ML20211B115

Forwards BNL Draft Prevention & Mitigation of Severe Accidents in PWR W/Large Dry Containment, Technical Rept. Rept Proposes Guidelines & Criteria Which Could Reduce Overall Core Damage Frequency.Meeting Scheduled for 870225

ML20211B115
Person / Time
Issue date:	02/12/1987
From:	Speis T Office of Nuclear Reactor Regulation
To:	Bernero R, Morris B, Russell W Office of Nuclear Reactor Regulation, NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
References
NUDOCS 8702190320
Download: ML20211B115 (2)

Text

.-

-]

FEB 121987 MdMORANDUM FOR: Robert Bernero, Director Division of BWR Licensing Office of Nuclear Reactor Regulation William T. Russell, Director Division of Human Factors Technology Off. ice of Nuclear Reactor Regulation .-

Bill Morris, Acting Director -

Division of Reactor System Safety Office of Nuclear Regulatory Research Frank Congel, Chief Reliability and Risk Assessment Branch Division of Safety Review and Oversight Warren Minners, Chief '

Reactor Safety Issues Branch Division of Safety Review and Oversight FROM: Themis Speis, Director Division of Safety Review and Oversight Office of Nuclear Reactor Regulation

SUBJECT:

DRAFT GUIDELINES AND CRITERIA LARGE DRY PWRs The Implementation Program (SECY-86-76) for the Severe Accident Policy specifies the development of guidelines and criteria for use by utilities during their individual plant examinations. The guidelines define which design and operational features are relevant for a plant's ability to respond to severe accidents. The criteria define the acceptable levels of performance for the design and operational features. Enclosed for comments is a copy of the BNL draft of " Prevention and Mitigation of Severe Accidents in a PWR with a large Dry Containment."

The draft report describes the results of BNL and the staff rev ww of analyses performed by the ASEP, IDCOR for Large Dry containment and other PRAs that have relevance. The report proposes guidelines and criteria which could reduce the overall core damage frequency, reduce the frequency of sequences with high.

i jo'

, /

- y 0702Wo320 WO %f ptt. No M 6 C g L

e

, 4 l

o g FEB 121987 consequences and provide enhanced protection against potential early contain-ment failure following a core melt accident. The report is being provided in the same form that it is being made accessible for the ACRS, the IDCOR groups, and the public. The guidelines and criteria for PWR Large Drys will be issued in final form as part of documents initiating the individual plant examinations.

A meeting to discuss the guidelines and criteria is scheduled for February 25, 1987, therefore, we would appreciate receiving your coments by February 24, 1987.

. 2 h OW Y.-

l Themis P. Speis, Director Division of Safety Review and Oversight Office of Nuclear Reactor Regulation

Enclosure:

As stated cc: NRC PDR H. Denton H. Thompson F. Miraglia G. Burdick W. Hodges G. Hulman M. Silberberg ACRS DISTRIBUTION tCentrab File 7 ,

DSR0 file RIB r/f T. Speis B. Sheron Z. Rosztoczy F. Coffman E. Eltawila R. Landry 0FC :DSRO: RIB :DSR0: RIB  : B :D RO: :DSP .  :  :

_____:.....p/rr _: _____.p__:. af.: __

NAME :RLan ry Coffman :Zf%zozy :B .r ..._k____:__.._______:______

TSI ei  :  :

DATE :02/s 2. /87 :02/l? /87 :02/tb /87 :02/lN87 :02/ /2 /87  :  :

0FFICIAL RECORD COPY

ej ' <. ;y TECHNICAL REPORT A-3828 12-15-86 PREVENTION AND MITIGATION OF SEVERE ACCIDENTS

,. IN A PWR WITH A LARGE ORY CONTAINMENT N. Cho, C.J. Hsu, J. Maly, J. R. Lehner, K. R. Perkins Safety and Risk Evaluation Division

' W. J. Luckas Engineering Technology. Division Department of Nuclear Energy .

Brookhaven National Laboratory Upton, New York 11973 i

(DRAFT) l December 1986 I

i' Prepared for U.S. Nuclear Regulatory Commission Washington, DC 20555 Contract No. DE-AC02-76CH00016 FIN A-3828 1*CTOYQY?'f

o, ABSTRACT Preliminary guidelines and proposed criteria have been developed for the prevention and mitigation of severe accidents in PWR reactors with large dry containments.- The preliminary guidelines were developed from insights derived from reviews of risk assessments performed specifically for the Zion plant and

. from other relevsnt studies. Accident sequences that dominat'e the core damage

~

frequency and those accident sequences that are of ~potentially high conse-~

quence were identified. Vulnerabilities of the large dry containment to severe accident containment loads were also identified. In addition, those features of a PWR with a large dry containment, which are important for pre-venting core damage and/or are available for mitigation of fission product release to the environment were also identified. Based on this information, ten preliminary guidelines with associated proposed criteria were developed.

These guidelines and criteria are intended to be used to assess the capability of individual PWR large dry plants to cope with severe accidents.

iii

3 e

. )

TABLE OF CONTENTS Page ABSTRACT................................................................. iii LIST OF FIGURES.......................................................... vii LIST OF TABLES........................................................... ix PREFACE.................................................................. xi ACKNOWLEDGMENTS.......................................................... xiii N O M E N C L AT U R E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' xy

1.

SUMMARY

............................................................. 1-1 1.1 Core Damage Profile............................................ 1-1 1.2 Consequence Analysis........................................... 1-2 1.3 P ro po s ed Gu i d el i n e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 -2

2. INTRODUCTION........................................................ 2-1 2.1 Background.....................................................2-1 2.2 0bjectives..................................................... 2-2 2.3 Organi zati on of the Report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3 2.4 References for Section 2....................................... 2-4

3. DEFINITION OF G0ALS AND RELEVANT LARGE DRY PLANT FEATURES........... 3-1 3.1 Mitigation of Fission Product Releases......................... 3-2 3.1.1 Pl ant Vul nerabil iti es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2 3.1.2 Mitigating Features..................................... 3-3 3.2 Reduction in the Frequency of High Consequence Sequences....... 3-4 3.3 Reducti on of Hi gh Co re Damage Frequency. . . . . . . . . . . . . . . . . . . . . . . . 3-5 3.4 References for Section 3....................................... 3-7

4. PRELIMINARY GUIDELINES AND PROPOSED CRITERIA........................ 4-1 4.1 Mitigation of Fi ssi on Product Rel eases . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 4.1.1 Maintenance of Containment Integrity in a large Dry Containment (Prel imina ry Guideline 1) . . . . . . . . . . . . . . . . . . . 4-2 4.2 Reduction in the Frequency of High Consequence Sequences....... 4-2 4.2.1 Interfacing Systems LOCA (Including Steam Generator Tube' Rupture) (Prelimi na ry Guideline 2) . . . . . . . . . . . . . . . . . 4-3 4.3 Reduction of High Core Damage Frequency Sequences.............. 4-4 4.3.1 Loss of Component Cooling Water (Preliminary Gu i d e l i n e 3 ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 - 4 4.3.2 High Pressure Injection Systems (Including Recirculation Switchover and Containment Heat Removal)

(Guideline 4)........................................... 4-5 v

• b

" age 4.3.3 Station Blackout (Preliminary Guideline 5).............. 4-6 4.3.4 Auxiliary Feedwater System and RCS Feed & Bleed Cooling (P r el i mi n a ry Gu i del i n e 6 ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-7 4.3.5 Low Pressure Injection (Preliminary Guideline 7)........ 4-7 4.3.6 RCS Depressurization by Secondary Blowdown

( Prel i mi n a ry Gui del i n e 8 ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8 4.3.7 Anticipated Transients Without Scram (ATWS)

( Prel imi na ry Gui del i ne 9 ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-8 4.3.8 Support System Interdependencies Gui del i ne 10 ) . . . . . . . . . . . . . . . .......................

. . . . .(Prel imina ry 4-9 4.4 References for Section 4....................................... 4-10 Appendi x A - SEVERE ACCIDENT RISK 1NSIGHTS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1 A.1 Core Damage Profile ............................................ A-1 A.1.1 IDCOR Baseline Estimate of Zion Core Damage Frequency.... A-2 A.1.2 Zion Review Estimate of Zion Core Damage Frequency....... A-3 A.1.3 SARP Rebaseline Estimate of Zion Core Damage Frequenc A-13 A.1.4 Comparison Between IDCOR and SARP....................y... .... A-30 A.2 Core Meltdown Phenomena and Containment Response................ A-31 A.2.1 Containment Performance.................................. A-31

A.2.1.1 Li st of Analyzed Accident s. . . . . . . . . . . . . . . . . . . . . . A-31 A.2.1.2 Containment Failure Probability................. A-33 A.2.2 Comparison of SARP and IDCOR Results..................... A-33 A.3 Compa ri son of Accident Rel ea ses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-3 5 A.3.1 IDCOR an.1 SARP Model i ng Di f ferences . . . . . . . . . . . . . . . . . . . . . . A-3 7 A.4 Offsite Consequences............................................ A-41

A.5 Summary and Risk Insights....................................... A-41 A.5.1 Co re Dana g e P r o f i l e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-41 A.S.2 Consequence Analysis..................................... A-42 A.6 R e f e r e n c e s . .'. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A - 4 3 vi l

- . _ _ _ - . _ _ _ _ , . ~ . . - _

_ _ . ~ _ _ . _ . _ _ - - - -

e e o 4 LIST OF FIGURES Figure Page A.1 A heat and fl uid fl ow diagram for Zi on. . . . . . . . . . . . . . . . . . . . . . . . . . . . A-46 A.2 Conditional probability of early containment failure: all s eq u e n c es i n cl u d ed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-4 7 A.3 Containment pressure response for S2 DC s A.4 Containment building pressure (IDCOR).R Note (equence therscale(SARP).......g...

2.5x10 A-48 1

psi and 5x10 hou rs , us ed sin all 10COR fi gu res .) . . . . . . . . . . . . . . . . . . A-49 A.5 Containment pressure response for S DC sequence with late A.6 containment failure (SARP)........ ...............................

2R A-50 ,' .

Containment pressure response for 5 DC sequences with early containment failure (SARP)........ ...............................

2R A-51 A.7 Containment building pressure (IDC0R)............................. A-52 A.8 Containment pressure response for Zion TMLB' sequence with ra p i d d e b r i s q u e n ch ( S AR P ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A- 5 3 A.9 Pressure in containment for Zion TMLB' se concrete attack (SARP)...................quence with direct

......................... A-54 A.10 Containment pressure response for the TMLU sequence (SARP)........ A-55 A.11 SLFC contai nment p ressu re (IDC0R) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-56 A.12 ALFC containment pressure (IDC0R)................................. A-57 A.13 Containment pressure response for Zion S 2D sequence with containment sprays and concrete attack by core debris (SARP)...... A-58 A.14 Comparison of LLH and point-estimate results for conditional probability of early containment failure (Bins 1 - 5 and 16 - 19) for fi ve representative pl ant damage states. . . . . . . . . . . . . . . . . . . . . . . A-59 A.15 Comparison of LLH and point-estimate results for conditional probability of late containment failure (Bins 8 - 10) for five representative plant damage states................................ A-60 vii

O t

. o LIST OF TABLES Table Page 1.0 Preliminary Guideline for the Prevention and Mitigation of Severe Accidents in a PWR With a large Dry Containment........... 1-6 3.0 Dominant Accident Sequences for Zion in the ASEP Study (Mean Values Per Reactor Year)................................... 3-8 4.0 Preliminary Guideline for the Prevention and Mitigation of.

Severe Accidents in a PWR With a large Dry Containment........... 4-12 4.1 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 1: Cont ai nment Integ ri ty. . . . . . . . . . . . . . . . . . 4-13 4.2 Proposed Criteria fot PWR Large Dry Containment Preliminary Guideline 2: Interfacing Systems LOCA (Includi ng Steam Generator Tube Rupture) . . . . . . . . . . . . . . . . . . . . . . . . . 4-17 4.3 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 3: Component Cooling Water................ 4-19 4.4 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 4: High Pressure Injection Systems (Including Recirculation Switchover and Containment Heat Removal). 4-20 4.5 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 5: Station Blackout (SB).................. 4-22 4.6 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 6: Auxiliary Feedwater System (AFWS) and RCS Feed & Bl eed Cool i n g. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-23 4.7 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 7: Low Pressure Injection................. 4-25 4.8 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 8: RCS Depressurization by Secondary B10wdown......................................................... 4-26 4.9 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 9: Anticipated Transients Without Scram (A M ).............................................. M.~.... 4-2?

4.10 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 10: Support System Interdependencies...... 4-28 A.1 Design Comparison of Nuclear Power Plants with large Dry Containments...................................................... A-61 A.2 IDCOR Baseline Core Damage Profile................................ A-62 A.3 Zi on Revi ew Co re Danage Profil e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-64 A.4 Comparisons of Dominant Accident Sequences Obtained by SARP Rebas el i ne , Zi on Revi ew and IDC0R-Bas el i ne. . . . . . . . . . . . . . . . . . . . . . . . A-6 6 A.5 Comparison of Dominant Core Damage Frequency for Zion (Per R e a c t o r Y e a r ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A- 7 0 A.6 Revi ew of Accident Analyses for Zion Nuclear Plant.. . ... . . . . . . . . . . A-72 A.7 Comparison of. Early Containment Failure Probability with Other Studies........................................................... A-73 A.8 Results of the Integrated Analysis of Accident Process and Fission Product Transport Zion.................................... A-74 A.9 SARP - IDCOR Cal cul at ed Source Te rms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-75 A.10 Cha racteri sti cs f or the Zi on Pl ant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-76 A.11 Results of Source Term Calculations Release Fraction By Group..... A-77 A.12 NRC/IDCOR Issues.................................................. A-79 A.13 Li st of Symbol s fo r Reacto r Accid ent s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-80

'x

Table Page A.14 Risk Results from the SARRP Rebaselining Report Compared to Previous Studies.................................................. A-81 O

e e

1 i

l l

. 'o I

PREFACE l

This draft report addresses the subject of formulation of guidelines and l

criteria for severe accidents in PWRs with large dry containments. It is an f interim (preliminary) product of a technical assistance contract with NRC/NRR in support of their Implementation Plan for the Severe Accident Policy State-ment (see SECY-86-76, Febr.uary 23, 1986 for details of this plan). It is im- ~

• portant to emphasize that while this effort required a broad range of in-depth expertise from Brookhaven National Laboratory (BNL) in the area of plant sys-

~

tems and operations, accident sequence analysis, severe accident phenomenol-ogy, and risk integration, there was considerable input from the NRR staff on progran emphasis and technical direction. In particular, BNL was directed by the staff to formulate preliminary guidelines and proposed criteria that are deterministic (rather than probabilistic) in character.

The information contained in this draft is subject to revision upon re-ceipt of information from two ottier programs. The 10COR program, sponsored by.

the nuclear utility industry, is developing a methodology for individual plant examinations which, subject to evaluation and modification by NRC, would be used in conjunction with guidelines and criteria developed by NRC. Draft doc-umentation on this methodology was available to BNL but our review of this material is incomplete. The SARRP program, sponsored by the NRC Office of Nuclear Regulatory Research, is rebaselining risk for several reference plants and this will be published in NUREG-1150. BNL has received preliminary re-suits on portions of this work along with a caveat from the SARRP contractor that the results are subject to revision.

The reviewers of this draft report are encouraged to provide comments and suggestions on all aspects of this work.

xi

. _ _ - - D

a ~.

ACKNOWLEDGMENTS This work was performed for the Regulatory Improvements Branch of the Division of Safety Review and Oversight, NRR/NRC. The NRC Manager for the program is F. Coffman, who has provided technical direction and considerable input to this program. In addition, the program has benefitted from the technical direction given by Z. R. Rosztoczy, F. Eltawila, b Sammons and R. Palla.

The authors are also grateful for several discussions with other members of the DNE staff at BNL. The draft report has benefitted significantly from the review and guidance given by R. Fitzpatrick, R. A. Bari, W. T. Pratt, R. Youngblood, M. Khatib-Rahbar and R. E. Hall.

The authors are grateful to D. Miesell for her excellent typing of a large part of this report and we are especially grateful to S. Flippen for her considerable patience in assembling the final document from numerous revisions.

4 xiii

NOMENCLATURE AC Alternating Current AFWS Auxiliary Feedwater Systems AMSAC ATWS Mitigating Systems Actuation Circuitry ASEP Accident Sequence Evaluation Progran .

ATWS Anticipated Transient (s) Without Scram ,1 BCL Battelle Columbus Division BNL Brookhaven National Laboratory BWR Boiling Water Reactor CCWS Component Cooling Water System CDF Core Damage Frequency I CHR Containment Heat Removal DC Direct Current ECCS Emergency Core Cooling System EFS Emergency Feedwater System ESW Essential Service Water GI Generic Issue HPIS High Pressure Injection System HPRS High Pressure Recirculation Systen IDCOR Industry Degraded Core Rulemaking IPE Individual Plant Evaluation LLRT Local Leak Rate Testing LOCA Loss of Co'olant Accident LPIS Low Pressure Injection System LPRS Low Pressure Recirculation System LWR Light Water Reactor MFW Main Feedwater xv

NOMENCLATURE (Cont'd)

MOV Motor Operated Valve MW Megawatt NPSH Net Positive Suction Head NRC Nuclear Regulatory Commission NRR Nuclear Reactor Regulation PORY Pressure Operated Relief Valve PRA Probabilistic Risk Assessment PWR Pressurized Water Reactor RCP Reactor Coolant Pumps RCS Reactor Coolant Systems RES Nuclear Regulatory Research RHR Residual Heat Removal RPS Reactor Protection System RWST Refueling Water Storage Tank SARP Severe Accident Research Program Severe Accident Risk Reduction Program SARRP SB Station Blackout SI Safety Injection SG Steam Generator SGTR Steam Generator Tube Rupture SNL Sandia National Laboratories SWS Service Water System USI Unresolved Safety Issue ZPSS Zion Probabilistic Safety Study 1

xvi

1-1

1.

SUMMARY

This investigation was performed in support of the NRC/NRR Implementation Plan (SECY-86-76) far the Severe Accident Policy Statement. Based on an ex-tensive review of severe accident investigations, the authors have proposed a set of preliminary guidelines and associat ed detailed criteria which can be used to assess the ' capability of individual PWR, large dry plants to cope with severe accidents. Although ms:h of 'the work is based on probabilistic risk assessments (PRAs), the preliminary guidelines and criteria are deterministic in nature and take into account detailed severe accident experiments and analyses performed by both NRC/RES and the nuclear industry.

1.1 Core Damage Profile Appendix A provides a summary of PWR, large dry plant risk assessment studies with emphasis on the recent ASEP and IDCOR results. Loss of component cooling water, transients (including station blackout) and small LOCAs domi-nated the core damage risk profile for the studies examined.- There was no consistent pattern of relative ranking of transient sequences across all of the studies. -

For the ASEP study of Zion, accidents involving loss of component cooling water appeared as the dominant contributor to the core damage frequency (about 80%). However, the quantification of this sequence appears conservative since it is dominated by low pressure pipe rupture events. These events were not identified by IDCOR and therefore the component cooling water failure sequence is not a significant contributor in the IDCOR study.

In addition to the component cooling water failures, ASEP indicated that sequences involving loss of offsite power and small LOCA are the dominant core damage sequences for' Zion. The preliminary guidelines for other PWR large dry plants will attempt to ensure that the likelihood of these dominant sequences is no higher than that indicated in the ASEP study for Zion.

i

. o 1-2 1.2 Consequence Analysis The assessment of core meltdown phenomena and containment response in Appendix A indicated that the relatively large containment is not vulnerable to overpressurization due to buildup of noncondensible gases. Both 10COR and SARRP indicate that early containment failure is unlikely. Thus, containment function (reduction of the source term) i_s preserved for almost all . cases; Although the frequency of early containment failure is estimated to be low for both Zion and Surry (about 5% mean), the releases are severe and such sequences are a dominant contributor to risk. Other large dry containments with different reactor cavities (i.e., less susceptible to quenching of the core debris), different containment strengths (e.g., steel shell), and differ-ent volumes may be more susceptible to direct heating or hydrogen combustion.

Direct containment bypass sequences (interfacing systems LOCA) also result in severe releases of fission products.

1.3 Proposed Guidelines For a PWR with a large dry containment, the dominant core damage sequences were found to be loss of component cooling water, small breaks, and transients (including station blackout). In order to minimize off-site conse-

, quences, the containment systems must be able to fulfill their role of re-stricting fission product releases even under severe accident conditions.

The most severe consequences of core damage accidents in Zion are from accidents which result in early containment failure or bypass. The SARRP

, analyses indicates that direct containment heating and hydrogen combustion may cause such early failure. In order to assess the importance of such early failures in other large dry containments one guideline is suggested pending resolution of early ~ containment failure issues.

Although the interfacing systens LOCA is usually a highly unlikely event, it could be a significant risk contributor due to the potentially high re-lease. One guideline and associated criteria are intended to ensure that the 1

l l

o .

1-3 frequency of interfacing systems LOCA events is kept at an acceptably low level for all large dry plants.

Although stean generator tube rupture (SGTR) with one or more tubes ruptured bears the characteristic of a small LOCA, it is unique in the sense that it is also a potential containment bypass LOCA, releasing primary reactor coolant into the secondary side of the steam generators. Thus the SGTR pro-vides several potential paths for release of fission product to the environ-ment outside the containment via the main steamline, turbine, turbine bypass, condenser, condenser exhaust, steam generator atmospheric relief valves or safety valves and the steam generator blowdown line. Thus, despite its rela-tively small corc damage frequency (usually a few percent of the overall core damage frequency from internal events), one guideline is developed to prevent i the occurrence of SGTR and to mitigate the potentially high release conse-1 quences if it occurs.

The major contributors to the core damage for Zion are identified in Appendix A. They are sequences from loss of component cooling water, small LOCA (S 2

), and station blackout. Thus, if the frequencies of these accident sequences (or a subset of them) can be reduced, then the overall core damage frequency will be substantially reduced.

After component coolms water failures, th'e small LOCA initiator (S2 ) is the largest contributor to core damage at Zion. Major contributors to the S 2 sequences are operator failures in the recirculation switchover operation and common causa failures of the containment sump suction valves and the high pressure pump suction valves. Although the sequences involving loss of con-tainment heat removal (CHR) were found only marginally inportant for Zion, the main contributor to these sequences is also the failure in the recirculation switchover. Thus a preliminary guideline is developed in Section 4 to ensure a low frequency of r'ecirculation failure.

In Zion, station blackout sequences are important contributors to the core damage frequency. The accident sequences in station blackout are charac-terized by two categories

• of events: First, ac power is not recovered before battery depletion which, in turn, defeats the turbine-driven AFWS pump, and

- _--__ __ 1

1-4 second, station blackout causes a RCP seal LOCA due to failures of seal injec-tion flow and RCP thermal barriers resulting from loss of the component cool-ing water and service water systems. Guidelines and criteria for station blackout are based on the NRC proposed rule and are developed in Section 4 An event initiated by loss of component cooling water leads to RCP seal LOCA sequences due to loss of RCP seal cooling, under the condition that high pressure injection fails because pumps in the high pressure injection systems are also cooled by component cooling water. The contribution of this initi-ator to core damage frequency can be reduced by reducing the frequency of loss of the Component Cooling Water System. Proposed criteria reported in Section 4 are preliminary, pending the results of ongoing effort at NRC to resolve the RCP seal LOCA issue (GI-23).

One potentially effectivo means of making up core inventory in case the high pressure systems are unavailable, either in injection or in recirculation phase. is to depressuri:c the reactor coolant system (RCS) by heat removal through steam generators. After sufficient heat removal the Low Pressure In-jection System (LPIS) can be actuated for the makeup operation. This emer-gency procedure appears to have a significant impact on reducing the core dam-age frequencies. To attain success in this procedure, the operator must open the atmospheric steam dump valves, maintain AFW or main feedwater to the steam generators and have one of the low pressure makeup trains available. The pro-posed criteria germane to this guideline are developed in Section 4 to address the RCS depressurization by secondary blowdown.

The Auxiliary Feedwater System (AFWS) is the normal means of decay heat removal in small LOCA and transient events, including a normal plant shut-down. Table A.5 indicates that the core damage sequences at Zion involving failure of the AFWS are related to (1) the station blackout controlled by failure of the AFWS' turbine-driven pump due to dc bus failure or battery de-pletion, and (2) the loss of a dc bus initiator followed and controlled by failures of the motor-driven pumps and by failure of the RCS feed & bleed cooling. The proposed criteria under the station blackout guideline address the availability of a turbine-driven pump during station blackout. The

1-5 criteria are also developed to address .the motor-driven pumps and RCS feed &

bleed cooling.

ATWS is not a significant contributor to core damage at Zion and this is also generally supported by PRAs for other Westinghouse PWRs. One factor for these results is the credit given to the manual scram and the emergency bora-tion using the charging system to deliver bo.ated water from the boron injec-tion tank to the reactor vessel. Failures of the manual scram and the emer-gency boration are dominated by failures of operator actions. Criteria are developed to address these operator actions in addition to the ATWS rule.

~

l l

l One of the insights of many risk assessment studies is the importance of support system .interdependencies. For example, a preliminary draft of the ASEP Peach. Bottom study indicated that loss of all service water was a domi-nant contributor to core damage.- In order to ensure that support system vul-nerabilities-do not cause unacceptably high core damage frequencies for-large dry PWis, the authors have proposed one guideline to help assess any weak-nesses of the support systems.

Table 1.0 sunmarizes the preliminary guidelines proposed in this study for a PWR with a large dry containment.

1-6 Tab'le 1.0 Preliminary Guidelines for the Prevention and Mitigation of Severe Accidents in a PWR With a large Dry Containment Preliminary Guideline Description For Mitigation of Fission Product Releases:

1 Maintenance of Containment Integrity 1.A. Provide Containment Spray and Long Term Heat Removal 1.B. Provide Filtered Venting 1.C. Assessment of Early Containment Failure For Control of High Consequence Sequences:

2 Interfacing Systems LOCA (Including Steam Generator Tube Rupture) 2.A. Prevent Overpressurization of Low Pressure Systems 2.B. Prevent Steam Generator Tube Rupture and Minimize Its Consequences For Reduction of High Core Damage Frequency:

3 Component Cooling Water (CCW) 3.A. Provide Adequate Cooling to Engineered Safety Features Systems 4 High Pressure Injection Systems (Including Recirculation Switchover and Containment Heat Removal) 4.A. Provide Adequate Core Recirculation Cooling 4.B. Provide Adequate Containment Heat Removal 5 Station Blackout (SB) 5 A. Comply with the Proposed SB Rule and Provide Operator Response During SB '

6 Auxiliary Feedwater System (AFWS) and RCS Feed & Bleed Cooling 6.A. AFWS Operation and Operator Actions for RCS Feed &

Bleed Cooling 7 Low Pressure Injection 7.A. Improve Availability of Low Pressure Injection 8 Reactor Coolant System (RCS) Depressurization by Secondary Blowdown 8.A. Implement Procedure to Depressurize RCS for Actuation of Low Pressure Injection or Recirculation Systems 9 Anticipated Transients Without Scram (ATWS) 9 A. Comply With ATWS Rule and Provide Operator Response During ATWS 10 Support System Interdependencies 10.A. Examine Support System Interdependencies

m 2-1

- 2. INTRODUCTION

2.1 Background

During the next two years the NRC plans to formulate and implement an approach for a systematic safety examination of existing plants to determine whether particular accident vulnerabilities are present and what cost-effective changes are desirable to ensure that there is no undue risk to pub-lic health and safety. The nuclear industry's group concerned with severe accidents (IDCOR) selected four reference plants for detailed analysis, name-ly:

Peach Bottom (a BWR with a Mark I containment)

Grand Gulf (a BWR with a Mark III containment)

Zion (a PWR with a large dry containment)

Sequoyah (a PWR with'an ice condenser containment).

