air used in safety

!.g. mmh.T i

. M:dYfC

~

1.'. l.

' ~ ^ ^ '

he'r%ftsystem actuationT(WCL"l p.5)

~ ~ " ' '

...: ~.1 ~

L.

~

The "Other" Category II.6 G :' G.:-

j' What assurance is there that the "other" category indeed includes.all events

)

not analyzed and properly identifies their probability and consequences? (WCL, q

p.5) l l

l

?

yy.

L We

)_,..m,l-ssn

.. v.

k

$';. d* ~

./. i

.,h., -w.,.h.. !

s a

r.-

4

-Review Questions and Comments 4/6/82 l

".Q.,'

.: v.

III. Plaht Analysis III.1 General g.g. g (1) Do the' event sequenc'es (p.' 1.5 - 183) include th'e ~out-of-lervice conditions

( ~ ~

permi_tted by Technical Specifications?

(WCL, p.6) 1 j (2)

In table 11.4-12 the var.iances listed for the Zion plant specific events indicate the distributions are quite narrow whereas.the PWR Popula-

~

tion Generic variances indicate broad-distributions for Initiating Event Categories 7, 8, lla, and 13a. What effect do these board distributions have on the final conclusions of the Zion PRA? (WCL, p.4)

jf m&,k I.II.2 Specific Systems 2

m' y

.r t -

J.$,X, (1) HPIS

.J.'M..The failure { ate for HPIS.seems.very low; the Zion PSS used a median value W.m. h. of'1.2 x 10-(2 of 3 p. umps) *in Table II 4-15.

The conditions and requirements 9.?$m.Q: assumed don't seem to explain such a large difference. kone of four pump Similarly, for small Mr.

e - LOCAs, the corre

~l.M.yy-a--. Zids vs 8. x 10 gponding flPIS differences are 5.8 x 10-;

--.+.y(one of, these pumps) for Surry;

.a

_., _..y

~

=:

y:

, w... y g.y c..~."~.c_

, w. -g.a. __ m.;...,_ _.,. n.

, y. r

.: n.

..w

.........,......v.n

.... ~.

,.n

.t 1.5.3.25"i W ^... -

MN

.. (2f' Engineered Safety Actuation'Sys~ tem p/ aw.,~:m:a. 7.*"^i" r.a v.-

w

.,r f..

.dli[ re3 ort'statesf""Thfs ;inaly,sN is 'cirried' ou(undN Me"!the initiatin

~

following'assump-d i M 7 tiods: The system is 'in 'fts normal op'erating mode prior tW

~

%.t?.'t.T:i.e Since the ESF systems are' in standby mode, how can it be justified that no g1J.Pr.c p.8),ational errors 'have,rm if'j jgoper been made prior to actuation.of the systems?

(WCL, np^

- -, m

. ~- %.:

q:..

~..

JkV;(3') ~ Reactor Protectfon System Breakers '

The report places great' emphasis on using Bayes' Th.eorem to fold in plant specific

'" * %,, data and considers this procedure as being conservative. But, it is conservative d to take plant specific data which'shows poorer performance.than generic data.

,""C.. ' fold it in with generic data, and then use the result? As an example, the Iiori data for the RPS Breakers'shows 1: &

5 failures = 8.2 x 10-3/ demand N._

- 612 tests for a roint estimate. On page 1.3-32 the unavailability of K-2 is that of scram eakers, wiring, and the CRDMs themselves:

Mean:

1.8 x 10-4 (failure per demand),

l Variance: 5.2 x'10-8,

I

- f ' L..,. '..

fM 3'hb I$lf.

.%. Q v5 :

n

.,.,-4.

- _,, - -,, -,, -, -,, - - _, -,,.,,. + -,, - - - - -., - -

,-,.n--

- - -,.w,_-,.,--m-e,-,,,,, - -,,,, - - -. - -, - -,,,

,.,-m

Review Questions and Comments 4/6/82 V._.Y.'...

Should sekected plant specific Zion failure data-have'been?nsed:in the study 1;p.Ef without folding it in to generic data to obtain a more accurate measure of v ~;

the risk at Zion? How many other Zion specific failure data values have been

" : T.s.

folded in to obtain lower failure rates than that representative of Zion? (WCL, O,...

' p. 586)

.,a.

~

(4) Trip Relay Failure The report states: "Although the relays for a particular scram are arranged in parallel more relays, diversity of scram signals' requires coincident failure of two or in series." The previous statement is not stated correctly. The relay. contacts are arranged in parallel.

Both contacts must open to open the scram string.

If redundancy is claimed in the contact functions, then two sets

..m.p ME[*.ps ' of-parallel contacts in series must fail to induce sys erg

^t How does one. conclude-that functional redundancy exists? Does functional redundancy

~~

((f [u.z exist:.for all accident sequences?

(WCL,p.6) mc

&~ - - ~. v - -.. :

r~

w

~=

= v -w

~

i. n.

.a..

WO (5). ~ ~ Case If" Failur'e' of Power at Bus"147' p.1.5-193 "

~

'~

&QA.

e z.. :: = - 1

~

"If no safeguards actuation signal. is;present on. either, E.;c. ;-

$ef_-;d.Thereportstates:GT unit, whichlbre'aker'fi.rst receives a. closing signalf,is_ dete h

.~..

' N.. _

kidEEdisf relativ'e speeds' of the Dus undervoltage sensing ' relays..L What this.means.

" ~'C49 Q-lis,that if'measur.ements(wek to'bfat Ziohitoday,1diesii!1*j'eserator 0 'would 71 "VC he preferentially ali.gned.with either Unit.1 or 2 each. time there.was loss

...,, Q gg. of offsite, power. depending on,.the adjustmentraf the undervoltage relaysh.:Z C-M.,.A lu ni. This' preferential seq'uence would always occur unless the settings of the-L iW undervoltage'~ relays were changed. ;Therefore there is not'a 50% probability.

l W'that diesel 0'will align with Unit 1.<If the undervoltage elays are set

. '.f; r

y' always occur untl the relay settings are changed and this p=1 -for Unit 1 such that diesel 0 automatically align's' with Unit lec this' alignment will 1.

i em;;,3 and p=0 for Unit 2 diesel 0 alignment.- (WCL, p.6)

(fd. Auxiliary Feedwater

.. 'y mt.ie

.4

-y; ? 5 1 The auxiliary feedwater system in the Zion PSS has. an estimated failure i'"

' f. probability that is-almost an order of magnitude better than that estimatd -

". J s

l in WASH-1400 for the~ Surry plant.

However, NUREG-0611 which included a q.h comparison of all AFWSs of Westinghouse-designed operating plants, identi,-

fied Zion as having an unavilability higher than Surry. This principally p%R stemmed froin.the Zion plant having a single manual valve at the condensate C*2 r storage tank which is shared by all three trains. The Zion study estimates that failure of this value can be detected, diagnosed and man over with a probability of.993 (failure probabil.ity of'7x10-g11y switched l

i This l

appears to be a large amount of credit for this complex series of human l

l l

.C

=

v:

,,c W,W -

' "g 7Q.

~.h?

..-.. y.%.+

a.

.~,

~ Review Questions and Comments ' - 4/6/82 (M/.

.Nt1[$si Apparently, this stems-from the fact that the pumps will trip off

f. '..

under these conditions, thus will not be dama.ged and therefore significant time..is available for recovery..Several factors ugy influence l behavior R'

however, including diagnosis time, the undesirability of valving the backup b'

1ake water into the steam gen.erator, or the potential for trying " feed and t,l eed". This more favorable. analysis in the Zion study than 'in NUREG-0611 may warrant further investiga,tions.

(JH, p.4)

In addition, the study apparently doei not take into account the limited sustainability of.ha steam supply needed for the operation of the steam driven auxiliary fegd pump. (PD, p.5) j( gp..

III.3. Specific Sequences.

g 4 -,>...

F:7' A problem with an ATWS sequence has been reported by Bus 11k. The

' ~

Y M '~~. (1)h,umait error probability of 0,004 was' used thht the operator would fail to hM open as necessary block valve in the 20 to 10. minutes, time required follow-

~

}#ik'

.W

.ing an ATWS.

This,.as he ppjnts out, appears. extremely optimistic.. Bus 11k alsofsggests'that. human error. probability of.0.64 to.0.95 may be more 2

_ appropriate in which case the ATWS core melt sequence.becomes 5.8 x 8.10"5 -

. _ '.fc'. '

~

43t;:

%~

Mid.

eviewed more closely. -r-F

'%f-J 13;}herefore an important; sequence..;This should-be!r.p.7).w..L46 edMe.4

..e E R&.

7 T;- *.

y m'ggrC 9 m

_,:- y T T imy;Ei'gr - '

Ne:< }d:1The second area"which has;been pointed out by:Kolb (8) is the credit-

.N given: for spray injection given a core melt due to ~ recirculation failure ~ ~* "'" ~

W l MEf.'.

foll'owing a LOCA. This credit is given on the basis th'at 100,000 gallons of2

~

yE-water will remain 11n the. Refueling Water Storage Tank (RWST) when switch

v 3

d '?

another. source. of. water to?. insure spray operatiori an.d reduce the probabilityl over. to recirculation from injection occurs.1 This ' injection water provides 3

L

$.E.-

of containment failure. The procedures we hav~e indicate that an injection

' /

spray pump will be left on until the RWST is emptied and we have found no

.. J LOCA precedural steps for refilling the RWST. Thus, the RWST may be de-pleted of water when needed during core melt for containment protection.

~a..

pW. This ~could. impact [significantly the plant damage; bin probabilities and

. ;E i

C~ perhaps the risk.'-Jgain, this has' the character of providing credit for e'

" ~ "

operator action beyond that which is typical'of PRAs and therefore may Q,.,

d3 serve further review.

(JH,p.7)

.r.

J%.

(3) A third accident sequence, Station Blackout due to a LOP transient, is a' b

domin. int contributor to risk. The calculation is or has been pursued by Bus 11k,

?

- Easterling, and Kolb. The questions arising have to do with several factors, including the treatment of the increasing trend in the unavailability of the turbine driven pump, the appropriateness of the LOP transient frequency pre-diction, and the onsite emergency power restoration assumptions. Depending on the way some of these are treated, the mean for this sequence could be i

approaching two orders of magnitude higher than the study predicts. This also deserves further investigation (JH, P.7); as does the assumed quick recovery of offsite power as the grid margin is reduced.

(PD,p.5) le.

c '."

s ;. r;.

i

" $\\ -

+ - -

Review Questions and Comments 4/6/82 (4).There has also been conyern over the low probability assessed for the V J

Surry (4 x 10 gn (1.17.x 10~ per yeag)).which is considerably less than at' l'

sequence at Zi

) or Sequoyah (5 x 10 A' difference in system design

/ may not explain. the differences (P'D, P.4 ).

The large effect of treating a

the WASH-1400 bounds as 5/95 percentiles instead of 20/80 percentiles was i

. pentioned earlier.

~

l IV. Containment Analysis IV.1 ' Assignment of-Split Fractions in Containment Analysis A barrier to review of the document is the lack of a clear correlation between p.

accident phenomena and the split fractions assigned to the branch points in the-l-i containment event tree. The formal documentation and the method of incorporation.

~

ff.

J of the. analyses performed in Sections 3 and 4 to substantiate the assigned split E-$;.9 fractions in Section 2.0 is 1,acking in detaib (ANL, C 3.0) Some of the problem w g.;~ _. lies in trying to lump phenomenological uncertainty.with truely stochastic sc

. processes.

(DP,P.1).,

J, a TJ; -

M.

, g.y, -

.,anggy 3

yp.gy. v

- =-

C.L'..-,d.T:.'

'?.GGh.

-.,... p.. X X..

~....]

. u :

. u X '.

.x g,y g g ;...;,:.;.., J'.)J g "' M. C. -

~

.4 UW I{2, Core Melt Coherency :

3,"

~'

.M-1d thEdh'esiiMal"h'e^5tl5Y%-Qq'bf thIs~teah@'oildalion *((Y"

~

.n:&&. <-

al w

~ m., - w... Gk *. a b :

f 'o.. 'a.T "wh t extinC Os

" y&sk...

linated i

Gr.m li

%,p"7(off. Zirconium reduciithe radial temperature gtadient'.in the core during'i. " '.4,y%

/Mdf meltdoEandTaiiiie~3e process'.to,be more cohelrsntSthan hypothesized ir thel.g Z

j AiBy~ -

ww...

.,. -.x.u :.

..-......... w...a c-.

D.. a?.W.C.i.on,PSS? (DP, 'p A) y3, ' -

Gk's(OC.To'what extent.ddIthe seif l1miting' naFuiio,f the oxidation p McT E.. ~ -

~~

^

hdeh high-hydroge'n' partial pressures, moltenTsilveF alloy from the control'

'G b"L'c rods disolving Zirconium cladding, ballooning of,the fuel rods,' and the O:

7eudothemic fomation' of eutectics of Zr, Ir0, and UO, cause the core melt process to be more incoherent than preditted in the Zion PSS?

(ANL, C

$'tYdNN-N) n 3.1 r.wa%J.h

.MU,,N:?Mi i.1 g.L U.S s-

[71V!3 pin-Vessel Steam Explosions /Spokel %. M% -

i P

1) Probability

!~W The ANL Gro'up was in agreement with the basic phenomenology limiting in-vessel F

'steim explosion as presented by the ZPSS authors; however, recent experimental f

data available after the ZPSS was prepared shows that, under the' impact. mode

~

of contact, reproducible steam explosions can occur at ' elevated system pres-It is suggested that the authors of the ZPSS study evaluate this new sure.

i dataanditsfmpact.

In addition, additional justification for the assign-l ment of

=10-as the split fraction for the likelihood of breaching

{

the pressure vessel should be requested.

(ANL, C 3.2)

[yy 9.'.". ::

s-

.;;.e.<.4

- 't'.

eYN

'b I. f

f*

L

- ~.

Review Questions and Comments 4/6/82 4

i i'

2) Steam Generator Tube Integrity a: W --

a.

v-

- ~ -

..g While the ZPSS method of calculation may be sufficiently accurate it is important to obtain an assessment from the analyst of the effe$:t differerices between the actual U-:.end tubes and test conditions. The following comments

_ seem appropriate:

(ANL, C 3.2)

A.

How valid are the results when the pressure loading source is dynamic?

B.

The dynamic pressuP'e' loading' effects could be more severe on the U-bend tubes as compared to the tested straight tubes?

l

.w

~~

How valid is the flow stress correlation given in Ref. (2) of the _

C.

Appendix when it is applied to other materials not tested, such as '

3 G.M7' T';i. Q f Inconel'6007 JMfr.

~ ~ '. '

-[.

e:..

. 5, '

. n-e er r.s - -

ww

- *M;

x--

.- mr-r- x.c. - - - - -

(...

J. M M IV.4 -

In-Vessel Cooling

.,. 1.._

. w.s.

7-@" The. eve ~nt tree defines' the nodal questio'n' to bel.4.Do the~conditio'n's' e~xist"-

H@--e.5:q ~for in-vessel. cooling of the core. debris?

r..

. As;.noted in Section 2.5.1.5 ' -.Ti.several. item (aire.? requi

~

L ey.are:

. is' r~ ' quire 6't's provide a source. of'^w'ater.6'rn,; pathy (3)the" debris c'an 'be ~.7 Y." 7 "

e

. (2) a.

p g#gCg#syst'e' iaus$' particle sizes a~re siffff' ientlflhrge to' al

.@k.i a

xistias"well' as~OiaWr7 ret 3.tMk@ qu'enthed and c

. ;. n. ;..... -~.9 = v :.y&e ~..es- ~~=-e A -x'." ' m

.rmay2 -. - -

a,..---

.w i.e.a n yw c.

- ~* m v.-

5 3.j,ts.g) IHe~at Sink and Return Path - The reflux mecha^nism cited, is.certainly #l=* > ~;-

%e6 A

.. -.. w ~;w --<n

~

~ - ~

fd2*bs.

^

-I ~an' effective. heat removal metho'd; however,;if non-condensibles (such 'as7' h_W.h

~

~ ir or hydrogen) accumulate inthe' steam generator region, it will pose a

.., _ ~

EM7'T"additionaKthehal resistance"and reduce heat transfer. We would suggest m

g.p& g f -}

an evalu.ation by IPSS of the e_ffect of non-condensible gases upon the "A

e -- -

reflux mechanism.

e i

B). Debris Coolab.111ty - The pool boiling critical heat flux has been chosen "q:S. by the -ZPSSv'uthors for evaluation of the in-vessel coolability limiY..

'h a

.... - 'The usVbTth'e~ critical heat flux limit is valid only for particles 'g'reater" ~ ~

~

,.gZf3.'

than 4-6'm in diameter at atmosph'eric pressure. Based upon the possibih ty.-

of small local explosions producing much finer particles and the small '

b%

particles dominating the coolability,. the ZPSS authors should be asked.to l

reassess.the choice of model.

y : 2.:

However, we do feel comfortable with the assigned probability of success of 0.1

[

as used by the ZPSS authors.

(ANL, C 3.2) l l

g '

i l

..:- + y p

'I U.Y

Review Questions an'd Comments 9-4/6/82 IV.5 Vessel Failure

. u t... ::.

r' en Y?" 1)--Considering the importance of -the 'reacto'r vessel failure mode to the sub " '

sequent analyses for short ters containment pressurization and'long-term

~

.' coolability, it"would seem that a more exhaustive and convincing analysis of bottom head fai. lure would be in order. The principal concern with the present analysis is with the realism of the assumption that failure of the instrument tube weld will lead directly to ejection of the guide tube from the penetration.

Mechanisms which could prevent the tube from being ejected include: a) Inter-ference due to differential thennal expansion, b) Interface pressure between the tube and vessel wall due'to system pressure, c) pressure welding of the tube to the vessel wall, and d) resistance to tube motion from external supports.

Const' ering the importance of understanding the expected mode of reactor d

s vessel-failure...it would be appropriate to review additional information which.":

7.'-l._, needs to be pro.v.ided in a manner similar. to that provided for the containment.' *

(ANL, C 3.2)

,7.;.

.- 42 r ~.,.

e mn:r-

- u :e :

--o..w-

. ~-

, -- ~.

GL 2

9D. ne)t -discharge ~ofifice that is larger ~t% the one : assumed in the Zion PSS.~It

~

5 :h.WE This :would reduce the main driving-force for~'-the~ dispersal of core debri's in-the

-st'r:- pressurized (small LOCA) ' scenarios and would cause them to look more.like the.

f.?; 7 F unpressurized;(large LOCA) cases.(DP, p.485) g g.3..,

f_.j?

_. g 4.

-Ihb,w't. ~ M896.b.wMEM.h@NMindikardEeSahdde.J.e y

=...

.u.,.

--. :n -

c:7.v.

Core Debris DispersionlT.... ~.,;n N--wm -w u-u.

'.M' ;. - C f+*.

.. e...

~

C Z Z M~~ -

} tup.

.IV.6 L-.

.v u.y s.r,s

%.Q&ffy.+. : -

.,.&h'./- L -..

T.u.Q'pl.'::4 1W &.A,.*3-- W M A.

udsu-

=- v *s in' a +-v

z Lu W6 1) _Given vessel failure for a ssmall break LOCA by failure of an instrument.. 9:

[3,,

tube penetratio~n','; the authors predict ~a large fraction of' the core debris "1 'J-

.1 (d [.

jected froni'the' vessel will be':disperied ~out' of the react'or cavity onto the [l', ?

driving mechanisms ~, several significant limitations were identified; a) the i '[i Although th'e ACRS consultants ; agreed in general.with the w containment floo6 Q.g2 ' effects of crust formation on liquid surfaces, b) the interaction of molten

? w-sv l

core with ex. vessel concrete resulting in substantial gas release ( ANL, C 3.4);

i

. DP, p 788); instrumentation tubes running the length of the instrumentation

' l t"""*1 "i ht cr'***

bl ck*9' 9r**ter th*" 5"99'. St'd by th'ir cross-5'ctia"*1 - ~

E.C 9

x.w. areas.(DP,Pp 6) h.

~

J.~

. T

^ "

" ",*"~~

~

0-

~~4;-- M M Xi.Cs (dQ*y',:):.m..&.;4%%.

4.

-w 2

The part of the core that is not involved in the coherent portion of the 4yn meltdown (50% as estimated in the Zion PSS) will eventually melt and leav.e the vessel without the dynamic forces associated with the initial vessel r

L Y95!

failure. The Zion report seems to neglect'this remainder of the core which

'f:T will not be dispersed.(DP, p 4).

I i

k

.. WMe

w. y z...

,V4

i.

2$: g. -

~

10 -

4/6/82 Review Questions and Comments IV.7 Presence of Cavity Water (Node J)

T 'he

.,.I.'

ilbbe'd ' asks the question whether water will be in t'h'e' ex-Ve's's'elicavityi T

' authors of the Zion PSS have assigned a probability of 1 - E. where E. = 10-4 that water will be in the ex-ve'ssel cavity. They state that this is based upon a detailed evaluation of the plant design. The reviewers' wers unable to find

^"y reference to the evaluation in'.the Zion report. Additional detail is warranted.

~

(ANL,' C 3.5)

IV.8 Basemat Penetration (Node K)

~

-~

1) The analysis of jet attack of the concrete assumes the form of a quasi-steady-l state calculation of a molten jet attacking and ablating the surface. Several conservative assumptions in the calculations were used: The non-conservative pj.f'.

assumption is that spallation the surface of the concgete" doe' hot occur. The s

,x.9;.

calculated heat flux into-the concrete of 20,000 kw/m'- (page 3.2.8) is an p;N 5 51 penetration unlikely; however, the.use ofE=10~pe jet mode.of attack does J

extremely, high value. The limited duration of does require' additio'nal~ just-G:. :.n.

ification particularly with respect to the effects of spallation, (ANL, C 3.6) x%.

s.

NQ 2)' The cavity sump is located -at the far end of the instrumentation tunnel.

~

tQh-Melt dispersed during discharge from the pressure vessel will collect in this,

r

.F sump., The concrete below the sump is especially thin (2-4 feet).

Penetration EL:

of the. concrete' basemat at this location.should.be' conside' red fo'rTall ?.';

T, J accidents in which molten cbre 'debRi escapes the^ pressure. vessel..The effect' " '

M.#se of the sump' on the novel hydrodynamics-of melt during high pressure discharge-i.

~

W W, 'fs uncertaihi! It is known that'onlyiYmall discontinuities in7s'urfa'cFca'n have~'

id$ME drasticinfliiences on the flow bf:liqiiids~ over. the' surfaces'. Other features of~ '

tMn..

melt behavior,_ such as melt / concrete interactions,.will provide even stronger

. effects on these hydrodynamics. (DP, p.5 & 6).'

^

.a.m -

.g,....ru e

i Nh}.

