ML20127E267

Review of Zion Probabilistic Safety Study

ML20127E267
Person / Time
Site:	Zion  File:ZionSolutions icon.png
Issue date:	03/24/1982
From:	Lipinski W ARGONNE NATIONAL LABORATORY
To:
Shared Package
ML20127E176	List: ML20127E173 ML20127E184 ML20127E252 ML20127E267
References
FOIA-85-44 NUDOCS 8506240501
Download: ML20127E267 (8)

Text

-

Review of Ifon Probabilistic Safety Study by Walter C. Lipinski L

Argonne National Laboratory 5.~...

f_;

~

March 24, 1982

,j t

N i

l A f, *,

e l

l r

l t

8506240501 850304 PDR FOIA PEDROO5-44 PDR 0

~

l

• ~j 4'

l' m

.s

.m....-_-

.o

This review covers the following sections of the Zion Probabilistic Safety Study:

Module 1 Introduction, Back' ground Information, and Sumary Report Module 2 Section 0 - Probabilistic Risk Assessment Methodology Module 3 Section 1 - Plant Analysis (up to and including Section 1.5.2.2.3, Engineered Safeguards Actuation System)

The coments as listed-will refer to specific page numbers and report sections of the ZION report.

P. 11.4-13 3.

Comon Cause Failures The comon cause failures were modeled using the followi$g relationships:

~

IND CC g =q

1. q l

= (1-s) q" + Sq 0<3<1

~

where.'

"Q a subsystem unavailabili1;y, R

it = single component unavailability,

_ s a conditional probability of redundant system unavailability.

The report states:

"in some cases we have used judgmental or bounding S-fac-tors (e.g., Section 1.33.6 s=1)."

If a value of 8 = 1 is used, then QR

• 4.

which states that comon mode unavailability can never be less than the single component unavailability. There is no basis for such an assumption.

A more general formulation is given by Q = sq" 0.< s < =,

R

=

In this formulation a can be selected large enough to cause QR > q.

The bas'ic

\\.

problem lies in selecting S to properly account for comon cause failures.

The proposed formulation does not impose an optimistic lower limit.

The applicant should be asked to justify the use of his formula.

j P.' 11.4-14 C.

Comon Abnormal Environment.

The report states:

"This is unlikely; we have centuries of experience to f

help up in cataloging potential conditions." The applicant should be asked to i

[

present his centuries-old catalog on contributions due to:

}

6

... Earthquake,

Fire,

~

- Flood (internal and external),

Tornado and Tornado Missiles, Aircraft Accidents, 4

Transportation and Hazardous Materials, Turbine Missiles.

as applicable to nuclear power plants.

P. 11.4-16 Section II.4.3.3' Systems' Interactions As used in this report, systems interaction has a very limited scope. The obvious dependencies have been identified such as supporting systems. Were the not-so-obvious systems interactions, such as water in air lines, consi-dered?

- The report states:

" Residual heat removal is accomplished by forced or natural convection from the core to the steam generators, --." Has natural convection been demonstrated for the ZION reactors?

P. 11.4-19 Line 10

' ~~

The report states:

"The containment building for the ZION 1 and 2 units is i~ olated on the air side except during short periods of venting under s

administrative control." How many hours per year is venting allowed and did the. study include venting in the risk analysis?: Are the vent valves able to close against a @namic load?

\\

P.~II.4-40 The discussion of the RHR system includes the following statement:

"If both valves had discs which had failed open, this condition would become apparent and corrective action taken. For this reason, the cutset involving disc failing open in both MOVs is excluded from further consideration." What corrective action can be taken? What is the numerical probability that both discs fail?. is the control room affected by a rupture of the RHR system?

What are the consequences of an RHR LOCA?

P. 11.4-43 The following statement is made:

" Failure o.f all' five component cooling water pumps due to loss of electric power requires that all of the Unit 1 ESF buses are dead and that, additionally, two of the Unit 2 ESF buses are dead.

Such events are extremely unlikely." What numerical value of probability is to be asigned to " extremely unlikely?" A PRA is supposed to be quantitative and terms like extremely unlikely should not be used unless they are defined by a numerical statement.

~ !

~

e P. II.4-46 11.4.4.2.1.2 Failure Data Sources L'

How Wlere the LER's used to provide failure data? The LERs report fail-ures, do not report successes', 'do not report operational hours, and do not report hours in standby.

~

P. II.4-50

~

Table 11.4-5 lists Relief / Safety Valves - Premature. Opening.

Where is the data for " failure to open" and "f.ailure to close?"

P. 11.4-51 Table 11.4-5 For systems that are in normal operation, " failure to ruA" is suffi-cient. For systems which are in standby and start on commanF, " failure to start" is important.

Is there data for " failure to start" of the Motor-Driven

-Containment Spray Pumps? Did the containment analysis include a " failure to start" mode?

-P.II.4-74 Table II.4-12

12.-

The variances listed for the ZION plant specific events indicate the distributions are quite narrow whereas the PWR Population Generic variances indicate broad distributions for Initiating Event Categories 7, 8, lla, and

13ai What effect do these broad ' dis _tributions have on the final conclusions.

of the ZION PRA?

l

'P.'II. -106 Table II.4-15 i

For System 5A, Containment Spray Injection, unavailability data is listed for "All three buses available" and "One bus unavailable." Why is data not included for "Two and three buses unavailable?" Did the analysis include "two i

or three buses unavailable?"

i.

P.II.4-108 Table II.4-15 Why is data not incidded for Component Cooling System "Three ESF buses unavailable?" Was the analysis perfonned for "three ESF buses unavailable?

P.II.4-116 states 5.2 x 10 g7 lists Large LOCA AEFC as 1.40 x 10-3 Table'II.4-but page II.4-117 Which is correct?

e S

.7

5 P.O.3-2 Table 0.3-2 The cumulative probability must sum to less than unity?

Is there some-thing inherent in the procedure which ensures this?

P.O.3-5 What assurance is there that the "other" category indeed includes all events not analyzed and properly identifies their probability and conse-quences?

P.O.14-1 Section 0.14 Data Analysis The entire report. is based on the use of Bayes' Theorem to fold in IION plant specific data into generic data.

Page 0.14-2 presents a theoretical discussion of the process. A worked example,would be helpful.

'.P. r:3-3 2.b The report states "While errors of connission to misunderstanding of

?corfect or mostly correct indications (as at TMI-2) are not explicitly modeled, it"is felt that the above approach on human error accounts for such events." The above,iudgment needs to.be further qualified.

r-

M :

.-P;1.3.7 Section 1.3.1 Event Tree Simplifications u

The Instrument Air Systems were not modeled.

Is instrument air used in-

~

~

, safety system actuation?

P.1.5-9 Section 1.5.1.1.4 Uncertainty in Site-Specific Data C

The report states:

"The development of a self-consistent site-specific component failure data base for this stu@ necessitated a conscientious effort to insure that the population data (the denominator) obtained from ZION rec-ords was compatible with the failure data obtained from the LERs."

Since the LERs do not include population data, what does this statement mean?

P.1.5-54 Reactor Protection System Breakers The report places great emphasis on using Bayes' Theorem 'to fold in plant But is it specific data and considers this procedure as being conservative.

' conservative to take plant specific data which shows poorer performance than generic data, fold it in with generic data, and then use the result? As an example, the ZION data for the RPS Breakers shows fa ures = 8.2 x 10-3/ demand

~

p l

for a.poin't estimate. On 'page 1.3-32 the unavailability of K-2 is that of scram breakers, wiring, and the CRDMs themselves:

....s

^~~

~

v

\\

Mean:

1.8 x 10-4 (failure per demand),

Variance: 5.2 x 10.8, Should selected. plant specific ZION failure data have been used in the study without folding it in to generic data to obtain a more accurate measure of the risk at ZION? How many other ZION specific failure data values have been folded in to obtain lower failure rates than that representative of ZION?

P.1.5-84 Table 1.5.1-10 Prior Distribution for Mean Duration of Maintenance The column labeled "probabi11ty" includes ' numbers greater than unity.

What are the correct numbers for this column?

P.1.5-164 Section 1.5.2.1.3.4 Simplification Procedures

~

judgments were used to elimin_implification procedures indicates that. many The description o.f the sate components and systems without utilization of ppmerical techniques to provide justification for the simplifications. An example or several examples should be provided to demonstrate that these s1}mplifications have not voided the study.

