ML21256A017

Using Operational Experience to Support Dynamic PRA Activities

ML21256A017
Person / Time
Issue date:	09/10/2021
From:	Michelle Gonzalez, Nathan Siu NRC/RES/DRA/PRAB
To:
Gonzalez, Michelle - 301 415 5661
References
Download: ML21256A017 (10)

Text

Using Operational Experience to S upport Dynamic PRA Activities

Michelle Gonzalez, Nathan Siu

U.S Nuclear Regulatory Commission

Corresponding Address

Michelle.Gonzalez@nrc.gov

[Digital Object Identifier (DOI) placeholder ]

ABSTRACT

Over the years, Dynamic PRA (DPRA) has been advocated on largely theoretical grounds as a potentially useful supplement to commonly used event tree/fault tree methods. However, there has been only limited formal investigation of dynamics observed during actual operating events that might be important to consider in a decision-support use of DPRA. This paper describe s the status and preliminary results of an exploratory study that reviews a small number of past incidents to identify important dynamic behaviors.

Key Words: dynamic PRA, event assessment, accident sequence precursor program

1 INTRODUCTION

Dynamic methodologies have long been advocated as a means for addressing system dynamic behaviors and interactions (e.g., [1-4]). However, the arguments are generally theory-based. When it comes to dynamic behaviors seen in actual incidents and accidents, the literature tends to provide only shorthand references, e.g., to the timing of failures and interventions at Three Mile Island (TMI) [1], or to the operator error of commission during that same accident [3]. Coyne and Mosleh [ 5] provide a rare exception to this tendency in their description of specific drivers to the TMI error and their analysis of a complicated transient at the H.B. Robinson Steam Electric Plant.

First-principles approaches, of course, provide a necessary, sound technical basis for the treatment of dynamics. However, also of course, such approaches can benefit from benchmarks provided by empirical data, e.g., observations from actual reactor incidents and accidents. In particular, such benchmarks can support DPRA developers in their consideration of phenomena to be addressed by their models and tools and can be informative to potential users of DPRA technologies in their evaluations of current DPRA activities and planning for future developments.

1.1 Objectives and Scope The objectives of this paper are to describe the status and current results of a limited scope, exploratory, qualitative study that: a) reviews a number of past nuclear power plant reactor incidents for important dynamic behaviors during the incidents, and b) considers if and how a DPRA might improve on conventional PRA treatments of such features.

Due to its limited scope, the study does not address the heavily documented and highly complex nuclear power plant accidents at TMI, Chernobyl, or Fukushima Daiichi (although of course these accidents involved many critical dynamic behaviors).0F1 Most of the events addressed involved nuclear power plants.

However, the study does include one accident at a test reactor, as the lessons from this accident might be relevant to the analysis of new or novel reactor designs.

Also due to scope limitations, the authors have relied upon readily available reports; an exhaustive search for additional event reports was not conducted.

Finally, it should be emphasized that the purpose of this study is not to perform 20-20 hindsight fault finding of decisions and actions taken in the past. Our sole purpose is to identify and discuss observed types of behaviors that might warrant inclusion in a DPRA.

1.2 Approach This study involved the review of available information for: (1) a 1999 flood at Blayais, (2) a 1989 turbine oil fire at Vandellos, (3) a 2020 extended loss of offsite power at Duane Arnold, (4) a 1985 loss of main feedwater at Davis-Besse, and, (5) a 1959 fuel melting accident at the Sodium Reactor Experiment.

These events were selected from a wide range of possible candidates based on the authors judgment and the availability of sufficiently detailed reports.

For each incident/accident, the review focused on identifying and characterizing broadly defined system elements and their interactions, th e latter causing motions (in state space) of these elements. For instance, for the Blayais event, the system elements included the external environment, the local environment, the network (power and transportation) connecting the plant to the outside, the operators, the plant st aff, and offsite organizations, as well as the plant.1F2 With such definitions of elements, definition of the interactions was usually (but not always) straightforward, as further discussed in Section 2.