5.l '. ; l { -

~

yf IV.9..Coolability of Ex Vessel Debris B'ed (Node Q)

~

J

.(1) The question addressed in the Node Q of the containment event tree is:

p.tn,.

4.'..Does the debris positioned on the reactor cavity and containment floor

@$4*;

'f.orm.a' configuration which is. initially coolable thereby preventing signifi-

f...

g % +.T cant concrete attack? A significant uncertainity with respect to the assess-ment of ex-vessel debris coolability is: What effect does the concrete and gas release from the concrete have upon the quenching process of the core melt in the ex-vessel cavity? This effect can not be ignored as the authors

[ M.t.,

indicate that up to 30 minutes may be required to quench the core.

(ANL C v:. -

3.7).

(2) There is a lack of sensitivity to the uncertainties associated with frag-mented debris beds.

Real fragmentation processes will yield particles that are not monodisperse and probably not spherical. Non-spherical particles j

with a range of sizes will routin'ely pack more densely than assumed in ZPRA.

I Packing density increases, and consequently porosity and coolability decrease I

with increases in the mean particle size and increase in the breadth of size distribution.

And stratification should be considered. (DP. p.7),

I i

f~n '

Review Questions and Comments 4/6/82 N...

(3) The" probability of achieving a coolabl

@f assigned a probability of 1 -2,where E.= 10 g bed in the ex-vessel cavity was for all events where water k

is available. The phenomena associated with the quench of the' core material which need additional evaluation arelP1) crust formation between the debris j.

and.the water,'.2). gas release from the concrete hindering water reentry into the cavity, 3) reduction of the gas released from the concrete by metal constit-uents in the melt and additional energy generation, and 4) late entry of the-remainder of the core materials into the ex-vessel cavity which seems to be omitted from the study (DP, p.486;.ANL, C 3.7).

The phenomena may effect the ultimate conclusion and need to be addressed in more detail to justify the ZPSS conclusion ofE= 10 4 as a split fraction.

(4) The Zion PSS analysis seems based upon the notion that cooling of the debris s;yp-is limited solely by the ability.to supply coolant.

During' a core melt accident 5

g..:

. cooling of ex-vesselldebris'is limited not by the supply of coolant but by the M;'

ability to get heat out of the material.

If the barrier to heat removal posed -

Fw-b.

by the low thermal diffusivity of the largely oxidic material were properly v-B-

recognized'in the ZPRA..the ex-vesse1 ~ hydrogen production would be greately ~ f 93

. increased. The material' stays %tter*f. longer, regardless of how large an

~

k' :..y,~

excess of coolant is' available.71n~ fact, the large supply of coolant' assures

.. q...

there. is an excess of. reactant-for;the; hydrogen production process.;(DP,:P.6)

-,,' eq+y.w+-pp -x~M e ':-&- w

- --.-W +

~;. :v-s

--A

= -.

4 w.* N.

e v4 mi e m o wg"egyqg.gg i@.va2;f * =**@gy g.g "gQ;.g..b

.. = =

vt w, -

.. r a,s.2 4

gg h 1,.

m. Wr IV;10 HyBr...

ogen Pro'dsctioK q;gcc ~. 7 m ;;y

.m 9~.:. y.;.. e m

,.m.. n...

m v

w. e-n - e.

. r, c.,;

x.+... -

n s.

..., vs.e r.: m.,--

n.

~

(1) The core exit. temperature.of 1093_,C.-.is quoted as the peak temperaturei 7

pgg.f" prio[r to vessel failure which seems somewhat low and should be investigated.

0.#. #.-

m i

.w..

UGu The iinportance of this calculatiohjelates' directly to tlie ultimate pressure

~1n" the containment be'cinuse'it iFi contributor to' the quaritity of hydrogen "_ s' ~

9 2-.

27 2 Y generated 'as well as' the: pressurF.'sssel ' structural integrity *."( ANLi C 3.8)Z

?hp

m :.: =

M %

Q.1..4:m..

w-

. '. p:

FT (2)~ The contribution of the non-conder..iible' gas generation to containment pressurization from core / concrete interactions during the approximately 30 minutes rdquired to. quench the debris in the ex-vessel cavity seems to

,, 'Q...have' been ignored and should be included.

(ANL, C 3.8) 2.-5

-r

, /+-

p.,

-e~

jg. 7.~. :, ;- 7 7,

3 ~m m - - ~g Qa. -,6(3)..The production 'of hydrogeh"glother ' combustible and non-combustib t

and

-A l

gases, due to the portion of the core.that leaves the vessel after the initial g

failure seems to be neglected. Would this be similar to the behavior of.all p.

the core in the large LOCA scenarios?

(DP,, p. 4.)

W: -

!C' (4) The effects on the concrete walls of the instrumentation tunnel due to the thermal radiation and steaming of the core debris that is dispersed there seems to be neglected.

(DP,P.7)

(5) The analysis of hydrogen generation neglects the solubility of Zr0 in p

t liquid Zr and in some parts of the analysis, neglects the formation of a i

eutectic between oxygen saturated zirconium and fuel.

(DP,p.3) i G y.

f.E i:-

?.l C.~ ?

s

. 4/6/82 Review Questions and Comments IV.11 Hydrogen Burn Analysis a

The reviewers recommend consideration of the following questions by the ZPSS authors.-

C si l

'- -A.

How-are steam removal rates and/or steam gradients talqen into con-

~

sideration in the analysis?

(ANL, C 3.8)

B. ' What justification is, there that locally-high concentrations of hydrogen or C0 could not build up in the time scale of their release or formation in the containment building during a given scenario?

(AHL, C 3.8)

C.

Tge flame temperature criteria becomes invalid when a homogenous H concentration cannot be assumed and its use precludes the.

.. prediction of hydrogen detonations.

(DP, p.2).;...

y.

z..

D.

$).. D. _,What eff.ects would _ structures ~in the containment. building.have on the.

~

R.'.T_,,

-- propagation of a postulated combustion wave', or conversely could any of the postulated combustion pressures damage structures or auxiliary.

hv,,s.

N

. a.rc,_

., safeguard systems?. JANL, t 3.8)

..c......;..

g. y;,:

.. = =

T,...,Z : ~~... @ 7... h...

-.L.:G... E..:.".t." G...n,

.C..i.

...I W.. h. F_.: W-J. W W J u

h.

=

: n -c.w w E.4 What was the basis and use of the hydrogen burn probabilities in -

x.

j ;LGhl.iEld. MfM4-Jable 2.5.1.17 J (See also.page.' II.5-19)S The. ran'geTof.= temperature.n.--.e a

~

MQ.'.. fr2.q;fis' 100*F in Tablie 2.5 C10 Smal.1 changes 'in.the' hydrogen so~urce 9 A.N:m ::sstaaB term, available oxygen br' steam may :'al:ter the: calciulated adiabaticw 4

@M.sy. F~=f', geMflame temperature. far more,than 100*F." ( AHL',- C 3.8t Q:6

. ?' - ?

b

" a;;f +c.

a.

~..

J..}Y).f' a.

U.." '

.7 - s-v W., -.. -

H. O.i9 i-

.IV.12 sContainment Mass and Energ'yitoadings 9 x 7.-

U.G..~ Ms):n

...; :> e,. m

- ' -: ; p ?.

S::

1)" MARCH Code limitations an'd nonc^onseWatisms need further consideration.'

f

( PD, 'p'. 4 )

2).The relation.between the bounding cases and the most probable cases for the ut-?.'.

slic sequence classes in the containment analysis in Section 4.3 needs to be.. -

Jf-.

"T"~ cle'a'rly indicated.

Some of the bounding cases would fail the containment and

(*

should be given a non-neglig'ible weight in the probabilistic treatment of L

containment failure.- (GS,p.4)

LC.,

IV.13 Containment Failure and Integrity (1)

In general the approach used to calculate conta'inment str'uctural capability appears sound and well documented.

Some of the questions which appear signif-icant in the context of the high estimated failure pressure of the containment building are:

A.

How and to what extent has failure to isolate the containment been considered?

(PD, p.2) 9

(

}

Review Questions an.d Comments '

' 4/6/82 t.

,e 1

B.

Aside from major openings has there been a systematic review of all other penetrations (piping, electrical, etc.) to assure that, under-the predicted 11gW temperatures and pressures, no premature failure c

occurs in'the: sense that the minimum structural strength or leak-tightness of..the vessel is ' degraded? (ANL, C 3.10; PD, p.2)

C.

How and. te what extent have interfacing system integrity failures

- ' been considered in the recirculation' mode under class,9 accident conditions of temperature, pressure, and radiation.

(PD, p.3)

D.

How has failure of the containment purge system been considered in the analysis of containment integrity?

(PD,p.3)

E.

How has the possible failure of fan coolers from aerosol plugging of i

e.n., filters been considered?. (PD, p.3) h,.f,,

.g. -

- - gym

. :7 g.

w

..:4.. Fi Primary containment ul'tTsit'icapacity wa3 detemined to 'be 149 psia..

~

j q.,

s 7. g.. It was calculated by Sargent & Lundy (Appendix 4.4.1).

The analysis ye w... fr-~ e was supposed to cover:rircontainment st~ucture, 2) penetrations, '

~

p.J',l:

':ff,

,,. 3) rate.ofsloads, 4) uncertainty bounds,.5) failure mechanisms.

a;

.y.

y./ :.f. 77.~. '.. Only the 'first' two items'"a're dealt lwith, 'in some detail. -(ZZ, p.2).

y - g. y. S.-C.a.

~

~:

e,.

y n ;;.

m y r p y : g :._ 4 :. -

v WJJ2n' G.T. Containeerit'~ structural'icap' ability ~ analysis ^doesinot. address' the systems;LI

~

4 N2.56-

'.ga.-E. appear._to.bejaireasor!ab1Gumber.,for thejcylinderfs containment bypass #EL.2h '

MfM.Jowy. pressurej. as. a consequence:.ef, some per.etration? break;away prior

..?%L g N f potential.

-W:Apf4&we +ws.fs+ r.3~~er.t**tW9Wwyee@ec+48.- WWWW+NP &

@$'fWh:in Temperature: effects dsi=theiconcrete"are dismissed. as not important*

Z: (Vol.7 Secte 4.. App;i4'.4.1)4 Is this conclusion. valid for all accident"

.f-pyy]; sri 94W re'24di.i$; sequenc,es,7 partial.ly thosEin which sustained hig'h containm

5

- Jr.?

PMW% tures%re'likely? Can more detail be'provided'on concrete temperature "

E@q&Jy* calculati6ns such as 11ner to' concrete heat' transfer' assumptions, and "

~

~ film heat tr~ansfer coefficients used?

($t, p.2; ZZ, p.3)

'N P

a

_1.

Transverse shear stresss should be NW 115 in more detail at the

3. gMQ,.

~

y ?,!on mat for potential. leak 7 f. 7 Mih;.it.. location.of_cylinderattachmentt1 c

(ZZ,0.3)

.Qw.+~3 path formationd -Themal; effects L.n agg..vate the stresses.

~-

.~.v

' ~+gtym 5 mpcr~~ 7~ 3. g.

J.

In order to more fully ensure integrity of the containment structure h"-

it would be helpful to have an evaluation of the effects. of credible con.struction errors to see what effect they might have on downgrading q.d the calculated structural strength of containment.

(ANL, C 5.3) p K.

Sargent and Lundy does not really calculate fai. lure of containment in the sense of liner rupture but rather. attempts to establish a floor or minimum pressure capability of containment.

It would be useful to seek their opinion as to just how the~ ultimate failure and release

~

of radioactivity would occur.

(ANL, C 3.19)

D 3

m%

i L;

WDn..r:2 t.'

?~-

~

,.L-------,,,-

,y,--.-.

Review Questions 'and Coments

- 14 1 4/6/82

.h

~

f-ff.

j-

.ll..

(2) The 10 -uncertainty in the containment structural failure; pressure is.of the order-of + 2 psi. based' only. on structural property uncertainty.

"4, Considering all the above factors, the use of a 2 psi uncertainty band

- requires additional justification.

(ANL, C 3.10)

(3) Analysis consists of hand calculations and of an axisymmetric finite element computer calculation ; It is s.trictly deterministic and the conclu-sion that confidence level of 95% is associated with the calculated contain-ment internal pressure capability is not supported (presumably based on knowledge of materials property statistics.)

(ZZ, p. 3) we%.h.2.. -

. #. s.

..#,;,;i.,c....

L-7.. -

2.e..

cc.:..:4..

f.

.r

. e.x. _.

. _.a. s.;.=c

.a..

.x.

.a

a_. u u: ^..q.

~.

.. W.IV.

.~." g.r n 14 Core Retention Device ~

'r F "'

. wa

... > :.w.

em_

m w

~

' N y M (11. A core retention' device can reduce hydrogen gene'ratiin, steam generation,l e,

w ear.osol formation.both.:before and after containment failure, as well as retard c:n' '

c%c.rdbasemat erosion? ' Analysis in ZPRA-focuses only on the' basement erosion issue.

~

l '& & _f y Df; p.9) f.ii Q qgig; Q fQ. y y&Ni-Q Lj.y gi;. 2:w; 4.-

-2fE Y..r.QWrkn:.Y.c,.no.-: -pr;q:."wme;MENEvenTwith.this7 focus ~on;basemat' erosion.the app

~im;new.T p:v M.i R...

ualv A'ainimalcretention device' will, according to: the analysis, ' prevent e M'.P gb. ;

.be'semat penetration for two. days. This is in contrast to less than a dayw/. 2.rm plAe;,,qsuggested 'above.T Further,sthe probability; of restoration of power during thisfre'

,Z n

J;ldw$$tro d4ys is; estimated.to be. quite. high so thatTenforced ' cooling of the core #6

-y

.4 %

?.7 L:.3l~$cki; debris..un'til. enforced' cooling becomes available' is' not pointed out as a.

wm. :. p; benefit of tlie devied in the Zion PSS.

(PD,p.9)

~ '4' M-

'C '

.g l ~

n.

6 M. :..

6EL 5.

u?. i.R E W

Source Terad: ~T.':.'T ' -:.a.imi/...d:'.?OS..

$l:

'v-vf.. i, 'X

'2

.V Mt L

L..

. V Comparison'of Point Estimate' Risk with L Wel~2 Risk M

'~

t" 2T By assigning probability weights to the site matrix through use of a'" source,

term multiplier, U" the effective accident source and resulting consequence 7. M. is reduced by over a order of magnitude.

In light of the impact of source term reduction in the site matrix, the ZPSS authors should be requested to l

provide additional detail to support the' probability; weighting values used.'

(ANL, C 1.0) i L

i.

l U. &, ~. -

I O

Review Questions and Coments 4/6/82

, m e,,

V.2 0xidative Source Term am

. n.4

.a

{MW

1) In the ZPRA' the role of steam' explosions is down p1hd, and they analyze

. w.

release from only half the core. The entire thrust of the ex-vessel inter-F-

BWR, action a'nalysis'in.ZPRA involves very $namic dispersal of csre debris. The W W amount of material' involved in the dispersal is the same as in the steam

' explosion events of the Reactor Safety Stub. Further, the time hot debris.

w.-

is exposed to the oxidizing environment according to the ZPRA analysis is far longer than the exposure according to the Reactor Safety Study steam explosion analysis. An accestuation y,ather than a reduction of the Reactor Safety Stub source, term is clearly called for.

(DP,p.8)

2) The error is compounded because coupling between sections on processes Wnd. the release of radioactivity is extremely peak.41f' there is one area

'd-g-

l...:...

wh'e're coupling should be strong it is between release of fission products from the fuel and the behavior of the fuel melt or debris during the accidenti

'a:9

~

1'

'. '. T P rn m ' M-i..i.

t hii sp.rr 4DP; p.8)~' p;_1 q., :. m. y e m. c ~ v wr -- 19..r9~

'O =5

=

s g -e c.c m

..pu

" nM27.6.:ix ^::.-w atW".2.:::.mni.PTT're.nw g.

. +...

~.

a- - v M+*.=

a

~~.

5.: Y sr Q.'Y'l* 5...Q & & s?' f,kht y h{..j%4,.: m &$U Q E $Q &

v h

h

?n E -

~ u.u e -

..~'.i,.

_,VI, Consequences..~ M -

,_m W _

I

a.m.~,.,......._.

%MtPfGW 47/F7 "5 WT i @E Completeness.-g.7 W;y..#3MM.WQsP8'p* 6;p:v:- en.te r - :. wp-c.r 5 n.N VI.1.wrwmMMbddhpekdLkEWWWE

+

.71FThe Zion 7studyWas 1.inited to examining ~ offsite'. health 1mpacts and did.?;jDiF@..

V

.:not specifically assess eitheH the contamination of.iland areas or the h ow.0/u..*@.w ifinancial'conseq5ptiesultshiting4rm potential' acc18entsW For somem.%=- #2.s aW

~ C.D hrd' T?' ^.' 7 TF

'.'a~cci'dehts? these "OthW t'on' sequence's: are 'doininand,W2G FA4FM15E' % ' E3-MU f M-

- W.;M$s4.ifin@W.W.W5@in th'e assessment of health effects...

.. m :p.W l

1)c Genetic. effects'.are not incitrded

, c::T u.' r yy;%m. :c :pe y.w~

.c.~.;i :...

'VI.2% EmEg~en'dy" Act'i$n$5-MEND,.. D7?i.M N,n=.7.

q '*5 E '"I ' Y Assumption regarding emergency actions can have a strong effect on the calculated results.

N

.d W. -..-..

M&

. *.%';m_4..r.t.%....w..,.[g. f., ". r 4 b&....' - y.Q..._,L.. W...&w.MW:~.M. ~

n

P,

~

7) -Early effects" arFsery 'sensit1W.to" assumed evacuation 'paraineters, SW..~.-.~...

o em

~. +. -.

.s

^'?

~~"'2"

'particular1f'the'de1W time'befch 'public movement.7These sensitivities' l

3.. f' -

should.be displayed in the reported results and distributions for the para-

idT meters rather than best-estimates should be used.

(DA, p. 485) a.

.t

[ h' ~ k 2) Some accident initi'ators may have a significant effect on the effectiveness of emergency actions. For exmple, earthquakes may-not only cause a large off-site release but.can disrupt transportation routes l

and the comunications necessary to coordinate the emergency re'sponse j

j (PD, p.6; DA, p.6).

The same may be true for a loss of offsite power i

accident initiated by a tornado.

(DA,p.6) xg.G.

-@idb.

..gr.

cn

'o

%%

.+

.<:y p

w

~

W 4

Review Questions and Coments

- 16 :

4/6/82

'Q 3

3) The assugtion is made that accident initiation times may be obtained by the random selection of times'from a. uniform distribution ;through the. entire year..The general procedure practiced by utilities tis to run reactors at or near.1005 power. because of their economic advantages over

- backup peer. However, outages are required for maintenance a'nd refueling.

Because of' economic advantages,'it is assumed that the utility will attempt to plan these outages at times, of low power demand (i.e., when the need for more expensive backup power is lower)._Since the analysis'iglicitly assumes that the outages are uniformly distributed through the year, two questions result:

1.

Are outages distributed uniformly throughout the year?

Q9.

L*,/.[N..

4.

w a.~:.g...

.h:. - M. --

Sh 2.

If not, would the use of historical and/or' anticipated outage distribution

$r

.Sv

?W data have a significant effect upon consequences?.a.1....

q w.,..w

.n..

n..

.e

,ww...

km An' appraisal of this potential effect is reconsnended for the following reason.. 0utages my decrease the initiating event frequencies for a.,1 -.. --

,.A-k' p[ ' particular, time of year.. Clearly..the weather, evacuation, and population

../' $.

data that apply during times of year (or-day).whenithe; initiating event:

--.P

'W^-

$.J e frequencies are highest should be weighted more:-strongly:than others.^.c r L

kg WM4.%k;,w w,. 2.4) 5.h &.'TS' ?"iM9#'d@%" ' potentiala; A-M Sampling,from a' non-uniform distribution-wil1Trec3ipitzelthis T.x 3,ieffect?.i(ANL'

'VF

' L MC-di:t :aM %9M M:QifhhhiW

&~n%-&-

4) foe *1arge accidents the.re. quired medicalliersonnel?and' equipment'uV ~~"9&Y "CP.~

f"@Q.:f ia s

~. '

not be'available for the assumed supportive medical treatment. This should' ff be reflected in the results?. (DA,p.7)sPrWEs@?l'y.

/

.w omppen.ubb=w

.Y. -

c w -- w g.

2 (k.. b.# VN P. Exteirna1 4 vents.,.. "'l Y 1'. f. E.? '. '.E"'W.".97f, -

..I,i[:.

TW n:. '

, n.

y n~% ^ '

y This is*a "first of its kind" analysis of seismic risk' integrated into a pro-n'"

babilistic risk assessement. As such, many of the methods used are without.

precedent and should be considered as extensions of.the. art rather than applica-h:K tionslof. it.. Significant, questions. relative to the,ZPSS seismic analysis are as a follows:-

g. ;g;g

=,%.

+

j..

w.

n.-

./

j ~

accelerations at the Zion s.ite and a low cutoff (zero probability of ground-1.

This stu $ used a rapid seismic attenuation relation for predict 1.ng peak accelerations above 0.65 g). Such an assumption is open to question; there are competing theories which would give low probabilities of substantially higher peak accelerations.

(ANL, C 4.0) 2.

The use of a lognormal distribution for describing uncertainty and variability in fragilities is probably.ju.stified although the assertion that such distribu-tions are accurate to the 0.01 level is optimistic. Th'ere is evidence that i

[

__._.,_-___,.____________.__.___.._.,__,/_____,,__._.,_.-_,.__,_,._._._._.__,_,._..

Review Questions and Comments

'17 -

4/6/B2 f.

.n

(

~,

, lognormal distr.ibutions show considerable variation with failure data at the

.05 to.10 level. This becomes significant because, As is pointed out in the t

- report',' the seismic risk is associated with an interaction of the tails of the seismicity distribution and the fragility distributions.

Further stu@ of this issue is warranted.

(ANL, C 4.0)

It is the impression of ~he reviewers that the uncertainties, for the 3.

t fragilities, particularly the equipment fragilities, are underesti Ye, d.

The reasons are:

1) Several studies attempting to predict loads on pipin during seismic simulation tests have indicated discrepancies of 200-3007,.

2 Extra-i "l j nonlinearities (e.g. gaps) can g, failure for equipment which my exhibit _ hardeni polations.of linear' analyses to rossly overestimate fragilities. 3) There has - -

Xp

,,A apparently been no consideration given to uncertainty in quality control, design"

. error, and installation error, i,n' the fragility c..a.lculat. ions.

(ANL, C 4.0).-

.; n "..

r. m'.

v.,..

4 + --+

.,n - w

-.ww.n ~

7.e -

.r.w -e.-

W.u. Further comments on Seismic issues +are given in the reports by Drs. T

~

Ye@. Tn'd Pomeroy. M !^

N-4 5: 0 -=^

l

~

4% ^ - 9.ME; ~ M.?