P.I.5 _165 Section 1.5.2.1.(6[ Fault Tree Development and Cutset Generation The report states:

"The above procedures allow the system analysis te proceed largely without the aid of computer aided fault-tree reduction."

j

..ithout the benefit of the results of computer-aided fault tree reduction,.

Wwhat confidence can be placed in the validity of the PRA results?

~

P,.1.5-183 Do the event sequences include the out-of-service conditions permitted by

. Technical Specifications?

P.1.5-193 Section 1.5.2.2.1.4.5.1.1 Case 1: Failure of power at bus 147 The report states:

"If no safeguards actuation signal is present on either unit, which breaker first receives a closing signal is determined by the relative speeds of the bus undervoltage sensing relays." What this means is that if measurements were to be at ZION today, diesel generator 0 would be preferentially aligned with either Unit 1 or 2 each time there was a loss of offsite power depending on the adjustment of the undervoltage relays. This l

preferential sequence would always occur'unless the settings of the undervol-tage relays were changed. Therefore there is not a 507, probability that diesel 0 will align with Unit 1.

If the undervoltage relays are now set such that diesel 0 automatically aligns witn Unit 1, this alignment will always

occur until the relay settings are changed and thus p = 1 for Unit I and p = 0 for. Unit 2-diesel 0 alignment.

9 P.1.5-214 and 215

'If WASH-140'O used a median value of 10-3 for the conditional loss of offsite power as a result of unit trip, provide a justification for the use of 2 x 10-5 for the ZION PRA.

P.1.5-287 1.5.2.2.2 Reactor ProtectionSystem Mean value = 1.7 x 1 -4, Mean value = 6.2 x 10-6, Mean value = 3.0 x 10-6, What 'are the units to be associated with these mean values - "per demand?"

Is the last value to be asociated with two or more rod clusters?

^'

P. 1.5-291,,,

The unavailability histogram shows a near. unavailability of 0.00597 due to testing. The Reactor Protection System bypass breakers have undervoltage coils which can be tripped by the RPS logic channels.

Is the RPS system

' unavailability changed when the system is under test since the bypass breaker

. can be tripped on demand?

j

\\

4 P.1.5-295 a.

Trip relay failures The resport states:

"Although the relays for a particular scram are arranged in parallel, diversity of scram signals requires coincident failure of two or more relays in series." The previous statement is not stated cor-

' rectly. The relay contacts are arranged in parallel.

Both contacts must open to open the scram string.

If redundancy is claimed in the contact functions, then two sets of parallel contacts in series must fail to indure system fail-ure. How does one conclude that functional redundancy exists? Does func'-

tional redundancy exist for all accident sequences?

P.1.'5-295 4.

Wiring fault leading to RPS failure The use of one-half of the test cycle time to establish the mean failure probability is nonconservative. Why isn't the full test cycle time used to detennine the mean value at the end of the test interval?

e e

--._--.-y,_--

3----

3

.g.

P.1.5-297 6.

Probability of. failure of the instrument channels

~

The report states:

"We use for the probability channel failing to provide a trip signal, A = 1 x 10jf a single instrument failures per demand.

What is the basis for this value. and why is it defined to be a. median value?

- The report states:

"As was the case for the logic matrices failure, we must fail at least two out of three instru'ments to cause a single scram signal failure." What'is the relationship between the instrument channels and the contacts in the scram strings ~ as shown in Fig. 1.5.2.2.2-1 on p. 1.5-308? Are there two or four instrument channels for each functional measurement, i.e.,

high reactor power? Why is the statement made that two out of three are required for failure?

~

P.1.5-298 1.5.2.2.2.4.4 Common Cause Failure How can the values used for connon cause. failure. be justified?

P.1^.5-312 1.5.2.2.3 Engineered Safeguards Actuation System The report states:

"This analysis is carried out under the following assumptions: The system is in its normal operating mode prior to the initi-ating event." Since the ESF systems are in standby mode, how can it be justi-fled that no operational errors have.been made prior to actuation of the sys-T. tems?

f P.1.5-322 Pressurizer Pressure Transmitters Why was a nonconservative mean time to detection of four hours for the pressurizer pressure transmitters selected rather than the full shift time of eight hours?

Why was a nonconservative mean time to detection of 6,570 hours0.0066 days <br />0.158 hours <br />9.424603e-4 weeks <br />2.16885e-4 months <br /> for the containment pressure transmitters selected rather than the normal-calibration frequency of 18 months (13,140 hours0.00162 days <br />0.0389 hours <br />2.314815e-4 weeks <br />5.327e-5 months <br />)?

P.1.5-325 Quantification of Common Cause What is the ' basis for selecting 1.33 x 10-5 as the mean" value of proba-bility of common cause miscalibration of a set of instruments?

e 0

4*

Ip

,Z Q

he.9 M. hc r:1CPO Roxwur

Assmuss, b

P.O. Box 224. Scone RJdse. New York 12484 sepett M

January 25, 1982 W

tasteditse puMl8 dh*1888** "

Edd esttoreleaseduns:*4-etasescenestbksaW8 RECEIVED NNu E

FEB2 1982 YQ1s2n3}

d, Dr. J. Michael Griesmeyer Advisory Comittee on Reactor Safeguards U.S. Nuclear Regulatory Comission Washington, D.C, 20555

Dear Dr. Griesmeyer:

In accordance with your letter of December 21, 1981, I. have reviewed the appropriate sections of the Zion PRA l:. 0...

... and a copy of sy remarks which I. forwarded to. Prof. Okrent, is attached.

~. J.{B'

~

bave also enclosed a signed Forin 148 for one day consulting fee. Can you arrange for proces. sing of this billing?-

i N

Thank you.

Sincerely yours,

'f2a.wQ. _)

("

Paul W. Pomeroy

/.J V

PWP:gla.

Attachments G

e l

~

x - r. v. F. e q x-99K-l fcatA96 A ^ ' Njf

=-

~ - _.. _ _ _

Coments on the Probab'ilistic Assessment of the Seismic Ground l

Motion Hazard at the Zion Nuclear Power Plant. Lake County, Illinois I have. dealt almost exclusively with Section 7.9.1 entitled ' Seismic Ground Motion Hazard at Zion Nuclear Power Plant Site' since 1)' that portion of the re-j port falls within aqy area' of. expertise and 2) the conclusions of that portion have profound effects on the later probabilistic analyses.- Section 7.9.1 was, prepared by the Golden, Colorado office of Dames & Moore ' presumably under the dilection of Dr. Robin McGuire with Prof. Otto Nuttli serving as a seismological consultant.

a In general, the methodology applied in the analysis in Section 7.9.1 con-forms to the present state of the art and, in my estimation, the conclusions are not inappropriate for this type of approach.

However, there are so many assump-tions in the analyses that I question the usefulness of the report as an input to the scientific decision making process: The implications of the assumptions are not discussed nor are implications of possible alternative assumptions. Some of the assumptions have been d' alt-with in other ACRS deliberations while others e

j have not.

I will try to list the, assumptions and indicate areas that require

b. _,

further elucidation. -: have underlined the assumpt' ions taken from the text.

t y

=-

A.

Page 3-1st paragraph-basic assumptions of the seismic hazard model..

I 1.

Zones of potential future earthquakes are delineated by seismicity and tectonic evidence. While this statement is almost an act of faith among the seismological comunity, there is certainly evidence that previous seis-

)

micity alone does not dIslineate future active zones and, while teEtonic evi-

~

dence.of ancient faulting is abundant, its relationship to present day seis-I micity is far from clear.

If this assumption were not made,' what are the im-

[,,

plications for probabilistic seismic risk analyses?

2.

The relative frecuency of earthquake magnitudes in seismogenic zones can be represented by a truncated exponential distribution.

What is the evi-dance that a truncated exponential is appropriate? What are the implications i

of a non-truncated exponential distribution?

B.

Page 4, Seismogenic Zones.

1.

The report indicates that all the seismooenic zones of Nuttli and Hennann were included in the analyses and that except for N. Illinois and the central stable region, they am not important.

It would be useful to see how they are non-important if the assumptions below happen to be wrong.

0

,.e.*

20 Three alternative hypotheses were examined for seismocenic zones in the vicinity of the site and these hypotheses are assioned a subjeetive (1) probability of 0.2, 0.5, and 0.3.