By focusing on elements and interactions (and not just on time dependence), we hope this approach adds some clarity to the t reatment of dynamics (as opposed to kinematics) in PRA. We recognize that the focus on interactions emphasizes an event -based view of system evolution, and that additional dynamic behaviors (e.g., changes in individual system element states due to internal laws) usually need to be considered in an actual DPRA. Our aim is not to guide how a DPRA should be performed, but to suggest classes of behaviors that should be considered when performing a DPRA.

2 EVENT ANALYSIS

Due to paper length limitat ions, detailed information (including a timeline of key events and a list of notable dynamic interactions) will be presented only for the Blayais flooding event. Detailed information for the remaining events will be provided in the project final report.

2.1 Blayais Flooding Event (1999) 2.1.1 Event Description The Blayais Nuclear Power Plant is a four -unit pressurized water reactor located on the Gironde estuary on the west coast of France. The flooding event discussed below, which is now considered by

1 Note that one of the authors has participated in PRA -oriented reviews of a number of past events, including the reactor accidents

at Fukushima Dai-ichi. However, those reviews were not specifically aimed at identifying and characterizing important dynamics.

2 This decomposition is useful for the purpose of our discussion but of course is not unique. The different elements can be

aggregated or sub-divided, depending on the needs of the analysis.

many to be a precursor to the 2011 Fukushima reactor accidents, is heavily documented (e.g., [6,7] ). Non-public reports from the International Atomic Energy Agency (IAEA) Incident Reporting System (IRS) and the Institute of Nuclear Plant Operations (INPO) are also insightful.

On the evening of December 27, Le Blayaiswas struck by a severe winter storm. Units 1, 2, and 4 were operating at full power; Unit 3 was shut down for refueling. Storm winds caused grid instabilities and loss of offsite power to Units 2 and 4. (The emergency diesel generators for these units started and supplied power as designed.) The combination of wind-driven waves, storm surge, and high tide was beyond the plants design basis. Flood waters damaged the dike, failed internal barriers and enteredUnits 1 and 2. The flood submerged the Unit 1 Train A essential service water system (ESWS) pumps (thereby degrading the units ultimate heat sink), and entered the rooms containing Unit 1 and Unit 2 low -head safety injection and containment spray pumps. These pumps were declared inoperable.

The plants execution of its emergency plan was delayed by the inability of offsite personnel to reach the plant. With the agreement of external technical experts (from both Electricit é de France -EDF - and the Insti tut de Protection et de Sûreté Nucléaire-IPSN ), the plant developed and implemented a shutdown strategy that accounted for potential additional equipment losses, as well as the losses already experienced. The strategy was informed by a real -time risk assessment that considered a variety of scenarios. Units 1 and 2 reached safe shutdown conditions by late morning December 28. Post-flooding actions (including pumping out flood waters and restoring equipment) were completed by January4.

2.1.2 Event Dynamics A timeline of key events is shown in Figure 1.

Figure 1. Timeline for Blayais Flooding Event To discuss the event dynamics its convenient to distinguish six system elements: the plants external environment, the local environment, the plants network connections (power, transportation) with the outside, the plant itself, the plant staff (including the operators), and the offsite organizations.2F3 Table I provides a list of selected interactions between these elements and their timing. ( The complete list of interactions will be providedin the final project report.)

3 Alternative decompositions could break the external environ ment into the storm and the estuary, the plant into the four units, the plant staff into control room and field operators, and/or the offsite organizations into the utility, the regulator, and the regulator s Technical Support Organization (TSO).

