ML20133A648

Review and Evaluation of the Millstone Unit 3 Probabilistic Safety Study.Containment Failure Modes,Radiological Source- Terms and Offsite Consequences

ML20133A648
Person / Time
Site:	Millstone
Issue date:	09/30/1985
From:	Barrett R, Easley P, Khatibrahbar, Ludewig H, Pratt W BROOKHAVEN NATIONAL LABORATORY, NRC
To:	Office of Nuclear Reactor Regulation
References
CON-FIN-A-3748 BNL-NUREG-51907, NUREG-CR-4143, NUDOCS 8510020257
Download: ML20133A648 (75)

Text

.

_.m NUREG/CR-4143 BNL-NUREG-51907 Review and Evaluation of the Millstone Unit 3 Probabilistic Safety Study Containment Failure Modes, Radiological Source-Terms and Offsite Consequences Prepared by M. Khatib-Rahbar, W. Pratt, H. Ludewig/BNL R. Barrett, P. Easley/NRC Brookhaven National Laboratory uclear Regulatory Commission N. - -j

$3A388((@$8has

7 1 l l I

1 I

I NOTICE This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, or any of their employees, makes any warranty, expressed or implied, or assumes any legal liabilsty of re-sponsibility for any third party's use, or the results of such use, of any information, apparatus, product or process disclosed in this report, or represents that its use by such third party would not mfringe privately owned rights.

NOTICE Availability of Reference Materials Cited in NRC Publications Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room,1717 H Street, N.W.

Washington, DC 20555

2. The Superintendent of Documents, U.S. Government Printing Of f ace, Post Of f ere Box 37082 Washington, DC 20013 7082

3. The National Technical Information Service Sprirgfield, VA 22161 Although the listing that follows represents the majority of documents cited in NRC publications, it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Docu ment Room include N RC correspondence and internal NRC memoranda; NRC Office of Inspection and Enforcement bulletins, circulars, information notices. inspection and investigation notices;

~

Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the GPO Sales Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and N RC booklets and brochures. Also available are Regulatory Guides, N RC regulations in the Code of federal Regulations, and Nuclear Regulatory Commission issuances.

Documents available from the National Technical Information Service include NUREG series reports and technical reports prepared by other federal agencies and reports prepared by the Atomic Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items, such as books, journal and periodical articles, and transactions. federal Register notices. federal and state legislation, and congressional reports can usually be obtair ed from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non NRC conference proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draf t reports are available free, to the extent of supply, upon written request to the Division of Technical Information and Document Control U.S. Nuclear Regulatory Com mission Washington, DC 20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available there for reference use by tne public. Codes and standards are usually copyrighted and may be purchased from the originating organization or, if they are American National Standards, from the American National Standards Institute,1430 Broadway, New York, NY 10018.

OvtPA

NUREG/CR-4143 BNL-NUREG-51907 Review and Evaluation of the Millstone Unit 3 Probabilistic Safety Study Containment Failure Modes, Radiological Source-Terms and Offsite Consequences Minuscript Completed: July 1985 Data Published: September 1985 Pr:: pared by M. Khatib-Rahbar, W. Pratt, H. Ludewig, Brookhaven National Laboratory R. Barrett, P. Easley, U.S. Nuclear Regulatory Commission Brookhaven National Laboratory Upton, NY 11973 Prepared for Division of Systems Integration Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Wcshington, D.C. 20555 NRC FIN A3748

~

- -y ,p, +- y- y_---,-w -,e,,_, --- , , , . ,_m,,. .y.

ud .

, - , , , . -,wr,- v.,-w p4

-iii-

. ABSTRACT A technical review and evaluation of the Hillstone Unit 3 probabilistic safety study has been performed. It was determined that; (1) long-term damage indices (latent fatalities, person-rem, etc.) are dominated by late failure of the containment, (2) short-term damage indices (early fatalities, etc.) are dominated by bypass sequences for internally initiated events, while severe seismic sequences can also contribute significantly to early damage indices.

These overall estimates of severe accident risk are extremely low compared with other societal sources of risk. Furthermore, the risks for Millstone-3 are comparable to risks from other nuclear plants at high population sites.

Seismically induced accidents dominate the severe accident risks at Mil l-stone-3. Potential mitigative features were shown not to be cost-effective for internal events. Value-impact analyses for seismic events showed that a manually actuated containment spray system might be cost-effective.

1 i

I

_-.,.------.m --,,.,,_-_,y _--,-,,,--.--,m. ,- - - . - - - , - - -y

-iv-ACKNOWLEDGEMENTS The authors are grateful to R. A. Bari (BNL), J. Mitchell, J. Rosenthal, L. G. Hulman, R. Palla, and M. W. Hodge (NRC) for review and many helpful re-marks on this manuscript. The authors also wish to thank T. Rowland for the excellent job in typing the various versions of the manuscript.

e

f

-v-TABLE OF CONTENTS Page ABSTRACT............................................................. iii ACKN0WLEDGEMENTS..................................................... iv LIST OF TABLES....................................................... vii LIST OF FIGURES...................................................... viii

1. INTRODUCTION..................................................... 1 1.1 Background.................................................. 1 1.2 Ob j e c t i v e s a n d Sc o p e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.3 Organization of the Report.................................. 2

2. PLANT DESIGN FEATURES IMPORTANT TO SEVERE ACCIDENT ANALYSIS...... 3 2.1 As se s sment o f Pl a nt Des i g n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.2 Comparison to Zion and Indian Point Plant Designs........... 6

3. CONTAINMENT RESPONSE AND RADIOLOGICAL SOURCE TERMS............... 9 3.1 Description of Plant Damage States and Containment Re s p o n s e Cl a s s e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.2 Conta i nment Anal ysi s Method s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.3 Containment Event Tree and Accident Phenomenology........... 18 3.4 Contai nment Mat ri x (C-Mat ri x ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 3.5 BNL/NRC Rea sses sment of the C-Mat ri x. . . . . . . . . . . . . . . . . . . . . . . . 21 3.5.1 Conditional Probability of Release Categories........ 21 3.5.2 Release Category Frequencies......................... 28 3.6 Ac c i d e n t So u rc e Te rm s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 3.7 BNL/NRC Reassessment of Radiological Source Terms........... 33

4. CONSEQUENCE CALCULATION METHODOLOGY AND THE MILLSTONE-3 SITE MODEL 39 4.1 Introduction................................................. 39 4.2 Probabilistic Assessment of Severe Accident Consequences..... 39 4.3 Use of the Mil l stone-3 Si te Mode 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 4.4 Consequences of Postul ated Severe Accidents. . . . . . . . . . . . . . . . . . 43

5. SEVERE ACCIDENT ~ RISK ESTIMATES.................................... 45  ;

l 5.1 Comparison of Severe Accident Risks With Other Societal Risks 45 l 5.2 Comparison of Risk with Other Nuclear Power Plants........... 45 5.3 Domi n a n t Co n t ri bu t o r s t o Ri s k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5.4 To t a l R i s k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 1

e

--_--y.

-vi-TABLE OF CONTENTS

-(Continued)

Page

6. UNCERTAINTIES..................................................... 50 6.1 Cont a i nme n t Fa i l u re Ma t ri x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 6.2 Ra d i o l o g i c a l So u rc e Te rm s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 6.3 Co n s e q u e n c e An a l y s i s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

7. ANALYSIS OF MITIGATIVE SYSTEMS.................................... 55 7.1 Hydrogen Burn Fail ure at Intermediate Time (M6) . . . . . . . . . . . . . . 57 7.2 Late Contai nment Fail u re. (M6 and M7 ) . . . . . . . . . . . . . . . . . . . . . . . . . 57 7.2.1 No n-Se i smi c In i ti a t o r s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 7.2.2 Seismic Initiators.................................... 60 B.

SUMMARY

........................................................... 62 REFERENCES............................................................ 63 ,

l I

..,,,,r. ..

l l

-vii-  ;

LIST OF TABLES Table Caption Page 2.1 Comparison of Design Characteristics....................... 8 3.1 Notation and Definitions for Plant Damage States. .. . . . . . . . . 10 3.2 Containment Response Cl ass Defi nitions . . . . . . . . . . . . . . . . . . . . . 11 3.3 Containment Class Mean Frequencies (Per Reactor Year)...... '12 3.4 Breakdown of Seismic Frequencies by Degree of Severity (Per Reactor Year)....................................... 14 3.5 Containment Class Frequencies for Normal and Impaired Evacuation Cases (Per Reactor Year)...................... 15 3.6 Summa ry of MPSS-3 Computati onal Tool s . . . . . . . . . . . . . . . . . . . . . . 16-3.7 Summary of Containment Event Tree Time Frames and No d a l Qu e s t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 3.8 Notation and Definitions for Release Categories.. .. . . . . . . . . 22 3.9 Containment Failure Probabilities (C-Matrix) from the MPSS-3............................................... 23 3.10 Simpl i fied C-Mat ri x Based on the MPSS-3. . . . . . . . . . . . . . . . . . . . 24 3.11 B NL /NRC Co n t a i nmen t Ma t ri x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 3.12 Frequencies of Risk-Significant Release Categories (Per Reactor Year)............................................ 29 3.13 MP SS-3 Rel ea se Categ ory Summa ry. . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3.14 MP S S- 3 Re l e a s e Ca t eg o ry DP Ds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 3.15 BNL/NRC Release Category Summary (Internal and Ex te rn a l Ev e n t s ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.16 Comparison of Estimated Release Fractions for Intermediate and Late Overpressurization (No Sprays); Millstone-3 Versus Indiar. Point...................................... 35 3.17 Release Times, Release Durations and Warning Times Assumed for Risk Significant Release Categories in the BNL/NRC Consequence Analysi s . . . . . . . . . . . . . . . . . . . . . . . . . 37 4.1 Emergency Response Assumptions for Millstone-3............. 42 4.2 Conditional Mean Values of Societal Consequences from Individual Release Categories for Two Alternative Offsite Emergency Response Modes......................... 44 5.1 A Breakdown of Mean Annual Risk by Release Categories for Internal Events, Fires and Earthquakes.(within 350 ' miles of the site boundary).................................... 46 5.2 Total Mean Annual Risk Estimates Based on D & M and SHCP Se i sm i c Ha z a rd Va l u e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 5.3 Comparison of Millstone-3 Risk Estimates with Zion, Indi an Poi nt and Lime ri ck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 6.1 Comparison of BNL/NRC Release Fractions for Millstone-3 with BMI-2104 Releases for Surry (late Containment Failure)................................................. 53 7.1 Mean Annual Public Exposure Risk Estimates from Various Containment Failure Modes for Internal Events, Fires and Seismic Events........................................... 56

I a

i ~

-viii-LIST OF FIGURES Figure Caption Page 2.1 Schematic of the Millstone-3 Containment Cooling System..... 4 i 2.2 Schematic of the Millstone-3 Lower Cavity Configuration..... 7 i

3.1 The MPSS-3 Computati onal Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 f

3.2 Containment Failure Pressure Distribution for Millstone-3... 19 1 7.1 Cost and Benefit Estimates and Uncertainty Ranges of Mitigative Features Which Would Provide Protection for 4

(a) Non-Seismic Overpressure Failure and Hydrogen Burns, and (b) Seismically Induced Overpressure Failure.......... 59 1

i f

1 9

1 a

-.--rn- -, .--a - - - - - - ,.:-, ,,,m,n--,---,,w,-----.-n.---,,--r-,-,.__,,,,vm , - - -- ,, ---- n_,,,,,--r-_, -n- - g~+-.ne

1. INTRODUCTION

1.1 Background

After the accident at Three Mile Island, the United States Nuclear Regu-latory Commission (USNRC) recognized the need to reexamine the capabilities of nuclear power plants to accommodate the effects of hypothetical severe acci-dents beyond the design basis. This reexamination included consideration of potential design modifications to mitigate the consequences of these degraded and core melt accidents.

The Zion and Indian Point (Z/IP) power plants were chosen to . initiate this activity because the populations surrounding the two sites are larger than other reactor sites. The concern was that due to the proximity of these two sites to high population densities, they could comprise a disproportion-ately high component of the total societal risk from U.S. commercial nuclear power programs.

As part of this continuing effort, programs have been undertaken to eval-uate the risk from other plant sites situated near high population centers in order to examine the need for design modifications or mitigation features which could potentially reduce the accident risks at these facilities.

Millstone-3 is one of these plants.

Probabilistic Risk Assessment (PRA) studies have been . undertaken by a number of utilities [1-3] and reviewed by Brookhaven National Laboratory (BNL) under contract to the USNRC. The staff's initial contribution to the understanding of severe accident progression and mitigation specifically for the Z/IP facilities is presented in NUREG-0850.[43 In August 1983, Northeast Utilities Inc. completed a probabilistic safety study for Millstone-3. The Millstone-3 plant, which is currently undergoing operating license review, is located near a relatively high population center in sout Connecticut. The Mill stone-3 Probabilistic Safety Study (MPSS-3)hegstern L6J included a probabilistic evaluation of core melt frequencies, an analysis of containment failure modes and radionuclide releases, and an assessmer:', of radiological consequences.

This report describes the review and evaluation- by the USNRC staff and their contractors at BNL of the containment failure modes, radiological source terms and offsite consequences for the MPSS-3.

1.2 Objectives and Scope The objective of this report is to provide a severe accident risk per-spective as a basis for examining the need for potential safety improvements to the Millstone-3 plant. The report describes severe accident phenomenology, containment response, radionuclide releases, and offsite consequences. Core melt frequencies are discussed in a separate report which was prepared for the Reliability and Risk Asse sm Branch of NRC by the Lawrence Livermore NationalLaboratory(LLNL).p6]ent

. . ._ _. ._- - .=. .-- _- .-. . ._

In the present report, principal containment design features are dis-cussed and compared with those of Indian Point and Zion. Those portions of the MPSS-3 related to severe accident phenomena, containment response, source terms and consequences, are described and evaluated. Numerical adjustments to j the MPSS-3 estimates are documented and justified.

Severe accident risk estimates are presented and some uncertainty esti-mates are described. The contributions to risk from individual accident se-quences and containment failure modes are presented. An assessment of poten-tial severe accident mitigative features is also presented.

1.3 Organization of the Report A brief review of the Millstone-3 plant design and features is presented in Chapter 2 along with comparisons to Zion and Indian Point plant designs.

Chapter 3 contains the assessment of containment performance. Specifically, analytical methods, containment event trees, accident phenomenology, the con-tainment matrix, and radiological source terms are reviewed. Where adjust-ments to the applicant's calculations were deemed necessary, changes have been documented and justified. Chapter 4 addresses the approach used by the NRC staff to calculate the offsite consequences. In Chapter 5, the NRC/BNL severe accident risk estimates are presented and discussed; Chapter 6 includes a dis-cussion of uncertainties. Cost-benefit analyses to evaluate potential miti-gative design improvements are described in Chapter 7. The results of this review are summarized in Chapter 8.

4 l .