What if these subjective probabilities are j

cospletely incorrect? What is the effect on the analyses? Who defined the Wisconsin. Arch Zone and the Wiconsin Arch-Michigan Basin Zone? Certainly not Nutt11 and Henmann who only defined a Northern Illinois zone and the Central Stable region..How does.the area of the Nuttli-Hermann zone compare with the area of the Wisconsin Arch Zone? If there is a difference, how does that effect the analyses? Are the boundaries of the Wisconsin Arch Zone and the Wisconsin Arch-Michigan Basin Zone real and, if so, why?

3.

Page 5--While other seismogenic zones might be defined which would indicate larger (or smaller) seismic hazard at the site, it is felt (1) that no such zones can be justified on a geological basis...

None of these zonais, including the ones used in the analysis, can be justified on a geological basis.

Why exclude some and include others?

C.

Page 6,' Seismicity Parameters.

How is seismic activity rate determined? It would be impossible for a non-specialist to figure it out from the discussion in this section.

1.~~Several modifications were made to the activity rates reported by Nutt11 and Hermann. Other than No.1 on page 6 which-is a valid correction, why?

In No. 2 on page 6 where the activity rates for this report are calcu-lated for a t 4 because earthquakes of smaller magnitude rarely cause structural b

damage.

What does that have to do with activity rates? What is the effect of

?

^

uncertainty in activity rates? In eg 1 on page 2. usually n'is the cumulative number of events greater than or equal to a given m.

Is there a purpose in b

and, defining n as the annual number of earthquakes of body wave magnitude ab if so, what is it? What is the effect on this. study of variation in b values?

2.

Page 7, paragraph 3--Maximum body wave magnitude g was assigned using-Dr. Muttli's subjective (l) Judgement. What is the evidence that there is a a b

)

max for any of these zones?

I know the arguments that Dr. Nutt11 has advanceyi but he could be wrong. What is the effect on this analyses.if there is no a 'b max? A double triangular probability distribution was chosen to represent un-certainty in m max over the range 5.4 to 6.2.

What is the effect on the analy-m" sis of this distribution? Why this and not another distribution?

3.

Page 8, paragraph 1--A simplifying assumption was made that low b j

values are perfectly correlated with high a max. This produces a wider range m

~

of hazard curves than less-than perfect correlation but it is not imoortant since the uncertainty in seismocenic zones causes the predominant'soread in i.

-7

~

~ ~ ".

_-,1,,_____________~

- ~ ~ ~ ' ~

~ ~ '

a seismic hazard curves. The simplifying assumption was judoed (1) to be aporopri-ate.

By whom?

D.

Page' 9, Estimation of Ground Motion.

Nuttli's theory estimates a sustained level of acceleration correspondino to the thNd highest peak in the acceleration time history. What is the valid-

'ity of the ' theory' of ' sustained' level of acceleration? Why was the value 1.37 used at all magnitudes? -

T On page 10, a factor 'of 0.9 is introduced as a correction for a random oriated acceleration. What is the derivation of that factor?

On page' 12, a further modification is made to ' account for the hypotheses' that effective peak acceleration may be limited and limits are chosen as follows:

a max probability 0.5g 30 0.8g 50%

00

' 20%

What is the effect if the hypothesis is completely wrong and an infinite a

has an associated probability of 10057 max On page 13, paragraph 3 grtain considerations outlined led the Dames &

Moore investigators to reject formal application of the TERA curves and use re-sults based solely on the Nutt11 estimates.

Nutt11 estimates or modified Nuttli estimates? What happens to the analysis if TERA curves are used?

To summarize, the comments outlined here suggest that while the methodology f

is ' state of he art', there are sd many assumptions and judgiments (subjective or other) that are made that'the usefulness of this analysis is open to question.

Apparently, the other parts of the Zion PRA rely heavily on this input data.

A J

much more detailed, systematic account of the analysis, as well as its assump-tions and their effects should be obtained. The report is incompTete as it stands and its unqualified acceptance is not warranted although its conclusions may.be valid.

fi i

)

n I

~ ' ~ ~.

• L

- ~

~

~

~~

-___L-,---

-. ~ ~ L - -. _ l ~ ~ l~ ~

Do.nA A. fowe.cs j$ cb e D

}' O Sandia National I.aboratories Albuquergue. New Mexico 87185 p.10ENEJ V

a

.... -, 4

3 44

,y -

. !::GS.U,j

. g.,

Dr. R. D. Okrent

..i.Ni"l'..!M'E ~ " s

.R 4:

5532 Boelter Hall University of California, Los Angeles Los Angeles, CA 9aM4

Dear Dr. Okrent,

~

To assert that I have been able to exhaustively review the Probabilistic Risk Assessment for Zion (ZPRA) would.be most inaccurate.

I have read and examined in fairly cursory fashion the document.

I will confine my comments here to sections 3, 5, and 9.

It will be apparent that my criticisms of the Zion Probabilistig i

Risk Assessment lie with, the accident analysis presented in these sections.

An adequate review of the ZPRA would be a challenging task.

_The. presentation is fairly chaotic.

The approach is, in many i

Arespects, quite novel.

There are numerous technical and typo-

- graphic errors.

The biggest barrier to reviewing the document is.the lack of clear correlation between accident phenomena and the heralgated risk.

One can find absolutely order of magnitude errors

ln the treatment of the accident phenomena.

Having found these errors, one is hard pressed to confidently assert how a correct treatment would change risk.

h; -. d :

This inability to relate treatment of the. phenomena to risk is the result of lumping together phenomenological uncertainty and the probability of truly stochastic processes and treating this combined parameter as probability.

This type of treatment and the

. striking "Delphi" technique for determining uncertainty in.

phenomena cannot be defended even on the grounds of expedience. The

. treatment does provide a nice defense for any criticism of the Janalysis.

Attack on any single item can be parried by the admonition that "it won't make any significant change in risk."

l-I will not, therefore, be able to provide you with comments to the effect that certain scenarios are conservatively or optimistically evaluated.

I will instead try to show what the treatments of phenomena were attempting to prove and what hypotheses were the keys to this " proof".

When the key hypotheses are found inaccurate,.large sections of the logic breakdown.

I can only presume this will alter the risk and that the risk associated with small break LOCAs and transients is probably a lower bound.

i i

.l m, +, a, n e u m - L,

u-ywr r ~

m s c

)

Dr. R. D. Okrent February 1, 1982 O

i Section 3 The EPRA presentation of core degradation accident scenarios is_an an objective was,advocccy argument.

That is, it is quite clear that formulated and then physical phenomena were hypothesized and experimental data were sought to support this objective.

This is quite the opposite of a technical argument in which all the data are amassed and conclusions drawn that are not inconsistent with any of-the data.

To give an example of this advocacy approach consider the

. treatment of steam explosion.

It is asserted that melt contact of a wetted surface can act as a steam explosion trigger.

Support for the assertion is drawn from several small tests in which bottom

. contact triggers were observed.

Yet industrial accident experiences, in which steam explosions were observed after large amounts of melt had collected at the bottom of a water pool, are not mentioned.

Laboratory tests in which bottom contact did not trigger an explosion 9e.<er_e ;also ignored.

It is also-noteworthy that " external" and

"- Apontaneous" triggers are redefined in the ZPRA.

Comparison of Ah.e ZPRA treatment with steam explosion literature is made

{.

difficult,.by the redefinitions.

i 5.

5b Any review of the EPRA treatment of core degradation

.I 3p(en'Bde'na must begin by determining what objective was being sought i

,dn the. analysis

.It is my belief that the analysis is an attempt j

to limit the amount of hydrogen generation during core degradation.

Processes.are then hypothesized to:

5:- ;

q (1) quickly remove the melting core materials from the primary system so there is little time for steam reaction with the core materials to form hydrogen, (2) distribute the core materials over a broad area to 5

assist quenching and cooling of the debris, but not so

+

. broad as to enhance the inventory of releaseable

~

radiactivity suspended in the containment atmosphere, (3) quickly quench the debris to minimize the amounN of time the debris has to react with steam to form hydrogen, and (4) prevent the debris from reheating.

To further cover the situation, the analysis drops accepted composition limits for. hydrogen ignition and detonation and invents I

a new definition of the limits -- the " flame temperature criterion".