-G:D. :.Z,.E*EGIL "O-E i.E M

MW.- we.- ':,hw c

w..a,w,

m e.

-~ ~.,,

w.-

r~

. rw - ~

~.%=r~NJ L&

.,. w-v.v-~ ^ y e

a 4 it a.

,- ;n

.y

- N.' ' < n

'a**&s -

av.. s.~~ ; a

.. $ A*t-k y **qv" ^***-'

A r-a -. =. e e

.w:.% sww:s s nw.5,,....;;...

.--..s.=,.

Te.

Nm.wc tmen,

.m

.w

-snm n

~#...-

e 3,

a M.2.. VIII.- Other Comments: ;;... y...

e'

' -p

.A-r.;s.g~gg15.p;.m? ?. y w

.f

- p c-

.y

.. w.

fY 5-N V-i.

.'h4-W$**' ? ? Y*W, % ~-Y D 'IM" V

~'

' b $ :.h.h W NsE.'- $

,ps 1).Are design errors and fabrication errors i uded adequately? If-not;-M;%%+A. ml QQ hoWT*auch change or. uncertainty would be introduced by ' allowing for them? - QOff N

wNW q~e,;,5

.% MW'T is; Are human errors.v; K =.25 & W.L of Comission adequately treated.in the 7'""*j2 y

w.

y.7..

..n

, y m. y y

-.::. m rz. - - -

$J;'3)Y,Is there a sTgnificant likelihood that a sev'ere ealthquake may nWonlyi ' W.E

~

'^'

cause a core melt accident but a' Iso directly cause a loss of containment l,

integrity?

%g@Q" 4.)y Does the evaluation of operator error for aTseve J. lq W ff be" reconsidered in view of the potential for major. losses of information inF

.m the* control room (combined with failure or spurious. behavior of much equip ?

ment with is not seismically qualified?

I

5) Has the, failure of large pressure components within the containment k,,,

been adequately treated?

i e

e er

. f....

? an.. '

~u

f t nclosare a DaviM C. Aidneh DA y

Sandia Laboratories RECE1VO

^' * = " * * " " 5 g%qNb.

~

FEB 4 se2 7Ji,1011:12 l 2 31{ \\h SM 9

itt January 29, 1962

'k Dr. David Okrent 5532 Boelter Ball University of California, Los Angeles Los Angeles, California 90024

Dear Dave:

~

Enclosed is a summary of the limited review I have-performed on the Site Consequence Analysis poftions of the Zion PRA.

Please let me know if you have any questions or desire, additional information.

1 Sincerely,

.stt.U 6 (d.0$M

//nu David C. Aldrich

\\

Safety and Environmental Division 4415 (505)844-9164 FTS: 844-9164 DCA 4415:dm Enclosure 3

Copy to:

i

-l Dr. J. Michael Griesmayer I

Advisory Committee on P.eactor Safeguards U.S. Nuclear Regulatory Co d ssion Washington, D.C.

20555 I

,e q A -1 6.1 L @,Q M 3 WW i

a9

?

Review of the Zion PRA:

Site Consequence Analysis

~

Performed for ACRS By:

David C. Aldrich Safe.ty and Environmental Studies Division Sandia National I,aboratories Albuquerque, New Mexico 67185 January 31, 1982 I have performed a limited review of the site consequence analysis portions of the Zion PRA, attempting to focus only on those aspects of the modeling or evaluation that could signifi-cantly impact predicted results, e'stimates of uncertainty, or major conclusions.

Specific sections of the Zion report included in this review were:

Section 6

- Site Consequence Analysis (Module 5, Volunie 9)

~Section II.6

- Site Analysis (Module 1, Volume 1)

Sectic'n II.8

- Existing Plant Risk--ResultsSection II.10 - Reflections, Advancements and Limitations In my opinion, the Zion. site consequence analysis is a reasonably comprehensive, well-performed and we,11-documented assessment of the public health impacts from potential acci-dents at that site.

The comments I have provided below

-(particularly on the emergency response assumptions employed) could result in altered predictions of early health effects (fatalities and injuries).

However, I have no major concerns or criticisms that would invalidate any significant conclu-sions of the study.

The authors should be commanded not only

q._

_. y for their evaluation but for extending the state-of-the-art in several Meling areas.~ In addition, I commend the attempt made to quantify the uncertainties inherent in the offsite consequence calculations.

Admittedly subjective (and difficult), I think a reasonable job was done.

This does not meani however, that I necessarily concur with the uncertainty distribution assigned.

The CRACIT code used for the Zion site analysis is a substantially modified version of the Reactor Safety Study consequence model, CRAC.

Modifications were made to the atmospheric-dispersion and evacuation submodels to more adequately treat specific site conditions.

The two funda-inental changes are the use of variable direction plume trajectories and the incorporation of a variable direction evacuation scheme.

In contrast, CRAC models both plume s

travel and evacuatio'n in straight lines extending radially outward from the plant.

Specific modeling additions or improvements to the original atmospheric transport and dispersion submodel in CRAC includes plume trajectories based on hourly wind-direction changes; a three-dimensional model for determining terraia offacts on wind flow and plume trajectory; use of.different wind speeds based on plume evalua-tion:

use of meteorological data from many surrounding stations in the site,regionr m.m -. e.

a== e

~

t

~

improved or additional models for wet de

.(washout), plume rise, lid penetration, position plume

" lift off," terrain height correction, and trap-ping and fumigation under inversion _ lidst i

a turbulent internal boundary layer (TIBL) model to account for lake effects; and ability to modify plume characteristics-based j

on expert judgement.

1 i

These modeling improvements do provide some additional con-p fidence in predicted results (i.e., reduced uncertainty)*.

However, I suspect that their overall impact on the predicted

~

risk curves is small.

This is supported by preliminary results of the International Benchmark Exercise on Reactor Accident Consequence Models.[ Reference 13 which show CRACIT

[

and"CRAC results to be similar when assuming no immediate I

l' emergency responsa.

There is one aspect of both the CRACIT and CRAC atmo-4

~

spheric dlspersion dubmode1s that, if improved, could significantly alter (most likely lower) predicted early i

health effects.

Both codes assume that all radioactive i

material released during an accident follows the same trajectory.. However, for long duration releases ( > l hour) such as predicted for Zion, wind shifts during and follow-i ing the release would likely send portions of the released miterial over entirely different trajectories.

Use of a i

I TM shough the terrain surrounding the Zion site is flat and

)

dcas not significantly influence wind-flow patterns, lake 4

effects were shown to significantly. impact the transport and dispersion plumes released from the plant under some weather conditions.

m.

.e m +

- - - - - - ~ - - - - - - _. - - - -..,,

,,.n,

--v,

.-.,,-n--

,,o.e_,,

,.n-n.,..+e,,-,,.._-.-,,,m,

ie-

-4 multi-phase or " puff" model would therefore predict lower doses to individuals and (most likely) reduced early health effects.

This aspect is discussed in the Zion report (Vol-1 une 9, Page 6.3-6).

The other major modification in CRACIT involves the evacuation submodel.

A scheme is employed that allows consideration of likely evacuation routes at the site (CRAC assumes evacuees move, radially away from the plant), as well as " bottlenecks" that could occur along the evacuation path.

However, the selection of input parameter values for the modifi,ed model is somewhat arbitrary.

The following assump-tions are made in the Zion studya n.

evacuation radius = 11 miles evacuation begins 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after warning by plant personnel (delay time = 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months ) average evacuation speed = approximately 3 mph (varies) no consideration of "non-participating" population groups (i.e., people who either are not warned or refuse to leave) upon reaching the end of the assumed evacuation path (at 11 mile radius), evacuees remain at that location for 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months beyond 11. miles, relocation after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of exposure A number of analyses have been performed at Sandi1t National Laboratories [2, 3, 4, 53 to examine the impa.ct of.

emergency response assumptions on predicted health effects.

~

,_.~.~..?

?.L. KT

"~1

,L K'*.l L2~, " -..

.%*'n:."*..m Y **l*

,_ a

..n--

~

These analyses indicate that early effects (fatalities) are

~

very sensitive to assumed evacuation parameters,lparticularly to the delay time before public movement.

Unfortunately, there is not a great deal of information available about how effectively.(delays,, speeds,,,etc.) an evacuation would be implemented during an actual accident situation.*

In most cases, the largest (and.most important) uncertainties.are associated with estimated warning and delay times, rather than the specific ~ oute followed.

The autho'rs of the Zion r

study are aware of these issues, generally agree with them, '

and discuss them explicitly (see Volume 9, Page 6.3-4, and j

Volume 1, Page II.10-5).

Because evacuation parameters are important and invol've large uncertainties, it would have been prefera51e to assign distributions to them rather than point ("best") estimates.

\\

The CRAC2' code (recently released) does this.

An alternative would have been to perform (and include in the report) a sensitivity analysis of the key parameters.' I would not be surprised.if other " reasonable" evacuation assumptions caused the left-hand side.(P 21) of the early fatality CCDFs to rise by a factor of 5, perhaps more.

The tails of the CCDFs would not be influenced, however, since they tend to occur deyond the evacuated zone.

The tails predicted for Zion are "I would expect the effectiveness to vary with time of dEy, weather, and perhaps other factors that may be associated with the cause of the accident (e.g.

seismic, loss-of-offsite power).

~

~:

(

~~

likely to be overpredicted because of the assumption of no inunediate response beyond.11 miles.

A large fraction of the risk at the' Zion site is pre-dicted to result from seismic events.

Seismic accelerations sufficient to cause serious damage to the ple.nt could also severely impact (or destroy) offsite power availability, roads, com: unication systems, warning systems, or availability of response personnel.*

Emergency response warning and implemen-tation might therefore be seriously degraded.

The possibility and effects of such a degraded response should have been discussed and evaluated in the study.

The Zion study was limited to examin sg offsite health impacts and did not specifically assess either the contamina-tion of land areas or the financial consequences resulting

\\

from potential accidents".

In' addition,thestudhdidnot I

include an assessment of potential health -impacts resulting from cont==4aetion of surface-or ground-water bodies I

(liquid pathways).

6ther recent studies [6] have indicat'ed i

that, for most sites, riska via the liquid pathways are l

small compared to those via the atmosphere.

However, several Possibly important pathways for surface-water contamination w' era not considered in those studies, including deposition (especially by washout) of contaminants directly on the surface of a water body, or washoff of materials deposited

A similar statement could perhaps be made for loss-of-

, offsite power as the initiating. event.

i t___

..gm

...-e

.-r------

~\\--

~ ~ - -

ft.

~'

-7 on the land surface into a water body.

I would guess that

'the inclusion of a liquid-pathway conseguence assessment for the Eion site 'would increase predictions of latent cancer fatalities by less than a factor of 2.

The early fatality dose thresholds (250) employed in the Zien study were those developed in the Reactor Safety Study (WASH-1400) assuming " supportive" medical treatment i

4 following exposure.

WASE-1400 estimated that approximately 5000 persons could be treated at that level in the United States.

Therefore, for.very high consequence events (CCDF

. tails) in which more than 5000 persons are predicted to receive bone marrow doses 'in excess. of 200 rem, calculations should be performed assuming the dose thresholds for " minimal" medical treatment.

This would tend to increase the " tails"

\\

of the early fatality CCDFs.

Finally, as a limited check on the Zion consequences estimates, the results of some recent calculations performed j

i at Sandia National Laboratories [5] for a large. core melt

.i l

release at the Zion site are compared to the Zion PRA results on the attached figures.

The Sandia calculations were performed with the CRAC2 code assuming an 1120 MWe PWR, the population distribution and windrose for Zion, Chicago meteorology, and a distribution of 10 mph evacuations (to 10 miles) after delays of l,'

3, and 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months .

The results M

t

3

.e I

i presented are for an SST 1 release which has the following charactieristics:

Time of Release Warning' Release Release

' Duration Time Height Release (hr)

(br)

(hr)

(meters)

Energy 1

1.5 2

0.5 10 O

Core Inventory Release Fractions (to atmosphere)

Xe-Kr I

Cs-Rb Te-Sb Ba-Sr Ru La i

1.0

.45

.67

.64

.07

.05 9 x 10-3 The SST 1 release is similar in magnitude to 2. ion release categories 2-1, 2, 2R, 23, and 25, although the release l

duraticins, warning times, and release energies are somewhat different.

Nevertheless, the comparison of results is f

enlightening.

Peakpredictedearh.hfatalitiesandinjuries (taij.s) for the two codes (CRACIT and CRAC2) are_similar.

The predicted probability of getting lower (non-zero) con-sequences (P 2. O, left-hand side of curves) is substantially higher for CRAC2.

This is due primarily to the longer delay times, shorter warning time, and smaller release duration assumed in the Sandia calculations.

Predictions of latent cancer fatalities by the CRACIT and CRAC2 codes

~

' are essentially identical.

e

y 6

l

- - ~.

. - mm

.e e-m.

References 1.

Aldrich, D.

C.,

et al., " International Standard Problem for consequence Modeling:

Results," International ANS/

ENS Topical Meeting on Probabilistic Risk Assessment, Port Chester, New York, September 20-24, 1981.

2.

Aldrich, D.

C.,

P.,E. McGrath, and N. Rasmussen, Exami-nation of Offsite Radiological E=ergency Protective Measures for Nuclear Reactor Accidents Involving Core Melt, NUREG/CR-1131, June 1978.

3.

Aldrich, D.

C.,

L. T. Ritchie, and J. L. Sprung, Effect of Revised Evacuation Model on Reactor Safety Study Accident Consequences, SAND 79-0095, February 1979.

4.

Chapter 9, PRA Procedures Guide, Draft, NUREG/CR-2300, September 19ul.

5.

Aldrich, D.

C.,

D. R. Strip, et al., Technical Guida..ce for Siting Criteria Develocment, NUREG/ CR-22.5 9, to oe published.

.i 6.

Niemczyk, S. J., et al.,'The Consequences from Liquid Pathways After a Reactor Meltdown Accident, NUREG/CR-2 1596, June 1981.

D e

e S

e G

p 7

1 e.

O e

e

,,,,.r,,

<-----.,-w---

.u-3 Reproduced from Elon report, Volume 9 1 B

=

N N g Sandia results for g

SST 1 release Z.1A

\\

so-' _-

\\

5 j'"

\\

z.s i

. E

\\

a h1o-2 l

=

\\

.. g I

E5 z.s4 1

I

~

2R

W io-3: --

.s

[

e=

8

\\

g d

to (ALLOTHER RELEASE CATEGORIES PRODUCE NO FATALITIES) ja.s i

I I

I o

1 to 10 102 s

a s

,a ig

,o EARLY FATALITIES Figure 6.4-1.

Conditional Consequenc.e Curves for Various Release Categoria! - Damage Index:

Fatalities 1

Reproduced from Zion report, Volume.9 10E

=--=~%

Sandia'results for N

SST 1 release g

\\

l

\\,

\\

2A i

2R y

5io-1

\\

c w

i 5

\\

5 Z-3 g

y 2 5A g

g

\\

r

\\

a<

\\

e

@to.2 (ALL OTHER RELEASE CATEGORIES C

PRODUCE NO INJURIES) e u

~

\\

{

~

2RY

\\

\\.

\\

t I

\\

i 10-7 t

0 1

10 10 102 3

4 igs ig gg INJURIES t

i Figure 6.4-2.

Conditional Consequence Curves for Various Release Categories, - Damage Index:

Early Injuries l

l..~*

t,-

~~

Reproduced from Zion report, Volume 9 Sandia results for SST 1 release 1@

%4 1A 2A AND 2R

/

5A

\\

z-3 W 10-1 5

\\

e i

E B

u g

i 5

]

y 7

R a"

i s

2Rv

)

e-

~C 3 g*2 r

8

~

.n I

go.3 I

I I

I

[

to 101 D

102 3,3

,g4

,gs CANCER FATALITIES #DTHER THAN THYRotDS)

Figure 6.4-4 Conditional Consequence Curves for Various Release Categories - Damage Index: Other Cancers n

is

m

/N' us w a %

ARCOM E NATO 5A_ LA3OREORY EMCAsshAncpedids604W Tdepkre312/972-457o February 17, 1982 RECEIVED ADVISORY COM'ATTEE ON Dr. David Okrent REACTOR SAFEGUARDS, U.S.M.R.C.

5532 Boelter Hall FEB 191982 University of California, Los Angeles N

f

,1044123t ~455

~

Los Angeles, CA 90024 49

Subject:

Review of the Zion PSS e

Dear Dr. Okrent:

We have completed our review of the Zion Probabilistic Safety Study for the ACRS and have enclosed a copy for your use.

The review was conducted during the period January 4 through February 15, 1982.

In view of the resources and staff expertise available, the focus of the review was limited to the areas. noted in the Introduction to the report.

We have appreciated the opportunity to review the Zion PSS.

If you have any questions concerning the review or if we can be of assistance to you in the future, please contact myself (312-972-4570), L. W. Deitrich (312-972-4563) or D. R. Pedersen (312-972-3335), who was the leader of the current review.

i-

.. x Very truly yours, if. n7 R. Avery, Director H

Reactor Analysis and Safety Division RA:DRP:ar:2264 cc:

J. M. Griesmeyer, ACRS e

1 b

i t

d Review of Zion Probabilistic Safety Study i

3

?

by.

R. Avery C. H. Bowers D. H. Cho Y. W. Chang

. L. W. Deitrich-J. F. Marchaterre

~

T. J. Moran C. J. Mueller l

D. R. Pedersen, editor A. B. Rothman 3,

~: .

R. W. Seidensticker

}

g

'=

5l

x Consultants to the Advisory Committee on' Reactor Safety C-l l.

l 1

i ll Review Performed Over Period January 4,1982 through February 15, 1982 February 1982 r.

ll h( - - i; 2

'I 1.

^

Table of Contente Page C1.0 Introduction /0verview.......................................

4 C2.0 Ba sic P robabil istic Safety Stu dy Me tho dol ogy.............'...

11 C2.1 Comments on Propagation of Uncertainties..............

11 C2.2 Comments on Data Analysi s.............................

13 C2.3 C omments on Human E rror...............................

14 C2.4 C omments on Rel ease Consequ'ences......................

15 C3.0 C on ta i nment Anal y si s........................................

16 C3.1 Core Melt Incoherency (Containment Node D)............

17 C3.1.1 Control Rod Material Melting and Migration....

17 C3.1.2 Core Degra,dation Processes....................

18 C3.1.3 Assignment of Split Fration for Mode D.".......

18 C3.2 Steas Spike / Steam Expl osion (Node E)..................

19 C3. 2.L S teen Expl osions/S team Spi k es.................

19 C3.2.2 Steam Generator Tube Integri ty................

20 C3.2.3 Spl it Fracti on for Mode E.....................

21 C3.3 In-Vessel Cool i ng (Node H )............................

23 C3.3.1 Comment on Assigned Split Fraction for Mode H........................................

25 C3.3.2 Natural Convection Driven In-Vessel

Coo 1 abi l i ty..................................

'25

~

C3.4 Debris Bed Di spersion (Node I)........................

26 C3.4.1 Mode of Vessel Fail ure........................

26 C3.4.1 Di spersal Mechani sm...........................

27 C3.4.3 Split Fraction and Uncertainty for Debris Di spersal Node (Mode I ).......................

29 i

C3.5 Presence of Cavi ty Water (Node J ).....................

30

~

C3.6 Basemat Penetration (Nodes K and S)...................

31 i

C3.7 Cool abl e Deb ri s Bed (Ex-Ves sel ) (Node Q )..............

34' C3.8 Hydrogen P roducti on and Burn..........................

37 l

C3.8.1 Hy d rogen Producti on...........................

37 C3.8.2 Hydrogen Burn Analysis......................

37 C3.9 Containment Pressure Structural Limit.................

41 I t as e

G c'

t i

a 4-C1.0*

Introduction / Overview At the request of Dr. David Okrent, several members of the staff of Argonne National Laboratory have undertaken to review the recently published Probabilistic Safety Stutty of the Zion Nuclear Power Plant of Cosmonwealth

Edison Company, acting in the role of consultants to the ACRS. An allocation of 43 man-days was available for the review. Thus, the scope and depth of the

review have been limited.

In view of the resources and staff expertise available, a few areas have been selected for the focus of the review. These

~

include:

Basic Probabilistic' Risk Methodology (Sections 0, 7 and 8)

Containment Analysis (Sections 2, 3, and 4)

External Events Phenomena (Section 7)

Existing Plant Risk Results (Section 8)

The remaining sections of the' report, Plant A'nalysis (Section 1), Core Melt Accident Source Terms (Section 5), Site Consequence Analysis (Section 6), New Plant Feature Considerations (Section 9) were not reviewed in detail.

An important aspect of the Zion pSS is its significantly lower prediction of Hsk compared to that of other~probabilistic studies, particular1f the Reactor Safety Study (WASH-1400). A comparison of the i

results of these two studies is presented in Fig.11.2-13 and Fig. II.8-27, i

based'on early fatalities as the measure of damage. An attempt has been made to identify the major contributors to the reductions of risk which are indicated in the graphs. Three sources of reduction in risk were examined:

reduction in the frequency of core melt events, reduction in the frequency of.

radioactive release.given a core melt, and reduction in the consequence associated with a given radioact19e release. '

There is essentially no difference between the frequency of core melt predicted in the RSS (4.9 x 10-s/yr based on arithmetic summation) and that predicted in the Zion PSS (5.2 x 10-s/yr from all causes). Of the core melt events predicted in the R15, about 205 result in releases which could cause early fatalities. The remainder cause containment failure by meltthrough of the basemat. The frequency of serious release predicted for Zion is about 6 x 10-s/yr, almost all in category 2R which leads to early fatalities. Thus, the portion of reduction in risk of early fatalities due to reduction in frequency of release for Zion relative to the RSS is about 6 x 10-s/(0.2

4.9 x 10-s) or approximately 0.6.

The small reduction comes about because there are several accident sequences identified for Zion, most notably the " seismic-loss of all AC power", which are of reasonably high frequency and are not mitigated by containment. These sequences put a floor under the frequency of release predicted for Zion, regardless of the effectiveness of containment for other sequences.

In the RSS the contribution of seismic events to risk was considered to be negligible.

'~

-Ine c 1: adden,,to allow distinction between comment and the Zion PSS section nue.-s. -

1 o

o 3

.r Table of Contents (cont'd)

Page C4.0 External Events...........'................ t................. -

44 C5.0 New Pl ant Feature Consideration'.............................

46 C6.0 Gene ral O b s e rv ati o n s........................................

46 References.

................s.....................................

47 e

9 me.

h O

e *

?*

4 e

O g

i 1

e 4-b l

I O

3 6

O e

i e

e 8

P $

D

}

g l

l

/

l

\\.