The IDCOR analyses performed for the above reference plants have been documented together with the methodology used for the analyses and the techni-cal basis supporting the methodology. In addition, IDCOR is presently working on a simplified approach to be used for the examination of other plants simi-

lar to one of the reference plants. The simplified approach together with a few sample applications has been submitted for NRC review.

j In parallel with the IDCOR work, NRC/RES is performing risk assessments, audit calculations, sensitivity studies, and uncertainty analysis for five plants under the Severe Accident Research Program (SARP). The five plants to be considered includ'e the above four IDCOR reference plants, and, in addition:

Surry (a PWR with a subatmospheric containment).

NRC/NRR will consider both the IDCOR and SARP analyses performed for the reference plants in addressing the adequacy of these plants with respect to l

2-2 public safety, and use the experience gained from these reviews for developing plant type specific guidelines and criteria for the prevention and mitigation of severe accidents. In turn, these guidelines will be used in the systematic safety ex~ amination of individual plants. In addition, a review of the simpli-fied approach for individual plant examinations being developed by IDCOR will be part of the effort.

The first reference plant reviewed by BNL1 was Peach Bottom, which is a BWR-4 with a Mark I containment. The IDCOR Peach Bottom analysis was docu-mented in March 1985 (IDCOR Technical Report 23.1PB) and supplemented by addi-tional sensitivity studies in July 1985. The SARP Peach Bottom reports have been submitted in draft form and are subject to change. The Sequoyah plant, which is a PWR with an ice condenser containment was also reviewed by BNL.

The IDCOR Sequoyah analysis was documented in March 1985 (Ref. 2). The SARP Sequoyah reports have been submitted in draft form.3 The experience gained from the review of studies for the two plants along with older reviews was sufficient to generate preliminary guidelines and proposed detailed criteria.

This draft report therefore builds on the experience gained during our Peach Bottom and Sequoyah work and on the comments received from reviewers of Refer-entes 1 and 4 This draft report deals specifically with potential severe accidents in a PWR with a large dry containment. Both IDCOR and SARP used Zion as a reference plant for this class of reactors; so this draft report is based largely on analyses of severe accidents at Zion. The IDCOR analysis 2 for Zion was documented in March 1985 whereas the SARP analysiss is again in draft form and subject to change.

2.2 Objectives I

There are three basic objectives or goals for this severe accident pro-gram which will apply equally to all plant types:

Goal 1: Mitigation of fission product releases Goal 2: Reduction in the frequency of high consequence sequences

, Goal 3: Reduction of high core damage frequency.

, e j 2-3 1

The aim is, therefore, to develop detailed plant type specific ' guidelines l and proposed criteria to be used to achieve these goals during the examination of individual plants. For example, Goal 1 implies that there shall be effec-tive means of mitigating the fission product releases for the broad classes of accident sequences which dominate the core damage frequency. Therefore, these dominant accident sequences have to be determined and those plant features and operator actions that are available to mitigate fission product release have to be identified. Only then can detailed guidelines and criteria be developed to ensure mitigation of these dominant accident sequences.

There may be accident sequences for which the plant will have substantial fission product releases (e.g., containment bypass sequences). Thus, for such sequences Goal 1 may be difficult to achieve. Therefore, all reasonable steps should be taken to reduce the frequency of these potentially high consequence sequences (namely goal 2). Again, the accident sequences have to be identi-fied and plant vulnerabilities and/or operator actions that lead to core dam-age for these sequences also have to be identified. Detailed guidelines and criteria can then be developed which will aid in assessing an individual plant's capability to prevent these sequences from occurring.

Finally, it is necessary to ensure that the overall core damage frequency is low (namely Goal 3). Again, the dominant accident sequences have to be found so that detailed guidelines and criteria' can be developed to reduce the frequency of these sequences, if necessary.

2.3 Organization of the Report In Section 3, the three basic goals of the program are related to the relevant design features and operating characteristics of a PWR with a large dry containment and then preliminary guidelines necessary to achieve the three goals are developed.' In Section 4 the preliminary guidelines are restated and detailed criteria are developed for each guideline. Both sections draw heavily on Appendix A which contains a review of the IDCOR and SARP analyses for Zion, a PWR with a large dry containment, along with other pertinent stud-ies. The insights gained from these studies lead to the identification of the strengths and vulnerabilities of a PWR with a large dry containment.

2-4 2.4 References for Section 2

1. Pratt, W. T. et al., " Prevention and Mitigation of Severe Accidents in a BWR-4 with a Mark I Containment," Draft BNL Technical Report A-3825, October 1986.

2. IDCOR Technical Report 23.1S, March 1985.

3. Bertucio, R. C. et al., " Analysis of Core Damage Frequency from Internal Events: Sequoyah, Unit 1," Sandia National Laboratories, Draft, circa June 1986.

4. Cho, N. et al., " Prevention and Mitigation of Severe Accidents in a PWR with an Ice Condenser Containment," Draft BNL Technical Report. A-3828, November 1986.

5. Wheeler, T. A., " Analysis of Core Damage Frequency from Internal Events:

Zion Unit 1," Sandia National Laboratories, NUREG/CR-4550, Volume 6, Final Draft, July 1986.

l 3-1

3. DEFINITION OF G0ALS AND RELEVANT FEATURES OF LARGE DRY CONTAINMENT PWRS I

In Section 2 of this report the concept of three basic objectives or goals for this severe accident program was introduced. The concept applies equally to all plant types. In this section, the three goals are related to the relevant design features and operating characteristics of a PWR with a large dry containment. This includes consideration of both favorable and unfavorable severe accident attributes. Appendix A provides the accident sequences and containment failure modes found to be important at Zion. Table 3.0 summarizes the dominant accident sequences identified in the ASEP study.

Screening criteria have been used to identify those sequences which need to be addressed by severe accident guidelines for each goal. Specifically:

For Goal 1 (Mitigation of fission product releases), all sequence bins have been examined which each represent at least 5% of the core damage fre-quency and are predicted to result in containment failure.

For Goal 2 (Reduce the frequency of high consequence sequences) all sequences have been examined which result in containment bypass and are esti-mated to occur more often that 10-7 per reactor-year.

For Goal 3 (Reduction of high core damage frequency) all sequences have been examined which "have the potential to occur" more frequently than 10-6 per reactor-year. Note that this screening criterion has been used to identi-fy potential vulnerabilities from risk assessment insights which do not neces-sarily apply to Zion itself, but may apply to other PWR large dry plants.

The aim is, therefore, to develop detailed plant specific guidelines and proposed criteria to be used to achieve these goals during the examination of individual plants. This section provides the link between the goals (devel-oped in Section 2)'and the preliminary guidelines (developed in Section 4, summarized in Table 4.0) that will be used to assess the capability of specif-ic plants to meet these goals. This section is organized into three subsec-tions, which correspond to the three goals.

3-2 3.1 Mitigation of Fission Product Releases This goal requires that there shall- be effective means of mitigating the fission product releases for the broad classes of accident sequences which may lead to core damage in a large dry plant. In Appendix A, Table A.8 we found that the most important contributors to the core damage frequency are small breaks (including the V sequence), large breaks, and transients with feedwater failure (including station blackout). No specific accident sequences for which mitigation by the large containment is ineffective have been identified-for either Surry or Zion. Rather, three generalized threats to the contain-ment (direct heating', hydrogen combustion and containment heat removal fail-ure) have been treated in the SARRP uncertainty assessment. These three phe-nomena appear to dominate containment failure and risk for PWRs with large dry containments. Specifically, the combined effects of direct heating and hydro-gen combustion _ pose the only significant threat to early containment failure while containment heat removal failure poses a significant threat to long term containment integrity. This section concentrates on these broad threats to containment integrity for which plant features provide significant mitigation of the fission product release.

3.1.1 Plant Vulnerabilities '

As noted in Appendix A, the Zion containment is a large volume contain-ment design. The volume of the containment makes it effective against pres- 4 sure buildup due to noncondensible gas generation and hydrogen combustion dur-ing a core meltdown accident. However, even a large dry containment will fail

. eventually unless containment heat removal is preserved. There are differ-1 3 ences between the IDCOR ,2 and ASEP/SARRP -s analyses as to how long it will i

take.to pressurize a large dry containment to its ultimate capacity after the core debris has failed the reactor vessel and the reactor cavity has dried out' but both studies cod'cluded that for some cases containment failure will even-tually occur.

Therefore, unless containment heat removal is preserved the containment will fail for some accidents due to overpressure. If containment i

failure occurs, a significant inventory fission products in the containment atmosphere could be released to the environment.

l

l

. . l l

1 3-3 l l

An inspection of the Zion containment configuration indicates that the l cavity below the reactor pressure vessel would tend to confine the core debris after a- core meltdown accident. Under normal conditions the water from the ECC accumulators and containment sprays will flood the lower cavity, cooling the core debris. There are differences between the IDCOR2 and BCL" analyses as to how hot the core debris will be during core / concrete interactions and as to how much of the less volatile fission products will be released. However, at this time the possibility of the core debris remaining hot or eventually drying out and releasing significant quantities of fission products has not been ruled out.

The most important vulnerability of the large dry containment appears to be the possibility of early containment failure, due to hydrogen deflagrations or detonations and direct heating. If early containment failure does not occur there is still a significant probability of late containment failure (about 4%), due to buildup of noncondensible gases or steam after failure of containment heat removal.

3.1.2 Mitigating Features For early containment failure sequences the containment sprays provide an effective device for removing any fission product aerosols that might pass through it. The sprays also help flood the reactor cavity and reduce the likelihood of direct heating.

Long term overpressure failure of the containment can be prevented by intensive cooling of ECC water and of recirculating spray water as well as operation of the fan cooler system.

The most severe consequences of core melt accidents in Zion are from accidents with earl'y containment failure. The SARRP uncertainty analysis s indicates that hydrogen detonations or deflagrations may contribute to such early failure. In order to prevent hydrogen detonations and deflagrations for some vulnerable plants, hydrogen igniters may be necessary. The NRC has iden-tified the threat of hydrogen to large dry containments as a generic issue (GI-121).

l

3 The above discussion has identified several features of the PWR plants that have the potential to help achieve Goal 1, namely, the mitigation of fis-sion product releases. Therefore, one preliminary guideline has been devel-oped and related to those features which will aid in assessing whether spe-cific plants can meet Goal 1. .The preliminary guidelines address the follow-ing three areas:

Containment Integrity Threats Due to Direct Heating and Hydrogen Com-bustion Availability of Containment Sprays

. Availability of Long Term Heat Removal In Section 4.1 one preliminary guideline will address each of the above areas. In addition, detailed proposed criteria will be developed to address each guideline.

3.2 Reduction in the Freauency of Hich Consequence Sequences The interfacing systems LOCA would open up a direct path from the primary side to the reactor buildings which bypasses the containment. The only plant feature pertinent to mitigating this event is the reactor auxiliary building, which may not be sufficient on its own to ensure low fission product releases to the environment. The frequencies of accident sequences resulting from this initiator should, therefore, be maintained at acceptably low levels (Goal 2).

In Section 4.2, we develop preliminary guidelines and detailed proposed crite-ria to try to meet Goal 2. It is noted that BNL is currently performing a study on interfacing systems LOCA to provide technical support to the Reactor Safety Issues Branch of NRC for a meaningful resolution of this generic issue.

The steam generator tube rupture event would provide an open pathway for early radioactive release to the atmosphere if the core damage is not arrested in a timely fashion and the release paths in the secondary side, e.g., the l main steam isolation valve of the ruptured steam generator, main steam isola- d tion valves, and power-operated atmospheric vent valves, are not isolated properly. Although this initiator is not a dominating contributor to the overall core damage frequency, it could be important to risk because it can

3-5 lead to accident sequences which bypass the containment. Thus, the fre-quencies of these sequences should be maintained at acceptably low levels (Goal 2). In Section 4.2, we develop preliminary guidelines and proposed cri-teria for this event.

3.3 Reduction of High Core Damage Frequency In Section A.1 we presented a set of accident sequences which were iden-tified in the IDCOR and SARP studies as dominant contributors to core damage for the Zion plant. This led us to conclude that if the frequency of a subset of these accident sequences can be controlled, then the overall core damage frequency will also be controlled.

The most important contributors to the core damage at Zion (excluding external events) were found to be loss of component cooling water, small LOCA, and station blackout sequences.

Loss of component cooling water, as an initiator, causes failures of seal injection flow and thermal barriers and thus may lead to RCP seal LOCA sequences due to loss of RCP seal cooling. Note also, that, depending on the redundancy and heat loads of t(e Component Cooling Water System (CCWS) and the Essential Service Water System (ESWS) in a particular pl ant , the loss of essential service water coul(Lbe more "crittcal" than the loss of comoonent cooling water with regard to RCP seal LOCA, depending on whether the charging pumps (which inject RCP seal injection water) are cooled by the CCWS or by the ESWS. Evec for pumps which are cooled by CCW, an RCP seal LOCA may result from the loss of the essential service water since the loss of the ESWS, if it is not rapidly recovered would lead to degradation of the CCWS. Reliability of the CCWS including the piping integrity at Zion should be improved and maintained high to reduce core damage frequency resulting from this initi-ator. In Section 473, preliminary guidelines and, criteria are developed for the two systems.

Major contributors to the small LOCA sequences are related to the high pressure recirculation switchover which involves several operator failures and the common cause failures of sump suction valves and high pressure pump

__.__________________________J

3-6 suction valves. This has been found also in other PWR PRAs and the emergency operating procedures of the plants usually address this recirculation switch-over operation.

Characteristics of the important accident sequences in station blackout are battery depletion defeating the turbine-driven AFWS pump, and RCP seal LOCA due to failures of seal injection flow and RCP thermal barriers resulting from loss of the component cooling water and service water systems. Station blackout is currently the subject of an unresolved safety issue (USI A-44).

Thus, development of guidelines and criteria for station blackout are prelimi-nary pending resolution of A-44 Failure of low pressure injection in a large LOCA is a significant con-tributor to the core damage at Zion. Improving availability of the Low Pressure Injection System (LPIS) would not only reduce the frequency of this sequence but also enhance the RCS depressurization by secondary blowdown which is a potentially effective means of making up core inventory in case the high pressure systems are unavailable, because this emergency operation requires the LPIS.

Another set of accident sequences that may defeat several plant safety features and that contribute to the core damage is related to an ATWS. The ATWS initiated by loss of main feedwater is most severe. Failure of secondary i

cooling and primary pressure relief in this sequence leads to a small LOCA and damages the check valves between the primary system and the high pressure in-I jection systems. The result is core damage. In particular, if the turbine fails to trip in this sequence, its demand on the steam generators will cause l them to dry out rapidly, rendering ineffective the secondary cooling by the Auxiliary Feedwater System (AFWS). Thus, it is important to make actuation i

circuitry for turbine trip and the AFWS diverse and independent of the Reactor Protection System (RPS), in order to control the core damage frequency from I

ATWS events. Therefore, the core damage frequency from the ATWS sequences should be controlled by ensuring that reliability of the reactor protection system is high and that the ATWS Mitigating Systems Actuation Circuitry (AMSAC) is installed, and/or that frequencies of the transients are low. An

3-7 i

ATWS rule has been recently issued by NRC and compliance with this rule is required.

3.4 References for Section 3

1. "IDCOR Technical Report 21.1 Risk Reduction Potential," Energy Incorporated, June 1985.

2. " Zion Nuclear Generating Station & Integrated Containment Analysis," IDCOR Technical Report 23.1.

3. Gieseke, J. A. , Cybulskis, P. , Denning, R. S. , Kuhlman, M. R. , Lee, K. W. and Chen, H., "Radionuclide Release Under Specific LWR Accident Conditions," BMI-2104, Volume VI, PWR-Large, Dry Containment Design (Zion Plant), Battelle Columbus Laboratories, Columbus, July 1984.

4. Denning, R. S. , Gieseke , J. A. , Cybulski s , P. , Lee, K. W. , Jordan , H. ,

Curtis, L. A., Kelly, R. F., Kogan, V. and Schmacher, P. M., " Report on Radionucide Release Calculations for Selected Severe Accident Scenarios to U.S. Nuclear Regulatory Commission," Battelle Columbus Division, NUREG/CR-4624, BMI-2139, Vol . 5, July 1986.

5. Khatib-Rahbar, M. et al., " Evaluation of Severe Accident Risks and Potential for Risk Reduction: Zion Power Plants," Brookhaven National Laboratory, NUREG/CR-4551, BNL-NUREG-52029, Vol. 5, September 1986.

F 3-8 Table 3.0 Dominant Accident Sequences for Zion in the ASEP Study (Mean Values per Reactor Year)*

Core Plant Damage Danage No. Sequence Frequency State 1 CCW failure, causing failure of all charging and SI pumps, seal LOCA 1.2E-4 SEFC 2 Small LOCA, failure of recirculation cooling 1.6E-5 SLFC 3 Large LOCA, failure of recirculation cooling 4.9E-6 ALFC 4 Medium LOCA, fai. lure of recirculation cooling 4.9E-6 ALFC 5 Loss of offsite power, failure of AFWS, failure of feed and bleed, failure to restore ac power in one hour (recovery by four hours) 2.1E-6 TEFC 6 Large LOCA, failure of low pressure injection 1.4E-6 AEFC 7 Loss of offsite power, failure of AFWS, failure of feed and bleed, failure to restore ac power in four hours (recovery by eight hours) 4.6E-7 TEFC 8 Loss of off site power, CCW/SWS loss, failure to restore ac in one hour (recovery by four hours) 3.2E-7 SEFC 9 Same as sequence 8, only this represents the SWS common mode portion of the rebaselined Zion Review sequence no. 3 of Table A.4 3.0E-7 SE 10 Loss of offsite power, CCW/SWS loss, failure to restore ac power in eight hours, failure of containment sprays and fan coolers 2.0E-7 SE 11 Loss of offsite power, CCW/SWS loss, failure to restore ac power in four hours (recovery by eight hours) 1.5E-7 SEFC 12 Loss of offsite power, failure of SWS, failure to restore ac power in eight hours. This sequence represents the SWS portions of the rebaselined Zion Review sequence no.4 and no.6 of Table A.4 1.5E-7 SE 13 Same as sequence 12 above, only this is the CCW portion of the rebaselined Zion Review sequence no. 4 of Table A.4 1.0E-7 SEC

3-9 Table 3.0 (Cont'd) Dominant Accident Sequences for Zion in the ASEP Study (Mean Values per Reactor Year)*

Core Pl ant Damage Damage No. Sequence Frequency State 14 Interfacing systems LOCA 1.0E-7 V 15 Failure of de Bus 112, causing loss of one PORV and loss of ac Bus 148, failure of AFW 5.0E-8 TEFC Total 1.5E-4

• From information contained in the draft ASEP report, July 1986 (Ref. 5 in Section 2).

4-1

4. PRELIMINARY GUIDELINES AND PROPOSED CRITERIA In Section 3 those accident sequences that dominate the core damage fre-quency were identified as were those that are potentially of high consequence.

Vulnerabilities of the large dry containment to severe accident containment loads were discussed, and those features of a PWR with a large dry containment which are important for preventing core damage, and available for mitigation of fission product release.to the environment, were identified.

Based on the " insights" from the IDCOR, Zion Review, and SARP studies for Zion and other previous PRA studies, the following sections provide guidelines defining " deterministic, plant-specific guidance on the design features and operating characteristics which are to be examined by the utilities,"I and criteria defining " deterministic standards for judging the acceptability of plant features."1 From SECY-86-762 further guidance is provided in defining preliminary guidelines and proposed criteria. These guidelines "will specify the plant features and operator actions which are considered important to ensuring acceptable risk for the reference plant.u2 Further acceptance crite-ria (for the various preliminary guidelines) "will specify the attributes necessary to ensure acceptable performance."2 Based on this work, ten preliminary guidelines were developed which reflect the importance of these features to plant risk. The ten preliminary guidelines are sump arized in Table 4.0.

The remainder of this section is organized into three sections corre-sponding to the three basic goals. The goals include (1) mitigation of fis-

sion product releases, (2) reduction of the frcquency of high consequence sequences, and (3) reduction of high core damage frequency. In each section, the corresponding preliminary guidelines are discussed from which detailed proposed criteria a're developed which provide the standards by which each l

plant will be measured to meet the guidelines. The criteria address, under i severe accident conditions, the general issues of (a) survivability of equip-ment (i.e., the ability of the equipment to function under the environmental l

conditions and fluid loads associated with severe accident sequences), (b) equipment capabilities and duration of operability, (c) accessibility of

4-2 equipment, (d) availability of support system, (e) identification of necessary components, (f) identification of important operator actions, and (g) identi-

.fication of parameters for initiation of mitigating systems and operator actions.

4.1 Mitigation of Fission Product Releases Foi a PWR with a large dry containment, the dominant core damage se-quences were found to be loss of component cooling water, small break LOCAs and transients (including station blackout). In order to minimize off-site consequences, the containment systems must be able to fulfill their role of restricting fission product releases even under these severe accident condi-tions. In this section one preliminary guideline is proposed with associated criteria which should help other large dry PWRs maintain similar containment performance to Zion.

4.1.1 Maintenance of Containment Integrity in a Large Dry Containment (Preliminary Guideline 1)

The phenomena that determine the magnitude of the containment pressure rise due to " direct heating" (transfer of sensible heat and oxidation energy from an aerosolized melt directly to the containment atmosphere) and hydrogen combustion are highly uncertain. However, the SARRP uncertainty analyses in-dicate these phenomena dominate the likelihood of early containment failure in the Zion and Surry containments. The present NRC research results indicate that direct heating is not risk dominant for Zion but the inportance for other large dry containments has yet to be demonstrated. Until this issue is re-solved we have proposed a preliminary guideline and associated criteria in Table 4.1 based on the engineering judgement that it is best to err on the side of caution.

4.2 Reduction in the Frequency of High Consequence Sequences In Section 4.1 one preliminary guideline and proposed criteria were iden-tified as needed to be developed that should effectively mitigate fission product releases for the broad classes of accident sequences found to be

4-3 important to the core damage frequency. However, accident sequences were found in Section A.1 for which the PWR large dry containment has no effective means of mitigating fission product releases. In this section a preliminary guideline and proposed criteria for the control of these potentially high con-sequence sequences are developed.

4.2.1 Interfacing Systens LOCA (Including Stean Generator Tube Rupture)

(Preliminary Guideline 2)

As discussed in Section 3.2, although the interfacing systems LOCA is usually a highly unlikely event, it could be a significant risk contributor due to the potentially high fission product releases to the environment. The objective of this guideline and associated criteria is to ensure that the fre-quency of interfacing systems LOCA events is kept at an acceptably low level.

Although steam generator tube rupture (SGTR) bears the characteristic of a small LOCA, it is unique in the sense that it is also a potential contain-ment bypass LOCA, releasing primary reactor coolant into the secondary-side of steam generators, which provide several potential paths for release of fission product to the environment outside the containment via the main stean-line, turbine, turbine bypass, condenser, condenser exhaust, steam generator atmo-spheric relief or safety valves, and the steam generator blowdown line, etc.

Thus, despite its relatively small core melt frequency (usually a few percent of the overall core melt frequency from internal events), it is important to provide the necessary measures to prevent the occurrence of SGTR or to miti-gate the release consequences if it occurs.

i Prevention of SGTR should be aimed at removing all conceivable causes that may contribute to degradation and failure of steam generator tubes, with special emphasis placed on preventing chemical corrosion of the tubes by im-proved secondary side water chemistry, and/or protecting the integrity of steam generator tubes from the impact of foreign objects through improved sur-l veillance and inspection. The primary objectives of recovery actions and mit-l i

igation of the consequences of SGTR should be (1) to minimize the release of fission product to the surrounding environment from the ruptured stean gener-ators, (2) to stop the primary-to-secondary , akage, (3) to restore reactor l

l

4-4 coolant inventory to ensure adequate core cooling, and (4) to stabilize the reactor system to regain plant control.

Several important operator actions are required for successful achieve-ment of these purposes, including early and correct diagnosis of SGTR, identi-fication as well as isolation of the faulty steam generator (SG), manual de-pressurization of RCS to stop the leakage fl ow, prevention of steam line flooding, and, in case of a failure of AFWS and secondary cooling, primary bleed and feed cooling using the safety injection pumps and pressurizer PORVs.

Since some of the key operator actions differ substantially depending upon whether the offsite power is available or not, the operators should be trained to familiarize themselves with the correct measures that must be taken to circumvent the adverse situation.

l The proposed criteria developed for this preliminary guideline are pre-sented in Table 4.2. This guideline and criteria must be considered as pre-liminary pending resolution of the generic issue on interfacing systems LOCA (GI-105).

4.3 Reduction of High Core Damage Frequency Sequences The major contributors to the core damage for Zion were identified in Section 3.3. They are accident sequences from loss of component cooling water, small LOCA, and station blackout. Thus, if the frequencies of these accident sequences (or a subset of them) can be reduced, then the overall core i damage frequency will be substantially reduced.

4.3.1 Loss of Component Cooling Water (Preliminary Guideline 3)

An event initidted by loss of component cooling water may lead to RCP seal LOCA sequences due to loss of RCP seal cooling, under the condition that high pressure injection fails because pumps in the high pressure injection systems are also cooled by component cooling water. In some plants the high pressure injection systems are cooled directly by the essential service water (ESW). RCP seal LOCA may also result from loss of the essential service water

4-5 (ESW) since the loss of the ESW, if it is not recovered in time, would lead to failure of the CCW system. Thus the criteria should also apply to the ESW system.

The contribution of this initiator to core damage frequency can be reduced by reducing the frequency of loss of the CCW and ESW systems. The core danage frequency due to seal LOCA can also be reduced by making the RCP seal cooling less susceptible to failure (e.g., using dedicated seal injection systems3 or steam-driven and self-cooled charging pumps") or by improving the seal designs (e.g., using a pneumatic seal which prevents leakages ). The pro-posed criteria developed for this preliminary guideline are presented in Table 4.3 and are preliminary, pending on the results of ongoing effort at the NRC to resolve the RCP seal LOCA issue (GI-23).

4.3.2 High Pressure Injection Systems (Including Recirculation Switchover and Containment Heat Removal) (Preliminary Guideline 4)

As presented in Section A.1, the small LOCA initiator is an important contributor to core damage at Zion. Major contributors to the small LOCA sequences are operator failures in the recirculation switchover operation and common cause failures of the containment sump suction valves and the high pressure pump suction valves. The recirculation switchover operation requires several operator actions to realign flow paths after the low RWST alarm is given:

i) changing positions of several valves downstream of the low pressure injection pumps, ii) isolation of ECCS from the RWST suction, and iii) valving in CCW to the RHR heat exchangers.