-e 9

l

__i__

_3e=e w,

-e e_

~

l Dr. R. D. Okrent February 1, 1982 This new definition and some astounding'ign'ition probabilities seen to be designed to asure that hydrogen detonations can never occur.

Why,-one wonders, do the analysts not just assert that no detonations occur, marshall the evidence to support this point of view, and avoid shrouding a key element of'their analysis with a veil of yet 1

another parameter that is, to say the least, controiersial.

~

Consider fir'st the process of core meltdown.

The analysis seeks to put molten core materials in contact with'the bottom head of the pressure vessel quickly.

There are almost no data on how reactor cores meltdown. ' Hypotheses on these processes usually fall into two categories:

i i

(1) coherent uniform meltdown in which a core-wide pool collects until it catastrophically collapses onto a grid plate and from there onto the pressure vessel boundary, and (2) incoherent meltdown in which material, once molten, i

falls immediately from the core region.

The f}rst of these categories is supported by data from the i

~accident at TMI and some limited experiments done in Germany.

One

u..

'co'niequence of this coherent process is that there.is time for significant steam oxidation of steel and zirconium to produce hydrogen.

There JLs -also time for heavy heat loads to be placed on i

the walls of the pressure vessel that can lead to vessel failure in j

mode's~ undesired by the EPRA analysts.

l

~

The EPRA analysts opt for the~second category of core i

[

-degradation events.

During the analyses to support this hypothesis c

technical errors begin to appear.

For instance, it is asserted that water flow of 100 gal / minute is adequate to remove the delay heat being generated in the core debris, My most optimistic calcu-lation indicates 100 gal / min can remove only a little over 3 MW.

If Zion is to be derated to a lot duty-cycle this 100 gal / min might be adequate.

Though this error is certainly not of major consequence I think it is indicative of the quality of analysis in 3PRA.

The analysis of hydrogen generation during core meltdown.

is either presented in astoundingly opaque prose or exhibits a complete ignorance of material behavior.

The solubility of i

2 in liquid Zr is neglected in order to justify lower reaction trO rates once the fuel cladding melts.

In fact, the whole analysis-of clad melting seems more appropriate for LMFBRs with stainless steel fuel cladding than.for LWRS.

Certainly, it neglects 4

e e

..e

--e mm.2 "h-A e

i

\\

,. ~

Dr. R. D. Okrent February 1, 1982 what is known about the fuel melting process for LWRs.

At one point'we are asked to believe in layers of steel, zirconium, and'

-fuel oxides.

The one'really marvelous feature of heated, zircaloy-clad. fusi-interactions -- the mutual solubility and possibly low melting eutectic. formation between oxygen saturated zirconium' and fuel -- is largely neglected except as mechanism for depressing hydrogen generation.

These incorrect assessments of material behavior during core meltdown may be responsible-for the lack of concern about chemical heat liberated by steam oxidation of zirconium.

This lack of concern manifests itself through omissions of the :hemical heat from heat balance arguments made in ZPRA.

In fact the chemical heat will reduce radial temperature gradients in the core.during

~

meltdown and makes the meltdown process more coherent than hypothesized in the ZPRA.

..~ i The analysis.of core degradation in support of the incoherent meltdown' process concentrates on the 50% of the core that first melts.

All of section 3.2' deals with this 50% of the

' core.

No where, that I have been able to find, is the behavior of the remaining 50%.of the core described.

It presumably continues

.to.. heat, react'with_ steam, and melt.

Eventually, it falls into

- P ~ reactor cavity.

This 50% is not subjected to the dynamic treatment oQtl'ined in section' 3.2.

The hydrogen and steam generation, the c

bbrW; debris / concrete interactions, and the fission product release

,fr]oh!this '50% of 'the cote are apparently lost.

..I_ i-It. appears. to me that the ex-vessel behavior of at least

' 5DtTof the core is the same for all accidents scenarios -'

'trassients, small or large breaks.

At least 50% of the coie behaves as does all the core in large break LOCAs.

The ZPRA treatment of vessel failure, given the ZPRA

- hipotheses on the co'urse of core meltdown, is appropriate.

Though hbt cited in ZPRA there are data to support ~ the rapid failure rate

~

F of'.the primary system.

These data only disagree on the point of crust formation between the steaming melt and the vessel steel.

The ZPRA treatment assumes crust formation.

It was observed ~in j'

experiments that any crust that was formed was sheared away by the L.

steaming melt.

Growth of any penetration that develops in the steel, as hypothesized in ZPRA, was observed.

Growth of a penetration is an important aspect of the melt discharge.

The ZPRA treatment assumes a single hole develops and that this hole grows during discharge to a radius of about 20 cm.

Experimental studies suggest that melt attack is not so selective.

3 l'

}

I i

j Dr. R. D. Okrent February 1, 1982 r.

2 "ftiVould be more likely that several holes would develop in the

~

pressure vessel. There are.scre than 50 instrumentation tubes entering the primary system at the lower plenum. ~Each of these is

~

j suceptible to, melt attack as hypothesized in the ZPRA.

If, as is likely, penetration of the vessel occurs at several of these points, growth of the penetrations during melt discharge will lead to a major portion of the' lower pressure vessel head being gone at the time discharge is complete.

The discharge orifice available to the primary system gases'will be'much larger than that considered in ZPRA.

Gas velocities will be lower, and the dynamics of the events in the cavity that accompany gas discharge will be reduced.

~I~~

The probability that the discharge orifice that develops in

the pressure vessel will be larger -- and certainly no smaller --

than that used in the ZPRA treatment is a critical point.

The

larger orifice size causes meltdown processes for transient and small-break LOCAs to evolve in nature to become more like the 2prgcesses associated with large break LOCAs.

Though phenomena associated with large break LOCAs are cursorily treated in ZPRA, it is clear that many processes ZPRA invokes to mitigate the y,

. consequences of ex-vessel material interactions are not operative py.

.ci6,large break accidents.

a e

w:---

f f-3 Consequently, it [s clear then that the phenomenological -

y treatments in section 3.2 are the most optimistic that can be expected.

s Let me emphasize that the events accompanying high pressure j*

tcgre. debris discharge from the primary system have not, to my

-knowledge,:been extensively studied.

Some simulant tests have recently been conducted at Argonne National Laboratory, but I have not seen the test results.

I cannot, therefore, say whether or not there is a germ of truth in the scenario outlined in the ZPRA.

The treatment of the phenomena associated with the ZPRA j

scenario can be critized on several bases:

(1) neglect of design features of the plant (2) technical errors in the treatment (3) neglect or selective inclusion of phen.omena.

The neglect of design feature peculiar to the Zion reactor cavity is disturbing.

The reactor cavity sump and the influences I

L of the instrumentation tubes serve as examples.

The cavity sump i

is located at the far end of the instrumentation tunnel.

Melt l

dispersed during discharge from the pressure vessel will collect 4

n h

Dr. R. D. Okrent February 1, 1983

~

in this sump.

The concrete below the sump is especially thin (2-4 feet).

Penetration of the concrete basemat at this location is assured fo'r all accidents in which. molten core debris escapes

'the pressure vessel.

The effect of the sump on the novel hydro-dynamics of melt during high pressure discharge is uncertain to me.

It is known that only small discontinuities in surface can have drastic influences on the flow of liquids over the surfaces.

Other features of melt behavior, such as melt / concrete interactions, will provide even stronger effects on these hydrodynamics.

The instrdmentation tubes that run the length of the instrumentation tunnel constitute a significant flow blockage for airborne transport of material through the tunnel and into the l

containment.

The disposition of the '<atrumentation tubes and the support hardware makes them a far greater blockage than might be expected from relative cross-sectional areas.

The ZPRA is quick to claim credit for mitigating influences' of the grid plate on in-vessel flow of material.

Not a word is given to the mitigation i

by the instrumentation tubes and their supporting hardware on ex-vessel material flows.

The errors in the technical analysis of phenomena as isaged in ZPRA are disconcerting.

For-instance, we are assured ir.

env

?

a_t one point that 276 kg particles can be entrained by gaces dishharging from..the pressure vessel.-

Yet simple calculation

'i indicate parti'cles larger than 1 cm will travel only short I

distances before they fall out due to gravity.