4 l

---

--#.-m- - _ , - - - , - - - , - , _ , , - - ,,.-_.__,-_.--,,_--m, m,-- , - _ . . , ,----,--r--,,--- ,,--,-- ,,

l

2. PLANT DESIGN FEATURES IMPORTANT TO SEVERE ACCIDENT ANALYSIS In this section, those plant design features that may be important to an assessment of degraded core and containment analysis are reviewed. These im-portant features are then compared with the Zion and Indian Point facilities in order to identify commonalities and differences for benchmark comparisons.

2.1 Assessment of Plant Design Millstone-3 is a four-loop Pressurized Water Reactor (PWR). The Nuclear Steam Supply System was designed by Westinghouse; the major b41 ce of plant systems and the containment were designed by Stone and Webster.L The plant is a 3411 MWt (1150 MWe) power reactor employing the Westing-house 17 x 17 core design. The reactor coolant system is a four-loop config-uration with U-tube recirculating steam generators. The emergency core cool-ing system consists of four accumulators containing 7100 gallons of water each, which are designed to discharge when the reactor coolant system pressure falls below 600 psia, and a safety injection system which draws water from a 1.2 million gallon refueling water storage tank and delivers it to the reactor coolant system via either the charging pumps, high head safety injection pumps or low head safety injection pumps. The long-term core cooling is attained by a completely independent recirculation cooling system (whose major components are shared witn the recirculation spray system) which consists of four pumps and four heat exchangers which are cooled by the service water system.

The auxiliary feedwater system also provides a core cooling function by removing heat from the RCS after reactor shutdown via the steam generators.

This system, which consists of two motor driven pumps and one turbine driven pump takes suction from the condensate storage tank.

The Millstone containment structure is a carbon steel-lined, reinforced concrete. structure with a net free volume of about 2,260,000 cubic feet. The Millstone containment design uses the subatmospheric containment concept.

During normal operation, the containment atmosphere will- be maintained at a subatmospheric pressure of approximately 9 to 12 psia.

The secondary containment in the Millstone design is comprised of the containment enclosure building and the associated supplementary leak collec-i tion and release system (SLCRS) provided to mitigate the radiological conse-quences of postulated design basis accidents.

i The Millstone design includes two independent active containment heat removal systems (CHRS) (Figure 2.1). These are the quench spray system (OSS) and the recirculation spray system (RSS). The containment air coolers are not considered part of the CHRS. The CHRS is designed to depressurize the con-tainment to a subatmospheric condition within one hour following a high energy line break accident.

ENCLOSURE BVILDING CUENCA SPRAYS (2) i used 3*- l

}

RwST oaaa a

SLCRS

[] SERVICE WATER I9 d

A

() aECiRCutArios 5 FRAYS (4)

To j l ST b i SUM P Figure 2.1 Schematic of the Millstone-3 Containment f Cooling System

I The QSS consists of two redundant 100 percent-capacity trains, each con-taining a quench spray pump, a chemical injection system and riser pipes lead-ing to two common 360 quench spray headers. Rated flow to the quench spray headers is approximately 4000 gpm with one quench spray pump operable and 6000 gpm with both pumps operable. Each redundant quench spray subsystem draws water independently from the 1.2 million gallon refueling water storage tank. The QSS is actuated automatically upon receipt of the containment de-pressurization signal (CDA). The CDA signal is initiated by high containment pressure (24.7 psig). The quench spray is terminated when the RWST reaches a predetermined low level.

The RSS consists of two parallel redundant 100-percent-capacity trains ,

each containing two containment recirculati .. pumps with dedicated heat ex-changers, and riser pipes leading to two common 360 recirculation spray headers. The rated flow for each recirculation pump is about 3900 gpm. The four redundant recirculation spray subsystems take suction from the contain-ment sump; the recirculation spray water flows through recirculation coolers where it is cooled by the service water. The .RSS pumps are started automat-ically approximately 4 minutes after receipt of the CDA signal.

An important f. actor in the reliability of recirculation spray for PWRs is the susceptibility of the containment sump to blockage. The principal threat of sump blockage is the insulation material which would be scattered by the jet created in large or intermediate break loss of coolant accidents (LOCA's). The ability of the sump to remain operational is a confirmatory item in the licensing review of Millstone-3. The significance of this issue lies not only in its effect on spray operation, but also on the likelihood that large and intermediate break LOCA's will result in core melt as a result of pump failure due to loss of NPSH. Because of the large debris screen area in the Millstone-3 sump, and because of the favorably low heat-loss character-istics of the insulation on the Millstone-3 primary coolant system, the staff has concluded that this effect will not contribute significantly to risk.

For certain severe accidents, core debris may be dispersed from the reac-tor cavity. The potential for this debris to be -transported to the contain-ment sump and to impact the performance of the recirculation spray pumps (via either sump screen blockage or debris ingestion) has not been addressed in the PRA. The likelihood of transporting a significant amount of core debris to-the sump area is considered to be small for two reasons. Fi rst , the con-figuration of the reactor cavity is such that the bulk of corium released from the reactor vessel would be trapped within the cavity, with only the smaller particles capable of exiting the cavity. Second, the region of containment into which the exiting debris would enter is not swept by the containment sprays; thus the potential for transport of debris to the sump is reduced.

The hydrogen recombiner system consists of two redundant thermal-type hy-drogen recombiners and associated control units located in the recombiner building. Each recombiner train has a capacity of 50 SCFM and is designed to seismic category I design criteria. The recombiner system is supplied from the Class IE emergency buses, and is manually started and operated from a

i local control panel. Operation of the hydrogen recombiner system during a severe accident would not significantly impact the accident progression since the predicted rates and magnitude of hydrogen generation and release for such accidents far exceed the capacity of the recombiner system.

. The containment geometry in the area underneath and around the reactor vessel precludes water from entering the reactor cavity area until a major l portion of the Refueling Water Storage Tank (RWST) has been exhausted via the quench spray system (see Figure 2.2). The containment design also includes a permanent seal ring between the reactor vessel flange and the biological shield wall s , which would prevent introduction of water into the reactor cavity from either break flow or spray flow in the area of the reactor vessel or the refueling cavity. This is referred to as a dry cavity configuration.

The cavity geometry is expected to suppress the dispersion of core debris from the reactor cavity to the general containment area following failure of the reactor vessel during core melt sequences. The cavity area geometry also i would reduce the potential for establishing effective convective air currents between the cavity and general containment area for heat removal from core debris in the reactor cavity area.

The containment building basemat and the internal concrete structures are composed of basaltic-based concrete. As concrete is heated, water vapor and other gases are released. The initial gas release consists largely of carbon monoxide, carbon dioxide, the quantity of which depends on the amount of cal-cium carbonate in the concrete mix. Limestone concrete can contain up to 80%

calcium carbonate by weight, which could yield up to 53 lb of carbon dioxide per cubic foot of concrete. However, basaltic-based concrete contains very little calcium carkopate and would not therefore release a significant amount of carbon dioxide.L4J 2.2 Comparison to Zion and Indian Point Plant Designs Table 2.1 sets forth the design characteristics of the Zion (Units 1 or

2) and the Indian Point (Unit 2) facilities as they compare to the Millstone Unit 3 plant.

It is seen that the three plants are quite similar in containment build-ing and primary system design although there are differences in the contain-ment cooling mechanisms, the lower reactor cavity configuration, RWST volume and the chemical compositions of the concrete mix, l

4 1

1 4

- .- y m.-- .m.w- y _-._.,__,..-._,,y-

, , _ _%...7_--_y,.,.,_.y .__ 7,, .,,,,,,,.,,.ym -,

/MY

$ k

% ()

M A NWAY ik Ej O

[1 5

%~

E 5;

{ j jfesset A.7s to*

i.t ers fd '

'V **

n

.9 -

W:+2xMnMDB MfkhWnKrB 9977Mka27%

~

Figure 2.2 Schematic of the Millstone-3 Lower Cavity Configuration

i Table 2.1 Comparison of Design Characteristics Zion Indian Point Millstone Unit 1 EI'43 Unit 2[3,4]

^

Design Parameters Unit 3[5]

Reactor Power [MW(t)] 3250 3030 3411 i

Containment Building:

(ft ) 2.26 x 10 6 Free Volume 3 2.73 x 106 2.61 x 106 Design Pressure (psia) 62 62 59.7 Initial Pressure (psia) 15 14.7 12.3/8.9*

Initial Temperature - (*F) 120 120 120/80 Primary System:

Water Volume (ft )

3 12,710 11,347 11,695*

Steam Volume (ft )

3 720 720 380*

• Mass of UO2 in Core (1b) 216500 216600 222739 Mass of Steel in Core (lb) 01,0,00- 20,407 Mass of Zr in Core (lb) 44,500 44,600 45,296 Mass of Bottom Head (lb) 87,000 78,130 87,000 Bottom Head Diameter (ft) 14.4 14.7 14.4 Bottom Head Thickness (ft) 0.45 0.44 0.45 Containment Building Heat Removal:

Sprays yes yes yes Fans yes yes no Accumulator Tanks:

Total Mass of Water (1b) 200,000 173,000' 236,000*

Initial Pressure (psia) 665 665 665*

Temperature ( F) 150 150 80 Refueling Water Storage Tank:

Total Mass of Water (1b) 2.89 x 106 2.89 x 106 1 x 10 7 Initial Pressure (psia) 14.7 14.7 14.7 Temperature ( F) 100 120 50/40 Reactor Cavity:

Design. Wet Wet Dry Concrete Material Limestone Basaltic Basaltic )

i

• These values were taken from the Millstone-3 FSAR and Technical l Specifications. l i

I l

1

3. CONTAINMENT RESPONSE AND RADIOLOGICAL SOURCE TERMS I,n this_ chapter, the review of containment response to severe accidents is described. The timing and mode of containment failure, as well as the ra-diological source terms are examined and discussed.

~

3.1 Description of Plant Damage States and Containment Response Classes In the tiPSS-3, each core melt accident sequence is assigned to one of the plant damage states listed in Table 3.1. Summation over all of the frequen-cies of core melt accidents associated with a given plant damage state yields the annual frequency of the damage state.

The plant damage states classify events according to three parameters; t (1) Initiating Event, namely:

A -

Large break Loss-of-Coolant Accident (LOCA)

S -

Small break LOCA S' -

Incore instrument tube LOCA T -

Transient V2 -

Steam Generator Tube Rupture (SGTR)

V3 -

Seismic induced large LOCA with failure of ECC injection combined with containment bypass

. V -

Interfacing systems LOCA (2) Timing of Core Melt, namely:

E -

Failure of' Emergency Core Cooling Injection (ECCI)

L -

Failure of ECC recirculation (3) Status of Containment Heat Removal (CHR), namely:

- Complete loss of Containment Sprays (CS)

C' -

Loss of recirculation CS C" -

Loss of quench CS C - All spray systems available From the viewpoint of containment response, many of the pl ant damage states can be grouped into containment classes. The classes defined in Table 3.2 are dif ferentiated primarily according to spray availability. The fre-quency of each containment class is the sum of the frequencies of the plant damage states assigned to the class.

Annual pl ant damage state frequencies calculated by the applicant fo r both internal and external events were reviewed and evaluated by the Relia-bility and Risk Assessment Branch (RRAB) of the U.S. Nuclear Regulatory Com-mission [fq. RC) with assistance from the Lawrence 'Livermore National Laboratory (LLNL). Table 3.3 presents the containment class frequency estimates of RRAB for internal events and fi res . Also included are seismic containment

,e Table 3.1 Notation and Definitions for Plant Damage States Symbol Description AEC Large LOCA, Early Melt AEC' Large LOCA, Early Melt, Failure of Recirculation Spray AE Large LOCA, Early Melt, No Containment Cooling AL' Large LOCA, Late Melt ALC' Large LOCA, Late Melt, Failure of Recirculation Spray ALC" Large LOCA, Late Melt, Failure of Quench Spray AL Large LOCA, Late Melt, No Containment Cooling SEC Small LOCA, Early Melt SEC' Small LOCA, Early Melt, Failure of Recirculation Spray SE Small. LOCA, Early Melt, No Containment Cooling S'E Incore Instrument Tube LOCA, Early Melt, No Containment Cooling

~

S'EC ~Incore Instrument Tube LOCA, Early Melt SLC Small LOCA, Late Melt SLC' Small LOCA, Late Melt, Failure of Recirculation Spray SLC" Small LOCA, Late Melt, Failure of Quench Spray SL Small LOCA, Late Melt, No Containment Cooling S'l Incore Instrument Tube LOCA, Late Melt, No Containment Cooling TEC Transient, Early Melt TEC' Transient, Early ikit, Failure of Recirculation Spray TE Transient, Early Melt, No Containment Cooling V2EC Steam Generator Tube Rupture, Steam Leak, Early Melt V2EC' SGTR, Early Melt, Failure of Recirculation Spray V2E SGTR, Early Melt, No Containment Coolirg V2LC SGTR, Late Melt V2LC' SGTR, Late Melt, Failure of Recirculation Spray V2LC" SGTR, Late Melt, Failure of Quench Spray.

V2L SGTR, Late Melt, No Containment Cooling V Interfacing Systems LOCA V3 Seismically Induced AE Combined with Containment Bypass

Table 3.2 Containment Response Class Definitions Containment Class Plant Darnage States 1 AE 2 SE 3 AL 4 TE 5 SL 6 AEC , ALC , SEC , SLC , TEC , S' EC 7 TEC', SLC' 8 AEC', ALC', SEC' 9 ALC", SLC" 10 S'E, S'l V

V2EC, V2EC', V2E, V2LC, V2LC', V2LC", V2L V3 I

i

Table 3.3 Containment Class Mean Frequencies (Per Reactor Year)*

Sei smic Containment Plant Damage Internal Dames & Seismic Class States Events Fires fbore SHCP 1 AE - -

SE-7 1E-5 2 SE 1.3E-5 -

6E-6 1E-4 3 AL - - -

4 TE 9E-7 3E-6 -

1E-6 5 SL -

6 AEC, ALC, SEC, 1.0E-4 3E-6 - -

SLC, TEC, S'EC 7 TEC', SLC' 6E-7 2E-7 - -

8 AEC', ALC', 3E-7 1E-7 - -

SEC' 9 ALC", SLC" - - - -

10 S'E, S'l 2E-7 - - -

V 8E-7 - - -

V2EC, V2EC', 2.5E-6 - - -

V2E, V2LC, V2LC', V2LC" V2L V

3 IE-7 4E-6 e

• assistance Frequenciesfromar.ethebased on theLivermore Lawrence review ofNational fiillstone-3 PSS by t)6]NRC Laboratory.. staff, with Frequencies less than 1E-7 per react,or year have been neglected.

.V d'

class frequency estimates based on two seismic hazard curves, one developed by the applicant's contractor (Dames and Moore), and one developed by the Lawrence Livermore acterization National7J Project (SHCP). [Lgboratory as part of the Seismic Hazard Char-The staff believes that the severe accident risk estimates attributable to seismic events are bounded on the high end by the SHCP results and on the low end by the Dames and Moore results.