L s

q

~

ilsing the predicted frequency of category 2R release and the " point.

i estimate" relationship between number of early fatalities and release category I

given in Table II.8-7a, one can estimate values of the frequency of exceeding a given number of deaths /yr from all causes for Zion which can be compared with RSS results and with the Zion results for internal causes only, from Table II.8-10a.

Annual frequency of exceeding the number of early fatalities Number of early fatalities RSS,

Zion, all causes Zion, internal causes 5.6 x 10-9 10 4.5 x'10~7 6 x 10-8 100 1.5 x 10-7 6 x 10-8 4.0 x 10-9 1000.

1.2 x 10-8 4.2 x 10-9 2.4 x 10~9 One notes that the " Zion, all' causes" values are less than an order of magnitude reduced from the RSS values.

The bulk of the risk reduction calculated for Zion relative to that calculated in the RSS appears to be tied up in the difference between the "two risk c' point estimate" risk curves (such as Fig. II.8-2a), and the' level Iso-called "

c.

urves (such as Fig. II.8-24).

It is the " level 2 internal and external risk" curves from Fig. II.8-24 which are compared with RSS values in

't i

Fig. 11.8-27. To quantify the risk reduction associated with the level two

.l risk curves relative to the point estimate one can compare the frequency of l

exceeding 100 'early fatalities based on various assumptions.

(Some values are calculated based on data from paragraph 11.8.10.3.)

o s

1 J

r e

e V6 l.

j e

4e e

.e e

o e

,o.-,.

.--y-,-.m----

,-,___,..,-e,

-.---y._,_--

-+--.-e.~-..~%,rr,---e%-vw.w-.,~.~m-_w"=,

~

~-

_g, Frequency of Reduction Factor Exceeding 100 in Zion Results Case Early Fatalities /yr Relative to RSS Reactor Safety Study 1.5 x 10-7 Zion Probabilistic Safety Study

~

All causes, point estimate 6 x 10-8 2.5 Internal c' uses, point estimate 4 x 10-9' 37.5 a

All causes, level 2, 90 percentile 5 x 10-9 30 th Internal causes, level 2 1 x 10-9 150 90th percentile -

, All causes, level 2, 50 percentile 1.7 x 10-10 880 0

i

' $1nternal causes, level 2, 7.7 x 10-11 1950 l

t -- 50th percentile One sees that the Msk reduction (for the particular measure and level selected) indicated in gbng from the " point estimate" to " level 2" curves is i

a~getorof12atthe90 percentile level and a factor of about 350 at the 50 percentile level, considering all causes. Since this is a major fraction l

of the total risk reduction, some attention to the difference between the two sets of consequence curves is warranted.

The difference between the " point estimate" and " level 2" risk curves lies in uncertainties and conservatism which is asserted by the authors to exist in the site model and in the quantities of isotopes released in various release categodes. Assignment of modified values and their proba-bilities is such as to produce a marked reduction in effective source strength. The table on page 11.8-55 states that for the numbers used, there is a probability of 0.66 that the effective 2R source is less than 10% of that used in the point estimate calculations. This'is a very important effect.

While the mathematics of paragraph II.8.6.2 seem to be correct, there is essentially no justification presented for the va*vs' assigned for the "U" factors (see pg. II.8-55) (defined to be a multiplier on the source strength). While we do not necessaH1y disagree that the source terms and site calculations are conservative in the " point estimate", thi degree of conservatism which is implied by the results is large. The discussion in paragraph II.5.5.1.4 seems to say that there is not sufficient basis for l

quantification of new source tems or source term categoHes, yet that is what is being done with the "U" factors. 0verall, development of the " level 2" curves with the large Msk reductions seems to be of great importance to a very visible result of.the study, but is weakly supported in the report.

)'

-7 P.

3 To summarize, it appears that the overall core melt frequency predicted for Zion is about the same as that predicted in the RSS. While the containment is predicted to be very effective in reducing releases from many sequences, its impact on total risk reduction is limited by the existence of a few sequences which lead to certain containment failure, notably the " seismic-loss of all AC power". Containment limits the frequency of serious release to about 11T of the core melt frequency. The bulk of the. reduction in risk relative to the RSS comes from the treatment of radiological consequences, and hinges on the removal of conservatism thought to exist in the source tenns and site evaluation. This latter area is weakly supported in the report and deserves further investigation.

Evaluation of the probability of core melt resulting from the seismic event with loss of all AC power is clearly a key factor in the overall risk evaluation. The general conclusion of our review of this area is that the seismic analysis represents state-of-the-art work. Some questions about details in the analysis and the Qncertainty estimates are raised but we see no clear basis for discounting the conclusion that seismic events are a major contributor to risk.

i

~

The Zion PSS study has predicted the containment split fraction to prevent serious release to be of the order of 10-4 (see Table II.8.22). This high value of containment effectiveness significantly reduces the potential frequency of release for those sequences which have containment safeguards available. The first two sequences ranked with respect to annual core melt frequency aWas follows from Table II.8.22.

~

6 Mean Annual Containment Split Mean Annual Frequency Fraction to Frequency of (Contribution to Serious Serious

, Core Melt)

Release Release s.

Small LOCA:

1.62 x 10-s 1 x 10-4 1.62 x 10-9 Failure of Recircu-lation Cooling-Seismic: Loss of 5.60 x 10~8 1.0 5.60 x 10-s All AC Power With respect to relative importance to core melt the Small LOCA and Seismic are of the same order of magnitude but because of the effectiveness of con tainment the. frequency of serious release is significantly less for the small LOCA. Two to three orders of magnitude reduction in containment effectiveness for the small LOCA would result in the frequency of release being of the same order of magnitude as the seismic. Clearly, the containment plays an important role in risk reduction to the pubite.

t' s

m---

,,-n_

_m,-,

.._m

?

. Of the scenarios which lead to little or no risk due to containment effectiveness, no clearly dominant sequence stands out. Thus, it is necessary to examine the containment analysis for all sequences, rather than focusing on a particular class of accident. It is instructive to examine the calculations done using the MARCH and C0C0 CLASS 9 codes reported in Section 4.. Six accident

- classes are considered which represent groupings of plant states derived in the plant analysis. The classes are defined in Table 4.2.1-1. -From the MARCH-COC0 CLASS 9' results, it appears that those cases in which Ja pressure level occurs that results in a probability of containment failure > 10-4 (P > 130 psia) have comon characteristics. For cases in which ccre debris coolability is assumed, all those producing P > 130 psia involve multiple.

mechanisms for containment pressurization acting so as to add their contributions. The phenomena include:

Steaming rate in containment due to rapid quench of core

, debris (11 of 11 cases).

Dispersive~ (high-pressure) vessel failure, with debris entrainment (6 of 11 cases).

Hydrogen burn at vessel failure with either 100% Zr oxidation or " experimentally based" oxidation, tne lattar in combination with dispersive vessel failure and entrainment (9 of 11 cases).

In one case, rapid quench plus dispersal of 805 of the core into the containment atmosphere produced a pressure greater than 130 psia without hydrogen burn.

In another, rapid quench plus burn of " experimentally based" hydrogen, with non-dispersive vessel failure leading to large steam generation, produced a pressure greater than'130 psia.

In all other cases of interest the multiple phenomena are involved acting together. These results indicate that multiple assumptions which are more conservative than those in "best estimate" cases are required to produce results indicating a probability of containment failure > 10-*.

The conditions producing containment challenge represent coincident major additions of energy to the containment.

Phenomena I

which reduce the magnitude of the source (less hydrogen, less molten core),

which separate the energy additions in time, or which reduce the rate of energy addition will reduce the threat to containment. The arguments for existence of such phenomena are, in many cases, phenomenological in nature and not directly verified by experiment, but appear reasonable.

If debris coolability is not obtained, the character of the pre-dicted transient is different, but the conclusion is essentially the same (only a very limited number of MARCH calculations were perfonned in which the debris was assumed to be uncoolable). The event which challenges containment occurs much later in the transient, and involves burning of combustible gases produced from 100t Zr oxidation plus corium-concrete interaction at the worst possible time, regardless of combustibility at much earlier times in the transient. Again, two conservative assumptions are needed to produce con-tainment challenge.

It is difficult to detennine from the report just how the MARCH results were used to establish probabilities in the containment matrix i

other than in a very general way, but the results do give an indication that' the low probabilities obtained for containment failure are qualitatively correct.

O e

d

.g.

in general, it is difficult to follow the trail of development of the containment metrix.

It is stated that the MARCH-C0C0 CLASS 9 results are used to establish the split fractions at various nodes in the containment event trees.

In a few cases, there is a general indication of the use of the results for guidance. However, the ~ general impression left is one of

~

qualitative discussion with numerical values somewhat arbitrarily assigned.

This procedure represents the state-of-the-art, but one is led to expect more quantitative use of the calculations than is actually the case! It is also worthwhile to note that selection of e and 1 - e split fractions at various containment modes seems to imply a high degree of certainty about details of ac:ident sequences and phenomena.

It is not clear that the certainty is always justified.

~

Also, there are a number of inconsistencies and difficulties in following the numerical development which detract from the report. For example, one cannot clearly get from the various metrices and vectors re;: resenting the results of the analysis to the summary, Table II.8-22. Some guidance on which plant states go into the various accident sequences would hel p.'

There are inconsistencies in numerical. values for total core melt fre<;uency between paragraph II.8.7.1 and Figure 11.8-9 and between paragraph II'.8.10.1 and Figure II.8-19. There are also inconsistencies between the stated frequency of seismic-caused core melt in paragraph II.7.1.4 and Figure I I ~. 7. 5.

These inconsistencies do nothing to improve confidence in the care wTth which the report was assembled.

The sections that were reviewed were those that match with the area c'f ipecialization of the Argonne personnel. The Argonne personnel involved in i

the-review and their areas of specialization are.as follows.

y.

x e

e O

e

e S.

l

10-Area of Specialization C. H. Bowers Degraded Core Phenomena D. H. Cho Molten Fuel Coolant Interactions, Debris Eed Quenchihg, Steam Spike Y. W. Chang Structural Analysis L.. W. Deitrich

, Degraded Core Phenomena J. F. Marchaterre Degraded Core Phenomena T. J. Moran Seismic Analysis

.C. J3. Mueller Probabilistic Risk Methodology

.4. R. Pedersen Debris Coolability, Molten UO2/ Concrete

' Interaction

'k?8[Rothman Hydrogen Burn T.f.Seidensticker Structural Analysis - Containment v

z...

The coments that follow' reflect the combined opinion of the members

9f.the review group.

~

(

n=: c e

f

\\

's

.u-9 de l

l t

L g

1

\\..

y w -

--v

-'ywgya.g e y-e-

g q +-

-,7-

C2.0,

$asic Probabilistke Safety Study Methodology The probabilistic methods used in the Zion PRA are very similar to the methods used in previous PRAs and the overall explanation of. the methodology, Section 0, was well written and should bit particularly useful to the non-probabilistically oriented reviewer. A word of caution that seems appropriate regards* the use of Bayes Theorem to update failure distri-

~

butions. Although the scope of this review did not allow in-depth comparisons of the Bayes-derived posterior distributions with generic distributions, say as used in the RSS, it is not obvious that unbiased statisticians would be as ccmfortable with the posteriot failure, distributions ultimately used as might be inferred from the text. This coment on the use of Bayes Theorem is expanded below (see Section C2.2).

Regarding the application of the methodology, there are a number of concerns with the actual numbers used as input to quantify the different matrices representing the event trees.

Besides the above coment on using Bayes Theorem to obtain (ultimately) failure probabilities, coments on the fitting of legnormal distributions appear below (see Section C2.2 and C2.3).

The basic thrust of these coments is that more justification for the para-meter values assigned to the legnormals is required.

It is clear that the authors strived to assure that the underestimation of the uncertainties in the RSS was not repeated in the Zion PSS.

Another concern, explained in more detail below (see Section 'C2.1),

is that shortcuts used to avoid performing uncertainty calculations for all the elements of the PRA may have been somewhat ill-advised since applying different values to the branchpoint probabilities may well impact the ranking of the sequences used to estabitsh the need for uncertainty calculations.

In particular, the assignments of branch point probabilities and uncertainties for the containment matrix were questioned by our reviewers. Actual questions regarding individual branch points are covered in those portions of the review

- dealing with containment response.

l As indicitted in our Overview, Section C1.0, a dcminant contributor to the reduction of predicted risk associated with Zion relative to that predicted in the RSS (WASH-1400) is the reduction of the effective radio-

' logical source tems by probabilistic weighting. Although the method seems straightforward, ~ justification for' the actual weights assigned needs to be strengthened. This is discussed in Section C2.1 below.

The final comment on methodology regards the treatment of human errors.

It ' appears that some of the treatments may be optimistic.

It is

. recommended that human error experts be consulted to review on this aspect.

Our preliminary suggestions are shown below.

C2.1 Comments on Procacation of Uncertainties Relevant sections: (as noted in text of comment).

In Section 0.13 (Propagation of Uncertainties) it is stated that uncertainty calculations throughout the study were performed using either the Method of Moments or Method of Discrete Probability Distributions. Aside from soce fai:ly obvious typographical errors in Section 0.13.2, this section i

.. s.

-,w.

.m.a e,-

e w-

+,,--e

comprises a well-written exposition of these methods. However, in actually applying these methods there appear to have been considerable " shortcuts" taken to avoid what seems to be fairly routine and not particularly expensive:

computations in actually calculating the uncertainty bands. Also, and with more important impact on the results, there has been considerable proba-bilistic weighting of source terms for the site matrix which is based on

" knowledge of the site model and experience with sensitivity studies," as stated on p. II.8-53. The basis for the probabilitie's used in this weighting, which causes a considerable reduction in the risk curves from that of the point estimate or unweighted curves, is not explained other.than in Sections 6.3-10 and 11.5.5.1.4 which implies that judgement was used to reduce the cascading effect of sequential, overly conservative assumptions.

To illustrate the extreme importance of this probabilistic weighting, consider the risk category 2R, a dominant category on the risk caused by both internal and external events. By assigning probability weights to the site matrix through a " source term multiplier, U", the effective source tenn is reduced by more than an order of magnitude (see pp. II 8-55 and 56).

The importance of the propagation of this type'of effective source term reduction onto the published risk can be illustrated by comparing the curves for early fatalities from internal events for point estimates, Fig. II.8-2a, and probability-weighted estimates, Fig. II.8-8a, the so-called 1.evel 2 risk results. The point estimate of frequency of exceeding 100 early fatalities (Fig.. II.*8-2a) is roughly one-order of magnitude higher than the 90". probable frequency (i.e. the frequency of occurrence for which we are. 90'. confident can't be exceeded) and roughly.two orders higher than the corresponding 50*.

probable frequency (Fig. II.8-8a). Visually extrapolating the curves on the latter figure, it appears that roughly the 957, level of probability would be attached to not exceeding the point estimate of frequency for 100 fatalities.

In light of the impact of source tens reduction in the site matrix, considerably more detail should have been provided to support the probability-weighting values used to quantify this reduction. The method, however, is straightforward.

To illustrate the aforementioned shortcuts, Section 8.6 (Inclusion

,of Uncertainty in the Risk Curves) (p. 8.6-1) refers to uncertainty calculations being performed "for [only] the sequences which dominate

[ risk]". Section 8.6.1 implies that uncertainties were calculated only for the sequences leading to the dominant release categories 2 and 2R; further shortcuts were then taken within these sequences in calculating the l

uncertainties.

In fact, the uncertainties in the containment matrix seem to have been generated from 3 calculations, high, low, and "best estimate", an approximation which does not appear to be consistent with either of the two methods discussed in Section 0.13.

Although it is stated in the study that these shortcuts do not significantly affect the published uncertainty bands, several concerns arise:

(1) The implication in Section 0.13 that a systematic methodology consisting of the two aforementioned methods for generating uncertainties was used throughout the study is somewhat misleading.

It suggestis a possible disconnect between the methodology authors of Section 0 and the engineers who actually l

L

~- -

e '

arrived at the probability distributions assigned to the various branch points of the accident sequences. This seems especially true in the case of the containment matrix.

(2) Using the point estimate of risk'to rank the release categories for which uncertainty calculations would 'actually be perfonned suggests two questions: First, were the aforement.ioned dominant categories the s'ame for all risk measures? Second, would another ranking indicator, e.g. uncertainty in risk, lead to the same ranking. With this latter measure, the release category that contributed.most to the uncertainty in risk would be ranked number one and so forth. Although, the answers to these questions may well support and vindicate the calculations actually perfonned in the study, we did not find any indication that these questions were addrested. They should be.

(3) Review of the phenomenology associated with the containment matrix event trees has led to some question as to whether the probabilities assigned to the branch points were in some cases optimistic with respect to both value and uncertainty range.

If probabilities and attendant uncertanties assigned to these branch points have been optimistic, short cuts used in assessing the uncertainty bands may be invalid.

In the worst case, the ranking used to establish the sequences worthy of uncertainty

~

i;

.-calculations may be wrong.

In many cases with respect to the s

containment matrix, it appears that the treatment was such that

s. -

r- ---

no uncertainty value was assigned. Specifica11y.. uncertainties in branch points having 1 - e or e probabilities were ignored -

obviously this is only justified if the confidence that is taplied by assigning these probabilities is fustified. Our staff did not always share this confidence.

N (4) Finally, if future studies lead to different rankings or piant changes eliminate or reduce the major contributors to risk, no estimate of uncertainties could be gleaned from the existing document.

r C2.2 Comments on Data Analysis Relevant Sections:

1

~

l a) Section 0.14, Data Analysis (Determining the Frequency of

' Elemental Elements)

The statement is made (p. 0.14.1):- " Bayes' theorem... fs the ideal tool (and, as a matter of principle, the only one) for quantitatively assessing the significance of the various items of ~fnformation". The use (overuse) of Bayes theorem in arriving at failure distributions has been the subject of much debate in both the statistical and the nuclear research com-muni ties. The thrust of the Zion PRA in promoting Bayesian statistics should be toned down to account for this ongoing debate.

To widen the published uncertainty bands associated with equipment failure rates, the lognormal distribution is fitted to " data" by matching the

14 I

20th and 80th percentiles to the ends of the published data range. Reference 0-17 of the Zion PSS is quoted as stating that 20-50% of "true values" fall outside judgmentally obtained 985 confidence bounds.

If we simply assume the pessimistic side of thi.s estimate, that 50% of opinions on failure rates'are

. wrong, then the 25th and 75th percentiles should be used. This!would multiply the 95/5 ratio, a measure of the uncertainty, by a factor of 3 (over the analogous ratio using the 20/80 percentiles) in the example cited on

p. 0.1'-5.

Since this ratio is obviously extremely sensitive to the matching 4

of percentiles associated with.the lognormal distribution, the use of the 20/80 band or any such band should be defended in more detail than is done in the text.

Note also that use-of the 20/80 band was selected to allow for 40%

of judgemental data being outside the published bounds.. If this 40". were a true value but biased toward higher failure rates, then the indicated 20/80 procedure could again be optimistic.

In any case, more justification for matching distributions should be provided.

C2.3 Coments on Human Error Relevant Section:

a) Section'O.15. Human Error Rates.

There appears to be a somewhat arbitrary decision to assign the 10/90 percentiles in matching the lognormal distribution to human error rates. The 20/80 percentiles were chosen to represent equipment failure rates (see coment on Data Analysis, Section C2.2 of our coments). Our ignorance of human error rates exceeds our ignorance of equipment failure rates.

i Therefore, assuming the 20/80 choice to be correct for equipment failure, the choice of the 10/90 percentile band for human error rates appears to be optimistic and counter to our present state of understanding. The matched

" distribution should be broader than. the analogous equipment distrib'ution, i.e..

it should be matched using, say, a 30/70 choice. Obviously, whatever choice is made should be defended with stronger arguments than are now provided.

Further, the treatment of dependence appears to be noncon-servative. To illustrate this consider the cited examples in Section 0.15.2.

With so called "high dependence", the error rate of a worker following a dominant coworker (operator) who has already acted in error is only 50%. This seems optimistic, especially in any stressful situation requiring fast action.

It would appear to be human nature to assume that one worker would follow a dominant worker more often than not, implying an error i

rate of > 505. Even if this is not true, the " dependency" arguments used to establish human error probabilities should be strengthened.

1 l

Another numerical example that illustrates -the concern occurs in the "moderata dependence" example in Section 0.15.2.

The 95th percentile value of compound error by two operators is only twice the value of the published ex pected failure rate for a single operator in improperly restoring a valve, the latter being 0.001. This implies 955 confidence that a pair of workers would fail to properly restore a valve no more tnan twice in a thousand cases, given that the expected failure rate for a single worker is once in a thousand.

This appears overly optimistic.

j

.c l

1 l

~ -

i Finally, high stress situations are stated as' being handled on a case by case basis. Several obvious questions should be answered:

(1) What is the general basis for handling individual cases?

(2) What is the impact of high stress situations on the results. of this study?

(3) Where and for what

" events is high stress behavior most critical?

(4)'How do high stress operator failure rates used in this study compare to low stress failure' rates?

~

As a final coment, we recomended that human error ' experts" be consulted.

It would seem particularly useful to solict such experts from the aerospace industry.

C2.4 Comments on Release Consequen'c'es Relevant Sections:

a)

Section 0.11,' Analysis of Release Consequences - The Site Model, b) Section 6, Site Consequence Analysis.

' The assumption is made that accident-initiation times may be obtained by the random selection of times from a uniform distribution through the entire year. The general procedure practiced by utilities is to run reactors at or near 100". power because of their economic advantages over backup power.

However, outages are required for maintenance and refueling.

Because of economic advantages, it is assumed that the utility will attempt to plan these outages at times of low power demand (i.e., when the need for.more expensive backup power is lower). Since the analysis implicitly assumes that the outages are unifomly distributed through the year, two questions result:

1.

Are outages distributed unifomly throughout,the year?

2.

If not, would the use of histarical and/or anticipated outage distributjon data have a significanc effect upon consequences?

a An appraisal of this potential effect is recommended for the following reason.

Outages may decrease the initiating event frequencies for a particular time of year.. Clearly the weather, evacuation, and population data that apply during times of year (or day) when the initiating event frequencies are highest should be weighted more strongly than others. Sampling from a non-unifom distribution will recognize this potential effect.

e l

' ~

t e

i

o P

C3.0 Containment Analysis-i Relevant Sections:

a) Section 2, Containment Response Analysis.

b) Section 3. Degraded Core Phenomena.

c) Section 4, Transient Arialysis.

d) Section 8.14, Containment Matrix C, Uncertainty.

The bottom line in the assessment of the containment matrix phenomenology involved in probabilistic safety study is the assignment of split fractions (probabilities) to branch points. Thus the report will,be outlined with respect to events selected in the containment event tree. The containment structural limit associated with Comparison of Pressure, (Nodes A, C, G, M, N, P and R) and the issue of hydrogen ignition associated with Hydrogen Burn, (Nodes B, F and 0) will be discussed as a group.