Although the se'quences involving loss of containment heat removal (con-tainment spray and fan coolers) were found not to be significant to core dam-age frequency for Zion, the main contributor to these sequences is also re-lated to the failure in the recirculation switchover operation. Since this switchover operation has been found important also in other PRAs, the emergen-cy operating procedures of the plants usually address the steps involved in l

4-6 the switchover . operation. The operator failure probabilities will be mini-mized if the operators are trained in such a way that several of these actions during switchover are an integral operation for a single function. Thus, the likelihood of human error could be substantially reduced.

The proposed criteria developed for this preliminary guideline in Table 4.4 are based on this consideration and on the common cause failures.

4.3.3 Station Blackout (Preliminary Guideline 5)

In most PRAs for LWRs as in Zion, station blackout sequences are impor-tant contributors to the core damage frequency. The accident sequences in station blackout are usually characterized by two categories of events: the failure to recover ac power are not recovered until battery depletion, defeat-ing the turbine-driven AFWS pump, and the RCP seal LOCA due to failures of seal injection flow and RCP taermal barriers resulting from loss of the compo-nent cooling water and service water systems. As part of the effort to resolve the safety issue (USI A-44) the NRC is proposing to amend its regula-tions "to provide further assurance that a station blackout (loss of both off-site power and onsite emergency ac power systems) will not adversely effect the public health and safety.a6 Therefore, the frequency of loss of offsite power, the reliability of the emergency ac system, and the ability of the plant to cope with a station blackout shall be evaluated according to the methods used for the NRC proposed rule on station blackout.

The proposed criteria for this preliminary guideline given in Table 4.5 are based on the NRC proposed rule.

Due to the different configurations and different emergency ac and dc systems, the methods used for the NRC proposed rule on station blackout may l not necessarily address all plant-specific vulnerabilities of the emergency ac and dc power system. Therefore, additional criteria may be necessary to address plant-specific vulnerabilities of the emergency ac and de power sys-tems. These vulnerabilities shall include, but not be limited to, dependen-cies on common support systems, lack of physical separation, and other plant-specific common causes of at and dc unreliabilities.

I

4-7 4.3.4 Auxiliary Feedwater System and RCS Feed & Bleed Cooling (Prelibinary Guideline 6)

The Auxiliary Feedwater System (AFWS) is the normal means of decay heat removal in small LOCA and transient events, including a normal plant shut-down. The station blackout sequences are controlled by failure of the AFWS turbine-driven pump due to dc bus failure or battery depletion. Additional contributions of AFWS failure are involved in the loss of a dc bus initiator followed by failures of the motor-driven pumps and of the feed & bleed cool-ing.

The success of RCS feed & bleed cooling (high pressure injection and steam relief through the PORVs) has a significant impact on reducing the core damage frequencies associated with sequences involving AFWS failures. Suc-cessful feed & bleed cooling hinges on proper operator actions as well as on operability of the high pressure injection systems and the PORVs, and the associated block valves. The operator must ensure sufficient injection by charging pumps or safety injection pumps and manually open the required nuater of PORVs. Containment heat removal systems must also be available.

The proposed criteria to address the AFWS turbine-driven pump developed for this guideline are presented in Table 4.5 under station blackout guideline (Preliminary Guideline 5). The proposed criteria developed in Table 4.6 address the AFWS motor-driven pumps and the RCS feed & bleed cooling.

4.3.5 Low Pressure Injection (Preliminary Guideline 7)

Table A.6 indicates that failure of low pressure injection in a large LOCA is a significant contributor to the core damage at Zion. The dominant cause for unavailability of the Low Pressure Injection System (LPIS) is a human error to reopen the two serial motor-operated valves in suction of the LPIS pumps after testing, combined with failures to discover the wrong posi-tion of the valves.

4-8 Improvement of availability of the low pressure injection would also enhance the RCS depressurization by secondary blowdown (see the next prelimi-

. nary guideline), since this depressurization operation requires the LPIS.

The proposed criteria for this preliminary guideline are presented in Table 4.7.

4.3.6 RCS Depressurization by Secondary Blowdown (Preliminary Guideline 8)

One potentially effective means of making up core inventory in case the high pressure systems are unavailable, either in the injection or recircula-tion phase, is to depressurize the reactor coolant system (RCS) using steam generators to the point where LPIS can be actuated for the makeup operation.

This emergency procedure would have significant impact on reducing the core damage frequencies for the small and medium LOCA sequences. The impact could be significant because this procedure makes the dominant contributor, operator failures in the high pressure recirculation switchover, no longer predomi-nant. To attain success in this procedure, the operator must op6a the htm >

spheric steam dump valves, maintain AFW or main feedwater to the steam gener-ators and have one of the low pressure makeup trains available. Note that this depressurization operation will be enhanced by the Preliminary Guideline 6 above, since the operation requires the LPIS be operable. The proposed cri-teria germane to this preliminary guideline are presented in Table 4.8 4.3.7 Anticipated Transients Without Scran (ATWS) (Preliminary Guideline 9)

The guideline for ATWS sequences relates to compliance with the NRC rule l on " reduction of risk from ATWS events for light-water-cooled nuclear power pl ants ." 7 Also, in the NRC rule on ATWS, "the Comniission has concluded tnat a reduction in the frequency of challenges to plant safety systems should be a prime goal of each licensee, and the Commissian believes that ATWS risk reo,'c-l tion can also be achieved by reducing the much larger fr equency of transients "

which call for the reactor protection system to operate."7 As indicated in Table A.4, ATWS is not a significant contributor to core datnage frequency for Zion and this is also generally supported by PRAs for other Westinghouse PWRs. One factor in these results is the credit given to the manual scram and l

4-9 the emergency boration using the charging system to deliver borated water from the boron injection tank to the reactor pressure vessel. Failures of the manual scram and the emergency boration are dominated by operator action fail-ures. These operator actions are not clearly addressed in the ATWS rule.

The proposed criteria developed for this preliminary guideline are pre-sented in Table 4.9 including that relating to operator procedures to compen-sate for actions not clearly addressed in the ATWS role.

4.3.8 Support System Interdependencies (Preliminary Guideline 10)

One of the primary benefits of performing a rigorous PRA is that the sys-tem interdependencies are modeled and are reflected in the results. However, not all PRA studies have performed in-depth interdependence analyses and therefore have not ferreted out all of the possible subtle interdependencies.

ThtC may have profound effects upon thair results. A dependency is defined as the failure of one system leading directly or indirectly to the failure of another system.

An in-depth application of basic PRA methodology with respect to interde-pendencies yielded significant fin. dings on a previously heavily studied PWR.

To illustrate this point further, reference is made to the BNL study of system Thteractions (support system interdependencies) at Indian Point Unic 3.8 The major finding af that study was that a specific single station Omergency bat-tery could fail a6d among other things, negate the entire low pressure injec-tion function. The point to be emphasized here is that none of the numerous other studies and reviews of the Indian Point 3 design were able to detect this important single failure nor did the BNL study until all the support sys-tems were explicitly modeled, linked together (the fault tree linking approach9 ) and solved using the SETS computer code.10 4

It is not sufficient to make a single overall dependence table of the

front-line and support systems for a given plant and simply compare that to the reference plant. No two plants will have the same set of system interde-pendencies. It is known that in U.S. nuclear plants support systems vary widely from plant to plant even though the plants may be of a similar class I

4-10 and have the same set of front-line systems. It is recognized that following the interdependency evaluation proposed criteria steps outlined in the pre-liminary guidelines *in Table 4.10, in a rigorous fashion, is a major under-taking. This fact, however, does not diminish its importance.

Based upon the dominance of the loss of component cooling water (CCW) sequence and the station blackout sequence for Zion as well as other PWR de-signs, it is recommended that detailed interdependency tables be constructed for loss of CCW and station blackout sequences, with all dependencies condi-tioned upon the loss of CCW and upon the existence of station blackout for various lengths of time, respectively.

4.4 References for Section 4

1. Barrett, R., " Status of the Severe Accident Program for Operating Reactors, NRR Staff Presentation to the ACRS Subcommittee Class 9 Acci-dents, February 24, 1986.

2. SECY-86-76, " Implementation Plan for the Severe Accident Policy Statement and the Regulatory Use of New Source-Term Information," NRC/EDO, February 28, 1986.

3. Silvestri, E. et al . , "A Model for the Probability of Core Uncovery in LOOSP Induced Accidents, as Applied in the Probabilistic Safety Study for ENEL PWR Standard Power Plant," Paper No.109, Proceedings of the Inter-national ANS/ ENS Topical Meeting on Probabilistic Safety Methods and Applications, Volume 2, February 1985, San Francisco, CA.

4 Edison, G. , "Sizewell-B: Analysis of British Application of U.S. PWR Technology," NUREG-0999, May 1983.

5. Schnurer, H. L. and Seipel, H. G., "The Safety Concept of Nuclear Power Plants in the Federal Republic of Germany," Nuclear Safety, 24, 743 (1983).

4-11

6. NRC Station Bl ackout Proposed Rul e , Federal Register Volume 51 No.

55/11 arch 21,1986, pgs. 9829-9835.

7. ATWS Final Rule - Code of Federal Regulations,10 Section 50.62, "Re-quirements for Reduction of Risk from Anticipated Transients Without Scram Events for Light-Water Cooled Nuclear Power Plants," June 1984

8. Youngblood, R. et al., " Fault Tree Application to the Study of Systems Interactions at Indian Point 3," Brookhaven National Laboratory, NUREG/

CR-4207, January 1986. .

9. American Nuclear Society and Institute of Electrical an'd Electronics En-gineers, "A PRA Procedures Guides," NUREG/CR-2300, January 1983.

10. Worrell, R. B. and Stack, D. W., "A SETS User's Manual for the Fault Tree Analyst," Sandia National Laboratories, NUREG/CR-0465, SAND 77-2051, Novenber 1978.

~

4-12 Table 4.0 Preliminary Guidelines for the Prevention and Mitigation of Severe Accidents in a PWR With a large Dry Containment 1

I Preliminary Guideline Description For Mitigation of Fission Product Releases:

1 Maintenance of Containment Integrity 1.A. Provide Containment Spray and Long Term Heat Removal 1.B. Provide Filtered Venting 1.C. Assessment of Early Containment Failure ,

For Control of High Consequence Sequences:

2 Interfacing Systems LOCA (Including Steam Generator Tube Rupture) 2.A. Prevent Overpressurization of Low Pressure Systems 2.B. Prevent Steam Generator Tube Rupture and Minimize Its Consequences Q Reduction of High Core Damage Frequency:

3 Component Cooling Water (CCW) 3.A. Provide Adequate Cooling to Engineered Safety Features Systems 4 High Pressure Injection Systems (Including Recirculation Switchover and Containment Heat Removal) 4.A. Provide Adequate Core Recirculation Cooling 4.B. Provide Adequate Containment Heat Removal 5 Station Blackout (SB) 5.A. Comply with the Proposed SB Rule and Provide Operator Response During SB 6 Auxiliary Feedwater System (AFWS) and RCS Feed & Bleed Cooling 6.A. AFWS Operation and Operator Actions for RCS Feed &

Bleed Cooling 7 Low Pressure Injection 7.A. Improve Availability of Low Pressure Injection 8 Reactor Coolant System (RCS) Depressurization by Secondary Blowdown 8.A. Implement Procedure to Depressurize RCS for Actuation of Low Pressure Injection or Recirculation Systems 9 Anticipated Transients Without Scram (ATWS) 9.A. Comply With ATWS Rule and Provide Operator Response During ATWS 10 Support System Interdependencies 10.A. Examine Support System Interdependencies

4-13

. Table 4.1 Proposed Criteria for PWR-Large Dry Containment-Preliminary Guideline 1: Containment Integrity Concern: Breach of the containment boundary in the progression of a severe accident can lead to significant releases of radioactivity.

Functions: Containment Spray and Heat Removal (Guideline 1.A)

Filtered Venting (Guideline 1.B)

Assessment of early containment failure (Guideline 1.C)

Guideline 1.A. Provide Containment Spray and Long Term Heat Removal Basis: Implementation of the following criteria related to containment heat removal will aid in fission product decontamination and help prevent containment failure due to long term pressurization.

Criteria:

1.A.1. Containment spray should commence when containment pressure reaches the automatic initiation setpoint.

1.A.2. Operator training and procedures should specify the flow paths and specific components to be aligned and their required positions for initiating containment spray. If containment spray does not initiate automatically on the pressure setpoint, operator training and proce-dures should specify the actions to be taken to manually initiate the spray expeditiously as soon as the pressure setpoint is reached.

1.A.3. The heat removal rate provided by the containment spray related compo-nents should be capable of removing decay haat.

1.A.4. The spray water supply should be available for an appropriate time of operation at the predicted environmental and fluid loads associated with severe accident sequences.

1.A.5. Equipment designated for containment spray should be capable of per-forming their function under the predicted environmental and fluid loads associated with severe accident sequences including during a station blackout sequence (see Table 4.5).

1.A.6. For plants that have AC independent sources of containment spray (e.g., diesel driven fire pumps) operator training and procedures should specify the flow paths and components to be aligned and their required position for initiating containment spray.

1.A.7. At least one long term containment heat removal system (fan coolers, recirculation heat exchangers, etc.) should be capable of performing its function.

t

4-14 Table 4.1.(Cont'd) Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 1: Containment Integrity Guideline 1.B. Provide Filtered Venting Basis: For those plants where ac independent containment sprays and long term containment heat removal are not available a filtered vent path may be necessary to ensure fission product mitigation for late ccatainment failure events.

Caution: Containment venting should not be indiscriminantly performed. A clear understanding of the accident sequence in progress should have been assessed prior to initiating venting. The effects of venting should have been assessed and made known to the operators during the training program. The assessment should include the effects of containment venting on the operation of ECC injection systems and health consequences.

Criteria:

The following should be assessed to ensure filtered venting capability:

1.B.1. For accident sequences where filtered venting has been assessed to be beneficial, filtered venting snould commence, except for a station blackout, when containment pressure reaches the predetermined contain-ment venting pressure set point. In selecting the containment venting pressure set point, the following functions should be assured:

a. the ultimate containment pressure capability would not be exceed-ed,

b. the backpressure acting on the safety relief valve assemblies would not prevent them from performing their function, and 1.B.2. If manual initiation of filtered venting is required, the time re-quired to perform this function should be taken into account in the training and procedures to preclude the potential for exposing person-nel to the harsh environment. Otherwise, the containment venting valve should be powered from a source independent from the plant emer-gency power sources.

i 1.B.3. Operator training and emergency procedures should specify the plant I

parameters that will prompt the operators to make preparation, rem-mence and terminate the venting sequence. The training and procedures should also be consistent with the required actions and timing of those actions so venting will commence immediately when required (see Criteria 1.A.1 and 1.A.2). The training and procedures should further specify the flow path (s) available for venting, specific components to be aligned, and the required positions / states for these components.

The training and procedures should specify how to proceed if termina-tion of venting is not possible especially as they relate to emergency management.

. e 4-15 Table 4.1 (Cont'd) Proposed Criteria for'PWR Large Dry Containment Preliminary Guideline 1: Containment Integrity 1.B.4. Venting capacity should be greater than the predicted rate of increase of the containment pressure during sequences where venting is antici-pated and meet the requirements of Criterion 1.A.1.

1.B.S. The filtering media should be capable of reducing the released frac-tion of the radicactivity to 1/10 of the non-noble gas component, 1.B.6. Equipment designated or used to support venting should be capable of performing that function in a reliable manner for a sufficient period to include vaporization release phase of core concrete interaction under the predicted environmental and fluid loads associated with the venting commencement pressure (see Criterion 1.A.1).

1.B.7. Support systems for the venting valves (electrical power for a motor-operated valve, air and/or spring / piston for an air-operated valve) should be of sufficient capacity that at minimum power or pressure provided, the delivered force from the actuator is greater than the resulting fluid loads for all angles of opening.

1.B.8. The filters should be capable of accepting the aerosol loading from core / concrete reactions while remaining functional.

Guideline 1.C. Assessment of Early Containment Failure Basis: The SARRP uncertainty analyses for Zion and Surry indicate that the likelihood of early containment failure for core melt acci-dents is about 5% (mean value). These early failures are due to the combined ef fects of direct heating and hydrogen detonation /

deflagration and even at this low likelihood the predicted re-leases are a dominant part of the risk for both plants.

Note: These criteria are very preliminary pending the outcome of further research on direct heating and pending the establishment of quantitative cri-teria to assess the importance of direct heating and hydrogen conbustion.

Criteria:

1.C.1. Assess the applicability of the containment perfonnance for Zion to the individual plants. Specific structual analysis for similar con-tainment design (e.g., for steel shell large dry containments) may be necessary.

1.C.2. Determine the likelihood of early containment failure due to direct heating for the dominant core damage sequences.

Guidance: If the likelihood of early containment failure is substantially larger than at Zion then additional mitigation is needed (e.g., containment sprays will aid in fission product decontamination and flooding for some reactor cavity geometries may reduce direct neating.

s .

4-16 Table 4.1 (Cont'd). Proposed Criter,ia for PWR Large Dry Containment Preliminary Guideline 1: Containment Integrity

' 1.C.3. Determine the likelihood of hydrogen detonation / deflagration .for the dominant core damage sequences and the contribution to containment

overpressure (Generic Issue 124).

i 4

5

)

e I

4 F

e u

4 1

1 1

~ . _ 4- _ _ , , _ . - . - - - . . _. - _ _ _ . _ . , _ _ _ . _ _ . _ _ _ . _ _ - . . - . . ~ . _ _ _ . . _ _ _ , . . - _ . . , _ _ . . . _ _ , - , _ _ _ . , _ . . . _

. o 4-17 Table 4.2 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 2: Interfacing Systems LOCA (Including Stean Generator Tube Rupture)

Concern: The interfacing systems LOCA sequences represent potentially high release sequences and were found to contribute significantly to risk, even though their contribution to core damage frequency (CDF) is not significant. The contribution to CDF by the steam generator tube rupture (SGTR) sequences is also relatively small; however, the associated risk can be potentially significant because the leakage of primary reactor coolant to the secondary side of the steam generator (SG) will cause release of radioactivity to the outside of containment via the steamlines, the turbines, the con-denser and the SG atmospheric relief and safety valves.

Function: Maintain Primary System Integrity (Guidelines 2.A and 2.B)

Guideline 2. A. Prevent Overpressurization of Low Pressure Systems Basis: Implementation of the following criteria will ensure the frequency of an interfacing systems LOCA will remain acceptably low.

Note: Resolution of the Generic Issue (GI-105), which deals with interfacing systems LOCAs for both BWRs and PWRs, may impact this guideline. Therefore, the criteria below should provide guidance to evaluate and factor in the pro-posed reconmendations from the Generic Issue resolution.

Criteria:

2.A.1. The structural integrity of all low pressure systens should be pro-tected from overpressurization due to inadvertent exposure to the in-terfacing high pressure systems. The equipment designated to prevent overpressurization should account for the potential of leakage and be

. designated to perform their functions in a reliable manner.

2.A.2. Maintenance and surveillance procedures and training should be consis-tent with manufacturer's recommendations and specify actions to be taken to ' ensure that the designated isolation valves and relief valves are capable of performing as required.

2.A.3. The equipment designated to provide isolation and prevent overpressur-ization, such as the RHR line isolation valves or the low pressure in-jection system check valves, should periodically undergo operability testing and local leak rate testing (LLRT).

2.A.4 The relief walves designated to mitigate overpressurization should be demonstrated to be capable of relieving primary system pressure at the corresponding maximum expected flow rates for each line.

2.A.5. All low pressure lines that potentially could be overpressurized should be identified and should be provided with alarms to alert the operator of an overpressure event.

6 .

4-18 Table 4.2 (Cont'd) Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 2: Interfacing Systems LOCA (Including Steam Generator Tube Rupture) 2.A.6. Operator training and procedures should specify the actions to be taken to isolate the low pressure systems identified in 1.A.5 above thereby mitigating the consequences of the interfacing systems LOCA.

Guideline 2.B. Prevent Steam Generator Tube Rupture (SGTR) and l

Minimize its Consequences e

Basis: Implementation of the following criteria will reduce the potential for occurrence of SGTR and ninimize the associated consequences should it occur.

2.B.1. The structural integrity of steam generator (SG) tubes should be main-tained by protecting them against all plausible causes leaoing to weakening, cracking or bursting of the tubes. More specifically, the chemical compositions and properties of the secondary side water should be routinely monitored to ensure that adequate water chemistry is maintained so as to minimize chemical corrosion of the tubes. (

Also, surveillance and inspection techniques should be instituted so that the secondary side of the SG can be cleared of all foreign ob-jects which might physically impact and damage the tubes.

2.B.2. Operator training and procedures should specify the means by which the occurrence of SGTR can be correctly diagnosed, the faulty SG identi-fied and isolated in a timely manner, and the necessary recovery actions taken. These actions include reactor coolant system (RCS) cooldown to below the saturation temperature corresponding to the faulty SG pressure by dumping steam only from the intact SGs to estab-lish sufficient subcooling margin, subsequent RCS depressurization to the faulty SG pressure with establishment of sufficient RCS inventory

.and safety injection (SI) termination to avoid repressurization and further primary-to-secondary leakage.

2.B.3. If offsite power is unavailable during the recovery actions, the RCS cooling described under 1.B.2 above should be achieved by using the atmospheric relief valves on the intact SGs, since neither the turbine bypass valves nor the main condenser would be available. Also, RCS pressure should be controlled by using pressurizer PORVs or auxiliary spray since nomal pressurizer spray will be unavailable due to loss of the reactor coolant pumps (RCPs).

2.B.4 In case of failure of the Auxiliary Feedwater System (AFWS), operator training and. procedures should specify initiation of RCS bleed & feed cooling by verifying SI flow and opening pressurizer PORVs. Once bleed and feed cooling is commenced, operator training and procedures should specify that containment heat is removed properly.

• 4 4-19 Table 4.3 Proposed Criteria for PWR Large Dry Containment.

Preliminary Guideline 3: Component Cooling Water Concern: An event initiated by loss of component cooling water (CCW) or essential service water (ESW) may lead to Reactor Coolant Pump (RCP) seal LOCA sequences due to loss of RCP seal cooling and seal injection, under the condition that high pressure injection also fails. This is an important contributor to core damage frequency at Zion, as is also the case at other PWRs. This is currently designated as a generic issue by NRC (GI-23).

Function: Adequate Cooling of Engineered Safety Features Systems (Guideline 3.A)

Guideline 3.A. Provide Adequate Cooling to Engineered Safety Fr.atures Systems Basis: Implementation of the following criteria on CCW will significantly reduce the core damage frequency and risk due to RCP seal LOCA se-quences. Loss of CCW initiated by loss of electric power is addressed by Preliminary Guideline 4: Station Blackout. If, de-pending on the design configuration of a particular plant, loss of ESW is likely to_ result in an RCP seal LOCA, then the criteria should be applied to the ESW system.

Criteria:

3.A.1. The standby CCW (or ESW) heat exchanger and associated pumps should be capable of operating upon failure of the operating train (s).

3.A.2. Operator training and procedures should specify actions to be taken to shed nonessential loads requiring CCW (or ESW) to increase the length of time that the plant can cope with partial loss of CCW (or ESW).

3.A.3. Technical specifications for the CCW (or ESW) system should ensure that the unavailability or loss of the system including pipe rupture is minimal.

3.A.4 No single hardware or maintenance-related unavailability should render redundant trains of the CCW (or ESW) system unavailable.

3.A.S. The CCW (or ESW) system and eastpment designated for operation during a severe accident should be capable of perfonning their functions under the predicted environmental and fluid loads associated with the accident.

3.A.6. Dedicated iiijection systems to cool the RCP seals or improved seal designs which prevent leakage should be considered for those plants where RCP seal LOCAs comprise a dominant part of the core damage fre-quency.

L

• 4-20 Table 4.4 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 4: High Pressure Injection

! Systems (Including Recirculation Switchover and l

Containment Heat Removal)

Concern: Inadequate decay heat removal due to failure in the recirculation switchover operation has been shown to be the leading contributor to severe accident sequences, in particular, sequences initiated by small LOCAs. Failure in the recirculation switchover of the high pressure systems leads to core damage' due to insufficient coolant makeup and thus inadequate decay heat removal from the core. Failure in the recirculation switchover of the containment spray system and failure to establish containment spray path fron RHR lead to inadequate containment heat removal. Containment _

failure due to inadequate containment heat removal could create NPSH problems for the pumps taking suction from the containment sump, which could in turn lead to core recirculation failure and subsequent core damage.

Functions: Adequate Core Recirculation Cooling (Guideline 4.A) )

Adequate Containment Heat Removal (Guideline 4.8)

\

Guideline 4.A. Provide Adequate Core Recirculation Cooling Basis: Implementation of the following criteria will significantly reduce the core damage frequency and risk due to core damage during re-circulation cooling phase.

Criteria:

4.A.1. Operator training and procedures should specify the actions to be per-formed to realign flow paths, including recovery actions that must be performed during recirculation switchover and RHR heat exchanger in-jection cooling. These actions should be specified in an integrated fashion, so that no single operator has a designated role whose incor-rect action woul' cause loss of the switchover or cooling functions.

4.A.2. No single hardware or maintenance-related unavailability should render redundant pumps or valves involved in the recirculation switchover unavailable.

Guideline 4.B. Provide Adequate Containment Heat Removal (CHR)

Basis: Implementation of the following criteria will significantly reduce the core damage frequency and risk.

Criteria:

4.B.1. Equipment provided as a source of injection to reduce containment heat input due to a severe accident should be capable of removing decay heat.

4.B.2. The RHR heat exchanger injection cooling system should be capable of removing decay heat.

4-21 Table 4.4 (Cont'd) Proposed Criteria for'PWR Large Dry Containment Preliminary Guideline 4: High Pressure Injection Systems (Including Recirculation Switchover and Containment Heat Removal) 4.B.3. The source of injection and injection cooling should be available for an appropriate time of operation at the predicted environmental and fluid loads associated with the severe accident sequences.

4.B.4. Operator training and procedures should specify all actions (including alternatives) required to initiate and maintain CHR under severe acci-dent conditions when recirculating from the containment sump.

4.B.S. When manual operation of equipment is required to initiate CHR, the operator training and procedures should specify the actions for per-forming these functions and provide an understanding of and experience with the time required to perform them.

4.B.6. Equipment designated for CHR should be available to reliably perform its function under the predicted environmental and fluid loads associ-ated with the severe accident sequences.

4-22

- Table 4.5 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 5: Station Blackout (SB)

Concern: Station blackout sequences have been shown to be one of the leading cla ses of severe accident sequences in terms of both core damage freq;ency and risk.

Function: Reliable Electric Power Supply (Guideline 5. A)

Guideline S.A. Comoly with Proposed SB Rule and Provide Operator Response During SB Basis: Significant study and research Save preceded current work on severe accidents, in particular, reference is made to the rulemaking activity already under way on station blackout. Nevertheless, the following. reflects specific measures that complement the proposed station blackout ' rule, particularly in the area of the operator's role and function.

Criteria:

5.A.1. Compliance with the NRC proposed rule on station blackout should be demonstrated including a reliability program which should ensure reli-able operation of the onsite emergency ac power source. The reliabil-ity program should be designed to monitor and maintain the reliability of each power source over time at a specified acceptable level and to improve the reliability if that level is not achieved.