In order to comprehensively assess the risk from seismic events, it is net 2ssary to make separate consequence calculations for those accidents which are initiated by ' earthquakes severe enough to impair evacuation. For this purpose, both the Dames and Moore and SHCP seismic frequency estimates are divided into two categories (Table 3.4). The seismic events with peak ground acceleration below 0.5 g can be binned with internal events and fi res .

Seismic events with acceleration greater than 0.5 g are judged to impai r evacuation, and are treated separately in the consequence analysis (Table 3.5). More details of the consequence analysis are given in Chapter 4.

3.2 Containment Analysis Methods A brief description of the computer codes used in the MPSS-3 to perform the transient degraded core and containment response analyses is provided in this section.

Table 3.6 summarizes the code package as applied to various phases of the accident. It is seen that the MARCH code is used to model the core and pri-mary system behavior and to obtain the steam and water energy releases for (1) the entire transient in the case of non-dispersal accident events and (2) un-til the vessel failure for the dispersal (high pressure) scenarios. These mass and energy releases form the input for the other computer codes used to evaluate the containment response for the non-dispersal cases (Figure 3.1).

For sequence classes in which the reactor coolant system remains at an elevated pressure until the vessel failure (dispersal cases), the MODMESH code is used. This code calculates the steam and hydrogen blowdown from the reac-tor vessel using an isothermal ideal gas model. The water boil-off from the reactor cavity floor is modeled using a saturated critical heat flux correla-tion. Additionally, the accumulator discharge following primary system de-pressurization caused by the vessel failure is also considered.

For the non-coolable debris bed and core-concrete interaction, the INTER i

subroutine of MARCH is replaced by the CORCON-MODI code modified by Westing-house. The output from MARCH or CORCON is used as input, after preprocessing by MODMESH, to the C0C0 CLASS 9 code. The C0C0 CLASS 9 code replaces the MACE subroutine of the MARCH code. In the C0C0 CLASS 9 code, the containment steam /

water, noncondensibles, and the sump water are modeled by a single volume.

The code also includes a structural heat transfer model, hydrogen combustion, and capability for containment heat removal' through containment sprays and sump recirculation spray s stems, as described in Section 4.3.2 and Appendix 4-E of the MPSS-3 report.E L

y-Table 3.4 Breakdown of Seismic Frequencies by Degree of Severity (Per Reactor Year)

Frequency (Per Reactor Year)

Containment Dames & Moore SHCP Class <.5g >.5g <.5g >.5g 1 7.8E-8 4.2E-7 1.1E-6 8.9E-6 2 3.1E-6 2.9E-6 4.0E-5 6.0E-5 4 - -

3.5E-7 6.5E-7 V3 1.6E-8 8.45-8 3.0E-7 3.7E-6

Table 3.15 BNL/NRC Release Category Summary (Internal and External Events)

Release Release Fission Product Release Fractions Duration Energy Catego ry (hrs) (Btu /hr) Xe-Kr 01 I-Br Cs-Rb Te-Sb Ba-Sr Ru La M-1A 1.0 0.5 E6 IE-0 7E-3 4.8E-1 7.9E-1 4.4E-1 9E 4E-2 6E-3 M-1B 1.0 0.5 E6 9E-1 7E-3 7E-2 SE-2 3E-2 6E-3 2E-3 4E-4 M-2A 2.0 150 E6 7E-1 SE-3 SE-1 6E-1 2E-1 7E-2 2 E-2 3 E-3 M-2B 0.5 520 E6 9E-1 -

7 E-1 4E-1 4 E-1 SE-2 4 E-1 3E-3 M-3 2.0 190 E6 8E-1 SE-3 SE-1 6E-1 2E-1 8E-2 3E-2 3E-3 M-4 2.0 70 E6 9E-1 6E-3 2E-1 6E-1 SE-1 7E-2 S E 7E-3 l M-5 0.5 150 E6 9E-1 6E-3 1E-2 SE-1 SE-1 SE-2 4E-2 6 E-3 M-6 0.5 150 E6 9E-1 6E-3 1E-2 SE-1 SE-1 SE-2 4E-2 7 E-3 M-6S 0.5 70 E6 9E-1 -

7E-3 IE-3 '1E-3 IE-4 9E-5 I E-5 M-7 0.5 150 E6 9E-1 6E-3 9E-3 3E-1 3E-1 3 E-2 2 E-2 4E-3 M-8 0.5 22 E6 9E-1 7 E-3 8E-3 1E-5 1E-5 1E-6 1E-6 2E-7 M-9 0.5 22 E6 9E-1 6E-3 2E-3 2E-6 1E-6 2E-7 9E-8 I E-8 M-10 10.0 n/a 3E-1 2E-3 8E-4 8E-4 1E-3 9E-5 7E-5 1E-5 M-11 10.0 n/a 6E-3 2E-5 2E-5 1E-5 2E-5 1E-6 1E-6 2E-7 M-12 5.0 n/a 1E-3 9E-6 6E-6 IE-6 9E-7 2E-7 8E-8 1E-8

l Table 3.6 Summary of MPSS-3 Computational Tools Computer Code Accident Phase

! MARCH 1. Non-dispersal Events - Total Transient

2. Dispersal Events - Initial blowdown, slump, and vessel failure

, MODMESH 1. Non-dispersal Events - Interface to other codes

2. Dispersal Events - Discharge and scatter within the reactor cavity, cavity boil-off CORCON-M001/W Core-concrete' interaction for dry cavity C0C0 CLASS 9 Containment building pressurization and hy~drogen

. combustion CORRAL-II Fission product transport in containment CRAC2 Consequences

f1 ARCH MASS / ENERGY (BOIL SUBROUTINE)

RELEASE DURING C0! LOFT AND flELT e TIME OF CORE SLUMP e RCS CONDITIONS AT CORE SLUMP M00 MESH MASS / ENERGY (DEMO SUSROUTINE)

RELEASE DURING VESSEL BLOWDOWN e TIME OF CeIITY AND 00!LOFF OF DRYOUT VESSEL WATER DISCHARGE CORCON-M001 (W VERSION) e itASS AhD ENERGY RELEASE DURING f1CCI MODMESH (MESH SUBROUTIhE)

MASS AND ENERGY INPU' TO CONTAINMENT COC0CLAS$9 CONTAINMENT PRESSURE, TEMPERATURE, HYDROGEN, FLAME TEMPERATURE. ETC.

Figure 3.1 The MPSS-3 Computational Approach

Fission product transport and consequence calculations are performed using the CORRAL-II and CRAC-2 computer codes, respectively.

l Benchmark studies of the containment response codes are performed in Ap-i pendix 4-1 of the MPSS-3. There, it ~ is shown that, for a simulated " design basis" large break loss-of-coolant accident, C0C0 CLASS 9 results are in agree-ment with the results predicted by (1) the LOCTIC containment response code, used for licensing calculations, and (2) the MACE subroutine of MARCH 1.1. It must be noted that these analyses were performed only for the case without any core degradation, and therefore the containment atmosphere was close to saturation.

Due to the limited scope of the present review, detailed audits of calcu-lational results were not' made; however, the results of Contpi_qment Loads Working Group (CLWG) studies for the subatmospheric containmentle) and other generic studies were used to verify the validity of the MPSS-3 estimates.

Several important changes to the containment response matrix and source term estimates were made.

The containment failure pressure probability distribution (Fig. 3.2) was not evaluated as part of this review. .

3.3 Containment Event Tree and Accident Phenomenology An important step towards the development of the containment matrix in-volves the quantification of branch point probabilities in the containment event trees. These probabilities depend heavily on the analyses of degraded core phenomenology and the containment building response described in Sections 4.2 through 4.7 of the MPSS-3.L5j In the MPSS-3, the containment event tree is divided into six distinct time frames, which represent the time phases during an accident event in which potential containment failure is considered. Table 3.7 is reproduced from MPSS-3 and summarizes the six time frames along with the corresponding con-tainment event tree nodal questions.

3.4 Containment Matrix (C-Matrix)

The sixteen nodes in the Millstone-3 containment event trees are outlined in Table 3.7. A negative response at any of seven nodes (CII, CI2, CI3, CI4, CIS, CI6, and BM6) in the containment event trees result in failure of the containment building by a variety of failure modes. Each of these failure modes results in a particular radiological release category. For those paths that do not have a negative response at any of the seven nodes, the path will eventually result in no failure of the containment. The containment event trees, therefore, link damage states to a range of possible containment fail-ure modes via the various paths through the tree. For a given tree, each path ends in a conditional probability (CP) of occurrence and these cps should sum to unity. The quantification of an event tree is the process by which all the l

1.0 .

ZTH 8tDCDITTLE

.9 -

I e

. 3 t

.7 -

t I

.6 ,

a i

. 50Tw etitetNT I LE .

1.5 ,

O l e

' l I

i sN I I e .

i e i

.3 '

. e i

e

, . s .

.s t l i .

i .

e i

.1 . I i '

J I". P.E P.C EN T 13( , , , , s, e!

,o io 0 70 80 90 100 110 120 120 140 150 160 CCNTAIN.".ENT PRESSURE: a. (Ps G1 Figure 3.2 Containment Failure Pressure Distribution for Millstone-3

a c Table 3.7 Summary of Containma and Nodal Questions 5j

[nt Event Tree Time Frames Time Frame I: Accident Initiation < t < Core Degradation CII -

Is the containment intact?

Time Frame II: Core Degradation ;E t < Significant Debris Accumulation in Lower Plenum NB2 -

Does the hydrogen not burn?

Cl2 -

Does the containment remain intact?

Time Frame III: Significant Debris Accumulation < t < Vessel Failure in Lower Plenum CD -

Is the core melt incoherent?

NB3 -

Does the hydrogen not burn?

CI3 -

Does the containment remain intact?

Time Frame IV: Vessel Failure < t < Complete Depressurization QUE -

Is the core debris quenched?

NB4 -

Does the hydrogen not burn?

CI4 -

Does the containment remain intact? ,

Time Frame V: Complete Depressurization < t ;[ 4 Hr* After Vessel Failure CD5 -

Is the debris coolable?

NB5 -

Does the hydrogen not burn?

CIS -

Does the containment. remain intact?

Time Frame VI: 4 Hr After Vessel Failure < t < One Day CD6 -

Is the debris coolable?

NB6 -

Does the hydrogen not burn?

CI6 -

Does the containment remain intact?

BM6 -

Does the basemat remain intact?

• The cavityestimated is 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. 5] time [to boil off the accumulator water from the lower rea h

--.- -- ,- - ---, , ,,,,, me-.,-- - . . - - , _ _ , . , . _ - - - , , _ _ - . - - - - . _ _...-y,:..r e... ,_,-r , , - -..,m._,%%. ,,,.._,- , - _ . m-. -. ,.,- ,-, ,, -- ._-

paths are combined to give the conditional probabilities of the various re-lease categories. In the MPSS-3, thirteen release categories were used for the quantification process as summarized in Table 3.8. Note that one of these release categories (namely, M12) corresponds to no containment failure. Fis-sion product release for this category would, therefore, be via normal design (allowable) leakage paths in the containment building.

The quantification of the Millstone-3 containment event trees was a sig-nificant task, and it was necessary. to use a computer code, ARBRE, to the various path probabilities into the thirteen release categories.[5] group The containment matrix 'C' is a concise summary of the quantification process.

Table 3.9 is a ' reproduction of the C-matrix for the MP SS-3.[5] It lists the conditional probabilities of the release categories given the con-tainment response class. A simplification to the C-matrix is obtained in Table 3.10 by disregarding all of the very low probability values.

3.5 BNL/NRC Reassessment of the C-Matrix Staff of Brookhaven National Laboratory (BNL) together with the NRC staff, have reviewed those aspects of the MPSS-3 related to the containment response and failure modes. Hawever, they have not performed independent confirmatory calculations of accident progression and containment response.

Instead, adjustments to the MPSS-3 have been made based on the experience gaingd from the previops Zionll] and Indian PointL3] in-depth reviews of similar risk studies (i.e.

Probabilistic Safety Studies). -

The mode and timing of containment failure cannot be calculated with great accuracy. Judgments must be made about the nature of the dominant phen-omena and about the magnitude of several important parameters. Furthermore, the codes and methods used for these calculations are approximate and.do not model all of the detailed phenomena. Fortunately, risk estimates are not sen-sitive to minor variations in failure mode and timing. It is important, how-ever, to properly characterize the major attributes of failure mechanisms:

(1) whether the failure is early or late, (2) whether it is by overpressuriza-tion, bypass or basemat melt-through and (3) whether or not radionuclide re-moval systems are effective.

3.5.1 Conditional Probability of Release Categories Our reassessment of the containment response and failure mechanism was based on our general understanding of the accident phenomenology and the con-tainment design. The resulting simplified C-matrix shown in Table 3.11 in-cludes only those failure modes which would contribute significantly to risk.

The phenomena of interest may be summarized as follows:

In-Vessel Steam Explosions (M2B), which result in direct containment failure are believed to be highly unlikely. Although explosions in the reac-tor vessel lower plenum are highly probable, the resulting mechanical energy would. be limited by the fraction of the core which could participate in a single explosion and by the efficiency of the process. In recent PRA reviews,

Table 3.8 Notation and Definitions for Release Categories Release Category Description M1A Containment Bypass, V-sequence M1B Containment Bypass, SGTR M2 Early Failure /Early Melt, No Sprays

)

M3 Early Failure / Late Melt, No Sprays M4 Containment Isolation Failure M5 Intermediate Failure / Late Melt, No Sprays M6- Intermediate Failure /Early Melt, No Sprays M7 Late Failure, No Sprays M8 Intermediate Failure With Sprays M9 Late Failure With Sprays M10 Basemat Failure, No Sprays Mll Basemat Failure With Sprays M12 No Containment Failure

Table 3.9 Containment Failure Probabilities (C-Matrix) from the MPSS-3[5]

Containment Class 'M1A M1B M2 M3 M4 MS M6 M7 M8 M9 M10 Mll M12 1

1 1 - -

2.87E-4 -

2E-4 -

6.16E-1 2.9E-1 - -

9.34E-2 -

1.32E-5 2 - -

1.15E-3 -

2E-4 -

6.17E-2 8.9E-1 - -

4.6E-2 -

1.40E-5 3 - -

3.07E-4 -

2E-4 -

5.3SE-1 3.5E-1 - -

1.13E-1 -

1.59E-5 l 4 -

2E-4 -

1.0E-4 2E-4 4.36E-3 -

9.0E-1 - -

9.83E-2 -

1.98E-5 5 - - -

2.3E-4 2E-4 9.48E-3 -

8.0E-1 - -

1.96E-1 -

2.94E-5 6 -

2E-4 2.9E-4 -

2E-4 6.37E-4 1.18E-4 9.48E-1 SE-2 7 - - -

2.9E-4 2E-4 6.38E-4 -

9.98E-1 - - -

9.89E-4 3.51E-5 A, 8 2.4E-4 2E-4 w 9.98E-1 6.77E-4 - -

9.77E-4 2.16E-5 '

9 -

2E-4 2.9E-4 -

2E-4 - - -

6.63E-4 1.19E-4 -

9.89E-1 1E-2 10 - -

2.1E-4 -

2E-4 1.1E-3 -

9.89E-1 - -

9.88E-3 -

1.1E-5 V 1.0 - - - - - - - - - - - -

V 2

1.0 - - - - - - - - - - -

V3 - - - -

1.0 - - - - - - - -

i I

l l

5 l

l

W Table 3.10 Simplified C-Matrix Based on the MPSS-3 Contain- Plant ment Damage Cl ass States M1A M1B M4 MS M6 M7 M9/M10/M11 ,, M12 1 AE 0.62 0.29 0.09 2 SE 0.06 0.89 0.05 3 AL 0.54 0.35 0.11 4 TE , 0.90 0.10 5 SL 0.01 0.79 0.20 6 _ _C 0.05 0.95 7,8 _ _C' 1.0 9 _ _C" 10 S'E,S'l 0.99 0.01 V- 1.0 0.99 0.01 V2 1.0 V3 1.0 l

l 1

u _ _ _ _ - - - _ _ . - - _ _ - - _ _ _ - - _ _ - _ _ _ _ _ _ _ - _ - .'

r we have assigned a conditional of 10 4 to direct containment failure due to this mechanism.1 probability 3] At this level, steam explosions would have a negligible ef fect on risk, and consequently they are not included in the simplified C-Matrix (Table 3.11).