Table I. Selection of Dynamic Interactions During Blayais Flooding Event

No. Time* Element 1 Element 2 Interaction 1 0:00 Ext. Env. Network High winds down trees, damage power lines 3 0:30 Ext. Env. Loc. Env. Storm driven waves on top of storm surge and high tide overtop dyke, flood site 4 2:00 Ext. Env. Network High winds cause grid instability 5 2:00 Network Plant Grid instability leads to loss of 400 kV power to Units 2 and 4, reactor scram, EDGs start and load 6 2:30 Loc. Env. Plant Site flooding leads to partial loss of Unit 1 ESWS, loss of Unit 1 and Unit 2 LHSI and CSS 7 2:30 Plant Staff Plant Unit 2 400 kV is restored 8 3:00 Ext. Env. Plant Staff High water level alarm received by Unit 4 9 3:00 Plant Staff High water alert not passed on to other units 10 4:20 Plant Staff Plant Unit 4 400 kV is restored 14 7:50 Plant Staff Arrival of offsite personnel allows activation of Level 1 Emergency Plan 20 14:00 Plant Staff Offsite Orgs. Level 2 Emergency Plan activated for Unit 1; national emergency teams activated, discuss proposed shutdown strategy considering possibility of additional failures and Y2K complications

• Approximate (hh:mm), starting from 12.27, 19:00

Table I illustrates several types of element interactions that the Blayais event suggests for consideration in a detailed dynamic analysis of a severe flooding event. Each interaction represents a change in overall system state, which then establishes the conditions that affect the likelihood and impact of future interactions. For example, Interaction #5, the loss of power to Unit 4, apparently played a role in Interaction #9, the failure of Unit 4 staff to notify other units of the high-water level alarm. (Note that in our decomposition, which does not distinguish between the different crews of the different units, the interaction is internal to the element Plant Staff.)

Other interactions of particular note include: a) Interactions #3 (site flooding) and #14 (activation of the Level 1 Emergency Plan) -the latter was delayed until the flood waters receded and site access was regained -and b) Interaction #20 (multi -organizational agreement on a situation-specific safe shutdown strategy).

2.1.3 Commentary Table I and Figure 1 show that some of the interactions occurred over a time scale of a few hours, others over the course of several hours, and still others over a few days. This information can be important when de veloping a detailed dynamic model.

Note also that a simple, game over PRA model, conventional or dynamic, which simply assumes that should site flooding occur, all equipment below the maximum flooding elevation is irretrievably lost, might be adequate when only a bounding analysis is needed. However, such a model is not realistic and may not suffice for such purposes as supporting the development of procedures and training to deal with real floods.

2.2 Vandellos Turbine Fire (1989) 2.2.1 Event Description The Vandellos nuclear power plant was a gas cooled, natural uranium fueled, graphite moderated reactor located 140 km South of Barcelona, Spain. As described by Nowlen et al. [8], on October 19, 1989, while the reactor was operating at 80% power, a series of events occurred as the result of Turbine No. 2 ejecting 36 blades. Because of the detection of unusual vibrations, the alarms for turbine trip annunciation and the observation of fire in the turbine hall, t he control room operators immediately acknowledged the unusual event, tripped the reactor,and alerted the local fire brigadeone minute after blade ejection.

The ejected blades severed a pipe, spilling 4500 liters of lubricating oil in 55 seconds. Burning hydrogen ignited the lubricating oil. The burni ng oil falling down from the severed pipe damaged circulating water system expansion joints, spilling significant amounts of sea water that then collected in the basement of the turbine building, with the burning oil spreading on top of the water. The water also entered the reactor building through an open door, reaching a depth of approximately 81 cm in both the reactor building and turbine building. Sump pumps did not activate due to cable failure, impeding the removal of water from these areas.

Ten minutes after the incident started, the turbo blowers and feedwater pumps for the heat exchangers failed due to cable failure related to the fire.

After two hours, operators were able to regain auxiliary feedwater flow to the main heat exchangers by manually adjusting the flow control valves located at the reactor building that was filled with smoke.

Six hours after the turbine blade failure, the fire was completely extinguished. In 1990, f ollowing this incident, the Vandellos nuclear power plant permanentlyshut down.

2.2.2 Event D ynamics When analyzing the Vandellos event, the following system elements were identified: plant components (e.g, turbine, pipe, turbo blower, valves), internal hazard sources (hydrogen, lubricating oil, sea water), and the plant staff.