In review of the phenomenology used to estimate the split fractions of the containment matrix and the range of uncertainties in individual events, the following questions were typical of those used to assist the reviewers in their assessment of the split fractions and uncertainties.

1.

What is the level of uncertainty in the calculations used to provide the analyses? If a computer code was used to perform the calculation, were alternate codes available and what would they. have predicted?

~

2.

How strong is the experimental evidence? Have experiments been performed to verify the prediction? How valid are the experiments? Do they agree with predictions?

i 3.

What is the uncertainty level in both the experiments and in the calculation due to non-prototypic effects.

It is our perception that, although the members participating in the Zion PSS study may have addressed these or similar questions on an informal basis, the lack of formal documentation substantiating the assessment of probabilities and uncertainties in the Zion Study represents a significant weakness.

e e

t 6

e

~,.

C3.1 Core Melt Incoherency (Containment Nqde D)

Relevant Sections Reviewed:

a) Section 2.2. Definition of the Containment Event. Tree.

b) Section 2.5.1.3, Core Melt Incoherency Node (Node D).

c) Section 3.1.2, Core Heatup.

d) Section 8.14, Appendix - Containment Matrix C,: Uncertainty.

e) Section 4.1.4, Phenomenological Model Modifications - Coherency of Core Melt.

On page 2.2-10 it ts stated-that event tree nodal question addressed in Node D is: Does the postulated fuel melting progress noncoherently? This question needs clarification as is provided in the folicwing paragraph from page 2.2-4.

... Rods D addresses the antatt of molten con debris uhich could coherently intenet with v1ter uithin the vesset, initiate vesset faiture, participate in initial ex-vesset uater internation and be initialty kvolved in debris bed fomstion or concrete intenetion. The discussion pnsented in Section.T inada natisticatty to the conclusion that less than 50 percent of the con vould be in a matten condi~ tion and stumping at the same time. This is reasonable given the pouer pmfitse, ndial heat loss chanctoristics and structunt netmints uhich are inhenntly part of the con configuntion.

Based on these analyses, a "yes" annuar at Rods D is interpnted as 50 percent of the.aore stumping initially uith the canzinder foltooing after vesset faitun...

Our evaluation of phenomenology and the resulting split fraction is as follows.

C3.1.1 Control Rod Material Melting and Migration Relevant Sections:

1 j

a) Section 3.1.2, Core Heatup.

The paragraph, page 3.1-18, discusses the initial melting and migration of the control rod materials. A mechanism is identified whereby the i

silver alloy migrates downward, freezing as blockages, accelerating the heatup locally and promoting further incoherencin of core melting.

In reality, there i

may be two other alternatives which promote incoherence: (1) the silver alloy could move downward and contact the water where small rapid energy releases could occur which would act to break up and disperse the solidified control rod material (there may also be some local damage to the fuel rod matrices),

or (2) the silver alloy could attack and dissolve the Zircaloy clad causing earlier fuel rod damage to occur (1400*C). Recent data (Ref. C3.1) indicates that alternative 2 may be a plausible early degradation path, with the Zircaloy being attacked at approximately the melting temperature of the control rod clad material.

j i;

l 1

-18.

~

C3.1.2 Core Degradation processes Relevant Section:

a) Section 3.1.3.1, Clad Reaction During Core Uncovery.

The discussion of the core degradation process should be expanded to i

include the significant contributors which support the incoherence argument.

Continuing with the previous comment on control rod melting and migration, additional incoherence ud11 be initiated by ballooning of the fuel rods at the hottest axial locations during heatup,. As the heatup progresses, eutectics of The eutectic zirconium, Ir02, and UO2 can be expected to " candle" downward.

formation process is also endothermic and it has been hypothesized by Chung (Ref. C3.2) that this endothermic feature offsets to some extent the exothermic energy release associated with oxidation of zirconium.

The oxidation rate in a TMI-2 type transient heatup accidents has been shown to be less than previously predicted by parabolic, steady-state data (Ref. C3.2). Zircaloy-4 oxidation rates have been measured in hydrogen-steam mixtures at 1375 and 1500*C.for various hydrogen-to-total pressure For hydrogen partial pressure ratios > 0.5, the oxide-layer grcwth ratios.

rate and specimen weight gain rate significantly decrease as the hydrogen This taplies a similar dependence for content in the gas mixture increases.

the reaction-heat-generation rate. These arguments support incoherence.

, Assignment of Split Fraction for Node D_

C3.1.3 Relevant Sections:

a)

Section 2.5.1.3, Core Melt Incoherency (Node 0).

b) sSection 3.1.2, Core Heatup.

c) Section 3.1.1,. Clad Water Reaction.

The above processes (Comments C3.1.1 and C3.1.2) translate into two advantages during core degradation:

(1) the oxidation process is self-limiting and therefore the actual progression of severe damage may be slower than previously predicted, and (2) the incoherence of the process seems assured, i.e., the damage will begin more slowly and proceed preferentially in The probability of incoherence in this process i

the highest power localities.

is obviously very high and thus we agree with the assigned value of 0.9 for incoherence of melting.

l e

+

e.

e a

O g

,o

. C3.2 Steam Spike / Steam Explosion (Node El.

Relevant Sections:

a) Section 2.2.2, Events Relating to In-Vessel Phenomena.

b) Section 2.5.1.4, System Pressurization Node (Node E).

c) Section 3.1.5, In-Vess'el Steam Explosions.

d) 'Section 3.1.6, In-Yessel Steam Spike.

e) Section 4.4.4, MARCH In-Vessel Pressure Spike.

f) Section 4.4.5,' Steam Generator Tube Integrity Evaluation for a Postulated Class-9 Event Loading for Zion / Indian Point.

Node E of the containment event tree addresses the following issue.

Is the pressure generated from a core debris - water interaction within the reactor vessel, within the pressure boundary failure limits? To address this nodal question two subquestions require answering: 1) What is the pressure source from the steam spike / steam explosion; and 2) What are the reactor pressure vessel failure limits? Our coments will address these two questions.

C3.2.1 Steam Explosions / Steam Spikes Relevant Sections:

a) Section 3.1.5, In-Vessel Steam Explosion.

b) Section 3.1.6. In-Vessel Steam Spike.

c)Section II.5.1.3.22. In-Vessel Steam Generation.

The steam explosion issue is treated in a much more realistic manner than was done in WASH-1400. However, it would appear that considerations given to steam explosions are largely qualitative.

In particular,.

(

quantitative estimates of the steam explosion energetics effect on the t

structural integrity of the raiactor vessel are lacking. The report concludes

{

that an in-vessel steam explosion would pose no threat to the integrity of the reactor vessel. While we believe that there is a general agreement on this point detailed analyses supporting this conclusion would be desirable.

Even if steam explosions pose no threat to the reactor vessel integrity, quantitative estimates of the steam explosion energetics would still be needed to strengthen the report's position on the vessel failure mode.

If a steam explosion were to crush and/or jam the instrument guide tubes, the outcome of the vessel failure mode assessment could be changed.

(increased probability of massive head failure).

Repeated, local staan explosions would also generate fine particles that must be taken into account in consideration of debris coolability. The report merely touches upon the potential for such effects.

Recent experimental results, published after of the Zion PSS, raise additional questions that need to be addressed relative to the pressure suppression effect. At the ASME Winter Annual Meeting in November 1981 Kottowski, et al. (Ref. C3.3) reported that in an impact rode of contact, reproducible steam explosions could occur at elevated system pressure as.well as at at:nospheric pressure. Also,- at the same meeting, Corradini, et al.

(Ref. C3.4) presented some experimental evidence that a steam explosion could

e,.

be triggered at elevated pressures if the external trigger was sufficiently strong. The conclusions of the report relevant to the potential for in-vessel steam explosions for small-break LOCAs or transients should be readdressed.in light of the recent experimental ~ data.

There are several statements in the report that seem to be incorrect and should be clarified.

a)

In a discussion of the requirements for a ' steam explosion. in the Introduction,Section II.5, page II.5-22, the third paragraph, ends with the statement.....As a result of the studies performed for att of the sequences, it is concluded that none of these conditions would be nee,1st aIons att of them (underline adoed). One of the conditions that would not be met is item 1:

"the c'onditions for a steam explosion must exist". The conditions for a steam explosion do exist for some of the sequences considered in the report. Otheraise the report would not have discussed the steam explosion question.

b) The last paragraph of page II.5-22 indicates that a steam explosion would be suppressed at system pressures greater than approximately 150 psi. This paragraph should be reconsidered in light of the recent experimental data referred to above.

~ x,c c)- In the last paragraph of page 11.5-30 twhich continues on page II.5-31), it is stated that "the amount of core unterial that

,1-would conceivably participate in a steam explosion with a layer of water in the reactor cavity that was 1/2 meter deep is less than 10 milligrams of core material" (underl.ine added).

Apparently, tais is a typographical error.

C3.2.2 Steam Generator Tube Integrity Relevant Sections:

a) ' Appendix 4.4.5, Steam Generator Tube Integrity Evaluation for a Postulated Class-9 Event Loading for Zion / Indian point As stated in this appendix, the steam generator tubing constitutes a critical barrier against the release of radioactivity.

It has been postulated that under specific accidents the tubes in these units could be dynamically pressurized to about 4500 psi at a temperature of about 1000*F.

The design values for these tubes are 2485 psi and 650*F. The source of over-pressurization in the steam generator tubes is postulated to be from a steam explosion, and would be a dynamic pressure loading.

The analysis presented uses strength data obtained from tests of Inconel-600 tubing as reported in NUREG/CR-0718

" Steam Generator Tube Integrity Program - Phase I Report," Sept.,1979. The tests that were perfonned used straight sections of tubing, and were conducted at a temperature of 600*F. Furthennore, the bursting tests were made using static internal pressure loads.

l

-n-In order to perfom the calculations,' the analyst had to estimate the ultimate strengths of the Inconel tubing at accident temperatures of 1000*F. This was done using a published correlation between flow stress i and the sum of yield and ultimate stresses (a a ) such as i = 0.66 (a +a)-

wereobtainedfromtest5+onYo)w. 'Thesecofr+elaIions(Ref.2inA 18.1 XSI or 5 = 0.51 (a a

and medium strength steel vessel materials.

To sumarize, the analysis in Appendix 4.4.5 is intended to calculate the estimated bursting pressure of straight and U-bend steam generator tubes, made of Inconel-600, loaded with a dynamic pressure source.

J It dees this by estimating the strength of Inconel-600 at 1000'F by extrapolation of static pressure burst tests data at 600'F on straight tube test sections. The method of estimation is based on a correlation obtained from tests of low to meditsn strength steel vessel me terials.

1 While the resulting calculations may be sufficiently accurate it is important to obtain an assessment from the analyst of the effect of the above stated differences between the actual U-bend tubes and test conditions. The following questions seem appropriate:

1.

The test results for the bursting strength of straight pipes (in Ref.1 of Appendix 4.4.5) were under steady-state or static pressure loadings. How valid are these results when the pressure loading source is dynamic?

2.

The %namic pressure loading effects,could be more severe on the U-bend tubes as compared to the tested straight tubes. What is the significance of this difference?

3.

How valid is the flow stress correlation given in Ref. (2) of the Appendix when it is applied to other materials not tested,

'such as Inconel 6007 It would be very helpful to resolve these questions to better assess the degree of confidence in the approach used here and the resulting calculated bursting pressure.

C3.2.3 Split Fraction for Node E Relevant Sections:

a) Section 2.5.'1.4 System Pressurization Node (Node E).

As stated _in Section 2.5.1.4 " Question E asks if the pressure inside the primary system, as a result of lower grid plate. failure and the subsequent reaction of the melt / debris with the lower plecum, is not sufficient to fail the primary system components". The authors of the report have assigned a split fraction of nearly unity that no component will. fail. The actual value used in the calculation is 0.2999 or only one chance in 10,000 that the pressure boundary will be exceeded (see pages 2.6-2, and 2-6-188 as examples).

In light of recent experimental results (Ref. C3-3 and C3-4),

o recent steam generator tube operating experience *, and uncertainties in steam generator tube conditions and performance, it is recommended that the choice be evaluated further. Additional questions relative to this same issue and the conditional effects on subsequent nodes in the event tree that should be considered are.:

1.

Presdmably by the time that core material can enter the lower plenum the ex-vessel cavity has filled with water. Will the water rise to the level of the pressure vessel and will the resulting thermal stresses induced in the vessel affect the probability of. vessel failure?

2.

If small-scale steam explosions do occur will this bend or jam the instrument guide tubes and affect in the vessel failure mode and could a sufficient quantity of small particles be generated to affect debris coolability?

t' i

l i

s 1

b t

j

=

%INNA pIant.

D

8#

l

~

C3.3 In-Vessel Cooling (Mode H)

Relevant Sections:

a)

Section 2.2.2, Events Relating to In-Vessel Phen'omena.

b) Section 2.5.1.5, In-Vessel Coolability Node (Node H).

~

I c)

Section 3.1.1,.In-Vessel Cooling Under Accident Conditions.

d) Appendix 3.4.5, Debris Bed Experiments.

The event tree defines the nodal question to be...Do the conditions exist for in-vessel cooling-of the core debris?... As noted in Section 2.5.1.5 several items are required for this to be true, they are:

1.

Human intervention is required to provide a source of water.

2.

A heat sink, such as the se:ondary system, must exist as well as a water return path.

3.

The debris can<be quenched and particle sizes are sufficiently large to allow coolability.

With respect to item 3, it is not required that immediate or even near term quench of the debris occur. The basic requirement is that progression of core damage be stopped or significantly slowed. A region of the core could be dried out and above the saturation temperature if this region can be surrounded by a stable crust / particle region.

Our consents on these three subquestions are as follows:

a)

Human Intervention - The reviewers were unable to find any infomation in the report as to the probability of human intervention, thus no evaluation could be performed.

b)

Heat Sink and Return Path - The reflux mechanism cited', Section 3.1.1 for small break LOCA's, as a factor in preventien of core heat up is certainly an effective heat removal method; however, if non-condensibles (such as air or hydrogen) accumulate in the steam i

generator region, it will pose additional themal resistance and reduce heat transfer. As pointed out in subsection 3.1.1.4 this becomes almost a certainty if the fuel is uncovered for long i

periods, releasing significant quantities of hydrogen.

In the assessment on page 3.1.3 in the calculation of the l

maximum, flooding-limited, water return rate the cross-sectional area of the core (12 m2) was used.

Is this the most restrictive area, how about the upper grid plate region; entrance to heat exchanger tubes, etc.

The analyses indicating in-vessel coolability which were completed in section 3.1.1 are unrealistic. The assumption is made that the decay heat generation drives the. core degradation process when in fact the oxidation represents the major energy source. The models are of value in assessing the steady-state cooling requirements after quench of the core has occurred. They have, p.

.however, ignored the transient problem of quench of the bed when significant chemical heat generation and non-condensible gas i

generation is occurring. The amount of water needed to just replace the decay heat generation over time would be,a better indicator of the minimum conditions for guaranteed no damage coolability. Rough j

calculations show that at about 15 power, ~ 45 lb/sec (~ 325 gal./ min.) of makeup would be sufficient to replace the water boiled away.

c)

Debris Coolability - Several coolability models in the literature are available for the evaluation of the maximum dryout coolability

^

limit

of a debris-bed. The reader is referred to reference C3.5 for review of some of the available models and comparison with i

hu.

Before addressing the question of choice of model, one must first determine the anticipated particle sizes as the particle size determines the appr,opriate model to use. The available experimental data Ref. C3.5 indicate that:

1.

If a steam explosion occurs, small particles are anticipated (similar to those resulting from a molten UO2-sodium interaction).

2.

If no steam explosion occurs, larger particles (in the order of several an) can be expected. The extent of fragmentation is

~

expected to be a function of the coolant to melt ratio for molten core / water interactions. T6e larger the coolant to melt ratio the smaller the anticipated particles (however, there is a lack available supporting experimental data to support this position).

The likelihood of a large coherent in-vessel steam explosion is small.

However, small local steam explosions map occur (see Section C3.2.1) which may not affect vessel integrity but can have a significant affect on coolability in terms of the generation of fine particles. The effect of the addition of a small fraction (11.7%) of smaller particles (0.55 mm) to a bed of large particles, 6.35 mm, is demonstrated in Appendix 3.4.5 of the Zion Report. Their results are as follows (p.18-19 of Appendix 3.4.5).

...Tuo experimente von conducted, one with the erutt peticise fitting m,,.*antaty five (5) inekse of the totat bed height, and a escond experiment with the entin bed (11-inches) fitted with the ariatun. The dryout heat flus for the 5-inch and 11-inch ariand bed depth use 'approximsely the same as that fa the 0.55 m partiete....

...These exper*.unt11 results indicate that for beds with targe differences in partiate diamesan (such that she amit partiates fitt the void between the Za me partiates), the entt partiates vitt dominats such that the nautting heat flus uitt be atoser to that of the amiter partiets oise....

Nryout coolantlity limit - Maximus' heat removal rate in a debris bed without local temperatures exceeding the coolant saturation temperature.

M

.,.......--. ~..~

.. - ~

The authors, in their analysis of in' vessel coolability (see page 3.1-13), assume large particles and use as a model for the coolability limit the pool boiling critical heat flux.

(A different model is used in the ex-vessel analysis.) Based upon available data this model appears to be conservative for particles whose diameters are larger than 4 to 6 m at atmospheric pressure (see Fig. 2 of Appendix 3.4.5) and non-conservative for smaller particles.

Based upon the possibility of small local steam explosions producing small particles and the small particles dominating the coolability the choice of the CHF model appears to be optimistic for in-vessel coolability assessment.

C3.3.1 Coment on Assigned Split Fraction for Node H Relevant Sections:

a) Section 2.5,.1.5 In-Yessel Coolability Node (Node H).

As noted in Section C3.3, three items enter into the assigned probability for Node H.- They are:

1.

Probability of human intervention, note as PHI' 2.

Probability of ultimate coolability, note as Pg.

3.

Probability of heat sink avaflabilhy, note as PHS' Thus the probability of in-vessel coolability is:

I P(N0DE H).= (PHI) (Pg) (PHS No values are assigned to the individual probabilities thus assessment of thi conclusion is difficult. The authbrs of the Zion PSS assigned only a probability of success of 0.1 to this node. This value seems reasonable to the reviewers.

Natural Convection Driven In-Vessel Coolability C3.3.2 Relevant Sections:

a) Section 3.1.1.3, In-Vessel Coolability of a Degraded Core.

We agree with the concept of natural convection driven in-vessel coolability.

Significant improvements in coolability can occur when the liquid and vapor flow are co-current instead of counter-current as exist in a normal debris bed.

(In a normal debris bed on a solid surface the downward liquid flow into the debris bed is resisted by upward vapor flow.)

Recent unpublished experimental data (G. Hoffman, KfK, private comunication,11/81) is available for comparison with the proposed model. A comparison is recomended.

O e

26-C3.4 Debris Dispersion Wode (Node I) f Relevant Sections:

a)

Section 2.2.2, Events Relating to In-Yessel Phenomena.

b) Section 2.5.1.6, Debris Dispersion Node (Node I).

~

c) Section 3.1.7, Vessel Failure Mechanism.

d) Appendix 3.4.6, Predicted Failure Modes for a Typical 4-Loop Reactor Vessel in the Event of a Core Meltdown.

The debris dispersion node'(Nede I) addresses the question:

Is the majority of the core debris forcibly ejected subsequent to vessel failure? ~ A positive response to this question according to the authors requires: 1) failure of the lower vessel head by the means of forcible ejection of instrument tube guides followed by a high velocity molten UO2 jet and 2)

- -- interaction of the U02 jet with cavity water resulting in dispersive forces ejecting the core debris out of the ex-vessel cavity. We will discuss these two items separately.

~

C3.4.1 Mode of Vessel Failure I

Considering the importance of the reactor vessel failure moce to the subsequent analyses for short tenn pressure development and long-term coolabili.ty, it would seem that a more exhaustive and convincing anal;/ sis of p-bottom head failure would be in order.

In particular, the criterion selected for vessel failure at the instrument guide tube penetrations - failure of the Nttachment weld at.about 2000*F followed by clear ejection of the tube from the penetration - appears to be quite simplistic.

The principal concern is with the realism of the assumption that r

failure of the weld will lead directly to ejection of the guide tube from the penetration. Mechanisms which could prevent the tube from being ejected l

include:

Interference between the Itube and vessel wall due to differential thermal expansion.

Interface pressure between the tube and vessel wall due to systen pressure within the weakened guide tube.

j Pressure welding of the tube to the vessel wall under the elevated

' temperatures and interface loads suggested above.

Mechanical distortion or resistance to tube motion from external supports.

I Insufficient data regarding tube support, penetration size, guide. tube size, materials, and temperatures are provided, so quantitative evaluation cannot be made.

It would improve the confidence in the split fractions assigned to Node I if evidence of evaluation of these mechanisms were included in the report.

Another potential failure mechanism could be penetration of molt'en corium into the instrument guide tube, either continuously or in a freezing-thawing cycle. Evaluation of this possibility, even if that result is r

y

_._....s s

O O

negative, would improve cocpleteness of the report.

Additional questions relating to the vessel failure modes are:

1.

How well are the material properties known for the reactor vessel in the range of ' temperatures involved in this failure?

In the LMFBR program, considerable difficulty is being encountered in obtaining this type of data for similar safety studies concerning core melts through LMFBR reactor vessels.

2.

The amount andlevel of' detail offered in Appendix 4.4.1 for containment structural analysis is quite high.

In general, the containment structural calculations are straightforward and show quite clearly how the lower bound estimates of potential failure of containment were obtained. Unfortunately, just the reverse exists for the reactor vessel failure mode analysis. There is a general lack of backup detail and sample calculations en its failure behavior, material properties, etc. Considering the importance of understanding the expected mode of reactor vessel fail:tre it would be appropriate to review additional infomation which needs to be provided in a manner similar to that provided for the containment.

L C364.2 Dispersal Mechanism

.'. Relevant Sectiens:

I.:.

a)' Section 3.2.5, DynamN. Configuration of Molten Core Debris.

b) Section 3.2.6, Potential for Kdditional Steam Generation.

j c) Section 3.2.7, Steam Hydrogen Blowdown from the Primary System.

g d).Section 3.2.8, Removal of Core Debris from Reactor Cavity.

i L

e) Section 4.1.4, Phenomenological Model. Modifications..

g i

Given vessel failure for a small break LOCA by failure of an instrument tube penetration, the authors predict a large fraction of the core debris ejected from the vessel will be dispersed out of the reactor cavity onto the containment floor. We agree the mechanisms proposed may be effective in aiding debris dispersal. However, the analyses are one-dimensional, calculations that do not provide a measure of dispersal efficiency (the bottom line). The effect of the limitation of two-dimensionality is more evident if one considers Fig. C3.1, a drawing of the Zign ex-vessel reactor cavity and,

keyway. Two significant limitations of the analyses are: 1) the effects of crust fonnation on liquid surfaces was not included; and 2) the interaction of the molten core with the ex-vessel concrete resulting in substantial gas release were not included except for the region under the U02 ' jet hitting the floor. The gas released from the concrete will aid in dispersal of the debris from the cavity; and is an additional dispersal mechanism.