Failure to Isolate Containment (M4) is considered a relatively unlikely event for a subatmospheric containment, because the plant is required by tech-nical specification to maintain a partial vacuum during all modes of operation except cold shutdown and refueling. Thus, there is a high probability that all sizable penetrations to the containment will be isolated prior to a severe accident. While we are not convinced the probability is as low as the appli-cant assumes (2x10 "), we are confident that it is low enough' to be a minimal contributor to risk. Therefore, we do not include this failure mode (M4) in the simplified containment matrix (Table 3.11). (The M4 failure due to the V 3 containment response class will be explained in Section 3.6 below.)

Early Containment Failure (M2A and M3) following core melt can resul t from rapid steam production as the core enters the reactor cavity (steam spike), or from a prompt hydrogen burn. Simple adiabatic calculations show that the steam spike from complete and rapid quench of the core would produce a peak pressure well below the containment failure point (refer to Fig. 3.2).

Similarly, assuming 1000 pounds of in-vessel hydrogen production, a complete adiabatic hydrogen burn at the time of vessel failure would also fall well below the. failure pressure. A combination of a steam spike and hydrogen burn would be very unlikely because the steam tends to inert the containment atmosphere at high steam mole fractions (>0.50) and prevent H2 burning. Our calculations indicate that even this improbable occurrence would not be likely to fail containment.

Early failure could also conceivably result from direct heating due to a rapid dispersal of the core debris throughout containment in the form of aero-sol s. The dispersal could only be caused by the high primary system pressures that would exist at vessel failure for a number of transient sequences. The aerosols could rapidly pressurize containment by direct heat exchange and con-comitant chemical reactions. Scoping calculations performed by the Contain-ment Loads Working Group (CLWG) showed that a very severe challenge to the containment integrity converted to aerosol.[could 12] result provided However, 25 percent no consensus couldofbethe core mass reached amongwere the.

CLWG analysts as to the credibility of this parameter value, and this failure mode is still under investigation by the CLWG. For the purpose of this re-l view, we do not assume any direct heating failure will occur. Millstone-3 has a somewhat larger volume, and higher failure pressure than considered by the CLWG, Furthermore, the design of the Millstone cavity would tend to suppress the dispersal of core debris beyond the cavity boundaries. Our assessment is that this mode of failure is not likely at Millstone-3. This issue is discus-sed further as part of the sensitivity analysis in Section 6.1.

For the reasons outlined above, we have concluded that early overpressure failure (M2A and M3) has a very low likelihood.

Intermediate Overpressure Fail ure (M6 and M6S) can occur due to com-bustion of hydrogen. Some time between four and sixteen hours after vessel

Table 3.11 BNL/NRC Containment Matrixt l-i k

Containment

Response

Cl ass M1A M1B M4 M6 (M6S) M7 M10/M11 M12 1 0.62 0.29 .09 2 0.34 0.03(1.0)* 0.63 3 0.54 0.35 0.11 4 0.90 0.1 5 0.80 0.2 6 .05 0.95 7,8 1.0 9 _

0.99 0.01 10 0.99 0.01 V 1.0 V2 1.0 V3 1.0 i

Matrix elements with low probabilities and with . low contributions to over-all risk have been deleted from the C-Matrix. This includes steam explo-sions (M2B) and early overpressure failures (M2A and M3).

• The conditional failure probability of the M7 release category following a seismically induced station blackout (SE) is 1.0. For non-seismic station blackouts, the conditional probabilities for M6S, M7, and M12 are 0.34, 0.03, and 0.63, respectively.

l l failure, the accumulated hydrogen production from all sources is expected to reach approximately 2,860 pounds, the maximum amount that could be burned by the oxygen in containment. The wide spread in estimated timing is due to un-l certainties in the rate at which core-concrete interaction progresses. De-

! tailed thermal-hydraulic calculations by the applicant and calculations per-l fonned as part of our review have shown that a hydrogen burn of this magnitude l could fail containment only for a narrow band of conditions in which the steam

concentration is high enough to produce a sufficient ^ containment background pressure, out not sufficient to inert the containment. There are only two scenarios in which this is believed to be attainable

(1) the AE sequence and (2) station blackout.

In the AE sequence, the applicant's thermal hydraulic calculations show that the containment atmosphere becomes deinerted less than an hour after core melt and reaches peak flammability about three hours later with a background pressure of 50 psia. The applicant's estimate of a high (0.62) probability for intermediate failure (M6) is reasonable in view of these conditions. The fact that it is less than unity would reflect the uncertainty in the burn pressure spike and also the possibility that the burn would occur before the hydrogen concentration reached the containment failure threshold.

A similar analysis for the SE sequence showed the atmosphere to be mar-ginally inerted throughout the accident. As a measure of conservatism, and to account- for uncertainties, the applicant has assumed a 0.06 probability for hydrogen burn failure at intermediate time (M6) in SE sequence.

In the NRC/BNL review, the SE sequence is dominated by station blackout sequences resulting in pump seal LOCA, in which containment sprays are not re-covered until six or more hours af ter core melt. We postulate that a large hydrogen burn is likely to occur due to deinerting of containment in the pe-riod beyond six hours. If deinerting results from late resumption -of spray operation, we estimate a 50 percent probability of containment failure. How-I ever, spray operation is estimated to greatly reduce the suspended aerosol concentration, thereby leading to reduced consequences. The corresponding re-lease category is labelled M6S.

Recent calculations by Sandia National Laboratory [9] indicate that de-inerting due to natural condensation processes is also likely. The contain-ment failure probability in the event of condensation deinarting is estimated by the NRC and BNL to be in the vicinity of 10 percent, because the energy ef-ficiency of the burn would be suppressed by the presence of high steam concen-trations. Condensation deinerting would not yield the large source term re-ductions experienced with spray deinerting. Consequently, this failure mode was assigned to the M7 release category.

The release category probabilities quoted in Table 3.11 for the SE plant damage state were derived based on the relative probabilities of spray dein-erting and condensation deinerting, along with the conditional containment

! failure probability for each. Implicit in the numbers is the assumption that l some form of AC power is recovered within a day after vessel failure. This assumption is reexamined in Section 6 below. The parenthetical value of 1.0 for the M7 release probability was used for SE events caused by earthquakes.

l

It reflects our assumption that containment overpressure failure is inevitable for seismically induced station blackouts.

Late Overpressure Failure (M7) can occur due to steam production in a wet cavity or noncondensible gas production in a dry cavity. For sequences in which early and intermediate failure is not expected to occur, and in which the containment spray recirculation is inoperable, we conclude that the con-tainment will fail due to late overpressurization. These sequences include AE, TE, SE sequences other than station blackout, sequences in which only quench spray operates (AEC', SEC'...), and instrument tube LOCA's (S'L).

It is possible that late overpressure failure will be precluded by slow depressurization of containment due to leakage. Such enhanced leakage could result from containment penetration seal degradation due to the high contain-ment temperatures. A methodology for assessing this type of leakage has been developed by the NRC Containment Performance Working Group (NUREG-1037) and applied to several plants. Neither the NRC nor the applicant has made such an analysis of leak-before-failure specifically for the Mill stone-3. Conse-quently, for the purpose of this review, the reduction in late overpressure failure probability due to this mechanism has not been accounted for.

The Overpressure Failure with Sprays (M8 and M9), Basemat Mel t-through (M10.and Mll) or No failure (M12) would result from sequences in which spray operation or recirculating spray operation would occur, leading to reduced fission product release and negligible off-site consequences.

Three Containment Bypass modes were identified: the interfacing system LOCA (V), the steam generator tube rupture (V2 ) and the seismically induced crane wall failure (V3 ). Unique release categories were defined for the in-terfacing systems LOCA (M1A) and steam generator tube rupture (M18). The crane wall failure is postulated to cause a large LOCA with failure of ECC and a simultaneous breach of the containment. The V3 sequence is assigned to the M4 release category, in which a large fraction of all fission products are postulated to be released to the environment over a two-hour period immedi-ately following core melt. This is a reasonable choice because the M4 release category represents a large early release with relatively low release energy.

3.5.2 Release Category Frequencies Based on the containment class frequencies in Table 3.5 and the contain-ment failure matrix of Table 3.11 the frequencies for each release category were calculated and are listed in Table 3.12.

3.6 Accident Source Terms In this section the approach used in the MPSS-3 to determine the fraction of fission products originally in the core which can leak to the outside environment will be outlined. The fission products released to the environ-ment as calculated by this ' approach for each release category will also be discussed.

Table 3.12 Frequencies of Risk-Significant Release Categories (Per Reactor Year)-

Frequency (Per Reactor Year)

Based on Dames & Moore Seismic Based on SHCP Seismic Release Normal. Evacuation Impaired Evacuation Normal Evacuation Impaired Evacuation Category (Internal, Fire (Internal, Fire and Seismic <.5 9 ) (Seismic ).5g) and Seismic <.5g) (Seismic >.5g)

M1A 8E-7 -

8E-7 -

MlB 2.5E-6 -

2.5E-6 -

M4 1.6E-8 8.4E-8 3.0E-7 3.7E-6 $

M6 4.8E-8 2.6E-7 6.8E-7 5.5E-6 M7 8.6E-6 3.1E-6 4.6E-5 6.3E-5 M6S 4.6E-6 -

4.6E-5 -

l As in the Reactor Sa fety Study (RSS)[10] methodology, the CORRAL-II code is the most important t'ool for determining the fission product leakage to the environment. Input to this code is obtained from the thermal-hydraulic analysis carried out for the containment atmosphere. In addition, the time-dependent emission of fission products is provided as input to the code. The fission product release is divided up into the customarily used phases, i.e.,

Gap, Melt, and vaporization releases. The time dependence of these phases is determined by the timing of core heatup, primary system failure, and core / con-crete interaction. In all, thirteen release categories were estimated ranging from the containment bypass sequence (V-sequence) to the no-fail sequence (Table 3.13).

The M1A release fractions and timing are identical to the PWR2 release in the RSS. The release M1B, which corresponds to a steam generator tube rup-ture which progresses to a core melt, was determined by dividing PWR2 or M1A by ten. Noble gases and organic iodine are not subject to this reduction in release.

The source terms for overpressure failure were all based on plant speci-fic calculations with CORRAL-II. For early failure without sprays (M2 and M3) a large fraction of the fission products that are not still trapped in the core debris are released to the environment. Not surprisingly, the calculated releases for the failure to isolate containment (M4) are similar in magni-tude. For intermediate (MS and M6) and late overpressurization (M7) without sprays, the iodine concentration is greatly reduced, but all other species re-main fairly constant or increase due to additional releases from the core-con-crete interactions. With the exception of iodine, very little credit is taken for source term reduction due to residence time in the containment.

On the other hand, the intermediate and late overpressure containment failures with sprays (M8 and M9) have significantly lower release fractions compared with the analogous cases without sprays. With the exception of noble gases, all fission products were estimated to be significantly reduced by the operation of sprays.

Fission product releases for the basemat melt-through with and without sprays (M11 and M10) were. taken directly from the values used in the RSS.

They represent a decontamination factor of 1000 due to soil filtration.

The M12 sequence represents the case in which the sprays are operational and the containment remains intact. A leak rate of 0.9 volume percent per day is assumed. Releases are extremely low because of the assumed low leak rate and the reduced levels of suspended radioactivity in the containment due to spray operation. No credit was taken for fission product removal by the Sup-plementary Leak Collection and Release System.

The release fractions in Table 3.13 do not reflect all mechanisms of source-term attenuation. Retention of fission products in the primary system was not credited. Furthermore, the enhancement of gravitational settling in containment due to aerosol agglomeration was not included. To account for these factors and their associated uncertainties, the MPSS-3 employed the method of discrete probability distributions (DPD) for those release cate-gories in which CORRAL predicts large releases of fission product aerosols.

l

i i

Table 3.13 MPSS-3 Release Category Summary [5]

Release Release Start Warning Release Release Fission Product Release Fraction Release Time Time Duration Energy Category (hrs) .(hrs) (hrs) (Btu /hr) Xe-Kr 01 I-Br Cs-Rb Te-Sb- Ba-Sr Ru La M-1A 2.5 1.0 1.0 20 E6* 9E-1 7E-3 7E-1 SE-1 3E-1 6E-2 2E-2 4E-3 M-1B 2.5 1.0 1.0 20 E6 9E-1 7E-3 7E-2 SE-2 3E-2 6E-3 2E-3 4E-4 M-2 0.75 0.2 2.0 150 E6 7E-1 SE-3 SE-1 6E-1 2E-1 7E-2 2E-2 3E-3 M-3 6.0 0.5 2.0 190 E6 8E-1 SE-3 SE-1 6E-1 2E-1 8E-2 3E-2 3E-3 M-4 0.2 0.0 2.0 70 E6 9E-1 6E-3 2E-1 6E-1 SE-1 7E-2 SE-2' 7E-3 M-5 8.3 4.1 0.5 450 E6 9E-1 6E-3 1E-2 SE-1 SE-1 SE-2 4E-2 6E-3 5' M-6 4.3 4.1 0.5 440 E6 9E-1 6E-3 1E-2 SE-1 SE-1 SE-2 4E-2 7E-3 M-7 20.1 16.0 0.5 540 E6 9E-1 6E-3 9E-3 3E-1 3E-1 3E-2 2E-2 4E-3 M-8 4.5 4.0 0.5 22 E6 9E-1 7E-3 8E-3 1E-5 1E-5 1E-6 1E-6 2E-7 M-9 21.0 20.0 0.5 22 E6 9E-1 6E-3 2E-3 2E-6 1E-6 2E-7 9E-8 1E-8 M-10 95.0 80.0 10.0 NA 3E-1 2E-3 -8E-4 8E-4 1E-3 9E-5 7E-5 1E-5 M-11 95.0 80.0 10.0 NA 6E-3 2E-5 2 E-5 1E-5 2E-5 1E-6 IE-6 2E-7 M-12 0.5 0.0 5.0 NA 1E-3 9E-6 6E-6 1E-6 9E-7 2E-7 8E-8 IE-8

• 20E6 = 20 X 106 = 20,000,000

Table 3.14 MPSS-3 Release Category DPDs[5]

l Probability (P) Associated With Release Fraction (F)

Release Category F/1 1/2* 1/4 1/10 1/100 M1A 0.17 0.55* 0.28 0 0 M2 0.25 0 0.25 0.50 0 M3 0.0 0 0.06 0.63 0.31 M4 0.40 0.60 0 0 0 M5 0.0 0.0 0.05 0.64 0.31 M6 0.11 0.14 0.27 0.48 0 M7 0 0 0 0.11 0.89

• For release ~ category M1A, the probability (P) that the actual fission product releasts will be one half (F=1/2) of the values calculated by-CORRAL is estinated to be 0.55.

k

l In this method, the actual release fractions for a given release category can assume values which are a fraction (F) of the values given in Table 3.13. The allowed fractions are 1,1/2,1/4,1/10, and 1/100. A probability (P) is as-sociated with each F, and the probabilities are different for each release category (Table 3.14). For example, in a failure to isolate containment (M4),

there is an assumed 40% probability that F is equal to unity, and a 60% proba-I bility that F_ is 1/2. This small reduction in fission product release re-flects an assumed retention of fission products in the primary system, but very little effect of agglomeration. For late failure without sprays (M7),

agglomeration is assumed to play a significant role, and the source term would be reduced by a factor of 10 to 100. The values of F and P are based largely on engineering judgment.