This incident presented a number of hazard scenarios developing at the same time. In particular, one plant failure ( turbine blade ejection) led to a series of additional failures (pipe failure leading to the spilling of l arge amounts of oil, a fire that spread out on top of the oil, and a flood resulting from damage to expansion joints caused by the burning oil), all failures happening in the first 10 min utes of the event. In parallel with these events, operators were taking action to control the fire and to control the plant.

2.2.3 Commentary As indicated above, a major modeling challenge indicated by this scenario is the rapid, parall el development of multiple hazard scenarios. DPRA provides a natural framework for treating these scenarios.

Of course, a high -fidelity model would have to deal with phenomenological complexities (e.g., the cascading of burning oil down to lower portions of the Turbine Building, and the movement of that oil on top of flowing sea water). Without passing judgment as to whether and when such fidelity is needed (clearly a function of the decision problem at hand), we observe that these complexities are real, do not appear to be unique to the Vandellos design, and could warrant developer attention.

2.3 Duane ArnoldLoss of Offsite Power Event( 2020) 2.3.1 Event Description The NextEra Energy Duane Arnold Energy Center is a boiling water reactor, with a Mark 1 containment, located in Iowa. On August 10, 2020, the plant experienced a loss of offsite power (LOOP) due to extreme high winds (exceeding 80 mph) caused by a severe storm (a derecho). The high winds caused damage to all 6 offsite power sources. The LOOP caused a generator trip and automatic reactor scram.

Emergency diesel generators (EDGs) provided power to the safety-related buses. Both recirculating pumps tripped when power was lost to their associated non-safety related electrical busses [9]. Following operating procedures, the operators were able to initiate shutdown cooling.

Due to the high winds, debris clogged the Tr a i n B Emergency Service Water (ESW) strainer and decreased the ESW flow to EDG B. Operators had to bypass the B strainer and declare the EDG inoperable.

Operators were able to restore offsite power to the safety busses approximately 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> after the LOOP event.

Although the incident did not involve damage to the safety systems, the high winds caused minor damage to the Reactor, Turbine and FLEX Buildings, along with more severe damage to the non-safety-related cooling towers [10]. On the day after the event, a small cut was discovered on a wall of the Reactor Building as a result of the high winds.

2.3.2 Event Dynamics The key elements identified for this event were: (1) the external environment (storm), (2) the plant staff, (3) the offsite network ( offsite power) and (4) the plant components ( EDGs, MSIVs, strainers).

During the course of the external event, the staff fac ed additional challenges, like the long duration LOOP (+24hrs) and the damage to plant structures (FLEX Building and Turbine Building). Operators completed various actions to bypass the strainers, align the main steam-line drain (MSIVs had failed open) and recover offsite power.

2.3.3 Commentary From a PRA perspective, this event appears to be a straightforward LOOP with an unavailable EDG and can be treated using conventional tools with few qualms. However, it should be noted that had the storm damage been more severe, plant staff actions to restore offsite power and/or EDG B, or to employ portable equipment if needed, could have been more challenged and a dy namic analysis considering available options, resources, and time might provide useful insights. We also note that as illustrated by Hurricane Andrews effect on Turkey Point in 1992, a more slowly moving storm could create a prolonged, hazardous onsite environment that would inhibit early actions [1 1].

2.4 Davis-Besse Loss of Main Feedwater Event ( 1985) 2.4.1 Event Description The Davis-Besse Nuclear Power plant is a Babcock and Wilcox, dry, ambient pressure containment, pressurized water reactor located in Ottawa County, Ohio. As discussed in NUREG-1154 [12], on June 9, 1985, the plant suffered a partial loss of feedwater when one of the two main feed water pumps tripped while operating at 90% power. A loss of all feedwater occurred following a reactor trip.