5.A.2. Operator training and procedures should specify the actions that should be performed to provide core cooling and decay heat removal and should specify the systems and components to be aligned and their re-quired positions.

5.A.3. Operator training and procedures should specify the actions required -

to restore offsite and onsite emergency ac power prior to depletion of the dc power supply during station blackout.

5.A.4. Operator training and procedures should specify the actions that should be performed to shed nonessential loads requiring de power to increase the length of time that the plant can cope with a station blackout.

5.A.5. Operator training and procedures should speci fy the actions that should be taken upon the loss of de power before ac power has been re-stored.

5.A.6. Operator training and procedures should specify the actions required to initiate operation and/or assure that containment spray is operable under station blackout conditions.

5.A.7. A turbine-driven auxiliary feedwater train or its equivalent should be capable of performing its function in a reliable manner under the predicted environmental and fluid loads associated with all severe accident conditions including those associated with station blackout.

3

. 4 4-23 Table 4.6 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 6: Auxiliary Feedwater System (AFWS) and RCS Feed & Bleed Cooling Concern: The AFWS or as called in some plants (mostly B&W) the Emergency Feedwater System (EFS) plays a prominent role in removing energy 4

stored in the core and primary coolant following small LOCAs and transient events including nomal plant shutdown. Failure to actuate the AFW/EFS system subsequent to loss of main feedwater (MFW) system will essentially deprive the stean generators (SGs) of their capabilities to remove the decay heat. For many PWRs feed & bleed cooling can be employed to remove the decay heat in case the RCS heat removal via the SGs fails completely. If the feed & bleed cooling also fails, core uncovery would ensue.

Functions: Maintain Post Accident Decay Heat Removal Capability of SGs and Provide Remedial Means of Core Heat Removal in Case of SG Heat Removal Failures (Guideline 6. A)

Guideline 6. A. AFWS/EFS Operation and Operator Actions for RCS Feed & Bleed Cooling Basis: Fulfilling the following criteria will improve the chances for successful AFWS/EFS operation and SG ability for RCS heat removal subsequent to loss of the MFW system, and significantly reduce the potential for core uncovery by RCS feed & bleed cooling in case the steam generators fail to function properly. The AFWS/EFS re-liability is being addressed in Generic Issue 124 and the follow-ing criteria should be considered preliminary pending resolution of this generic issue. Overall decay heat removal capability is being addressed by Generic Issue 45.

Criteria:

6. A.1. ' Equipment designated for AFWS/EFS operation should be capable of per-forming their functions under the predicted environmental and fluid loads of a severe accident including station blackout conditions.

6.A.2. The equipment for actuating the AFWS/EFS should be designed to func-tion independently of the reactor protection system, in compliance with the ATWS Final Rule dated June 26, 1984.

l l 6.A.3. Operator training and procedures should specify the actions that should be perfomed to ensure that the AFWS/EF3 functions in a relia-ble manner. This includes appropriate manual actions if there is no automatic initiation as intended by design.

6.A.4 No single hardware or maintenance-related unavailability should render redundant pump trains of the AFWS/EFS unavailable.

i .

4-24 Table 4.6 (Cont'd) ~ Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 6: Auxiliary Feedwater System (AFWS) and RCS Feed & Bleed Cooling 6.A.5. Operator training and emergency operating procedures should specify the actions required for RCS feed & bleed cooling. In particular, the diagnostic means of determining the need for feed & bleed cooling and the detailed procedures to be followed as well as the number of PORVs to be manually opened should be clearly stipulated. Appropriate means of containment heat removal should also be available (Guideline 3.B).

m, = . i . . - - ,

. 4 4-25 Table 4.7 Proposed Criteria for PWR Large Dry Containment -

Preliminary Guideline 7: Low Pressure Injection Concern: Failure of low pressure injection in a large LOCA is found to be a significant contributor to core damage frequency for Zion. The unavailability of low pressure injection which defeats the RCS de-pressurization by the secondary blowdown option for the case where the high pressure systems fail in small and medium LOCA sequences is part of the concern.

Functions: Improve Availability of Low Pressure Injection for Core Inventory Makeup (Guideline 7.A.)

Depressurize the Reactor Coolant System (RCS) by Blowing Down the Secondary-side of the Steam Genrators (Guideline 8.A.)

Guideline 7. A. Improve Availability of Low Pressure Injection Basis: Impl ementation of the following criteria will enhance the core inventory makeup capability of the low pressure emergency coolant injection function when called upon.

Criteria:

7.A.1. Operator training and procedures should specify the actions to be per-formed to establish flow paths in the suction of the low pressure injection system (LPIS) pumps.

7.A.2. Surveillance procedures for the LPIS should ensure that potentially wrong positioned of the valves in the suction of LPIS pumps will be identified and restored to normal as part of restoration after test-ing.

d e

i

_ . . - . - . _ - - . - . , - _ . . . - . , - - _--.__--._,-----y - - - - , , - -

4-26 Table 4.8 Proposed Criteria for PWR Large Dry Containnent Preliminary Guideline 8: RCS Depressurization by Secondary Blowdown

' Concern: Small or medium LOCAs and transients followed by failure of the high pressure recirculation system (HPRS) or the high pressure in-jection system (HPIS) .were determined to be important contributors to core damage frequency for Zion. Some of these transients were also found to contribute quite significantly to risk.

Function: Depressurize the reactor coolant system (RCS) by blowing down the secondary-side of steam generators (SG) so that the low pressure recirculation system (LPRS) or the low pressure injection system  ;

(LPIS) can be actuated to provide core inventory makeup (Guideline  ;

7.A) l Guideline 8.A. Implement Procedure to Depressurize RCS for Actuation of Low Pressure Injection or Recirculation Systems l

Basis: Implementation of the following criteria will enhance the core in-ventory makeup capabilities of low pressure emergency coolant re-circulation and injection function in the event that the high pressure systems are unavailable.

Criteria:

8.A.1. Operator training and procedures should specify the actions to be per-formed to realign flow paths and initiate, control RCS depressuriza-i tion by secondary blowdown and provide emergency core makeup via the LPIS if the high pressure systems are unavailable. The procedures, such as opening the SG atmospheric relief valves and maintaining Aux-iliary Feedwater/ Emergency Feedwater or Main Feedwater to the SGs, should follow the instructions given in the proper Emergency Response

.Suidel i nes.

8.A.2. Equipment and systems designated to depressurize the RCS by secondary blowdown should be capable of performing their functions under pre-dicted environmental and fluid loads of a severe accident which re-quires RCS depressurization in a reliable manner.

.; e, 4-27 Table 4.9 Proposed Criteria for PWR ~Large Dry' Containment

' Preliminary Guideline 9: Anticipated Transients Without Scram (ATWS)

Concern: Although PRAs for some PWRs generally indicate that ATWS sequences are not significant contributors to core damage frequency, they have been studied extensively in the past because they may lead to plant conditions that may render several engineered safety fea-tures' ineffective and thus may contribute significantly to risk.

Function: Reliability of the Reactor Protection System and Operator Response During ATWS (Guideline 9.A.)

Guideline 9.A. Comply With ATWS Rule and Provide Operator Response During ATWS Basis: Significant study and research have preceded the current work on severe accidents, in particular, reference is made to - the rule-making activity already accomplished on the ATWS subject. In ad-dition, the following reflects specific measures that complement and supplement the ATWS rule, particularly in the area of the operator's role and function.

In the case when the automatic scram system fails during plant transients, the operator is required to attempt to manually scram the reactor and inject borated water to the reactor pressure vessel by using the charging system and reposition the valves which are necessary to properly align the charging system to the boron supply.

Criteria:

9.A.1. Compliance with the ATWS Final Rule dated June 26, 1984 is required.

This includes a requirement that the equipment required to meet the ATWS rule does not increase the potential for transients (e.g., inad-vertent scram) which challenge other safety systems.

9.A.2. Operator training and procedures should specify the actions- required in the manual scram and emergency boration. They should also specify the responsibilities of operating staff crew members and clarify how information will be exchanged among them. In particular, instrumenta-tion readings may have to be relayed between the crew members (s) oper-ating the control boards and the senior reactor operator coordinating the crew's response to accident.

9.A.3. The systent and equipment designated for operation during an ATWS should be capable of performing their functions in a reliable manner under predicted environmental and fluid loads associated with ATWS sequences.

4-28 Table 4.10 Proposed Criteria for PWR Large Dry Containment Preliminary Guideline 10: Support System Interdependencies Concern: When conducting a Probabilistic Risk Assessment (PRA), Individual Plant Evaluation (IPE) or similar analysis, it is imperative that the support system interdependencies be fully developed, under-stood and reflected in the final results. Otherwise there is no assurance that the dominant core damage / risk sequences have been identified.

Function: Support System Interdependencies (Guideline 10.A)

Guideline 10.A. Examine Support System Interdependencies Basis: Implementation of the following criteria will ensure that the full set of support system interdependencies have been identified and have been reflected in the results.

Note: The following criteria are easily outlined but are not easily imple-mented. The complex nature of a nuclear power plant makes it imperative that this area of analysis be fully examined. However, since no two plants' have identical support systems, this analysis should be done on a plant specific basis.

Criteria:

10.A.1 All systems that provide any direct support to either a frontline or support system should be identified along with its supported system.

10.A.2. Each dependency should be conditioned as appropriate as to what sequences or under what (if not all) circumstances it applies. In view of its importance, a separate station blackout dependency table should be provided which,gives the available systems, their antici- -

pated survival period and the ultimate cause (e.g., no room cooling) of their failure.

10.A.3. As in Criterion 10. A.2, a dependency table should be provided which shows the effects of loss of componert cooling water (or service water) on other systems.

10.A.4. The dependencies should then be linked t..gether (preferably by com-puter) within the analysis in order that the extent to which their influence reaches through the systems to a consequence will be dis-covered. This will help identify secondary dependencies to ensure that no one failure in a support system has a critical outcome on other support or front line systems.

A-1 Appendix A SEVERE ACCIDENT RISK INSIGHTS This section reviews the IDCOR and SARP analyses for the Zion plant which is a PWR with a large dry containment. Differences between these studies are identified and insights are provided which helped in the development of the plant type-specific preliminary guidelines and criteria for the prevention and mitigation of severe accidents which are discussed in Section 4 of this report. In addition to the review of the IDCOR and SARP analyses for Zion, design features of other plants (Surry, Oconee) with a similar containment are

'also briefly surveyed to identify similarities and differences among the pl ants. The insights gained from this overview of the design features also contributed to the development of the preliminary guidelines and criteria pro-posed in Section 4.

The Zion Station Units 1 and 2, located in Lake County, Illinois, are Westinghouse PWRs of thermal output of 3250 MW per unit. -Table A.1 summarizes the design of the safety-related systems at Zion in comparison with those at Surry and Oconee. Figure A.1 shows a heat and fluid flow diagram for the Zion's various cooling systems.

Section A.1 describes our review of the various estimates of the core damage profile. Core meltdown phenomena and containment response are ad-dressed in Section A.2. Differences between IDCOR and SARP estimates of fis-sion product release and offsite consequences are discussed in Sections A.3 and A.4 Finally, Section A.5 indicates the insights gained from our review of these studies.

A.1 Core Damage Profile The main objective of this section is to present within the scope of this I

study, the Zion core damage profiles emerging from the IDCOR and ASEP/SARP 2 analyses.

.1 e

A-2 The primary information reviewed in this section is from Refs. I and 2.

The information in Refs. 3 through 5 was also used in the review. It is noted that the information received from the SARP analysis for Zion (Ref. 2) is in draft form and that the scope of the analysis is a limited rebaselining of the Zion Review (Ref. 3). The rebaselining effort on Zion is limited to the models and accident sequences addressed in the Zion Review. Thus, the results in the SARP analysis would represent an update of the existing dominant se-quences in the Zion Review, and no attempt was made to identify any new domi-nant sequences which may result from plant changes or improved PRA methods.

A.1.1 IDCOR Baseline Estimate of Zion Core Damage Frequency This section _ presents a brief summary of the major differences between the dominant core damage sequences designated by the Zion IDCOR baseline risk profile (or the Zion pre-IDCOR risk profile) and those identified in the course of reviewing and evaluating the Zion Probabilistic Safety Study (ZPSS) by Sandia National Laboratories (NUREG/CR-3300, hereafter referred to as the 1

Zion Review). The risk profile being considered here consists of two distinc-tive parts, one displaying the plant core damage frequency and the other the societal risk and population dose. Both the Zion IDCOR baseline risk profile and the Zion pre-IDCOR risk profile derive their origins from the ZPSS. They differ chiefly in the part pertaining to plant risk and release consequences.

As far as the dominant core damage sequences and their frequencies are con-cerned, no distinction can be nade between these two Zion IDCOR risk pro-files. This is mainly due to the fact that when the Zion IDCOR baseline risk profile was developed by partially updating the ZPSS, the revision was carried out primarily to reflect new information on accident processes and containment responses. No alterations were made to initiating event frequencies, success criteria, system unavailabilities, or plant configuration. The dominant core damage sequences and their frequencies appearing in both the Zion pre-IDCOR 4

risk profile and th'e Zion IDCOR baseline risk profile are, therefore, con-pletely identical. Incorporation of the new information in accident process analysis and containment response, however, results in a significant decrease of societal latent cancer fatality risk (by a factor of about 60 as compared to the Zion pre-IDCOR risk profile) and no early fatalities for the Zion IDCOR baseline risk profile.

1 A-3 For reference, . the Zion IDCOR baseline dominant accident sequ'ences and the associated core damage frequencies are listed in Table A.2. This list is intrinsically similar to that presented in the ZPSS (ZPSS Table 8.10-1),

except that the two ATWS sequences, originally numbered 5 (loss of main feed-water ATWS) and numbered 6 (turbine trip ATWS), are replaced by two new sequences, denoted 5-TEFC and 6-TEC, respectively, both of which are initiated by fires. This was done, in part, to conform to the changes made in Revision 1 to the ZPSS and also to reflect the potential for the two new sequences to contribute significantly to core damage f requency. Besides these difference, two new sequences,17-AE and 18-SLF, are added to the Zion 10COR baseline list. Also, a slight discrepancy in the result of core damage frequency quan-tification can be found for some of the accident sequences, as footnoted in Table A.2.

It can be observed that, for the Zion IDCOR baseline risk profile, the most dominant core damage sequence is the small LOCA accident with recircula-tion failure,1-SLFC (approximately 39% of the overall core damage frequen-cy). This is followed by the seismic sequence, 2-SE (about 13%), and large and intermediate LOCAs with recirculation failures, sequence 3-ALFC and 4-ALFC, each contributing about 12%.

A.1.2 Zion Review Estimate of Zion Core Damage Frequency In contrast with the Zion IDCOR baseline risk profile discussed above, the dominant accident sequences generated in the Zion Review deviate substan-tially from those presented in the ZPSS (ZPSS Table 8.10-1). The chief objec-tive of the Zion Review was to scrutinize significant omissions and crucial judgements which might have been made in the ZPSS, and to assess their impact on the quantitative results of the Zion Probabilistic Safety Study. This was achieved basically by reviewing thoroughly the initiating events, the event trees depicting the' plant system response to the initiating events, the system fault trees, the human reliability analysis, and other PRA methodology em-ployed in the ZPSS. A total of 14 dominant accident sequences were identified in the Zion Review; they are tabulated in Table A.3 for quick reference. As

compared with the list of dominant accident sequences presented in the ZPSS (ZPSS Table 8.10-1) or that displayed in Table A.2 (for the Zion IDCOR 5

.- . -__....--___. - . _ _ ~ , , _ , , , -_._-._.,__.---. ,____ ,_ _

,.c . - . . - , . - , _ -

A-4 baseline), the most remarkable difference is the identification of several

' dominant accident sequences involving failure of the component cooling water (CCW) system. (Although the Zion IDCOR baseline study (Ref.1) was aware of this result of the Zion Review, it did not reevaluate the result in order to limit the scope of the study.) In fact, the most dominaat accident sequence was determined to be CCW failure leading to failure of all charging and safety injection (SI) pumps and the development of RCP (recirculation pump) seal LOCA. The next three dominant positions are taken up consecutively by three accident sequences initiated by loss of offsite pour, followed by loss of component cooling water, with failure to restore offsite power in four hours, one hour, and eight hours (with simultaneous failure of containment fans),

respectively. The sequence of small LOCA with recirculation cooling failure, ranked first in the Zion IDCOR baseline core damage ranking list, is dropped to the fifth position on the Zion Review list. Noteworthily, only six l (including the interfacing system LOCA sequence) out of the eighteen accident I

sequences, deemed dominant in the Zion IDCOR baseline core damage list, appear in the Zion Review dominant core damage list.

In addition to the CCW system failure sequences, other important accident I

sequences newly identified in the Zion Review include failure of the dc Bus 112 with loss of auxiliary feedwater (AFW), and loss of offsite power accom-panied by failure of AFW and the loss of " feed and bleed" capability. One major reason for the sudden emergence of CCW system failure as predominant accident sequences in the Zion Review is the recognition of the possibility for failure of both charging and safety injection pumps shortly after the loss of CCW. Such a possibility was not considered credible in the ZPSS analysis, which assumed that loss of CCW alone would not lead directly to core melt without additional system failure.

In the following, a condensed summary is given on the core damage fre-

[ quency quantifications performed by the Zion Review for each of the dominant

! accident sequences identified. It should be remarked that, for accident sequences involving loss of CCWS the system success criteria is defined to be 2 CCWS pumps (out of 5 CCWS pumps) and 2 service water system pumps (out of 6 SWS pumps) operating.

A-5 (1) Failure of Component Cooling Water (CCW), SEFC The core damage frequency of this most dominant accident sequence is quantified based on the presumption that failures of both charging pumps and safety injection pumps will ensue shortly after the loss of component cooling water (CCh). The sequence is initiated by loss of CCW with consequential loss of cooling to the RCP (reactor coolant pump) thermal barriers. Seal cooling to the two centrifugal charging pumps, normally placed to service in succes-sion, will fail in about ten minutes after the onset of CCW failure. All four RCP seals fail in about 30 minutes following the loss of seal cooling, with coolant leakage rate of about 300 gallons per minute per pump. Both safety injection (SI) pumps are actuated by low RCS pressure and fail in about five minutes due to lack of cooling. Core uncovery will occur as a result of the loss of makeup capability through either the charging or safety injection pumps. Unless cooling to the Si pumps is restored in about 45 minutes, core melt is almost a certain outcome. The frequency for complete loss of CCW is given in the ZPSS as 9.4(-4) per reactor year. Of this, the Zion Review esti-mated that 2.3(-4) is due to pipe rupture. By applying a recovery factor of 0.5, core melt frequency due to CCW failure attributable to pipe rupture is estimated to be 1.2(-4). The frequency of CCW loss not caused by pipe rupture is 7.1(-4) . For these events, failure of recovery is defined as failure to start the two standby pumps, each with an unavailability of 0.033, which accounts for that due to maintenance and pump failing to start. Core damage frequency due to failure of recovery from loss of CCW not originated from. pipe rupture is, accordingly, 7.1(-4)(0.066) = 4.7(-5). The overall core damage frequency due to loss of CCW is, therefore, 4.7(-5)+1.2(-4) = 1.7(-4).

Because of the conjectural nature of the estimation method, the core damage frequency for this sequence is rounded up to 2(-4).

(2) Loss of Offsite Power: Loss of Component Cooling Water: Failure to Recover power in Four Hours, SEFC The accident sequence envisaged here is initiated by loss of offsite power followed by loss of CCW with failure to restore offsite power in four hours. As described above in (1), loss of CCW can induce a series of events

r A-6 leading to a seal LOCA with loss of makeup capability and the eventual core damage.

The initiating event frequency for loss of offsite power is given in the ZPSS as 5.7(-2). To this are added the frequencies (taken from the ZPSS) of turbine trip, loss of main feedwater and reactor trip, each followed by loss of offsite power. The sun of these frequencies totals 0.061, which is taken to be the initiating frequency for loss of offsite power in the Zion Review.

Simultaneous loss of offsite power to both Zion Unit 1 and Unit 2 is assumed.

The probability'for failure to restore offsite power in four hours (but, success prior to eight hours) was estimated to be 0.15. The conditional prob-ability of CCW failure, given-loss of offsite power, (CCW)', is dependent on the state of the vital ac buses. Calculation of these probabilities for each of the eight electric power states is detailed in the Zion Review. The condi-tional probabilities of the electric power states following a loss of offsite power initiating event, (EP)', are given in the ZPSS and are used directly in the Zion Review analysis. By calculating the value of the product, (0.15)

(CCW)' (EP)', for each of the eight electric power states, and summing them up, one obtains 7.5(-4). Multiplying this number by the initiating event fre-quency, 0.061, the core damage frequency for this accident sequence was found to be 4.6(-5).

(3) Loss of Offsite Power: Loss of Component Cooling Water: Failure to Restore Power in One Hour, SEFC l This accident sequence is essentially identical to that delineated in (2), except for the time at which offsite power is restored. The probability for failure to restore power in one hour (but success prior to four hours) is estimated to be 0.13. By imposing only this change in probability, the core damage frequency for this sequence was quantified, in exactly the same manner, as that described in (2), to be 4.0(-5).

A-7 (4) Loss of Offsite Power: Loss of Component Cooling Water: Failure to Restore Power in Eight Hours, SEFC This accident sequence is also similar to that discussed above in (2) or (3), except for the timing of offsite power restoration. The plant damage state being considered is SEFC, which implies success of both containment fan system and containment spray. The probability for failure to restore offsite power in eight hours was estimated to be 0.1. The success criterion for the containment fan system is 3-out-of-5 fan coolers operating, which necessitates the availability of power from 2-out-of-3 Unit 1 ac buses. For each of the four electric power states having at least two buses available, therefore, this probability, 0.1, is multiplied by (CCW)', the conditional probability of CCW failure given loss of offsita power and (EP)', tne conditional probability of power state, and sunmed together to yield 1.3(-4). Multiplication of this sum by the loss of offsite power initiating frequency, 0.061, yields the core damage frequency for this sequence, ~/.9(-6).

(5) inss of Offsite Power: Failure of Component Cooling Water: Failure to Restore Power in Eight Hours, Failure of Coritainment Fans, SEC The major difference between this accident sequence and that delineated above in (4) is the inclusion of additional containment fan system failure.

Quantification of core damage frequency can be continued from (4) by calcu-lating the product, (0.1) (CCW)' (EP)', for each of the three electric power states in which only one bus is available. These products sum up to 2.9(-4).

Since the plant damage state under consideration is SEC, which implies success of containment spray system, the power state with no power available on any of the three emergency buses is excluded. With no power on any of the emergency buses, the containment spray system automatically fails with probability of 1.0, since power from an emergency bus is required to open the normally-closed M0V CS-006 in the outlet of the diesel-driven containment spray pump. Multi-plying 2.9(-4) by the loss of offsite power initiating event frequency, 0.061, yields 1.8(-5) as the core damage frequency for this sequence.

A-8 (6) Failure of DC Bus 112, Failure of Auxiliary Feedwater, TEFC Failure of the dc Pus 112 will not only cause loss of main feedwater and reactor trip, but also render one of the two PORVs inoperable. Since the dc Bus 112 provides control power for the ac Bus 149, ac power to one of the aux-iliary feedwater pumps will likewise be lost. With loss of both main and aux-iliary feedwater, core heat removal must rely upon " feed and bleed" cooling, which, in this case, cannot succeed because it requires both PORVs to be oper-ational. This accident sequence, therefore, eventually leads to core melt.

The frequency for loss of the dc Bus 112 is given in the ZPSS as 0.28, which'was judged to be reasonable by the Zion Review. The frequency of auxil-iary feedwater system failure, given the unavailability of the ac Bus 149, is estimated to be 2.3(-4) in the Zion Review. Since the probabilities for loss of main feedwater, reactor trip, and failure of " feed and bleed" cooling are all unity, the frequency of this sequence can be calculated as 0.28x2.3(-4) =

6.4(-5). By applying a recovery factor to account for possible recovery action by the operators, the sequence core damage frequency was finally esti-mated to be 7.0(-6). Since the loss of the de Bus 112 does not interfere witn the function of containment fans and sprays, the sequence plant damage state is TEFC.

(7) Small LOCA: Failure of Recirculation Cooling, SLF This accident sequence, identified as the foremost contributor to core melt 'in the ZPSS, is initiated by a small LOCA, followed by failure of recir-culation cooling (R-2). The dominant sequence occurs when ac power is availa-ble at all three buses. The mean initiating event frequency for small LOCAs is estimated to be 3.54(-2) in the ZPSS, which is reasonably consistent with the available data. The mean value for the probability of the event R-2 was evaluated as 4.55(-(). Multiplication of these two numbers and the probabili-ty of power at all ac buses (-1), together, yields 1.6(-5) as the estimated core damage frequency for this sequence. The ZPSS estimates for the unavaila-bility of high head recirculation (ZPSS, p.1.5-463) is dominated by the human error of failure to initiate the switchover from injection to recirculation phase and the blockage of containment sump. Due to lack of data, the Zion

. . _ ~ .

A-9 Review did not evaluate the reasonableness of these largely subjective esti-nates. Although the Zion Review points out some minor computational inconsis-tency in the ZPSS estimate, it accepts 1.6(-5) as the core damage frequency for.this sequence.

(8) Large LOCA: Failure of Recirculation Cooling, ALF Among the internally initiated accidents, this sequence ranks second in the ZPSS list of leading contributors to core melt. The mean frequency for large LOCA initiating events is presented in the ZPSS as 9.4(-4) per reactor year, which is deemed consistent with the available data. Failure of recircu-lation cooling (R-1) refers to failure of low pressure (or low head) recircu-4 lation. In the ZPSS, the unavailability of low head recirculation was esti-mated on the assumption that fan coolers are unavailable and that all three ac buses are available (ZPSS p.1.5-475). The dominant contributor to this unavailability is the human error of failure to initiate switchover from in-jection to recirculation. The mean value for R-1 was evaluated in the ZPSS to be 5.19(-3), which, when multiplied by the initiating event frequency, yields the core damage frequency for this sequence, 4.9(-6). The Zion Review concurs with this result although it gives some remark concerning minor discrepancy caused by the precision of the ZPSS estimates.

The Zion Review also points out that the exclusion of catastrophic reac-tor vessel rupture in the ZPSS large LOCA analysis is a somewhat nonconserva-tive approach. Depending upon how the data presented in the WASH-1400 are interpreted in terms of percentiles, the Zion Review claims that the frequency of vessel rupture could become potentially significant.

(9) Medium LOCA: Failure of Recirculation Cooling, ALF Owing to the sfmilarity in both the initiating frequency and operational procedures between this sequence and that involving large LOCA with recircula-tion cooling failure, the analysis and results presented in the ZPSS and dis-cussed in (8) above also apply to this sequence. The comments by the Zion Review also remain uncharfged.