3.7 BNL/NRC Reassessment of Radiological Source-Terms There are three significant areas in which we questioned the release fractions used in the MPSS-3. These are the release fractions for the bypass sequences, the iodine release for the overpressurization failure sequence (MS, M6 and M7), and release timings for certain sequences.

It is noted that the WASH-1400 PWR2 estimated release used in the MPSS-3 report for the release category M1A was defined for sequen. pes other than the interfacing system LOCA (Event V). The Oconee-RSS-MAPLllJ study produced a set of estimated releases specifically defined for the characteristics of a V sequence. Because the RSS-MAP source term estimate includes virtually no credit for fission product retention in the auxiliary building, differences between Oconee and Millstone-3 design are not important. Consequently, we decided to substitute the Oconee release fractions for the MPSS-3 values in release category M1A (see Table 3.15).

MPSS-3 does not give any basis for setting the M1B release fractions equal to one tenth of the PWR2 releases with the exception of noble gases and organic iodine. It is reasonable to assume that some fraction of the fission products would be deposited in the primary system piping, steam generator in-ternals and steam separators / dryers. Furthermore it appears that no CORRAL-II calculations have been performed for the tube rupture accident. Fortunately ,

for the large majority of core melt sequences from tube ruptures, RRAB esti-mates that there is no leakage through the relief valves. Further, if the re-lease is through the condenser, we can assume considerable deposition of fis-sion products. Consequently, the applicant's values are used in the present calculations.

The licensee calculated two sets of source terms, one based on the as-sumption of elemental iodine, and the other based on the more commonly ac-cepted model of iodine chemically bonded with cesium. Although the MPSS-3 risk calculations were based on the cesium iodide model, we chose to employ the elemental Iodine model in order to be more consistent with WASH-1400 methods. However, com. pari WASH-1400 methodologyL10] sons of Table in show discrepancies 3.13 thewith otherreleases iodine studies for performed the with M5, M6 and M7 release categories. In References [3] and [12], the iodine releases for late overpressure failure estimated for the Indian Point reactors were an order of magnitude higher than the MPSS-3 results (Table 3.16). The

Table 3.15 BNL/NRC Release Category Sumnary (Internal and External Events)

Release Release Fission Product Release Fractions Duration Energy Category (hrs) (Btu /hr) Xe-Kr 01 I-Br Cs-Rb Te-Sb Ba-Sr Ru La M-1A 1.0 0.5 E6 1E-0 7E-3 4.8E-1 7.9E-1 4.4E-1 9E-2 4E-2 6E-3 M-1B 1.0 0.5 E6 9E-1 7E-3 7E-2 SE-2 3E-2 6E-3 2E-3 4E-4 M-2A 2.0 150 E6 7E-1 SE-3 SE-1 6E-1 2E-1 7E-2 2E-2 3E- 3 M-2B 0.5 520 E6 9E-1 -

7E-1 4E-1 4E-1 SE-2 4E-1 3E-3 M-3 2.0 190 E6 8E-1 SE-3 SE-1 6E-1 2E-1 8E-2 3E-2 3E-3 M-4 2.0 70 E6 9E-1 6E-3 2E-1 6E-1 SE-1 7E-2 SE-2 7E-3 M-5 0.5 150 E6 9E-1 6E-3 1E-2 SE-1 SE-1 SE-2 4E-2 6E-3 M-6 0.5 150 E6 9E-1 6E-3 IE-2 SE-1 SE-1 SE-2 4E-2 7E-3 M-6S 0.5 70 E6 9E-1 7E-3 IE-3 1E-3 1E-4 IE-5 9E-5 M-7 0.5 150 E6 9E-1 6E-3 9E-3 3E-1 3E-1 3E-2 2E-2 4E-3 M-8 0.5 22 E6 9E-1 7E-3 8E-3 1E-5 IE-5 1E-6 1E-6 2E-7 M-9 0.5 22 E6 9E-1 6E-3 2E-3 2E-6 1E-6 2E-7 9E-8 1E-8 5 M-10 10.0 n/a 3E-1 2E-3 8E-4 8E-4 1E-3 9E-5 7E-5 1E-5 M-11 10.0 n/a 6E-3 2E 2E-5 1E-5 2E-5 1E-6 1E-6 2E-7 M-12 5.0 n/a 1E-3 9E-6 6E-6 1E-6 9E-7 2E-7 8E-8 1E-8

f Table 3.16 Comparison of Estimated Release Fractions for Intermediate and Late Overpressurization (No Sprays); Millstone-3 Versus Indian Point Release Fraction Fission Sequence Product Group MPSS-3* MPSS-3* IPS [12]t IPPSS [3]t M5 M7 TMLB'-6 2RW Xe-Kr 9E-1 9E-1 9.6E-1 1E0 10+I 1.6E-2 1.5E-2 1.05E-1 9.3E-2 Cs-Rb SE-1 3E-1 3.4E-1 2.6E-1

'Te-Sb SE-1 3E-1 3.8E-1 4.4E-1 Ba-Sr SE-2 3E-2 3.7E-2 2.5E-2 Ru 4E-2 2E-2 2.9E-2 2.9E-2 La 6E-3 4E-3 4.9E-3 1.0E-2

• These figures represent the MPSS-3 elemental iodine model.[5]

tFission product release fractions for late overpressure failure as esti-mated in the Indian Point Probabilistic Safety Study (IPPSS) and the NRC staff review of Indian Point (IPS).

releases of all other radionucli. des were of comparable magnitude. This is due to the fact that we are using source terms characteristic of gaseous iodine.

We have not adjusted the MPSS-3 release fractions. However, we have performed a consequence calculation which shows that an order of magnitude increase in Iodine releases would have a minimal impact on risk.

The energy of release for release categories M5 through M7 is high when compared to similar sequences (overpressurization failure) in other PRAs. The MPSS-3 release energy is more characteristic of a steam explosion release (a) as evaluated in the RSS. This value is a function of the failure pressure and the assumed rupture size. Furthermore, it has been found that a high energy of release lifts the plume to a higher altitude than a lower release energy.

The overall effect of this is to disperse the plume, and thus reduce the con-centration of the dose received by the surrounding population. This reduction in the dose affects consequences which are a function of a threshold dose, i.e., early fatalities. In view of the uncertainty and the possible effect on early fatalities, we have reduced the release energy from 450 x 106 to 150 x 106 BTV/hr as shown in Table 3.15 in our consequence analyses. The reduced release energy is consistent with values quoted in the Reactor Safety Study for overpressure failure.

Due to the significance of the release time of the early release categor-ies for generating early fatalities, and also the importance of the warning time on the effectiveness of evacuation, the release and warning times quoted in the MPSS-3 were reevaluated for each response class. The results of the reevaluations, based on the dominant sequence in each response class, are sum-marized as follows:

For the M1A and M1B release categories, the MPSS-3 release time and warn-ing times are acceptable.

Early and intermediate overpressure failures result primarily from hydro-gen burns. The release times for categories M2, M2, MS, M6 and M8 are calcul-ated as the time when containment atmosphere becomes flammable; otherwise, they are set to the vessel failure time for a given containment response class. Esti tes of the time of flammability were taken from Section 4.4 of the MPSS-3. The warning time is defined as the time after core melt j starts to the time of release. For M2B and M4 the release is assumed to occur

following vessel failure, and the warning time is the time following the core

melt to the time of radiological release in our consequence analyses.

For M7 and M9 through M12 the MPSS-3 release and warning times are accep-

) table since their influence on acute fatalities is negligible.

! In the consequence analysis, only one value of the warning time was used

] for each failure mode (Table 3.17). These values were chosen to represent the dominant sequence for each failure mode.

4 i

- - ~,-,-._,,.- - _ _.,--~.,- - _ --,, .,. . . - - . , . . , - , - - . - ,

I Table 3.17 Release Times, Release Durations and Warning Times Assumed for Ris.k Significant Release Categories in the BNL/NRC Consequence Analysis Release Time Release Duration Warning Time Failure Mode (hr) (hr) (hr)

M1A 2.5 1.0 1.0 M1B 2.5 1.0 1.0 M4 1.5(I) 0.25(I) 2.5(E) 1.0(E)-

M5 5,f 0.5 0.4 M6 0.8 0.5 0.2 M6S 11.5 0.5 5.9 M7 20.1 0.5 16.0

• Times given are for internal (I) and external (E) events.

L f

l 4

I i

The DPD methodology (Section 3.6, Table 3.14) has been examined and it was concluded that it should not be factored into the release fractions used for the present evaluation. Fission product retention in the primary system and aerosol agglomeration in containment are credible mechanisms for fission product attenuation, and are curren.tly under study by the NRC Accident Source Term Program Office ( ASTP0). Because the ASTP0 evaluation of the existence and magnitude of these mechanisms was not complete at the time we performed this assessment, there was no sound basis for assuming a reduction in radiolo-gical releases for all release categories. Even if the ASTP0 evaluation was available when this assessment was performed it is unlikely the DPD methodo-logy would have been accepted. This methodology is subjective in nature. We believe that reductions in source term estimates should be based on explicit '

mechanistic calculations. It is recognized that the decision not to factor in the DPD's' represents a conservative approach to the source-term.

i l

i i c 4

1 l

4. CONSEQUENCE CALCULATION METHODOLOGY AND THE MILLSTONE-3 SITE MODEL 4.1 Introduction The NRC staff has estimated the consequences and risks of potential se-vere accidents at Millstone-3. The first part of this work was done for the Millstone-3 Final Environmental Statement (NUREG-1064). A more complete dis-cussion of the methodology is found in that report, as well as a discussion of general characteristics of accidents, fission product characteristics, expo-sure pathways, health effects, post-accident exposure avoidance, accident ex-perience, an evaluation of consequences assuming evacuation and no evacuation (just early relocation) and a critique of the applicant's consequence analysis (Section 5.9.4 and Appendices F, L, M and N of NUREG-1064).

The exposure pathways considered here are restricted to those that start with a release to the atmosphere because the NRC staff concluded that the risk contribution of the liquid pathway at Millstone-3 is small in comparison to the risk posed by airborne pathways (p. 5-50 of NUREG-1064).

4.2 Probabilistic Assessment of Severe Accident Consequences The calculative methodology used to estimate the conditional consequences of varioug severe releases is essentially as described in the Reactor Safety Study,Q'3J but includes improvements in the assessment methodology that were develop 5d after publication of the RSS. Potential accidents initiated by fires and external events have been included in this analysis, but the effects

.e of possible sabotage have not been included.

In general, there is a very large number of potential accident se-quences. These are reduced or combined to represent the few most important to risk. Depending on containment behavior, these accident sequences are pre-dicted to lead to several different releases as defined previously. Simpli-fied descriptions of the releases of radioactive material in a form useable by the consequence calculation code, are called release categories (see Chapter 3).

Tables 3.15 and 3.17 provide information used in the NRC staff's conse-quence assessment for each specific release category. The information includes time estimates f rom termination of the fission process during the accident until the beginning of release to the environment (release time),

duration of the atmospheric release, warning time for offsite evacuation, and estimates of the energy associated with the release, height of the release location above the ground level, and fractions of the core inventory of eight groups of radionuclides in the release.

The magnitudes (curies) of fission products released to the atmosphere for each accident sequence or release category are obtained by multiplying the release f ractiors shown in Table 3.15 by the amounts that would be present in the core at the time of the hypothetical accident and by depletion factors that result from in-plant radioactive decay before the release to the environ-ment. The core inventory of radionuclides used is based on a core thermal l

power level of 3579 MWt, the same power level used in the Millstone-3 Final Safety Analysis Report for accident analysis (see Table 5.13 of NUREG-1064).

From the eight groups listed in Table 3.15, 54 nuclides were used to represent those that are potentially major contributors to the health and economic effects of severe accidents.

Many estimated radiological consequences of the postulated release cate-gories were calculated using the computer code CRAC, which is based on the RSS consequence model (see NUREG-0340 and NUREG/CR-2300). Three types of conse-quences (early fatalities, latent fatalities and person-rem) were used as sur-rogates for all severe accident consequences (including numerous impacts not directly treated by CRAC). CRAC has been adopted and modified to be site-specific and to better model evacuation. The site-specific data input to CRAC comprises the " site model," as it is often called. The nature of these data and the way they were used is summarized below.

4.3 Use of the Millstone-3 Site Model Information describing the Millstone-3 site was independently determined or checked by the NRC staff.

These data include:

(1) meteorological data for the site representing a full year (1981) of consecutive hourly measurements and seasonal variations (2) projected population for the year 2010 extending throughout regions of 80-km (50-mile) and 563-km (350-mile) radius from the site (3) the habitable land fraction within a 563-km (350-mile) radius (4) land-use statistics on a statewide basis, including fa rm land values, farm product values including dairy production, and growing season information, for the State of Connecticut and each surround-ing state within the 563-km (350-mile) region For the region beyond 563 km (350 miles), the U.S. average population density was assumed.

The calculation was extended out to 3200 km (2000 miles) from the site to account for the residual radionuclides that would remain in the atmosphere at large distances with rain assumed in the interval between 563 km and 3200 km to deplete the plume of all non-noble-gas inventory. To sample the dispersion conditions as they vary during a year, calculations were performed assuming the occurrence of each release category at each of 91 different " start" times distributed throughout a 1-year period. Each calculation used site-specific hourly meteorological data and seasonal information for the period following each start time.