Even if it is F

conceded that a 276 kg particle will be entrained by a 276 m/s i

wind one can't help but wonder what effect this high speed particle will have when it slams into the containment wall-e, The ZPRA analysis exhibits the profound notion that cooling of the debris is limited solely by the ability to supply coolant.

It is stated that a 10 cm slab of material can be cooled from 2200*C

}:

in 5 to 8 minutes.

It is clear that during.a core melt accident,

?

cooling of ex-vessel debris is limited not by the supply of coolant but by the ability to get heat out of the material.

Simple calculations of the cocling rate of a 10 cm slab with one side held at 100*C, an initial temperature of 2100*C, and n'egligab1'e

]

decay heating indicate temperatures in such a slab would not be L

reduced to 1000*C in less than 20 minutes.

Including ~. realistic decay heating would further slow the-cooling process.

The assurance by ZPRA that core debris quenches as it is disc'harged is nonsense.

A very prompt quenching of the core debris is sought in the ZPRA analysis because once quenched the reactions of the' debris i

with water to form hydrogen are slowed to a negligible rate.

If y

'the barrier to heat removal posed by the low thermal diffusivity of H

the largely oxidic material were properly recognized in the ZPRA, h

0 l

b-m

Dr. R. D. Okrent,

February 1, 1982 the ex-vessel hydrogen production would be greatly increased.

The material stays hotter, longer, regardless of how large an excess of

^

coolant is available.

In fact, the large supply of coolant assures there is an excess of reactant for the hydrogen production process.

i The ZPRA treatment of long-term cooling of core debris is j

.sub ect to criticism.

First there is a lack of sensitivity to the uncertainties associated with fragmented debris beds.

Debris bed coolability depends on the bed porosity, E, by way of terms having 4

U the form (1-E)/E.

Obviously, small changes in bed porosity have a greatly magnified effect on coolability.

The ZPRA analysis seems to feel bed porosities cf E = 0.4.are conservative.

Such porosities may well be appropriate best-estimates for monodisperse particles used in lab studies.

Certainly real. fragmentation processes will yield particles that are not monodisperse and probably not spherical.

Non-spherical particles with a range of sizes.

will~, routinely pack more densely than _ assumed _in ZPRA.

Packing density increases, and consequently, porosity'and coolability decrease, with increases in the mean particle size and increases in the breadth of size distribution.

Real system effects can also reduce coolability in other

,iysi For. instance, stratification of a bed according to particle w

size J-an effect that has been experimentally observed and is theoret'ically calculable - is known to reduce the coolability.of a debefi bed.-- - '.

7 l

The crictical heat flux limit may well be an upper bound on the coolability of real debris beds.

It certainly is not a lower bound.

The minimum coolable sizes for debris cited in the ZPRA m'ust then be considered the most optimistic possible.

That is, they are neither conservative sizes nor "best-estimate" sizes.

The ZPRA analysis is also contaminated by a tendency to l

neglect phenomena or consider phenomena in very restricted circumstances.

Consider the treatment of core debris attacking concrete.

ZPRA treats core debris interactions with concrete during the discharge of debris from the primary system.

The attack is conservatively calculated over a 40 cm diameter. circle.

One can't help but wonder what the debris, spreading over the entire' floor of the reactor cavity, down the instrumentation tunnel and into the sump, is doing to the concrete.

Experiments with stagnant pools of core debris at these temperatures have, yielded erosion rates of 100-150 cm/hr.

Flowing melts are known to attack the concrete at far higher rates than relatively stagnant pools.

The hypothesized flow of melt up the keyway walls is ye t another circumstance in.

which significant attack on the concrete would be expected and yet this attack is not addressed.

The radiant heat flux to concrete above the molten core debris is also neglected.

/

j a

}

Dr. R. D..Okrent February 1, 1982 1

h Even if the hydrogen, carbon monoxide, and carbon dioxide F

produced by the concrete attack are negligible from a risk standpoint, the disruption of the smooth hydrodynamics postulated in ZPRA ought.to.be significant.

Experimentally it is found that melts _ flow with difficulty over concrete surfaces. -The concrete attack produces, effectively, a " super-friction" that blocks flow far more than the shear forces considered in ZPRA.

The analysis in 2PRA of' melt flow seems born of a presumption that high temperature melts will behave like water.

In fact, the freezing and crusting of melt surfaces are most important.

The relatively cool wind over the melt during gas discharge from the primary system will cause a tough solid crust to form over the melt.

This crust may well completely negate flow processes analyzed in ZPRA.

The ZPRA analysis may be a victim of over-reliance on simulang experiments.

Section 5 K

The EPRA adopts and modifies the fission product source 4

term used in the Reactor Safety Study.

I cannot criticize the-J';;>9, analysts for adopting the Reactor Safety Study source term.

This is not because I think this source term is right or even conservative.

~

J

?

There are real questions about how this source term treats 1"~

refrac_ tory-fission products and whether or not a burst release, as j

opposed to a burst followed by a long duration continuous release, j"

is conservative.

I cannot critize the analysts because there is mot available a replacement for the Reactor Safety Study source term that is both\\self-consistent and takes advantage of the rssearch on

?l,

l source terms since 1974.

I can criticize the analysts for inconsistent application j

of the source term.

Take as an example the ZPRA treatment of the

'+

• oxidative source.

In the Reactor Safety Study this source term was j.,__

associated with violent, steam explosions that distributed hot core debris into an oxidizing atmosphere.

In the EPRA the role of steam e

explosions is down played, and they analyze release from only half the core.

Consequently, the oxidative source term from the-f Reactor Safety Study is considered conservative and is reduced by j

half.

Yet,'the entire thrust of the ex-vessel interaction analysis,.

H in ZPRA involves very dynamic dispersal of core debris.

The amount of material involved in.the dispersal is the -same as. in the' steam explosion events of the Reactor Safety Study.

Further, the time hot debris is exposed to the oxidizing environment according to the ZPRA analysis is far longer than the exposure according to the Reactor Safety Study steam explosion analysis.

An accentuation rather than a reduction of _ the Reactor Safety Study source term is clearly called for.

Dr. R. D. Okrent Feb:uary 1, 1982 s.

I think this error in the EPRA analysis arises because the l

analysts simply do not understand what the Reactor Safety Study was

'considering when the various' release categories werel invented.

The error is compounded because coupling between sections on processes and the release of radioactivity is extremely weak.

This, in itself, is a sad aspect of 2PRA.

If there is one area where 1

coupling should be strong 'it is between release of fission products 1

from the fuel and the behavior of the fuel melt or debris during

~

the accident.,

Section 9 The EPRA. analysis of accident phenomena effectively minimizes the reduction in risk that could be accomplished by any engineered mitigation system.

This may well change if the analysis embodie3 in section 3 were modified to address some of the objections raised above.

More disturbing than the fore-ordained conclusions of section 9 is the narrow focus of the analysis and the inconsistent i

i appealsal of the results of analysis.

Consider the treatment of l --

' coreTretention devices.

A core retention device can reduce hydrogen generation, steam generation, aerosol formation both before"'and af ter contalament failure, as well as retard 'basemat erosion.

Analysis in %PRA focuses ~only on the basemat erosion l

issue.

l Even with this focus' on basemat erosion the appraisal of

'the r.e.sults is unusual.

A minimal retention device.will, according to the analysis, prevent basamat penetration for two days.

This is in contrast to less than a day predicted by ZPRA or less than a few hours if the cavity sump is considered as suggested above.

Further, the probability of restoration of power during this two days-is. estimated to be quite high so that enforced cooling of the core debris becomes possible.. The ability of a core retention device to contain the core debris until enforced cooling becomes available is viewed by the 2PRA as an unremarkable finding.

i Concluding Comments t

In summary my impressions of the zion Probabilistic Risk Assessment are:

(1) core meltdown processes vill be more coherent than is hypothesized in ZPRA, (2) re-analysis of the accident scenarios will show far more, hydrogen is generated than is now predicted.

2 i

l i

a

I t

Dr. R. D.* Okrent

-10 February 1, 1982 (3) dynamics of high. pressure ~ discharge of core debris

~

will be found not as dispersive as hypothesized in

[

SPRA, (4) ex-vessel material interactions are more nearly the same, regardless of accident scenario, than is sug-gested in ZPRA, (5) penetration of the basemat by molten debris discharged from the pressure vessel is nearly assured for all types of accidents,

-(6) cooling of core debris will not be as effective as is postulated in the EPRA, and (7) radioactivity release du' ring core degradation would be better approximated by the Reactor Safety Study source term than the modifications proposed in ZPRA.

n j

[,[

These impressions imply that the risk associated with

~

0;-

-.stetxe~acci. dents is far higher,than admitted in the.2PRA..

t g.