When the event was developing, the shift supervisor noticed that the main feedwater flow was decreasing and that one of the pumps had tripped. Other operators also noticed the winding down sound of the feedwater pump turbine and addressed the issue by manually increasing the speed of the second main feedwater pump to compensate for the decrease in feedwater flow. Operators were also reducing reactor power by inserting control rods. Operators followed immediate post-trip actions as specified in the emergency procedures.

In an attempt to actuate the Auxiliary Feedwater (AFW) System (to prevent steam generator dry out),

an operator proceeded to manually trip the Steam Feedwater Rupture Control System (SFRCS), but accidentally pushed the wrong two buttons, isolating the steam generators from the AFW supply. Operators proceeded to complete a series of actions to take corrective actions under a very high stress environment after losing all feedwater, watching the reactor pressure and temperature increasing and other concurrent failures (AFW turbine 1 and 2 trip ). Operators were directed to restore AFW p umps to service; place feed pump in service and open AFW containment isolation valves. It took the operators approximately 30 minutes to get the plant to a stable state.

2.4.2 Event Dynamics When analyzing the Davis Besse loss of main feedwater event, the following system elements were identified: (1) the plant components ( e.g.,feedwater pump, turbine, valves) and (2) plant staff.

Operators were able to react immediately to the plant input (loud noise from the feedwater pump turbine, and low flow notifications) following the plant operating procedures. There were many plant failuresoccurring concurrently ( e.g., feed water pump trip, SFRCS system trip, AFW turbine trip), and the plant staff was able to react accordingly to bring the plant back to a safe stable state. Even though that one of the operators performed an incorrect action (error of commission that isolated the steam generators), the team was able to recover after completing additional remedial actions. It is noteworthy to highlight the fact that these operators were performing these tasks under high levels of stress (operators had to run down stairs, at some point throwing the keys in the air to unlock the AFW pump room as quickly as possible, manually adjust valves, etc.) [12].

2.4.3 Commentary When analyzing the dynamic interactions of this event, it is important to pay attention to the complexity of the actions taken to recover the plant, operators needing to complete a series of steps in a matter of minutes adding to the high stress factor. After a number of failures occurred in less than 30 minutes operators were ableto get the plant to a stable state. The error of commission in this incident (pushing the wrong buttonthat isolated the steam generators) played a big role in the event progression.

Not that it would be simple, but the use of a dyna mic approach c ould facilitate the analysis of the human actions and the effects of the operator error of commission by combining or integrating different models for operating crew behavior and plant hardware.

2.5 Sodium Reactor Experiment Event (1959) 2.5.1 Event Description The Sodium Reactor Experiment (SRE) was a 20 MW test reactor operated from 1957 to 1964 at the Santa Susana Field Laboratory, some 30 miles northwest of downtown Los Angeles. The reactor used 2.7%

enriched uranium metal fuel in stainless steel tu bes (with NaK bonding between the fuel and cladding) and was cooled by liquid sodium. The purpose of the reactor was to test different fuel materials and the use of sodium as a coolant. An overview of the 1959 accident is provided by Pickard [13]. Lochbaum [14,15 ]

provides additional detail, including a n accident chronology. ]3F4

During test runs in early 1959, operators noticed higher than expected temperatures in some fuel channels. Despite various activities (e.g., to clean fuel bundles ), temperatures remained higher than expected. On July 13, the reactor was shutdown due to a reactivity excursion caused by sodium boiling and re-flooding. Operations were continued through July 14-26 to identify the reasons for the unexpected temperature and flow readings. This operation (during which workers apparently ignored a number of power excursion warning signals) resulted in cladding failures and partial fuel melting in 13 of the reactors 43 fuel bundles, release of fission products into the sodium coolant, and venting to the atmosphere.

4 Although Ref. 14 is a blog entry, we note that the author was a member of the Santa Susana Field Laboratory Advisory Panel (see https://www.ssflpanel.org/) and that his more formal report (Ref.15) cites numerous formal accident investigation reports.