I

1 f Two different sets of assumptions about offsite emergency response were used, depending on whether or not the postulated accident was initiated by a severe earthquake (the results of a third emergency response scenario were presented in the DES as a sensitivity study). The basic premise behind these assumptions is that under normal or even fairly bad weather conditions, early evacuation and relocation of people would considerably reduce both cloud and ground exposure; while a severe earthquake would prevent early evacuation f.or most people. The early evacuation / relocation (abbreviated as Evac-Reloc) assumptions were used for those accidents initiated by internal events, fire, and earthquakes of low to moderate severity (instrumental peak ground accele-ration less than 0.59), equivalent to Modified Mercalli Intensity Scale VIII.

The second set was used solely for accidents initiated by severe earthquakes.

The sets of assumptions for both scenarios are shown in Table 4.1.

The value of delay time in Table 4.1 is consistent with the NRC require-ment regarding prompt notification of the public of the emergency, and the time people would take preparing for evacuation after being notified of the emergency during normal to moderately adverse conditions such as snow, ice, hurricane, and low to moderately severe earthquakes. The values of delay time before evacuation and effective evacuation speed used in the NRC staff analy-sis are assumed only to be average values. For areas beyond 16 km (10 miles) the parameters selected reflect the assumption that an extension of emergency response would occur during a large accident and people would be advised to leave areas that would be considered to be highly contaminated (see below for criterion); that is, people would relocate. Relocation of the public from the highly contaminated areas beyond 16 km (10 miles) is assumed to take place 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after plume passage. The criterion for this relocation is whether the projected 7-day ground dose to the total bone marrow, as projected by field measurements, would exceed 200 rems (which is only slightly above the average threshold exposure for potential early f atality with minimal medical treat-ment); otherwise, people in highly contaminated areas are assumed to be relo-cated within 7 days.

The second set of parameters reflects a radiological emergency response situation hampered by a severe type of external event, such as a severe re-gional earthquake, which would seriously limit the ability to evacuate and would also eliminate or reduce the shielding protection that the public would otherwise experience. However, relocation of the public from highly contamin-ated areas 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after plume passage is assumed. The criterion for this relocation is the same as in the first set of assumptions, but relocation is assumed to extend outward from the site exclusion area boundary (503 m, as op-posed to the 16-km (10-mile) EPZ boundary); otherwise, people are assumed to be relocated within 7 days. The of fsite emergency response mode characterized by this second set of assumptions is designated Late Reloc.

In addition to the two types of short-term emergency response described above, a long-term response (common to both scenarios above) is modeled. The long-term environmental protective actions to reduce chronic exposure include complete interdiction of food; decontamination of food, property, or land; and/or temporary interdiction of food, property, or land followed by deconta-mination.

Table 4.1 Emergency Response Assumptions for Millstone-3 Evacuation iblocation Sielding Pmtection Factorst iblocation**

Emergency Area Delay Time Effective Effective

• Distance Beyond Dose Criterion Wring Ibsponse Evacuated After Evacuation Evacuation mich iblocation . Time of (7-daypro- Evacuation Other Times Scenario (miles fmn Wming Speed Distance iblocation jectedbone Occurs (miles (plune dose / (plune dose /

the plant) (hr) (nph) (mi) fmn the plant) (hr) after narrow dose) grounddose) gmund dose) plune passage (ren)

Evac-N1oc 10 1 2 15 10 12 200 1/0.5 0.75/0.33 Late-ibloc N/A N/A N/A 0 N/A 24 200 N/A 1.0/0.5 b N/A = Pbt Applicable. ,

• An artificial paraneter used only to represent an effective path length for each evacuee over dich radiation exposure to the evacuee is calcu-lated in the CRfC code.

• • People would be mlocated fmn any area sere the radiation level is high enough to give a 200 ren dose to the bone narrow over a seven4y period.

tDefined as ratio of dose with pmtection to dose without protection. During evacuation, automobiles am expected to give no protectim fron plune dose, but sone pmtection (0.5) fran ground dose. For other times, the pmtection factors mpmsent nonnal activities for people and wre extracted fmn WASH-1400, Appendix VI, Tables VI 11-13. Wring sevem earthquakes buildings may not renain habitable and would thus pro-vide no protection fmn plune dose. Wwever, the buildup of mud and debris muld provide some protection frdn gmmd dose.

- . _ . - . - - _ -. _ _ = - - . -

The consequences of severe accidents in the Millstone-3 reactor-initiated by plant internal causes, fires, and low to moderately severe earthquakes are evaluated using the release categories in Table 3.15 and the parameters of the Evac-Reloc mode offsite emergency response in Table 4.1. The consequences and risks of accidents initiated by very severe regional earthquakes that could also affect the offsite conditions so as to seriously hamper evacuation or early relocation are also evaluated using the accident parameters in Table 3.15 and.the parameters of the Late Reloc mode of offsite emergency response in Table 4.1 4.4 Consequences of Postulated Severe Accidents Estimates of meteorology-averaged societal consequences, conditional upon

, releases of each ca.tegory in Table 3.15, are shown in Table 4.2. For each re-lease category, separate estimates are given using both of the offsite emer-gency response modes described in Table 4.1. These conditional mean values are useful in judging the relative severity of each release category, but can-not be used directly for risk assessment without also considering the proba-bility of the release category causing the consequence. The risk (probability times consequence) contribution of each release category, and the total risk, including the probability-weighted consequences of all release categories, is discussed in Chapters 5 and 6.

m

Table 4.2 Conditional Mean Values of Societal Consequences from Individual Release Categories for Two Alternative Offsite Emergency Response Modes Offsite Conditional Mean Consequences For Release Categories l Consequence Emergency l Category Response M1A M1B M2A M2B M4 M6 M6St M7 M7'* M12 l

l 1. Early fatalities Evac-Reloc 420 4.3 0.17 6.6 9.6 8.8 0 0 0 0 with supportive medical treatment j (persons) Late-Reloc ** *** 55 13 260 22 t 1.1 1.4 *** '

l

2. Delayed cancer Evac-Reloc 2400 410 2800 4200 3000 2200 27 1400 1500 0.07 fatalities (including thyroid) Late-Reloc ** *** 3100 4600 3400 2500 t 1600 1700 ***

(persons)

3. Total person-rems Evac-Reloctt ,

l within s

-50 miles 5.0x106 1.8x106 5.5x106 4. 5x'106 6.5x106 4.5x106 1.4x105 3.3x106 3.3x106 _

-350 miles 2.4x107 4.7x106 3x107 2.7x107 3.2x107 2.4x107 3x105 1.8x10 7 1.8x107 6x102 Late-Reloc ** *** 3.4x107 3.1x107 3.6x107 2.7x107 t 2x10 7 2x10 7 ***

tM6S is the case where electric power is recovered, resulting in the restoration of containment sprays leading to a hydrogen burn-induced containment failure. This release category is not applicable to the late reloc case.

itPerson-rem dose for the Evac-Reloc case were calculated both for the areas within 50 miles and 350 miles of the plant.

oM7' is the case with iodine release fraction of 0.10 instead of 0.015.

"These release categories are initiated only by plant internal causes; therefore, the Late Reloc mode does not apply.

N OThis release category has a probability less than 10-9 per reactor-year to be initiated by severe earthquakes; therefore it is not analyzed with Late Reloc mode because the low probability will lead to an insignificant con-tribution to risk.

I

5. SEVERE ACCIDENT RISK ESTIMATES The conditional risk estimates listed in Table 4.2 are combined with the frequency of the containment release categories (Table 3.12) to calculate the risk contribution from each release category and to determine the total severe accident risk (Table 5.1). Estimates of total risk are shown in Table 5.2.

By examining the overall risk estimates and the risk breakdowns contained in Table 5.1, conclusions are drawn about the overall safety of the Millstone Unit 3 plant and about those aspects of the plant where improvements need to be made.

5.1 Comparison of Severe Accident Risks With Other Societal Risks To gain a perspective on the severity of the total risk estimates in Table 5.1, a comparison with related risks from non-nuclear sources is made.

Early fatality estimates can be compared with the risk of accidental death from other sources. The probability of accidental death for an indivi-dual in the United States is 5 x 10-4 per year. Based on this figure and the population distribution around the Millstone site, the expected number of ac-cidental deaths within 1 mile of the plant's exclusion area boundary is 1 per-son per year. The corresponding expected number of early fatalities due to severe accidents at Millstone-3 within the same area is 6 x 10-5 persons per year,* based on the D&M seismic estimates or 2 x 10-4 based on the SHCP esti-mates. Clearly, the early fatality risk due to severe accidents at Mill-stone-3 is very small compared to other causes of accidental deaths.

The number of latent cancer fatalities can be compared with the annual cancer death rate from all causes. The probability of an individual dying from cancer in any given year is about 1.9 x 10-3 Given the projected popu-lation within 50 miles of Millstone-3, one would expect about 6,300 cancer deaths per year. The estimated rate of 5.8 x 10-3 cancer deaths per reactor year within the same area as a result of postulated severe accidents at Mill-stone-3 based on Dames and Moore seismic estimates and 4.6 x 10-2 based on SHCP estimates is small by comparison.

5.2 Comparison of Risk With Other Nuclear Power Plants The NRC requested a probabilistic safety study for Millstone-3, primarily because of concern about the high population density in the vicinity of the site. As in the cases of Zion, Indian Point and Limerick, the staff wanted to ascertain whether the Millstone 3 represents an undue portion of the risk of nuclear power. To help answer this question, we have compared the estimated risks for Millstone-3 with those of Zion and Indian Point and Limerick. These plants were chosen because they are located at high population sites, and because probabilistic safety studies for those plants, performed with methods comparable to those used for Millstone-3, have already been reviewed by the NRC staff. The risk estimates for all five plants are compared in Table 5.3.

i

• approximately 15% of all early fatalities that would occur following severe accidents can be expected within one mile of the plant.[17]

Table 5.1 A Breakdown of Mean Annual Risk by Release Categories for Internal Events, Fires and Earthquakes (within 350 miles of the site boundary)*

1. Early Fatalities (Per Reactor Year)

. Release .

Sei smic Category Internal Fi re D&M SHCP M1A 3.4(-4)- -- - -

M1B 1.1(-5) - - -

M4 -

2.2(-5) 9.6(-4)

MS/6 - -

6.1(-6) 1.3(-4)

MS - - - -

M7 - -

3.1(-6) 6.2(-5) ii. Latent Cancer Deaths (Per Reactor Year)

M1A 1.9(-3) - - -

M1B 1.0(-3) -

M4 - -

3.3(-4) 1.4(-2)

MS/6 - -

7.6(-4) 1.6(-2)

M6S 1.2(-4) - - -

M7 3.4(-3) 4.2(-3) 9.5(-3) 1.6(-1) 111. Person-Rem (Per Reactor Year)

M1A 19* - - -

[4] -

M1B 12 - -

[5]

M4 - - 4 143

[1] [26]

- - 8 165 MS/6

[1] [28]

M6S 1

[1]

M7 43 54 120 1998

[8] [10] [21] [343]

• The numbers in brackets represent the mean annual person-rem dose within 50 miles of the plant. Otherwise the values are calculated to 35,0 miles.

i

11 t

l Table 5.2 Total Mean Annual Risk Estimates Based on D & M and SHCP Seismic Hazard Values i

l l

Seismic Total Risk Index (Per Reactor Yr) Internal Fi re D&M SHCP D & M. SHCP i

Ea rly' Fatalities 3.5E-4* -

3.1E-5 1.2E-3 3.8E-4 1.6E-3 Latent Fatalities 6.4E-3. 4.2E-3 1.1E-2 1.9E-1 2.2E-2 2.0E-1 Public Dose **

(Person-Rem)

- within 50 miles 18- 10 23 397 51 425

- within 350 miles 75 54 132 2306 261 2435

• 3.5E-4 = 3.5x10 " = .00035

• *Public dose is quoted for the area within 50 miles of the plant and for the area within 350 miles of the plant.

m J

4 _.,....,,,,._-,_.,.,_,..,,y,,__,,,,,,,,,,,,.w,.,___,y , , , . , _ _ - _ _ . , . ,,,y,

l l

Table 5.3' Comparison of Millstone-3 Mean Risk Estimates with Zion, '

Indian Point and Limerick Plant Zion ~IP2t IP3t timericktt Mill stone-3 Risk D&M SHCP Index Seismic Sei smic Early Fatalities 2(-4) 1.5(-2) 3.8(-3) 5(-3) 3.8(-4) 1.6(-3)

Latent Cancer 1.8(-2) 2.1(-1) 1.1(-1) 8(-2) 2.2(-2) 2.0(-1)

Person-Rem 268 2600 1430 1000 261 2435

• 2(-4) = 2x10 4 = 0.0004 tJanict E. Moore (NRC Counsel) to James P. Gleason, et al. ( Administrative Judges), NRC Staff Witness Testimony (Witness, S. Acharya) on Commission Question 1 on Indian Point Units 1 and 2, January 24, 1983. Pages III.C.8

& 9, and Tables III.C.6 and 7.

ttNUREG-0974; Final Environment Statement, Limerick Generating Station.

• • NUREG/CR-3300, BNL-NUREG-51677 Vol . 2, W. T. Pratt, et al . , " Review and Evaluation of the Zion Probabilistic Safety Study; Con' tafnment and Site

! Consequence Analysis, (Draft), July 1982.

l i

I 1

i l

l

l. - - . _ _ . . , _ _. . - - - _ . . _ _ _ . . . . _ _ . _ , _ - -

Millstone-3 risk estimates based on both the Dames and Moore and the SHCP seismic hazard functions are shown in Table 5.3. For purposes of comparison, the Dames and Moore numbers should be used, because that seismic calculation more closely approximates the methods used in estimating seismic hazard for Zion, Indian Point, and Limerick. The Millstone-3 risks based on the SHCP seismic method are much higher, but we assume that a reanalysis of the other plants with the LLNL seismic method could also yield higher risk estimates.

The Millstone-3 risk estimates are generally comparable to Zion and some-what lower than Indian Point and Limerick, given the uncertainties in the data and methods used in calculating these risk estimates.

5.3 Dominant Contributors to Risk The contributions of each release category to the three risk categories used in our comparisons (early fatalities, latent cancer fatalities and per-son-rem) are summarized in Table 5.1. Examination of these results reveals several interesting cor.clusions:

(a) For internal events, early fatality risks are dominated by the interfacing systems LOCA (release category M1A).

(b) Seismic events also contribute significantly to early fatality risks, particularly for the SHCP hazard function. These con-tributions are primarily from severe earthquakes which can directly fail containment (release category M4) and impede evacuation.

(c) Latent fatality and person-rem risks are dominated by late con-tainment failure events (M7) due to overpressure failure or late hydrogen burns. A large fraction of these risks are esti-mated to result from seismically induced station blackout events. Those events will be examined in greater detail in Section 7 below.