A-10 (10) Loss of Offsite Power: Failure of Component Cooling Water: Failure to Recover Offsite Power in Eight- Hours: Failure of Containment Sprays and Fan Coolers, SE This sequence is analogous to that discussed above in (5) except that it also involves failure of containment sprays. Loss of power from ac buses in Unit I constitutes the dominant cause for failures of both containment fans and sprays in this sequence. Evaluation of core damage frequency for this se-quence can be perfonned by modifying the computational procedures delineated in (4) and (5). The value of the product, (0.1) (CCW)' (EP)' (unavailability of containment sprays) (unavailability of fans), is evaluated for each of the eight electric power states and summed together to yield 7.7(-5). Multiplying this number by the initiating event frequency gives 4.7(-6) as the core damage frequency of this sequence.

(11) Large LOCA: Failure of Low Pressure Injection, AEFC The large LOCA initiating frequency is 9.4(-4), as stated previously in (8). The mean probability for failure of low pressure injection system is given in the ZPSS as 1.39(-3), which was reexamined in the Zion Review and found to be acceptable. The dominant contributor to this failure is a human error of leaving both MOVs 8812A and 8812B in the low pressure injection sys-tem open after testing and without being detected in the control roon. Multi-plication of this probability and the initiating frequency together yields 1.31(-6) as the core damage frequency for this sequence.

(12) Loss of Offsite Power: Failure of Auxiliary Feedwater: Failure of Feed and Bleed: Failure to Restore Offsite Power in Four Hours, TEFC This sequence, 1s initiated by loss of offsite power, followed by loss of auxiliary feedwater and loss of " feed and bleed"~ capability, with failure to restore power in four hours. The loss of auxiliary feedwater incapacitates steam generator secondary cooling because without offsite power, the main feedwater pumps are tripped and cannot be restored. The loss of " feed and bleed" capability eliminates the remaining option for core heat removal.

A-11 As was the case in (2), the frequency of loss of offsite power as an initiating event was taken to be 0.061 in the Zion Review by including the frequencies of loss of offsite power following turbine trip, loss of main feedwater, or reactor trip. This inclusion was made because each of these events could lead to the accident sequence in question. The Zion Review also assumes simultaneous loss of offsite power to both Zion units, which is con-sistent with the ZPSS analysis. The probability o' failure to restore offsite power in four hours (but success prior to eight hours) was estimated to be 0.15, as mentioned in (2). The conditional probability for failure of auxil-iary feedwater, (AFW)', or failure of feed and bleed, (F&B)', given loss of offsite power, is dependent on the state of the vital ac power buses. They were estimated for each of the eight electric power states and are shown in the Zion Review (p.2-49 and p.2-33).

To evaluate the core damage frequency, the value of the product, (0.15)

(CCW)' (AFW)' (F&B)' (EP)', is calculated for each of the eight electric power states and summed together to yield 1.8(-5). The symbols, (CCW)' and (EP)',

denote, respectively, the conditional probability for success of component cooling water and the conditional probability of power state, given loss of offsite power. Multiplying this number by the initiating event frequency, 0.061, one obtains 1.1(-6) as the core damage frequency for this sequence.

(13) Loss of Offsite Power: Failure of Auxiliary Feedwater: Failure of Feed and Bleed: Failure to Restore Offsite Power in One Hour, TEFC This sequence is basically identical to that discussed in (12) except that the time for failure to restore offsite power is one hour rather than four hours. Quantification of the core damage frequency can, thus, be pro-ceeded in exactly the same way as that delineated in (12), by only changing 0.15 to 0.13, which corresponds to the probability for failure to restore off-site power in one nour, as stated previously in (3). This yields 1.0(-6) as the core damage frequency for this sequence.

A-12 (14) The Interfacing System LOCA, Event V From the viewpoint of core damage, the interfacing systems LOCA is not regarded as a dominant sequence. However, it can lead to release category 2, which, according to the ZPSS estimates, is one 'of the risk dominating re-leases. For the Zion plant, the dominant sequence for Event V is the joint failure of two motor-operated valves located in the RHR suction line inside the containment. This line is used when the RHR system is in operation during plant shutdown conditions. At the time of RCS startup, these two interlocked motor-operated valves are closed because, otherwise, the RCS repressurization cannot take place. Subsequent failures of both of these valves can then cause the low pressure piping section in the RHR line outside the containment to be inadvertently exposed to high RCS pressure, leading to possible pipe rupture and direct release of radionuclides to the surrounding atmosphere.

The probability for the occurrence of Event V was estimated in the ZPSS by considering logical combinations of the failure modes of these valves including valve disc rupture and valve disc failing open after use. The meth-od and data used in this estimate were critically reexamined by the Zion Review, which pointed out several shortcomings of the ZPSS analysis such as the mismatching of the textual description and the model. By employing a newly developed model for the Indian Point plant, an alternative but approxi-mate reevaluation was carried out by the Zion Review, yielding a somewhat higher value of 1.6(-7) for the probability of occurrence of Event V. A sta-tistical analysis based on available data, however, indicates that an upper 95% statistical confidence limit on the probability of Event V is 1.4(-7). In view of these results, the Zion Review finally drew a conclusion that the ZPSS value of 1.05(-7) is a reasonable point estimate.

1 (15) Seismic: Loss of All AC Power, SE This externally initiated sequence occupies the second and the eighth positions in the Zion IDCOR baseline core damage risk profile and that of the Zion Review, respectively. The sequence is of special significance because it has been identified to be the largest contributor to the societal risk among all the sequences listed in the Zion IDCOR baseline risk profile.

o .

A-13 In essence, the initiator of this sequence consists of a seismic event

, severe enough to cause failures of both offsite power and the service water system. Failure of the service water system causes subsequent failure of the emergency diesel generators which rely upon service water for cooling. As a consequence, loss of all ac power arises, followed by failure of the RCP seal cooling and eventually a RCP seal LOCA. Since safety injection and contain-ment heat removal systems require ac power, the loss of RCS inventory cannot be made up, thus leading to core melt with core damage state, SE. The fre-quency of this sequence has been evaluated in the ZPSS to be 5.6(-6), which was judged to be reasonable by the Zion Review. This frequency represents an insignificant fraction (about 1.6%) of the total core damage frequency esti-mated by the Zion Review, due to the new emergence of several dominating sequences pertaining to the failure of component cooling water system. In the Zion IDCOR baseline core damage profile, however, it constitutes roughly 13%

of the total core damage frequency, as stated previously. The fact that the plant damage state corresponding to this sequence is SE, meaning early core melt without containment cooling, makes this sequence a potentially important contributor to risk and release consequences.

A.1.3 SARP Rebaseline Estimate of Zion Core Damage Frequency The rebaselining study on Zion was limited essentially to reexamination and updating of the models and core damage sequences presented in the Zion Review. One major accomplishment of the study was the evaluation of the potential impact of certain issues on the dominant sequence core damage fre-quencies and plant damage states. These issues include both plant operation changes and some generic PRA issues which have emerged since the time of the Zion Review. In addition to the Zion Review, the study also made reference to the Zion Probabilistic Safety Study (ZPSS), and the NRR Staff Report on Zion (August 1, 1985). The letter (of July 9, 1984) sent from Dave Kunsman of Sandia National Labo'ratories to Scott Newberry of NRR was also used as a valu-able source of information because it presents the new sequence equations and estimates for the Zion Review sequences influenced by the imposition of new success criteria for the component cooling water system (CCWS) and service water system (SWS). The letter, in effect, represents a forerunner to a

l 1 A-14

. limited rebaselining of the' Zion Review, since it constitutes the quantitative f bases for the NRR Staff Report" and the SARP Study.2 I

In the Zion limited rebaselining study, the scheme for labeling the sequences and defining the plant damage states follows exactly that developed

) in the ZPSS (and adopted by the Zion Review). The sequences are-simply iden-tified by their ranking among the dominant sequences. Also, only one plant damage state is assigned to each sequence. .The plant damage state is charac-terized by using a four letter set, with the first letter describing the ini-tiator (Tatransient, A= Medium or Large LOCA, S=Small LOCA), the second letter the phase of reactor' cooling (injection or recirculation) failure during which 4

core melt occurs (EsEarly core melt with injection failure, Lalate core melt j with recirculation failure) and the last two letters denoting respectively

, successful operation of the containment fan coolers and spray .systen

. (Casuccessful containment spray injection or recirculation, F= successful con-

! tainment fan coolers).

t The rebaseline Zion dominant core damage sequences and the corresponding plant damage states are shown in Table A.4, along with those developed by the Zion Review and 10COR Baseline for ready comparison. Since no attempt was made to identify any new dominant sequences, the rebaselining ef fort only brought about shifting and rearrangement of the ranking of the sequences established by the Zion Review. In particular, the following points' can be '

noted by comparing the two sets of core damage profiles.

i l '1. The seismic event with loss of all ac power, the eighth sequence in j

the Zion Review, is removed from the rebaselining list, apparently because it is an externally initiated event that is beyond the scope of the study.

t i

l 2. There are 'five sequences whose core damage frequencies remain un-changed from those estimated by the Zion Review. Falling under this l category are the small, mediun, or large LOCAs followed by failure of

recirculation cooling (sequences 2, 3, and 4), large LOCA followed by

failure of low pressure injection (sequence 6) and the interfacing t

i system LOCA (sequence 14).  ;

i i

A-15

3. For all but one (sequence 5) of the remaining sequences, the core damage frequencies reevaluated by the rebaselining are significantly reduced. The increase in the core damage frequency for sequence 5, by roughly a f actor of two, is chiefly attributable to the substan-tially larger probability estimated for the failure to restore ac power in one hour (but success in four hours).

4. As will be discussed in more detail later, the three sequences -(se-quences 9, 12, and 16) which did not appear in the Zion Review repre-sent portions. of certain Zion Review sequences newly created as a result of including loss of SWS as a contributor to core damage.

5. Owing to the credit newly given to refilling the RWST, which enables long term use of the containment sprays, the plant damage state for sequence 2 is reclassified as SLFC instead of SLF. By the same rea-son, the plant damage states for sequences 3 and 4 are both changed from ALF to ALFC, implying successful operation of the containment spray system as well as the containment fans. Consideration of this new credit, however, did not affect the core damage frequencies of these sequences.

Focusing attention on the top six dominant sequences, it is of interest to observe that, with the exception of sequence 1, the loss of component cool-ing water system (CCWS) following the loss of offsite power no longer occupies leading positions in the core damage list. Instead, these positions are taken by the LOCAs of various sizes, followed by failure of recirculation cooling or low pressure injection, a trend which prevailed in the ZPSS core damage pro-file. The relative importance of CCWS failure is diminished primarily by virtue of the relaxation in the success criterion for the CCWS. In the Zion Review, the success criteria for the CCWS and the SWS were assumed to be func-tioning of 2-of-5 CCWS pumps and 2-of-6 SWS pumps. These criteria were eased somewhat in the rebaselining study, based on the concurrence between NRR staff and Comonwealth Edison, to 1-of-5 CCWS punps, while maintaining the same 2-of-6 SWS pumps success criterion. It should not be overlooked, however, that this less stringent CCWS success criterion increases the importance of SWS with respect to CCWS. The relative importance of SWS can have significant

1 A-16 impact on the plant damage state since its failure will cause failure of the containment fans and spray pumps, while CCWS failure will not.

The rebaselining study, therefore, took into consideration the SWS fail-ure, which was not included in the Zion Review models. The sequence equations presented in the Kunsman's letter, which made no distinction between loss of CCWS and loss of SWS, were requantified, factoring out the SWS terms from the CCWS terms to determine the impact of SWS failure on plant damage states. The rebaseline models also incorporate pumps and diesel generator common mode failure events, which were not considered in the Kunsman's analysis.

The essential details on the quantification of CCWS and SWS unavailabili-ties based on the new success criteria are presented in Section IV.4.1 of the rebaseline analysis report.2 Table IV.4.1 of the same report tabulates the calculated unavailabilities of these two systems as a function of the eight electric power states.

In addition to the CCWS and SWS pump success criteria discussed above, several other importaht issues were considered in the rebaseline analysis, a concise summary of which is given in the following.

(a) Common Mode Failures i The common mode failures among CCWS, SWS, and Unit 2 diesel generator,

! which were not included in the models of ZPSS, the Zion Review and Kunsman's letter, were taken into account in the rebaseline analysis (1) to enhance the consistency between the Zion NUREG-1150 work and other NUREG-1150 analyses, and (2) to take advantage of the detailed nature of the equations in Kunsman's letter, which permits easy application of the NUREG-1150 common mode analysis to the Zion models. The diesel generator common mode event, however, was mod-( eled only for the t'wo diesel generators dedicated to Unit 2, and not modeled l

across Units 1 and 2.

A-17 (b) Restoration of AC Power The probability of failure to restore offsite power within a given time span was adjusted in the sequence models to reflect the changes in the generic power recovery models which have taken place since the time of the Zion Review. Additionally, failure to restore a diesel generator was also included in the sequence models. The failure probabilities for restoring offsite power and diesel generators are taken from the ASEP generic data base.

(c) Feed and Bleed The procedures for feed and bleed are said to be in place at Zion. In the Zion Review, one of the primary requisites to successful feed and bleed cooling, in case of complete loss of feedwater and AFW, is the functioning of two pressurizer PORVs. On the ground that the shutoff head of the two chargi-ng pumps (2670 psig) is sufficiently higher than the pressure set point for the safety relief valves (2435 psig), the rebaseline analysis assumed that only one PORV needs to be operational for successful operation of feed' and bleed.

(d) RWST Refill Procedures are said to be in place at Zion for replenishing the RWST shobid such a need occur. The rebaseline analysis, therefore, gives credit to the RWST refill, which does not have any impact on the core melt frequencies.

It can, however, alter the plant damage states of certain sequences, because, if RWST is replenished, the containment spray injection could be.-continued as a substitute for failed containment recirculation cooling.

(e) Reactor Coolant Pump Seal LOCA The crucial question of how large and how quickly a seal LOCA will devel-op upon loss of CCW cooling to the RCP seals remains an unresolved issue. The Zion Review assumed that a 300 gpm leak per pump would develop within one hour if CCWS flow to the RCP s'eal is lost, a postulation deemed potentially conser-vative by the f4RR staff. The seal LOCA model used in the rebaseline analysis

A-18 is a time dependent Weibull distributed random variable with a 5% confidence limit at one hour and 95% confidence limit at ten hours. It implies that, after the CCWS cooling is lost, there is a 0.05 probability that the seals will have failed within one hour, and 0.95 probability that the seal will have failed within ten hours. The rebaseline sequence models also assumed that all RCP seals fail concurrently, with a leakage rate of 450 gpm per pump, for a total seal LOCA of 1800 gpm. It is further assuned that, once a seal LOCA occurs, core uncovery will not take place for a period of one hour even with-out injection to the primary system. For loss of offsite power transients resulting in failure of high pressure injection, this allows for an extra hour for recovery of ac power.

l (f) Manual Switchover to Recirculation Cooling In the event of a LOCA (such as sequences 2, 3, and 4 in Table A.4), or under certain transient conditions, the operators must manually switch the ECCS (emergency core cooling system) over from injection phase to recircula-tion phase, when the RWST reaches a low level. Human errors involved in this manual switchover are the leading contributors to the core melt frequencies of these sequences. Since no new information suggesting improved reliability in this human action was received, the rebaseline analysis made no changes in the recirculation cooling models.

l (g) Recovery of CCWS Pipe Ruptures In both the Zion Review and the rebaseline study, the most dominating

[ core damage sequence was identified to be CCWS failure, causing failure of all charging and safety injection pumps and the development of RCP seal LOCA, as shown in Table A.4 The CCW system failure due to pipe rupture plays a deci-sive role in the quantification of the core melt frequency for this sequence.

In the Zion Review,'the frequency of CCWS pipe rupture was estimated based on i

the mean pipe rupture data (per hour per section) given in the ZPSS, which

( originated from WASH-1400. In computing the core melt frequency of this se- l quence, however, credit was given to recovery of CCW pipe due to the availa- <

{ bility of procedures in Zion to isolate pipe leaks in the CCWS. There are, however, some uncertainty about the credibility of isolating such leaks in a l

l

A-19 timely manner. Furthermore, no data are available for a statistical analysis of this recovery action. Notwithstanding, the rebaseline analysis retains the assumptions made in the Zion Review.

(h) RHR System Check Valve Testing It is required by the NRC Confirmatory Order of 1980 that the RHR check valve disks be tested for integrity at every refueling shutdown and cold shut-down. Without such testing, the frequency of an interfacing system LOCA would increase to 1.0E-6, an order of magnitude larger than that predicted by both the ZPSS and Zion Review. Since compliance with the Confirmatory Order by the Zion station has been confirmed, the interfacing system LOCA analysis of the Zion Review was considered adequate.

(1) Diesel-Driven Containment Spray Punp Owing to its need for SWS cooling water, the one diesel-driven contain-ment spray pump in Zion still has an indirect dependency on ac power. Accora-ing to the NRR Staff Report, modifying one or more of the containment spray pumps to be entirely ac independent could have significant impact on reducing the risk after core melt. Since no such modifications are currently contem-plated by the utility, the impact of this issue on plant damage state fre-

quencies was investigated only as a sensitivity study in the rebaseline analy-i sis. '

i To facilitate understanding of the methodology used in the Zion rebase-i line analysis for developing the dominant core danage sequences shown in Table l A.4, a brief discussion of each sequence is given below in order of sequence dominance. Emphasit, is placed upon describing the analytical methods and log-I ical basis of rebaseline sequence frequency quantification in relation to the Zion Review. The Zion Review sequence frequencies are shown inside parenthe-l ses.

i i

t L

o o A-20 (1) Sequence 1. CCWS f ailure, causing loss of all charging and SI pumps, loss of RCP seal cooling resulting in RCP seal LOCA. 1.2E-4

, (2.0E-4).

l This sequence, identified to be the most dominant by both the Zion Review and the rebaseline analysis, is essentially dominated by the frequency of pipe rupture event in the CCWS. The sequence frequency estimated by the Zion Review is reduced by roughly a factor of two by virtue of the less stringent  ;

success criterion for the CCWS (1-of-5 pumps). The frequency of CCW pipe rup-ture leading to core melt,1.2E-4, assessed by the Zion Review upon consider-

! ing 50% recovery factor, is retained in the rebaseline analysis. The fre-l' quency of CCWS failure due to causes other than the pipe rupture, 7.1E-4, is considered recoverable by successfully starting one of two standby pumps (as opposed to 2-of-2 standby pumps in Zion Review). By using the same unavaila-l bility data for the standby punp (due to maintenance or failure to start) as those shown in the Zion Review, the probability of failure to restore CCWS was l found to be 7.7E-3. The rebaseline sequence frequency is, therefore, 1.2E-4+( 7.1E-4)( 7.7E-3) = 1.2E-4 It is, thus, demonstrated that this se-quence frequency is almost totally doninated by the frequency of CCWS pipe rupture. The lack of reliable data for CCWS pipe rupture, however, arouses a question regarding the suitability of the pipe rupture frequency, which de-rives its origin from the WASH-1400, used in this quantification.

The WASH-1400 pipe rupture data are more representative of rupture of l large pipes exposed to the environment of the primary system, which is sub-jected to relatively high temperature and high pressure. Whether or not such

! data are applicable to the rupture of CCWS, which is normally under lower pressure and significantly lower temperature, is certainly a debatable issue.

l In viow of the dominating nature of CCWS pipe rupture frequency and the un-

! availability of applicable data, a parametric study was performed, in the rebaseline analysis, to study its effect on the core melt frequency of this l sequence.

I i

i

A-21

.(2) Sequence 2. Small LOCA, followed by failure of recirculation cooling.

1.6E-5 (1.6E-5).

The only modification made to this sequence, the fifth ranked sequence in l the Zion Review, is to grant credit for refilling the RWST, which would allow for long-term use of the Containment Spray Injection System (CSIS). The plant damage state is, thus, reclassified from SLF to SLFC, with no change made in the sequence frequency. Although availability of the RWST is postulated, there are enough factors favoring this seemingly nonconservative assumption, i

Since the failure occurs during recirculation phase, the operators would have sufficient time to decide on the need for refilling the RWST and to take such actions if necessary. Moreover, this sequence does not involve any degraded power situations, which could adversely affect the success of refilling the

! RWST.

i (3) Sequence 3. Large LOCA, followed by failure of recirculation cooling.

! 4.9E-6 (4.9E-6).

Just as for sequence 2 discussed above, the only change from the Zion j Review analysis is the reclassification of the plant damage state from ALF to l ALFC, by awarding credit to refilling the RWST. The sequence frequency remains unchanged from the Zion Review analysis.

(4) Sequence 4 Medium LOCA, followed by failure of recirculation cooling.

4.9E-6 (4.9E-6).

1 i The comments given above on sequence 3 also apply to this sequence.

! (5) Sequence 5. Loss of offsite power, failure of auxiliary feedwater (AFW),

failure of feed and bleed, failure to restore ac power in one hour (but recovery prior to four hours). 2.1E-6 (1.0E-6).

! As mentioned earlier, this is the only sequence which involves an in-crease in the sequence core melt frequency in comparisa' with the Zion Re-l view. The factors contributing to this increase are explained in the

A-22 following. Three principal modifications are made to the Zion Review analysis for this sequence, including recalculations of the probabilities for (a) fail-

• ure to restore ac power in one hour (recovery prior to four hours), (b) fail-ure to operate SWS and CCWS based on the new success criteria (1-of-5 CCWS pumps and 2-of-6 SWS pumps), and (c) failure of feed and bleed based on the new success criterion (1-of-2 PORVs).

Of these, the probability for (a) was reevaluated to be 0.23, a value substantially larger than that of 0.13 used in the Zion Review. As stated previously, the probabilities for (b) have been calculated as a function of the eight power states, and are tabulated in Table IV.4.1 of the rebaseline analysis report.2 Since the plant damage state for this sequence is TEFC, the main quantities of interest here are the probabilities of successful operation of SWS and CCWS, the complements of the unavailabilities of SWS and CCWS. For those four power states where there are at least two emergency ac buses avail-able, these complements are all practically equal to 1.0, the same as those found in the Zion Review. For the three power states which have only one emergency power bus available, these complements also take the value of 1.0, which is slightly larger than the 0.97 used in the Zion Review. For the power state with no bus available, the complement was found to be 0.97 rather than the 0.83 used in the Zion Review. It must be remarked that, for the Zion Review, these complements only reflect the unavailabilities of CCWS, since the failure of SWS was not considered.

The probabilities for the failure of feed and bleed (c) above, based on the new and more relaxed success criterion of 1-of-2 PORVs, are obtained by adding together the probabilities of three distinctive events, namely (1) all charging and SI pumps fail, (ii) one PORV and both charging pumps fail, and (iii) both PORVs fail. Occurrence of any of these events constitutes failure of feed and bleed based on the new success criterion. The probabilities for the event (1) have 'been evaluated as a function of the eight power states in the Zion Review (page 2.31), and are adopted directly. The probability for failure to open 1-of-2 PORVs was estimated to be 2.9E-3, based on the data shown in the Zion Review (page 2.32). The PORV block valves are assumed to be normally open. The probabilities for the failure of both charging pumps, as a function of the eight power states, are also available from the Zion Review

A-23 (page 2.31). When they are multiplied by 2.9E-3, the probabilities for event (ii) can be obtained. The probabilities for event (iii) were estimated to be 1.3E-4, also based on the data shown in Zion Review (page 2.32), o To calculate the core damage frequency for this sequence, the product,

. (0.23) (probability for successful operation of SWS, CCWS) (failure probabili-ty of feed and bleed) (AFW failure probability) (probability of power states),

is evaluated for each of the eight power states and summed together. It should be reiterated that only the first three probabilities appearing in this

product have been reevaluated from those used in the Zion Review analysis.

! The summation, after multiplying by the initiator frequency, 0.061 per year, i

yields 2.1E-6 as the core damage frequency for this sequence. It was deter- t mined that, the increase in the sequence frequency, as compared to the Zion Review, is primarily due to the larger probability found for failure to re-j store ac power within one hour. The new success criterion for feed and bleed l was found to have little impact on the sequence core melt frequency, because it is dominated by loss of ac power to the charging and SI pumps. .

I (6) Sequence 6 Large LOCA, followed by failure of low pressure injection.

1.4E-6 (1.4E-6).

No modifications or changes were made on the Zion Review sequence model for this core damage sequence, which was sequence 12 in the Zion Review.

(7) Sequence 7 Loss of offsite power, followed by AFWS failure, failure of feed and bleed, failure to restore ac power within four

- hours (but successful restoration by eight hours). 4.6E-7 (1.1E-6).

l This sequence is exactly identical to sequence 5 except for the timing j for restoring the ac* power.

As a result, the discussions presented above in (5) with regard to recal-

< culating the failure probability of feed and bleed or the unavailabilities of i

CCWS and SWS, based on' the new success criteria, are directly applicable {

here. The only difference lies in the probability of failure to restore ac

A-24 power, which was found to be 0.05 for this particular time span. It is note-worthy that this value correspond to one-third of that used in the Zion Review. Calculation of the sequence core melt frequency can be proceeded by following the description given in the last paragraph of (5) above, with only replacing 0.23 by 0.05. It was found to be 4.6E-7/yr, less than one-half of that estimated by the Zion Review (sequence 13).

(8) Sequence 8. Loss of offsite power, loss of either CCWS or SWS, failure to restore ac power in one hour (but successful restoration of ac power by four hours). 3.2E-7 (4.0E-5).

The SWS failure considered here refers to the recoverable SWS failures such as those caused by diesel generator failure. Most of the failures in the SWS model are recoverable upon successful restoration of ac power. The non-recoverable SWS failures are separated out and defined as a new sequence, sequence 9. No counterpart of sequence 9 exists in the Zion Review, since SWS failure was not considered in the Zion Review.

The probability for failure to restore ac power was determined to be 0.23 for the power state "All" (implying ac power available at all buses), and 0.26 for the remaining seven power states due to the additional one hour the NUREG-1150 RCP seal LOCA model allows for ac restoration over that in the Zion Re-view models. In the Zion Review. 0.13 was used for all the eight power states.

For the power state "All," an RCP seal LOCA is assumed to take place with probability 1.0, since loss of CCWS is almost certain to occur due to common mode (nonrecoverable) failures. For the remaining seven power states, how-ever, the probability for a seal LOCA to occur at one hour was taken to be 0.05, based on the NUREG-1150 RCP seal LOCA model. For the unavailabilities of both SWS and CCW3, the beta factors in Ref. 6 for the common mode event probabilities, shown in Table IV.4.1 of the rebaseline report, are used.

The sequence core melt frequency was computed by first evaluating the product, (f ailure probability to restore ac by one hour) (probability for loss of CCUS or SWS) (power state probability) (probability of RCP seal LOCA at one

' 0 o .

A-25

$ hour), for each of the eight power states and summed up to obtain 5.2E-6.

Multiplying this by the frequency of loss of offsite power, 6.1E-2/yr, gives 3.2E-7/yr as the core melt frequency for this sequence.

(9) Sequence 9. Same as sequence 8, except this represents the SWS common i

mode failure portion of the Zion Review sequence No. 3.