However, two additional effects of the gas released from the concrete need to be con-sidered: 'll reduction of the water vapor and carbon dioxide to H2 and CD by~

the metal phase of core debris will result in additional energy generation and

2) effect of gas release hindering water reentry into the cavity. No published experimental data are available at this time support the contention that 50-755 of the molten core debris would be ejected from the vessel and s

discharged into the containment floor (see Section 4.1.4, page 4.1-11).

In

I

(

g.

f L-A-. 7 -.

-,f

~

s%.

s b

/

s s

l l

, / * ~~ ~ K

~

's.,

x.

_ _ 7/ -

3

\\

q

-,p g

i.

i 3

n l

l s

..l

-l l

I I

I

- - I T l -...I1.

l'

\\

I 1

If-7*

s 8

.m

_ ~(.

.t

_l u.

s e

}

t.. _ a o

.{

_3

\\

%' q.

rm

,. / f I

CAVITY semer PIT

\\

0,=.s I

\\

/

\\

s

's

/

e' TO ME N

TASLE

\\

~

s e'

III Colti msTRUUCNTATIO04 a

sui 0c Tuecs

(

~--

s 2

e -- 83'-s*

3s'-f ei.

8

\\

g to 910 LOGICAL 8tKLD

/

- T'- 10*--

-e d IS', DIA.

f dl:

10'-0*

49 3 ;4.'"'*,\\

p-sAstastari FLcon

p. 77

\\

au.

1. s

stt '.'r' b".Q:e'.* 4 :

REACTOR VESSEL

y.....:n sup

.Q T

1 t.

'9-(

sTert sinces

\\

1r

... a..wm.. N Q

J 6

. /,

4..$*

4

.. a i

^

s 2.1 i s.t <G. ;,

i w

_r_3:,';t: *.iYes*- ;3 N.

c LAmma

,s

.i

.2 lit 31AtalfMT l.t 1

fEACTOR CAVITY

.4. f.m

,\\

g..

.f l-,lg -

utan.

tmen Ps.4T

.l x

es -="

d

\\. Q)

K 7.

i s

N' s\\ sk j

D-k' % M E W M 3 m m u.:

k'

.'i5

.}~p:*n-1 9 w' >

g

s.,

a

. -r-

.a..

CAVITY FLoom

-7. --

3.. eascasai core stL t is'-s')

se c.

'*!%y.9;o.'s 1.s::m,~.,: w::,.-, scg,.n: e.. c, sh tIUfW_ A'-t d

,i

.HCsson_ A~ A Fl p e C3.1 Zion EO-Vessel Ca01t%

l

-2c-conclusion, we agree with the phenomena as being valid dispersal mechanisms.

The claimed efficiency of dispersal needs experimental verification.

An additional consent lies' with respect to the assumption tha.: the core debris will be molten at the time of vessel failure. ' No analysis was performed that indicates the core debris will be molten at time of failure of the reactor vessel.

C3.4.3 Split Fraction and Uncertainty for Debris Discersal Node (Node I)

The authors of the Zion report place a probability 0.9 that the reactor vessel failure will ' occur by ' popping or sliding out of the instrument tube followed by a molten UO2 jet and a resulting dispersal efficiency of 50 to 757, of the ejected material. The probability of success of debris dispersal for small break LOCAs is given by P

PDD = Pyp DM where POD = Probability of Debris Dispersal Pyp = Probability of Instrument Tube Vessel Failure Mode PDM = Probability of Efficient Dispersal Mechanisms No individual values are given by the authors. We feel the additional justif.ication of the proposed vessel failure mode and disperssi efficiency is needed to evaluate the proposed split fraction. Two different uncertainty ranges are given: 1) in Section 2.5.1.6 the uncertainty range is given as 0.8 to 0.99 and 2) in Section 1I.5.1.4.2.1, page II.5-30 the~ range is 0.5 to 0.99 7

l (which is the correct value).

i N

e 6

9 e

t 9

f

)

/

3o.

C3.5 Presence of Cavity Water (Node J)

Relevant Sections:

a)

Section 2.2.3, twents Related to Ex-Vessel Phenomena Following Vessel Failure.

b)

Section 2.5.1.7, Presence of Cavity Water (Node J).

Node J asks the question whether water will be in the ex-vessel cavity. The authors of the Zion PSS have assigned a probability of 1 - c where c = 10-4 that water will be in tlie ex-vessel cavity. They state that this is based upon a' detailed evaluation of the plant design. The reviewers were unable to find reference to the evaluation in the Zion report.

e 9

e O

8 o

e 4

9

\\

i l

I l

f i

l 1

i 9.

e O

e 4..

..x

~

31 C3.6 Basemat Penetration (Nodes K and S)

Relevant Sections:

a) Section 2.2.3, Events Related to Ex-Vessel Phenomena Following Vessel Failure.

b) Section 2.5.1, Basis of Probability Estimates.

c) Section 3.2.4, Concr.ete Attack-Jet Effect.

d) Section 3.2.15,, Concrete Attack by a Bed of Overheated Core Debris e) Appendix 3.4.2, Literature Review of the Sandia Melt / Concrete Interactions.

4 The authors consider the possibility of core / concrete interactions at two stages in the event tree.. Node K. jet attack by molten UO2 at the time of initial vessel failure for small break LOCAs for the dominant sequence and Node S, ultimate basemat failure given that a uncoolable debris bed exists in the ex-vessel cavity. These two issues will be discussed separately.

Jet Attack The analysis of jet attack is in Section 3.2.4 of the report.

The analysis assumes the form of a quasi-steady-state calculation of a molten jet attacking and ablating the surface. Conservative assumptions of the calculations are:

1.

No credit is taken for conduction away from the melting interface into the concrete.

2.

No credit is taken for a gas film between the jet and the surface.

3.

The assumed value of specific heat of 0.8 XJ/Kg*C of concrete

' neglects the energy associated with release of, water, vapor and C0. The energy associated with water and CO2 release from 2

concrete is considerable as indicated by examination of Table I from Ref. C3.6.

The non-conservative assumption is that spallation the surface of the concrete

'does not occur. The calculated heat flux into the concrete of 20,000 kw/m2 (page 3.2.8) is.an extremely high value.

(The surface heat flux from a UFBR fuel pin during normal operation is 3,000 kw/m2 or a factor of ~ 7 less.)

In Appendix 3.4.2, page 12, in the review of the Sandia experiments, the authors state that spallation was ~ observed during the initial stages of the inter action for a molten steel dump into a concrete cavity. Additional con.

versation'with J. M. Kennedy, Argonne Reactor Analysis and Safety Division, indicates that spallation of concrete with high surface heat flux is not unreasonable. The working slab of concrete in the ex-vessel cavity is 60 cm thick (page 3.2-8).

The removal of the conservative. assumptions in the calculation of jet penetration will significantly lower the heat flux to the surface, thus lessening the likelihood of spallation. The limited duration of the jet mode of attack does make penetration unlikely; however, the use of a = 10** does require additional justification particularly with respect to the effects of spallation.

I TABLE I."

ESTIMATED HEAT EFFECTS IN "CRBR" CONCRETE DECOMPOSITION BASED ON HARMATHY'S MODEL (from Ref. 3.6)

Effect Temp. Range,.. C Heat, J/kg

Effective C, J/.kg-K p

Loss of Evaporable 100-200 81,800 1,923 Mater Loss of Bound 400-600

.92,000 1,565 Water

~ Loss of CO 650-750 215,000 3,255 fromDol$ mite

^ ~

Loss of CO 850-950 1,126,000 12,365 from Cal $1te Fusion -

1400 544,000

Effective specific heat at other temperatures,1105 J/kg-K.

g.

e e

+

m e

g e

p e

Ie e.

C t

Molten Core Attack of Dry Cavity The INTER code was used in the calculation of the penetration rate of core debris in a dry cavity. The INTER code is an NRC supported code that has been replaced by the more recent CORCON code, developed'at Sandia, (see Ref. C3.5).

The INTER code appears to be conservative, both in predicted basemat penetration rate and in gas release rate relative to CORCON (Ref. C3.5). The usefulness of CORCON as stated by its developers is limited to the first few hours (< 5 hr) and/we believe that a similar limitation exists for. INTER. The limiting assumption in CORCON is the existence of stable gas film between the melt and the concrete. After the initial period of high gas evolution it is anticipated that this gas film will not exist allowing intimate contact of the core debris and concrete. A comparison of CORCON and GROWS-II (an-i.MFBR supported code) is being performed in the DOE /LMFBR program by G.E.

~

1 e

t l

I

}

A j

l l

i l

l L

m

-a----

__A--

.m

_34 C3.7 Coolable Debris Bed (Ex-Vessel) (Node Q)

Relevant Sections:

a) Section 2.2.3, Events Related to Ex-Vessel Phenomena Following Vessel Failure.

b) Section 2.5.1.10, Initially Coolable Debris Bed Node (Node Q).

c) Section 3.2.13, Ex-Vessel Debris Bed Coolability.

d) Appendix 3.4.5, Debris Bed Experiments.

The question addressed in the Node Q of the containment event tree is:

...Does the debris posftioned cri~the reactor cavity and containment floor form a configuration which is initially coolable thereby preventing significant concrete attack? A significant uncertainty with respect to the assessment of ex-vessel debris coolability is: What effect does the concrete and gas release from the concrete have upon the quenching process of the core melt in the ex-vessel cavity? This effect can not be ignored as the authors indicate that up to 30 minutes may be required to quench the core. The importance of this is obvious, if one notes that idealized limestone concrete

~

releases, upon decomposition; 375 by weight CO2 and 6t by weight bound

~

water.

Several smal'l-scale experiments have been performed, see Ref. C3.5, which indicate the formation of a stable upper crust between the water and the debris to be quenched. Figure C3.2 represents possible configurations envisioned in Ref. C3.5. Small-scale is emphasized because where a stable crust scy exist in a small cavity, stability in a large cavity is less likely. Sdoping experiments are being performed at Sandia to investigate the process. The goal of the experiments is to investigate the transition from a molten core to a coolable bed. Decay heating will be simulated by induction heating. The gas release from concrete will also provide some limitation upon the rate of water reentry into the ex-vessel cavity by the flooding mechanism as the gas escapes from the keyway.- Slow rates of quenching, if quenching occurs, in the ex-vessel cavity will tend to produce larger particles. The authors of the Zion report do not discuss 'in detail the effects of the gas release from the concrete or the femation of stable crusts which may prevent water reentry into the molten region.

An additional question is formulated as follows. The probability of.

large coherent core melt was identified as a low probability event. Thus the initial fraction of the core entering the ex-vessel cavity may only involve 50% or less of the core, while 50% of the core remains in the reactor vessel. No discussion of the ultimate coolability of the material remaining in the core was offered. Unless in-place coolability can be shown, its later entry into the ex-vessel cavity may significantly affect the long range coolability of the debris in the ex-vessel cavity as a result of small-scale steam explosions generating small particles which will dominate heat transfer, see Section C3.3.

It is likely that in-place coolability can be demonstrated or that the most likely mode of entry of the material into the cavity, should it occur, will be as a solid.

The probability of achieving a coolable bed in the ex-ressel cavity was assigned a probability of 1 - c where s = 10-4 for all events where water is available. Water could enter the ex-vessel cavity as a result of a positive result from either Node J (Cavity Water) or Node L (Accumulator Discharge). Thus the probability of achieving a coolable debris bed is very

r.

~

i.-

)

Water Crust (may not be present)

O o

O O O O

O O

i O

O O ae. sussiing through O

0 O

"O g

matten cor. Mat. ries Q

O Geses Released from Concrete Water B

o*

oQ C C

o C

J o

Frozen Debris 0

(Medium Sized Particles of o

o CO Molten Ccre Meteriell o

Q 0 00 O

Oc 0 -

o Concrete Water Crust (may not be present) g

,P 4 f

d 0 'p II &

p g gg Mne Particulate Core I 4 &

p d Meterial 8

dp 44 g # g g

b 4e, g

gg g*,

g gO q

4s a f a 9 e d,4 d e b ' a# ge0*O s

O-Concrete

~

Yigure C3.2 Illustradon of the possible core meterial configuration upon the roector cavity floor (from Ref. 3.5)

4 high. The, phenomena associated with the quench of the core material are:

1) crust fomation between the debris and the water, 2) gas release from the concrete hindering water reentry into the cavity, 3) reduction of the gas released from the concrete by metal constituents in the melt and additional energy generation, and 4) late entry of material into the ex-vessel cavity.

These phenomena may effect the ultimate conclusion and should. be addressed.

-Experimental scoping programs supported by NRC have been initiated at Sandia to investigate these phenomena.

~

Oe I

)

I g.-

t.

2 *. !I'~'-

l I

~ ~.

l a

f

[

e e

f r

i 1

P l

r ;~

.~..

37_

i.

C3.8 Hydrogen Production and Burn Relevant Sections:

a) Section 2.5.1.2, Hydrogen Burn Nodes.

b) Section 3.1.4, Hydrogen Production from Upper Intervals.

c) Section 3.2, Degraded Core Phenomena.

I d)

Section 4.0, Transient Analyses.

e) Section 4.1.2, C0C0 CLASS 9 Code.

f) Appendix 4.1.3, Flame Tec:perature Calculation, g) Appendix 4.4.9,-Compilation of Results.

The purpose of this section is to discuss hydrogen production and the. requirements for hydrogen burn. Only a limited review of hydrogen production was performed.

C3.8.1 Hydrogen Production Section 3.1.4, Hydrogen Production from Upper Internals, page 3.1-30, discusses the temperatures reached during the transients at the core exit. and upper intervals. The importance of this calculation relates directly to the ultimate pressure in the containment because it is a contributor to the quantity of hydrogen generated. The core exit temperature of 1093 C is quoted as the peak temperature prior to vessel failure which seems somewhat low.

This is just an observation; the output from in the MARCH code was not available; however, the TMI-2 accident produced above core thermocouple data wfitch ' implied temperatures above 1093 C for significant lengths of time (Ref.

C3.7).

Two tables (Tables 4.4c4-1 and 4.4.4-2) in Appendix 4.4.4, show the pressure increase in the pressure vessel when 48000 lbs of water are evaporated rapidly.

In Table.4.4.4-1 the C0C0 CLASS 9 code reports a pressure which is significantly different over a 2 minute rise time when compared to

'apparently the same calculation in' MARCH in which the pressure rises over a single unspecified time step. Some explanation of this difference would aid l

.in understanding.

The contribution of the ncn-condensible gas generation to containment pressurization from i: ore / concrete interactions during the I

approximately 30 minutes required to quench the debris in the ex-vessel cavity l

seems to have been ignored.

i C3.8.2 Hydrogen Burn Analysis l

l C3.8.2.1 Specific Matters of Concern l

The issues addressed are those posed for hydrogen-burn node points

8. F and 0 in the containment event trees, as well as the issues associated with node point R, for the various LOCA scenarios postulated in the Zion A key for major issues ' associated with these, node points is as follows:

PSS.

i Node B Is sufficient hydrogen generated and released prior to core melt and do the conditions for ignition of this hydrogen exist?

L t

Node F Is sufficient hydrogen generated and released prior to vessel l

failure and do conditions for ignition of this hydrogen exist?

m n -

- - ~ ~

_3s_

~

Node 0 Is sufficient hydrogen available imediately following vessel failure and do conditions for ignition of this hydrogen exist?

Node R Does the containment pressure remain within the containment pressure, limit?

C3.8.2.2 Important Assumotions Made in Analytical Assessments of these Issues in the Zion P55 The hydrogen generation rates from oxidation of zirconium by steam-subsequent to core uncovery were derived from experimental data, MARCH predictions and phenomenological considerations. Watet vapor and CO2 generation from core debris concrete interactions and reduction to H2 and CD respectively by the metal phase of the core debris were included but only for the case of non-coolable debris in the ex-vessel cavity. The interaction of core debris with concreta during the quench phase of an ultimately coolable debris be'd following vessel faflure was appaqently not included. The quench time is stated to be up to 30 minutes.

Hydrogen and steam releases to the containment building were calculated by the MARCH code. These releases were then used as input to another code, COC0 CLASS 9, which computed the containment pressure due to steam releases and hydrogen and CD combustion.

i Our interpretation of the important assumptions in the combustion analysis methodology is as follows:

1) Subsequent to their release to the containment the steam and hydrogen (or CD) are assumed to be uniformly distributed throughout the containmentbujlding.

2) MARCH /COC0 CLASS 9 assumes all the hydrogen or CO which is formed

.;in a time period is distributed homogeneously. The combustion of hydrogen

will proceed if the flame temperature criterion is satisfied (see comment 3). The chemical reactions yield their respective exothennic. heats of reaction. The enthalpies of the constituents in the homogeneous mixture of reaction products, steam, nitrogen and unreacted oxygen are then detemined from an instantaneous. energy balance. From this calculation the temperature of the gaseous atmosphere is determined.

3) Flame Tesserature Criteria If the calculated flame temperature is less than HQ'C, MARai/rnrno asw assumed that hydrogen combustion would not propagate.

If the flame temperature is equal to or greater than this value, combustion propagates, and could lead to non-benign containment pressures, but did not lead to detonations. Conservative calculations were performed analyzing cases in which combustion was forced even though the flame temperature criterion was not met. Also delayed burn cases which could lead to conservatively high pressure buildups at the worst possible burn time were included in the analyses.

9e e.

w,. - -.. - - - - - - -,,., - - - - - -- - - - -

C3.8.2.3 Implications of these Assumptions' If concentration gradients of hydrogen and steam existed in the were to be ignited)g (such that pockets of hydrogen-rich, steam-poor zones containment buildin the calculated pressures would be higher for the same hydrogen source term. Such ignition conditions could even lead to detonations. Also the analysis appeaied only to address the consequences l

resulting from direct damage to the containment from the calculated overpressures.

Therefore an open question in the reviewers' minds involves the possibility of damage to auxiliary safeguard (or heat transfer) systems.

Under the conditions for the~various hydrogen release scenarios in the report, it appears that the combustion analysis methodology is l

conservative and valid provided that the possible effects of concentration gradients are quantified.

It.is very reasonable (and convenient in the analysis) to assume that there should be some flame-temperature limits, which correspond to minimum hydrogen and/or maximum steam concentrations, to determint whether or not a hydrogen burn will propagate. Therefore, we feel comfortable with accepting the, 710*C flame-temperature criterion as valid for a given gas comporiition. Also, contingent upon resolution of specific issues (or questions) discussed in the next section, the analytical approach appears to be straightforward and the calculated results valid.

C3.8.2.4 Identification of Specific Issues or Matters of Concern

~

Open questions and discussions regarding these concerns are as j

follows:

l;\\

1.

Are any steam removal rates and/or' steam gradients taken into consiceration in the analysis? Drier sections of the containment butiding could be expected to ignite for lower j

~

hydrogen concentrations than at those regions which had higher i

f steam concentrations.

J l1 2.

What justification is there that locally-high concentrations of hydrogen or CD could not builo up in tne time scale of their i

release to or formation in the containment building during a

{

given scenario 7 A main concern 1s tnat in a large Dreat LOGA at node points 5 or F hydrogen could separate from steam released 9

to the containment, and (in the absence of ignition sources) due j-to buoyancy it could build up to much higher concentrations in i

the' dome.

Perha's the concentration next to the dome itself p

l-could be high enough to be above its upper combustion limit; and j

consequently it would not burn. Somewhere between the dome and the reactor vessel, however, there coul.d be less. steam and more hydrogen; and a detonation is not inconceivable. The explosion limits (or ranges) for hydrogen detonation are ven wide (~ 18 -

597, for dry hydrogen). For small break LOCAs, the Zion PSS analysis indicates that most of the hydrogen is released into I

s the lower reactor cavity after failure of the primary vessel and our concern is not as great. We agree that early ignition is

.i very likely soon after vessel failure in these cases. However, no analysis in the study was found that rules out the possibility of higher concentrations of hydrogen which escape l

W-e=

I

ignition and build up in the compartments between the lower reactor cavity and the upper containiment building atmosphere (no

. details of design were available). Containment sprays and fan coolers will ter.d to. promote a well-mixed system. The efficiency of these systems in promoting a well-mixed system should be addressed.

3.

ilhat effects would structures in the containment building have i

on the propagation of a postulated combustion wave, or conversely could any of the postulated combustion pressures l

d=>ge structures or auxiliary safeguard systems? While it may be possible to rule out containment failure directly due to overpressures from combustion, it is not clear to the reviewers what consideration was given in the analysis regarding indirect effects of combustion on those heat transfer systems such as containment sprays and an coolers which were assumed to be operative during specific LOCAs.

4.

ilhat other experimental programs which address hydrogen problems related to LWR safety are b1ing reviewed, in conjunction with the experiments which will be performed by Fenwall, Incorporated 7 our reasons for this question are: (1) The experiments discussed in the study have a limited range of i

experiment sizes so that surface-to-volume effects may not be adequately covered.

(2) lihile the program covers flame m

temperature criterion concerns, it may not address the range of conditions which could lead to detonation, especially for the non-homogeneous releaser as postulated.

5.

lihat was the basis and use of the hydrogen' burn probab,ilities in Table z.5.1.17 (see also page 11.5-19).

The range of

. temperature is 100*F in Table 2.5.1.1.

Small changes in the N

hydrogen source term, available oxygen or steam may alter the calculated adiabatic flame temperature far more than 100'F.

l C3.8.2.5 Identification of Matters of Importance for Other Reviewers

~

lihat confidence is there that the hydrogen generation rates are conservative for both in-vessel cladding oxidation and ex-vessel core-concrete reactions?

s

}

nihat damage of structures within the containment building could lead l.

to degradation of auxiliary safeguards sys.tems for the pressure tran,sients given in Section 4.

S e

9 P

1 t

V

41 i

C3.9 Containment Pressure Structural t.imi,t, Relevant Sections:

1 I

a) Appendix 4.4.1, Primary Containment Ultimate Capacity of Zion Nuclear Power Plant for Internal Pressure.

i

?

l In general the approach used to calculate containment structural l

capability appears sound and well documented.

The key assumptions made in the structural analysis are: (1) that I

the over-pressure and temper'ature peaEs loading the containment do not occur at the same time; (2) that.overpressurization and significant seismic loadings do not occur simultaneously; '(3) that variability in the calculated failure i

pressure is due primarily to variability in material properties in the steel i

and concrete; and (4) that by careful and conservative selection of the failure criteria, the contai<iment structure still does not actually burst or a

collapse, and that its leaktightness is preserved (i.e., the failure pressure is a lower bound). Overall these are reasonable assumptions.