5.4 Total Risk The various risk indices are totaled and tabulated in Table 5.2. The SHCP-based early fatality estimates are about' 4 times higher than the D&M based estimates, similarly the SHCP based latent fatalities and public dose are about an order of magnitude higher than their respective D&M estimates.

.- , , - - - . . a,. , , - - , . - - > - - - . , , . , . - - , , , - , - . _ , - . , , , , -----n ,e.,-.-~-.,, , , - - . - - , - . , ----.---c,--e .

n-

i I

1 1

6. UNCERTAINTIES The use of point estimate values allows us to determine which plant sys-tems, accident sequences and containment failure modes contribute most signi-ficantly to risk. However, in order to use those insights to make decisions about plant modifications and improvements, it is necessary to consider the uncertainties, biases and known errors in the point estimates. Uncertainties and errors can result from modeling assumptions, computational problems, omis-sions, and statistical fluctuations in random processes. The uncertainties' arise in each step of the computational process; in the estimation of core melt frequencies, containment failure probabilities, radiological release fractions and offsite consequences. The purpose of this chapter is to explain and quantify the sources of these uncertainties (with the exception of core melt frequency), and to understand their potential impact on the uncertainty in overall risk.

6.1 Containment Failure Matrix Because our actual experience with severe accidents at nuclear power plants is extremely limited, estimates of containment response must be based on phenomenological modeling and structural analysis. Nonetheless, for the large subatmospheric type of containment used at Millstone-3, there is a great i deal of confidence that the response is well understood. The range of uncer-tainty is narrowed considerably by three factors, namely: (1) for the major-ity of accident sequences, operation of the recirculation sprays dramatically reduces containment failure probability and radioactivity available for re-lease (2) there is little likelihood that the major penetrations to this type of containment will not be isolated at the start of an accident, and (3) the probability of early overpressure failure due to a " steam spike" has been shown by analysis to be ninimal.[8]

Sequences without spray operation are dominated by station blackouts.

The risk-dominant mode of containment failure for this sequence is a hydrogen burn failure following deinerting by natural condensation. Our analysis pre-dicted a very low probability of containment failure by this mode, for two reasons: (1) containment sprays are likely to be recovered before the con-tainment is deinerted by natural condensation, and (2) the resulting hydrogen burn is likely to be thermally inefficient due to the high steam concentra-tions. Under these assumptions, station blackout contributes about 9 person-rem per reactor year, approximately 12% of the total risk from internal events. If, however, all station blackouts lasting more than six hours after core melt are assumed to result in condensation deinerting and containment failure, the risks from station blackout would be 240 person rem per reactor year, and the overall risk from internal events would be increased by a factor of four.

A potentially significant source of uncertainty, and one which is diffi-cult to quantify, is the possibility of early containment failure due to di-rect heating of the atmosphere by core debris dispersed from the reactor cav-ity. Recent experiments at Sandia National Laboratory indicate that failure of the reactor vessel lower head when the primary system is at high pressure

i will result in large portions of the core debris being lifted as aerosols into the upper regions of containment. The small corium particles would directly heat the atmosphere and chemically react with oxygen and steam. Calculations performed for the NRC's Containment loads Working Group show that early con-tainment failure is possible if a large fraction of the core can be suspended as aerosols for sufficient time.[13]

If direct heating induced containment failure were to occur for all high pressure sequences and the release fractions were characteristic of an M2B re-lease category (a-failure mode), the estimates of early and latent fatalities together with the public dose would increase significantly for internally ini-tiated events.

The scientific community is divided on whether such conditions can be at-tained, given all the obstructions in the lower part of containment (the highly confined reactor cavity at Millstone-3 would be a _further impediment).

There is also some evidence that high pressure failures of the reactor vessel lower head may be precluded. It has been argued that the high temperature steam produced during core boildown will produce breaks in the upper regions of the primary sys;em which will relieve the pressure before the bottom head failure occurs.Ll4.1 An additional source of uncertainty is the distribution function used by the applicant to describe the containment failure pressures (see Figure 3.2).

There is concern that the low pressure end of the distribution gives undue weight to the possibility of failure at pressures below 100 psia. We have examined the dominant containment failure modes and found that variation of the failure pressure distribution within reasonable limits would not appre-ciably affect our risk estimates.

6.2 Radiological Source Terms The amount, timing and energy of releases of radionuclides ~ to the envi-ronment as a result of severe accidents are a source of considerable uncer-tainty in the estimation of risk. For the past decade, release fractions have been Safetycalculated Study.L10]withSevere the CORRAL accidentcode, the method research developed conducted forRSS since the the Reactor has un-covered several phenomena which would tend to reduce the release fractions calculated by CORRAL. A systematic program to define a new methodology for source term estimation has been conducted in recent years by NRC's Accident Source Term Program Office (ASTP0). Part of this effort has begn an uncer-tainty analysis (QUEST) conducted at Sandia National Laboratory.L153 During the period when the Millstone-3 review was conducted, the ASTP0 methodology and QUEST uncertainty analysis were under review by a panel of the American Physical Society. Hence, the Millstone-3 review was conducted within the framework of the CORRAL methodology. Nonetheless, the ASTP0 and QUEST results provide us with a useful source of information concerning source term uncer-

, tainties and their potential impact on overall risk.

The dominant release category contributing to latent cancer risk and per-son-rem is late failure without sprays (M7). For that scenario, the most ef-fective mechanism for fission product removal is gravitational settling in

the containment. The ASTP0 codes calculate higher settling rates than the CORRAL code, mostly because the ASTP0 codes predict enhanced agglomeration of aerosol s , which enhances settling. However, the noble gases and organic iodine wouid not be significantly reduced by these mechanisms. Calculations of late containment failure for the Surry subatmospheric containment with the ASTP0 methodology have yielded aerosol release fractions significantly less than the releases used in our risk calculations (Table 6.1). Furthermore, a preliminary QUEST analysis of this failure mode showed relatively little un-certainty. A range of cases was run by the QUEST program and the results generally confirmed the low release rates for late failures.(15]

These results indicate that the uncertainty in the BNL/NRC releases are very high and all in the direction of much lower releases. The impact of this result will be discussed further in Section 7 below.

The principal source- of early fatality risk is the interfacing system LOCA sequence (M1A). The release fractions assumed in arriving at that risk estimate took virtually no credit .for deposition of fission products in the primary system or in the ECCS building, where the break was postulated to occur. To the extent that fission products are deposited in those two areas, and are not resuspended, the source term would be reduced, and with it the estimate of early fatalities. We have no firm basis for quantifying the extent of that uncertainty, except to say that it is almost certainly all in the direction of lower releases.

By contrast, the steam generator tube rupture (SGTR) source term (M1B),

shows release fractions of a few percent for iodine, cesium, and tellurium. -

Such releases imply an order of magnitude reduction due to deposition in the primary system, steam generator secondary, steam piping and condenser. Actual radiological releases in SGTR events that lead to core melting are not well understood. Hence, it cannot be concluded that the M1B release fractions are conservative.

6.3 Consequence Analysis Although the consequence model CRAC has been improved since the publica-tion of the RSS, there are still large uncertainties in the results that are attributable to the consequence modeling, both in input to the model and in the model i tsel f. A complete discussion of uncertainty in the consequence calculations is given in the -Millstone-3 Final Environmental Study (NUREG-1064).

The relatively more important contributor to uncertainties in the results is atmospheric dispersion modeling for the radioactive plume, including the physical and chemical behavior of radionuclides in particulate form in the atmosphere. This uncertainty is due to differences between the modeling of the atmospheric dispersion of radioactivity in gaseous and particulate states in the CRAC code and the actual transport, diffusion and deposition that would occur during an accident (including the effects of precipitation). The pheno-menon of plume rise because of heat that is associated with the atmospheric

. _ _ . _ _ . _ . _ _ _ . - - _ _ _ . _ _ . _ _ _ _ _ _ _ _ . _ . _ - _ . _ _ . ._ ~ . - _ . _ _ ,

Table 6.1 Comparison of BNL/NRC Release Fractions for Millstone-3 with '

BMI-2104 Releases for Surry (Late Containment Failure)

Release Fraction BNL/NRC M7' Release BMI-2104 (Vol . 5)t Radionuclides for Millstone 3* Surry[18]

i Xe-Kr 9E-1 1E0

. 01+1 1E-1* 2.8E-3 Cs-Rb 3E-1 3.9E-4 Te-Sb 3E-1 8.5E-2

Ba-Sr 3E-2 1.8E-2 Ru 2E-2 3.3E-6

. La 4E-3 4.7E-4

, *The M7 release differs from M7 insofar as the iodine release fraction 4

is 1E-1 instead .o.f 1.5E-2. This difference has minimal influence on severe accident consequences.

l tThese release fractions represent the amount of radiation released to the l

ground beneath the reactor due to a basemat meltthrough at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />.

They are indicat41ve of the releases to the atmosphere if the failure mode

had been overpressurization.

release, effects of precipitation on the plume, and fallout .of particulate j matter from the plume all have considerable impact on both the magnitude of the early health consequences and the distance from the reactor to which these consequences would occur. It is our judgment that these factors can result in substantial overestimates or underestimates of both early and later effects (health and economic).

Other areas that have substantial but relatively less effect on uncer-tainty than the preceding items include the duration and energy of release, warning time, and in-plant radionuclide decay time. The assumed release dura-tion, energy of release, and the warning and the in-plant radioactivity decay

. times may differ from those that would actually occur during a real accident.

It is believed that the uncertainty associated with the consequence cal-culation could cause substantial underestimates or overestimates of the early consequences and risks. The magnitude of the overall uncertainty is difficult to quantify, but it is believed to be between one and two orders of magnitude.

e 9

6

7. ANALYSIS OF MITIGATIVE SYSTEMS If design improvements for the purpose of mitigating severe accidents are to be required for Millstone-3, the decision will be based on the estimated cost of averted public dose. For the purpose of performing a preliminary screening analysis, the estimated person-rem per reactor year for each failure i

mode (Table 7.1) was assigned a monetary value based on $1000 per person-rem over an assumed 40-year lifetime. A complete regulatory cost / benefit analysis would not lead to qualitatively different results. Although the NRC method of cost benefit analysis treats only the risk within 50 miles of the plant, we also considered the risk within 350 miles because there are several large pop-ulation areas beyond the 50-mile point and the societal risks could b4 sub-stantially greater than indicated from only considering effects within 50 miles.

For various reasons, several of the release categories may be excluded from consideration. For instance, the dominant contributor to the M4 release category is direct containment failure due to seismic events with accelera-tions several times the safe shutdown earthquake (SSE). We do not believe we should contemplate a mitigative device which would be expected to operate under such severe circumstances.

The M6S release category was also disregarded because of its minimal im-pact on overall risk.

The M1A release category, interfacing system LOCA, leads to bypass of containment. Our analysis of radiological releases in the sequence gave lit-tle credit for the mitigative effects of features which already exist on the plant; i.e., fission product retention in the react.or vessel, primary system piping and ECCS building. Even under these conservative assumptions, the monetized value of person-rem within 50 miles (Table 7.1) is $160 thousand*

($800 thousand for person-rem within 350 miles). Taking credit for existing mitigative features, it is difficult to justify consideration of design changes based on the level of risk. ,

Finally, mitigation devices for the M1B release category (steam generator tube ruptures) are also excluded from consideration. Core melt accidents in this category are dominated by operator errors. The staff has decided to pur-sue a reduction in core melt frequency through operator training.

Having eliminated several release categories from consideration, we con-ducted detailed screening cost / benefit analyses for tso: hydrogen burn fail-ure at intermediate time (M6) and late containment failure (M7).

• 4 person-ren per reactor year x 40 years x $1,000 per person-rem.

, _ . - ,, , y- ,,,, , , , - - - . . , . - - ,, - - _ _ , - - , . . , , , -

,,,-,,,---.-------,,-.-.--y - - . - - - - - - , , - -..--e.,, - -

l

[

Table 7.1 Mean Annual Public Exposure Risk Estimates from Various Containment Failure Modes for Internal Events, Fires and Seismic Events Mean Annual Public Exposure (Person-rem per Reactor Year)

Seismic' Failure

• Mode Internal Events Fi res D&M SHCP M1A 19t - - -

[4]

M1B 12 - - -

[5]

M4 - - 4 143

[1] [26]

MS/6 - -

'8 165

[1] [28]

M6S 1 - - -

[1]

M7 43 54 120 1998

[8] [10] [21] [343]

• M1A: Interfacing Systems LOCA M1B: Steam Generator Tube Rupture

'M4: Seismic Induced Crane Wall Failure MS/6: Intermediate Failure due to Hydrogen Burn M6S: Hydrogen Burn Following Recovery of Sprays in a Station Blackout M7: Late Failure Due to Overpressurization or Hydrogen Burn tNumbers of brackets represent person-rem dose intearated over the area within 50' miles of the plant. Un-bracketed estimates are integrated to 350 miles from the plant.

W -aw w p--ww-- e t e e esa-rw ,--w,v,S.y-% r we,---- e ye----r+gew---..,y4w.--gy v e-p- vv---e---v?mt e e .re + Mrwpe--4----W fy'T-7-Mw--w-v=--'t-*'wv*'My9 7'my-~rt-*-ryw'*--

7.1 Hydrogen Burn Failure at Intermediate Time (M6)  ;

The M6 release category results from severe seismic events which lead to large LOCA's in coincidence with station blackout. Detailed containment -

thermal-hydraulic calculations by the applicant showed that hydrogen burns would be possible at about four hours after reactor trips. They assigned a 62% likelihood to hydrogen burn failure at that point.

For the purpose of estimating risk, the staff and BNL accepted the appli-cant's analysis of this sequence. However, for the purpose of evaluating mitigative actions, we have reconsidered the accident phenomenology. Our es-timate of hydrogen generation during core meltdown and after vessel failure lead us to conclude that a hydrogen burn at four hours would be very unlikely to fail containment, and the actual failure would occur much later due to overpressurization. To fail containment, a hydrogen burn would have to occur more than six hours after vessel failure, and probably much later when the hy-drogen produced in-vessel and the continuing hydrogen production ex-vessel due to core-concrete interactions would lead to high hydrogen concentrations in the containment.

In either case, we conclude that the core melt sequence currently as-signed to the M6 release category would actually lead to late containment failure instead. Consequently, for the purpose of evaluating mitigative sys-tems, we have grouped the M6 and M7 release categories under the general head-ing of late containment failure.

7.2 Late Containment Failure (M6 and M7)

Late containment failures result from both seismic and non-seismic ini-tiators. These two categories are treated separately in the discussion below because the seismic sequences have greater uncertainty and the cost of seis-mically qualified design changes are expected to be higher.

7.2.1 Non-Seismic Initiators The person-rem risk from non-seismic initiators comes from a variety of sequences, including station blackouts, fires, and LOCA's with failure of re-circulation spray. Late failures result from both overpressurization and hy-drogen burns. There are two types of design improvements which would be capa-ble of mitigating all of these scenarios. A filtered-vent would prevent over-pressure failure by relieving the pressure in containment and prevent hydrogen burn failure by removing considerable quantities of oxygen.