3.0E-7 (none in the Zion Review).

i As stated previously in (8), this new sequence is created as a result of separating out the nonrecoverable SWS failures from the CCWS f ailures in sequence 8. Nonrecoverable failures refer to SWS failures which can not be recovered upon restoration of ac power. This sequence is alnost totally domi-nated by common mode failure of the SWS pumps. Since SWS failure is not re-coverable, the CCWS and the injection pumps will not be operable, and an RCP seal LOCA will develop with probability 1.0. The plant damage state of this sequence is SE, since both the containment sprays and containment fans depend on SWS. The probability for failure to restore ac power within one hour (but, success by four hours) was found to be 0.23 for all the power states. Also, the unavailability of the SWS not caused by diesel generator failure was de-termined to be 2.2E-5. Evaluating the product, (0.23) (2.2E-5) (power stato probability) (1.0), for each of the eight states, and summing them up yields 4.9E-6. Multiplying this by the frequency of loss of offsite power, 6.1E-2/yr, gives 3.0E-7/yr as the core melt frequency for this sequence.

(10) Sequence 10. Loss of of fsite power, loss of CCWS or SWS, failure to re-store ac power within eight hours, failure of containment sprays and fan coolers. 2.0E-7(4.7E-6).

This sequence is similar to sequence 8, except that ac power is not re-stored in eight hours. Both the Zion Review and ZPSS gave no credit for con-tainment systems if'they could not be restored within eight hours.

Contributions to the sequence core melt frequency were evaluated separ-ately for failures of CCWS and SWS. As in the Zion Review, only the four highly degraded power states (with only one bus or none available) were con-sidered in estimat'ng the contribution due to CCWS failure. The probability

A-26 for failure to restore ac power within eight hours was found to be 0.02, a smaller value compared to the 0.1 used in the Zion Review. For those highly degraded power states, the unavailability of containment fans is 1.0. To cal-culate the CCWS contribution, the product, (failure probability to restore ac by eight hours) (unavailability of CCWS) (unavailability of containment sprays) (power state probability), is evaluated for each of the four degraded power states and summed together to obtain 8.4E-7.

The SWS contributions are assessed by considering all the eight power j states, since loss of SWS causes failure of both containment sprays and fans

! with probability 1.0, given loss of offsite power, due to the eventual station i blackout upon loss of diesel generator cooling.

The product, (failure probability to restore ac in eight hours) (unavail-abilities of SWS) (power state probability), is evaluated for each of the

eight power states and added together to yield 2.4E-6. Multiplying (8.4E-7 +

j 2.4E-6) by the frequency of loss of offsite power, (6.1E-2), the core melt frequency of this sequence is obtained as 2.0E-7.

i

! (11) Sequence 11. Loss of offsite power, loss of CCWS or SWS, failure to re-store ac power within four hours (successful restoration i by eight hours). 1.5E-7 (4.6E-5).

1 1

This sequence dif fers from sequence 8 only in that the time span over

which recovery of offsite power and the probability of an RCP seal LOCA are

! modeled is prolonged. An RCP seal LOCA is considered to occur, in this se-1

quence, at four hours, and ac power is successfully restored within four to

elght hours for power state,"All," and five to eight hours for the remaining degraded power states, taking into account the additional one hour allotted for restoring ac power after the seal LOCA occurs. The discussions given above in (8) regarding the RCP seal LOCA model and restoration of offsite power are also applicable here. The nonrecoverable SWS portion of sequence 11 is calculated in sequence 16. The probabilities for failure to recover ac power within four to eight hours and five to eight hours were estimated to be 0.05 and 0.02, respectively. For the degraded power states, the probability for RCP seal LOCA to occur at four hours was evaluated to be 0.47 based on the

r A-27 NUREG-1150 RCP seal LOCA model. With only these two changes, the sequence core melt frequency can be calculated, following the description given for sequence 8, to be 1.5E-7/yr.

(12) Sequence 12. Loss of offsite power, failure of SWS, failure to restore ac power within eight hours. This sequence represents the SWS failure portion of the rebaselined Zion Review se-quences No. 4 and No. 6. 1.5E-7 (no corresponding se-quence in Zion Review).

This sequence, newly created by the inclusion of SWS failure into the se-quence model, should be considered as an offshoot of sequences 13 and 17, in which SWS failure contributes to core melt. These two sequences had to be re-defined into three sequences, because the ensuing plant damage states depend upon whether CCWS or SWS contributed to the sequences. This sequence is newly fomed by separating out those portions of sequences 13 and 17 which are attributable to SWS failure. No counterpart of this sequence can be found in the Zion Review, since SWS was not included in the sequence models. For this sequence, all SWS failures are unrecoverable because ac power is not restored within eight hours, leading to complete loss of containment sprays and fans.

The plant damage state is, accordingly, SE, as compared to sequence 13 (SEC) and sequence 17 (SEFC), both of which involve CCWS rather than SWS failures.

The probability for failure to restore ac power within eight hours was esti-mated to be 0.02.

The sequence frequency quantification can be carried out by evaluating the product, (0.02) (unavailability of SWS) (power state pr,obability), for each of the eight power states, and summing them up to obtain 2.4E-6. Mul ti-plying this by the frequency of loss of offsite power, 0,061/yr, gives 1.5E-7/yr as the core melt frequency of this sequence.

A

A-28 (13) Sequence 13. Same as sequence 12 above, except this is the CCW portion of the Zion Review sequence No. 4, and containment fans fail. 1.0E-7 (1.8E-5).

This sequence involves a set of events similar to those in sequence 12, except that containment fan failure is explicitly included here. It corre-sponds to sequence 4 in the Zion Review, and results in plant damage state SEC, with loss of the containment fans due to degraded power states. The dom-inant cause of fan failure here is loss of 2-of-3 ac buses at Unit i due to random failures in the diesel generators. As mentioned earlier, the success criterion for the containment fan coolers is at least 3-of-5 fans. These fan coolers will fail electrically only for degraded power states with one bus (147,148, or 149) or no bus available. Since failure of all ac power at Unit I will also result in loss of containment sprays, which is not compatible with the plant damage state SEC, the power state of "no bus available" is ex-cluded. The probability for failure to restore ac power within eight hours is 0.02, as compared to the value of 0.1 used in the Zion Review. The unavaila-bilities of CCW are those reevaluated based on the new success criterion for the CCWS.

For those three degraded power states with only one bus (147,148, or 149) available, the product, (0.02) (unavailability of CCW) (power state prob-ability), is evaluated and sunmed up to obtain 1.7E-6. The sequence core melt frequency is, therefore, (6.1E-2/yr) (1.7E-6) = 1.0E-7/yr.

(14) Sequence 14, Interfacing Systems LOCA. 1.05E-7 (1.05E-7) .

For this sequence, no change was made on the model in the Zion Review.

(15) Sequence 15. , Failure of de Bus 112, causing loss of one PORV and loss of ac Bus 148, failure of AFWS. 5.0E-8 (7.0E-6)

The only change made on the Zion Review model, for this sequence, is the reevaluation of the probability for failure of feed and bleed based on the new success criterion of 1-of-2 PORVs. It was calculated by adding the probabili-ty for operator error to open one PORV (=1.3E-4), and the probability for

A-29 failure of PORV to open on demand (=1.4E-3). The initiator frequency (0.28/yr), the recovery of initiator (0.1), and the conditional failure proba-bility of AFWS, given the loss of ac Bus 148 (=2.3E-4), are all taken directly from the Zion Review. The sequence core melt frequency is, therefore, (0.28/yr) (0.1) (2.3E-4) (1.4E-3 + 1.3E-4) = 5.0E-8/yr.

(16) Sequence 16. Same as sequence 11, except this represents the SWS comon mode failure portion of the Zion Review sequence No. 2.

4.8E-8 (none in the Zion Review).

This sequence is analogous to sequence 11 except that it is caused by nonrecoverable failure of the SWS, which is dominated by common mode failure.

As mentioned earlier, SWS failure becomes important relative to CCWS failure because of the new success criterion for CCWS. The nonrecoverable SWS fail-ures, which will result in damage state SE, therefore, must be separated from nonrecoverable SWS failures and CCWS fault,s. Since the SWS can not be re-covered, the CCWS and injection pumps will not be operable, leading to an RCP seal LOCA with probability 1.0. The containment sprays and fans also fail due to the nonrecoverable SWS failure, thus giving rise to plant damage state, SE. As mentioned in (9) above, the unavailability of SUS not caused by diesel generator failure is 2.2E-5. Also, the probability for failure to restore ac power within four hours (success by eight hours) was determined to be 0.06.

The product, (0.06) (2.2E-5) (power state probability) (1.0), is evalu-ated for each of the eight power states and summed up to give 7.8E-7. Multi-plying this by the frequency of loss of offsite power, 6.1E-2/yr, yields 4.8E-8/yr as the core melt frequency of this sequence.

(17) Sequence 17 Loss of of fsite power, CCWS failure, f ailure to recover offsite power or diesel generators in eight hours. 3.7E-8

'(8.0E-6).

This sequence is essentially equivalent to sequence 6 in the Zion Review and is similar to sequence 8 in that it involves a set of events leading to core damage due to an RCA seal LOCA. Unlike sequence 8, however, none of the ac power failures are restored within eight hours after initiation of the

s, A-30 sequence. Since the plant damage state is defined to be SEFC, meaning suc-cessful operation of both containment fans and sprays, only the power states resulting in SEFC for this set of events are included in the analysis. These power states correspond to emergency power available at all buses or at two buses (147-148, 147-149, 148-149). The probability of an RCP seal LOCA is 1.0, as in the Zion Review, whereas that for failure to restore ac power with-in eight hours was taken to be 0.02 instead of 0.1. The unavailabilities of CCWS are those based on the new CCWS success criterion.

i For those four power states, the product, (0.02) (unavailability of CCWS)

(power state probability), is evaluated and summed up to give 6.0E-7. Multi-plying this by the frequency of Icss of offsite power, 6.1E-2/yr, yields 3.7E-8/yr as the sequence core melt frequency.

A.1.4 Comparison Between IDCOR and SARP Table A.5 compares dominant core damage sequences for Zion between the SARP rebaseline and IDCOR baseline studies. Although the IDCOR baseline risk profile was developed by updating the ZPSS, the IDCOR baseline core damage se-quences and their frequences are practically identical with those of the

, ZPSS. The SARP ef fort for Zion is a limited rebaselining of the models and

{ accident sequences addressed in the Zion Review. Thus, the results in the SARP rebaseline study would represent an update of the existing dominant se-quences in the Zion Review, and no attempt was made to identify any new domi-j nant sequences.

l A major difference between the two studies is the loss of component cool-

) ing water which may lead to a RCP seal LOCA sequence under high pressure j injection failure. This was identified in the SARP rebaseline study as the '

most dominant contributor to core damage, which was not, however, considered f in the 10COR baseline study. Minor differences between the two studies are l due to the new success criteria used for the CCWS, SWS, and pressurizer PORVs, resulting in slightly dif ferent sequence definitions and associated sequence l frequencies.

l

A-31 A.2 Core Meltdown Phenomena and Containment Response 1

This section contains a description of Zion containment performance and a list of available Zion Plant accident analyses (Section A.2.1). A comparison of available results from IDCOR and SARP analyses for containment response, radioactivity release and consequences is given in Section A.2.2. The discus-sion of additional accidents analyzed by NRC contractors for this plant is in Section A.3. The differences between 10COR and SARP analyses identified in Section A.2.2 are discussed in Section A.3.1. Model differences and important emergency system features, which could diminish the consequences of analyzed accidents, are also discussed. The offsite consequences are discussed in Sec-tion A.4 A.2.1 Containment Performance The Zion containment is in the shape of a cylinder with a shallow, domed roo'f, and a flat foundation slab. The pressure at which failure would be expected to occur is a key determinant in the likelihood and timing of con-tainment failure during pressure transients that result from the generation of steam or combustion of hydrogen. The pressure at containment failure can also influence the dispersion of fission products released to the environment. The PRA for Zion Nuclear Power Station determined the realistic containment build-ing ultimate pressure capacity to be about 150 psia (lower bound).

The containment fan cooler spray systems provide redundant and diverse containment heat removal capability for Zion. The containment fan cooler sys-tem is designed to remove heat from the containment building during both normal operation and in the event of a design basis accident. The containment fan cooler units are an engineered safeguard system. Five fan coolers are provided for each containment. Each cooler is rated at one-third the required capacity for design' basis accident conditions.

The containment spray system, on the other hand, is designed to limit the pressure in the containment atmosphere to levels below the containment design pressure and to reduce the radiological releases to the 10CFR100 limits.

Three completely redundant containment spray system trains are provided for

A-32 each unit, with each system rated at 100 percent capacity for design basis accident conditions. One of the spray trains has a diesel engine driven spray pump for added diversity. All three :ontainment spray pumps take suction from the Refueling Water Storage Tank (RUST) and discharge into the spray rings located around the inside of the containment dome. Should spray be required during the recirculation phase of the accident, two of the three spray sub-systems can be supplied with water from the containment sump via the residual heat removal pumps which deliver water to the discharge lines of the two motor operated spray pumps. Spray pump operaticn is therefore not necessary during the recirculation phase. Both motor-driven pumps arid all motor operated valves can be supplied with power from the emergency diesel generators in the event of a loss-of-off-site power. Failure of a single diesel or emergency bus will affect one subsystem only.

A.2.1.1 List of Analyzed Accidents The Zion Nuclear Plant Accidents were analyzed by SNL 3 and BNL8 in the review of Zion PRAs study; by BCL in BMI-21049 and a recent study 10 in support of NVREG-1150, and very recently by BNL's rebaselining study.Il Previously the Zion Plant accidents were analyzed by the NRC in NUREG-0880,12 by BNL in NUREG/CR-222813 and reviewed by the NRC staff in Ref. 4 The industry Zion study is reported in Volume 23.1 14 and Volume 21.1 1 of the IDCOR report and in Zion PRA study (ZPSS).s

• Table A.6 gives a list of analyzed accidents. The status of plant damage is given by two to four letter symbols (e.g., SLFC = Small LOCA, Late contain-ment rupture, fans operating, Containment Sprays operating, see explanation to Table A.2). The other colunns in Table A.6 are defined by symbols from WASH-1400.ls A.2.1.2 Containment Failure Probability The probability for early containment failure from the SARRP study ll (Figure 3.5 of Ref. 11) when considering all accident sequences is plotted in Figure A.2 along with mean, median values and uncertainty ranges represented

A-33 by the 5th and 95th percentiles. As shown, the uncertainty range is from 1x10 3 to 0.17 The median value is 0.01 and the mean value is 0.04 The results were compared with other studies in Table A.7. The Surry study has a mean value of 0.2 which is about a factor of five higher than that of Zion. The IDCOR analysis predicted a significantly lower probability of 5x10-3 based on the assumption that early containment failure is dominated by the isolation failure. A separate calculation for the isolation failure prob-ability of the Zion containment showed a similar result to that of the IDCOR analysis. The mean probabilities of isolation failure were .04 in the SARRP study and 5.0x10-3 in the IDCOR analysis, respectively.

A.2.2 Comparison of SARP and 10COR Results The results of SARP and IDCOR calculations for the primary system and containment response are sumarized in Table A.8. The containment pressure response for conpared accidents are given in Figures A.3 through A.1J. The main features from this comparison are given as follows:

The " Seal LOCA" Accidents (Sequences 1 through 4 in Table A.8)

The " seal LOCA" accidents are either TMLB' type as in Refs. I and 14 or 52 0 type as in Ref. 10. They are both characterized by small LOCA from pump seals with failure of ECCS cooling injection (D) and failure of containment spray injection (C), which may include failure of spray recirculation system (F). The same failure events occur with TMLB' accident seal LOCA (failure of all ECC systems due to loss of site power).

in the TMLB' case the seal LOCA occurs 45 minutes after loss of site

! power; in the S2 D case a seal LOCA occurs as an initiating event, at t = 0, j followed by failure' of ECC injection and spray injection and recirculation j system failure. The S2 0 Ci r fir 1 case assumes early containment failure l (at 2.22 hrs) due to hydrogen burn overpressure (y case), the S2 0 Cir Fir 2 case assumes late containment failure (at 15 hrs).

l i

I

A-34 Figure A.3 from Ref. 10 shows for S 02 C r i(SARP) containment pressure increasing from 14.7 psia to 149 psi almost linearly during 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, when containment is assuned to rupture. At the RPV failure one can see (Fig. A 3),

a pressure spike with another spike at 2.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> (53 psi) due to hydrogen burning. Similarly, for the TMLB', seal LOCA case (IOCOR), given in Figure A.4 from Ref. 14, one can see a steep pressure rise at core uncovery (1.57 hrs) and another steep rise with a spike at RPV failure (3.8 hrs). Subse-quently, the pressure rises slowly to 149 psi, when the containment ruptures at 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> and very slowly (due to the assumption a small hole in contain-ment) loses pressure (IDCOR case). The containment rupture in SARP case (see Fig. A.3), occurs faster (at 24 hrs) and the containment pressure drops sud-denly, due to an assumed large hole in containment. The pressure in contain-ment for SARP 2S D Cir Fir 2 case behaves rather similarly as in SARP S 2D Cri case, except the containment ruptures faster, at 17.93 hours0.00108 days <br />0.0258 hours <br />1.537698e-4 weeks <br />3.53865e-5 months <br /> (see Fig.

A.5). On the other hand for the SARP S 2D Cir Fir 2 case the containment ruptures due to a pressure spike caused by hydrogen burn at 2.22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> (see Fig. A.6). No such spike is ever observed in the IDCOR calculations. The IDCOR TMLB'-8, seal LOCA case behaves similarly to the TMLB'-6 case, except the containment is assumed to be bypassed, with times of core melt and RPV failure about the same, as for IDCOR TMLB'-6 seal LOCA case.

The TMLB' (no LOCA) cases (Sequences 5 through 7 in Table A.8)

The IDCOR calculation of TMLB' (no LOCA) case show in Figure A.7 shows almost the identical pressure in containment, as shown in Figure A.4 for the TMLB' seal LOCA case. In comparison to this, the SARP results 9 for Zion TMLB1 and TMLB2 shown on Figures A.8 and A.9, indicates two pressure rises at core uncovery (1.88 hours0.00102 days <br />0.0244 hours <br />1.455026e-4 weeks <br />3.3484e-5 months <br />) and at RPV failure (2.83 hrs) which are similar to the same event in IDCOR calculations (2.2 and 4.0 hrs, respectively). After RPV rupture the containment pressure rises slowly in Figures A.8 and A.9 for the SARP case and at 16.7' hours reaches a maximum (time of the end of SARP calcu-lation). It appears that if the SARP calculations proceeded to about 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> the containment would rupture as in the IDCOR case (Figure A.7).

A-35 The Zion TMLU case (SARP) in Figure A.10 shows one small pressure peak at core uncovery (2 hrs) and large 149 psi peak at 3.16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, when the contain-ment ruptures due to hydrogen burn.

SLFC, ALFC and 10-AEFC (S,0) Accidents (Sequences 9 through 11 in Table A.8)

The containment pressure for SLFC accidents from IDCOR calculations (Fig-ure A.11) shows three peaks; one at 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (26 psia), the second at core uncovery (7.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 23 psi) and the third sharp peak at RPV failure (13.9 hrs, 34 psi). Figure A.12 shows that for ALFC accident (10COR results) there is only one main pressure peak at 3.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (35 psi), with some very small pressure peaks at 2.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> (RPV failure) since the reactor vessel is already depressurized.

After 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (SLFC) or 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> (ALFC) the pressure is slowly decreas-ing. Finally, the S 0-c2 accident (SARP results), Figure A.13 shows the number of small peaks between 18 and 25 psi pressure which occ'urs between 0 and 5.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> during the accident, with slowly dropping pressure after 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. 'All three accidents (SLFC = S H6, 2 ALFC = AH 6, S2 D-c) lead to relatively small loading of containment, without final containment failure (NCF), both for 10COR and SARP calculations.

A.3 Comparison of Accident Releases The fractional releases of core radioactivity inventory into the environ-ment from the previously discussed accidents are given in Table A.9. From the table, one can see that IDCOR TMLB'-6-seal LOCA and TMLB'-6-no LOCA releases are identical, if we compare those release with SARP-seal LOCA cases (see first three lines of Table A.9), we can see that IDCOR releases are one and two orders of magnitude smaller than SDCr 2 i and S2 D C i r Fi r 1 releases, respectively. On the other hand, the 10COR TMLB'-6-seal LOCA releases for I and Cs are all about 100 to 1,000 times larger than SD 2 Cr i releases (released at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) even if they are released later (32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br />). The SARRP and IDCOR predictions for the other elements are similar for the same conpared cases (see Te, Sr, Ru, La columns in Table A.9). Thus, the 10COR and SARP

A-36 releases often show remarkable di f ferences , due to different modeling approaches (particularly for I and Cs).

The SARRP uncertainty analysis was performed at BNL for the Zion plant.Il In this course of calculations the SURRY BIN matrix was used, depicting the containment performance of the plant. This matrix was extended from 15 bins (originally used for Surry in Ref. 17, Table D2) to 19 bins for Zion, where the last bins 16 to 19 represent the Surry bins 1 to 4 with containment fail-ure due to direct heating of the containmer,t. The bin table is given in Table A.10 and is explained in detail in Ref.17 for each bin. The code SOURCE was used at BNL, to produce approximate source terms for the 19 Zion bins. The results are given in Table A.11. These releases were obtained from the basic four STCP releases given in the BCL 10 results of Table A.9. The combinations of the releases for 19 bins were performed by the SOURCE code, which all ws calculation of radioactivity releases for early or late containment failure, with sprays operating or failed and with different containment failure modes given in Table A.10.

Several mechanisms have been identified by which there could be signifi-cant releases of Cs and iodine from the containment atmosphere at late times.

These include; (a) revolatilization from the RCS, (b) slow deposition of ini-tial releases from the RCS, (c) radioactive decay chains, (d) resuspension at containment failure, (e) retention in melt until af ter vessel failure. All of these mechanisms are lumped together as a " delayed release" for I and Cs in SOURCE.

Another inportant phenomena not modeled in the STCP methodology deals with radiological releases associated with high pressure melt ejection and direct containment heating.

If the primary siystem is pressurized at the time of vessel breach, fuel will be ejected under pressure in a process which can result in significant aerosol generation, as has been demonstrated experimentally. The SOURCE code also accounts for releases due to early containment failure by direct heating which was not modeled in the BCL results.10

A-37 In general, much higher releases are predicted by the SOURCE code, th&n in STCP calculations. Those higher releases are due to more volatile iodine (1,2 Hydrogen iodide, etc.), delayed release of I and Cs from the RCS, and the direct heating release attributed to high pressure ejection of corium from the RCS following high pressure sequences.

A.3.1 IDCOR and SARP Modeling Differences There are a number of differences bet een the IDCOR and the BCL computer model s. These differences are listed in the form of issues, which have been discussed by NRC and IDCOR staff in a series of meetings. These issues are listed in Table A.12. Out of the eighteen issues, a subset of eight have been -

identified that are appropriate to the subject of this section. Each issue is briefly discussed in the following sections. Differences between IDCOR and BCL will be identified and their significance indicated.

Invessel H, Generation (NRC/IDCOR Issue 5)

There are significant differences between the IDCOR and BCL predictions of H 2 generation during invessel core melting. During the early stages of core heatup and degradation (while the fuel rods are still in place in the core region), both IDCOR and BCL predict similar H 2 generation. However, after the fuel rods and cladding begin to melt and relocate in the bottom of the reactor vessel, the BCL analysis indicates, substantially, more H2 gener-ation than the IDCOR analysis. Of ten twice as much H 2 in the BCL analysis compared to IDCOR.

Hydrogen is important to containment loading because it is a conbustible and noncondensible gas. The larger amount of H 2 generated invessel in the BCL and SARRP analysis leads to a higher likelihood of hydrogen burning along with a higher likelihood of early containment failure.

Core Slump, Core Collapse, and Reactor Vessel Failure (NRC/IDCOR Issue 6)

The IDCOR core slump model assumes that after 40% of the core has nelted, it will relocate into the bottom of the reactor vessel, which will then

A-38 rapidly fail due to local penetration failure. Thus, only a small fraction of-the core will be initially released from the reactor vessel. The remainder of the core melts down over a rauch larger time period. On the other hand, the BCL core slump model assumes total collapse of the core into the bottom of the reactor vessel after 75% of the core is predicted to melt. Thus, all of the core debris is available to be released when the vessel is predicted to fail in the BCL model. This modeling tends to increase the hydrogen available for detonation / deflagration at vessel break (Issue 5), and the potential for direct heating (Issue 8) as well as promote a more rapid core / concrete attack (Issue 10) with more aerosol generation (Issue 9).

Direct Heating of Containment (Issue 8)

The pressure rise in containment due to direct heating is directly pro-portional to the quantity of core debris dispersed from the reactor vessel.

The BCL analysis predicts significantly more debris release at vessel failure than the IDCOR analysis. Thus the potential for early containment failure due to direct heating is higher in the BCL analysis.

The assumption that all the core debris is released at vessel failure (BCL analysis) is clearly conservative and the SARP il uncertainty study has addressed the probability of small debris fractions. The IDCOR results appear ,

to be too optimistic considering the lack of supporting large scale experi-ments. However, spray operation may reduce the pressure pulse associated with direct heating by flooding the reactor cavity and would help quench the core debris. Containment sprays and containment cooling are thus very important to the timing and mode of containment failure.

i l

Exvessel Heat Transfer Model from Molten Core to Concrete (Issue 10)

Almost all cases analyzed by IDCOR assume that the reactor cavity is flooded by water from containment sprays. This mechanism allows hot debris to drop from the failed RPV into water and form a coolable debris bed under water. The solidified debris is assumed to stay solid without further attack-

[ ing the concrete. In the BCL analyses the spray is assumed to fail and the debris attacks concrete continually.

l l

t

A-39 We regard the IDCOR assumption as overly optimistic given the lack of large scale debris coolability data. If the debris is not cooled, it will attack concrete and produce noncondensible gases, even if the top surface of the debris is covered by water. In view of the uncertainty, the slow pressur-ization of the containment resulting from the coolable debris assumption in the IDCOR analyses appears to be unjustified and the potential for the rapid containment pressurization in the BCL analyses should be considered. The SARRP uncertainty study ll has assigned weighting factors to the various possi-ble combinations of containment spray operation and debris cooling. Most of the risk was found to come from early containment failure due to direct heat-ing.

Containnent Failure Due to Hydrogen Deflagration (Issue 17)

In the IDCOR analysis hydrogen deflagrations do not occur. This is due to the small amounts of hydrogen generated (about 1/2 of the BCL9 .10 predic-tions).

BCL predicts substantial hydrogen generation and subsequent combustion but even with hydrogen combustion the containment pressure is substantially below the failure point.

Containment Performance (Issue 15) i For those cases with failure of the containment heat removal system, the containment eventually overpressurizes and IDCOR assumes that a relatively small opening will occur which allows gradual leakage of the containnent atmo-sphere to the auxiliary building. By comparison the BCL analysis assumes an l

opening large enough (7 ft2 ) to rapidly depressurize the primary containment.

These differences result in substantial differences in the estimated decon-tamination factor for the auxiliary building.

Fission Product Release Prior to Vessel Failure (Issue 1)

Both studies predict similar releases of the more volatile fission prod-ucts during invessel core degradation with the exception of Te. (IDCOR i

l

A-40 predicts about 1/10 releases of BCL for Te for TMLB'-6). However, in the 10COR analysis, Rb, Zr, Pu, La, Ba, Y, Tc, Rh, and Pd were omitted from the in-vessel release. This IDCOR omission will lead to somewhat smaller environ-mental doses than in the BCL cases. IDCOR has agreed to account for these omissions in future calculations.