The Zion Probabilistic Risk ~ Assessment will be a model for j

many* assessments in the futute.. Two problems may arise because of tb.e: acceptance of this existing treatment:

~

(1) sion has an exceptionally robust containment.

~~

c i t.: _ _.

xIncorrect aspects. of the analysis that are accepted In the EPRA because even in the worst case they do not threaten containment integrity may be

,i ^

grossly inappropriate for weaker containments.

lj (2)

Analyses accepted for Zion that are rejected in future PRAs will lead, inevitably, to charges of inconsistency and "rachetting".

sincerely yours, Q

I 3

Dana A. Powers lT DAP:4422:em j

V.

7 l.

l4

6arry AC IoTI i

Univ:rsityof Califernis

m. O A y.

.w a d DLOS ALAMOSSCIEN unwovruuu/n Postomcesex1ess i.e Aiem,.u u.;ssafsa 12 R.! 3 19~

enseswyreferto: Explosives Technology uenstep: 920 5{'.f$'jf,!;

anuar7 28, 1992 5

'Z K R Sali K ap.. 5 F

Dr. David Okrent, Chairman Reliability anil Probability Assessment Subcommittee 4

Advisory Committee on Reactor Safeguards U.S. Nuclear Regulatory Commission 5532 Boelter Hall

/

p r

. _ University of California at Losl Angelesj

- Los Angeles, CA 90024~

g

Dear Dr. Okrent:

y This letter reports my observations and opinions pertaining p to assessment of flammable hydrogen hazard in the utility's Prob-abilistic Risk Analysis (PRA) of the, Zion nuclear power plant.

.i-These are submitted..in response to instructions and request fo.r m

.:.. consultants' aid in conducting an ACRS review of the Zion PRA, a

which were directed to me by your subcommittee's staff' engineer, t-

-J. M. Griesmeyer, by a letter. dated December 18,19Ei.

L u:

My most specific and affirmative findings relate to the

' mechanistic treatment of hydrogen -aceraulation. and burning in the Zion containment, atmosphere.

This treatment is found mainly in Section 4 of the PRA, under the title' "Transiegt Anal}uis."

In-p y $rtant explanatory material occurs in Section II.5 c'rf'the Sun-mary Report, most particularly on pages II.5-18 !and 19.

.The in-portant analytical tool used here is Westinghouse',s COC0 CLASS 9 3

computer code for evaluating so,ntainment conditions under the in-

[

fluences of hydrogen combustion phenomena and heat sinkis.

For perspective, I note that an analogous code to COC0 CLASS 9 is CLASII.

The latter has been widely used and exposed to ACRS scrutiny in the recent modeling of deliberate ignition as a means 1

l Y

b f0,~

/

1 wn

)

l f

Dr. okrent January 28, 1982 I

of' p'ro'tecting the ~ pressure-suppressing containment. designs (Ice Condensers and Mark III) against otherwise large, flammable accu-

' mulations of hy'drogen accidentally formed by core degradation.

Both these codes are used in conjunction with Batte11e's MARCH code, which models hydrogen generation and release.

Validation studies of CLASIZ have bited COCOCLASS9 as a standard for compar-ison.

From the details ascribed to COCOCLASS 9 in the Zion PRA, I conclude that its assumptions and procedures are generally sound and that its application to postulated degraded core accidents in a large, dry containment should be e'xpected to produce satisfac-torily conservative results.

In particular, the Zion containment is treated as a single volume with continuously homogenized dis-persal of hydrogen.

This leads to maximum accumulation of hydro-

- "f gen ~priof~to bur'ning, which'is then" volumetrically complete over

~

- an: ausumed time of:20 seconds..

e Convection of unburn~d gases in

' he: processes of dispersal and deflagrative burning appear not to t

be treated.

I believe that amitting these effects which CLASIX Includes 'is' appropriate for the large, dry containment at Zion, whereas their inclusi$n would be necessary in a campartmelted containment design.

-,f, Reckoning of 'flannability of the variety of hydrogen-air-steam mixtures is done internally by the COCOCLASS9 code.

The algorithm used appears to be elaborate (Appendix 4.4.4 is devoted to it), but it embodies a simple and empirically based principle for approximate quantitative discrimination between regimes of flame behavior.

The flammability criterion that is applied takes the form of a unique minimum value of the adi'abatic flame temper-ature.

That is, flammability is measured by the ratio of the la-t'ent heat of complete combustion to the specific heat of the same l

gas mixture, with allowance for variation of the sensible heat initially present.

The repea.tedly stated value of this flame-w m-

l'..-

Dr. okrent

-3' January 28, 1982 temperature criterion, 710?C = 1310*F, is evidently associ-ated with 8.5% H in dry (or nearly dry, the distinction is in-2 significant) air at ordinary room temperature, abou't 70*F.

These values coincide closely with the inflection in the plot of measured pressure rise versus per cent hydrogen as reported by A. L. Furno, et al. (Safety Research Center, U.S. Bureau of Mines, Pittsburgh, Pennsylvania, 13th Combustion Symposium Pro-ceedings, 1971, pg. 593) for a large sphere of stagnant, uniform-ly mixed gases at 18"C (64.4"F) mildly ignited at the cen-ter.

The 710*C criterion thus represents the boundary between reginies of omnidirectional ' propagation of flame and substantially complete consumption of combustibles in zo're highly flammable gises and of gravitationally restricted occurrence of flame under less flammable conditions.

These regimes are denoted, respec-i

d, tisfely, as those of "significant pressure rise" (if adiabatic and

~

iisve6ted, by a factor' of at least four) and of " benign burning."

In COC0 CLASS 9, this flammability boundary is taken to pre-se6t 50% probability of inflammation over 30 seconds of[ time.

A

, distribution, of probabiliti'es is then assumed, which increases. to iihitiy~ or decreases to insignificance over displacements o?

l 100*F above or below the nominal boundary temperature.

I esti-

~

mate,th'at these displacements correspond to H Percentage dis-2 f

pladaments of about 0.W.

Thus, 9.2% E ain dry ai'r, of.some-2 what more or less than this at an elevated containment tempera-ture with non-negligible humidity, is calculated as assuredly flammable, and 7.8% H is correspondingly computed by 2

COCCCLASS9 to be nonflammable.

Without seeing or doing ~.a calcu-

~

lation myself, I do not know how closely this formulation of the flammability boundary agrees with the measurements at 300 F for high steam concentrations that are included -in the triangular composition diagram presented by shapiro and Moffette

[

(WAPD-SC-545, Fig. 3).

However, the allowances for steam an.d/or 4

Dr. Okrent January 28, 1982 i

initially elevated temperature are assuredly qualitatively cor-rect.

Thus, I judge that the COC0 CLASS 9 ' formulation is at least l

as ' satisfactory as the CLASIX approach of parametrically assign-j ing the t H at the flammability boundary at 8,10, or 124, and 2

handling the inerting effect cf excess steam independently.

l Thus, in the Zion'PRA, telnporary inerting by steam is fac-I tored into the mechanistic analysis, hydrogen is considered to accumulate up to the largest amounts, which, by being uniformly dispersed and stagnant, might escape combustion, and finally, as-suredly flammable accumulations of hydrogen (or equivalent compo-sitions including some carbon monoxide as fuel) are reckoned to

~

'~

i burn until the fuel (or oxygen) in the mixture is exhausted In

~

determining the pressure excursion of a burn, credit is taken for 4

real-time heat transfer between the burned gases and active or hk +'

~past'ive' heat sinks-in accordance with the' defined accidenE sce-

'~

nario'. It is only the numerical application of the flammability

' criterion to the unburned gas that makes hypothetical use of adiabatic flame considerations.

This is all as it. should 'be.

The molecules experiencing a flame front have only milliseconds l

in which to burn or ex~ti..gtishr the burned gaser have", on the 4

average, about ten seconds over which to lose heat before the last of such gases are formed and the peak pressure develops.