A dedicated AC-independent spray pump system would significantly reduce the radiological releases due to the late failure. Furthermore, the spray would prevent overpressure failures by condensing steam. The effect of sprays on hydrogen burn failure probability is ambiguous. On the one hand, the re-sulting steam condensation would enhance the probability and magnitude of hy-drogen burns, but on the other hand, spray operation could lead to early hy-drogen burns before sufficient hydrogen is available to fail containment.

Nonetheless, the reduction in source term would always lead to reduced levels of risk.

!F i

Accurate cost estimates for these two systems are difficult to obtain. l Reference [16] presents cost estimates for both the filtered vented ,' stem and i a direct diesel driven pump spray system. The ' estimates are based on somewhat different applications, and are for the BWR Mark II containment, but the costs should be indicative. The cost of each system was estimated at about 4 mil-lion dollars. The study described in Reference [16] attempted to evaluate the minimum costs for mitigative features. The equipments selected were normal industrial stock. The cost to qualify the equipment as safety related was in-tentionally disregarded. The costs included only installation, with no ac-counting for maintenance and surveillance. Finally, it was assumed that the entire installation would be accomplished during refueling. Hence, there was no allowance for the cost of replacement power. Consequently, we assume that these cost estimates represent a lower limit.

We have no sound basis for estimating an upper limit. Qualifying equip-ment as safety related can multiply the cost by as much .as a factor of ten.

Again the staff does not intend to require such qualification. If installa-tion extended the refueling time by one week the replacement power cost would be about $5 million. Maintenance and surveillance costs over the 30-year lifetime of the plant would also be substantial.

For perspective the FILTRA vent installed on the Barsbeck containment in Sweden cost about $20 million (Figure 7.la).

The person-rem risk for internal events and fires (Table 7.1) ranges from 18 person-rem per reactor year within 50 miles of the plant to 97 person-rem per reactor year within 350 miles. The monetized values of these two esti-mates are $720 thousand* and $3.9 million, respectively. This range of values is plotted on Figure 7.la together with the cost estimates discussed above.

As seen in Figure 7.la, the monetized risk due to non-seismic late containment failures is generally lower than the range of estimated costs for mitigation devices.

Furthermore, our estimates of conditional consequences for late failures are based on source term estimates derived with WASH-1400 methodology. Mini-mal. credit for aerosol agglomeration and gravitational settligg {s included in those estimates. The revised NRC source term methodologyL19J claims con-siderable credit for that mechanism. The -new methodology also includes mech-anisms which would tend to increase the releases of refractory fission pro-ducts. For early containment failure scenarios, it is not clear what the net effect of these competing mechanisms would be. However, for the late contain-ment failures considered here, the revised methodology would unambiguously predict substantially lower source terms than we have assumed in our risk estimate.

We conclude that the cost effectiveness of a filtered vent or AC-indepen-dent spray system would be even less favorable than Figure 7.1 indicates if new source term information were used, and we would not recommend either sys-tem for mitigation of non-seismic events. Less expensive systems that might be cost effective will be discussed below in connection with seismic events.

• 18 person-rem per reactor year x 40 years x $1000 per person-rem.

- . - . - - - - - - . _ . . - - - . _ . - - . ~ - . . _ - - - - _ - , .- - - . - - _ .

6 Value (Dollars /10 )

o

~

~

o G o

m .

. . . ....g . .

.....g i i i . ..

2 MONETIZED RISK

@$994A$fiilillWr m

3*w'a , x c.o n

.i

""C"

-2e FILTERED VENT COST 0" o : A h l g 7u> 'E.i v < U. E.'

~

• J i * : 8' E

m. E l =I,5,,!

- SPRAY PUMP COST D

-oi"l E,i n., i I I d< m i IT1 I M in W M!m, ' w,

.-. u r; s. e i

E]

c\v A, ?Wnw SIE 9- @ l Hgi MONETIZED RISK N c

--.)

";I m c1Q'?l S ,l FILTERED VENT COST E,j

< w;g:

e 2C n

s . fD j : l l m ,, o..ows E Mo*

-4 a. o :o o'8 *.

e, in t e c: SPRAY PUMP COST (D (D 8- (D e 3 o us I l u

cn";o SioY 3

l l k

4

7.2.2 Seismic Initiators Seismically induced late failures are dominated by station blackout se- )

quences. Late failure would result from hydrogen burns, or failing that, from late overpressurization. Mitigative devices to prevent or reduce hydrogen burns alone would be of limited usefulness because the containment would eventually fail due to overpressure.

The prime candidates for mitigation of seismic events are the same examined for non-seismic sequences: filtered venting and AC-independent con-tainment spray. To be effective in mitigating seismic events, the design improvements would have to have a seismic capacity of 1.5 g or greater." We estimate that this extra requirement would roughly double the cost (Figure 7.lb).

The risk reduction achievable would be the sum of seismic and non-seismic events for both the M6 and M7 release categories (Table 7.1). These estimates range from a low value of 40 person-rem per reactor year based on the PSS haz-ard curve and including only the risk within 50 miles of the plant, to 2260 person-rem per reactor year for the SHCP hazard curve including risk within 350 miles. The monetized values of those risk est'imates are $1.6 millior and

$90 million, respectively, are plotted in Figure 7.lb.

The comparison of costs and benefits in Figure 7.lb indicates that either of the two mitigative fixes might be cost effective. This result prompted us to more closely examine the estimates of both cost and risk.

For a number of reasons, we have concluded that the risk estimates shown in Figure 7.lb are greatly overestimated. First, a reduction of about a fac.

tor of two was obtained by reexamining the seismic fragility of some key com-ponents. One important failure point, the diesel generator room footings, were found to have been evaluated too conservatively. Another weakness, the bolts on the diesel generator oil cooler, could be eliminated with an inexpen-sive design change which the staff intends to recommend.

More importantly, for reasons discussed in Sections 6.2 and 7.2.1, we are confident that the radiological releases have been overestimated by an order of magnitude or more. This conclusion is based on results of the revised NRC source term methodology.

Taking these factors .into account, we estimate that mitigative measures in the vicinity of $1 million in cost would be justified. It is not reason-able to expect that a seismically qualified filtered vent could be installed for that price. It is possible, however, that some type of AC-independent spray system could be installed. For instance, a fire truck could be expected to survive a severe seismic event and could serve as part of a mobile, manual-ly-operated, AC-independent spray system, taking suction from Long Island Sound.

The results of our cost / benefit screening analysis indicate that such a system should be examined in more detail. A more careful analysis of risk should be performed including consideration of any potential for increased

risk due to the system. More accurate cost figures should be obtained for a variety of options including mobile and stationary pumps, both automatic and manually operated. This proposed change will be discussed in the NRC staff report on the risk of the Millstone-3 plant.

c w w - -

{ 8.

SUMMARY

The purpose of this report is to describe the technical review of the Millstone-3 probabilistic risk study (MPSS-3) and to present our estimates of containment performance, radiological source terms, offsite consequences and risk.

The containment response to severe accidents is judged to be an importan't factor in reducing risk. There is negligible probability of prompt contain-ment failure or failure to isolate. Failure during the first four hours after co're melt. is also unlikely. Late overpressure failures are also unlikely, ex-cept for seismically initiated sequences. Most core melt accidents would be effectively mitigated by containment spray operation.

Offsite consequences of core melt accidents with containment failure are relatively high because of the high population surrounding the site.

The estimated overall early and latent fatality risk from severe acci-dents at Millstone-3 is extremely low compared with non-nuclear sources of risk. Severe accident fatality risk for Millstone-3 are comparable to the risk from other plants at high population sites. Seismically induced acci-dents dominate the latent fatality risk of Millstone-3.

Cost-benefit screening analyses for various potential mitigative features have been performed based on a range of assumptions about risk and cost esti-mates. In general, the mitigative features are not cost-effective. Our pre-liminary assessment indicctes that an inexpensive containmert spray pumping system should be carefully evaluated as a potential mitigative feature for late containment failures.

The final determination of the desirability of mitigative features in-volves factors which are forthcoming beyond the scope of this report.. That determination will be discussed in the forthcoming NRC staff report on the regulatory implications of the risk analysis for the Millstone-3 plant.

n I

l t

9. REFERENCES

1. " Zion Probabilistic Safety Study," Commonwealth Edison Company, September 1981.

2. " Limerick Probabilistic Safety Study," Philadelphia Electric Co., Sep-tember 1982.

3. " Indian Point Probabilistic Safety Study," Power Authority of the State of New York and Consolidated Edison Company, March 1982.

4. " Preliminary Assessment of ' Core Melt Accidents at the Zion and Indian Point Nuclear Power Plants and Strategies for Mitigating Their Effects,"

NUREG-0850, Vol .1, November '1981.

5. " Millstone Unit 3 Probabilistic Safety Study," Northeast Utilities, August 1983.

6. A. Garcia, et al . , "A Review of the Millstone-3 Probabilistic Safety Study," Lawrence Livermore National Laboratory Report, January 25, 1984.

7. D. L. Bernreuter, et al., " Seismic Hazard Characterization of Eastern United States: Methodology and Interim Results for 10 Sites," NUREG/ .

CR-3756, Draft, April 1984.

8. M. Khatib-Rahbar, "Subatmospheric Containment Loads-PWR Standard Problem

1. 2," Presented at the Containment Loads Working Group Meeting, Rockville, Maryland (March 13-14,1984).

9. D. C. Williams, et al., " Integrated Phenomenological Analysis of Contain-ment Response to Severe Core Damage Accidents," SAND 85-0690J (Draft).

10. " Reactor Safety Study," U.S. Nuclear Regulatory Commission, WASH-1400, NUREG-75/014, October 1975.

11. G. S. Kolb, et al., " Reactor Safety Study Methodology Application Pro-gram: OconeT#TPWR P1 ant," NUREG/CR-1659/2 of 4.

12. Direct Testimony of J. F. Meyer and W. T. Pratt concerning Commission Question 1, Indian Point Hearings, Docket Numbers 50-247 and 50-286, 1983.

13. D. C. Williams and K. D. Bergeron, " Summary of Results for Standard Prob-lem No. 2," Draft Report, Sandia National Laboratory, June 12, 1984.

14. T. G. Theofanous, "RCS Pressure Boundary Heating During Severe Acci-dents," USNRC Meeting, Bethesda, Maryland, May 14, 1984.

15. R. J. Lipinski, et al ., " Uncertainty in Radionuclide Release Under Speci-fic LWR Accident Conditions,t' SAND 84-0410/2 RX.

.-s- . ----- --,

m , .-- -ee-- w - -

-6 4-

16. J. L. Dooley, et al. , " Mitigation Systems for MARK-II Reactors,"

Preliminary Report, R & D Associates, RDA-TR-127303-001, May 1984.

i

! 17. A. S. Benjamin, " Severe Accident Risk Reduction Program," Briefing to j USNRC Office of Nuclear Reactor Regulation, Sandia National- Laboratory, 4 November 14, 1984.

) 18. " Final Environmental Statement Related to the Operation of Millstone Nu-

clear Power Station, Unit No. 3,"- NUREG-1064, December 1984.

]

19. "Radionuclide Release Under Specific LWR Accident Conditions," Battelle 4

Columbus Laboratory. Report BMI-2104, July 1984.

l 1

1 J

4 e

O 1

- - - . . . - - . . . . - . - - - - . - . , . . ~ . . - - . . . . _ . . - - - . - . , . . . . _ , . . _ - . . - - - , -

1. REPORT NUMRE R IAwgned Der DDC)

[,RC FORM 335 U.S. NUCLEAR REGULATORY COMMISSION NUREG/CR-4143 BIBLIOGRAPHIC DATA SHEET BNL/NUREG-51907

• 4 TlTLE ANO SuuTITLE lAad Vosume No., oIaooroornatei 2. (Leave Dimki Review and Evaluation of the Millstone Unit 3 Probabilistic Safety Study: Containment Failure Modes, Radiological 3. Rec,,,gur.S ACCESSION NO.

Source-Terms and Offsite Consequences

/ AUTHOHIS) 5. DATE REPORT COMPLETED M. Khatib-Rahbar, W. Pratt, H. Ludewig (BNL) u ON m l YEAR R. Barrett. P. Easlev (NRc) July 1985 9 PE RFOHMING ORGANIZATION N AME AND MAILING ADDRESS (inctuor I,o Cooel DATE REPORT ISSUED Department of Nuclear Energy mon m lvuR Brookhaven National Laboratory SeDtember 19RR Upton, New York 11973 s ILeave D<aa*i

8. (Leave Dianki 1/ SPONSOHING OHGANI/AtlON NAMb AND MAILING ADDRESS (tactuur 2,0 Cuoel i 10 PHOJECT/T ASK/WOHK UNIT NO Division of Systems Integration s Office of Nuclear Reactor Regulation 11. FIN NO.

U.S. Nuclear Regulatory Commission /

Washington, D.C. 20555 A-3748 IJ l YPh OF HLPOHT e l PE RIOD COVE RE D linclusive dates /

l' Technical

15. SUPPLEMEN TAHY NO TES 14. ' Leave ormal 1G. ABSTH ACT (200 evorns or sen)

A technical review and evaluation of the Millstone Unit 3 Probabilistic Safety Study has been performed. It was determined that; (1) long-term damage indices (latent fatalities, person-rem, etc.) are dominated by late failure of the containment, (2) short-term damage indices (early fatalities, etc.) are dominated by bypass sequences for internally initiated events, while severe seismic sequences can also contribute significantly to early damage indices. These overall estimates of severe accident risk are extremely low compared with other societal sources of risk. Furthermore, the risks for Millstone-3 are comparable to risks from other nucleu plants at high population sites. Seismically induced accidents dominate the severe accident risks at Millstone-3. Potential mitigative features were shown not to be cost-effective for internal events. Value-impact analyses for seismic events showed that a manually actuated containment spray system might be cost-effective.

J l

f II. KE Y WOHOS AND DOCUME NY AN ALYSIS 17a DESCHIPTOHS Millstone-3 Probabilistic Risk Assessment Consequence Analysis Containment Failur'e Modes Accident Mitigation Systems Source Term Reactor Safety

?

I /li IUL N Til IE 6tS. OPE N k N DE U TE HYS A

d 18 AV AIL ABl(ITY ST ATE MEN T 19 SE CURIT Y CL ASS (Th.s reporti 21 NO Of PAGES r Unclassified '

Unlimifed 20 se CURITY CL ASS IThes paw / 22 PRICE Unclassified 3 N HC F ORM 336 sti gu

/

UNITED STATES counta etass man NUCLEAR REGULATORY COMMISSION . msuoi e eens Paio WASHINGTON, D.C. 20555 ofs','. "o' c PERMIT No G $7 OFFICIAL BUSINESS PENALTY FOR PRIVATE USE 8300 I

t