However, certain implications resulting from these assumptions may have undesirable effects on the containment capability and will be, discussed later in these

,j coments.

i

,l)

It is well known that while estimates of the " lower bound" failure loadings can be made with reasonable confidence, it is difficult to determine just when, how, and where actual release of radioactivity to the environment will occur. It is important, therefore, to keep in mind that the failure pressures calculated in Appendix 4.4.1 do not necessarily constitute failure i

of the containment to contain radioactivity. Even at these assumed lower bound failure pressures, the building structural integrity is still intact and the leaktightness of the steel liner plate is probably not significantly degraded. Thus, to assume release of radioactivity at these pressures to the l

environment is probably conservative.

While many sets of failure criteria can be chosen, the ones used in the lion analysis appear well thought out.

Further, they are believed to be somewhat conservative in the sense that what is calculated is not the failure point of containment, but a value of pressure somewhat below the actual failure. Unfortunately, with our present state of knowledge we cannot be j

quite as certain as to when, where, and precisely how the liner will fail j-substantially and release significant isounts of radionuclides to outside of containment. This, plus other uncertainties, led NRC to state, Ref. C3-5:

3 "We are assuming an uncertainty in the pressure at which the containment j-building will fail of t 105 for assessing the effect of failure pressure unknowns on containment building failure modes and their ultimate consequences to the public."

Some of the questions which appear significant in the context of the estimated failure pressure of the containment building are next presented.

1.

The main job of containment is to prevent uncontrolled release i

of radioactivity from the plant. The key elements in a prestressed concrete containment vessel in achieving this are to limit the stresses and deformations under loads to acceptably J

I N

j

442-low values to assure leaktig'htness of the liner and structural.

stability of the building. Liner failure is of paramount importance. A liner failure would most likely occur at a discontinuity in the. structure such as at the shell ta basemat joint or a penetration. Aside from major openings has there been a systematic review of all other penetrations (piping, electrical, etc.) to assure that no premature failure occurs in the sense that the minimum structural strength or leaktightness of the vessel is degraded?

2.

With respect to effects.of construction errcrs, what was the history during the construction of the Zicn containment sfructure? Were there problem areas over and above what is nonna11y experienced at such sites?

In order to more fully ensure integrity of the containment structure it would be helpful to have an evaluation of the effects of credible construction errors to see what affect they might have on downgrading the calculated structural strength of containment.

3.

Assume the containment is overpressurized at a late stage in the course of an. accident and that this accident, which results in a core melt through the reactor vessel, was initiated by an earthquake induced failure. What is the probability of significant seismic aftershocks occurring during the time that containment is subjected to high pressure?

L. - -

4.

As a corollary to #3, if the containment were subjected to near-failure pressures and the pressure subsided, but significant l!

amounts of radioactivity remained in the building, would the y

damage to the containment structure have significantly degraded y

its ability to withstand subsequent seismic (or other external)

' loads?

S.

Sargent and Lundy does not really calculate failure of containment in the sense of liner rupture but rather attempts to 4

establish a floor or minimum pressure capability of R

containment.

It would be useful to seek their opinion as to 4

just how the ultimate failure and release of radioactivity would occur. For example, would large tears occur in the liner-1 suddenly? Would large penetrations move out excessively, k

thereby tearing their connection to the liner plate? Is there

]

any chance of failure of one or more smaller penetrations due to a combination of internal building pressure and excessive l'

l distortion of the containment shell?

h 6.

It is not entirely clear'as to just what' the probability of 9

failure of containment is and how ~it was derived. For example, on page 24 of Appendix 4.4.1 it is stated: "A confidence level of 95-95* is estimated for the ultimate capacity calculations of the Zion containment, as well as for the original design

! 4

%e 91 rect quote from 41on PSS.

7

~

o

-43,

~

loads." On pages 2.5-2 and 2.5-3 in Section 2 it is stated that Figure 2.5.1-2,

Zion Contaiment Failure Pressure Probability Distribution," was based.on results of the containment analysis in Appendix 4.4.1, with the probability distribution conservatively set to include effects such as material variations.

It would be appropriate to ask for clarification of these statements and to ask just how the curve in Figure 2.5.1-2 was derived. For example, during the Zion PSS the only effects on variability which were explicitly used were the variations in material properties for the steel liner, steel reinforcing bars, concrete, and the prestressing steel.

i S

e e

e 0

e lL

\\

4 t

i e

e b

e O

e O

h

7 i

44

~

C4.0 External Events l

Relevant Sections.

I a) Sectidn 0.17, Seismic Analysis Methodology.

b) Sec, tion 7.2, Seismic Events.

c) Appendix 7.9.1, Dames and Moore Seismic Study..

d) Appendix 7.9.2, Structural Associhtes Seismic Study.

i In reviewing the analysis of seismic ~ related risk we were guided by the following:

1) This is a "first of its kind" analysis of seismic risk integrated into a probabilistic risk assessment. As such, many of the methods used are without precedent and should be considered as extensions of the art rather than applications of it.

2) The NRC-sponsored Seismic Saf^ety Margins Research Program (SSMRP) Phase I demonstration analysis is using the Zion plant as a model. This analysis will result in more detailed methodology which will provide a basis for evaluation of the seismic aspect of the Zion Safety Study when the reports are i

available. However, the same subcontractor, Structural Mechanics Associates, was used by both studies for determining seismic fragilities of structures and equipment. The SSMRP J

cannot be considered an independent review in the' fragilities 1

area.

i l

3) The conclusion that 90f, of the core melt risk is seismic j

initiated may have important implications on allocation of d funding for both improved safety features for Zion and future g

NRC research efforts. For this reason it is important to assess not only if all seismic risks were considered but also if, because of lack of data or methodology, the seismic risks were overestimated.

With these factors in mind we asked the fol'10 wing questions:

Is the procedure used valid and complete? Are the assumptions used reasonable, documented, and consistent both within the report and with other available data? We reviewed the seismicity assumptions briefly and the fragility.

calculations in some detail. We did not attempt to nyiew the seismic related plant Ingic (fault trees). The following observations arose.

1.

This study used a rapid seismic attenuation relation for.

predicting peak accelerations at the Zion site and a low cutoff (zero' probability of ground accelerations above 0.65 g).

Such an assumption is open to question; there are competing theories which would give low prob' abilities of substantially higher peak accelerations. While it is not clear that the assumptions are unjustified, the uncertainty in seismic attenuation is questionable.

't a

w e-w--, -

e%---,,-n

-e-

.w

- r w m-

---S,-,-----------w-d.---

e--------------~-e---,---ir----- - - - - - +

-e

45-2.

The use of a lognormal distribution for describing uncertainty and vaHability in frag 111 ties is probably justified although the assertion that such distributions are accurate to the 0.01 i

level is optimistic. There is evidence that legnormal distH-butions show considerable variation with failure data at the i

.05 to.10 level. This< becomes significant because', as is pointed out in the report, the seismic risk is associated with an interaction of the tails of the seismicity distribution and the fragility distributions. Further study of this issue is warranted.

3.

The distinction' between'5ncertainty and random variation in frag 111 ties is clear within the text of the report, but in the Appendix 7.9 where the calculations are illustrated what is calculated is a total logarithmic standard deviation, s, for the fragility..This is then, oftentimes arbitrarily, divided j

into contributions due to random variation, s, and uncertainty, r

s. As a result, the distinction between these parameters is u

overemphasized in the bo# of the study.

4.

It is the impression of the reviewers that the uncertainties, s, for the fragilities, particularly the equipment fragilities, u

are underestimated. The reasons are:

1) several studies attempting to predict loads on piping during seismic simulation tests have indicated discrepancies of 200-3005. 2) extrapo-lations of linear analyses to failure for equipment which may exhibit hardening nonlineadtfes (e.g. gaps) can grossly overestimate fragilities. 3) There has apparently been no consideration given to uncertainty in quality control, design error, and installation error in the fragility calculations.

~

5. 'The fragility calculations are documented only by generic method and example. For most of the fragilities only the results are 4-given in a Table 5-6 of Appendix 7.9.2 and the specific assumptions are not avail.able. There is at least cne error (the condensate storage tank mean failure acceleration,1, is calculated as 0.81 g but listed in the tables as 0.83 g) and there are differences between the fragilities used for this stu@ and the SSNtP (e.g., service water system buHed 48 inch pi e).

P Conclusions Relative to Seismic Methodology While there are many questionable details.and the uncertainties may be underestimated there is no clear basis for discounting.the primary conclusion that seismic events are a major contributor to risk.

It will be important to compare the results of this study with that of the SSMRP evaluation of Zion to determine the necessity of the more detailed SSMRP methodology. Further efforts to hbtain fragility data and to develop methods.

l for calculating equipment fragilities are essential to reduce the uncertainty in seismic risk assessment.

li

~_

' Fire Events Not reviewed.

C5.0 New Plant Feature Consideration Relevant Sections:

a) Section 9, New Plant Feature Consideration.

Only a brief review of Section 9 was perfor.med. The use of ris.k curves to assess the feasibility and iisk reduction potential of the new plant features requires that agreement on the basic plant event trees, probabilities and resulting risk be obtained prior to investigation of new plant features.

As an example, if you can always achieve a coolable debris bed in the ex-vessel cavity and/or containment floor with the present configuration for a large variety of risk dominating events then there is no benefit of the addition of a core ladle in terms of risk reduction.

C6.0 General Observation's 1.

Several equations are given in the report without reference to source. An example is the equation for the Nusselt Number for a jet impinging on a solid surface on page 3.2.-7.

Neither a reference for the equation or the range of applicability is given.

~

Appendix 4.4.6, page 2, the radius calculated at the bottom of 2.

the page should be 0.072 ft.

3.

The material properties used in calculations in Section 3 are 1

poorly documented. -

f i.

4

'i l

Y

_47_

Referencei C3.1 Personal Comunication, T. W. Parker, ORNL to C. H. Bowers, ANL, January 20, 1982.

C3.2 H. M. Chung, C. H. Bowers, G. R. Thomas and R. Stuart, "Some New Aspects of Core Degradation During a PWR Small-Break LOCA," Trans, ANS, 39,

p. 364-365, November,'1981.

C3.3 H. Kottowski, et al., " Vapor Explosion Studies in a Constrained Geometry and Forced Fragmentatica and Mixing," Presented at ASME Winter Annual Meeting, Washington, D.C., November 15-20, 1981.

C3.4 M. F. Corradini, et al., "Recent Experiments and Analysis Regarding Steam Explosion with Simulant Molten Reactor Fuels," Presented at ASME Winter Annual Meeting, Washington, D.C., November 15-20, 1981.

C3.5 NUREG-0850 (Volume 1) " Preliminary ' Assessment of Core Melt Accidents at the Zion and Indian Point Nuclear Power Plants' and Strategies for Mitigating Their Effects," November,1981.

~

C3.6 L. Baker, Jr., et al., " Core Debris Penetration Into Concrete,"

Proceeding of the Third Post-Accident Heat Removal "Information Exchange"," Nov. 2-4, 1977, Argonne, IL, published as Argonne Rational Laboratory Report i ANL 78-10.

C3.7. Nuclear Safety knalysis Center, " Analysis of Three Mile Island Unit 2 Accident," NSAC-1, July,1979.

h f

c o

9 e

L

. _. _. _., ~ -. -. - -.. - - _. - -, _. -,,,,,. -

P R Ab i

)

3 anent e.ammoine osee:teamsesmeesessia pressessi te m pshBs shsta m a. 9 P. R. D, avis esatiestkIslegedestiegute Intermountain Technologies Inc.'

desdiesmenthehas6 R E C E I Y E ~7 Idaho Falls. Idaho 83401 ADVISORY COMMUEE M January 15,'1982 3DCfDR SAEGUARDS, U.sJut.c.

Dr. J. Michae'l Griesmeyer

N19 m,,.

Staff Engineer Ag

' I $$J011,12,I 2 3 4sh6 Advisory Concittee on J

i i

Reactor Safeguards Washington, D.C. 20555

}

~

Subject:

FIRST ROUND REVIEW OF ZION PRA Re: Letter, J. Michael Griesmeyer to P. Davis, Dec. 15. 1981

Dear Dr. Griesmeyer:

l Pursuant to your letter referenced above, I have reviewed portions of the Zion PRA study and g concerns are contained herein. My review was restricted to the documents which you provided,U, 2) plus NUREG-0850,(3) and infoimation l~

presented at the Class 9 Subconsittee meeting in Denver on December 16 and 17.

~

C.

=

To the extent possible. I have tried to pattern g review after the enclosure l

to your referenced letter (ACRS Review of the Zion PRA), which appears to l

delineate most of the important issues associated with PRA's. However, due to the limited information available and the very restrictive time provided,

!~

it was not possible to do more than an overview of the documents. No in-depth assessment could be made of questionable or sketchy areas. As such, it'is possible that W present concerns are adequately considered in other parts of the study, and some of g concerns may be due to a lack of understanding l

of design details for the Zion plant. Dn the other hand. I have found several l

areas which appear to be of questionable validity, as described in the following I

items.

I have made no attempt to rank or group the items, but I have, per your l

instructions, tried to avoid broad, generalized concerns as well as'what are obviously minor or trivial deficiencies.

I hope g limited review is of some use to you and.the ACRS.

I consider this effort to be a very important step in the increasing use of PRA in the regulatory process, and I look forward to continued participation in the Zion PRA review. My concerns are as follows:

c,vwJcAcowyn waw' q' MT s

\\

a m

M

1.

The computed core melt probability for Zion (s 4 x 10 / reactor year) is quite close to core melt probabilities predicted irj.other PRA's, including

..the RSS.. However, the computed Zion risks from core" melts are substantially less than RSS computed risks. One of the apparent reasons for the difference is the increased integrity ascribed tr, the Zion containment.

I have therefore concentrated a significant port'on of ny review on various aspects of contain-ment integrity, and have the following related concerns:

A.

There appears to b'e no conOderation in References 1 or 2 of gross containment leakage due to failure of the isolation system. This event does not appear on the event trees (as it did in WASH-1400 an.d otherPRA's),norisitconsideredindiscussionsofpotential containment leak paths.

B.

While a deriviation of the containment failure pressure does not appear in the documents provided, it is cor. iderably higher for Zion than Surry (the RSS PWR).

Determination of containment

. failure pressure is extremely uncertain, as has been noted by other reviewers of this issue.

It.would be of interest to detensine

~

if the followin'g factors have been considered in the Zion assessment of containment integrity:

a.

Penetration seal failures due to high temperature /high 4

L pressure' conditions. Seal materials begin to seriously degrade at 400'F. This mode of containment failure has beenfoundtobesignificantinotherstudies,(5.6)but appears not to be considered in the documents provided.

~

b.

Detrimental influence on concrete structure from thennal,

effects. These include added stress due to thennal expan-sion of the liner, stress from thermal gradient in concrete wells, strength ~ deterioration from elevated concrete tempera-ture (such deterioration can begin to occur at 100*C for someconcretes(4)).

c.

Uncertainties in thermal resistance between liner and concrete structure. Such uncertainty can have a large effect on thennal

~

factors described is. previous itans.

m

r..

d.

Interfacing systems failure. During most accident

~

sequences,eithertheLpISorCSIS(orboth)are operating or at least lined up to provide flow to J

the containment. Since much of the equipment'

-(pumps," valves, piping) for these systems is located outside containment, failure 6f this equipment (including pump seal failure) can provide a leakage pathbypassini;containident. These systems were designed to provide flow at containment conditions corresponding to the calculated maximum design basis accident (42 psigI7), modest temperature and ra'diation levels in coolant), and not Class 9 accident conditions (pressure up to 135 psig, high temper-ature' and radiation levels in coolant). The signi-ficantly more severe Class 9 conditions may produce

~

non-negligible failure probabilities in this equip-ment, and the high radiation level's may preclude its f

' repair and maintenance. This pitantial is not consid-ered in the documents provided.

a.

Containment purge system. According to Reference 7

\\ the Zion containment design includes a purge system for hydrogen control which is actuated when H2 **"C'"~

tration reaches 31. Failure or inadequate operation.

of this system under severe Class 9 accident conditions could provide a containment leak path. Such a possibility is not considered in the' documents providad.although much discussion.of conta,inment integrity is included.

f.

Fan coolers. Containment fan coolers appear to be considered operable and effective for most accident sequences. Reference 3 concludes that fan cooler operation

'during Class'9 accidents say be, precluded due to high filter aerosal loadings.

______-,_-______m._-

_.. ~ -

2.

The rates and magnitudes of mass and energy loading on the containment are crucial" factors in any assessment of containment integrity. Many aspects of centaimeent loading during Class 1 accidents are couplex and uncertain.

In this regard, I nota the following:

A.

The assumptions regarding extent of core melt (pg.'II'5-8, '

Reference 1) and metal-water reaction appear more optimistic than generally used in PRA!s.

(In this regard, the production and combustion of H were said to be the most important differences 2

between the Zion and NRC's assessmentI3) during the Denver ACRS meeting. This issue needs continued scrutiny.) While such assumption may be more realistic, they need to be carefully assessed and.iusti.fied, and their-influence on accident progression investigated.

In view'of the lack of ev'en basic physical informa-tion necessary for a confident understanding of core melt accident progression details, it seems prudent that pessimistic assumptions

(-

..be considered to provide a bounding result.

i B.

The MARCH code, us'ad in the Zion ' study, contains inherent uncer-tainties, limitations, errors, and questionable assumptions, some of which are delineated in Reference 8.

A few of these problems lead 'to non-conservative resultsi It is not clear that these problems have been acknowledged and accounted for in the Zion assessment.

(In this regard, I note that the concrete erosion rate quoted for the Zion study is some 5 times greater than that which is more.

generally acceptedI3) based on recent experiments and' analyses).

3.

The Y accident sequence (which ranks second in terus of risk contribution) probability (1.1 x 10~7) assessed for Zion is considerably less than for

('

Surri (4 x 10-6) or Sequoyah ( 5 x 104). While the system design for Zion i

is different, I am unable to reconcile these differences.even when consid '

ering information iit Reference (10).

4.

The documents provided do not contain a discussion of the basis for and uncertainties in event tree functional success criteria.

Such information is essential in order to evaluate the basis and validity of associated plant system success definition.

.... I

~

5.

The potential for and adverse influence.of cascading effects has become a recent ACRS concern.

I do not see any consideration of such effects in the Zion study.

6.

The probability of loss of off,-site power.is much lower (E a factor of 10) than used in WASH-1400 or in other generic assessments.- Furthermore, the*.

probability of off-site power recovery is also much better (about 7 times l

higher at 1 min) than assumed in WASH-1400. While cogent arguments are

]

. provided for such high' grid reflability,' actual data are not. When such i

a large probability difference exists in a critical accident initiator, detailed justification is essential, including the prospects that such probabilities will remain constant in the future when grid reserve's are likely to diminish.

(Ialsofoundapparentinconsistenciesinthe.presen-tation.of power restor 4 tion probability - Sect. II.4.5.2.1.3, Reference 1).

7.

Indefinite operation of the s. team driven auxiliary feedwater pump appears

{

assumed. Depending on system design, steam driven systems require a minimum

~

steam supply (produced in this case by decay heat) for successful operation.

( ~

. Thus, indefinite bperation of these systems cannot be sustained.

o 8.

In WASH-1400, it was assumed that switmhover from cold to hot leg injection j

with the RHR system would be required for' cold leg LOCA's after 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months of RHR operation. A similar requirement does not appear considered for Zion although similarities in system ~ design seem to indicate a similar requirement j

may exist.

I 9.

In view of the very,small risks calculated for the Zion plant, it is not j

clear that the risks from Class I through VIII accidents are negligible by comparison (as is apparently assumed based on the discussion on pa'ge I-14 of Reference 1). Reference 11 does imply that Class. I through VIII hisks are small compared to WASH-1400 results, but it is not obvious that' the same L

conclusion is valid for the Zion result.

[.

10. Common cause failures are always an important co'nsideration in PRA's, and are very difficult to find and assess. While the documents provided(1, 2) give a good general discussion of the subject, the actual quantitative evaluations were not provided.

I am somewhat concerned about the Zion cassen cause assessment based on failure rates quoted in Tables II.4-13

i l

, 6-1 and II.4-15.

For example, based on the failu'rie rates p'rovided, the failure of electrical buses appear completely independent, contrasted with the WASH-1400 assessment that comann cause contributions will fail two redundant systems 10% of the time.

11.

Some failure rates appear extraordinarily low compared to other PRA results.

For example (from Table II 4-15) for the HPIS, Zion used a median unavaijability 'of 1.2 x'io-6 for 2 of four pumps while WASH-1400 computes a value of 1.2 x 10-2 (2 of 3 pumps). The conditions and.

requirements assumed don't seem to explain such a large difference.

Similarly, for small LOCA's, the corresponding HPIS differences are 5.8 x 10-9 (one of four pumps). for Zion,vs 8.6 x 10-3 (one of these pumps) for Suc 12.

In WASH-1400, the results are said to' be invalid after 5 years based on

~

consideration of several factors, which appear to be valid. There is no discussion of a similar time limit qualification for Zion. Such factors as increasing site population, changes in the data base, wear out failures, plant design changes etc. can influence the results as a function of time.

,-- 13~.

Over 90% of the Zion risks are calculated ' o be due to a seismic initiated t

accident.

I have raised the concern in the past that seismic events of sufficient magnitude to cause nuclear: plant accidents will likely~ mini.mize j

evacuation effectiveness due to the high potential for disruption of '

?-

comunications and destruction of evacuation pathways (bridges, roads etc).

In respor.se to a similar concern raised by Dr. Okrent at the December ACRS l

meeting, it was stated that no change had been made in the evacuation model to account for these concerns. Unless communications and traffic arteries necessary for evacuation are (or can be) " seismically' qualified", or special.

evacuation procedures provided in the event of earthquakes, it does not seem realistic or' prudent to assume an unaltered evacuation model, especially i

in view of the dominance of the seismic accident contribution.

14. While the preceding concerns deal mainly with the potential for increasing the Zion risks, it should.be noted that many conservative assumptions were ende in the assessment. 'While the influence of these. assumptions is frequently difficult to evaluate,it is clear that some could have a substantial effect.

Very truly yours, u

, _,,,_.. P. R. Davi s D

_ _ _ AR2JYdd_ Okrent_-,_.___

REFERENCES:

l 1.

ZionProbabilisticSafetyStudy,Vol.1.

2.

Zion Probalistic Safety Study Sec. 0. Probabilistic lisk Assessment Methodology.

Preliminary Assessment of Core Melt' Accidents at'the' Zion and' Indian 3.

Point Nuclear Power Plants and Strategies for Mitigating Their Effects, NUREG-0850. Vol. 1. Nov. 1981.

4.