.; ~

Having begun witH'a matter that I understand well enough to

~

~

trust, I tur.n now to one that I do not. Much of section 4.3 of the Zion PRA is devoted to mechanistic treatment of some 50

" bounding cases" that are discussed alongside the "most probable cases" for the six sequence classes.

I judge these bounding cases to be satisfactorily conservative, provided I suppose that they are factored into the probabilistic treatment with an aggre-gate weight that is non-negligible.

Indeed, some of these bound-4 ing cases do lead to expected. containment failure, and a good many others might be expected.,to produce temporary leakage frda the. contai' ment while the pressure is above the design value, l

n J

+=

e--*

= = = = = =.

.s l

Dr. Okrent January 28, 1982 1

3 even though. no irreversible rupturing of containment is likely.

What I find to be ambiguously presented, and to warrant further scrutiny, is'the relative weighting given to these' bounding cases in comparison with the most probable ones.

As symptoms of this ambiguity, I quote sect {on 4.0.).,

third paragraph, final sentence (with underlining added. for emphasis):

"For each of the sequence classes, the principle (sic) parameters used and some alternative cases investicated are discussed." section 4.3, final sentence, is similarly vague in stating, "These were used to bour.d the phenomena that might ' occur.within the containment and to. aid in assioning probabilities to the unlikely paths in the containment event tree. "

From what I have seen, I simply cannot tell wh'at l-these' statements mean.

Are these bounding cases a smoke screen?

' y, c.,

The third matter I raise for. attention. is the apparent

[

disparity between seemingly major findings of the Zion PRA and of C-i

,the NRC Staff's Preliminary Report, Volume 1, NUREG-085,0.; pub-lished November, 1981.

In the former, hydrogen burning,is a con-spicuous contributor to peak containment pressures only in the, N

vast majority of core degradation seguences that do not, result in containment failure.

Section 3.3.6 of NURm-0850, however, finds l'

that gamma-mode failure of containment (Combustible Gas Burn /-

(;

Detonation, summarily pscribed to hydrogen but, in,facth.in-L-

cluding possible carbon monoxide as well) is of the high'est re-cognized degree of concern among a set of modes that includes the t,

L delta 'l and. delta-2 modes, with lesser degress of concerri.. In the Zion PRA, these latter failure modes are found to pose the

\\\\

1 O S 3

.t

{

/

e

,- ^,,

g a,

~

Dr. Okretnt January 28, 1982 highst likelihood of-containment failure.. The basis of, this reversal of' the order of seriousness between these two non-negl'ibile failure modes should be scrutinized further, and the results reconciled if possible.

~

Sincerely, h-Garr L. Schott,

GLS'mg cc:

Dr. J. M. Griesmeyer, ACRS/NRC

. m.._.m '

~

J. C. Mark, T-DO, MS 210 J. E. Boudreau, EP/NP, MS 671 L. D. Gritzo, M-DO, MS 915 E

G.

L. Schott L

- M-1 111e

'~

r CRMO (27 '.. '

,.I.

i.

e s

,a s

wy,

'i.

y.

S e

O p.M

~ ' '

• m

-r

- + -

M. D. Tfl ! FV N AC-e

' * + +

UNIVERSITY OF SOU

)b k

/E d /.6 m.P Cf m marrastrr PARE 105 ANGEI.ES, CAIDOINIA gooey scNCF INGDGIIING gg gjdth E

DEPAENENT oF QVIL INGDG2 RING gggt,gtedjrgegggg(lttitSSr5.'.N sheausettereleased sattareviar

~

dtadoes:detk'st beenetapish$

February 23,1982 RECEIVED ADYl50RY COMMIUEE ON Mr. J. Michael Griesmeyer

" 3^94% "

ici!""~

p 2 a2 Wat$n

n. D.C. 20550 MIIM.II36]

E L 6

~

Derr Mr. Griesmeyer:

I have now completed my review of the material you mailed to me on December 21,1981 and regarding the Zion probabilistic assessment.

I will first state a number of general connents and follow this with some more detailed remarks.

L.. r The general" methods and principles employed in the analysis of

'=

possible earthquake shaking and Zion site appear to apply the modern state of the art techniques. In reviewing the specific steps involved l

in this analysis, I found that:

?

1. Theoveralllevelofseismicity,3hywhatIinfertobe n

l AlogjoN.s -0.58 - 0.59 Igg /yr/10 for the Wisconsin arch-.

l-4-

Michigan basin is not in obvious disagreement with what.might l

be expected in this area.

I tested this seismicity using

~

literature at my disposal and found no difficulties. When I i

receive from you the paper by Nuttli and Hermann (19'78), I can l

review this question again. The maximum cut off magnitude D

(intensity) for this area has been assumed to be 5.6 to 6.0 P

(~VII to -VIII). This again appears rea'sonable, but except for f

the general historic record, I wish I found other more physical U

support for this cut off range.

I wonder whether sensitivity studies were carried out for letI=IX cut off?

2.

I calculated the approximate probabilisties of exceed'ing peak acceleration (analogous to the results presented in Figure 10 of Dames and Moore report) and found that the solid curve in Figure 10 for Wisconsin Arch - Michigan basin (using Nuttli modified attenuation) appears to give good results. The curves l

based on TERA (1979) attenuation should not be used since there is evidence that this correlation may be biased towards smaller peak accelerations. For smaller. peak accelerations mainly resulting from more distant earthquakes, the Nuttli attenuation seems to give reasonable results. However, the results for higher accelerations resulting from closer earthquakes may be b A /f U.d h/

r p ev / oy" o %

o

i

~-

Mr. J. Michael Griesmeyer February 22, 1982 Page Two

)!

highly suspect. Figure II.7-1 clearly shows this to result T

from an assumption that the acceleration versus distance levels off at a constant acceleration and for the assumed maximum magnitude. The abrupt cut off of all curves in Figure II.7-1 at. 45, -.55 and

.65 g is a consequence of certain assumptions which at present cannot be supported by the strong-motion observations. - Even though the hypothetical arguments supporting such abrupt cut-off may be reasonable, the continuity of the-physical nature of the problem and the lack of conclusive data strongly argue against introducing such hypothetical and theoretical assumptions into an engineering decision process.

In any case, why not consider other alternatives? Especially when one is aware of the approximate Median Fragility Distribution

-3 shown in Figure II.7-1. Even to an uninitiated reader, the rather unlikely event'tbat the " upper bound of seismic transmissibility" just happens to be whhre the number o'f affected items begins to increase,wouldseemveryunlikely(FigureII.7-8).

i 3.

The analysis of the " conditional probab.ilities of siasmic induced l.

failures for structures and components for the Zion Nuclear Generating Station" by S.M.A.'is very difficult to evaluate.

It

~"

T is just impossible to. review gr)d check this work..without structural drawings and details. Furthemore, such checking would I;

h be very time consuming and thus expensive.

I would recomend some serious spot checks to be~made by a very experienced i

l structural design engineer.

N

}

j Selected Detailed Coments:

Fage II.7-6.65g is used as "the upper acceleration bound". What j

is the basis for this estimate?

~

Pages 11.7-20 and II.7-21~: These conclusions are based on the 7

l.

assumption that 0.65 g is the upper limit for the 4

~

e acceleration. How can these conclusion be made when it was not demonstrated that.65g is indeed the upper a

limit?

Ll*

Page 7.2-2.

The idea of a sustained peak acceleration (corresponding to the third largest peak of the a:celeration time history) may be' appealing to a' time series analyst j

interested in simple yet stable scaling parameters for a random like function, but is neither an accepted measure of ground accelerations in engineering design, 4

nor it has some general physically meaningful basis in the analytical b namic response analysis.

Page 4-18 Reductions if 0.90 for the reactor building and o.85 3

for the aux 1111ary building are assigned to the

.)

Mr. J. Michael Griesmeyer February 22,1982 Page Three embednent effects. However, other consequences of the embeidment, like rocking excitation for Rayliegh waves and torsional excitation for Love and SH waves

~

are ignored? It is not clear then how the factor of safety 1.2 follows from this?

If you find any of these comments not to be clear, or if you have other specific questions, please-let me know.

~

Sincerely, k.LTvy ~

M.D. Trifunac Professor ET:mdm f

~ ~. i'" ~

D S. * *.

?-

l _

..a. -

.r >.

.9,.

...d.....

I*

IM l

\\

s O * '?.*.