Fission Product and Aerosol Retention in the Primary System (Issue 4)

Differences in the initial primary system retention predicted by IDCOR and BCL are not too significant and differ by less than a factor of two. In the BCL modeling it is assumed that fission products retained in the primary system at the point of vessel failure are retained permanently. In the IDCOR analysis of the Peach Bottom plant, revaporization of these fission products after vessel failure was modeled.18 This revaporization is not used in IDCOR nodel for Zion since the higher heat losses from the primary system are pre-dicted to keep the Zion primary system relatively cool.

Exvessel Fission Product Release (Issue 9)

There are significant differences between the IDCOR and BCL analyses for fission product release as a result of core / concrete interactions. The higher releases of Sr (and also La, Ce and Ba groups) in Table A.9 in the SARP analy-ses are -due to the modeling of exvessel fission product rel ease. Fission product release and inert aerosol generation during core / concrete interactions was not modeled in the IDCOR analysis. IDCOR argued that even for a dry cavi-ty the aerosol generation during core / concrete interactions would increase aerosol density in containment and increase aerosol agglomeration or settling, thus reducing the predicted environmental release fractions relative to those predicted without this additional aerosol source. We do not consider that this IDCOR argument has been adequately supported. In addition, the IDCOR predicted core debris temperatures during core / concrete interactions are very high. Based on experimental evidence one would expect the release of sone of the refractory fission product groups at these elevated temperatures. The BCL and SARRP analyses currently model the release of the refractory fission prod-ucts and the inert aerosols and the environmental release fractions are sig-nificant (refer to Table A.9).

A-41 A.4 Offsite Consecuences The estimated risk results for Zion are summarized in Table A.14. The IDCOR results indicate that the large dry containment is very effective in mitigating fission product releases and the offsite consequences are quite small. However, the SARRP il consequence results are very different than IDCOR for Zion.

The major differences between SARRP and IDCOR appear to be containment performance and releases during core concrete interaction. The overall con-tainment failure probability produced by SARRP is shown in Figure A.12.

SARRPll estimates that there is about a 4% chance of early containment failure for Zion core damage sequences. A comparison of containment failure probabil-ities is given in Table A.14 As shown in Figures A.14 and A.15, SARRP ll pre-dicts that there is only about a 2% chance of late containment failure as long as one or more containment heat removal systems (F and C for fans and sprays, respectively) are operational. For the SE damage state there is no water in reactor cavity so there is a substantial likelihood of containment faifure (SARRP estinates a range of 5 to 80%). For late containment failure sequences the releases from core concrete interactions tend to be important contributors to risk. IDCOR assessed the probability of early containment failure to be negligible. The overall risk appears to be fairly consistent with previous studies of Zion except IDCOR which is two orders of magnitude lower.

A.5 Sumnary and Risk Insights A.5.1 Core Danage Profile Generally, as in other PWRs, transients (including station blackout),

service water failure and small LOCA dominate the core damage risk profile for the Zion plant. It is particularly noteworthy that loss of component cooling water which may lead to a RCP seal LOCA sequence under high pressure injection failure is the most predominant contributor to the core damage in both the Zion Review and the SNL study. This is a result of two conservative consider-ations in (a) the quantification of the CCWS pipe rupture frequency and (b) the assumption that loss of component cooling water leads very promptly to a

A-42 sizable seal LOCA. It is also noted that the small LOCA is an important con-tributor to core damage. It is also important to note that the major differ-ences in quantitative results among the studies result from the difference in modeling assumptions and level of detail and scope rather than plant differ-ences or data differences.

Although there are a large number of contributing sequences there is a reasonable expectation that if these initiators can be minimized, then the overall core damage frequency will be controlled to a minimum. As in Refer-ences 8 and 19, this principle is used in Sections 3 and 4 of this report to develop preliminary guidelines and proposed criteria to reduce the overall core damage frequency-(Goal 3).

It is recognized that the qualitative accident sequence descriptors are rather general and broad and that similar hardware functional requirements and operator actions in the large dry plants would lead to the same general acci-dent sequences, a plant-specific examination (such as a failure mode and effects analysis coupled with a fault tree / event tree analysis) is needed in order to identify the plant specific vulnerabilities (e.g., in maintenance practices, operator training, and emergency operating procedures) to con-tribute to a given general sequence descriptor.

A.S.2 Consequence Analysis The assessment of core meltdown phenomena and containment response indi-l cates that the large dry containment provides a robust defense against early severe accident pressures and temperatures. However, differences in the IDCOR and BCL/SARRP assessments of containment response and fission product release result in major differences in the predicted offsite consequences. The IDCOR assessment indicates that the containment will only fail very late in the accident sequence if'it fails at all. BCL/SARRP predict the possibility of much earlier containment failure and much higher releases. The overall risk estimatedll for Zion is dominated by the early containment failure sequences which in turn is dominated by the perceived possibility of direct containment heating.

A-43 If the containment does not fail early, SARRP considers the likelihood of containment failure to be low (about 2".) due to the redundant and diverse con-tainment heat removal systems and the availability of long term coolant sup-plies.

A.6 References

1. "IDCOR Technical Report 21.1 Risk Reduction Potential," Energy Incor-porated, June 1985.

2. Wheeler, T. A. , " Analysis of Core Damage Frequency From Internal Events:

Zion Unit 1," Sandia National Laboratories, NUREG/CR-4550, Volume 6, Final Draft, July 1986.

3. Berry, D. L. et al., " Review and Evaluatien of the Zion Probabilistic Safety Study, Volume 1," Sandia National Laboratories, NUREG/CR-3300, SAND 83-1118, Vol. 1, May 1984

4. " Zion Risk Evaluation," USNRC NRR Staff Report, August 1985.

5. " Zion Probabilistic Safety Study," Commonwealth Edison Conpany, NRC Dockt.t Nos. 50-295 and 50-304

6. Fleming, K. N. et al., " Classification and Analysis of Reactor Operating Experience Involving Dependent Events," Pickard, Lowe and Garrick, Inc.,

EPRI NP-3967, June 1985.

7. Pratt , W. T. et al., " Review and Evaluation of the Zion Probabilistic Stud3 ,, Volune 2, Containnent and Site Consequence Analysis," NUREG/CR-3360.' BNL-NUREG-51677, Volune 2.

83 Cho, N. et al.~, " Prevention and Mitigation of Severe Accidents in a PWR

/ with an Ice Condenser Containment," Brookhaven National Laboratory, Draft, November 1986.

A-44

9. Gieseke, J. A. , Cybulskis, P. , Denning, R. S. , Kuhlman, M. R. , Lee, K.

W. and Chen, H., "Radionuclide Release Under Specific LWR Accident Con-ditions," BMI-2104, Volume VI, PWR-Large, Dry Containment Design (Zion Plant), Battelle Columbus Laboratories, Columbus, July 1984

10. Denning, R. S. , Gieseke, J. A. , Cybul skis , P. , Lee, K. W. , Jordan, H. ,

Curti s , L. A. , Kelly, R. F. , Kogan, V. and Schmacher, P. M. , " Report on Radionuclide Release Calculations for Selected Severe Accident Scenarios to U.S. Nuclear Regulatory Commission," NUREG/CR-4624, BMI-2139, Vol. 5, Battelle Columbus Division, July 1986.

11. Khatib-Rahbar, M. et al., " Evaluation of Severe Accident Risks and Potential for Risk Reduction: Zion Power Plants," Brookhaven National Laboratory, NUREG/CR-4551, BNL-NUREG-52029, Vol. 5, September 1986.

12. " Preliminary Assessment of Core Melt Accidents at the Zion and Indian Point Nuclear Power Plants and Strategies for Mitigating Their Effects,"

NUREG-0880, USNRC, Vol .1, October 1981.

13. Pratt, W. T. and Bari, R. A., " Containment Response During Degraded Core Accidents Initiated by Transients and Small Break LOCA in the Zion / Indian Point Reactor Plants ," NUREG/CR-2228, BNL-NUREG-51415, BNL, May 1981.

14. " Zion Nuclear Generating Station & Integrated Containment Analysis,"

IDCOR Technical Report 23.1.

15. U.S. Nuclear Regulatory Commission, " Reactor Safety Study (RSS)," WASH-1400, 1975.

16. Fauske and Associates, " Evaluation of Containment Bypass and Failure to' Isolate Sequences for the IDCOR Reference Plant," Draft, July 1984

17. Silberberg, M. , Mitchell, J. A. , Meyer, R.- 0. , Pasedag, W. F. , Ryder, C. P., Peabody, C. A. and Jaukowski, M. W., " Reassessment of the Techni-cal Bases for Estimating Source Terms," USNRC, NUREG-0956, July 1986.

A-45

18. " Peach Bottom Atonic Power Station - Integrated Containment Analysis,"

IDCOR Technical Report J23./PB, March 1985.

19. Pratt, W. T. et al., " Prevention and Mitigation of Severe Accidents in a BWR-4 with a Mark I Containment," Brookhaven National Laboratory, Draft, October 1986.

20. Benjanin, A. S. et al., " Evaluation of Severe Accident Risks and the Potential for Risk Reduciton: Surry Power Station, Unit 1," Sandia National Laboratories, SAND 86-1309 (Draft, May 1986).

M

RHR HX ~ SFP HX __, Containment Fan Coolers o

Pump Seals &

Oil Coolers  : CCWS HX  : SWS Emergency (51,RHR) DGs

?

Motor-driven $; ;t

.AFWS Pumps i Charging Pump I':

Seals & 011 ~

f

}y Coolers --

i ESF Pump

_.- Room Coolers RCP Seal RCP Thermal _

~

CS Pump Diesel CS Pump Motors Injection Barrier a

l i

l Figure A.1 A heat and fluid flow diagram for Zion.

I e r 5

.O CONDITIONRL ERRLY FRILURE PROB'RBILITY "o _

! 0 5- D i

95th percentile 23 i mean 7

>, a _ I.; median ,

4 U ~! i d :

cn o .

g;gy 3: 5th percentile 0'

' 5 m

o l 37

~

f 2-I I

Figure A.2 Conditional probability of early containment failure: all sequences included.Il

ZION S2DCR1 160.0 140.0 -

4 s

i i CO 120.0 -

k$

Z h

m 100.0-N Z

A 80.0-P E~

Z e

[2] 60.0-A Z

s

[ 40.0-Z o

20.0- i 00 0.0 2d0.0 4$0.0 6$0.0 8$0.0 10b0.0 12b0.0 14b0.0 16b0.0 18b0.0 2000.0 TIME - (MINUTE)

Figure A.3 Containment pressure response for 5 DCR 2 sequence (SARP).IO k

4

ZION THLB/ SEAL LOCA ..

n Ln oN X  :

N _

m (n  :

O. -

in In in "

Ld  :

Q:  :

Q. _

H  : "

E" ---

E F

Z -

o .  :

U -

8 .

5-o : _

6 $ in nlin in. ..liiniinilin niiiil o.. niilniini nli n n iinli... n nliini sini.. ni ..I O- O 50 1 15 2 25 3 3.5 4 45 5 TIME HR xlO '

2 Figure A.4 Containment building pressure (IOCOR).1" (Note the scale 2.5x10 psi and 5x10 1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, used in all IDCOR figures.)

j i

~

\

l 1

ZION S2DCF2 i

160 0 i

k 140.0 -

.--4 l (D l Q4 '

12 0.0 -

h5 l Q:

i (n

100.0 -

i N Q$

l m 80.0-i E-4  ?"

i Z $

i M 60.0-7.

.-4

% 400-z

O O

20.0- (

L OO , , , , , , [

0.0 200.0 - 400.0 600 0 800.0 1000.0 1200.0 1400.0 TIME - (MINUTE)

Figure A.5 Containment pressure response for S DCR 2 sequence with late containment failure (SARP).IO v -

,b N

a l

)

P R

A S

(

e r

u l

i a

f 0

b t n

e m

n i

a t

n o

0 c y

1 F b )E T l

r a

e C U h D N t i

w 2 0. I e S b4 (M c n

e u

- q e

N E s

g O

0 M I

C D

2 I 0 S dT Z _

3 f

r o

e

_ s n

o p

0 s 0 e g 0 r

- 2 e

r u

s s

e r

0 p 0 t d1 n e

m

, n i

a t

n o

0 C 0

- - - - - - 6 0 0 0 0 0 0 0 0 A 0 0 0 0 0 0 0 0 4 2 0 8 6 4 2 e 6 1 1 r 1 1 u g

i F

AM4 r4Z@mdZa p dsZM%ZOU E  :

i' , iII ;iI; ,

O ZION THLB /NO LOCA -

, tn oN  :

x :_

- 1

~

N _

in 1  :

en In ma i -

1 s  : >

r" : -

t,,

~

I--

Z -

O  :

U -

l 8.

2 t

l O  :

d ii....,,,l...,,,,,,l ........l.........l ....... I,,,,,,,,,1.,,,,,,,,1,,,,,,n ,1,,,,,,,,,l,,,,,,,,,i 0- 0 50 1 15 2 2.5 3 35 4 45 5 i

TIME IIR xlO '

l Figure A.7 Containment building pressure (IDCOR).1" 1

I e

A-53 o

~

e S

A 5

_g 5

5

=

C"

= .N

.5 8

o 3 5

5

• e E E 6 e

& Er E

A -

• e. .e a

g 2 - -

b $ 8

% o* G E

e 8

_g

- e E

=

o C t

m T

E o .5

-8 c 0

~

I

, , i i i i i 8 d

. i o o o e A A Q Q A o '

s- 9 $ .R 8 S S R 2 2 .}

w l

j e pd 'aJnS50Jd SUOW4JPdWO3 [9401 l

- - _ - . - - - - - _ . _ _ - - _ - _ - . - . . - . . - _ . - ~_ __- .- ___- _ . _ - _ - _ - _ . . - _ . _ . - , _ _ _ . _ _ _ _ . _ . - .

d ZTMLB2

] 12 0.0 100.0 -

e i a I

. . 80.0-

. E'

! a E

o C1.

y 60.0-

$ P l

t' .$

l 1

E o 40.0 - ,

"e l o i

! 20.0-R0 , , , , , , , , i a0 100.0 200.0 300.0 400.0 500.0 600.0 'l00.0 800.0 900.0 1000.0 i Time, min i Figure A.9 Pressure in containment for Zion TMLB' sequence with direct concrete attack (SARP).9

• l

A-55 o

o

=

1 o  %

-@ E S

5

=

o if z

D a

e5E W ogE~ -

4 -8 c~wz e' E-d i Z o i  :=

O -8 e H '89 e

e h

N - -

E~ g o u

_g o t E

.5 o  ;

• -g "

o m

S d

' o e

. m j o O o o

o f o' o o

. .o o

e o

o u 8 g g a

, g e VISd '2EDSS2Ed IN2KNIVIgo3

l ZION GLFC tn o

n : -

X :_

-n

~

i tn  :

Q, _

Ln _- l g

wW:-

W m. r

. e i Q. / . a t-s

ls .

y r

Z  : ,/ x .,

'A W

E m  :

,I x N.s_ ~ . ~ .,

N ~. 's.__ ,

P m

cn z -l

.# s.,

- x._,

< J w i i--  %

Z N.

s O

y ina f._

,, l.....Ii.....,11......l.......!.......l.........l..,,,,,,l.,,,,,,,: 1.....,o.i._,_ .

O. O 20 0.40 0 60 0 80 1 1.2 1.4 1.6 18 2.0 TIME HR  :< 10

• Figure A.11 SLFC containment pressure (IDCOR).1" i

e

O .

>a~

i 0

1 i

s i

t i

n i

l i

9 i

i n

i i

s l

i 8

- t i

t i

i n

i

' s I

7 I' i

n

)

i R s O

- e C i D s I n (

6 R

I i

e r

C i i

l i u F i i

s s

L i i

E e r

A l i

5 M p i I t n

N i i

T e m

O i i

i i

n I i a

Z i i 4 t

n l

o N

\ -

i i

i c

s i C i F A i L

/ i A i

l i 3 i

2 1

i

/ i A

/ i

/ i i

e r

/ i i u g

_. i 2 i Nli i F i

i i

i

-' i

' i s\ i I

\ l i

\s\

i i

i i

\ i

_:.:il6 .t

\'\s_-

'l

- _-  : - - - ~ -

i i

O

_:___~

)

n t- "f W ~

w t

- ga. W& mmWMg >=EpzaU "OX

ZION S2D 24.0-s

! Om 22.0-i J h

t 2'

! 20.0-U

1. ?

l f 8; E

!! 18.0 u 5

! E i

! t-16.0 -

l 14.0 , , , , , , ,

0.0 100.0 200.0 300.0 400.0 500.0 600.0 700.0 800.0 Time, min Figure A.13 Containment pressure response for Zion S 20 sequence with containment sprays and concrete attack by core debris (SARP).9 1

e O

4 RESULTS FOR BINS 1:5 RND 16:19 RLL. DATA SEFC AEFC TEFC SEC SE SYMBOLS:

o- -

I- o o '-

f E l 5 - 95% LLH Range

'l -

a o ,

1 h D h

,N- - a-- '-B- 8 -o- --- MediaTi LLH Value S "

3 ..  : -- 8 0

o X Base Case (OCP a

j 0 n 0 Central) Estimate

,- 0 ,

g 3

, g. g ..: -

--M-.

o 9 : o O l}

I f g _.8., 8 _ _{l_ _

irez _o_ , H _IL t 8 ,

a E o o *

o a o -e---

o_.-

r X

91 X X X X

~

e  ; . . -

S- . .

4.0 6.0 8.0 10.0 12.0 14.0 16.0 0.0 2.0 DRMOGC STflTE Figure A.14 Comparison of LLH and point-estimate results for conditional probability of early containment failure (Bins 1 - 5 and 16 - 19)'for five representative plant damage

' states.Il i

N s

] .

1 RESULTS FOR BINS 8:10 RLL;DATR -

i

. SE SEFC AEFC TEFC SEC

! o_  !

~j 1

__.g _ SYMBOLS:

6 :

I . 5..95%'LLH Range g

9- 8 - n --, D, g --- Median LLH Value E o

., o . . g. .

- n o X Base Case (OCP l -

,'97 D. Central) Estimate i o '

EE i

$f - -M - --%-  % X

• ?

i Wo-u- .g i  ! 8 g --g-- 8

- a

~

r

Si

-

l

,1 l

9 7 7 7 7 7 , ,

0.0 2.0 1.0 6.0 8.0 10.0 12.0 14.0 16.0 j

• DAMAGE STATE .

I Figure A.15 Comparison of LLH and point-estimate results for conditional . probability of late .3 containment failure (Bins 8 - 10) for five representative plant damage' states.31

.o 1 i

l Table A.1 Design Comparison of Nuclear Power Plants With large Dry Containments 1

Zion Surry Oconee Owner Commonwealth Edison Virginia Electric & Power Duke Power Lake County, Illinois Surry County, Virginia Oconee County, South Carolina Site 2441 MWt 2568 MWt Capacity 325D MWt 4 Loop' Westinghouse PWR 3 Loop Westinghouse PWR 2 Loop Babcock & Wilcox PWR Type (2 Units) (2 Units) (3 Units)

Containment Large, Dry Large, Dry, Subatmospheric Large, Dry LPIS & LPRS 4 Accumulators 3 Accumulators 2 Core Flood Tanks 2 RHRS Pumps 2 2 RHRS Pumps 3 DHRS Pumps l 2 CS Pumps 2 RBS Pumps CSIS & CSRS 3 CS Pumps 3 2 S1 Pumps 3 Charging Pumps 3 Centrifugal Charging Pumps i HPIS & HPRS 2 Centrifugal Charging Pumps 5 RCFC Fan / Cooler Units 4CSRS Pumps with 4 CHRS HXs 3 RBCS Fan / Cooler Units CHRS 2 Motor-Driven Pumps 2 Motor-Driven Pumps 2 Motor-Driven Pumps AFWS 1 Turbine-Driven Pump 3" 1 Turbine-Driven Pump 1 Turbine-Driven Pump 2 Essential Power Divisions 3 Load Divisions with 2 Hydro- 53 EPS 3 Essential Power Divisions with l 2 (Dedicated) + 1 (Swing) Diesel with 1 (Dedicated) + 1 electric Generators and 1 Generators (Swing) Diesel Generators Transmission System from a Steam Station

6 Low Pressure SW Pumps Shared CCWS 5 Pumps & 3 HXs Shared by Both 4 Pumps & 4 HXs Shared by-Units Both Units by 3 Units with a Backup _from 6 Punps Shared by Both Units 8 Pumps & 3 Diesel Pumps 3 High Pressure SW Pumps' ESWS Shared by Both Units 4

1 Design parameters are for a unit unless otherwise noted.

2No associated heat exchangers in recirculation loops.

3The 3rd pump is a direct-driven diesel pump.

4 Component Cooling Water System in Dconee is used mainly for cooling.of the RCP thermal barrier.

1 4

i ,

A-62 Table A.2 IDCOR Baseline Core Damage Profile Core Melt Plant Damage Rank Sequence Frequency (yr-1) State 1 Small LOCA, failure of recirculation cooling 1.6E-5 SLFC 2 Seismic, loss of all ac power 5.6E-6 SE 3 Large LOCA, failure of recirculation cooling 4.9E-6 ALFC 4 Medium LOCA, failure of recirculation cooling 4.9E-6 ALFC 5 Fire in the AEE room with safety system malfunctions 2.8E-6 TEFC 6 Fire in the cable spreading room with loss of fans 1.8E-6 TEC 7 Spurious safety injection, failure to control safety injection, recirculation 1.5E-6 SLFC cooling (1.64E-6)*

8 Spurious safety injection, loss of offsite 1.5E-6 SLC power, loss of ESF Buses 148 and 149 (1.43E-6)*

9 Large LOCA, failure of low pressure injection 1.3E-6 AEFC 10 Medium LOCA, failure of low pressure 4.3E-7 AEFC injection (4.36E-7)*

11 Loss of main feedwater, loss of offsite power, loss of ESF Buses 148 and 149 2.9E-7 TEC 12 Reactor trip, loss of offsite power, loss of ESF Buses 148 and 149, auxiliary feed- 2.1E-7 TEC water failure (2.23E-7)*

13 Turbine trip, loss of offsite power, loss of ESF Buses 148 and 149, auxiliary feed-water failure

• 2.1E-7 TEC 14 Turbine trip due to loss of offsite power, loss of all ac power, auxiliary feedwater failure 2.0E-7 TE(TMLB')

A-63 Table A.2 (Cont'd) . IDCOR Baseline Damage Profile Core Melt Plant Damage Rank Sequence Frequency (yr-1) State 15 Loss of main feedwater, auxiliary feed-water failure, failure of feed and bleed 1.4E-7 TEFC cooling (1.33E-7)*

16 Interfacing systems LOCA (Residual Heat Removal Systen Inlet Valves) 1.1E-7 VL-17 Medium LOCA, failure of low pressure injection, containment spray injection and containment fan coolers 6.9E-12 AE 18 Spurious safety injection, failure of recirculation cooling, failure of containment sprays 2.5E-9 SLF Totals 4.2E-5 (3.2E-5)**

• Values shown inside parentheses correspond to those in ZPSS.

• • Internal events only. , _,

i i

l l

}

[

l

A-64 Table A.3 Zion Review Core Damage Profile Rank Sequence Core Melt Plant Damage Frequency (yr-1) State 1 CCW failure, causing failure of all charging and SI pumps, seal LOCA 2.0E-4 SEFC 2 Loss of offsite power, failure of component cooling water, failure to recover offsite power in four hours (recovery prior to eight hours) 4.6E-5 SEFC 3 Loss of offsite power, failure of component cooling water, failure to recover offsite power in one hour (recovery prior to four hours) 4.0E-5 SEFC 4 Loss of offsite power, failure of component cooling water, failure to recover offsite power in eight hours, failure of containment fans 1.8E-5 SEC 5 Small LOCA, failure of recirculation cooling 1.6E-5 SLF 6 Loss of offsite power, failure of component cooling water, failure to recover offsite power in eight hours 7.9E-6 SEFC 7 Failure of dc bus 112, causing failure of one PORV and loss of ac bus 149, failure of auxiliary feedwater 7.0E-6 TEFC 8 Seismic, loss of all ac power 5.6E-6 SE 9 Large LOCA, failure of recirculation cooling 4.9E-6 ALF 10 Medium LOCA, failure of recirculation cooling 4.9E-6 ALF 11 Loss of offsite power, failure of component cooling water, failure to recover offsite power in eight hours, failure of containment sprays and fan coolers 4.7E-6 SE 12 Large LOCA, failure of low pressure injection 1.4E-6 AEFC

~

A Table A.3 (Cont'd) $1on Review Core Damage Profile Core Melt Plant Damage Rank Sequence s Frequency (yr-1) State 13 . Loss of offsite power, failure of auxiliary feedwater, failure of feed and bleed, failure to restore offsite power in four hours -(recovery prior to eight hours) s 1.1E-6 TEFC 14 Loss of offsite power, failure of i auxiliary feedwater, failure of feed and bleed, failure to restore ac power in one hour (recovery prior to four

^

hours) 1.0E-6 TEFC 15 Interfacing system LOCA 1.1E-7 V Total 3.6E-4 (3.54E-4)*

• Internal events only.