Task 2:

Concrete Properties in' Nuclear Environment'

'A* Review of_

Concrete Material Sysitems for Ap slication to Prestressed Concrete 1

Pressure Vessels, ORNL/TM-7632, ). J. Naus, May 1981.

5.

Severe Accident Sequence Assessment of Hypothetical Complete Station Blackout at the Browns Ferry Nuclear Plant. D. D. Yue and W. A. Condon, presented at the International ANS/ ENS Topical Meeting on Probabilistic Risk Assessment Port Chester N.Y., September 1981 (paper to be published).

6.

An Evaluation of Selected Accidents Relative to Underground Nuclear Power Plants P. R. Davis, et al., December 1977.

7.

Desian Data and Safety Features of Comercial Nuclear Power Plants (Vol. II),

f ORML-NSIC-55, January 1972.

~.

L.

l 8.

MARCH Code Assessment, S. 3. Rivard, presented at US/FRG Core Melt and Fission Product Behavior Research 'Information Exchange Meeting, i

Columbus, Ohio Nov. 2 and 3,1981.

2 9.

Reactor Safety Study Methodolony Applications Program: Sequoyah i 1 PWR t

Power Plant. NUREG/CR-1659, Feb.1981.

10. ' Probabilistic Safett Analysi. EPRI NP-424, April '1977.

11'.

A Risk Assessment of a Pressurized ' Water Reactor for Class 3-8 Accidents, NUREG/CR-0603, R. E. Hall, et al., January 1979.

1 r

1 l

l i

l-ji y

' Jack W. Rickman

//nclemyf I...

"i

J s

r Sandia National Laboratories mo........u..u.m..n s

g l

February 15, 1982 i

Professor David Okrent 5532 Boelter Hall University of California at Ics Angeles School of Engineering and Applied Sciences Los Angeles, California 90024 Dear Professor Okrents.

In response to Mr. Griesmeyer's letter of December 18, 1981, I've enclosed a brief review and personal observation about the Zion PRA.

I hope it provides food for thought.

i; Sincerely, sh W~

Jack W. Hickman, Supervisor Nuclear Fuel Cycle Systema Safety Division 4412 JWH:4412 rep Enclosures

'l copy to:

BNL A. J. Busiik USNRC J. M. Griesmeyer 9

USNRC F. H. Rowsome USNRC A. C. Thadani 1223 R. G. Easterling 4410 D. J. McCloskey 4412 D. D. Carlson 4412 G. J. Kolb O

g a2 MA I5W

1

'o 1

=

f t

Review of Zion Probabfiistic Safety Study Systems Analysis JackW.Rickman Nuclear Fuel Cycle Safety Research Department Sandia National Laboratories f

,r

\\,

t

)

February 15, 1982 e

. p e

?e o

6 O

i l

t.

M g

I.

g

T.

l'l l.

Introduction r

) review of the Zi'on Probabilistic Safety Study. (3)brief (few days This report summarizes The review was carried.out for J

1 e

The, review focuses on comparing the methodology and results of that part of the analysis which leads to a prediction the ACRS.

of the core melt frequency with other pablished or' ongoing PRAs.

containment response and consequence analysis were not reviewed.

Tc provide perspective, the methods and results of this study are contrasted with several NRC)sponscred studies (g{,PWR power plants; and IREP f

namely, WASH-1400 (Surry)(2, RSSMAP (Cconee)The latter study is unp (Arkansas Nuclear one).

nearing completion.

j Ihe Zion study had a broader scope than the NRC-sponsored The addition in studies or, for that matter, any previous PRAs.

scope most important to this review was the more detailed modeling Thus, the most-of external events, particularly se'immic events.

meaningful comparison with other PRAs is between th l

This may also be of some significance in the regulatory ing to it.

since nonexternal-event core melt calculations may see greater.use in the regulatory environment in the near term than

arena, other parts,of the PRA in general.

The sec'tions covered as part of this review are Section 0,-

Probabilistic Risk Assessment Methodology (Modules 2, Volume 2)t.

Section 1, Plant Analysis (Module 3, Volume 2).

The ' review consisted of reading the appropriate sections and 7

, drawing from previous meetings with the. representatives of Common-Lowe and Garrick, and discussing the l>

wealth Edison and Pickard, study with colleagues having PRA expertise in human reliability,The vie l

data analysis, and systems analysis.

l-are my personal views only, however.

p t

General Comments Based on meetings with representatives of. Commonwealth Edison and Pickard, Lowe and Garrick bot? in the course of reviewing the r.t

tion study and interfacing with them in preparing the Industry /

7 f-NRC PRA Procedures Guide, my impression is that this study has been carried out by competent people and has made significant l;.

methodological contributions to PRA in the area of external events.

j}

Despite its many thousand pages, however, the document does notThe met;

.=.

l:

represent an advancement in scrutability.

and the many apparent numerical errors makes thei i

l(l In general, their estimated core melt frequency does f.;

not differ significantly from core melt frequencies seen in previous on the study.

The next section makes some of studies or other current studies.

j.;

these comparisons.

.s.

\\ -l

Co=parisons with other Studies Core. Melt Frequencies Per comparison, the estimated core melt frequencies from For convenience, I've arrived at several studies are given below.

these by merely susaning the dominant core melt sequence frequencies It is be they advertized as means, medians, or point estimates.

recognized that means and medians may vary by a factor of two or so.

4.4(10-5 (mean)

= 3.8(1 -5))(mean)

=

Zion Zion (excluding seismic)

= 6(10~ )

(median or point estimate)

Surry (W(ASH-1400)

Oconee RSSMAP)

= 8(10" )

(point estimate)

= 9(10- )* (point estimate)

ANO (IREP)

As can be seen by this comparison; the Zion results are at the lower end, but not markedly different from results of these other studies.

Dominant Accident Inid.iators (excluding seismic)

It is also interesting to compare which initiating events lead.to accidents either dominating risk or dominating the core For purposes of comparing the systems analysis, I've.left out the seismic initiator which was only included in the melt frequency

~

Zion study.

s et sc t.'

y

.e l

o

g g

L

//**

yll4;'

eo

oo c

zien x

x x

x x x x

x x x x x x x x

sorry (w(ass-14ool Oconee RSSHAP) x x x x x x x x x x X

X X

X ANO (IREP)

.X X :X l

Initiators identified Initiators Identi-as important to risk.

fled as important r

to core melt probability As can be seen on the right of the above table, the initiators i

identified in the Zion study which are important to the frequency o

' Draft Results 3

.._y..,.--

______.m__.._

(.,,.-

o l

i

\\

of core melt are not appreciably different from those identified Two noteworthy differences are the absence in other studies.

from the Sion list of " Loss.of offsite Power (LOP) transients" The latter does not and the " transients without loss of MFW.*

show up since,the main feedwater (MFW) was assumed in,the zion The lower a somewhat conservative assumption.

study to be lost, no doubt, stems from the lower importance of the LOP transient, LOP frequency predicted at Zion.

They have never had an LOP and Thus, the differences in have high redundancy in the grid system. initiator importance in th assumptions or apparent plant / site differences rather than method-The lop initiated sequence has been questioned, however, ology.

and will be discussed at greater length later.

For the left side of the above table, rnly two nonseismic initiators are identified as importants the interfacing system The explanation for this appears to LOCA, and LOP transient. stem not from a system analysis methodology Since the study indicates differences in containment response.

there exists a low probability of containment failure unless boththe on containment sprays and fans are lost,(interfacing system LOCA).or are those which bypass containmentones Which represent a comm Thus, even though LOP transients are predicted to be very

{

infrequently, they give rise to station blackout which is a common-sprays.

cause failure set for both sprays and fans and thus become important 2-The point here is that the differences in what initiators not so much a product of system differences or sys to risk.

f differences as it is a product of the significantly differ.ent j

containment response predicted in the study.

i It.is of interest to continue the comparison into lower sub-as an example, sets of the analysis.

The next chart compares, auxiliary feedwater system (AFWS) failure probabilities for loss of MFW transients between the four studies.

AFW5 Failure Probability Plant (as best we can tell) 4.6 (1g-)6 )

tion 4(10-Surry (W(ASH-1400) 2.4(1g)4) oconee RSSMAP)

ANo (IREP) 3(10 This numbers above include operator recovery of the AFWS to that extent operator recovery was considered in the specific It is at this level we begin to see significantNUREG-0611(4),

studies.

differences in results from what one might expect.

which included a comparison of all AFW5s of Westinghouse-designed identified zion as having an unavailability operating plants, As I' recall, this principally stemmed'from higher than surry.the Zion plant having a single manual valve at the condensateTh ptorage tank which is shared by all three trains.

estimates that failure of this value can be detected, diagnosed

~

f e' t

and manually switche over with a probability of.993 (failure probabilityof7x10g).

At first glance, this appears to be a large assunt of credit for this complex a series of human actions.

Apparently, this stems 'from the fact that the pcaps will trip off under these conditions, thus will not be damaged and therefore several factors significtnt, time is available for recovery.

may influence behavior, however, including diagnosis time, the undesirability of valving the backup lake water into the steam generator, or the potential for trying " feed and bleed." This more favorable analysis in the Zicn study than_in NUREG-0611 may warrant further investigation.'

To compare the treatment of human reliability in general, a comparison is made of human failure to switch from injection to recirculation during a large LOCA:

Failure Probability O.004 Zion 0.003 surry (RSS)

^

Oconee (RSSMAP) 0.003 0.001 ANO (IREP)

These numbers are, of course, highly dependent upon plant design, particularly the switch-over time available after the The numbers derived in the Zion study are con-initial alarm.

sistent with predictions in other studies, although, again, slightly on the lower side.

I *'.

Methodoloev d

The following are general observations about the methods being used in the systems analysis:

Initiating Events The Zion study team appears to have tre ted the identifica-tion of initiating events quite thoroughly and more formally than the other studies.. Their identification and categorization of initiating events should prove quite useful in~ future studies.

system Modeling As with other studies, the Zion study team turned to event How-trees and fault trees for cataloguing accident sequences.

ever, their use of event trees and fault trees is somewhat They have chosen to carry several support systemSuch an approach different.

faults (e.g., AC bus failures) in the event tree.

usually limits the number of support system failure states As you by the analyst based usually on a probabilistic argument.m i;

t:

u-m e

e.:

i My personal experience is that when such simp:li-power failure.

fications are made, the models then have limited utility for future studies and thus this is not usually the method-of-choice.

Nevertheless, if competently applied, this method should yield N

valid results.

similarly., the fault tree analysis took on an abbreviated As I understand it, the front line systems were redrawn

\\

in block diagram form, and simplified fault trees' depicting the character.

The system cut sets were F

most important cut sets were then drawn.for each sequence reflecting the derived, apparently by hand, The sequence cut sets were dependencies for that sequence.

apparently not derived.

A similar technique was used in an earlier 7.SSMAP studyit (which I was involved in), and if competently carried out,

=

our experience has been, however, should yield valid results.

that such abbreviated models result in analysis that are diffi-eult to follow and, therefore, diff,1 cult to use and draw insights from.

Component Data The integretation and use of component data has emerge'd as Some have argued that the Zion report s

a controversial issue.

Others reflects a new philosophy.that must be evaluated carefully.

have argued that this "new philosophy

yields similar resultarEasterling

- - - +

therefore, is unimportant.

on-the treatment of the V sequence, a dominant sequence in the Zion and many other studies, and has shown that the sequence mean changes about four orders of magnitude depending on whether the WASH-1400. parameter bounds are used as 5th and 95th percentiles, j

or as 20th and 80th percentiles, a choice thdt seems to be highlyIf this cho subjective if not somewhat arbitrary.

and if the Easterling calculations do reflect what was done in the Zion study (it is not always easy to tell), then one must conclude that the methodology allows one to get any answers one wishesIf that is tru within the four orders of magnitude.

I meaningfulness of the results must be judged. highly suspect.

With.

believe this is an area that should be further investigated.

Bob's permission, I have attached a memorandum with his findings.

Sequence Quantification The matrix algebra formalization of quantification is new to It appears to be a useful contribution to PRA.

Although it does allow one to determine the most important initia

PRA and novel.

or anything else ting events, we have found it difficult to use it,

Thus, in the study, to find the most important sequence cut sets.

what fault events cause a sequence to be important is difficult to ascertain.

9 i'

b

' 4-1 m

u 1

j i e

seismic Analysis I have not delved into the seismic analysis in detail.

I do i

know that this is pioneering work in PRA.

The question of.the acceptability of this methodology has been discussed at length.

5 within the development effort of the PRA Procedures Guide, particu-larly the IEEE/NRC Review Conference on the PRA Procedures Guide.

L It was the purpose of that conference to bring the PRA community together to judge acceptability of the methods covered in the Guide, and my reading of their conclypions is that this method of evaluating seismic risk is being judged acceptable at least by the majority L-of the practitioners.

I would have to admit, of course, that this r.ethodology has not yet seen the test of time.

.i.

\\

Human Reliability W

the human reliability methods appear to follow NUREG/CR-1278 and I believe represents the state-of-the-art.

Swain has indicated be relatively conservative. (6) human error probabilities appear to that most of the estimates of some exceptions to this are noted later.

l R'

specific scenarios l2.

~-

Three accident sequences have come to my attention-which 3 i

ultimately will need clarification.

}

u d

s by Busiik.Igjt hva to do with an ATW5 sequence and has been The fJ I

As he points out, the human error probability of r

0.004 was used that'the operator would fail-to open a necessary block valve in the 2 to 10 minutes time required following an l_.

This, as he poin,ts out, appears extremely optimistic.

ATWS.

Busiik also suggests that a human error probability of 0.64 to becomes 5 8x10 g appropriate in which case the ATWS/ core m 0.95 may be mor and therefore an important sequence.

I would agree with Busiik's conclusion that this should be reviewed more i

/,'

closely.

The second area which has been pointed out by Kolb(8).is the C

!4 '

credit given for spray injection given a core melt due to recircula-tion failure following a M.

This credit is given on the basis gallons of water will remain in the Refueling Water that 100,000 storage Tank (RWST) when switch over to recirculation from injection

't

[

This injection water provides another source of water to occurs.

insure spray operation and reduce the probability of containment L.,.,

failure.

The procedures we have indicate 'that an injection spray

!('

pump will be left on until the NWST in emptied and we have found no l.

Thus, the RWST may Loch procedural steps for refilling tae RWsT.

l.

be depleted of water when needed during core melt for containment 3

protection.

This could impact significantly the plant damage bin lC Again, this has the character probabL11 ties and perhaps the risk.

I of providing credit for operator action beyond that which is typical 7

of PRAs and therefore may deserve further review.

4 f

n-

.>~n-

- - ~ _.

,e i

The third accident sequence, Station Blackout due to a LOP is a dominant contributor to risk.

The calculation is The questions transient, or has been pursued by Busiik, Easterling, and Kolb.

arising have to do with several factors, including the. treatment of i

the increasing trend in the unavailability of the turbine driven pump, the appr.opriateness of the LOP transient frequency prediction, Depending and the onsite emergency power restoration assumptions.

on the way some of these are treated, the mean for this sequence could be approaching two orders of magnitude higher than the study This also deserves further investigation.

predicts.

summary In summary, I believe (admittedly based on a somewhat limited review) that the systems analysis portion of the study appears to be an adequate methodology carried out by competent practitioners.

Perhaps the methodology requiring the closest further scrutiny is Three that used to arrive at the component failure distributions.

the LOCA sequence with late melt, sequences, the ATWS/ core melt,should receive further study.

Obviously, a and station blackout, final opinion on the appropriateness of the study methods will require a more detailed review than completed to date.

i I kMrlieve, however, the interpretation of the data in this For example, had the i.-

study should be carefully considered.

WASH-1400 data bounds, used to calculate the V sequence (see Easterling's paper attached), been interpreted as 20th and 80th percentile values as was done throughout most of the rest of the l

j study, many insights advertised as-resulting from this study

~

frequency would not have been less than 10-4,he mean core meltseismic would i

y would have been.different.

T risk, and the sequences dominating core melt frequency would These seem like significant insights have also dominated risk.

to rest on an interpretation of the appropriate use of the bounds, an interpretation which appears to lie some-WA58-1400 where between highly subjective a'nd somewhat arbitrary.

r h.'

y-I

/

1

?

t' r

,s*

f

~..

t References Rion Probabilistic Safety Studyr Conanonwealth Edison Company (1) of Chicago, 1981.

Reactor Safety 5thd, WASH-1400 (NUREG-75/014), tiSNRC, (2)

October 1975.

Reactor Safety Study Methodology Applications Program,NUREG/CR-1659, (3)

SAND 80-1897/2, Oconee 43 PWR Power Plant, Vol. 2: Kolb, Hatch, May.,1981 Generic Evaluation of Feedwater Transients and S (4)

Plants, NUREG-0611, USNRC, January 1980.

Handbook'of Human Reliability Analysis with Emphasis on Nuclear Swain, Guttman, NUREG/CR-12978, (5)

Power Plant Applications BAND 80-0200, March 1980.

A. D. Swain, Sandia National Laboratories, personal communica-(6) tions.

BNL Peer Review of the Zion Probabilistic Safety Memorandunt Study, A. J. Busilk-to'R. A. Bari, 1/18/82.

(7)

G. J. Kolb, Sandia National I4boratories, personal communica-(8) tion.

5 e

'I 4

e s

/

e D

4 4

y

-. -w

y Sandialaboratodes l Am

.u u.

i 8 ate:

February 9.1982 barmor..ces m j

e c..

. to:

J. W. Miclean 4412 "O $

from:

R. G. Easterling 1223 821*ct:

Coments on the Zion Inferfacing LOCA Analysis TheinterfacingLOCA(pp. 1.3-72.77) is dominat:<d 'by PLE's (Pickard.'

Lowe, and Garrick) estimates, by the rupture of tvo motor-operated valves in the RHR suction path. The scenario is that fi.rst the upstream and then the downstream valves rupture some time during a one year period between Let A denote the hourly rate of valve rupture (assumed refueling outa s.

to be constant. Suppose further that both valves are subject to the same

~ ' - '

'l rupture rate. Then the scenario probability is 6

l Q = 1 - e-AT(1 + xy),

I.

~

5-where T = 8760 hrs. (This is a basic reliability result for the case E standby redu ancy.) For small AT. Q = (AT)Z/2. PLG erroneously took Q = (AT) /4. Since our purpose here is to explore their use of WASH-1400 information, for the sake of comparison we will use their expression (which. incidentally. is not in the report but was elicited

~

f in conversations with the authors).

7 In PLG's Bayesian analysis 1 is assigned a prior dijtribution. That distributiN.is lognormal with a mean of 2.66 x 10-* and a varia 4.32 x 10-The basis for this distribution is not g ven, bu it-turns out that if one takes the WASH-1400 bounds of 10- to 10- on C

the hourly rate of valve rupture and equates them to the 5th and 95th percent 11es of a lognormal distribution, this mean and variance result.

This prior distribution is not modified by Zion data. in contrast to' PLG's usual procedures, so it is the bcsis for their subsequent results.

GivenQ=(AT)2/4 and the assumed distribution of 1. the mean of Q is' l

2 2

mean(Q)=(T/4)mean(1)

=(T/4)[mean2(A)+ var (A)3 2

1

= 9.7 x 10-8 (Anothe-scenario considered is a leak of the upstream valve followed f

by rupture of the downstream valve.to the above yields P Adding its

(

for the probability l

E J' i L

February 9,1982

-2 J. W. Hickman. 4412

~.

The second equality above is a of the interfacing LOCA. p.1.3-77). standard relationship am l

consequence of the lognormality assumption.

PLG's stated methodology was to treat WASH-1400 bounds as th 80th percentiles of a lognormal distribution 7 and. the variance of A Then the prior mean b. A would be 4.28 x 10-Substituting these values f

would be 3.36 x 10-l expression for mean (Q) yields mean(Q) = 6.5 x 10-3, Part of a surprising five orders of magnitude' larger than PLG's result.

i We did this difference is due to approximating 1 - exp(-AT/2) by(AT/2.

a 5000-run Monte Carlo and estimated. the mean of (1 - exp -A j

to l

be 3.9 x 10-9, so there are still four orders of m results from the change in var (A) and the way in which var (A) contributes to PLG's mean value, their point estimate.

For PLG's Let y and o denote the mean.and standard deviation of In(A).

In

' assumptions a = 1.40 8) =. g the 20/80 assumptions Usin

~

18.42.

By increasing a from 1.40 to 2.74, the mean is increased u =.1n(10-bothcaseg/2).

n The variance of.a lognormal distribution is exp(v + o' exp(2u + o )(exp(o ) -1). Here the' increase in a results in incre by a facto of.16 2

~~'

In the above calculations for mean the variance by a factog(or 77,719.A) and thus the large difference is var (A)overshadowsmean The figure below'shows the two lognormal diskributions drawn on arithmetic scale.' uwed dfstributions on arithmetic scale.

scale transform to greatly s Whether they accurately depict anybody's state of

However, the 20/80 assumptions, rather than 5/95,13 not, question.

5% in the latter exerts considerable leverage..

This analysis shows-the extreme sensitivity of PLG's results to, assumed prior distributions (and the advisability of having dat illustrates an unrecognized, though conservative distribution for A, then modified it by data consisting of f failure methodology.

Then the posterior distribution of A would have (approxim Z

The posterior mean of A T hours.

a mean of A* = f/T and a variance of A*/T.

/

.i would be mean(x2). x 2 + A*/T s g e

,,--,--.,,.--_.,4,-,

,_-,--,.-.,---.-,,m.--

J. W. Hickman, 4412 February 9,1982 f we regard this as a point estimator of 12 and take its expectation with respect to the sampling distribution of f, the result is j

E [mean(1 )3,x2 + 21/T.

2 f

Thus, as an estimater of 1, the posterior mean is positively biased 2

and can be seriqusly so, as the above results illustrate. 2,lternative A

estimators of A4 based on non-Bayesian methods wguld be 1*

if one. wanted a maximum likelihood estimator, or A*4 - A*/T, if one wanted an unbiased estimator (though this can turn out negative, so it might not be used in such cases).

RGE:1223:dw

.._ y

' '".mamwm,.m-n 2

--__z

~

j a %.Carh ew

e g-r :-

goa' y

\\

s l

se

. W er p f4

p.4 /e gy l'~

L x(p= -st.u, c's 2.ss); n,9 JKM w liLJ.

W n

S of L,2 pre' ruwel ! of h

5.1yn*'"

I et

=

~

Lj Ap(A3 -/gto 5" * /. NP) J o g W 8#***e law.ie es t/pg g /.*4,sj gsE j

f U y of 7.b1M reeslal of h* lof UM" 1

I,.:

[

i./

e I

!(

s j

s me _ _.___

m m

se-a.

_

ML20127E184

Text

SUBJECT:

Dear Dave:

Subject:

Dear Dr. Okrent:

Subject:

Dear Dr. Griesmeyer:

REFERENCES:

Navigation menu

Search