. '.7I

• l L

r 5

• e 6

1 1 -. - --

2e.woss v.do.ns A

ae.

00.Franklin Research Center

~

W A DMslon of The Franklin Institute isn,aturase g

. CM 3 esteW5, 3 Febrsary 22,.1982

&5lWEsEs Dr. David Okrant Professor, School of Engineering and RECEIVED 30 Applied science c0MMliTEE0#

5532 Boelter Ball GUARDS, U.uutc, University of California Los Angeles, CA 90024 4#

3 1982

.t:34h 2

Re:

Zion Probabilistic Safety Study i

Dear.Dr. Okrent:

1 As requested by Dr. Griesmeyer, I undertcok something like a mini review of the subject study.

The approach I used was as follows:

r.:,

1.

Quick look at.the structure and contents of ~

the entire PRA study.

",W

~m

[.N 2.

Closer.look as the derivation of cont =4 = nt i,- -

ultimate capability.

,"f-3.

Quick look at:-RPV failure modes. -

j, i

4.

Quick look'a6' structure and' component N fragility.

[..

1.

The overall PRA appears to be very comprehensive and structured in a manner useful to different classes of readers.

,1 Exscutive summary clearly defines the results of the study, summary report gives adequete discussion for the reader to find his way 1.

through the main body of the report.

The differences between WASE-1400 and Zion PRA are clearly stated, one of the most important ones being the assignment of levels of confidence'asspciated with various frequencies of the exceedance.

Although not reviewed at this t

time in detail, it appears that the physical phenomena asser inted L

with the progression of nuclear power plant accidents are t.Laressed*

1 in a comprehensive manner (Page II.5-8).*

i

,i.

• For example, the conclusion that independent of degree of initial

. fragmentation, mechanisms exist that drive core debri system j

toward ultimate coolable geometry, is similar to that given by T.G. Theofanous and M. Saito, in PNE-81-148, June, 1981, Purdue

,4 University.

,~

~

- ~-. ~ -. -.

- _ _ _ _ __ _ _ { ; --- ~~ = g --- ~.

-~3-~.----

ene Dr. David okrant February 22, 1982 2.

Containment response is analyzed for 21 e'ntry states to the containment event tree leading.to 11 exist states, each associated with specific release' category.

Exit to entry states are coupled by the containment matrix'-(Table 22.5-1, Page 22.5-10, Vol. 1).

Each of tho' entries in this matrix represents a cobditional probabi-lity that a given entry state will result in an exit state correspond-ing to a release category.

It is shown that the event behavior and the containment integrity are affected by 1.

RCS pressore at the time of RPV failure.

2.

B venting from RCS pr'ior to RPV failure.

2 3.

Timing of. fuel melting.

4.

Operation of containment sprays and fans.

...~ ".~ Failure of Item 4 or containment. bypass (failure of two (2)

RER~ isolation valves). lead'to a dire ~ct release.' Integrated core and containment analysis is performed by use of MARCH code.

As I_ recall from another Class 9 Accident discussion at an ACRS meeting, time scale by MARCH analysis may have sizeable variability.

Because of that one does know how significant the structural heat sinks will-

~

be,.in" mitigating the response.

. y- :

~c..~

r_T Primary containment ~ ultimate capacity was de'termined to_be 119' psia.

It was cali::alated' by ~sargent s Lundy (Appendix 4~4.1).

De analysis was supposed to cover:

1) containment structure, 21: penetrations, 3) rate of loads, 4)' uncertainty bounds, 5) failure mechanisms.

Only the first two' items are dealt with,in some detail.

s The Reactor Cont =Wat i.s in the shape.of 3'6" wall cylinder with (use Fig. 2), 2'8" thick shallow demed roof based on 9' flat foundation slab.

The cylindrical portion is prestressed by a-post-tensioning system consisting of horizontal (hoop) and vertical.

l" tendons.. The dome has a three-way post-tensioning system.. Founda m s tion slab is conventionally reinforced.

The inside of the entire containment is lined with 1/4" welded steel plate.

A cy.lindricab reactor pit with a wall thickness of 16 feet and an internal diameter of 21 feet is located at the center of the base mata crc.

Sargent & Lundy addressed in detail only the containment build-a ing internal pressure capability and isubcontracted CB&I'to derive the structural capability of the equipnent hatch.. The analysis used 4

materials properties derived from the mill tests and from the 90-day As the failure mode, 14 strain in hoo concrete cylinder tests. tendon is assumed, and.not,the open flow area of 10 to 15 in as specified by the PRA contracter.

1 I

i

^ ^ ^ -

+ -. -.,-

m

,1 x.-

7 Dr. David Okrent

' ", February 22,.1982 l

r.

Analysis consists of hand calculations and of an axisynsnetric finite element computer calculation.

It is strictly deterministic and the' conclusion that confidence level of 95% is ass.ociated with

' the calculated containment internal pressure capability is nots supported (presumably based on knowledge of materials property l

statistics, see Item 4 below for further comment).

.The hand calculations is one of the type

• Ia A y

P=

R where o is the yield stress, A is'the corresponding material I

(tendon, rebar) cross.section area and R is the radius of the cylinder.

This assumes that all concrete'has cracked and that the liner has not lost its leaktightness.

The calculated result is 134.4 psig, a reasonable number.

Finite element model is quite complete.

It allows for gradual concrete cracking through the wall.

Included in the model are:

T mat, cylinder and dome.

Account is given for non-linear behavior of steel"(tendons and rebar) ~ and of concrete (by cracking).-

The results confirm internal pressure at it hoop tendon strain obtained by hand calculation.

This calculated result and the observed mode j-of ductile failure is favorable compared to 1:14 scale model test

.i of a thin-walled post-tensioned concrete containment.

In addition I!

to this failure mode, transverse shear stresses are examined at

'l various' locations.

of these I beli' eve the location of cylinder attachment 'to ' foundation mat would have to be examined in greater detail for potential leak path formation.

This is because at 1%

i hoop strain in the cylinder, the radial displacement in the cylinder is of the order of 3 to 7 inches greater than that at l.

the mat.

Also, thermal effects are written off as insignificant,

'. * ~

j however, gross thermal expansion differences- (between the cylinder wall and the mat) ma,y,cause severe transverse shear and potentially,,_

l form leakage path.

Cont =4-nt wall arourid the penetrations (incluhing the equip-ment hat'h) is significantly thicker than in the cylinder, hence c

stronger for the failure mode postulated.

CBsI anal.ysis of the equipment-hatch is well organized.and provides credible number of 134 psig for ultimate buckling capability of'the hatch dome.

The effect of the pro-}ected ultimate internal pressure on the hatch boundary is not considered in the equipment hatch analysis.

Poten-

' tial for leak path at the hatch boundary has to be evaluated with realistic boundary conditions.

1. e O

A l

t r

o A

Dr. David okrent February 22, 1982 Containment structural capability analysis does not address the syst, ems'and structures attached to the containment. wall.

Three -

..to seygn inch radial. displacement of the cont =4 M t wall will

. definitely cause some distress at the wall attar h=&nt of these.

While 149 psia appear to be a reasonable number for the cylinder, containment bypass. potential as a consequence of some penetration -

breakaway prior to this pressure,has not been included in the study.

3.

Reactor pressure vessel faliure dynamics are addressed in Section II.5-44.

The treatment appears to be reasonable and the failure of an instrument nozzle in the bottom head is the likely j

first.

4.

Seismic fragility of various safety related structures and equipment (section II.7-2) was determined by structural Mechanics Associates (Section 7.9.2)..The approach taken was to identify the design basis acceleration and the factor of safety for each item e, valuated.-

This safety factor was then decomposed into various contributing elements, each of which was analyzed for its variabi-lities and uncertainties.

These variabilities and uncertainties were then combined.to get the variability and uncertainty of the safety factor.and'of the acceleration capability for the item.

This approach ~ appears to be rational and result:.ng families of fragility curves should be credible.

I believe the question of internal pressure ultimate capacity should have been subjected

.to a similar treatment, leading to family of curves such as L

Fig. II.7-2, rather than an single curve, such as Fig. II.5-5, i

t L

which has no justified confidence level associated with it.

T s

m a

a i

Very truly yours,

.g,

~

l WQY ons Zudans I

ces senior Vice President

[

cca Dr. J. Greismayer, ACRS l

E r

[

(

n