"A

'% \

s g

\

9 O

e t

4

i A-66

' Table A.4 C'mparisons o of Dominant Accident Sequences Obtained by SARP Rebaseline, Zion Review and IDCOR-Baseline Rank Core SARP Melt Plant Rebase- Zion IDCOR Frequency Damage line Review Baseline Sequence- (y r- 1) State 1 1 -

CCW failure, causing failure of 1.2E-4 SEFC all charging and SI pumps, seal (2.0E-4)* (SEFC)*

LOCA-2 5 1 Small LOCA, failure of recir- 1.6E-5 SLFC culation cooling (1.6E-5) , (SLF)

((1.6E-5))* ((SLFC))*

2 Seiwaic, loss of all ac power ((5.6E-6)) ((SE))

3- 9 3 Large LOCA, failure of recir- 4.9E-6 ALFC culation cooling (4.9E-6) (ALF)

((4.9E-6)) ((ALFC))

4 10 4 Medium LOCA, failure of recir- 4.9E-6 ALFC culation cooling (4.9E-6) (ALF)

((4.9E-6)) ((ALFC))

5 Fire in the AEE room with ((2.8E-6)) ((TEFC))

safety system malfunctions 5 14 -

Loss of offsite power, failure 2.1E-6 TEFC of AFWS, failure of feed ano (1.0E-6) (TEFC) bleed, failure to restore ac power in one hour (recovery by four hours) 6 Fire in the cable spreading ((1.8E-6)) ((TEC))

room with loss of fans 7 Spurious safety injection, ((1.5E-6)) ((SLFC))

f ailure to control safety injection, recirculation cooling

- - 8 Spurious safety injection, ((1.5E-6)) ((SLC))

4 loss of offsite power, loss of ESF buses 148 and 149 6 12 9 Large LOCA, failure of low 1.4E-6 AEFC pressure injection (1.4E-6) (AEFC)

((1.3E-6)) ((AEFC))

A-67 Table A.4 (Cont'd) Comparisons of Dominant' Accident Sequences Obtained by SARP Rebaseline, Zion Review and IDCOR-Baseline Rank Core

, SARP Melt Plant Rebase- Zion IDCOR Frequency Damage line Review Baseline Sequence (y r- 1) State 7 13 -

Loss of offsite power, failure 4.6E-7 TEFC of AFWS, failure of feed and (1.1E-6) (TEFC) bleed, failure to restore ac power in four baurs (recovery by eight hours) 10 Medium LOCA, failure of low ((4.3E-7)) ((AEFC))

pressure injection 8 3 -

Loss of offsite power, CCW/SWS 3.2E-7 SEFC l loss, failure to restore ac (4.0E-5) (SEFC) in one hour (recovery by four

hours) 9 - -

Same as sequence 8, only this 3.0E-7 SE represents the SWS common mode (----) (--)

portion of the rebaselined Zion Review sequence no. 3 11 Loss of main feedwater, loss of ((2.9E-7)) ((TEC))

offsite power, loss of ESF buses i

148 and 149 s

12 Reactor trip, loss of offsite ((2.1E-7)) ((TEC))

power, loss of ESF Buses 148 and 149, AFW failure I

13 Turbine trip, loss of offsite ((2.1E-7)) ((TEC))

power, loss of ESF Buses 148 and 149, AFW failure f

14 Turbine trip due to loss of ((2.0E-7)) ((TE or i offsite power, loss of all ac TMLB'))

power, AFW failure 10 11 -

Loss of offsite power, CCW/SWS 2.0E-7 SE

! , loss, failure to restore ac (4.7E-6) (SE) power in eight hours, failure of j containment sprays and fan coolers 11 2 - Loss of offsite power, CCW/SWS 1.5E-7 SEFC loss, failure to restore ac (4.6E-5) (SEFC) l power in four hours (recovery by eight hours)

- ------.- -.._- . . , - - . -.--_.,,-,,..,,,...,-n,.,. - . , . _ , . . . . . - . , , , . , , - , . - . - . - . , , - . . - _ . , , , - , = - - - - -

. , . . -. ~ . -, . --. . . - _-

J. -

A-68 Table A.4'(Cont'd) Comparisons of Dominant Accident Sequences Obtained by SARP.Rebaseline, Zion' Review and IDCOR-Baseline r'

Rank ' Core SARP . Melt Plant 4 - Rebase- Zion IDCOR Frequency Damage

- line Review Baseline Sequence (yr 1) State

12 - -

Loss of offsite power, failure 1.5E-7 SE

,. of SWS, failure to restore ac- (----) (--) '

power in eight hours. This se-quence represents the SWS por--

tions of the rebaselined Zion Review sequences no. 4 and no. 6 l'5 Loss of main feedwater, AFW ((1.4E-7)) ((TEFC))

j failure, failure of feed and

bleed cooling 13 4 -

Same as sequence 12 above, only 1.0E-7 SEC this is the CCW portion of the (1.8E-5) (SEC) rebaselined Zion Review sequence no. 4

~

i 14 16 Interfacing systems LOCA 1.0E-7 V (1.0E-7) (V)

((1.1E-7)) ((VL))

15 7. -

Failure of dc Bus 112, causing 5.0E-8 TEFC loss of one PORV and loss of ac (7.0E-6) (TEFC)

Bus 148, failure of AFW 16 - -

.Same as sequence 11,'only this 4.8E-8 .SE .

represents the SWS common mode portion of the rebaselined Zion

(----) (--)

Review sequence no.'2 17 6 -

Loss of offsite power, CCW 3.7E-8 SEFC

failure, failure to recover ac (8.0E-6) (SEFC)

{. power in eight hours I - -

17 Medium LOCA, failure of low ((6.9E-12)) ((AE))

i pressure injection, containment spray injection and containment

, fan coolers

- - 18 Spurious safety injection, ((2.5E-9)) ((SLF))

failure of recirculation cool-

, ing, failure of containment i

sprays h

v.-,+, +-.-e a .-m . , , - - - - - , . . , ..-- --.---.n, , . - . , . . . . . , . -,-,----,,--.w.--.,-.n.e,,mnn,, ,,.,-a_,-,-n,--v,- . , , - - -, .

A-70 Table A.5 Comparison of Dominant Core Damage Frequency for Zion (Per Reactor Year)

SARP Pl ant se- IDCOR Damage N o '. Sequence Baseline State 1 CCW failure, causing failure of all charging and SI pumps, seal LOCA 1.2E-4 --

• SEFC 2 e nall LOCA, failure of recirculation cooling 1.6E-5 1.6E-5 SLFC 3 Large LOCA, failure of recirculation cooling 4.9E-6 4.9E-6 ALFC-4 Medium LOCA, failure of recirculation cooling 4.9E-6 4.9E-6 ALFC 5 Loss of offsite power, failure of AFWS, failure of feed and bleed, failure to restore ac power in one hour (recovery by four hours) 2.1E-6 --- TEFC

- Spurious safety injection, failure to control safety injection, recirculation cooling ---

1.5E-6 SLFC Spurious safety injection, loss of offsite power, loss of ESF buses 148 and 149 ---

1.5E-6 SLC 6 Large LOCA, failure of low pressure injection 1.4E-6 1.3E-6 AEFC 7 Loss of offsite power, failure of AFWS, failure of feed and bleed, failure to restore ac power in four hours (recovery by eight hours) 4.6E-7 ---

TEFC Medium LOCA, f ailure of low pressure injection ---

4.3E-7 AEFC 8 Loss of offsite power, CCW/SWS loss, failure to restore ac in one hour (recovery by four hours) 3.2E-7 ---

SEFC 9 Same as sequence 8, only this represents the SWS common mode portion of the rebaselined Zion Review sequence no. 3 3.0E-7 ---

SE Loss of main feedwater, loss of offsite power, loss of ESF buses 148 and 149 ---

2.9E-7 TEC

- Reactor trip, loss of of fsite power, loss of ESF Buses 148 and 149, AFW failure ---

2.1E-7 TEC

s -

A-71 Table A.5 (Cont'd) Comparison of Dominant Core Damage Frequency for Zion (Per Reactor Year)

SARP Plant Rebase- IDCOR Damage No. Sequence line Baseline State Turbine trip, loss of offsite power, loss of ESF Buses 148 and 149, AFW failure ---

2.1E-7 -TEC.

Turbine trip due to loss of offsite power, loss of all ac power, AFW failure ---

2.0E-7 TE 10 Loss of offsite power, CCW/SWS loss, failure to restore ac power in eight hours, failure of containment sprays and fan coolers 2.0E-7 ---

SE 11 Loss of offsite power, CCW/SWS loss, failure to restore ac power in four hours (recovery by eight hours) 1.5E-7 ---

SEFC 12 Loss of offsite power, failure of SWS, failure to restore ac power in eight hours. This sequence represents the SMS portions of the rebaselined Zion Review sequence no.4 and no.6.

of Table A.4 1.5E-7 ---

SE Loss of main feedwater, AFW failure, failure of feed and bleed. cooling ---

1.4E-7 TEFC 13 Same as sequence 12 above, only this is the CCW portion of the rebaselined Zion Review sequence no. 4 of Table A.4 1.0E-7 ---

SEC 14 Interfacing systems LOCA 1.0E-7 1.1E-7 V i

15 Failure of dc Bus 112, causing loss of one PORV and loss of ac Bus 148, failure of AFW 5.0E-8 ---

TEFC Total 1.5E-4 3.2E-5

• Not identified or provided as dominant sequences.

(

l

Table A.6 Review of Accident Analyses for Zion Nuclear Plant MARCH-CORRAL-CRAC Analysis Raseline Detalled Calculations 5ARRP JP55 Review'.e leeC't IDCOR' 2P55 5 (5NL. RNt) RelL3 '

10 Colt SARP DNL - Rebateline

Sequence Sequence Sequence Secuence Sequence Sequence Sequeace seqsence Analyzed Analyred Analyred Analysed Analyred Analyred*

Analysed Analysed 1-5t F C 1-5f f C (TMLR') (TMLR's) ll-SE (IMtR*y.e) 1-SLF C 2-5E 7-SE (IMtR*-c)'. 2-5E l-St F C 3-ALFC seal ttWA. <enteinaent 3-AL F C 3-5t F C bysiass. nr (5,D n-scal 4-ALFC 4-ALFC 4-5F C g

10CA) 5- ANS. FW loss 5-5tf (5,0) (5,0.) 5-1F F C 2-5E (5,f1C,) seal 10CA '

8 l-SIFC ($ 20. seal LOCA) 6-1(C

<-50 (TMtR*-41'. 8 6-ATWS. Turb loss 6-5t F C (S yR) seat LnCA oc (520-seal 2-5E y (5t IICirF tr1) seal 10CA ' 7-TEFC (S iR+one spray) 7-5LFC

• 7-stFC LOCA) 2-5E (5,n(tr#1r?) seal torAss (S iR+ flooded cavity) 8-5LC 8-5LC 8-SE 9-AffC 9-AEFC 9-ALF (5 gB+ break stre)

(TMt8's) 10 AEFC 10-AFIC 10-ALF (TMtB')

14-It (In n'- al .l lo Atst (5,n-.)' 4-5EC (TMIR*i) 11-if C ll-5E (TMLR*-flooded cavity) (TMLB'82 ) ll-TEC coLMA 14-if (fMta')-e' l 12-TEC 12- AE FC 12-TEC 14-IF (IMH)-y

• TEIC (TMLR' 8) 13-it FC (TMLR'+ basalt concrete) 13-ilt 13-if t 14-TE (TMLR')

14-TE (TMLB') 14-itFC ( TMLB' + sand )

15-1F F C 15-V 15-if fC 15-v 16-VL y 14-VL'. 16-VL (TMLR'+ spray) 17-AE (TML)

(TMLQ) 18-5LF y (5 gNF) (5,HF) 3' 4-5LF (5,H4) 1-5t FC (%,Hs)' (51MFI fan fallvee) 9-ALF (AH) 3-At FC( AH4)'.

IF-AEFC (ao) 4 AtFC (Awal'

A-73

. Table A.7 Comparison of Early Containment Failure Probability with Other Studies 5th 95th Median Mean Zionli .

(Revised 12/8/86) 1.0X10 0.17 .01 .04 Surry18 1.5x10-2 0.50 0.1 0.2 RSS* - - -

0.2 IDCOR* - - -

5x10-3 s-

• Data from the Surry Report.20

'i i

i 1

I I

4 8

4 1

L 4

1

,o i Table A.8 Results of the Integrated Analysis of Accident Process and Fission Product Transport Zion Core Start of Time of Time of Maximal Uncovery Core RPV Containment Fraction of Containment Time Melt Failure Failure Cladding Pressure Sequence * (hrs) (hrs) (hrs) (hrs) Reacted (psi) - (hrs) 3.8 0 NR NR NR

1. 2-SE (TMLB')-8 1 I" 2.2 2.9 (seal LOCA) - 1DCOR 1.08 1.57 2.22 24.0 0.47 149.0 24.0

2. 2-SE (S 2DC )10 (sealLOCAf-SARP a 3.8 32 0.153 149.0 32.0 2-SE (TMLB')-6 .1" 2.2 3.0 1

l (seal LOCA) - IDCOR 1.08 1.57 2.21 2.22 0.47 149.0 2.22

, 3. 2-SEy (52DC jpFir 1)l0

) (seal LOCA) - SARP I

4. 2-SE (S2DC ir fir 2)l0 1.08 1.57 2.21 14.93 0.47 149.0 14.93 {*

(seal LOCA) - SARP a 1 1" 2.2 3.1 4.0 32.0 0.143 149.0 32.0

5. 14-TE (TMLB' )-6 (no seal LOCA) - IDCOR 9 1.83 2.18 2.83 NCF(10h) 0.51 114.1 16.7

6. 14-TE (TMLB')-c - SARP 14-TE (TMLU)-y l0 - SARP 2.08 2.47 3.16 3.16 0.52 149.0 3.16 7.

0 NR NR NR 8, 16-VL I .1" - IDCOR -24 -24 26 a

13.9 NCF 0.655 34.0 13.9 1-SLFC (S2 H)-6 1" - IDCOR -7.2 1 12 i 9. a 0.8 1.7 2.3 NCF 0.486 34.0 3.5 3-ALFC (AH)-6 1" - IDCOR 3

10.

1.89 2.51 3.13 NCF(10h) 0.85 25.4 3.13

11. 10-AEFC (52 0)-c9 - IDCOR f

• Symbols are defined in Table A.2.

NCF = No containment failure.

NR = Not reported in Ref. 1.

aCalculated from amount of H2 at RPV failure, given in Ref.14.

. -. -. - --- . -- -. . . _ . ~. .. --. . . . ~ . - . - - . - . . _- . - . .

~"

Table A.9 SARP IDCOR Calculated Source Terms Time of Duration

• Release' of Release Fractional Release Reference Sequencewww Puff' (hr) (hr) xe i Cs To Sr Ru La Ce Ba 1 24 0.5 0.98 2.9E-6 1.2E-5 1.2E-3 - 6.2 E-4 1.4E-8 3.4E-6 9E-6 SE j SARP IO Sg (seafLOCA) 2 25 3.0 0 0 4E-6 7.2 E-4 2.8E-4 1.4E-8 1.5E-6 4E-6 - 2.3E-4 IO 1 2.2 0.5 0.97 0.18 0.18 0.14 9.4E-5 1.1E-7 9.8E-9 0 2E-3 SARP S2 DC F 1 1

(sea!LkAb 2 3.5 5.5 0 -0.04 0.04 0.18 3.7E-2 ,1.7E-4 1.8E-3 6.4E-4 2.6E-2 1 15 0.5 0.97 0 .01 2 0 .01 2 0.077 4.2 E-3 2.8E-4 2 E-4 7.2 E-5 5.2 E-3

• i SARP 10 $2 DC F 2 (seabtb) 2 16 2.0 0 4E-3 4E-3 0.02 6 1.4E-3 9E-5 7E-5 2.6E-5 .IE-3 l

1 3.2 0.5 0.99 4.9E-3 5.4E-3 0.02 5 7.6E-5 1.3E-7 9.9E-9 0 1.4E-3 p gg 2 4.5 5.5 0 8E-4 IE-3 0 .01 5 1.8E-5 3E-7 3.8E-7 1.9E-8 4E-4 a

SARP3 1MLB'-c -

3.2 -

0.98 2.1 E-6 2.1E-6 8.4E-5 3.1E-5 5.9E-7 1.BE-6 1.8E-6 3.1E-5 SARP 9 SD -

NCF -

0.98 . 2.5E-8 2.3E-8 3.6E-8 . VS VS VS VS VS p' 2

M IDCORI "

l

! TM LB'- 6 -

32 -

0.98 1.7E-3 1.7E-3 2.0E-5 <1.0E-5 <1.0E-5 VS VS - <1.0E-5 on 1 (seal LOCA) 16 IDCOR TMLB'-6 -

32 -

0.98 1.7E 1.7E-3 2.0E-5 <l.0E-5 <1.0E-5 vs .VS <1.0E-5 ,

(no LOCA) i ,

IDCOR16 16-V L -

0 -

0.98 8.0E-5 .8.0E-5 .8.0E-5 VS VS VS VS VS i

j IDCORI " 1-SLFC - NCF - VS .VS VS VS VS VS VS . VS- VS '

IDCORI " 3-ALFC - NCF -

VS VS VS VS VS VS VS VS VS j IDCORl6 TMLB'-8 -

0 -

0.98 0 .01 0 . 01 3.0E-4 VS VS VS VS VS

(seal LOCA) t i *The distribution of f ractional releases between two puf f s and duration of release are reprinted f ram Ref.11.

l NCF = no containment f ailure, i VS = very small (negilgible) i I,

9 .

i j a .

• t' iegla V*IO 3yeJE31aJ{S)!35 oj )yO $onJ3a laaW etuS

$abnaU3a eup 3OUSP!uW002- $0nJ30 iaJW aluS sleanS I 2 E V S 9 L 8 6 10 II 12 lE lt IS 19 IL 18 16 3OU1ELUWa01 jettnJa dndinJa gaJOJa 30Ja wat4 /

/ / / / / / / /

3eJlK QaaJdJaSSnJa lela QAaJdJaSSnJa-dnd1nJa / /

/

lela 0AaJdJaS@naa-laene6a / /

Hat 4-lyJOnGy laeM OJ ISO [P1 LOU je![nJa / /

3ouletuWauq gKdeSS-SD1U /

3ouletumauJ gKdeSS-0JK /

ne jettnaa /

3OU1etUWaul $dJe4 SASlaW / /

)saa jrola {( 0daJelaS . . / . /

jeit S / / / - / / /

cc dJLWeJ4 $451aW dJaSSnJa

/ / / / 7

,u Ht 64 / /

HopaJela / /

loM 3OU1e[UWOU1 dJOSSnJa

/

)saa lala 2( Hl64 /

loM MelaJ V^elle9La 3x-AaSSat AaS

/ / / / / ' / / / /

NO QLJa31 HaelguG 311331 Noua / / / / -

s16ugJt3euq - / / / -/

/ - 1ya 3yeJe31aJlS1!3 tS Jabn) Jap JOJ 1ya q[U* ]yeJe31aJt51}3S 001 WeJ1Op eJa U01 palaJW[Ueuq oj 1ya qgu eup eut aoWqrueatou WeK edd iK*

- - 3tlyaJ OJ 1ya 3yeJe31aJgS1goS uolap qA )yt S SXWqot edd l A go 1ya qlu }u 3oWq}ue11ou Mtty 1ya oayaJS WeJ1ap /*

NOla {: 140 SdJPK bnaS1 LOU }S et SO padaupaul OU ))W)U6* 3Jt1[3et ])WajJeWBS eJO p} jjaJa01 )0J pljjaJaul q!uS-jgla 2: 1y!S JS outA nSap eS e p[S3J)W)uelOJ JOJ Q)US ((' tup {)* )Q A[ 0nSLA' 3OU]e)UWaU1 dJOSSnJO

)S y}64 JU WEUA 01yaJ q{US eup 1yaSa eJa 001 3ya31ap*

k

Table A.11 Results of Source Term Calculations Release Traction By Group a D Release Warning Eleva- 1 2 3 4 5 6- 7 8 9

Time Dur. Time tion Energy i Bin (hr) (br) (br) (m) BTU /hr KR-XE I CS TE SR RU LA CE BA 1 2.5 5. 0.5 10 2.+7 .88 .59 43 .40 5.1-2 4.5-3 1.4-2 3.3-3 5.9-2 1.21 1.19 i.22 1.21 14.9-2 18.5-3 !2.4-2 15.5-3 15.3-2 i 2 2.5 5. 0.5 10 8.46 .88 .23 .14 8.2-2 1.1-3 1.1-6 1,4-4 6.1-5 5.0-3 1.21 .051 1.07 16.4-2 tl.2-3 11.9-6 13.5-4 1.4-4 5.7-3

! 3 2.5 5. 0.5 10 2.+7 .88 9.1-2 3.6-2 .18 5.0-2 4.5-3 1.4-2 3.3-3 4.6-2 I i.21 16.1-2 14.2-2 .11 14.8-2 18.5-3 2.4-2 15.5-3 15.0-2 4 2.5 5. 0.5 10 8.46 .88 8.9-2 3.4-2 1.6-2 8.2-4 7.0-7 1.4-4 6.1-5 4.9-4

! t.21 16.1-2 14.2-2 12.6-2 tl.1-3 11.8-6 2.4-4 11.5-4 15.3-3 I

5 1.5 5. 1.0 10 1.+7 .88 .43 .37 .36 5.1-2 4.5-3 1.4-2 3.3-3 6.0-2 [

1.21 .18 1.18 .19 14.8-2 18.5-3 12.4-2 15.5-3 15.2-2 l

I i 6 2.5 5. 0.0 10 1.+7 .88 .12 8.8-2 .17 5.0-2 4.5-3 1.4-2 3.3-3 4.6-2 I t.21 t.08 t.10 .11 14.8-2 18.5-3 2.4-2 15.5-3 15.0-2 l 7 1.5 5. . 0.0 10 1.+5 88 8.9-2 3.4-2 1.6-2 4.1-4 8.1-7 8.3-5 3.0-5 6.9-4

i.21 16.1-2 14.2-2 12.6-2 18.5-4 13.1-6 13.0-4 11.0-4 11.1-3 i

j 8 8.0 1. 6.0 10 1.46 88 5.3-2 9.6-3 1.3-3 3.9-4 7.9-7 8.3-5 3.0-5 2.2-4 i 1.21 13.8-2 11.7-2 11.4-3 t8.5-4 13.1-6 13.0-4 11.0-4 t1,1-3 9 15.0 1. 12.0 10 1.46 .88 .18 .13 .14 1.1-2 1.8-3 2.9-3 6.1-4 1.2-2 l 1.21 1.12 .13 .13 11.5-2 14.8-3 16.8-3 11.4-3 il.5-2 1

i 10 2.5 5. 0.5 10 2.+5 .88 .18 .13 5.7-2 2.3-3 3.9-4 6.0-4 1. 3-4 4.4-3 l 1.21 1.12 .13 15.7-2 t2.5-3 t9.7-4 11.3-3 12.6-4 14.8-3

! a. Late iodine and revolatilization releases are included.

b. Revolitized Cs release is included.

i

.4,

.v.

Table A.11 (Cont'd) Results of Source Term Calculations Release Fraction By Group a b 6 7 8 9 Warning Eleva- ' l' 2 3 4 5 Release Time Dur. Time tion Energy I CS TE SR RU LA . CE 8A Bin (hr) (br) (hr) (m) BTU /hr KR-XE 11 2.0 5. 1.0 0 3.+6 .88 .13 6.2-2 6.0-2 1.1-2 6.9-4 2.2-3 5.6-4 1.1-2

.21 t.17 .15 17.9-2 tl.9-2 12.7-3' 27.7-3 21.8-3 11.9-2 2.0 5. 1.0 0 3.+6 .88 42 .27 .18 2.5-2 4.9-3* 6.0-3 1.5-3 2. 9-2 12 ~

i.21 1.19 .18 r.132 12.9-2 14.6-3 11.3-2 13.0-3 13.1-2 0 .88 2.1-5 2.1-5 3.9-5 '4.1-6 7.5-7 1.2-6 2.4-7 4.6-6 13 24.0 1. 22.0 0

.21 12.0-5 t2.0-5 13.3-5 t4.8-6 11.8-6 ' 12.5-6 4. 9- 7 15.2-6 24.0 1. 22.0 0 0 .88 2.8-6 2.9-6 2.6-6 1.4-7 2.7-10 2. 8-8 1.0-8 2.0-7 14

.21 4.1-6 4.2-6 13.9-6 21.9-7 17.0-10 16.8-8 2.2-8 23.3-7 0 .88 2. 8-6 2.9-6 2.6-6 1.4-7 2.7-10 2.8-8 1.0-8 2.0-7 $

24.0 1. 22.0 10 14.1-6 14.1-6 13.3-6 11.9-7 17.0-10 16.8-8 i2.2-8 13.3-7 15 i.21 2.+7 .95 .65 .49 .51 8.2-2 .10 2.8-2 3.7-3 9.1-2 16 1.5 5. 0.5 10 22.0-2 13.1-3 15.2-2 t .09 .14 1.19 1.13 15.0-2 i .12

.93 .28 .19 .23 4.4-2 7.3-2 1.6-2 1.7-3 4.7-2 17 1.5 5. 0.5 10 8.+6 11.2-3 13.1-2 1.22 .07 1.08 1.07 13.1-2 18.5-2 il.2-2 2.+7 .92 .12 7.0-2 .23 6.6-2 5.5-2 2.0-2 3.5-3 .6.3-2 18 2.5 5. 0.5 10 14.3-2 16.0-2 2.0-2 14.1-a UE+00 2.15 2.08 6.9-2 1.11 0.5 8.+ 6 .92 .12 6.6-2 6.0-2 1.3-2 1.9-2 5.6-3 6.2-4 1.3-2 2.5 5. 10 19 t.15 1.08 16.6-2 23.4-2 t8.5-3 12.0-2' 15.5-3 15.7-4 18.2-3 I

a. Late iodine and revolatilization releases are included.

b. Revolitized Cs release is included. .

9

. ~

A-79 Table A.12 NRC/IDCOR Issues Issue Subject 1

Fission Product Release Prior to Vessel Falure 2 Recirculation of Coolant in Reactor Vessel 3 Release Model of Control Rod Materials 4 Fission Product and Aerosol Retention in the Primary Systen 5 In-vessel H Generation 6 Core Slump,2 Core Collapse, and Reactor Vessel Failure 7 Containment Failure due to In-vessel Steam Explosions 8 Direct Heating of Containment 9 Ex-vessel Fission Product Release 10 Ex-vessel ~ Heat TFhn's' fey'Model from'Mollen Core to Concrete 11 Revaporization of Fission Products from the Primary System 12 Fission Product Deposition Model in Containment 13A Suppression Pool Bypass (Pool Scrubbing) 13B Retention of Fission Products in Ice Beds 14 Modeling of Emergency Response 15 Containment Performance 16 Secondary Containment Performance 17 Hydrogen Ignition and Burning 18 Essential Equipment Performance

w .

A-80 Table A.13 List of Symbols for Reactor Accidents A Intermediate to large LOCA.

8 Failure of electric power to ESF's.

B' Failure to recover either onsite or offsite electric power within about 1 to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> following an initiating transient which is a loss of offsite ac power, Tg.

D Failure of the emergency core cooling injection system.

F Failure of the containment spray recirculation system.

Ft,F2,F3 Different variants of F.

H Failure of the emergency core cooling recirculation system.

L Failure of the secondary system stean relief valves and the auxiliary feedwater system.

M Failure of the secondary system steam relief valves and the power conversion system.

53 A small LOCA with an equivalent diameter of about 2-6 inches.

53 A small LOCA with an equivalent diameter of 1/2-2 inches.

S3 Small accident with an equivalent diameter 0.75 inch = pump seal LOCA.

SGTR Steam generator tube rupture.

T Transient event.

T 23 Transient event other than i t = transient from loss of offsite power.

U Chemical and volume control systen.

V LPIS check valve failure.

W Failure to remove residual core heat. -

a Containment rupture due to a reactor vessel steam explosion.

8 Containment failure resulting fron inadequate isolation of con-tainment openings and penetrations, y Containnent failure due to hydrogen burning.

6 Containment failure due to overpressure.

c Containment vessel melt-through.

6 Water present in cavity at RPV failure time.

d

Table A.14 Risk Results from the SARRP Rebaselining Report Compared to Previous Studies Index RSS BNL 7

(Per Year) Mean Median 5% 95% (Surry) ZPSS5 Review IDCOR I

1. Early Deaths 2.3-4 6.5-5 3.5-6 8.3-4 4.-5 1.1-5 6.5-5 0.0

2. Early Illness, 5.4-4 1.6-4 1.605 1.9-3 --

2.8-4 3.5-3 --

3. Cancer Deaths 3.9-2 1.7-2 3.0-3 1.2-1 3.-2 3.6-3 1.6-2 1.6-5 4 Off-site Costs 1.5+4 6.5+3 8. *-

4.3+4 --

--t -- --

5. Population Dose 8.4+1 4.5+1 7.3+0 2.3+2 1.5+1 2.2+2 3,

.31 g, i

e