After reactor shutdown on July 26, post-accident investigation found that: a) most fuel damage probably occurred during July 22-24; b) coolant channels had been blocked by tetralin (a reactor coolant pump - RCP - organic coolant) leakage into the primary system, c) the high fuel temperatures in the blocked channels led to the formation of a low melting point alloy between the stainless steel cladding and the fuel, d) this formation caused local fuel melting and cladding failure, and e ) cladding failure allowed release of gaseous and volatile fission products into the coolant.

2.5.2 Event Dynamics For this event, although it might be instructive to distinguish between the fuel, control rods, coolant, and tetralin contaminant, for the purpose of this paper we choose to lump these elements together under the generic banner of plant and focus on the interactions between the plant and the operating staff. 4F5 That there are interesting dynamic interactions between the operators and the plant is not surprising. What is of interest is the specific nature of these interactions.

1) In the case of the SRE accident, the plant operators had many opportunities to stop the flow of events. That they did not stop it appears to be attributable in part to their past experience. Per Ref.

[13], based on earlier operations, the operators recognized that tetralin in-leakage would degrade heat transfer, and so took mitigative actions to try to remove the tetralin. However, they did not think of coolant blockage by contaminants. Per Ref. [14], presumably based on past problems with instrumentation and power sources, the operators discounted high temperature readings and rapid power rise scrams.

2) Considering the early reactor operations that influenced operator thinking, the event unfolded over late December 1958 through July 1959, i.e., a time period of months. Even considering the activities leading to fuel damage, events probably occurred over the period July 12-26, i.e., a time scale of weeks.

It is interesting to n ote that Ref. [13 ] characterizes the continued operation at high power in late July as a means to find the reason for unexpected temperature and flow readings. This is analogous to operator trouble-shooting actions taken during the 1975 fire at the Greifswald NPP (manipulation of switchgear to find intactcables and provide power ) which led to additional failures [16].

Note also that o ur aggregation of the fuel, cladding, and coolant into a single reactor element masks the internal reactor system dynamics during the accident, notably cladding failure due to: fuel channel blockage, subsequent fuel-clad interface heatup, and finally the formation of a low-melting-point iron-uranium alloy.

2.5.3 Commentary Conventional PRAs treat some aspects of prior reactor experience (notably equipment failures ) and can, in principle, capture operator views and biases during interviews supporting human reliability analysis, ( of course, we expect it would take a very clever interview to address and appropriately prioritize such things as the SRE flow blockage prior to its recognized occurrence.)

However, in general, a conventional analysis will not address chains of events well in advance of the initiating event, e.g., possible prior operation histories that establish different operator mindsets, in the

5 None of our reviewed sources address organizational or safety culture factors and so although the multiple reactor shutdowns

and rapid restarts indicate a potentially interesting area of exploration, we will refrain from speculating on these matters.

case of SRE, or different warning timings that enable preparations i n advance of the induced reactor transient in the case of Blayais.This is not to say that dynamic PRA will make such analyses simple -in fact, theyre likely to be extremely difficult. However, dynamic PRA provides a natural framework to discuss such issues and perhaps identify those that warrant some degree of consideration.

3 CONCLUSIONS

To date we have analyzed five nuclear events (Blayais flood, Vandellos fire, Duane Arnold LOOP, Davis Besse Loss of Main feedwater, and the fuel melting accident at the Sodium Reactor Experiment ).

With the analysis of these events, we have identified a number of interactions that : a) appeared to be important in the evolution of some significant incid ents, and b) appear ed to be amenable to direct treatment in a DPRA. These interactions include plant staff interactions ( staff reaction to a specific input s); plant interactions (e.g, ejected turbine blades damaging lubricating oil piping), internal hazards (e.g., fire, flooding) and external plant hazards (e.g, winds, flooding).

Similar to past exercises in deriving PRA lessons from reviews of operational events, we found that insights from this small -scale study indicate that the real-life behaviors and interactions identified by conducting a simplified dynamic analysis can point towards other failures and responses that could be modeled in a conventional PRA to more realistically reflect plant operation and operator response during severe accident conditions.

This work is a very small-scale exploratory study. The insights and results that have been presented in this paper are preliminary, insights regarding behaviors deserving consideration in DPRA might change as more events are reviewed. The authores expect to perform a dditional work, to (1) analyze other events and (2) address how the identified dynamic behaviors would be treated -if at all - in a conventional PRA.

4 REFERENCES

1. A. Amendola and G. Reina, Event sequences an d consequence spectrum: a methodology for probabilistic transient analysis, Nuclear Science and Engineering, 77, 297-315(1981).

2. J. Devooght and C. Smidts, Probabilistic reactor dynamics -I: The theory of continuous event trees, Nuclear Science and Engine ering, 111,229 -240, 1992.

3. N. Siu, " Dynamic approaches - issues and methods: an overview, Reliability and Safety Assessment of Dynamic Process Systems, T. Aldemir, N. Siu, A. Mosleh, P.C. Cacciabue, and B.G. G ktepe, eds.,

NATO ASI Series, Springer-Verlag, Berlin 1994.

4. T. Aldemir, Advanced Concepts in Nuclear Energy Risk Assessment and Management, World Scientific Publishing Co., New Jersey, 2018.

5. K. Coyne and A. Mosleh, Dynamic probabilistic risk assessment model validation and application -

experience with ADS-IDAC, Version 2.0, Advanced Concepts in Nuclear Energy Risk Assessment and Management, T. Aldemir, ed., World Scientific Publishing Co.,2018.

6. A. Gorbatchev, et al., Report on flooding of Le Blayais power plant on 27 December 1999, Proceedings of EUROSAFE 2000, Cologne, Germany, November 6 -7, 2000.

7. E. Vial, V. Rebour, and B. Perrin, Severe storm resulting in partial plant flooding in Le Blayais nuclear power plant, Proceedings of International Workshop on External Flooding Haz ards at Nuclear Power Plant Sites, Kalpakkam, Tamil Nadu, India, August 29 -September 2, 2005.

8. S.P. Nowlen, M. Kazarians, and F. Wyant, Risk Methods Insights Gained from Fire Incidents, NUREG/CR-6738, September 2001.

9. Notice of Unusual Event and Unit Trip Due to Loss of Offsite Power Due to High Winds - Duane Arnold, Licensee Event Report (LER) 2020 -001-01, September 2020.( ML20283A373)

10. Final ASP Analysis-Duane Arnold, U.S. Nuclear Regulatory Commission, March 2021.

(ML21056A382).

11. N. Siu, I. Gifford, Z. Wang, M. Carr, and J. Kanney, Qualitative PRA Insights from Operational Events: An Exploratory Study, U.S. Nuclear Regulatory Commission, 2021. ( ML21081A038)

12. Loss of Main and Auxiliary Feedwater Event at the DavisBesse Plant on June 9, 1985, NUREG -

1154, 1985. (ML063560434)

13. P. S. Pickard, Sodium Reactor Experiment Acc ident, July 1959, Sandia National Laboratories, August 29, 2009. (Available from:

https://www.etec.energy.gov/Library/Main/Pickard%20SRE%20presentation.pdf)

14. D.A. Lochbaum, Nuclear Plant Accidents: The Sodium Reactor Experiment, July 5, 2016.

(Available from https://allthingsnuclear.org/dlochbaum/nuclear-plant-accidents-sodium-reactor-experiment/)

15. D.A. Lochbaum, An Assessment of Potential Pathways for Release of Gaseous Radioactivity Following Fuel Damage During Run 14 at the Sodium Reactor Experiment, October 5, 2006.

(Available from http://www.ssflpanel.org/files/Lochbaum_SRE -Report.pdf)

16. M. Rwekamp and E. Gelfort, Sicherheitsrelevanter Kabeltrassenbrand im Kernkraftwerk Greifswald - Beschreibung und Einschtzung, GRS -V-SR 2449-1, Gesellschaft für Anlagen und Reaktorsicherheit (GRS) mbH, Kln, Germany, 2004.